From nobody Thu Aug 1 03:15:09 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5FF401200E3 for ; Thu, 1 Aug 2019 03:15:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.299 X-Spam-Level: X-Spam-Status: No, score=-4.299 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=swm.pp.se Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Wy6jDxazYPLv for ; Thu, 1 Aug 2019 03:15:05 -0700 (PDT) Received: from uplift.swm.pp.se (swm.pp.se [212.247.200.143]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5913B120096 for ; Thu, 1 Aug 2019 03:15:05 -0700 (PDT) Received: by uplift.swm.pp.se (Postfix, from userid 501) id EC6CBB0; Thu, 1 Aug 2019 12:15:01 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=swm.pp.se; s=mail; t=1564654501; bh=elAx9pTsjL5OJ0oEJ3xMAPao6mWA6ZlOpyddHTSuo8g=; h=Date:From:To:cc:Subject:In-Reply-To:References:From; b=E/tOeQAM7Su3BV6IsEz1uyROrQNG22nelUotzcTV2uR/1dNnikQkX6LtSDP58U7KP Tp7xjrkcmhaR0lGZCdWPzBWExx4gcqsFFg+q+kvfDtqGFhV3YfdTmqavHZKYVK15lq o1pQ9BlTI2Km9qb2d0xQ3dMFJMf1uZy16UyQX2S8= Received: from localhost (localhost [127.0.0.1]) by uplift.swm.pp.se (Postfix) with ESMTP id E8B4DAF; Thu, 1 Aug 2019 12:15:01 +0200 (CEST) Date: Thu, 1 Aug 2019 12:15:01 +0200 (CEST) From: Mikael Abrahamsson To: Alec Muffett cc: ADD Mailing list In-Reply-To: Message-ID: References: <112384FB-C68D-4308-8ED9-C0BBF615751D@frobbit.se> <1C02AB5B-D01E-49F6-86CE-BAEF4779E776@frobbit.se> <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> <64bcfc51-6f3d-ae24-4de5-d0eb89975c66@cs.tcd.ie> <539D6F9D-137C-4F68-A8DE-EA3DFAF4D827@huitema.net> User-Agent: Alpine 2.20 (DEB 67 2015-01-07) Organization: People's Front Against WWW MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII; format=flowed Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 01 Aug 2019 10:15:07 -0000 On Wed, 31 Jul 2019, Alec Muffett wrote: > On Wed, 31 Jul 2019, 14:02 Mikael Abrahamsson, wrote: > >> I feel we're back in the bad old days where a browser would just change >> what default browser I want to use, just because I happened to install >> that browser. Those kinds of policy choices are for me explicitly to make, >> not for the browser vendor to do for me. > > So, how do you feel about a coffee shop owner, ISP, or national government > doing the same thing to you? I decide what I feel about it when I connect. If I don't trust the network I am connecting to, I'm going to use a VPN to encrypt everything or I might not use that network at all. If I was at a hotel network I'd probably trust some quad-X provider more than the hotel network. If I am at home, I'd trust my ISP more. These are policy decisions I want to be able to make on a case by case basis. -- Mikael Abrahamsson email: swmike@swm.pp.se From nobody Thu Aug 1 03:25:36 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BD9B6120113 for ; Thu, 1 Aug 2019 03:25:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.299 X-Spam-Level: X-Spam-Status: No, score=-4.299 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=swm.pp.se Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CKP88Jmrtl_5 for ; Thu, 1 Aug 2019 03:25:32 -0700 (PDT) Received: from uplift.swm.pp.se (swm.pp.se [212.247.200.143]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 913EF120033 for ; Thu, 1 Aug 2019 03:25:32 -0700 (PDT) Received: by uplift.swm.pp.se (Postfix, from userid 501) id 6E658B0; Thu, 1 Aug 2019 12:25:30 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=swm.pp.se; s=mail; t=1564655130; bh=T9PgJymwqKJ3ZfkkCvISAUkSSbd50u/uiHQlUzaLhPw=; h=Date:From:To:cc:Subject:In-Reply-To:References:From; b=V+OLvW+IN9TxNK2iyi2sL3+avXRKd8HkAAdXahi2wm1ZwCG+wcDNCpcfDBD71gU96 cP/ocARFAVwqXHFKPGVnbLxK7jSRXcwf0D1R+1T9e+lBa4Y6GOFwUmI2G+9/1r698y FDIA3FZJHDHsfFG/HuKoExM4BdMmxMPqIsKv/xFs= Received: from localhost (localhost [127.0.0.1]) by uplift.swm.pp.se (Postfix) with ESMTP id 66226AF; Thu, 1 Aug 2019 12:25:30 +0200 (CEST) Date: Thu, 1 Aug 2019 12:25:30 +0200 (CEST) From: Mikael Abrahamsson To: Stephen Farrell cc: Ralf Weber , Paul Wouters , Alec Muffett , ADD Mailing list In-Reply-To: Message-ID: References: <1C02AB5B-D01E-49F6-86CE-BAEF4779E776@frobbit.se> <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> <64bcfc51-6f3d-ae24-4de5-d0eb89975c66@cs.tcd.ie> <539D6F9D-137C-4F68-A8DE-EA3DFAF4D827@huitema.net> <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> User-Agent: Alpine 2.20 (DEB 67 2015-01-07) Organization: People's Front Against WWW MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII; format=flowed Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 01 Aug 2019 10:25:34 -0000 On Wed, 31 Jul 2019, Stephen Farrell wrote: > In much of the discussion on this list, I see what I perceive as people > (on all "sides") frequently describing DNS setups in ways that seem > tailored to suit their argument and not reflect reality with any > fidelity. I don't find any conclusions based on such arguments at all > convincing TBH, no matter how frequently those may be asserted. > > And I have a hard time seeing any WG working on this topic being able to > make progress in the face of such dodgy arguments. You shouldn't see these as "dodgy arguments". It's just a reflection of very different realities that people live in. I travel between realities and there are cases where I want the system resolver to be used, and there are cases where I would want DoH to some quad-X provider to be used. There is no single right answer to this. In windows there is a popup after I connect to a new network, asking me whether this is "public" or "private". I guess this is an proxy for "do you trust this network and the devices that are on it?" and the answer if I choose public is "no". Security settings (firewall and perhaps more) are under the hood set accordingly. We're going to need similar settings here based on user input. I'd even think it was ok for the browser vendor to have sensible defaults per network type. Only the user knows who they trust in each case. We have to ask them. -- Mikael Abrahamsson email: swmike@swm.pp.se From nobody Thu Aug 1 04:11:57 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D6BB012015B for ; Thu, 1 Aug 2019 04:11:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ob2F3gOrMsWi for ; Thu, 1 Aug 2019 04:11:53 -0700 (PDT) Received: from smtp.guxx.net (nyx.guxx.net [85.10.208.173]) by ietfa.amsl.com (Postfix) with ESMTP id 747FA120125 for ; Thu, 1 Aug 2019 04:11:53 -0700 (PDT) Received: by nyx.guxx.net (Postfix, from userid 107) id E6D935F4223A; Thu, 1 Aug 2019 13:11:51 +0200 (CEST) Received: from [192.168.2.128] (p54B8A0E0.dip0.t-ipconnect.de [84.184.160.224]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by nyx.guxx.net (Postfix) with ESMTPSA id B3B935F421D6; Thu, 1 Aug 2019 13:11:50 +0200 (CEST) From: "Ralf Weber" To: "Stephen Farrell" Cc: "Paul Wouters" , "Alec Muffett" , "ADD Mailing list" , "Mikael Abrahamsson" Date: Thu, 01 Aug 2019 13:11:49 +0200 X-Mailer: MailMate (1.12.5r5635) Message-ID: In-Reply-To: References: <1C02AB5B-D01E-49F6-86CE-BAEF4779E776@frobbit.se> <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> <64bcfc51-6f3d-ae24-4de5-d0eb89975c66@cs.tcd.ie> <539D6F9D-137C-4F68-A8DE-EA3DFAF4D827@huitema.net> <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 01 Aug 2019 11:11:56 -0000 Moin! On 1 Aug 2019, at 0:02, Stephen Farrell wrote: > On 31/07/2019 22:29, Ralf Weber wrote: >> Long story short there is no reason for me > > It's fine that you conclude that. > >> or any other european > > That is incorrect. I do use CF's DoT and other DoT > services and occasionally CF's DoH. Some of that is > just playing about/testing, but my home ISP did have > an incident last year where their DNS went awol for > a weekend (seemingly related to the root key roll;-) > so I set my home router to use CF's DoT. I've not > bothered to reset it since as my view of the choice > is between two for-profit foreign-owned companies > and in fact I know more about CF than the latest > in a long line of investors who happen to own the > ISP today. I make no claim that that is common but > it is an existence proof that your claim above is > false. Well I was not specific enough here. The argument being made here is that ISP do bad things to my data and therefore have to be avoided. While this may be true in other part of the world it certainly is not the case in Europe. That’s what I meant by there is at least not that reason. Now there might be other reasons (RFC5011 is hard ;-) and I don’t think anyone here has a problem if an informed user switched it’s DNS via a setting or VPN or whatever, I just don’t want to have the browser do it for me. > In much of the discussion on this list, I see what > I perceive as people (on all "sides") frequently > describing DNS setups in ways that seem tailored > to suit their argument and not reflect reality with > any fidelity. I don't find any conclusions based > on such arguments at all convincing TBH, no matter > how frequently those may be asserted. Well there are multiple realities here and the hard part will to find something that matches all or at least most of them. There also might not be a single solution for that. So long -Ralf —-- Ralf Weber From nobody Thu Aug 1 04:12:56 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AF0BB12015B for ; Thu, 1 Aug 2019 04:12:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.297 X-Spam-Level: X-Spam-Status: No, score=-4.297 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=telekom.de Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 94PN_8fySuLX for ; Thu, 1 Aug 2019 04:12:52 -0700 (PDT) Received: from mailout41.telekom.de (mailout41.telekom.de [194.25.225.151]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6077612003F for ; Thu, 1 Aug 2019 04:12:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=telekom.de; i=@telekom.de; q=dns/txt; s=dtag1; t=1564657967; x=1596193967; h=from:to:subject:date:message-id:references:in-reply-to: mime-version; bh=kxXYWqXGVy+k+qcSYrRPlxLAoeofs9OLhvbHI5cZSVQ=; b=xtpyeHSZZe9B0XOziKc30zhDgooAm0TZIs2A7uG8b/b8VSerjpTyKUaS YnJ3Br41iJKwl7fhwVZGgzKmE/LCaoz39xLlyJQpzfuXNZf4rsuUhKuyz +qVVjKCJjSr//O/yj2rTiCclBttcpCgAz00Pi1ou2tYFk2GybgpdXtiDO idH2Yx2YHiC7fXXLzGArDJgtrE8ruyqU8qd+GgyHLi07jgo7cukjnjNIT C3AvOQIDf3D7pz3yYGSYbE9WMja7+Llrx/1LF3nQzU6QYmo/hgkyLCupB bw0u0RyTFXzuwyX3Q3DYt2tOaxONe65oLBA3HJG1B/ai2ot57x0ES7wCz Q==; Received: from qde8e4.de.t-internal.com ([10.171.255.33]) by MAILOUT41.dmznet.de.t-internal.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 01 Aug 2019 13:12:44 +0200 X-IronPort-AV: E=Sophos;i="5.64,333,1559512800"; d="scan'208,217";a="593073299" X-MGA-submission: =?us-ascii?q?MDGZbMxTZTssI+yYNA/P98UGoMUy09bE7foRgy?= =?us-ascii?q?60ZsoUWWw/XRD9+Mn8oV6I05MI0panWyB9kV5lJAx95QbYEnRrHwDsLu?= =?us-ascii?q?GaU/qO6AAfPNeX/8G6+z0IViSkkVg+YUAhRNlM1OrVu5JRy2TREL+gRO?= =?us-ascii?q?EBK29AwYd2rgxjm3rZBycunA=3D=3D?= Received: from he105864.emea1.cds.t-internal.com ([10.169.119.41]) by QDE8PP.de.t-internal.com with ESMTP/TLS/AES256-SHA; 01 Aug 2019 13:12:48 +0200 Received: from HE199744.EMEA1.cds.t-internal.com (10.169.119.52) by HE105864.emea1.cds.t-internal.com (10.169.119.41) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Thu, 1 Aug 2019 13:12:47 +0200 Received: from HE104163.emea1.cds.t-internal.com (10.171.40.38) by HE199744.EMEA1.cds.t-internal.com (10.169.119.52) with Microsoft SMTP Server (TLS) id 15.0.1473.3 via Frontend Transport; Thu, 1 Aug 2019 13:12:47 +0200 Received: from GER01-FRA-obe.outbound.protection.outlook.de (51.4.80.17) by O365mail05.telekom.de (172.30.0.230) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Thu, 1 Aug 2019 13:12:47 +0200 Received: from LEXPR01MB0381.DEUPRD01.PROD.OUTLOOK.DE (10.158.165.23) by LEXPR01MB0174.DEUPRD01.PROD.OUTLOOK.DE (10.158.164.11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2115.16; Thu, 1 Aug 2019 11:12:46 +0000 Received: from LEXPR01MB0381.DEUPRD01.PROD.OUTLOOK.DE ([fe80::24da:b35e:127a:a22c]) by LEXPR01MB0381.DEUPRD01.PROD.OUTLOOK.DE ([fe80::24da:b35e:127a:a22c%3]) with mapi id 15.20.2115.005; Thu, 1 Aug 2019 11:12:46 +0000 From: To: , , Thread-Topic: [Add] My longer list of questions [from partial distribution at the MIC] Thread-Index: AQHVR6mWZoZPou0EEUS/VpZ0WAAFuKblQdBAgADgopA= Date: Thu, 1 Aug 2019 11:12:46 +0000 Message-ID: References: <20190731140106.CDA3215EDF38@fafnir.remote.dragon.net> In-Reply-To: Accept-Language: de-DE, en-US Content-Language: de-DE X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=N.Leymann@telekom.de; x-originating-ip: [164.19.3.14] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 86876053-5a21-44b5-640b-08d716712e8c x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:LEXPR01MB0174; x-ms-traffictypediagnostic: LEXPR01MB0174: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:8273; x-forefront-prvs: 01165471DB x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(376002)(39860400002)(346002)(136003)(366004)(396003)(189003)(199004)(102836004)(86362001)(186003)(26005)(71200400001)(76116006)(66476007)(66556008)(5660300002)(64756008)(66446008)(8936002)(11346002)(66946007)(66066001)(110136005)(19627235002)(52396003)(7696005)(71190400001)(53546011)(256004)(33656002)(6116002)(236005)(55016002)(9686003)(7736002)(76176011)(6306002)(54896002)(2906002)(3846002)(508600001)(53936002)(790700001)(14454004)(446003)(476003)(81166006)(81156014)(68736007)(486006)(8676002)(148743002); DIR:OUT; SFP:1101; SCL:1; SRVR:LEXPR01MB0174; H:LEXPR01MB0381.DEUPRD01.PROD.OUTLOOK.DE; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: telekom.de does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: +e/CsxTMYyra13OuDO2N2gSG+/bu17X/tDSX2+ha0xeisfevFpyA0RxIBqpdX6FjhrqTkWC5IPzgj8bvcq18knPYlFeHC3a35kWE4pPxYeewzGjMXqwTysiXxP0StFeVP6ivhuOpKdjEg2y0Rd5n7xirwCmvfWEskmkZAS0avqY+5C9a0631DR4VfqYrTvX1vTVu4beyeNExSp/wpJlvAhQ8GgH497eafBU5tk1lkl7zi//sA1IrkMGQM731xlX3AxO61bzr0dbA3eEtoOQzKGFKXbS/xp8oB4RTILDZ0au4CwmAV5FI16vqalIBWJlPaZCc1u/4a9FNgu8TLVS/ulD1NFo2RCz0eHQitBMc6mtaxzaADdZjz69/OhsjnLUFXuUgMRuYvkLaq/UYnmzzu0r/qjq2QSpNXCUFCO0N2dk= Content-Type: multipart/alternative; boundary="_000_LEXPR01MB0381FFFD5E61D1AE6635A78398DE0LEXPR01MB0381DEUP_" MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: 86876053-5a21-44b5-640b-08d716712e8c X-MS-Exchange-CrossTenant-originalarrivaltime: 01 Aug 2019 11:12:46.2821 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: bde4dffc-4b60-4cf6-8b04-a5eeb25f5c4f X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: N.Leymann@telekom.de X-MS-Exchange-Transport-CrossTenantHeadersStamped: LEXPR01MB0174 X-OriginatorOrg: telekom.de Archived-At: Subject: Re: [Add] My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 01 Aug 2019 11:12:55 -0000 --_000_LEXPR01MB0381FFFD5E61D1AE6635A78398DE0LEXPR01MB0381DEUP_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGksDQoNClRoYXQgaXMgYWxzbyBvdXIgZXhwZXJpZW5jZSBmcm9tIGxhcmdlIHNjYWxlIEROUyBk ZXBsb3ltZW50cy4gTW9yZSB0aGFuIDkwJSBvZiB0aGUgdXNlcnMgYXJlIHVzaW5nIHRoZSBETlMg c2VydmljZSB3aGljaCBpcyBwcm92aWRlZCBieSB0aGUgbmV0d29yayAodXN1YWxseSB2aWEgREhD UCBidXQgdGhpcyBjb3VsZCBiZSBhbHNvIGFuIGFsdGVybmF0aXZlIGRpc2NvdmVyeSBtZWNoYW5p c21zIGluIHRoZSBmdXR1cmUpIOKAkyBpbiBtb3N0IG9mIHRoZSBjYXNlcyB0aGV5IGV2ZW4gZG8g bm90IGtub3cgd2hhdCBETlMgaXMuIFRoZSBvdGhlciAxMCUgYXJlIGFjdGl2ZWx5IG9wdGluZyBv dXQgLSBmb3Igd2hhdGV2ZXIgcmVhc29uIC0gb2YgdGhlIEROUyBwcm92aWRlZCBieSB0aGUgbmV0 d29yayAod2hpY2ggaXMgZmluZSBiZWNhdXNlIEkgYXNzdW1lIHRoYXQgdGhleSBleGFjdGx5IGtu b3cgd2hhdCB0aGV5IGFyZSBkb2luZykuDQoNClJlZ2FyZHMNCg0KTmljDQoNClZvbjogQWRkIDxh ZGQtYm91bmNlc0BpZXRmLm9yZz4gSW0gQXVmdHJhZyB2b24gQW5kcmV3IENhbXBsaW5nDQpHZXNl bmRldDogTWl0dHdvY2gsIDMxLiBKdWxpIDIwMTkgMjM6NTINCkFuOiBFcmljIFJlc2NvcmxhIDxl a3JAcnRmbS5jb20+OyBBREQgTWFpbGluZyBsaXN0IDxhZGRAaWV0Zi5vcmc+DQpCZXRyZWZmOiBS ZTogW0FkZF0gTXkgbG9uZ2VyIGxpc3Qgb2YgcXVlc3Rpb25zIFtmcm9tIHBhcnRpYWwgZGlzdHJp YnV0aW9uIGF0IHRoZSBNSUNdDQoNCg0KPiBPbiBXZWQsIEp1bCAzMSwgMjAxOSBhdCAxNTowMiBF cmljIFJlc2NvcmxhIDxla3JAcnRmbS5jb208bWFpbHRvOmVrckBydGZtLmNvbT4+IHdyb3RlOg0K DQo+PiBPbiBXZWQsIEp1bCAzMSwgMjAxOSBhdCA3OjAxIEFNIFBhdWwgRWJlcnNtYW4gPGxpc3Qt YWRkQGRyYWdvbi5uZXQ8bWFpbHRvOmxpc3QtYWRkQGRyYWdvbi5uZXQ+PiB3cm90ZToNCg0KPj4g TWFueSB1c2VycyBvZiA4LjguOC44IGRvIHNvIGJlY2F1c2UgdGhleSBnZXQgaXQgdmlhIERIQ1Au DQoNCj4gQWJzb2x1dGVseSB0cnVlLCBidXQgSSdtIG5vdCBzdXJlIHdoeSB0aGF0IG1hdHRlcnMu IFRoZSBmYWN0IGlzIHRoYXQgbWFueSBhbHNvIG1hbnVhbGx5IGNvbmZpZ3VyZSBpdCwgYW5kIG5v IG1hdHRlciBob3cgaXQgaXMgY29uZmlndXJlZCwgaXQncyBub3QgdGhlIElTUCBwcm92aWRpbmcg dGhlIHNlcnZpY2UuDQoNCg0KSW4gdGhlIG1hcmtldHMgdGhhdCBJ4oCZbSBtb3N0IGZhbWlsaWFy IHdpdGgsIHRoZSBzcGxpdCBvZiB1c2VycyBvcHRpbmcgdG8gb2J0YWluIEROUyBmcm9tIGEgc291 cmNlIG90aGVyIHRoYW4gdGhlaXIgSVNQIGlzIGFyb3VuZCB0ZW4gcGVyY2VudC4gIEluIHRob3Nl IG1hcmtldHMgdGhlIGFib3ZlIHN0YXRlbWVudCB0aGF0IOKAnOKApiBtYW55IGFsc28gbWFudWFs bHkgY29uZmlndXJlIOKApuKAnSB3b3VsZCBiZSBtb3JlIGFjY3VyYXRlbHkgcmV3cml0dGVuIGFz IOKAnGEgc21hbGwgbWlub3JpdHkgbWFudWFsbHkgY29uZmlndXJl4oCdLg0KDQpJbiByZWFsaXR5 IGJlaGF2aW91ciB2YXJpZXMgc2lnbmlmaWNhbnRseSBiZXR3ZWVuIG1hcmtldHMgc28gd2Ugc2hv dWxkbuKAmXQgYXNzdW1lIHRoYXQsIGZvciBleGFtcGxlLCB0aGUgYmVoYXZpb3VycyB0aGF0IGFw cGx5IGluIHRoZSBVUywgb3IgaW5kZWVkIHRoZSB2ZXJ5IGRpZmZlcmVudCBiZWhhdmlvdXJzIGlu IFZpZXRuYW0sIGFyZSBnZW5lcmFsbHkgdHJ1ZSBlbHNld2hlcmUuDQo= --_000_LEXPR01MB0381FFFD5E61D1AE6635A78398DE0LEXPR01MB0381DEUP_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBjbTsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQph OmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xv cjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFuLk1z b0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpwdXJw bGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwLk1zb0xpc3RQYXJhZ3JhcGgsIGxp Lk1zb0xpc3RQYXJhZ3JhcGgsIGRpdi5Nc29MaXN0UGFyYWdyYXBoDQoJe21zby1zdHlsZS1wcmlv cml0eTozNDsNCgltYXJnaW4tdG9wOjBjbTsNCgltYXJnaW4tcmlnaHQ6MGNtOw0KCW1hcmdpbi1i b3R0b206MGNtOw0KCW1hcmdpbi1sZWZ0OjM2LjBwdDsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7 DQoJZm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9 DQpwLm1zb25vcm1hbDAsIGxpLm1zb25vcm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHls ZS1uYW1lOm1zb25vcm1hbDsNCgltc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmln aHQ6MGNtOw0KCW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBjbTsN Cglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30N CnNwYW4uRS1NYWlsRm9ybWF0dm9ybGFnZTE5DQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsOw0K CWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOndpbmRvd3RleHQ7fQ0K c3Bhbi5FLU1haWxGb3JtYXR2b3JsYWdlMjENCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWw7DQoJ Zm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6d2luZG93dGV4dDt9DQpz cGFuLkUtTWFpbEZvcm1hdHZvcmxhZ2UyMg0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbC1jb21w b3NlOw0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOndpbmRvd3Rl eHQ7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9u dC1zaXplOjEwLjBwdDt9DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7c2l6ZTo2MTIuMHB0IDc5Mi4w cHQ7DQoJbWFyZ2luOjcyLjBwdCA3Mi4wcHQgNzIuMHB0IDcyLjBwdDt9DQpkaXYuV29yZFNlY3Rp b24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi0tPjwvc3R5bGU+PCEtLVtpZiBndGUgbXNvIDld Pjx4bWw+DQo8bzpzaGFwZWRlZmF1bHRzIHY6ZXh0PSJlZGl0IiBzcGlkbWF4PSIxMDI2IiAvPg0K PC94bWw+PCFbZW5kaWZdLS0+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWxheW91 dCB2OmV4dD0iZWRpdCI+DQo8bzppZG1hcCB2OmV4dD0iZWRpdCIgZGF0YT0iMSIgLz4NCjwvbzpz aGFwZWxheW91dD48L3htbD48IVtlbmRpZl0tLT4NCjwvaGVhZD4NCjxib2R5IGxhbmc9IkRFIiBs aW5rPSJibHVlIiB2bGluaz0icHVycGxlIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0ibXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4t VVMiPkhpLDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJtc28tZmFyZWFzdC1sYW5ndWFnZTpFTi1VUyI+PG86cD4mbmJzcDs8L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJt c28tZmFyZWFzdC1sYW5ndWFnZTpFTi1VUyI+VGhhdCBpcyBhbHNvIG91ciBleHBlcmllbmNlIGZy b20gbGFyZ2Ugc2NhbGUgRE5TIGRlcGxveW1lbnRzLiBNb3JlIHRoYW4gOTAlIG9mIHRoZSB1c2Vy cyBhcmUgdXNpbmcgdGhlIEROUyBzZXJ2aWNlIHdoaWNoIGlzIHByb3ZpZGVkIGJ5IHRoZSBuZXR3 b3JrICh1c3VhbGx5IHZpYSBESENQIGJ1dCB0aGlzIGNvdWxkIGJlDQogYWxzbyBhbiBhbHRlcm5h dGl2ZSBkaXNjb3ZlcnkgbWVjaGFuaXNtcyBpbiB0aGUgZnV0dXJlKSDigJMgaW4gbW9zdCBvZiB0 aGUgY2FzZXMgdGhleSBldmVuIGRvIG5vdCBrbm93IHdoYXQgRE5TIGlzLiBUaGUgb3RoZXIgMTAl IGFyZSBhY3RpdmVseSBvcHRpbmcgb3V0IC0gZm9yIHdoYXRldmVyIHJlYXNvbiAtIG9mIHRoZSBE TlMgcHJvdmlkZWQgYnkgdGhlIG5ldHdvcmsgKHdoaWNoIGlzIGZpbmUgYmVjYXVzZSBJIGFzc3Vt ZSB0aGF0IHRoZXkgZXhhY3RseQ0KIGtub3cgd2hhdCB0aGV5IGFyZSBkb2luZykuICZuYnNwOyZu YnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxh bmc9IkVOLVVTIiBzdHlsZT0ibXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVMiPjxvOnA+Jm5ic3A7 PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVT IiBzdHlsZT0ibXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVMiPlJlZ2FyZHM8bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1VUyIgc3R5bGU9 Im1zby1mYXJlYXN0LWxhbmd1YWdlOkVOLVVTIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1VUyIgc3R5bGU9Im1zby1mYXJl YXN0LWxhbmd1YWdlOkVOLVVTIj5OaWM8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1VUyIgc3R5bGU9Im1zby1mYXJlYXN0LWxhbmd1YWdl OkVOLVVTIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0i Ym9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjRTFFMUUxIDEuMHB0O3BhZGRpbmc6My4wcHQg MGNtIDBjbSAwY20iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+Vm9uOjwvYj4gQWRkICZsdDth ZGQtYm91bmNlc0BpZXRmLm9yZyZndDsgPGI+SW0gQXVmdHJhZyB2b24gPC9iPg0KQW5kcmV3IENh bXBsaW5nPGJyPg0KPGI+R2VzZW5kZXQ6PC9iPiBNaXR0d29jaCwgMzEuIEp1bGkgMjAxOSAyMzo1 Mjxicj4NCjxiPkFuOjwvYj4gRXJpYyBSZXNjb3JsYSAmbHQ7ZWtyQHJ0Zm0uY29tJmd0OzsgQURE IE1haWxpbmcgbGlzdCAmbHQ7YWRkQGlldGYub3JnJmd0Ozxicj4NCjxiPkJldHJlZmY6PC9iPiBS ZTogW0FkZF0gTXkgbG9uZ2VyIGxpc3Qgb2YgcXVlc3Rpb25zIFtmcm9tIHBhcnRpYWwgZGlzdHJp YnV0aW9uIGF0IHRoZSBNSUNdPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBsYW5nPSJFTi1HQiI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPGRpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiI+Jmd0OyBPbiBX ZWQsIEp1bCAzMSwgMjAxOSBhdCAxNTowMiBFPC9zcGFuPjxzcGFuIGxhbmc9IkVOLVVTIj5yaWMg UmVzY29ybGEgJmx0OzxhIGhyZWY9Im1haWx0bzpla3JAcnRmbS5jb20iPmVrckBydGZtLmNvbTwv YT4mZ3Q7DQo8L3NwYW4+PHNwYW4gbGFuZz0iRU4tR0IiPndyb3RlOjxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiPjxv OnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiPiZndDsmZ3Q7IE9uIFdlZCwgSnVsIDMxLCAyMDE5IGF0 IDc6MDEgQU0gUGF1bCBFYmVyc21hbiAmbHQ7PGEgaHJlZj0ibWFpbHRvOmxpc3QtYWRkQGRyYWdv bi5uZXQiPmxpc3QtYWRkQGRyYWdvbi5uZXQ8L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVm dDpzb2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRpbmc6MGNtIDBjbSAwY20gNi4wcHQ7bWFyZ2luLWxl ZnQ6NC44cHQ7bWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0b206 NS4wcHQiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiPjxicj4NCiZn dDsmZ3Q7IE1hbnkgdXNlcnMgb2YgOC44LjguOCBkbyBzbyBiZWNhdXNlIHRoZXkgZ2V0IGl0IHZp YSBESENQLiA8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Jsb2NrcXVvdGU+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiPjxvOnA+Jm5ic3A7PC9vOnA+PC9z cGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9 IkVOLUdCIj4mZ3Q7IEFic29sdXRlbHkgdHJ1ZSwgYnV0IEknbSBub3Qgc3VyZSB3aHkgdGhhdCBt YXR0ZXJzLiBUaGUgZmFjdCBpcyB0aGF0IG1hbnkgYWxzbyBtYW51YWxseSBjb25maWd1cmUgaXQs IGFuZCBubyBtYXR0ZXIgaG93IGl0IGlzIGNvbmZpZ3VyZWQsIGl0J3Mgbm90IHRoZSBJU1AgcHJv dmlkaW5nIHRoZSBzZXJ2aWNlLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+PG86cD4m bmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0i RU4tR0IiIHN0eWxlPSJmb250LXNpemU6MTIuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiIgc3R5bGU9ImZvbnQt c2l6ZToxMi4wcHQiPkluIHRoZSBtYXJrZXRzIHRoYXQgSeKAmW0gbW9zdCBmYW1pbGlhciB3aXRo LCB0aGUgc3BsaXQgb2YgdXNlcnMgb3B0aW5nIHRvIG9idGFpbiBETlMgZnJvbSBhIHNvdXJjZSBv dGhlciB0aGFuIHRoZWlyIElTUCBpcyBhcm91bmQgdGVuIHBlcmNlbnQuJm5ic3A7IEluIHRob3Nl IG1hcmtldHMgdGhlIGFib3ZlIHN0YXRlbWVudCB0aGF0IOKAnOKApiBtYW55DQogYWxzbyBtYW51 YWxseSBjb25maWd1cmUg4oCm4oCdIHdvdWxkIGJlIG1vcmUgYWNjdXJhdGVseSByZXdyaXR0ZW4g YXMg4oCcYSBzbWFsbCBtaW5vcml0eSBtYW51YWxseSBjb25maWd1cmXigJ0uJm5ic3A7DQo8bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1H QiIgc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIiBzdHlsZT0iZm9udC1zaXpl OjEyLjBwdCI+SW4gcmVhbGl0eSBiZWhhdmlvdXIgdmFyaWVzIHNpZ25pZmljYW50bHkgYmV0d2Vl biBtYXJrZXRzIHNvIHdlIHNob3VsZG7igJl0IGFzc3VtZSB0aGF0LCBmb3IgZXhhbXBsZSwgdGhl IGJlaGF2aW91cnMgdGhhdCBhcHBseSBpbiB0aGUgVVMsIG9yIGluZGVlZCB0aGUgdmVyeSBkaWZm ZXJlbnQgYmVoYXZpb3VycyBpbiBWaWV0bmFtLCBhcmUNCiBnZW5lcmFsbHkgdHJ1ZSBlbHNld2hl cmUuICZuYnNwOyZuYnNwOyZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9k aXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ib2R5Pg0KPC9odG1sPg0K --_000_LEXPR01MB0381FFFD5E61D1AE6635A78398DE0LEXPR01MB0381DEUP_-- From nobody Thu Aug 1 04:40:42 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9936912008C for ; Thu, 1 Aug 2019 04:40:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ennp2sZadgMc for ; Thu, 1 Aug 2019 04:40:39 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C3C9F12003F for ; Thu, 1 Aug 2019 04:40:38 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 7506BBE58; Thu, 1 Aug 2019 12:40:37 +0100 (IST) Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id R3ogqIwYZl4O; Thu, 1 Aug 2019 12:40:37 +0100 (IST) Received: from [134.226.36.93] (unknown [134.226.36.93]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 2D052BE56; Thu, 1 Aug 2019 12:40:37 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1564659637; bh=oUhaMq36OuSBFYQNKLHqekoE1RNNNjTj8egcq7c4ZZU=; h=To:Cc:References:From:Subject:Date:In-Reply-To:From; b=A8Q5d9XSsgVPHfbXR74Lfkz8xB4csQn3uvV8eAZBA2hfge7LdrYY8/Gyv1VyEUMNH kydty54Cj+pNJ6tGzTgqTfsn4bY6Mwq/I2qcDlYP+18sYQT+LhgOW7jUBqIzXJ/gu8 cQQI7YLJ38h9Yf4Wj7ZyHJ8K2ZggrmiWo1wb6/C8= To: Mikael Abrahamsson Cc: Ralf Weber , Paul Wouters , Alec Muffett , ADD Mailing list References: <1C02AB5B-D01E-49F6-86CE-BAEF4779E776@frobbit.se> <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> <64bcfc51-6f3d-ae24-4de5-d0eb89975c66@cs.tcd.ie> <539D6F9D-137C-4F68-A8DE-EA3DFAF4D827@huitema.net> <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: Date: Thu, 1 Aug 2019 12:40:36 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="UXeyZbMj5zEn4iIIiO4UBpV0vcayDpRoi" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 01 Aug 2019 11:40:41 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --UXeyZbMj5zEn4iIIiO4UBpV0vcayDpRoi Content-Type: multipart/mixed; boundary="2Qik7hEz5SkTnW0QrH0ggW7YUzAzSwbxJ"; protected-headers="v1" From: Stephen Farrell To: Mikael Abrahamsson Cc: Ralf Weber , Paul Wouters , Alec Muffett , ADD Mailing list Message-ID: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] References: <1C02AB5B-D01E-49F6-86CE-BAEF4779E776@frobbit.se> <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> <64bcfc51-6f3d-ae24-4de5-d0eb89975c66@cs.tcd.ie> <539D6F9D-137C-4F68-A8DE-EA3DFAF4D827@huitema.net> <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> In-Reply-To: --2Qik7hEz5SkTnW0QrH0ggW7YUzAzSwbxJ Content-Type: multipart/mixed; boundary="------------CB5A85DD7BCED27F7EB92E21" Content-Language: en-GB This is a multi-part message in MIME format. --------------CB5A85DD7BCED27F7EB92E21 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hiya, On 01/08/2019 11:25, Mikael Abrahamsson wrote: > On Wed, 31 Jul 2019, Stephen Farrell wrote: >=20 >> In much of the discussion on this list, I see what I perceive as >> people (on all "sides") frequently describing DNS setups in ways that >> seem tailored to suit their argument and not reflect reality with any >> fidelity. I don't find any conclusions based on such arguments at all >> convincing TBH, no matter how frequently those may be asserted. >> >> And I have a hard time seeing any WG working on this topic being able >> to make progress in the face of such dodgy arguments. >=20 > You shouldn't see these as "dodgy arguments".=20 I guess we disagree. (BTW, I mean "dodgy" in the sense of "bad logic" rather than "being deliberately disingenuous") > It's just a reflection of > very different realities that people live in. I travel between realitie= s > and there are cases where I want the system resolver to be used, and > there are cases where I would want DoH to some quad-X provider to be us= ed. >=20 > There is no single right answer to this. In windows there is a popup > after I connect to a new network, asking me whether this is "public" or= > "private". I guess this is an proxy for "do you trust this network and > the devices that are on it?" and the answer if I choose public is "no".= > Security settings (firewall and perhaps more) are under the hood set > accordingly. >=20 > We're going to need similar settings here based on user input. I'd even= > think it was ok for the browser vendor to have sensible defaults per > network type. Mostly agree. ISTM though that better and fairly widespread OS support for that kind of subtlety would be needed before applications that need to run on different OSes could really benefit without having to do their own DoH stuff, and that's not something that the IETF can really "fix." > Only the user knows who they trust in each case. We have to ask them. I'm less sure of that. Given most people don't know what DNS is, nor the trade-offs involved, it's unclear how to effectively ask what question. Someone could do research of course that helps there, but I'm not convinced we could write BCP-like text at the moment. Cheers, S. >=20 --------------CB5A85DD7BCED27F7EB92E21 Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------CB5A85DD7BCED27F7EB92E21-- --2Qik7hEz5SkTnW0QrH0ggW7YUzAzSwbxJ-- --UXeyZbMj5zEn4iIIiO4UBpV0vcayDpRoi Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAl1Cz7QACgkQWrL68XsX K+pm0g/6Amzty8ALh/hr3cdM/9VsTOt57zVam3ydGdkdKcyUvq6mZpc08yC+DMXb ykY1HQvv83dPoMfX1f1JJfzmgrtCKTsCR5gsmkKwe4qQw/WgpCxwJVr28cbD+b1j 9TaiR/7XtNVPvxKaJdel9HbdXu1ZmS9MGFKDc+mR4JsIkQIMIC/xxxyy6dtMO28S sAsNoIuyc40yFUdhCRq3Oi4OjchHyLcAS2jueBHQCyRq+oNj3/+G5f8AMDG0FgSy 4FP1Bn4iRGZS/rw77CPhi+B76j3EtTkQejGtSxzRfD3b3toyCXkLmWUva7Mt0NQD MblK/PEUyr3+ef0R7afW6FY8lZqi5cK8P2sEnu3g2Szcbvb0hlvYSqv0Ty9YfoLS d7Z10AGMFO0djMOJs2M2PJBD4/BacH9qr3DSfkjacB9KH78e+f7jg6GEuU9Iuky5 7fCvocOtUyhTFW6Lv3EnPYA5uTLHlhpHa6KWmWzyfTKVnqUfmjSw+csOCjoswZ7I 2pnCyWJnbjLhTg2wNPvXtbqrcA0uZ/ReIx6ejsh/iESygZc8Jar1ihicXMNhSA4i 2ToZeQ4FhCnX3VLXrXPve3Kq1W9Mlv4OzcYk1XqFnu9D0GaCtElosoDrJxs3Gm2J nRdsVod2Jpr7SGOlLNbQHrReunhL+h3go5vUeITbFVBOpg7azCs= =PgNH -----END PGP SIGNATURE----- --UXeyZbMj5zEn4iIIiO4UBpV0vcayDpRoi-- From nobody Thu Aug 1 05:12:59 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 17E5B1200CD for ; Thu, 1 Aug 2019 05:12:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.299 X-Spam-Level: X-Spam-Status: No, score=-4.299 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=swm.pp.se Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id s0VC7cQi4IxM for ; Thu, 1 Aug 2019 05:12:56 -0700 (PDT) Received: from uplift.swm.pp.se (ipv6.swm.pp.se [IPv6:2a00:801::f]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B626612008C for ; Thu, 1 Aug 2019 05:12:55 -0700 (PDT) Received: by uplift.swm.pp.se (Postfix, from userid 501) id 45BABB0; Thu, 1 Aug 2019 14:12:53 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=swm.pp.se; s=mail; t=1564661573; bh=RWhn73wHADMRJNlzqUJ/OUa0xPOVR6mrtDvXYpPgmvI=; h=Date:From:To:cc:Subject:In-Reply-To:References:From; b=qSX99A+yIttLzbecxf64KRZ58TKxzQ+oJyYgFS7zwKsMp3ZAhbynuz+rxMIrpm5Tq wDn7Cc3SdgRKgJ+M8ZBo1uDYdqnLrnX7R7OW5H9xWekDLiANgTm0lWAClXZhYd4CLT K4CMH+iT8+om30VRtn1Z8tt7BgNs1F7UP6IcmsVA= Received: from localhost (localhost [127.0.0.1]) by uplift.swm.pp.se (Postfix) with ESMTP id 3DC22AF; Thu, 1 Aug 2019 14:12:53 +0200 (CEST) Date: Thu, 1 Aug 2019 14:12:53 +0200 (CEST) From: Mikael Abrahamsson To: Stephen Farrell cc: Ralf Weber , Paul Wouters , Alec Muffett , ADD Mailing list In-Reply-To: Message-ID: References: <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> <64bcfc51-6f3d-ae24-4de5-d0eb89975c66@cs.tcd.ie> <539D6F9D-137C-4F68-A8DE-EA3DFAF4D827@huitema.net> <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> User-Agent: Alpine 2.20 (DEB 67 2015-01-07) Organization: People's Front Against WWW MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII; format=flowed Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 01 Aug 2019 12:12:58 -0000 On Thu, 1 Aug 2019, Stephen Farrell wrote: >> You shouldn't see these as "dodgy arguments". > > I guess we disagree. (BTW, I mean "dodgy" in the sense of > "bad logic" rather than "being deliberately disingenuous") Thanks for the clarification, I did interpret your statement that you thought the arguments were disingenous which I thought was strange. > Mostly agree. ISTM though that better and fairly widespread > OS support for that kind of subtlety would be needed before > applications that need to run on different OSes could really > benefit without having to do their own DoH stuff, and that's > not something that the IETF can really "fix." Sure. >> Only the user knows who they trust in each case. We have to ask them. > > I'm less sure of that. Given most people don't know what > DNS is, nor the trade-offs involved, it's unclear how to > effectively ask what question. Someone could do research > of course that helps there, but I'm not convinced we could > write BCP-like text at the moment. It seems most people agree that this is hard. The disagreements are about what to do when it's hard. Some say "it's hard, so let's just change it to DoH server that the browser vendor decides unless the user makes an active decision" and others seem to say "it's hard, so let's keep the status quo (system resolver) unless the user makes an active decision". Doing browser/operating system integration is hard for most if you're not a vendor that happen to do both (there are a few). That doesn't mean it's not the right thing to do long term. One thing that would be good to get agreement on is that there are valid use-cases for both using the system resolver by default and using a (remote, non-ISP) DoH resolver by default, and my estimation is that these are close to equally large/important. If we can agree on that and the discussion stops being on whose use-case is most important and instead being on how to solve this problem, then the discussion might be more fruitful and productive. The IETF role in this I would say is that it's one of the few places where application/browser vendors and operators are in the same "place". So coming up with a BCP that is balanced, and works for a lot of different use-cases and make applications behave in a similar fashion across the board would be of great benefit. -- Mikael Abrahamsson email: swmike@swm.pp.se From nobody Thu Aug 1 05:54:52 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8990F12015C for ; Thu, 1 Aug 2019 05:54:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VeVl0mGvVY35 for ; Thu, 1 Aug 2019 05:54:40 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2646D1201D8 for ; Thu, 1 Aug 2019 05:54:39 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 672BBBE2C; Thu, 1 Aug 2019 13:54:37 +0100 (IST) Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9dmwEnq8Bh5y; Thu, 1 Aug 2019 13:54:37 +0100 (IST) Received: from [134.226.36.93] (unknown [134.226.36.93]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 2C6F1BE24; Thu, 1 Aug 2019 13:54:37 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1564664077; bh=hCEF5zoF2PpH0NuE6yHdJuG1/gvTVv07ofzpiIrdHjs=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From; b=Pa8z/tHnhTfvQ9NnUUaaSjUarvQSghHY8WFSSiH8AhjABMMhpDXKXg5Wv0frVIW22 vGGjv+Mgv8Ga66MIG/nBIWVUknAJgrUk70Mm1aTrCeT/HLJlBrEmdm+FlHtRC6ojiV 8fdBfaZ+QXDan9f2ng4Pfvqx0gq6u9ANebuKaOmc= To: Mikael Abrahamsson Cc: Paul Wouters , ADD Mailing list , Ralf Weber , Alec Muffett References: <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> <64bcfc51-6f3d-ae24-4de5-d0eb89975c66@cs.tcd.ie> <539D6F9D-137C-4F68-A8DE-EA3DFAF4D827@huitema.net> <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> Date: Thu, 1 Aug 2019 13:54:33 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="DJalWDq8jkdg7S1EMxFXMjuiFUJPMDRXW" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 01 Aug 2019 12:54:50 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --DJalWDq8jkdg7S1EMxFXMjuiFUJPMDRXW Content-Type: multipart/mixed; boundary="rrxwESsyqlJE4rK3DW2GnVIbNjdBYdFOx"; protected-headers="v1" From: Stephen Farrell To: Mikael Abrahamsson Cc: Paul Wouters , ADD Mailing list , Ralf Weber , Alec Muffett Message-ID: <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] References: <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> <64bcfc51-6f3d-ae24-4de5-d0eb89975c66@cs.tcd.ie> <539D6F9D-137C-4F68-A8DE-EA3DFAF4D827@huitema.net> <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> In-Reply-To: --rrxwESsyqlJE4rK3DW2GnVIbNjdBYdFOx Content-Type: multipart/mixed; boundary="------------7245BE6A5B978F64ABC9A85B" Content-Language: en-GB This is a multi-part message in MIME format. --------------7245BE6A5B978F64ABC9A85B Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hiya, On 01/08/2019 13:12, Mikael Abrahamsson wrote: >=20 > One thing that would be good to get agreement on is that there are vali= d > use-cases for both using the system resolver by default and using a > (remote, non-ISP) DoH resolver by default, and my estimation is that > these are close to equally large/important. If we can agree on that and= > the discussion stops being on whose use-case is most important and > instead being on how to solve this problem, then the discussion might b= e > more fruitful and productive. Ah, interesting. FWIW I personally agree there are valid use-cases for both, and maybe more too, e.g. cases where an application may try DoH but fall back to the OS because of . But I don't think documenting that'd remove the disagreements. I wonder would it help to try to separately describe the main abuse-cases as well? If we had objective descriptions of both use- and abuse- cases maybe it'd be easier to figure out what kinds of defaults and/or inputs (e.g. user or admin or app selection) would be needed to indicate that a particular setup was reasonable? (Could end up a bit theoretical I guess, but I'm interested in the general question of whether considering abuse-cases might help in situations like this.) Cheers, S. --------------7245BE6A5B978F64ABC9A85B Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------7245BE6A5B978F64ABC9A85B-- --rrxwESsyqlJE4rK3DW2GnVIbNjdBYdFOx-- --DJalWDq8jkdg7S1EMxFXMjuiFUJPMDRXW Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAl1C4QkACgkQWrL68XsX K+pVcg/+PWNIj+Ps8AGswyP2TSEj5dcuwL1YyEyIWHKcgz9WvfYM6KUv4d0jCCYv Lk8n3bgndntshy26p5lNJYtNeUACGcnNhnnyHNf41B5gsj6e2JpbF2A3jDj80PD9 GRUcmocTbzXIHoXyIxLpXbHhDxn/46XJlvbPFVut/24xNFwCdGuevailS9HRKIQY 3IwW7bKjpkThwWqwLaKPtGg2OnRXmSiyWuumeqqT4//fKInX3ipjyGrNYa/n6Smp Ojiw387Wcpo35upg9hPoodMGVicxkOz5g16KtKqPvd5CoPHea0Y5jzWYnE74ozjE BD1PUkHBlXTnSakdsboNLUWNFLQNDLFQHJvXJ06Ft+6nueqADFzFOmI1r5UrSrJ0 2f1Op+eAZqil+E1HTWtBwUk+VNBP3WiGcIApHIU1S0v8JnkxjBc2p+94wUaot4V8 DaXSdRC8Nj6MAl0CHe4mpfMs1jaqqjKr6WzMr/Gjb1ddO3Arrg2uv5Vu6SymIND6 GX/NqhBAJ/eWdJG7AvBiO4FKG7kb2VJpYJEhEBJHVRz2sqQRkSsOBvi6H/Zr055m dzx/4iGqfvhz2Zjt6Pbk7EyCDJ4X0FuHQbUkP5dCuwjllHJ3zl1LkUs/jBJrOF7y Fi61/bMty4OHf2BX+tT/6638ghmoyeekZ4HeFtu/+Ay1/AU17Xk= =wOy/ -----END PGP SIGNATURE----- --DJalWDq8jkdg7S1EMxFXMjuiFUJPMDRXW-- From nobody Thu Aug 1 09:41:49 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AC1CF1201B5 for ; Thu, 1 Aug 2019 09:41:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id T_VtR0Cs5wKo for ; Thu, 1 Aug 2019 09:41:44 -0700 (PDT) Received: from NAM04-CO1-obe.outbound.protection.outlook.com (mail-eopbgr690122.outbound.protection.outlook.com [40.107.69.122]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 160D91200E0 for ; Thu, 1 Aug 2019 09:41:43 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=mWgqP2uYt9wBBX/zb6Zg0+RbREpklmc/gSYV2hsdKcR+ZKbcyZ/gM8wZ9ptCCp25LjXoSUm3Zh2IvK1Khg+KSLNjb7WLMwPefVSFCi87xc1mQY4FLqHj5P4uGvpakgtXPceATcVQYhA1EwareV3g42ADc256iVgdl4JR8hqlmzcRdesJe2NotQ5mn5ixZyKetEltYA/NtooAudXD+1t6Y9InavVhUOjoMUmkmP0Bv7jVSVrwVhl6p/LSx/w2VEuiR/HjJW/n88ptHhyRjmCkH8PRjHG+8eEITofJ1gldtnhG61Xlua2HxhJUxefsXCL/6iNJAy9AeMs94TDOvmkCSw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=eg7+VP3NWmHRVb6QuY1JLSIvp+jdFkxBhxhD+oD00y4=; b=R0wnbFa7Uxbpxdi+FQDt7Gz6E53Kn1DuFW7XnBpiUTDSO19SK+amOR6EZZteNReyye/9aYwwxVDuq8cMeSdcf7HU0PSZk3MQjUPpEf0ajFwi95eCHV7J3ErZnfqTvK/PjJVRfVqcqqZsYd6jLWHz+D/2FYQx8/5X+klQfkCP8BoxUEcFdSsNrTzEnlyUqZnwHW0wsSSJuBcsatMyqd1hkCQzjxJUKErAjqwOBpzy0tQ2WxXmR3OcA1Az3qa5ODXiseJOquCj02nBcmGU1zkaVxPTY4NYZm6qHmAs/xiAeMKq3yYOzmwNHBmiY1asDEU+FMVBVKod0r9itKhwVFqApw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=microsoft.com; dmarc=pass action=none header.from=microsoft.com; dkim=pass header.d=microsoft.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=eg7+VP3NWmHRVb6QuY1JLSIvp+jdFkxBhxhD+oD00y4=; b=MNTg0COlNDMc3JCHembCkzUZPBOfoj59+7mgCMT/RXlDqKYl901yCawzQ9DbhXeB3Bg/XI4aPtEcaOZg0285xJg6GPP8iVU0XglNqS1OIokfksdEamkUxAN+MoppolRq4MCu/uOzqCo/SCnkt1Oi3y5i1BBxtqTNpR6JcRIFpzg= Received: from MN2PR21MB1213.namprd21.prod.outlook.com (20.179.20.141) by MN2PR21MB1279.namprd21.prod.outlook.com (20.179.21.91) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2157.2; Thu, 1 Aug 2019 16:41:42 +0000 Received: from MN2PR21MB1213.namprd21.prod.outlook.com ([fe80::24eb:3b4c:428b:8fde]) by MN2PR21MB1213.namprd21.prod.outlook.com ([fe80::24eb:3b4c:428b:8fde%9]) with mapi id 15.20.2157.001; Thu, 1 Aug 2019 16:41:41 +0000 From: Tommy Jensen To: Stephen Farrell , Mikael Abrahamsson CC: Paul Wouters , ADD Mailing list , Ralf Weber , Alec Muffett Thread-Topic: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] Thread-Index: AQHVRBOBtJeM4aHo/0yt9008UHcqWqbemEMAgAAO7gCAACA1AIABBgcAgAAx2YCAAccgAIAABO0AgALs5ICAAEqVgIAAFY4AgAAY2wCAABS6gIAACREAgADPuwCAABT8AIAACQWAgAALpICAAD745w== Date: Thu, 1 Aug 2019 16:41:41 +0000 Message-ID: References: <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> <64bcfc51-6f3d-ae24-4de5-d0eb89975c66@cs.tcd.ie> <539D6F9D-137C-4F68-A8DE-EA3DFAF4D827@huitema.net> <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> , <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> In-Reply-To: <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Jensen.Thomas@microsoft.com; x-originating-ip: [131.107.160.60] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 6bf1380d-a693-4943-9f96-08d7169f21d0 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(5600148)(711020)(4605104)(1401327)(4618075)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(2017052603328)(7193020); SRVR:MN2PR21MB1279; x-ms-traffictypediagnostic: MN2PR21MB1279: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-forefront-prvs: 01165471DB x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(4636009)(39860400002)(376002)(346002)(396003)(136003)(366004)(199004)(189003)(8990500004)(478600001)(229853002)(8936002)(81166006)(7736002)(26005)(19627405001)(8676002)(68736007)(10290500003)(10090500001)(76116006)(186003)(91956017)(6436002)(33656002)(2906002)(66446008)(66556008)(52536014)(64756008)(66476007)(66946007)(6506007)(7696005)(54896002)(9686003)(76176011)(14454004)(81156014)(99286004)(53546011)(55016002)(11346002)(102836004)(53936002)(3846002)(6116002)(5660300002)(22452003)(256004)(14444005)(316002)(66066001)(71190400001)(71200400001)(54906003)(105004)(446003)(486006)(296002)(25786009)(110136005)(6246003)(86362001)(74316002)(4326008)(476003)(148743002); DIR:OUT; SFP:1102; SCL:1; SRVR:MN2PR21MB1279; H:MN2PR21MB1213.namprd21.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: PZN86JlRVfr9wwWxUCDFNonmoRhQOEjJn0tPCFu5g/RViE/z9GpeQOXnTC/5SLBMhxC2ilYrS33lW5LUkxafoF978nrvHpC6MlCoRJAN+2vjMzR4gKYsbssW8S7UXFbt0f5cU68kH8qv0l7UBv97n1z9+ZtaddgHWUFwk8kwexFpZhF18wDCGPza95eh+7nGuw5flrcWLA8RP1QM+8G9PhIeNs1HqfdIdVA7qzxTzKUH4dPw1e3AgKy16cc/wzJDsIyN6d1/yAwlHXSamDLRc2P3k93ed/iGaslRPzK8xcF8MaIz7rnh3fbJBSPIl9b/3mVnIsgb9Lqxk22U3FtsTGNeolWIpzQhfT24MVzYxKMWOuE6BAf/Ij4BL4d17I2wt+omxi3VWDyHOmZMwewdRmzlXDFsJ9sCpsQ4DXL+M4I= x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_MN2PR21MB1213C8B8FED0F4F1746DA087FADE0MN2PR21MB1213namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: 6bf1380d-a693-4943-9f96-08d7169f21d0 X-MS-Exchange-CrossTenant-originalarrivaltime: 01 Aug 2019 16:41:41.7087 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: 01RQIK06vQiqDPK4FrHuK/eCe8wrlUWZjAik09VHqfhgTSSevQlJNVM0kLrYW8KBGCfTRAxb+c7SCj0vFLCwtA== X-MS-Exchange-Transport-CrossTenantHeadersStamped: MN2PR21MB1279 Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 01 Aug 2019 16:41:47 -0000 --_000_MN2PR21MB1213C8B8FED0F4F1746DA087FADE0MN2PR21MB1213namp_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable +1 for different valid use cases regarding default choice. Such a document,= even attempted, would give a more concrete framework for this discussion a= nyway. I'd happily collaborate. Thanks, Tommy ________________________________ From: Add on behalf of Stephen Farrell Sent: Thursday, August 1, 2019 5:54 AM To: Mikael Abrahamsson Cc: Paul Wouters ; ADD Mailing list ; Ralf We= ber ; Alec Muffett Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial= distribution at the MIC] Hiya, On 01/08/2019 13:12, Mikael Abrahamsson wrote: > > One thing that would be good to get agreement on is that there are valid > use-cases for both using the system resolver by default and using a > (remote, non-ISP) DoH resolver by default, and my estimation is that > these are close to equally large/important. If we can agree on that and > the discussion stops being on whose use-case is most important and > instead being on how to solve this problem, then the discussion might be > more fruitful and productive. Ah, interesting. FWIW I personally agree there are valid use-cases for both, and maybe more too, e.g. cases where an application may try DoH but fall back to the OS because of . But I don't think documenting that'd remove the disagreements. I wonder would it help to try to separately describe the main abuse-cases as well? If we had objective descriptions of both use- and abuse- cases maybe it'd be easier to figure out what kinds of defaults and/or inputs (e.g. user or admin or app selection) would be needed to indicate that a particular setup was reasonable? (Could end up a bit theoretical I guess, but I'm interested in the general question of whether considering abuse-cases might help in situations like this.) Cheers, S. --_000_MN2PR21MB1213C8B8FED0F4F1746DA087FADE0MN2PR21MB1213namp_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable
+1 for different valid use cases regarding default choice. Such a docum= ent, even attempted, would give a more concrete framework for this discussi= on anyway. I'd happily collaborate.

Thanks,
Tommy
From: Add <add-bounces@i= etf.org> on behalf of Stephen Farrell <stephen.farrell@cs.tcd.ie><= br> Sent: Thursday, August 1, 2019 5:54 AM
To: Mikael Abrahamsson <swmike@swm.pp.se>
Cc: Paul Wouters <paul@nohats.ca>; ADD Mailing list <add@ie= tf.org>; Ralf Weber <dns@fl1ger.de>; Alec Muffett <alec.muffett= @gmail.com>
Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from = partial distribution at the MIC]
 

Hiya,

On 01/08/2019 13:12, Mikael Abrahamsson wrote:
>
> One thing that would be good to get agreement on is that there are val= id
> use-cases for both using the system resolver by default and using a > (remote, non-ISP) DoH resolver by default, and my estimation is that > these are close to equally large/important. If we can agree on that an= d
> the discussion stops being on whose use-case is most important and
> instead being on how to solve this problem, then the discussion might = be
> more fruitful and productive.

Ah, interesting. FWIW I personally agree there are valid
use-cases for both, and maybe more too, e.g. cases where
an application may try DoH but fall back to the OS because
of <foo>. But I don't think documenting that'd remove the
disagreements. I wonder would it help to try to separately
describe the main abuse-cases as well? If we had objective
descriptions of both use- and abuse- cases maybe it'd be
easier to figure out what kinds of defaults and/or inputs
(e.g. user or admin or app selection) would be needed to
indicate that a particular setup was reasonable?

(Could end up a bit theoretical I guess, but I'm interested
in the general question of whether considering abuse-cases
might help in situations like this.)

Cheers,
S.
--_000_MN2PR21MB1213C8B8FED0F4F1746DA087FADE0MN2PR21MB1213namp_-- From nobody Thu Aug 1 09:51:30 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 68C9C120253 for ; Thu, 1 Aug 2019 09:51:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=telefonica.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id B6iqmC1GiZx6 for ; Thu, 1 Aug 2019 09:51:23 -0700 (PDT) Received: from EUR02-AM5-obe.outbound.protection.outlook.com (mail-am5eur02on0713.outbound.protection.outlook.com [IPv6:2a01:111:f400:fe07::713]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 02D6E12026D for ; Thu, 1 Aug 2019 09:51:22 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=aJaLPhrjVBLJO4aKOO6yOO5maIAlZGJvebJP97XAALi5m941IvlmFZI8gjOnsSs87AwbgmQwilVS700v3uBymU93qeF0OWUE7uXCbM2R1tMeahhrQhJ5xwW1lkzmduR5BHX52VKc/84iESHNFD+beDAv10Z2sEMl9iID9UtDFj1hLW05MOG08y8oVYmXHWx9xc4+Iu7agFPg7oUXgf+nL8KmmEMMMUgrEl9gYdq4PGVme6VVsWZpFI8+S7bVoQpeVNEFk4VN/ahoFfPw4MeesUBhZfsymVyuJ+9u4B6cPF792CO7+e7Vih+N/MVlwmr+u+vN+XahtU190iISslN7Mg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=NW0J4y9vmerSHgNfbqdTPUGQSimWvNWGfI9+uJ13Hns=; b=L2aP9KSQo8uj7RcERpjFsKALz8ATWEoJh6J3g8VfH+i03RHgXjIFt1MUar7gqoSap9s18syJ/3jQpVT+UXLfTwtKM5L0H1pdlqxYTL5dSCzXyIc/AXCVlejFD2OiBnmfbOAHrcbt9ggo5isU5pXuuqN2IJkznFTSqLrY1dLeLSrjR1luXnFc2rtvtjChsbEqQYwZOgJfCzN4N8a63S+4QCXz7I++DTeW6i+txCZ9oP7JQK6OYIrnfKjSVMsn+H5Em2qVtHjqxgDQsbSGLchXG3MhmV/zcS+XsxNYVwQnUDpS4f+xZgyHkQatAbJW+g7HtR5zvTQDQteYojn4HyBuVw== ARC-Authentication-Results: i=1; mx.microsoft.com 1;spf=pass smtp.mailfrom=telefonica.com;dmarc=pass action=none header.from=telefonica.com;dkim=pass header.d=telefonica.com;arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=telefonica.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=NW0J4y9vmerSHgNfbqdTPUGQSimWvNWGfI9+uJ13Hns=; b=AczWIA/D0HNeUYKIXw0D8ZiHqVqcu5KpEQMdPcUA3aIPbUnFVwAqEv3kjc3fZT6G3KzI6kELCj6vpSNchGSM+8SzQgq1/TQsObQ9Bc63xCcoVu/470YLPm9iwb3gMh7RSMrEEOvP1rGiAMrPg6Kr59twkm0A7bxsNnqqf2bq1QI= Received: from DB3PR0602MB3788.eurprd06.prod.outlook.com (52.134.70.148) by DB3PR0602MB3690.eurprd06.prod.outlook.com (52.134.71.142) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2115.13; Thu, 1 Aug 2019 16:51:20 +0000 Received: from DB3PR0602MB3788.eurprd06.prod.outlook.com ([fe80::9c53:d10:400e:c71]) by DB3PR0602MB3788.eurprd06.prod.outlook.com ([fe80::9c53:d10:400e:c71%5]) with mapi id 15.20.2115.005; Thu, 1 Aug 2019 16:51:19 +0000 From: "Diego R. Lopez" To: Stephen Farrell , Mikael Abrahamsson CC: Paul Wouters , ADD Mailing list , Ralf Weber , Alec Muffett Thread-Topic: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] Thread-Index: AQHVRBOF8j3sbj+H8U6AmZjx4etAGabemEMAgAAO7gCAACA1AIABBgcAgAAx2YCAAccgAIAABO0AgALs5ICAAEqUgIAAFY8AgAAY2wCAABS6gIAACREAgADPuwCAABT8AIAACQWAgAALpID///8YAA== Date: Thu, 1 Aug 2019 16:51:19 +0000 Message-ID: <3C2CBA87-F8AB-4F7D-8598-E650613A1847@telefonica.com> References: <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> <64bcfc51-6f3d-ae24-4de5-d0eb89975c66@cs.tcd.ie> <539D6F9D-137C-4F68-A8DE-EA3DFAF4D827@huitema.net> <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> In-Reply-To: <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.10.c.190715 authentication-results: spf=none (sender IP is ) smtp.mailfrom=diego.r.lopez@telefonica.com; x-originating-ip: [88.16.178.60] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 4dec5d55-d035-4d15-e5f9-08d716a07a2d x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(4618075)(2017052603328)(7193020); SRVR:DB3PR0602MB3690; x-ms-traffictypediagnostic: DB3PR0602MB3690: x-ms-exchange-purlcount: 1 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:6790; x-forefront-prvs: 01165471DB x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(4636009)(136003)(346002)(396003)(366004)(39860400002)(376002)(40134004)(199004)(189003)(296002)(786003)(316002)(4326008)(6506007)(186003)(2906002)(102836004)(26005)(76176011)(3846002)(6116002)(58126008)(45080400002)(110136005)(99286004)(54906003)(81166006)(6436002)(36756003)(81156014)(478600001)(966005)(14454004)(8936002)(6246003)(229853002)(8676002)(66066001)(25786009)(68736007)(33656002)(7736002)(6486002)(305945005)(53936002)(256004)(14444005)(71200400001)(71190400001)(446003)(66446008)(66574012)(64756008)(91956017)(2616005)(6306002)(5660300002)(76116006)(486006)(86362001)(476003)(6512007)(66946007)(66556008)(66476007)(11346002)(148743002); DIR:OUT; SFP:1102; SCL:1; SRVR:DB3PR0602MB3690; H:DB3PR0602MB3788.eurprd06.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: telefonica.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: 78zvn+9RRjJ4+LidashxVpRiF/lTw0b27I9oTNbVcBaQu8tT0zgFJ6uJMJe5ymQHiZ1exuV9zuwn0rfFi/5EIy/FCAhIGyjwnTOv+QYecyKtzoDOqxK9y14w8DkOBbyYgf2LYCNGwV1qoSo3RHcuF6nGyb5i36vA7RKjiCPVlZFNWcCkFwXMWJ/n489GwEgO74drTz9I2Zn587sjriRHO7ixnVagDkLDsSYdqo5dvh2nCbeBIWTotyyYZYEr3AFlgvb7JxhbRpmZ5LjSbK0pH2cRNqMa9eK0808pXTkXfxs1Bcy1MlHGfbE3nuhpXWyQCjuqn7gg4eSzoqRfaPtH1phk5U4lYa8aN2NbDDTCfyhP7yzErtbiMqMfo/c7DZ9uYDslzXKOMkfPE6g84aF6IpRzWU1Wwt7a4rAvAv8qOZ0= Content-Type: text/plain; charset="utf-8" Content-ID: <882E63F0B1161240A1C3A23D33016136@eurprd06.prod.outlook.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: telefonica.com X-MS-Exchange-CrossTenant-Network-Message-Id: 4dec5d55-d035-4d15-e5f9-08d716a07a2d X-MS-Exchange-CrossTenant-originalarrivaltime: 01 Aug 2019 16:51:19.5841 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 9744600e-3e04-492e-baa1-25ec245c6f10 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: diego.r.lopez@telefonica.com X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB3PR0602MB3690 Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 01 Aug 2019 16:51:28 -0000 SGksDQoNCu+7v09uIDAxLzA4LzIwMTksIDE0OjU1LCAiQWRkIG9uIGJlaGFsZiBvZiBTdGVwaGVu IEZhcnJlbGwiIDxhZGQtYm91bmNlc0BpZXRmLm9yZyBvbiBiZWhhbGYgb2Ygc3RlcGhlbi5mYXJy ZWxsQGNzLnRjZC5pZT4gd3JvdGU6DQoNCiAgICAoQ291bGQgZW5kIHVwIGEgYml0IHRoZW9yZXRp Y2FsIEkgZ3Vlc3MsIGJ1dCBJJ20gaW50ZXJlc3RlZA0KICAgIGluIHRoZSBnZW5lcmFsIHF1ZXN0 aW9uIG9mIHdoZXRoZXIgY29uc2lkZXJpbmcgYWJ1c2UtY2FzZXMNCiAgICBtaWdodCBoZWxwIGlu IHNpdHVhdGlvbnMgbGlrZSB0aGlzLikNCg0KSSBtdXN0IHNheSB0aGF0IHRoaXMgYW5hbHlzaXMg b2YgYWJ1c2UtY2FzZXMgc291bmRzIGxpa2UgYW4gaW50ZXJlc3Rpbmcgd2F5IHRvIGdvLCBhbmQg ZXZlbiBwcm9iYWJseSBiZWNvbWUgYSBmdXR1cmUgcHJhY3RpY2UgZm9yIHNlY3VyaXR5IGFuYWx5 c2lzLCBtdWNoIGxpa2UgY3VycmVudCB0aHJlYXQgbW9kZWxzLg0KDQotLQ0KIkVzdGEgdmV6IG5v IGZhbGxhcmVtb3MsIERvY3RvciBJbmZpZXJubyINCg0KRHIgRGllZ28gUi4gTG9wZXoNClRlbGVm b25pY2EgSStEDQpodHRwczovL3d3dy5saW5rZWRpbi5jb20vaW4vZHIybG9wZXovDQoNCmUtbWFp bDogZGllZ28uci5sb3BlekB0ZWxlZm9uaWNhLmNvbQ0KVGVsOiAgICAgICAgICszNCA5MTMgMTI5 IDA0MQ0KTW9iaWxlOiAgKzM0IDY4MiAwNTEgMDkxDQotLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tDQoNCg0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCg0KRXN0ZSBt ZW5zYWplIHkgc3VzIGFkanVudG9zIHNlIGRpcmlnZW4gZXhjbHVzaXZhbWVudGUgYSBzdSBkZXN0 aW5hdGFyaW8sIHB1ZWRlIGNvbnRlbmVyIGluZm9ybWFjacOzbiBwcml2aWxlZ2lhZGEgbyBjb25m aWRlbmNpYWwgeSBlcyBwYXJhIHVzbyBleGNsdXNpdm8gZGUgbGEgcGVyc29uYSBvIGVudGlkYWQg ZGUgZGVzdGluby4gU2kgbm8gZXMgdXN0ZWQuIGVsIGRlc3RpbmF0YXJpbyBpbmRpY2FkbywgcXVl ZGEgbm90aWZpY2FkbyBkZSBxdWUgbGEgbGVjdHVyYSwgdXRpbGl6YWNpw7NuLCBkaXZ1bGdhY2nD s24geS9vIGNvcGlhIHNpbiBhdXRvcml6YWNpw7NuIHB1ZWRlIGVzdGFyIHByb2hpYmlkYSBlbiB2 aXJ0dWQgZGUgbGEgbGVnaXNsYWNpw7NuIHZpZ2VudGUuIFNpIGhhIHJlY2liaWRvIGVzdGUgbWVu c2FqZSBwb3IgZXJyb3IsIGxlIHJvZ2Ftb3MgcXVlIG5vcyBsbyBjb211bmlxdWUgaW5tZWRpYXRh bWVudGUgcG9yIGVzdGEgbWlzbWEgdsOtYSB5IHByb2NlZGEgYSBzdSBkZXN0cnVjY2nDs24uDQoN ClRoZSBpbmZvcm1hdGlvbiBjb250YWluZWQgaW4gdGhpcyB0cmFuc21pc3Npb24gaXMgcHJpdmls ZWdlZCBhbmQgY29uZmlkZW50aWFsIGluZm9ybWF0aW9uIGludGVuZGVkIG9ubHkgZm9yIHRoZSB1 c2Ugb2YgdGhlIGluZGl2aWR1YWwgb3IgZW50aXR5IG5hbWVkIGFib3ZlLiBJZiB0aGUgcmVhZGVy IG9mIHRoaXMgbWVzc2FnZSBpcyBub3QgdGhlIGludGVuZGVkIHJlY2lwaWVudCwgeW91IGFyZSBo ZXJlYnkgbm90aWZpZWQgdGhhdCBhbnkgZGlzc2VtaW5hdGlvbiwgZGlzdHJpYnV0aW9uIG9yIGNv cHlpbmcgb2YgdGhpcyBjb21tdW5pY2F0aW9uIGlzIHN0cmljdGx5IHByb2hpYml0ZWQuIElmIHlv dSBoYXZlIHJlY2VpdmVkIHRoaXMgdHJhbnNtaXNzaW9uIGluIGVycm9yLCBkbyBub3QgcmVhZCBp dC4gUGxlYXNlIGltbWVkaWF0ZWx5IHJlcGx5IHRvIHRoZSBzZW5kZXIgdGhhdCB5b3UgaGF2ZSBy ZWNlaXZlZCB0aGlzIGNvbW11bmljYXRpb24gaW4gZXJyb3IgYW5kIHRoZW4gZGVsZXRlIGl0Lg0K DQpFc3RhIG1lbnNhZ2VtIGUgc2V1cyBhbmV4b3Mgc2UgZGlyaWdlbSBleGNsdXNpdmFtZW50ZSBh byBzZXUgZGVzdGluYXTDoXJpbywgcG9kZSBjb250ZXIgaW5mb3JtYcOnw6NvIHByaXZpbGVnaWFk YSBvdSBjb25maWRlbmNpYWwgZSDDqSBwYXJhIHVzbyBleGNsdXNpdm8gZGEgcGVzc29hIG91IGVu dGlkYWRlIGRlIGRlc3Rpbm8uIFNlIG7Do28gw6kgdm9zc2Egc2VuaG9yaWEgbyBkZXN0aW5hdMOh cmlvIGluZGljYWRvLCBmaWNhIG5vdGlmaWNhZG8gZGUgcXVlIGEgbGVpdHVyYSwgdXRpbGl6YcOn w6NvLCBkaXZ1bGdhw6fDo28gZS9vdSBjw7NwaWEgc2VtIGF1dG9yaXphw6fDo28gcG9kZSBlc3Rh ciBwcm9pYmlkYSBlbSB2aXJ0dWRlIGRhIGxlZ2lzbGHDp8OjbyB2aWdlbnRlLiBTZSByZWNlYmV1 IGVzdGEgbWVuc2FnZW0gcG9yIGVycm8sIHJvZ2Ftb3MtbGhlIHF1ZSBub3MgbyBjb211bmlxdWUg aW1lZGlhdGFtZW50ZSBwb3IgZXN0YSBtZXNtYSB2aWEgZSBwcm9jZWRhIGEgc3VhIGRlc3RydWnD p8Ojbw0K From nobody Thu Aug 1 10:59:24 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DB546120182 for ; Thu, 1 Aug 2019 10:59:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.355 X-Spam-Level: X-Spam-Status: No, score=-1.355 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, NORMAL_HTTP_TO_IP=0.001, NUMERIC_HTTP_ADDR=1.242, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wIrDP83wXpHm for ; Thu, 1 Aug 2019 10:59:17 -0700 (PDT) Received: from mx2.cira.ca (mx2.cira.ca [192.228.22.117]) by ietfa.amsl.com (Postfix) with ESMTP id 36AD712018C for ; Thu, 1 Aug 2019 10:59:17 -0700 (PDT) X-Virus-Scanned: by SpamTitan at cira.ca Authentication-Results: mx2.cira.ca; none Received: from CRP-EX16-02.CORP.CIRA.CA (10.2.36.121) by CRP-EX16-01.CORP.CIRA.CA (10.2.36.120) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.1531.3; Thu, 1 Aug 2019 13:59:12 -0400 Received: from CRP-EX16-02.CORP.CIRA.CA ([fe80::15c6:1482:4083:e9f7]) by CRP-EX16-02.CORP.CIRA.CA ([fe80::15c6:1482:4083:e9f7%13]) with mapi id 15.01.1531.010; Thu, 1 Aug 2019 13:59:12 -0400 From: Jacques Latour To: =?utf-8?B?w5NsYWZ1ciBHdcOwbXVuZHNzb24=?= , "Livingood, Jason" CC: "add@ietf.org" , Adam Roach Thread-Topic: [EXT] Re: [Add] meeting hum: should the IETF take up this work? Thread-Index: AQHVQaWUsOtY75RYHEWQSwVrGEsv2abZDCIAgAAELYCAATHegIAA+sKAgABopACACFt5gIABddGAgAEfF6A= Date: Thu, 1 Aug 2019 17:59:12 +0000 Message-ID: References: <8F094057-DFBC-4732-9DA4-BE46E7914C8A@rfc1035.com> <20190724165951.GB29051@laperouse.bortzmeyer.org> <821B448B-F7EA-46A5-837D-DA0E8C60643A@open-xchange.com> <488E2CE0-73D5-4B9E-A5AD-28FDCB95ED2A@cable.comcast.com> In-Reply-To: Accept-Language: en-CA, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [172.16.4.142] Content-Type: multipart/alternative; boundary="_000_a956c801f12745fb839f3a5394247002ciraca_" MIME-Version: 1.0 Archived-At: Subject: Re: [Add] [EXT] Re: meeting hum: should the IETF take up this work? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 01 Aug 2019 17:59:21 -0000 --_000_a956c801f12745fb839f3a5394247002ciraca_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 RnJvbSB0aGUgZGVwYXJ0bWVudCBvZiB0aGlzLWNvdWxkLWJlLWEtYmFkLWlkZWEgYW5kIHRoZSBk ZXBhcnRtZW50IG9mIG9tZy10aGlzLWdvZXMtYWdhaW5zdC1ldmVyeXRoaW5nLXdl4oCZcmUtdHJ5 aW5nLWRvLCBidXQgaGVyZSBpdCBnb2VzOiBhIERvSCBvcGVyYXRvciBzaG91bGQgaGF2ZSBhIHBv bGljeSB0byBibGFja2xpc3QgSVAgYWRkcmVzcyBhcyByZXF1ZXN0ZWQgYnkgdGhlIG5ldHdvcmsg b3BlcmF0b3IsIHNpbmNlIHdlIGNhbuKAmXQgZWZmZWN0aXZlbHkgYmxvY2sgRG9IIGF0IHRoZSBl ZGdlIG9mIHRoZSBlbnRlcnByaXNlIG5ldHdvcmssIGFuIGVudGVycHJpc2UgbmV0d29yayBzaG91 bGQgaGF2ZSB0aGUgYWJpbGl0eSB0byByZXF1ZXN0IHRoZSB3ZWxsIGJlaGF2ZWQgRG9IIHJlY3Vy c2l2ZSBvcGVyYXRvcnMgdG8gYmxvY2sgcmVxdWVzdHMgY29taW5nIGZyb20gdGhlaXIgbmV0d29y ayBJUCBhZGRyZXNzLiAgUGVyaGFwcyBoYXZlIHNvbWUgc29ydCBvZiB0cnVzdGVkIGNsZWFyaW5n IGhvdXNlIG9mIElQIGFkZHJlc3NlcyB0aGF0IHRoZSB3ZWxsIGJlaGF2ZWQgRG9IIHJlY3Vyc2l2 ZSBvcGVyYXRvcnMgc2hvdWxkIGJsYWNrbGlzdCBmcm9tLiBFbnRlcnByaXNlcyBjYW4gYmxvY2sg bm9uIHdlbGwgYmVoYXZpbmcgRG9IIHJlY3Vyc2l2ZSBvcGVyYXRvcnMuDQoNClNpbmNlIHRoZSBt YWpvciBwcm9ibGVtcyBvZiBEb0ggaXMgZm9yIGFsbCB0byB1bmRlcnN0YW5kIHRoZSBtdWx0aWRp bWVuc2lvbmFsIG1hdHJpeCBvZiBkZXBsb3ltZW50IG1vZGVscyB2cy4gdmFsdWUgcHJvcG9zaXRp b24gdnMuIHVzZXIgKHZhbnRhZ2UpIHBvaW50IG9mIHZpZXcsIGl04oCZcyBhbG1vc3QgaW1wb3Nz aWJsZSB0byBhc3Nlc3MgdGhlIHZhbHVlIHByb3Bvc2l0aW9uIG9mIHRoZSBhYm92ZSBleGFtcGxl IGFnYWluc3QgYWxsIHRoZSBjdXJyZW50bHkgcG9zc2libGUvYXZhaWxhYmxlIHNjZW5hcmlvcy4g QnV0IHdlIGtub3cgdGhhdCBEb0ggaGFzIGEgbmVnYXRpdmUgdmFsdWUgcHJvcG9zaXRpb24gZm9y IEVudGVycHJpc2VzLg0KDQpIb3cgZG8gd2UgdHVybiBEb0ggdG8gaGF2ZSBhIHBvc2l0aXZlIHZh bHVlIHByb3Bvc2l0aW9uIGZvciBFbnRlcnByaXNlPw0KDQpDYW4gRG9IIGhhdmUgcG9zaXRpdmUg dmFsdWUgcHJvcG9zaXRpb24gZm9yIGFsbCBzY2VuYXJpb3M/DQoNCldoYXQgYXJlIHRoZSBnYXBz IGFuZCBob3cgZG8gd2UgYWRkcmVzcyB0aGVtIG1ldGhvZGljYWxseT8NCg0KSmFjaw0KDQoNCkZy b206IEFkZCA8YWRkLWJvdW5jZXNAaWV0Zi5vcmc+IE9uIEJlaGFsZiBPZiDDk2xhZnVyIEd1w7Bt dW5kc3Nvbg0KU2VudDogSnVseSAzMSwgMjAxOSA0OjA3IFBNDQpUbzogTGl2aW5nb29kLCBKYXNv biA8SmFzb25fTGl2aW5nb29kQGNvbWNhc3QuY29tPg0KQ2M6IGFkZEBpZXRmLm9yZzsgQWRhbSBS b2FjaCA8YWRhbUBub3N0cnVtLmNvbT4NClN1YmplY3Q6IFtFWFRdIFJlOiBbQWRkXSBtZWV0aW5n IGh1bTogc2hvdWxkIHRoZSBJRVRGIHRha2UgdXAgdGhpcyB3b3JrPw0KDQpKYXNvbiwNCg0KT24g VHVlLCBKdWwgMzAsIDIwMTkgYXQgNTo0OSBQTSBMaXZpbmdvb2QsIEphc29uIDxKYXNvbl9MaXZp bmdvb2RAY29tY2FzdC5jb208bWFpbHRvOkphc29uX0xpdmluZ29vZEBjb21jYXN0LmNvbT4+IHdy b3RlOg0KT24gNy8yNS8xOSwgMTA6MTIgQU0sICJBZGQgb24gYmVoYWxmIG9mIEFkYW0gUm9hY2gi IDxhZGQtYm91bmNlc0BpZXRmLm9yZzxtYWlsdG86YWRkLWJvdW5jZXNAaWV0Zi5vcmc+IG9uIGJl aGFsZiBvZiBhZGFtQG5vc3RydW0uY29tPG1haWx0bzphZGFtQG5vc3RydW0uY29tPj4gd3JvdGU6 DQo+IFlvdSBjYW4gc2VlLCBmb3IgZXhhbXBsZSwgQ2xvdWRmbGFyZSdzIGFzc29jaWF0ZWQgcHJp dmFjeQ0KICAgIHBvbGljeSBhdCBodHRwczovL2RldmVsb3BlcnMuY2xvdWRmbGFyZS5jb20vMS4x LjEuMS9jb21taXRtZW50LXRvLXByaXZhY3kvcHJpdmFjeS1wb2xpY3kvZmlyZWZveC8NCg0KW0pM XSBUaGlzIHNwZWFrcyB0byB0aGUgRE5TIHF1ZXJ5L3Jlc3BvbnNlLiBCdXQgd2l0aCBEb0gsIHRo aXMgaXMgY29udGFpbmVkIGluc2lkZSBvZiBhbiBIVFRQIGVudmVsb3BlLCBzbyB0byBzcGVhaywg d2hpY2ggaGFzIG11Y2ggbW9yZSByaWNoIHRyYWNraW5nIC0gbm90ZWQgYXQgaHR0cHM6Ly93d3cu Y2xvdWRmbGFyZS5jb20vcHJpdmFjeXBvbGljeS8gdW5kZXIgd2Vic2l0ZSB2aXNpdG9ycyAod2hp Y2ggSSBwcmVzdW1lIGFwcGxpZXMgdG8gYWxsIEhUVFAgdHJhbnNhY3Rpb25zKS4gU28gdGhlIGNv bmZsdWVuY2Ugb2YgRE5TIGFuZCBIVFRQIGhlcmUgc2VlbXMgaW50ZXJlc3RpbmcgdG8gYmV0dGVy IHVuZGVyc3RhbmQgYW5kIGRvY3VtZW50IGFzIFRSUi1zdHlsZSBwb2xpY2llcyBldm9sdmUuIFNp bmNlIHRoZXJlIGlzIGFuIEhUVFAgc2VydmVyIGludm9sdmVkIGluIERvSCwgcHJlc3VtYWJseSBh bGwgdGhlIG5vcm1hbCBIVFRQIGxvZyBpdGVtcyBhcmUgc2VlbiAmIHByb2Nlc3NlZCBhbmQgY2Fu IGJlIGxvZ2dlZCwgbGlrZSB1c2VyIGFnZW50LCBjb29raWVzLCBhbmQgc28gb24uDQoNCkNsb3Vk ZmxhcmUgbW9kaWZpZWQgdGhlIEhUVFBTIHByb2Nlc3NpbmcgZm9yIERvSCByZXF1ZXN0cywgd2Ug ZGlkIHRoaXMgZm9yIHByaXZhY3ksIGVmZmljaWVuY3kgYW5kIHNwZWVkIHJlYXNvbnMuDQpUaGUg b3ZlcndyaXRpbmcgZ29hbCB3YXMgdG8gYmUgY29tcGxpYW50IHdpdGggdGhlIG91ciBwdWJsaWMg cG9saWNpZXMgYW5kIGNvbW1pdG1lbnRzLg0KQW55dGhpbmcgdGhhdCBtYXRjaGVzIGh0dHBzOi8v dG9vbHMuaWV0Zi5vcmcvaHRtbC9yZmM4NDg0I3NlY3Rpb24tNC4xPGh0dHBzOi8vdG9vbHMuaWV0 Zi4ub3JnL2h0bWwvcmZjODQ4NCNzZWN0aW9uLTQuMT4gZGVmaW5pdGlvbiBvZiBEb0ggcmVxdWVz dCBpcyBOT1QgbG9nZ2VkIGJ5IHRoZSBIVFRQUyBzZXJ2aWNlLCB3ZSB3aWxsIG9ubHkgcmVzcG9u ZCB0byBEb0ggcmVxdWVzdHMgb24gYSBkZWZpbmVkIGxpc3Qgb2YgRG9IIHNlcnZpY2UgbmFtZXMv YWRkcmVzc2VzLg0KDQpPdXIgRG9IIG1vZHVsZSBvbmx5IGNvdW50cyBjb25uZWN0aW9ucywgbm8g bG9nZ2luZyBvZiBjb250ZW50ICggbWFpbmx5IHRvIHZlcmlmeSB3ZSBkbyBub3QgZHJvcCBhbnl0 aGluZyBpbnRlcm5hbGx5KQ0KVGhlIEROUyAgcmVzb2x2ZXIgc3lzdGVtIGlzIHRoZSBvbmx5IG9u ZSB0aGF0IHdyaXRlcyB0byB0aGUgcmVzb2x2ZXIgbG9ncywgaXQgaXMgdW5hd2FyZSBvZiBhbnkg dXNlciBhZ2VudCBhbmQgb3RoZXIgSFRUUCB0aGluZ3MsDQoNClRoZXJlIGlzIG5vIHNldHRpbmcg b3IgcmVhZGluZyBvZiBjb29raWVzIGZyb20gb3VyIHNlcnZlcnMgKHlvdSBjYW4gY29uZmlybSB0 aGlzIGJ5IGRvaW5nIGEgcmVxdWVzdCBvbiB5b3Ugb3duKSwgbGlrZQ0KDQoNCmN1cmwgLS12ZXJi b3NlIC1IICdhY2NlcHQ6IGFwcGxpY2F0aW9uL2Rucy1qc29uJyAnaHR0cHM6Ly9jbG91ZGZsYXJl LWRucy5jb20vZG5zLXF1ZXJ5P25hbWU9Y29tY2FzdC5jb20mdHlwZT1BQUFBJw0KDQoNCltKTF0g SW4gYWRkaXRpb24sIEkgc3VzcGVjdCBhIGNvbmNlcm4gKGZvciB0aGUgdmVyeSBoaWdoIHNjYWxl IGNlbnRyYWxpc2VkIERvSCBwbGF0Zm9ybXMpIGlzIG5vdCBqdXN0IHRoZSBwZXItdXNlciBwcml2 YWN5IHBvbGljeSBidXQgYWxzbyB3aGF0IGFnZ3JlZ2F0ZWQgYnVzaW5lc3MgaW50ZWxsaWdlbmNl IGEgZ2xvYmFsIHNjYWxlIHBsYXRmb3JtIHdvdWxkIGJlIGFibGUgdG8gZGV2ZWxvcCAoZS5nLiBv ZiBhIHBvcHVsYXRpb24gb2YgNTAwTSB1c2VycywgaG93IG1hbnkgaGF2ZSBxdWVyaWVkIGZvciAq Lm5ldGZsaXguY29tPGh0dHA6Ly9uZXRmbGl4LmNvbT4gaW4gdGhlIHBhc3QgTiBob3VycywgYnkg Y291bnRyeSwgQVNOLCB1c2VyIGFnZW50LCBldGMuKSwgcmVsYXRpdmUgdG8gY29tcGV0aXRvcnMg b3IgcG90ZW50aWFsIGNvbXBldGl0b3JzLiBTbyBJIHN1c3BlY3QgdGhlc2UgY29uY2VybnMgbWF5 IGFyaXNlLCBhdCBsZWFzdCBmb3IgcGxhdGZvcm1zIG9mIHZlcnkgaGlnaCBzY2FsZSAvIHBlbmV0 cmF0aW9uLg0KDQpUaGlzIGlzIG5vdCB1bmlxdWUgdG8gRG9IIGluIGFueSB3YXkgb3Igc2hhcGUh DQpUaGlzIGlzIGNvbW1vbiB0byBhbGwgRE5TIHF1ZXJpZXMgYW5kIGhhdmluZyBhY2Nlc3MgdG8g cXVlcnkgc3RyZWFtcywgc28gZXZlcnkgRE5TIHByb3ZpZGVyIHNob3VsZCBhbnN3ZXIgaWYgdGhl eSBzaGFyZSBhbnkgRE5TIHF1ZXJ5IGRhdGEgYW5kIHdpdGggd2hvbSBhbmQgZm9yIHdoYXQgcHVy cG9zZS4NCkFueW9uZSB0aGF0IGhhcyBhY2Nlc3MgdG8gcXVlcnkgc3RyZWFtIGZyb20gb25lIG9m IHRoZSB0b3AgSVNQJ3MgaW4gYSBmZXcgY291bnRyaWVzIG1pZ2h0IGhhdmUgYmV0dGVyIHZpZXcg dGhhbiBsYXJnZSBQdWJsaWMgRE5TIFJlc29sdmVyLg0KDQpSZXN0YXRpbmcgQ2xvdWRmbGFyZSAx LjEuMS4xIGRhdGEgcG9saWN5OiBDbG91ZGZsYXJlIHdpbGwgbm90IHNoYXJlIGFueSBxdWVyeSBk YXRhIHdpdGggYW55b25lISEgUGVyIG91ciBhZ3JlZW1lbnQgd2l0aCBBcG5pYzsgdGhleSBoYXZl IGFjY2VzcyB0byBzdWJzZXQgUmVzb2x2ZXIgb2YgbG9ncyBmb3IgdGhlIGxhc3QgMjQgaG91cnMg b25seSBkYXRhIHRoYXQgYXJyaXZlZCBvbiB0aGUgMS54LnguMSBhZGRyZXNzZXMsIHRoZXkgZG8g bm90IGEgaGF2ZSBhY2Nlc3MgdG8gZGF0YSBzZW50IGJ5IEZpcmVmb3ggdXNlcnMgdW5sZXNzIHRo ZSB1c2VyIG1vZGlmaWVkIHRoZSBVUkwgdG8gImh0dHBzOi8vMS4xLjEuMS9kbnMtcXVlcnkiLg0K Q2xvdWRmbGFyZSB3aWxsIG5vdCB1c2UgdGhlIHF1ZXJ5IGRhdGEgZm9yIGFueXRoaW5nIG90aGVy IHRoYW4gdG8gaW1wcm92ZSB0aGUgc2VydmljZS4gQ2xvdWRmbGFyZSBrZWVwcyB0cmFmZmljIGFn Z3JlZ2F0aW9ucyBhbmQgbWF5IHNoYXJlIHRob3NlIHB1YmxpY2x5IGZyb20gdGltZSB0byB0aW1l Lg0KDQpDbG91ZGZsYXJlIGlzIGZ1bGx5IGNvbXBsaWFudCB0aGUgcG9saWN5IHRoYXQgRmlyZWZv eCBoYXMgcHVibGlzaGVkIEFORCB0aGV5IGhhdmUgTk8gYWNjZXNzIHRvIHF1ZXJ5IGRhdGENCi0t DQrDk2xhZnVyIEd1ZG11bmRzc29uIHwgRW5naW5lZXJpbmcgRGlyZWN0b3INCnd3dy5jbG91ZGZs YXJlLmNvbTxodHRwOi8vd3d3LmNsb3VkZmxhcmUuY29tPiBibG9nLmNsb3VkZmxhcmUuY29tPGh0 dHA6Ly9ibG9nLmNsb3VkZmxhcmUuY29tPg0K --_000_a956c801f12745fb839f3a5394247002ciraca_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6eD0idXJuOnNjaGVtYXMtbWljcm9z b2Z0LWNvbTpvZmZpY2U6ZXhjZWwiIHhtbG5zOm09Imh0dHA6Ly9zY2hlbWFzLm1pY3Jvc29mdC5j b20vb2ZmaWNlLzIwMDQvMTIvb21tbCIgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnL1RSL1JFQy1o dG1sNDAiPg0KPGhlYWQ+DQo8bWV0YSBodHRwLWVxdWl2PSJDb250ZW50LVR5cGUiIGNvbnRlbnQ9 InRleHQvaHRtbDsgY2hhcnNldD11dGYtOCI+DQo8bWV0YSBuYW1lPSJHZW5lcmF0b3IiIGNvbnRl bnQ9Ik1pY3Jvc29mdCBXb3JkIDE1IChmaWx0ZXJlZCBtZWRpdW0pIj4NCjxzdHlsZT48IS0tDQov KiBGb250IERlZmluaXRpb25zICovDQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OiJDYW1icmlh IE1hdGgiOw0KCXBhbm9zZS0xOjIgNCA1IDMgNSA0IDYgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtm b250LWZhbWlseTpDYWxpYnJpOw0KCXBhbm9zZS0xOjIgMTUgNSAyIDIgMiA0IDMgMiA0O30NCkBm b250LWZhY2UNCgl7Zm9udC1mYW1pbHk6TWVubG87DQoJcGFub3NlLTE6MCAwIDAgMCAwIDAgMCAw IDAgMDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWwsIGxpLk1zb05vcm1h bCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGNtOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsN Cglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iLHNlcmlm O30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0K CWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQphOnZpc2l0ZWQsIHNw YW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9y OnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCnAubXNvbm9ybWFsMCwgbGku bXNvbm9ybWFsMCwgZGl2Lm1zb25vcm1hbDANCgl7bXNvLXN0eWxlLW5hbWU6bXNvbm9ybWFsOw0K CW1zby1tYXJnaW4tdG9wLWFsdDphdXRvOw0KCW1hcmdpbi1yaWdodDowY207DQoJbXNvLW1hcmdp bi1ib3R0b20tYWx0OmF1dG87DQoJbWFyZ2luLWxlZnQ6MGNtOw0KCWZvbnQtc2l6ZToxMi4wcHQ7 DQoJZm9udC1mYW1pbHk6IlRpbWVzIE5ldyBSb21hbiIsc2VyaWY7fQ0KcC5tMjIyMzQ5MDUxMDg3 MjYwNjcwNG02NTUxODQyMzAyNzg5NTM2Njk5bTg0NDI1NDQ5MTQyODI2MjQ4NDFnbWFpbC1wMSwg bGkubTIyMjM0OTA1MTA4NzI2MDY3MDRtNjU1MTg0MjMwMjc4OTUzNjY5OW04NDQyNTQ0OTE0Mjgy NjI0ODQxZ21haWwtcDEsIGRpdi5tMjIyMzQ5MDUxMDg3MjYwNjcwNG02NTUxODQyMzAyNzg5NTM2 Njk5bTg0NDI1NDQ5MTQyODI2MjQ4NDFnbWFpbC1wMQ0KCXttc28tc3R5bGUtbmFtZTptXzIyMjM0 OTA1MTA4NzI2MDY3MDRtXzY1NTE4NDIzMDI3ODk1MzY2OTltXzg0NDI1NDQ5MTQyODI2MjQ4NDFn bWFpbC1wMTsNCgltc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGNtOw0K CW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBjbTsNCglmb250LXNp emU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iLHNlcmlmO30NCnNwYW4u bTIyMjM0OTA1MTA4NzI2MDY3MDRtNjU1MTg0MjMwMjc4OTUzNjY5OW04NDQyNTQ0OTE0MjgyNjI0 ODQxZ21haWwtczENCgl7bXNvLXN0eWxlLW5hbWU6bV8yMjIzNDkwNTEwODcyNjA2NzA0bV82NTUx ODQyMzAyNzg5NTM2Njk5bV84NDQyNTQ0OTE0MjgyNjI0ODQxZ21haWwtczE7fQ0Kc3Bhbi5FbWFp bFN0eWxlMjANCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWwtcmVwbHk7DQoJZm9udC1mYW1pbHk6 IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6IzFGNDk3RDt9DQouTXNvQ2hwRGVmYXVsdA0K CXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fu cy1zZXJpZjsNCgltc28tZmFyZWFzdC1sYW5ndWFnZTpFTi1VUzt9DQpAcGFnZSBXb3JkU2VjdGlv bjENCgl7c2l6ZTo2MTIuMHB0IDc5Mi4wcHQ7DQoJbWFyZ2luOjcyLjBwdCA3Mi4wcHQgNzIuMHB0 IDcyLjBwdDt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi0tPjwv c3R5bGU+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWRlZmF1bHRzIHY6ZXh0PSJl ZGl0IiBzcGlkbWF4PSIxMDI2IiAvPg0KPC94bWw+PCFbZW5kaWZdLS0+PCEtLVtpZiBndGUgbXNv IDldPjx4bWw+DQo8bzpzaGFwZWxheW91dCB2OmV4dD0iZWRpdCI+DQo8bzppZG1hcCB2OmV4dD0i ZWRpdCIgZGF0YT0iMSIgLz4NCjwvbzpzaGFwZWxheW91dD48L3htbD48IVtlbmRpZl0tLT4NCjwv aGVhZD4NCjxib2R5IGxhbmc9IkVOLUNBIiBsaW5rPSJibHVlIiB2bGluaz0icHVycGxlIj4NCjxk aXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5 N0Q7bXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVMiPkZyb20gdGhlIGRlcGFydG1lbnQgb2YgdGhp cy1jb3VsZC1iZS1hLWJhZC1pZGVhIGFuZCB0aGUgZGVwYXJ0bWVudCBvZiBvbWctdGhpcy1nb2Vz LWFnYWluc3QtZXZlcnl0aGluZy13ZeKAmXJlLXRyeWluZy1kbywgYnV0IGhlcmUgaXQgZ29lczog YSBEb0ggb3BlcmF0b3INCiBzaG91bGQgaGF2ZSBhIHBvbGljeSB0byBibGFja2xpc3QgSVAgYWRk cmVzcyBhcyByZXF1ZXN0ZWQgYnkgdGhlIG5ldHdvcmsgb3BlcmF0b3IsIHNpbmNlIHdlIGNhbuKA mXQgZWZmZWN0aXZlbHkgYmxvY2sgRG9IIGF0IHRoZSBlZGdlIG9mIHRoZSBlbnRlcnByaXNlIG5l dHdvcmssIGFuIGVudGVycHJpc2UgbmV0d29yayBzaG91bGQgaGF2ZSB0aGUgYWJpbGl0eSB0byBy ZXF1ZXN0IHRoZSB3ZWxsIGJlaGF2ZWQgRG9IIHJlY3Vyc2l2ZSBvcGVyYXRvcnMNCiB0byBibG9j ayByZXF1ZXN0cyBjb21pbmcgZnJvbSB0aGVpciBuZXR3b3JrIElQIGFkZHJlc3MuJm5ic3A7IFBl cmhhcHMgaGF2ZSBzb21lIHNvcnQgb2YgdHJ1c3RlZCBjbGVhcmluZyBob3VzZSBvZiBJUCBhZGRy ZXNzZXMgdGhhdCB0aGUgd2VsbCBiZWhhdmVkIERvSCByZWN1cnNpdmUgb3BlcmF0b3JzIHNob3Vs ZCBibGFja2xpc3QgZnJvbS4gRW50ZXJwcmlzZXMgY2FuIGJsb2NrIG5vbiB3ZWxsIGJlaGF2aW5n IERvSCByZWN1cnNpdmUgb3BlcmF0b3JzLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7 LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RDttc28tZmFyZWFzdC1sYW5ndWFnZTpFTi1VUyI+PG86 cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0 OTdEO21zby1mYXJlYXN0LWxhbmd1YWdlOkVOLVVTIj5TaW5jZSB0aGUgbWFqb3IgcHJvYmxlbXMg b2YgRG9IIGlzIGZvciBhbGwgdG8gdW5kZXJzdGFuZCB0aGUgbXVsdGlkaW1lbnNpb25hbCBtYXRy aXggb2YgZGVwbG95bWVudCBtb2RlbHMgdnMuIHZhbHVlIHByb3Bvc2l0aW9uIHZzLiB1c2VyICh2 YW50YWdlKSBwb2ludA0KIG9mIHZpZXcsIGl04oCZcyBhbG1vc3QgaW1wb3NzaWJsZSB0byBhc3Nl c3MgdGhlIHZhbHVlIHByb3Bvc2l0aW9uIG9mIHRoZSBhYm92ZSBleGFtcGxlIGFnYWluc3QgYWxs IHRoZSBjdXJyZW50bHkgcG9zc2libGUvYXZhaWxhYmxlIHNjZW5hcmlvcy4gQnV0IHdlIGtub3cg dGhhdCBEb0ggaGFzIGEgbmVnYXRpdmUgdmFsdWUgcHJvcG9zaXRpb24gZm9yIEVudGVycHJpc2Vz LjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3 RDttc28tZmFyZWFzdC1sYW5ndWFnZTpFTi1VUyI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0Nh bGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEO21zby1mYXJlYXN0LWxhbmd1YWdl OkVOLVVTIj5Ib3cgZG8gd2UgdHVybiBEb0ggdG8gaGF2ZSBhIHBvc2l0aXZlIHZhbHVlIHByb3Bv c2l0aW9uIGZvciBFbnRlcnByaXNlPzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNh bnMtc2VyaWY7Y29sb3I6IzFGNDk3RDttc28tZmFyZWFzdC1sYW5ndWFnZTpFTi1VUyI+PG86cD4m bmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdE O21zby1mYXJlYXN0LWxhbmd1YWdlOkVOLVVTIj5DYW4gRG9IIGhhdmUgcG9zaXRpdmUgdmFsdWUg cHJvcG9zaXRpb24gZm9yIGFsbCBzY2VuYXJpb3M/DQo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJy aSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0Q7bXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4t VVMiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29s b3I6IzFGNDk3RDttc28tZmFyZWFzdC1sYW5ndWFnZTpFTi1VUyI+V2hhdCBhcmUgdGhlIGdhcHMg YW5kIGhvdyBkbyB3ZSBhZGRyZXNzIHRoZW0gbWV0aG9kaWNhbGx5PzxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVv dDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RDttc28tZmFyZWFzdC1sYW5n dWFnZTpFTi1VUyI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2Fs aWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0Q7bXNvLWZhcmVhc3QtbGFuZ3VhZ2U6 RU4tVVMiPkphY2s8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1 b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RDttc28tZmFyZWFzdC1sYW5ndWFnZTpFTi1VUyI+ PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90Oyxz YW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0Q7bXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVMiPjxvOnA+ Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1s ZWZ0OnNvbGlkIGJsdWUgMS41cHQ7cGFkZGluZzowY20gMGNtIDBjbSA0LjBwdCI+DQo8ZGl2Pg0K PGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjRTFFMUUxIDEuMHB0O3Bh ZGRpbmc6My4wcHQgMGNtIDBjbSAwY20iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNwYW4g bGFuZz0iRU4tVVMiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0Nh bGlicmkmcXVvdDssc2Fucy1zZXJpZiI+RnJvbTo8L3NwYW4+PC9iPjxzcGFuIGxhbmc9IkVOLVVT IiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7 LHNhbnMtc2VyaWYiPiBBZGQgJmx0O2FkZC1ib3VuY2VzQGlldGYub3JnJmd0Ow0KPGI+T24gQmVo YWxmIE9mIDwvYj7Dk2xhZnVyIEd1w7BtdW5kc3Nvbjxicj4NCjxiPlNlbnQ6PC9iPiBKdWx5IDMx LCAyMDE5IDQ6MDcgUE08YnI+DQo8Yj5Ubzo8L2I+IExpdmluZ29vZCwgSmFzb24gJmx0O0phc29u X0xpdmluZ29vZEBjb21jYXN0LmNvbSZndDs8YnI+DQo8Yj5DYzo8L2I+IGFkZEBpZXRmLm9yZzsg QWRhbSBSb2FjaCAmbHQ7YWRhbUBub3N0cnVtLmNvbSZndDs8YnI+DQo8Yj5TdWJqZWN0OjwvYj4g W0VYVF0gUmU6IFtBZGRdIG1lZXRpbmcgaHVtOiBzaG91bGQgdGhlIElFVEYgdGFrZSB1cCB0aGlz IHdvcms/PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj5KYXNvbiwmbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPk9uIFR1ZSwgSnVsIDMwLCAyMDE5IGF0IDU6NDkgUE0gTGl2aW5nb29kLCBK YXNvbiAmbHQ7PGEgaHJlZj0ibWFpbHRvOkphc29uX0xpdmluZ29vZEBjb21jYXN0LmNvbSIgdGFy Z2V0PSJfYmxhbmsiPkphc29uX0xpdmluZ29vZEBjb21jYXN0LmNvbTwvYT4mZ3Q7IHdyb3RlOjxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9y ZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBwdDtwYWRkaW5nOjBjbSAwY20gMGNtIDYuMHB0O21h cmdpbi1sZWZ0OjQuOHB0O21hcmdpbi1yaWdodDowY20iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ T24gNy8yNS8xOSwgMTA6MTIgQU0sICZxdW90O0FkZCBvbiBiZWhhbGYgb2YgQWRhbSBSb2FjaCZx dW90OyAmbHQ7PGEgaHJlZj0ibWFpbHRvOmFkZC1ib3VuY2VzQGlldGYub3JnIiB0YXJnZXQ9Il9i bGFuayI+YWRkLWJvdW5jZXNAaWV0Zi5vcmc8L2E+IG9uIGJlaGFsZiBvZg0KPGEgaHJlZj0ibWFp bHRvOmFkYW1Abm9zdHJ1bS5jb20iIHRhcmdldD0iX2JsYW5rIj5hZGFtQG5vc3RydW0uY29tPC9h PiZndDsgd3JvdGU6PGJyPg0KJmd0OyBZb3UgY2FuIHNlZSwgZm9yIGV4YW1wbGUsIENsb3VkZmxh cmUncyBhc3NvY2lhdGVkIHByaXZhY3kgPGJyPg0KJm5ic3A7ICZuYnNwOyBwb2xpY3kgYXQgPGEg aHJlZj0iaHR0cHM6Ly9kZXZlbG9wZXJzLmNsb3VkZmxhcmUuY29tLzEuMS4xLjEvY29tbWl0bWVu dC10by1wcml2YWN5L3ByaXZhY3ktcG9saWN5L2ZpcmVmb3gvIiB0YXJnZXQ9Il9ibGFuayI+DQpo dHRwczovL2RldmVsb3BlcnMuY2xvdWRmbGFyZS5jb20vMS4xLjEuMS9jb21taXRtZW50LXRvLXBy aXZhY3kvcHJpdmFjeS1wb2xpY3kvZmlyZWZveC88L2E+DQo8YnI+DQo8YnI+DQpbSkxdIFRoaXMg c3BlYWtzIHRvIHRoZSBETlMgcXVlcnkvcmVzcG9uc2UuIEJ1dCB3aXRoIERvSCwgdGhpcyBpcyBj b250YWluZWQgaW5zaWRlIG9mIGFuIEhUVFAgZW52ZWxvcGUsIHNvIHRvIHNwZWFrLCB3aGljaCBo YXMgbXVjaCBtb3JlIHJpY2ggdHJhY2tpbmcgLSBub3RlZCBhdA0KPGEgaHJlZj0iaHR0cHM6Ly93 d3cuY2xvdWRmbGFyZS5jb20vcHJpdmFjeXBvbGljeS8iIHRhcmdldD0iX2JsYW5rIj5odHRwczov L3d3dy5jbG91ZGZsYXJlLmNvbS9wcml2YWN5cG9saWN5LzwvYT4gdW5kZXIgd2Vic2l0ZSB2aXNp dG9ycyAod2hpY2ggSSBwcmVzdW1lIGFwcGxpZXMgdG8gYWxsIEhUVFAgdHJhbnNhY3Rpb25zKS4g U28gdGhlIGNvbmZsdWVuY2Ugb2YgRE5TIGFuZCBIVFRQIGhlcmUgc2VlbXMgaW50ZXJlc3Rpbmcg dG8gYmV0dGVyIHVuZGVyc3RhbmQNCiBhbmQgZG9jdW1lbnQgYXMgVFJSLXN0eWxlIHBvbGljaWVz IGV2b2x2ZS4gU2luY2UgdGhlcmUgaXMgYW4gSFRUUCBzZXJ2ZXIgaW52b2x2ZWQgaW4gRG9ILCBw cmVzdW1hYmx5IGFsbCB0aGUgbm9ybWFsIEhUVFAgbG9nIGl0ZW1zIGFyZSBzZWVuICZhbXA7IHBy b2Nlc3NlZCBhbmQgY2FuIGJlIGxvZ2dlZCwgbGlrZSB1c2VyIGFnZW50LCBjb29raWVzLCBhbmQg c28gb24uPG86cD48L286cD48L3A+DQo8L2Jsb2NrcXVvdGU+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj5DbG91ZGZsYXJlIG1vZGlmaWVkIHRoZSBIVFRQUyBwcm9jZXNzaW5nIGZvciBE b0ggcmVxdWVzdHMsIHdlIGRpZCB0aGlzIGZvciBwcml2YWN5LCBlZmZpY2llbmN5IGFuZCBzcGVl ZCByZWFzb25zLiZuYnNwOzxicj4NClRoZSBvdmVyd3JpdGluZyBnb2FsIHdhcyB0byBiZSBjb21w bGlhbnQgd2l0aCB0aGUgb3VyIHB1YmxpYyBwb2xpY2llcyBhbmQgY29tbWl0bWVudHMuJm5ic3A7 PGJyPg0KQW55dGhpbmcgdGhhdCBtYXRjaGVzJm5ic3A7PGEgaHJlZj0iaHR0cHM6Ly90b29scy5p ZXRmLi5vcmcvaHRtbC9yZmM4NDg0I3NlY3Rpb24tNC4xIiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6 Ly90b29scy5pZXRmLm9yZy9odG1sL3JmYzg0ODQjc2VjdGlvbi00LjE8L2E+Jm5ic3A7ZGVmaW5p dGlvbiBvZiBEb0ggcmVxdWVzdCBpcyBOT1QgbG9nZ2VkIGJ5IHRoZSBIVFRQUyBzZXJ2aWNlLCB3 ZSB3aWxsIG9ubHkgcmVzcG9uZCB0byBEb0ggcmVxdWVzdHMgb24gYSBkZWZpbmVkDQogbGlzdCBv ZiBEb0ggc2VydmljZSBuYW1lcy9hZGRyZXNzZXMuJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk91ciBEb0ggbW9kdWxlIG9ubHkgY291 bnRzIGNvbm5lY3Rpb25zLCBubyBsb2dnaW5nIG9mIGNvbnRlbnQgKCBtYWlubHkgdG8gdmVyaWZ5 IHdlIGRvIG5vdCBkcm9wIGFueXRoaW5nIGludGVybmFsbHkpJm5ic3A7PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5UaGUgRE5TJm5ic3A7IHJlc29s dmVyIHN5c3RlbSBpcyB0aGUgb25seSBvbmUgdGhhdCB3cml0ZXMgdG8gdGhlIHJlc29sdmVyIGxv Z3MsIGl0IGlzIHVuYXdhcmUgb2YgYW55IHVzZXIgYWdlbnQgYW5kIG90aGVyIEhUVFAgdGhpbmdz LCZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj5UaGVyZSBpcyBubyBzZXR0aW5nIG9yIHJlYWRpbmcgb2YgY29va2llcyBmcm9tIG91ciBz ZXJ2ZXJzICh5b3UgY2FuIGNvbmZpcm0gdGhpcyBieSBkb2luZyBhIHJlcXVlc3Qgb24geW91IG93 biksIGxpa2UmbmJzcDs8YnI+DQo8YnI+DQo8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJtMjIy MzQ5MDUxMDg3MjYwNjcwNG02NTUxODQyMzAyNzg5NTM2Njk5bTg0NDI1NDQ5MTQyODI2MjQ4NDFn bWFpbC1wMSIgc3R5bGU9Im1hcmdpbjowY207bWFyZ2luLWJvdHRvbTouMDAwMXB0Ij4NCjxzcGFu IGNsYXNzPSJtMjIyMzQ5MDUxMDg3MjYwNjcwNG02NTUxODQyMzAyNzg5NTM2Njk5bTg0NDI1NDQ5 MTQyODI2MjQ4NDFnbWFpbC1zMSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS41cHQ7Zm9udC1m YW1pbHk6JnF1b3Q7TWVubG8mcXVvdDssc2VyaWY7Y29sb3I6YmxhY2siPmN1cmwgLS12ZXJib3Nl IC1IICdhY2NlcHQ6IGFwcGxpY2F0aW9uL2Rucy1qc29uJyAnPGEgaHJlZj0iaHR0cHM6Ly9jbG91 ZGZsYXJlLWRucy5jb20vZG5zLXF1ZXJ5P25hbWU9Y29tY2FzdC5jb20mYW1wO3R5cGU9QUFBQSIg dGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vY2xvdWRmbGFyZS1kbnMuY29tL2Rucy1xdWVyeT9uYW1l PWNvbWNhc3QuY29tJmFtcDt0eXBlPUFBQUE8L2E+Jzwvc3Bhbj48L3NwYW4+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS41cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7TWVubG8mcXVvdDssc2VyaWY7Y29s b3I6YmxhY2siPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8YmxvY2txdW90ZSBz dHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBwdDtwYWRkaW5n OjBjbSAwY20gMGNtIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi1yaWdodDowY20iPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1ib3R0b206MTIuMHB0Ij48YnI+DQpb SkxdIEluIGFkZGl0aW9uLCBJIHN1c3BlY3QgYSBjb25jZXJuIChmb3IgdGhlIHZlcnkgaGlnaCBz Y2FsZSBjZW50cmFsaXNlZCBEb0ggcGxhdGZvcm1zKSBpcyBub3QganVzdCB0aGUgcGVyLXVzZXIg cHJpdmFjeSBwb2xpY3kgYnV0IGFsc28gd2hhdCBhZ2dyZWdhdGVkIGJ1c2luZXNzIGludGVsbGln ZW5jZSBhIGdsb2JhbCBzY2FsZSBwbGF0Zm9ybSB3b3VsZCBiZSBhYmxlIHRvIGRldmVsb3AgKGUu Zy4gb2YgYSBwb3B1bGF0aW9uIG9mIDUwME0gdXNlcnMsDQogaG93IG1hbnkgaGF2ZSBxdWVyaWVk IGZvciAqLjxhIGhyZWY9Imh0dHA6Ly9uZXRmbGl4LmNvbSIgdGFyZ2V0PSJfYmxhbmsiPm5ldGZs aXguY29tPC9hPiBpbiB0aGUgcGFzdCBOIGhvdXJzLCBieSBjb3VudHJ5LCBBU04sIHVzZXIgYWdl bnQsIGV0Yy4pLCByZWxhdGl2ZSB0byBjb21wZXRpdG9ycyBvciBwb3RlbnRpYWwgY29tcGV0aXRv cnMuIFNvIEkgc3VzcGVjdCB0aGVzZSBjb25jZXJucyBtYXkgYXJpc2UsIGF0IGxlYXN0IGZvciBw bGF0Zm9ybXMNCiBvZiB2ZXJ5IGhpZ2ggc2NhbGUgLyBwZW5ldHJhdGlvbi4mbmJzcDsgPG86cD48 L286cD48L3A+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxi ciBjbGVhcj0iYWxsIj4NCjxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPlRoaXMgaXMgbm90IHVuaXF1ZSB0byBEb0ggaW4gYW55IHdheSBvciBzaGFwZSE8bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlRoaXMgaXMgY29t bW9uIHRvIGFsbCBETlMgcXVlcmllcyBhbmQgaGF2aW5nIGFjY2VzcyB0byBxdWVyeSBzdHJlYW1z LCBzbyBldmVyeSBETlMgcHJvdmlkZXIgc2hvdWxkIGFuc3dlciBpZiB0aGV5IHNoYXJlIGFueSBE TlMgcXVlcnkgZGF0YSBhbmQgd2l0aCB3aG9tIGFuZCBmb3Igd2hhdCBwdXJwb3NlLiZuYnNwOzxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+QW55b25l IHRoYXQgaGFzIGFjY2VzcyB0byBxdWVyeSBzdHJlYW0gZnJvbSBvbmUgb2YgdGhlIHRvcCBJU1An cyBpbiBhIGZldyBjb3VudHJpZXMgbWlnaHQgaGF2ZSBiZXR0ZXIgdmlldyB0aGFuIGxhcmdlIFB1 YmxpYyBETlMgUmVzb2x2ZXIuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPlJlc3RhdGluZyBDbG91ZGZsYXJlIDEuMS4xLjEgZGF0YSBwb2xpY3k6 IENsb3VkZmxhcmUgd2lsbCBub3Qgc2hhcmUgYW55IHF1ZXJ5IGRhdGEgd2l0aCBhbnlvbmUhISBQ ZXIgb3VyIGFncmVlbWVudCB3aXRoIEFwbmljOyB0aGV5IGhhdmUgYWNjZXNzIHRvIHN1YnNldCBS ZXNvbHZlciBvZiBsb2dzIGZvciB0aGUgbGFzdCAyNCBob3VycyBvbmx5IGRhdGEgdGhhdCBhcnJp dmVkIG9uIHRoZSAxLngueC4xIGFkZHJlc3NlcywNCiB0aGV5IGRvIG5vdCBhIGhhdmUgYWNjZXNz IHRvIGRhdGEgc2VudCBieSBGaXJlZm94IHVzZXJzIHVubGVzcyB0aGUgdXNlciBtb2RpZmllZCB0 aGUgVVJMIHRvJm5ic3A7PGk+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1 b3Q7LHNhbnMtc2VyaWYiPiZxdW90Ozwvc3Bhbj48L2k+PGk+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS41cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpi bGFjayI+PGEgaHJlZj0iaHR0cHM6Ly8xLjEuMS4xL2Rucy1xdWVyeSIgdGFyZ2V0PSJfYmxhbmsi Pmh0dHBzOi8vMS4xLjEuMS9kbnMtcXVlcnk8L2E+JnF1b3Q7Ljwvc3Bhbj48L2k+PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5DbG91ZGZsYXJlIHdp bGwgbm90IHVzZSB0aGUgcXVlcnkgZGF0YSBmb3IgYW55dGhpbmcgb3RoZXIgdGhhbiB0byBpbXBy b3ZlIHRoZSBzZXJ2aWNlLiBDbG91ZGZsYXJlIGtlZXBzIHRyYWZmaWMgYWdncmVnYXRpb25zIGFu ZCBtYXkgc2hhcmUgdGhvc2UgcHVibGljbHkgZnJvbSB0aW1lIHRvIHRpbWUuJm5ic3A7PG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNw OzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkNsb3VkZmxh cmUgaXMgZnVsbHkgY29tcGxpYW50IHRoZSBwb2xpY3kgdGhhdCBGaXJlZm94IGhhcyBwdWJsaXNo ZWQgQU5EIHRoZXkgaGF2ZSBOTyBhY2Nlc3MgdG8gcXVlcnkgZGF0YSZuYnNwOzxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4tLSA8bzpwPjwvbzpwPjwvcD4NCjxk aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+w5NsYWZ1ciBHdWRtdW5kc3NvbiB8Jm5i c3A7PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjVwdCI+RW5naW5lZXJpbmcgRGlyZWN0b3ImbmJz cDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjVwdCI+PGEgaHJlZj0iaHR0cDovL3d3dy5jbG91ZGZsYXJl LmNvbSIgdGFyZ2V0PSJfYmxhbmsiPnd3dy5jbG91ZGZsYXJlLmNvbTwvYT4NCjxhIGhyZWY9Imh0 dHA6Ly9ibG9nLmNsb3VkZmxhcmUuY29tIiB0YXJnZXQ9Il9ibGFuayI+YmxvZy5jbG91ZGZsYXJl LmNvbTwvYT48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8 L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_a956c801f12745fb839f3a5394247002ciraca_-- From nobody Thu Aug 1 11:31:16 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C5E151201D0 for ; Thu, 1 Aug 2019 11:31:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4o99nzq-Inji for ; Thu, 1 Aug 2019 11:31:13 -0700 (PDT) Received: from mail-ua1-x934.google.com (mail-ua1-x934.google.com [IPv6:2607:f8b0:4864:20::934]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5B5A7120168 for ; Thu, 1 Aug 2019 11:31:13 -0700 (PDT) Received: by mail-ua1-x934.google.com with SMTP id z13so28737231uaa.4 for ; Thu, 01 Aug 2019 11:31:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=sLLSxmWLXGbvfMVFn8jnKn/uXxDZiiP3FIJ/Ukm04zg=; b=DM6jWLEXGGF5Wcb+WagMVEQWW6DrE0IpbAkS4VPdEELl+eJOaZUmUc0t4gMTAHT10G QjtqvxnrsIZYKmvPGs5C11WKQsIQBkmB4X8rL653QiMIZuT5GWq8lc0ZCs9E+x4AGMVX b/EvmZKt0UrpYfFimw/7AsAtaqlZgRTsYsslV8fSVqKv2qKTPwfA+iONrU20SqDPQKVz /lAg/rbLqhnw5442jPe6bF0voEk1oJN5Cnvh7rDbfnQPzqM2PJ9BGTPyC7eSxW9tVYqn beRCgZqSmmXKI3oENPTPbDeFcejephPNkaGfaPlKtXCwNEeBi6jxgn3vkPx8P27FB2Tt k5DA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=sLLSxmWLXGbvfMVFn8jnKn/uXxDZiiP3FIJ/Ukm04zg=; b=aZcVn/sqqQpLN/NpKbMEoaAQhvuKh7Cd07hK4McX6Wwdwa4QZlVABJIRhbVHI3gEkV jizCMioKKeaGsBKhG4jqh3V1QRGUpaLpEjaZHsawe6FUPwrI+wUDfzFl4TM4X1ctVby4 VHkifAm3Tctfnpf3DPVYa/EX70gNvQDra6plszOV/orj7ovZyznU+woznd70KuxitUGW MhKFNlOzLXW1CAo4krx6jHAx5k+vPsEHR7rY/Z094TmzGi2or5wiuFZl3yHqe3twwU+b Qp4z8FeUMXQv3Tjla8/AAA3JkOwVac7hvywQTc+zZUySpUrvOtkK0yMs5PMrfiv2ILMU 12Vg== X-Gm-Message-State: APjAAAVybNTHBX1vuvSaQ+JvFMig/V8nBxqXB9/MfVbeQrx7gVxzYA2y v+9sx010WdvaMU3NV6FLxGyb5ruud/GkGQhKksM= X-Google-Smtp-Source: APXvYqxoleFNG+XkzK/ZmYYwgltnwBw7dmw/u1moEtpzzCMrc+K28Hn121nImKd8KsCYlv6j7ROAm9vcIc89wU7BLnY= X-Received: by 2002:ab0:1c0c:: with SMTP id a12mr40593640uaj.75.1564684272370; Thu, 01 Aug 2019 11:31:12 -0700 (PDT) MIME-Version: 1.0 References: <112384FB-C68D-4308-8ED9-C0BBF615751D@frobbit.se> <1C02AB5B-D01E-49F6-86CE-BAEF4779E776@frobbit.se> <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> <64bcfc51-6f3d-ae24-4de5-d0eb89975c66@cs.tcd.ie> <539D6F9D-137C-4F68-A8DE-EA3DFAF4D827@huitema.net> <73C24907-048A-46C8-812A-C45483C607D4@frobbit.se> <2BF62C0F-B2E9-4E09-9B50-4E592EF6691F@cable.comcast.com> In-Reply-To: <2BF62C0F-B2E9-4E09-9B50-4E592EF6691F@cable.comcast.com> From: Brian Dickson Date: Thu, 1 Aug 2019 11:31:00 -0700 Message-ID: To: "Livingood, Jason" Cc: Paul Wouters , ADD Mailing list Content-Type: multipart/alternative; boundary="0000000000003d87df058f12729f" Archived-At: Subject: [Add] Historical analogy: Site Finder (forking thread with new subject) X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 01 Aug 2019 18:31:16 -0000 --0000000000003d87df058f12729f Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Wed, Jul 31, 2019 at 5:12 AM Livingood, Jason < Jason_Livingood@comcast.com> wrote: > On 7/29/19, 7:30 AM, "Add on behalf of Paul Wouters" on behalf of paul@nohats.ca> wrote: > > I=E2=80=99m not a fan of the centralization. I am a fan of removing = blind > trust on unknown parties. > > The potential for an unknown party seems to arise when an app changes fro= m > the user's typical resolver to some unknown-to-the-user party, so I agree > this is a risk. > For me, one of the major concerns is the unintended breakage (consequences) of changing defaults or overriding existing behavior/configuration. The analogy I'd like to reference, is from an earlier situation in DNS: wildcard records in TLDs. (This might be before the time of many current folks' involvement in DNS, so I'll give a very brief, probably incomplete and/or inaccurate, summary of the issue then.) Verisign deployed a wildcard A record at the apex of the ".com" and ".net" TLD zones in 2003. This was a huge controversy, largely because of things that broke as a result. These wildcards were removed a relatively short time later, and everyone agreed that it was not a good idea to do things like this. (Google "Site Finder" for all the gory details, history, etc.) I see this as a close analogy, and a strong precedent that should be observed/followed. Some examples of how/why SiteFinder was bad, have to do with behavior that is expected and relied upon, as part of things like DNS search lists which rely on NXDOMAIN responses. Wildcards at the same level as a missing name always match, so this broke a lot of things. Also of note was the impact on SMTP traffic, since mail transport relies on using both MX and A records, while the wildcard A record wasn't answering on the SMTP port. How is SiteFinder relevant? The particular use case of enterprise DNS is impacted in a very similar way. The only difference is the underlying mechanism: changing the DNS resolver, rather than wildcards on authority servers. The effect is roughly equivalent: answers that are incorrect or unexpected, from the perspective of the user, as a result of a change not explicitly done by the user or the user's administrator (host, network, DNS, or other kind of admin). Whatever kinds of things we do with/to/in DNS, we need to be cognizant of all consequences, intended or otherwise. In particular, major changes in behavior MUST adequately protect against unintended breakage in a fail-safe manner. This may include mandating that the changes be opt-in only, rather than any other model (opt-out, require active policy management on hosts, force MITM inspection of all HTTPS traffic, etc.) Brian --0000000000003d87df058f12729f Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Wed, Jul 31, 2019 at 5:12 AM Livingood= , Jason <Jason_Livingood@= comcast.com> wrote:
On 7/29/19, 7:30 AM, "Add on beh= alf of Paul Wouters" <add-bounces@ietf.org on behalf of paul@nohats.ca> wrote:
>=C2=A0 =C2=A0 I=E2=80=99m not a fan of the centralization. I am a fan o= f removing blind trust on unknown parties.

The potential for an unknown party seems to arise when an app changes from = the user's typical resolver to some unknown-to-the-user party, so I agr= ee this is a risk.=C2=A0

For me, one of= the major concerns is the unintended breakage (consequences) of changing d= efaults or overriding existing behavior/configuration.

=
The analogy I'd like to reference, is from an earlier situation in= DNS: wildcard records in TLDs.

(This might be bef= ore the time of many current folks' involvement in DNS, so I'll giv= e a very brief, probably incomplete and/or inaccurate, summary of the issue= then.)

Verisign deployed a wildcard A record at t= he apex of the ".com" and ".net" TLD zones in 2003.
This was a huge controversy, largely because of things that broke as= a result.
These wildcards were removed a relatively short time l= ater, and everyone agreed that it was not a good idea to do things like thi= s. (Google "Site Finder" for all the gory details, history, etc.)=

I see this as a close analogy, and a strong prece= dent that should be observed/followed.

Some exampl= es of how/why SiteFinder was bad, have to do with behavior that is expected= and relied upon, as part of things like DNS search lists which rely on NXD= OMAIN responses. Wildcards at the same level as a missing name always match= , so this broke a lot of things. Also of note was the impact on SMTP traffi= c, since mail transport relies on using both MX and A records, while the wi= ldcard A record wasn't answering on the SMTP port.

=
How is SiteFinder relevant? The particular use case of enterprise DNS = is impacted in a very similar way. The only difference is the underlying me= chanism: changing the DNS resolver, rather than wildcards on authority serv= ers. The effect is roughly equivalent: answers that are incorrect or unexpe= cted, from the perspective of the user, as a result of a change not explici= tly done by the user or the user's administrator (host, network, DNS, o= r other kind of admin).

Whatever kinds of things w= e do with/to/in DNS, we need to be cognizant of all consequences, intended = or otherwise. In particular, major changes in behavior MUST adequately prot= ect against unintended breakage in a fail-safe manner. This may include man= dating that the changes be opt-in only, rather than any other model (opt-ou= t, require active policy management on hosts, force MITM inspection of all = HTTPS traffic, etc.)

Brian
--0000000000003d87df058f12729f-- From nobody Thu Aug 1 11:32:07 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 59AA31201D0 for ; Thu, 1 Aug 2019 11:32:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.996 X-Spam-Level: X-Spam-Status: No, score=-1.996 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=hopcount.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id n5ij2wsQhaGu for ; Thu, 1 Aug 2019 11:32:02 -0700 (PDT) Received: from mail-io1-xd34.google.com (mail-io1-xd34.google.com [IPv6:2607:f8b0:4864:20::d34]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B8DA1120168 for ; Thu, 1 Aug 2019 11:32:02 -0700 (PDT) Received: by mail-io1-xd34.google.com with SMTP id k20so146506543ios.10 for ; Thu, 01 Aug 2019 11:32:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hopcount.ca; s=google; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=7ooFq5/NwPZuREDmFpyZW4LRge1hBz3za8oPpbAV+gI=; b=j7W4jLCE5iMNYlaYWTp/NTNvj8za7e5KsHZdLwMAeIwmm6Be7LvXPkw2O56l6AwhMK eAvujr553kVds5ac9spUU45nVx+9ttC+dn2STsZ2hTSJhASb40WVmtwbPm2WXOEOXNlL sCsJt82tMcRaZdelLPZrBV8/PnJdP+mnjkLSI= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=7ooFq5/NwPZuREDmFpyZW4LRge1hBz3za8oPpbAV+gI=; b=s0KyBR6oez1LVefWEUXxdSya+A43igbXgm9zGMfe9fOBiNK3BFcFq97+4WSvtE7cAh 20EBTcP497Go96pcCb+12mGLe8VLwyRcf+jK573pJBKeX2ybRPzZZ5ptrpylydrbSgZD rh+Z9NihLGCkmiGwCGZjDK93DU/lSFwo6MjcYChFwvFENjIGfZ0roIBo4DkmFJJB7C+w ZKVSK15eGWY0F4emJpK8qQyITZYkxhA4/JVD9NXZrCSeOyxDOi9G8RjQubjnWPfkY/3d cmnrbITyLT35Li0LBBwZT+HxQ6W0Mcm8bxgP7GQ8xZwuqksQWgQCA4gRHK9nOf0yKFTY hdsQ== X-Gm-Message-State: APjAAAXd1T3nXTh7vvkQ/nBe1sv66cSwK/bMtpxeNH7DHWwnH0eSJin+ 6SCXQlAUui81cOarN3cSC9Q= X-Google-Smtp-Source: APXvYqzD8i3MSjQ8Akjo+avvlYYyYYQinY1B7YRoUlITqVF1rRoeFPtzz5af2pNxNooSZupKxChoiQ== X-Received: by 2002:a02:bca:: with SMTP id 193mr94779057jad.46.1564684321737; Thu, 01 Aug 2019 11:32:01 -0700 (PDT) Received: from [192.168.1.50] (24-246-23-138.cable.teksavvy.com. [24.246.23.138]) by smtp.gmail.com with ESMTPSA id i3sm59798774ion.9.2019.08.01.11.32.00 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 01 Aug 2019 11:32:00 -0700 (PDT) From: Joe Abley Message-Id: <15B6E0CE-0047-4F2A-A63B-E9A8B8910412@hopcount.ca> Content-Type: multipart/signed; boundary="Apple-Mail=_985CCC0F-8FB4-4FEF-BB02-861A18C2E04B"; protocol="application/pgp-signature"; micalg=pgp-sha1 Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Thu, 1 Aug 2019 14:31:58 -0400 In-Reply-To: Cc: =?utf-8?Q?=C3=93lafur_Gu=C3=B0mundsson?= , "Livingood, Jason" , "add@ietf.org" , Adam Roach To: Jacques Latour References: <8F094057-DFBC-4732-9DA4-BE46E7914C8A@rfc1035.com> <20190724165951.GB29051@laperouse.bortzmeyer.org> <821B448B-F7EA-46A5-837D-DA0E8C60643A@open-xchange.com> <488E2CE0-73D5-4B9E-A5AD-28FDCB95ED2A@cable.comcast.com> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] [EXT] Re: meeting hum: should the IETF take up this work? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 01 Aug 2019 18:32:05 -0000 --Apple-Mail=_985CCC0F-8FB4-4FEF-BB02-861A18C2E04B Content-Type: multipart/alternative; boundary="Apple-Mail=_B4DA4767-DACE-4AA3-82BB-BE971969A045" --Apple-Mail=_B4DA4767-DACE-4AA3-82BB-BE971969A045 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Hi Jacques! > On 1 Aug 2019, at 13:59, Jacques Latour = wrote: >=20 > =46rom the department of this-could-be-a-bad-idea and the department = of omg-this-goes-against-everything-we=E2=80=99re-trying-do, but here it = goes: a DoH operator should have a policy to blacklist IP address as = requested by the network operator, since we can=E2=80=99t effectively = block DoH at the edge of the enterprise network, We can though, right? Depending on what you mean by "effective". It's = just more expensive than blocking DoT and Do53 if all you care about is = blocking the well-known ports. We can even do this without affecting end-user privacy in some (many? = most?) cases since in some (many? most?) corporate networks there's no = expectation of end-user privacy in the first place. There are certainly = some corporate networks that were stripping TLS using privately-issued = trust anchors for client devices in order to police content long before = DoH had been specified. Given that the number of end-users who inhabit enterprise networks is a = rounding error compared to the total number of users of the Internet = globally, I continue to be surprised at the amount of focus the = enterprise deployment case gets in these discussions. > an enterprise network should have the ability to request the well = behaved DoH recursive operators to block requests coming from their = network IP address. Perhaps have some sort of trusted clearing house of = IP addresses that the well behaved DoH recursive operators should = blacklist from. Enterprises can block non well behaving DoH recursive = operators. >=20 > Since the major problems of DoH is for all to understand the = multidimensional matrix of deployment models vs. value proposition vs. = user (vantage) point of view, it=E2=80=99s almost impossible to assess = the value proposition of the above example against all the currently = possible/available scenarios. But we know that DoH has a negative value = proposition for Enterprises. If we know that, I don't know how we know. Is there a potential benefit in some enterprise security architectures = to having DNS resolution not being visible across the network, perhaps? Perhaps not being complicit in enabling DNS resolution for particular = clients and particular content is a benefit in arguing for a lack of = liability in some legal framework? In the case where an enterprise is deliberately using external recursive = services (e.g. the ones that CIRA and OpenDNS sell) perhaps there's a = benefit to having that DNS traffic protected by TLS? Are we conflating DoH as a protocol with the specific case of a client = on an enterprise network using a non-blessed third-party DoH service = when we talk about DoH and the enterprise, or an application on a client = device that is acting contrary to the device's system-wide = configuration? Is that helpful? I like the questions you're asking about risk analysis for the = enterprise (although it still feels a bit like a corner case) but I = think there are a lot more questions to ask about the implications of = DoH before we can assume that there's no benefit. Joe --Apple-Mail=_B4DA4767-DACE-4AA3-82BB-BE971969A045 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Hi = Jacques!

On 1 Aug 2019, at 13:59, Jacques Latour = <Jacques.Latour@cira.ca> wrote:

=46rom the department of = this-could-be-a-bad-idea and the department of = omg-this-goes-against-everything-we=E2=80=99re-trying-do, but here it = goes: a DoH operator should have a policy to blacklist IP address as = requested by the network operator, since we can=E2=80=99t effectively = block DoH at the edge of the enterprise = network,

We can though, right? Depending on what you mean = by "effective". It's just more expensive than blocking DoT and Do53 if = all you care about is blocking the well-known ports.

We can even do this without affecting end-user = privacy in some (many? most?) cases since in some (many? most?) = corporate networks there's no expectation of end-user privacy in the = first place. There are certainly some corporate networks that were = stripping TLS using privately-issued trust anchors for client devices in = order to police content long before DoH had been = specified.

Given that the number of = end-users who inhabit enterprise networks is a rounding error compared = to the total number of users of the Internet globally, I continue to be = surprised at the amount of focus the enterprise deployment case gets in = these discussions.

an enterprise network should have the ability to request the = well behaved DoH recursive operators to block requests coming from their = network IP address. Perhaps have some sort of trusted clearing house of IP = addresses that the well behaved DoH recursive operators should blacklist = from. Enterprises can block non well behaving DoH recursive = operators.
 
Since the major = problems of DoH is for all to understand the multidimensional matrix of = deployment models vs. value proposition vs. user (vantage) point of = view, it=E2=80=99s almost impossible to assess the value proposition of = the above example against all the currently possible/available = scenarios. But we know that DoH has a negative value proposition for = Enterprises.

If we know that, I don't know how we = know.

Is there a potential benefit = in some enterprise security architectures to having DNS resolution not = being visible across the network, perhaps?

Perhaps not being complicit in enabling DNS = resolution for particular clients and particular content is a benefit in = arguing for a lack of liability in some legal framework?

In the case where an enterprise is deliberately = using external recursive services (e.g. the ones that CIRA and OpenDNS = sell) perhaps there's a benefit to having that DNS traffic protected by = TLS?

Are we conflating DoH as a = protocol with the specific case of a client on an enterprise network = using a non-blessed third-party DoH service when we talk about DoH and = the enterprise, or an application on a client device that is acting = contrary to the device's system-wide configuration? Is that = helpful?

I like the questions you're = asking about risk analysis for the enterprise (although it still feels a = bit like a corner case) but I think there are a lot more questions to = ask about the implications of DoH before we can assume that there's no = benefit.


Joe
= --Apple-Mail=_B4DA4767-DACE-4AA3-82BB-BE971969A045-- --Apple-Mail=_985CCC0F-8FB4-4FEF-BB02-861A18C2E04B Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iF0EARECAB0WIQSAt40QkiztAcvphdg0jwy9hlI6LAUCXUMwHwAKCRA0jwy9hlI6 LIjFAJ0Wr70jiq/FIjrY+OqykrHzYQfY7gCfXuIa+zz3zPxOw+ScGW91oshlMyE= =wTUj -----END PGP SIGNATURE----- --Apple-Mail=_985CCC0F-8FB4-4FEF-BB02-861A18C2E04B-- From nobody Thu Aug 1 11:36:32 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 419671200E5 for ; Thu, 1 Aug 2019 11:36:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kNog_3W09hBe for ; Thu, 1 Aug 2019 11:36:29 -0700 (PDT) Received: from smtp.guxx.net (nyx.guxx.net [85.10.208.173]) by ietfa.amsl.com (Postfix) with ESMTP id 01505120059 for ; Thu, 1 Aug 2019 11:36:29 -0700 (PDT) Received: by nyx.guxx.net (Postfix, from userid 107) id AABBB5F42AC6; Thu, 1 Aug 2019 20:36:27 +0200 (CEST) Received: from [192.168.2.128] (p54B8A0E0.dip0.t-ipconnect.de [84.184.160.224]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by nyx.guxx.net (Postfix) with ESMTPSA id C1DBF5F40409; Thu, 1 Aug 2019 20:36:26 +0200 (CEST) From: "Ralf Weber" To: "Jacques Latour" Cc: "=?utf-8?b?w5NsYWZ1ciBHdcOwbXVuZHNzb24=?=" , "Livingood, Jason" , add@ietf.org, "Adam Roach" Date: Thu, 01 Aug 2019 20:36:25 +0200 X-Mailer: MailMate (1.12.5r5635) Message-ID: <5BA9CB4E-D764-40F5-B2FA-86F319C13B90@fl1ger.de> In-Reply-To: References: <8F094057-DFBC-4732-9DA4-BE46E7914C8A@rfc1035.com> <20190724165951.GB29051@laperouse.bortzmeyer.org> <821B448B-F7EA-46A5-837D-DA0E8C60643A@open-xchange.com> <488E2CE0-73D5-4B9E-A5AD-28FDCB95ED2A@cable.comcast.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [Add] [EXT] Re: meeting hum: should the IETF take up this work? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 01 Aug 2019 18:36:31 -0000 Moin! On 1 Aug 2019, at 19:59, Jacques Latour wrote: > From the department of this-could-be-a-bad-idea and the department of > omg-this-goes-against-everything-we’re-trying-do, but here it goes: > a DoH operator should have a policy to blacklist IP address as > requested by the network operator, since we can’t effectively block > DoH at the edge of the enterprise network, an enterprise network > should have the ability to request the well behaved DoH recursive > operators to block requests coming from their network IP address. > Perhaps have some sort of trusted clearing house of IP addresses that > the well behaved DoH recursive operators should blacklist from. > Enterprises can block non well behaving DoH recursive operators. Interesting idea. I think that in addition to discovery mechanism for DoH servers we need some best practices rules for DoH server operators so that white hat operators of DoH servers don’t interfere with enterprise security and maybe a blacklist for those who use DoH for exfiltration. While the idea of the operators blocking requests from known enterprises is technically interesting I don’t think it fits into enterprise security requirements, as they want the packets not to leave their perimeter. So running DoH servers on know addresses (that some providers like Google already said they would do) and let the enterprise block them outbound might be the better way. So long -Ralf —-- Ralf Weber From nobody Thu Aug 1 11:38:48 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9BD4F1201B3 for ; Thu, 1 Aug 2019 11:38:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.694 X-Spam-Level: X-Spam-Status: No, score=-1.694 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FORGED_FROMDOMAIN=0.001, FREEMAIL_FROM=0.001, FROM_EXCESS_BASE64=0.001, HEADER_FROM_DIFFERENT_DOMAINS=0.201, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZDiK1qXWvz2Y for ; Thu, 1 Aug 2019 11:38:45 -0700 (PDT) Received: from mail-wm1-f43.google.com (mail-wm1-f43.google.com [209.85.128.43]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 178801201DA for ; Thu, 1 Aug 2019 11:38:23 -0700 (PDT) Received: by mail-wm1-f43.google.com with SMTP id 207so65599770wma.1 for ; Thu, 01 Aug 2019 11:38:23 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=9HZc1kxHLDJ77gV+WQ1ngakleVfOOOY/03CtiPpqDBU=; b=r0t07v1/bs2MYNYs8tsGVBYT6DVX6tgG9qNboDm1PRXxT6a1kmS/TDv73Om3rTMRdx lmQMazVdzZfsUKw8eleWxBxJ+dnAaKwJ4L0jxyyflpqFzwCHemwWe6dyTF5gOx9Vcu8F g9fkhnvT0c6/K4Svp4e9I3614yjwvpYuOrMjRC241YW6Ev6N44tNDvMVFMtsJctcM+HN Ugq176XqQjmTrr5UfMxQqEJSgVMDDtmw45BUYUiyVJUj90Jd5gIDZPUneIkq0M7t0X07 rIc9YeYAdXAv/NIiTNulX5aFvQnco91YmmjGJUOxZO7C0AkN3Y7DPerjqUZA2lplH0sZ yxRg== X-Gm-Message-State: APjAAAWT0iZpHeDNllrleyA3oyWXARcZKUjss26Ttr68GGTS6PnXjjAm f0lYVAYYAvLfmwJB5FwmwwqguniVW2DD69wR+2g= X-Google-Smtp-Source: APXvYqxoOssQvN7Jcb7rzJEW4pQrRU1fVELwp1/GxPRPDp4V64QRPucV3HFkTS6gmw8wIj/zDjB0t1Eb0pvT2fkGBfg= X-Received: by 2002:a05:600c:224d:: with SMTP id a13mr135953wmm.62.1564684701220; Thu, 01 Aug 2019 11:38:21 -0700 (PDT) MIME-Version: 1.0 References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <20190724171549.GD29051@laperouse.bortzmeyer.org> In-Reply-To: <20190724171549.GD29051@laperouse.bortzmeyer.org> From: =?UTF-8?B?56We5piO6YGU5ZOJ?= Date: Thu, 1 Aug 2019 11:38:10 -0700 Message-ID: To: Stephane Bortzmeyer Cc: "STARK, BARBARA H" , "add@ietf.org" , Barry Leiba , Rob Sayre Content-Type: multipart/alternative; boundary="000000000000cd473a058f128b56" Archived-At: Subject: [Add] point of deploying DoH in access network (Re: meeting hum: should the IETF take up this work?) X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 01 Aug 2019 18:38:47 -0000 --000000000000cd473a058f128b56 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable At Wed, 24 Jul 2019 13:15:49 -0400, Stephane Bortzmeyer wrote: > > I=E2=80=99m also trying to understand why there seems to be resistance = to > > providing ISPs with advice on deploying DoH. > > I'm tempted to say that I don't see the point for an access network to > deploy DoH. If the network is safe, DoH is not really necessary > (paranoid may use DoT, since the access network can ensure that port > 853 is clear). If it is not, for instance because the resolver > modifies the answers, then users will want to bypass it, anyway. > > My guess is that DoH operators will be different from access network > operators. I've been wondering about this, too. Although DoH has some other (potentially) cool features like "push", my understanding is that its primary and much more important purpose is to hide DNS resolution attempts in a normal HTTPS connection that is also used for normal, popular web services. And (again in my understanding) the point here is to make it very hard and mostly impossible for an intermediate player to even block the resolution (because such a player can't do this without also blocking the "popular web service", which such a player is assumed to not want/afford to do). I don't see why a resolver in "an access network" needs this capability. Could someone enlighten me about what I'm missing? -- JINMEI, Tatuya --000000000000cd473a058f128b56 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
At Wed, 24 Jul 2019 13:15:49 -0400,
Stephane Bortzmeyer= <bortzmeyer@nic.fr> wrote:<= br>
> > I=E2=80=99m also trying to understand why there seems to b= e resistance to
> > providing ISPs with advice on deploying DoH.>
> I'm tempted to say that I don't see the point for a= n access network to
> deploy DoH. If the network is safe, DoH is not = really necessary
> (paranoid may use DoT, since the access network ca= n ensure that port
> 853 is clear). If it is not, for instance becaus= e the resolver
> modifies the answers, then users will want to bypass= it, anyway.
>
> My guess is that DoH operators will be differ= ent from access network
> operators.

I've been wondering a= bout this, too.=C2=A0 Although DoH has some other
(potentially) cool fea= tures like "push", my understanding is that its
primary and mu= ch more important purpose is to hide DNS resolution
attempts in a normal= HTTPS connection that is also used for normal,
popular web services.=C2= =A0 And (again in my understanding) the point here
is to make it very ha= rd and mostly impossible for an intermediate
player to even block the re= solution (because such a player can't do
this without also blocking = the "popular web service", which such a
player is assumed to n= ot want/afford to do).=C2=A0 I don't see why a
resolver in "an = access network" needs this capability.=C2=A0 Could someone
enlighte= n me about what I'm missing?

--
JINMEI, Tatuya
--000000000000cd473a058f128b56-- From nobody Thu Aug 1 11:46:01 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 30D56120165 for ; Thu, 1 Aug 2019 11:46:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.996 X-Spam-Level: X-Spam-Status: No, score=-1.996 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=hopcount.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lBnxbTrmiuW6 for ; Thu, 1 Aug 2019 11:45:58 -0700 (PDT) Received: from mail-io1-xd41.google.com (mail-io1-xd41.google.com [IPv6:2607:f8b0:4864:20::d41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4B0C6120059 for ; Thu, 1 Aug 2019 11:45:58 -0700 (PDT) Received: by mail-io1-xd41.google.com with SMTP id j5so142506775ioj.8 for ; Thu, 01 Aug 2019 11:45:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hopcount.ca; s=google; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=QZkccvEC7alTjNJjHoTsa7IhSiGzHTpmTwxltpHZ29M=; b=mTFi4M0YxlXjmS1JhzdxRrynRBNimdg4RSTpCcmzlynHfNKNRVTJlzNeIxvcDAQ3Pv mfep/xVaQRlLvXvjjqzZMSVRMu+tqJjH6Pkm4HvvaCWdvbUMGBVlVP+dfYGLBYEqXplM ywPCnMLlY6jrJEy1XYLADQQOqji62vMcD/CzY= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=QZkccvEC7alTjNJjHoTsa7IhSiGzHTpmTwxltpHZ29M=; b=CiOKrZXUdLTtu0WCh6w9cKDqIiRAR/HOPiBjrqDysGueLKs46b2mVKDnV4m6ZUyO4y 41DVALPYjcuH9iYnlqK2d1xyfIxd33/zaDavKcOi8hyDL32RCVXGfmKkwI/nkrx+j4xs Ngn/z51Wo4//X+yZIzL0GCKNsVSQU5XxIZ4RzNaAZYbml5s3/nPS3g+lpkGmtXzWnLo7 MoYo9/Pl2yGZ56s89OZRxuWkr43UwBjmIRibltlfjo1E/iFHDOI28wlJTqa4tiIqRoP5 twBP7RA+fOwVaqOOQamiF0nj79JJkjanMBpTpmOkXYY5yk7opGtcRn+OJ4ob6cOpwpiK EROw== X-Gm-Message-State: APjAAAU83viYeVIND3yGOWmVrn43hTR+8pJcKhfC+OjjQFeE9ycSqghs tbyiC7N/CuglCyqzfA8vdPM= X-Google-Smtp-Source: APXvYqxhrVgKqSDNywAbXdfesY44JOMpP8srmnbUStAqYnnOCndhLBn2OVyJ+0bnSLbuFuJdsfNCmQ== X-Received: by 2002:a05:6638:52:: with SMTP id a18mr10574055jap.75.1564685157246; Thu, 01 Aug 2019 11:45:57 -0700 (PDT) Received: from [192.168.1.50] (24-246-23-138.cable.teksavvy.com. [24.246.23.138]) by smtp.gmail.com with ESMTPSA id h19sm49444016iol.65.2019.08.01.11.45.55 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 01 Aug 2019 11:45:56 -0700 (PDT) From: Joe Abley Message-Id: Content-Type: multipart/signed; boundary="Apple-Mail=_4FC5DF76-8922-4C40-A096-A0A81365A38E"; protocol="application/pgp-signature"; micalg=pgp-sha1 Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Thu, 1 Aug 2019 14:45:54 -0400 In-Reply-To: Cc: Stephane Bortzmeyer , "add@ietf.org" , Barry Leiba , "STARK, BARBARA H" , Rob Sayre To: =?utf-8?B?56We5piO6YGU5ZOJ?= References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <20190724171549.GD29051@laperouse.bortzmeyer.org> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] point of deploying DoH in access network (Re: meeting hum: should the IETF take up this work?) X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 01 Aug 2019 18:46:00 -0000 --Apple-Mail=_4FC5DF76-8922-4C40-A096-A0A81365A38E Content-Type: multipart/alternative; boundary="Apple-Mail=_479CA94B-DB48-490D-8BF5-7C43457B0535" --Apple-Mail=_479CA94B-DB48-490D-8BF5-7C43457B0535 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 On 1 Aug 2019, at 14:38, =E7=A5=9E=E6=98=8E=E9=81=94=E5=93=89 = wrote: > At Wed, 24 Jul 2019 13:15:49 -0400, > Stephane Bortzmeyer > = wrote: >=20 > > > I=E2=80=99m also trying to understand why there seems to be = resistance to > > > providing ISPs with advice on deploying DoH. > > > > I'm tempted to say that I don't see the point for an access network = to > > deploy DoH. If the network is safe, DoH is not really necessary > > (paranoid may use DoT, since the access network can ensure that port > > 853 is clear). If it is not, for instance because the resolver > > modifies the answers, then users will want to bypass it, anyway. > > > > My guess is that DoH operators will be different from access network > > operators. >=20 > I've been wondering about this, too. Lots of access network providers don't control all of the infrastructure = between their network and their end-users. Examples are ISPs that use = wholesale DSL and CATV access networks operated by incumbents who are = required to allow third-party access by regulators. I have heard concerns before that such access wholesalers might = interfere (e.g. block, rate-limit) traffic that was in competition with = their own services, or for other reasons. I've also heard concerns that = such wholesalers routinely target retail customers of other ISPs when = trying to sell their own retail services, and that visibility of the = traffic of the end-users allows them to be tempted with targeted = promotions. I'm not saying any of this has happened, anywhere; I'm just saying I = have heard concerns about these kinds of things. To the extent that any of this kind of thing can be enabled by = surveillance of DNS traffic between an end-user and a resolver, this to = me is a plausible reason to want privacy protection. DoH is arguably a = better mechanism than DoT for anybody whose primary focus is privacy (as = has been discussed from many angles, many times) because the existence = of the channel is obfuscated along with its content. Joe --Apple-Mail=_479CA94B-DB48-490D-8BF5-7C43457B0535 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 On = 1 Aug 2019, at 14:38, =E7=A5=9E=E6=98=8E=E9=81=94=E5=93=89 <jinmei@wide.ad.jp> = wrote:

At Wed, 24 Jul = 2019 13:15:49 -0400,
Stephane Bortzmeyer <bortzmeyer@nic.fr> = wrote:

> > I=E2=80=99m also trying to = understand why there seems to be resistance to
> > = providing ISPs with advice on deploying DoH.
>
> I'm tempted to say that I don't see the point for an = access network to
> deploy DoH. If the network is safe, = DoH is not really necessary
> (paranoid may use DoT, = since the access network can ensure that port
> 853 is = clear). If it is not, for instance because the resolver
>= modifies the answers, then users will want to bypass it, anyway.
>
> My guess is that DoH operators will = be different from access network
> operators.

I've been wondering about this, = too.

Lots of = access network providers don't control all of the infrastructure between = their network and their end-users. Examples are ISPs that use wholesale = DSL and CATV access networks operated by incumbents who are required to = allow third-party access by regulators.

I have heard concerns before that such access = wholesalers might interfere (e.g. block, rate-limit) traffic that was in = competition with their own services, or for other reasons. I've also = heard concerns that such wholesalers routinely target retail customers = of other ISPs when trying to sell their own retail services, and that = visibility of the traffic of the end-users allows them to be tempted = with targeted promotions.

I'm not = saying any of this has happened, anywhere; I'm just saying I have heard = concerns about these kinds of things.

To the extent that any of this kind of thing can = be enabled by surveillance of DNS traffic between an end-user and a = resolver, this to me is a plausible reason to want privacy protection. = DoH is arguably a better mechanism than DoT for anybody whose primary = focus is privacy (as has been discussed from many angles, many times) = because the existence of the channel is obfuscated along with its = content.


Joe

= --Apple-Mail=_479CA94B-DB48-490D-8BF5-7C43457B0535-- --Apple-Mail=_4FC5DF76-8922-4C40-A096-A0A81365A38E Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iF0EARECAB0WIQSAt40QkiztAcvphdg0jwy9hlI6LAUCXUMzYgAKCRA0jwy9hlI6 LGcOAJwM85S9QuhA/mpRjP6MS1oYL4gzfgCgpw0u5T6YrTf33qXo9kQj6fOf7B4= =uyYg -----END PGP SIGNATURE----- --Apple-Mail=_4FC5DF76-8922-4C40-A096-A0A81365A38E-- From nobody Thu Aug 1 13:26:32 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 67B541201EE for ; Thu, 1 Aug 2019 13:26:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.199 X-Spam-Level: X-Spam-Status: No, score=-4.199 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vQnfyo0CIEf9 for ; Thu, 1 Aug 2019 13:26:28 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [209.87.249.19]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9BAA51201EB for ; Thu, 1 Aug 2019 13:26:28 -0700 (PDT) Received: from sandelman.ca (unknown [IPv6:2607:f0b0:f:2:56b2:3ff:fe0b:d84]) by tuna.sandelman.ca (Postfix) with ESMTP id 5F5B9380BE for ; Thu, 1 Aug 2019 16:25:59 -0400 (EDT) Received: from localhost (localhost [IPv6:::1]) by sandelman.ca (Postfix) with ESMTP id 1F7B08EF for ; Thu, 1 Aug 2019 16:26:27 -0400 (EDT) From: Michael Richardson To: ADD Mailing list In-Reply-To: References: <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> <64bcfc51-6f3d-ae24-4de5-d0eb89975c66@cs.tcd.ie> <539D6F9D-137C-4F68-A8DE-EA3DFAF4D827@huitema.net> <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> X-Mailer: MH-E 8.6; nmh 1.7+dev; GNU Emacs 24.5.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 01 Aug 2019 20:26:31 -0000 --=-=-= Content-Type: text/plain Mikael Abrahamsson wrote: > One thing that would be good to get agreement on is that there are > valid use-cases for both using the system resolver by default and using > a (remote, non-ISP) DoH resolver by default, and my estimation is that > these are close to equally large/important. As a user, I'd sometimes like it on a tab-by-tab basis! Certainly "Incognito" browsing might have a different policy. {I'll also say if you are a dissident trying to hide/blend-in in a hostile environment, the last thing you want is all your Do53 traffic to do is disappear.} > If we can agree on that and > the discussion stops being on whose use-case is most important and > instead being on how to solve this problem, then the discussion might > be more fruitful and productive. Agreed. -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAl1DSvIACgkQgItw+93Q 3WWMKgf+JStxmGxBruRC1GUaYhcg6HT2+OQ19GcrcD/SGdDTAKyjDyyycwrVo50q zalwJPp/NGMLIkcXZJtzXiXKKQq3bUDoismPmvo68OA9JQDwGU9IokL390E7eOQA 2YsSQn5tvolYHriAH7JgXtCdihsL2yGQ3TFKWcTCtc4D94Vufd5GKHMW75dfC9CF 4+DQOZSrJf+9A+ht+40ifK3KC96NuSFP/w5zQKlgQ6dg5m+WL88oRKUXUtvF9C64 UJ1I84dtJSGb8NvpkOl9HgAfLYsuIyG/VO5QYZUNB8/W4Xw/MPB/+wWv0F9Kew3r IXlVMz68ExWkWMM5xRUtexWs7ZsKGA== =Mb+8 -----END PGP SIGNATURE----- --=-=-=-- From nobody Thu Aug 1 13:49:48 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5CC6F12022B for ; Thu, 1 Aug 2019 13:49:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.499 X-Spam-Level: X-Spam-Status: No, score=-17.499 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sF0iZWvPl6k9 for ; Thu, 1 Aug 2019 13:49:44 -0700 (PDT) Received: from mail-wr1-x42a.google.com (mail-wr1-x42a.google.com [IPv6:2a00:1450:4864:20::42a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 11CED1201EA for ; Thu, 1 Aug 2019 13:49:44 -0700 (PDT) Received: by mail-wr1-x42a.google.com with SMTP id y4so74984227wrm.2 for ; Thu, 01 Aug 2019 13:49:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=ReDs22nvjoDmnvNEy3DwIy6+MGQzJmFAjoyeOqMYFoY=; b=kMRCmtIhlJbR3xeQQcuWT/ONziimolNaSJyrhgUyca3PToTHYf3UVkxmLcvnCFcXTm tvqHpslrV7rD+B1ENwkSScDq5FrPHv+7YCFPBJxl5iaMirVFTMqTnghKmIPhxx1ej+ps ilLJQqA2cbIKxOg9iz1r2CzKf31C9XVq7qClFtdTYf9odVNRd63BqArm+4qVUOOU1+4h uTezNVudLXkK4XO0jmB3Ag8X6csvYlzrJqHg4zcL5yoen1F9PDhm5GxV6ZjW+vlYprkA Fr+x2CD1UqbaNmYrbV5sLTkv16Civ6LdBXv0uxngvRswl9gzw4JVu8DY9q21fqm4wugO XCcQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=ReDs22nvjoDmnvNEy3DwIy6+MGQzJmFAjoyeOqMYFoY=; b=Z3uk7EzFZ7zyG+l0Ej6CApKUxq6I63evZH/SjIHub3u7y6ZDMokA5v6yJd7s+91WtE aL5NCu0eYv91JvIhfTC8vI4j9AAwHgOGtsZvINwtGYLAItQ4uFtUKBWpzkz3Z3/at1s8 WuE3OTL7tNZCYU4FXq02vZ8mHbUd6Kp8BlxXV16phHmVbDANdUe3r1L4LZBbGxdMmI1x RmCWqoA5OYIZPbS6ocqp+ktJQ6N+7GDA3BSClq9sKOWJ6ql5W3j4/dpFFCYZcxvs15T6 js0pwp+kh29YcH07czNfsAmhrkXDcu2h0ioNeIZ2SST3NAm0tG/6Lk+kLNFWN9HBU5Tm xdeA== X-Gm-Message-State: APjAAAWAckdG8JXlHoOiCg0BCu5PzkVG9CbtLJRE6UZS8byOPmj+5Mag waMIhCIwVWqVY1TdLt5ywYo/yM0mzRPRaOGKzQIVDA== X-Google-Smtp-Source: APXvYqzR/8uHhT246ZOVe4QTz2N8oKHVuIVSEQdXhvAZt+v5klWWLZ5FdS9UMCacQpDGE15UJhyN18Th2w1GJHp1ous= X-Received: by 2002:adf:d081:: with SMTP id y1mr1275183wrh.34.1564692582134; Thu, 01 Aug 2019 13:49:42 -0700 (PDT) MIME-Version: 1.0 References: <8F094057-DFBC-4732-9DA4-BE46E7914C8A@rfc1035.com> <20190724165951.GB29051@laperouse.bortzmeyer.org> <821B448B-F7EA-46A5-837D-DA0E8C60643A@open-xchange.com> <488E2CE0-73D5-4B9E-A5AD-28FDCB95ED2A@cable.comcast.com> In-Reply-To: From: Eric Orth Date: Thu, 1 Aug 2019 16:49:29 -0400 Message-ID: To: Jacques Latour Cc: =?UTF-8?B?w5NsYWZ1ciBHdcOwbXVuZHNzb24=?= , "Livingood, Jason" , "add@ietf.org" , Adam Roach Content-Type: multipart/alternative; boundary="0000000000008abe47058f146194" Archived-At: Subject: Re: [Add] [EXT] Re: meeting hum: should the IETF take up this work? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 01 Aug 2019 20:49:46 -0000 --0000000000008abe47058f146194 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Thu, Aug 1, 2019 at 1:59 PM Jacques Latour wrote: > From the department of this-could-be-a-bad-idea and the department of > omg-this-goes-against-everything-we=E2=80=99re-trying-do, but here it goe= s: a DoH > operator should have a policy to blacklist IP address as requested by the > network operator, since we can=E2=80=99t effectively block DoH at the edg= e of the > enterprise network, an enterprise network should have the ability to > request the well behaved DoH recursive operators to block requests coming > from their network IP address. Perhaps have some sort of trusted clearin= g > house of IP addresses that the well behaved DoH recursive operators shoul= d > blacklist from. Enterprises can block non well behaving DoH recursive > operators. > > > > Since the major problems of DoH is for all to understand the > multidimensional matrix of deployment models vs. value proposition vs. us= er > (vantage) point of view, it=E2=80=99s almost impossible to assess the val= ue > proposition of the above example against all the currently > possible/available scenarios. But we know that DoH has a negative value > proposition for Enterprises. > > > > How do we turn DoH to have a positive value proposition for Enterprise? > > > > Can DoH have positive value proposition for all scenarios? > > > > What are the gaps and how do we address them methodically? > > > > Jack > > > I can't speak for any DoH server operators, but I would imagine most would not be willing to trust a please-block-these-IPs/names signal unless the agent sending the signal could prove it has authority over the user/device making the request. Could be very damaging for an enterprise's operations if an unauthorized attacker can disrupt their access to websites the enterprise wants to be able to access. Maybe there's a way I'm missing, but I'm having trouble thinking of any way for the blocking agent to prove that authority without having control of the requesting user/device. And if any enterprise has that control, they should be able to just block IPs/names from the device or control from there what DNS server is used. --0000000000008abe47058f146194 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Thu, Aug 1, 2019 at 1:59 PM Jacque= s Latour <Jacques.Latour@cira.= ca> wrote:

From the department of this-could-be-a-bad-idea and the dep= artment of omg-this-goes-against-everything-we=E2=80=99re-trying-do, but he= re it goes: a DoH operator should have a policy to blacklist IP address as requested by the network o= perator, since we can=E2=80=99t effectively block DoH at the edge of the en= terprise network, an enterprise network should have the ability to request = the well behaved DoH recursive operators to block requests coming from their network IP address.=C2=A0 Perhaps have= some sort of trusted clearing house of IP addresses that the well behaved = DoH recursive operators should blacklist from. Enterprises can block non we= ll behaving DoH recursive operators.

=C2=A0

Since the major problems of DoH is for all to understand th= e multidimensional matrix of deployment models vs. value proposition vs. us= er (vantage) point of view, it=E2=80=99s almost impossible to assess the value proposition of= the above example against all the currently possible/available scenarios. = But we know that DoH has a negative value proposition for Enterprises.

=C2=A0

How do we turn DoH to have a positive value proposition for= Enterprise?

=C2=A0

Can DoH have positive value proposition for all scenarios?

=C2=A0

What are the gaps and how do we address them methodically?<= u>

=C2=A0

Jack

=C2=A0


I can't speak for any DoH server operators, bu= t I would imagine most would not be willing to trust a please-block-these-I= Ps/names signal unless the agent sending the signal could prove it has auth= ority over the user/device making the request.=C2=A0 Could be very damaging= for an enterprise's operations if an unauthorized attacker can disrupt= their access to websites the enterprise wants to be able to access.=C2=A0 = Maybe there's a way I'm missing, but I'm having trouble thinkin= g of any way for the blocking agent to prove that authority without having = control of the requesting user/device.=C2=A0 And if any enterprise has that= control, they should be able to just block IPs/names from the device or co= ntrol from there what DNS server is used.
--0000000000008abe47058f146194-- From nobody Thu Aug 1 14:00:23 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8F7BE12022E for ; Thu, 1 Aug 2019 14:00:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Z5CJX8I2Kx7f for ; Thu, 1 Aug 2019 14:00:14 -0700 (PDT) Received: from NAM02-CY1-obe.outbound.protection.outlook.com (mail-eopbgr760107.outbound.protection.outlook.com [40.107.76.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4CAA212011D for ; Thu, 1 Aug 2019 14:00:14 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=PUjJ1cTEq6lzXw1/k7i3n3pxbRfvt9u6J+1vYLNROBOncfYN0bXfzMg2ilLdhDS77BJjGk13bk2NE/aN9MRxM8XR88WF8fyFcJ9rUYlrrimxRhFtQ1q0qrq7nB+QakHlgEQvpxShecdVFYD7/j6XiHoLt9xS/O5/sL1lKeM6Cls7QRZaa3lFuLQ/vVBrK8u/u9ETXSF07KjgJUFDzgqdy96I7FPq3L5QxV4egpquKoEggkRzvLhgTJrZkTEnfohNmA5Z6r2bh6qfygMTvczHsExGSsn9gIG3zJ26gjMSW03HU4QFPSivv5V/dQM8ET0u8qAWaPWemfUlaC8iXRS4aQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=HWJQkRjtbwjPqJvHszc8OKQiu/qPKpU5kvthIlUV76Y=; b=apZz0paZ7aoIAEQTz+SkbqkU3NIU6tcioAgPdsIZc6CR3pMEWQKdedfZK21XGLu/EiBmDKO5X0xc4OEoYtZ4yv2kYznhWa3WeVOuEwwfDLi4n0Wg3fPpUEGJjI3xZWyxVPQTrz7MA8dCE6SG67ALQRZvTjTZvFhXc4S6mJzOo9wI+DAmX2ngoeEdeTHfUT3qbvKEb2wrhrl6R5Nvu/tWODrxgSOExTuhM++tT52ph59JHLcbZbzrnKjPGe5YHAIQJsosv8TZrL5pTYHniLv94/gvMf9XnsoOkfy08mgvu93A7/MXRJKjX2pzz0zKaI63/tHlwJhO5Mp1xShthctPVQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=microsoft.com; dmarc=pass action=none header.from=microsoft.com; dkim=pass header.d=microsoft.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=HWJQkRjtbwjPqJvHszc8OKQiu/qPKpU5kvthIlUV76Y=; b=C83gR+xNGPWltKM/v8hRp0ab+5dR/Pwg40aJvyR4pGlEyWTLjzlF6VZi50CjqjwlhjLKvOtnVIE7deP4TtUcIB9nXu20WeCXFVLG/QFvaJIEpif/JxdDrzXZnfCGdGLEmK4x/YUqy/+xqDtbCUIeyT35FUH+cd1jSGo+ZdUqPGo= Received: from MN2PR21MB1213.namprd21.prod.outlook.com (20.179.20.141) by MN2PR21MB1183.namprd21.prod.outlook.com (20.179.20.14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2157.3; Thu, 1 Aug 2019 21:00:13 +0000 Received: from MN2PR21MB1213.namprd21.prod.outlook.com ([fe80::24eb:3b4c:428b:8fde]) by MN2PR21MB1213.namprd21.prod.outlook.com ([fe80::24eb:3b4c:428b:8fde%9]) with mapi id 15.20.2157.001; Thu, 1 Aug 2019 21:00:13 +0000 From: Tommy Jensen To: ADD Mailing list Thread-Topic: WG wiki Thread-Index: AQHVSKv0HsJsgbG0FUilNBeWjdXxnw== Date: Thu, 1 Aug 2019 21:00:12 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Jensen.Thomas@microsoft.com; x-originating-ip: [131.107.147.60] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 81396bb6-531e-4554-e147-08d716c33f39 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(4618075)(2017052603328)(7193020); SRVR:MN2PR21MB1183; x-ms-traffictypediagnostic: MN2PR21MB1183: x-ms-exchange-purlcount: 1 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-forefront-prvs: 01165471DB x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(4636009)(366004)(396003)(136003)(376002)(346002)(39860400002)(53754006)(189003)(199004)(64756008)(66476007)(66446008)(66556008)(66946007)(19627405001)(221733001)(6306002)(6506007)(7696005)(236005)(53936002)(486006)(478600001)(6116002)(74316002)(22452003)(99286004)(55016002)(26005)(4744005)(33656002)(66066001)(76116006)(25786009)(8990500004)(10090500001)(9686003)(3846002)(68736007)(186003)(54896002)(91956017)(256004)(102836004)(8676002)(86362001)(7736002)(6436002)(316002)(71200400001)(966005)(10290500003)(476003)(2906002)(71190400001)(5660300002)(606006)(14444005)(105004)(6916009)(81156014)(8936002)(3480700005)(14454004)(81166006)(52536014)(7116003); DIR:OUT; SFP:1102; SCL:1; SRVR:MN2PR21MB1183; H:MN2PR21MB1213.namprd21.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: +JHqXz2n68LTktuUlfZBP1UijKgiLuaG4de4vnUQ6wiRAUuIfbMEUctTNOsYWpa8IKiRIj/LW8OTtY7vFhT1UHe+grhNKRzyx5lD2BEN28GGeyOq+5pvIrRlAP2riTb4MzDO9oJ31TtOR/TRQDVLu7IJf+5gMSROkKGZaUnX88H9PPeaogwy7iz89Hygl934WHem2UuwYswQ7eNYUS0T/yn3UWTMZ6GF6OovyQtJOJlGi+RrcWf+/wAeJMn4UMNzQXpmyW3KQNyxcOnODDhzdJlh+9GLkrx4SzB5Rix74q4v94w45K44K1FtS62FwqY8ELxMMuTl8PpgPcAVDKu4DXVydazuv9QzQnKDlaLKlDlacL1y2yAfTqgU6ixls3Hw5YRY79qEtYBxPMO0uw22vKEap0m6R5REM0vOuztVqXg= x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_MN2PR21MB1213CE95655B0A58732B9CC0FADE0MN2PR21MB1213namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: 81396bb6-531e-4554-e147-08d716c33f39 X-MS-Exchange-CrossTenant-originalarrivaltime: 01 Aug 2019 21:00:12.9717 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: 6Ys/gkIBOoWBjiAcurW9T69R4USBvP3eS03rdT2ry2HaDW6XqGkYBn3ydvqhbWnso73x46j5fUDK9xflcL6omA== X-MS-Exchange-Transport-CrossTenantHeadersStamped: MN2PR21MB1183 Archived-At: Subject: [Add] WG wiki X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 01 Aug 2019 21:00:20 -0000 --_000_MN2PR21MB1213CE95655B0A58732B9CC0FADE0MN2PR21MB1213namp_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Hey all, I checked https://trac.ietf.org/ to see if there was a wiki we could use to= pursue some of the collaboration efforts people are +1ing today, but the A= DD path appears to be blocked/nonexistant. Is there any way for us to creat= e that so we can start writing down and brainstorming through some of the d= ocument ideas being brought up without having to build them up into full bl= own drafts offline first? Thanks, Tommy --_000_MN2PR21MB1213CE95655B0A58732B9CC0FADE0MN2PR21MB1213namp_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
Hey all,

I checked https://trac.i= etf.org/ to see if there was a wiki we could use to pursue some of= the collaboration efforts people are +1ing today, but the ADD path app= ears to be blocked/nonexistant. Is there any way for us to create that so we can start writing down and brainstorming through s= ome of the document ideas being brought up without having to build them up = into full blown drafts offline first?

Thanks,
Tommy
--_000_MN2PR21MB1213CE95655B0A58732B9CC0FADE0MN2PR21MB1213namp_-- From nobody Thu Aug 1 17:04:11 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8C0A3120073 for ; Thu, 1 Aug 2019 17:04:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.199 X-Spam-Level: X-Spam-Status: No, score=-4.199 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0a0pMf26wPma for ; Thu, 1 Aug 2019 17:04:08 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [IPv6:2607:f0b0:f:3:216:3eff:fe7c:d1f3]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6470912001A for ; Thu, 1 Aug 2019 17:04:07 -0700 (PDT) Received: from sandelman.ca (unknown [IPv6:2607:f0b0:f:2:56b2:3ff:fe0b:d84]) by tuna.sandelman.ca (Postfix) with ESMTP id 8E49A380BE for ; Thu, 1 Aug 2019 20:03:37 -0400 (EDT) Received: from localhost (localhost [IPv6:::1]) by sandelman.ca (Postfix) with ESMTP id 7BF6280 for ; Thu, 1 Aug 2019 20:04:05 -0400 (EDT) From: Michael Richardson To: ADD Mailing list In-Reply-To: References: <112384FB-C68D-4308-8ED9-C0BBF615751D@frobbit.se> <1C02AB5B-D01E-49F6-86CE-BAEF4779E776@frobbit.se> <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> <64bcfc51-6f3d-ae24-4de5-d0eb89975c66@cs.tcd.ie> <539D6F9D-137C-4F68-A8DE-EA3DFAF4D827@huitema.net> <73C24907-048A-46C8-812A-C45483C607D4@frobbit.se> <2BF62C0F-B2E9-4E09-9B50-4E592EF6691F@cable.comcast.com> X-Mailer: MH-E 8.6; nmh 1.7+dev; GNU Emacs 24.5.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: Re: [Add] Historical analogy: Site Finder (forking thread with new subject) X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 02 Aug 2019 00:04:11 -0000 --=-=-= Content-Type: text/plain Brian Dickson wrote: > Verisign deployed a wildcard A record at the apex of the ".com" and > ".net" TLD zones in 2003. This was a huge controversy, largely because > of things that broke as a result. These wildcards were removed a > relatively short time later, and everyone agreed that it was not a good > idea to do things like this. (Google "Site Finder" for all the gory > details, history, etc.) > I see this as a close analogy, and a strong precedent that should be > observed/followed. > Some examples of how/why SiteFinder was bad, have to do with behavior > that is expected and relied upon, as part of things like DNS search > lists which rely on NXDOMAIN responses. Wildcards at the same level as > a missing name always match, so this broke a lot of things. Also of > note was the impact on SMTP traffic, since mail transport relies on > using both MX and A records, while the wildcard A record wasn't > answering on the SMTP port. > How is SiteFinder relevant? The particular use case of enterprise DNS > is impacted in a very similar way. The only difference is the A good explanation, thank you. And, having not learned at all from the SiteFinder disaster, a bunch of ISPs decided to implement this in their recursive resolvers in order to drive traffic to their hosted ad sites. This was probably one of the things that created the need for the quadX resolvers. -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAl1DffUACgkQgItw+93Q 3WWhFAf+LuO4ugL9obZSQLOcUbVwvwEXp13NqlsrcUXLa1nw9fbIgsniZclae4aq mDFkZh7HgV/gfMeiy6eU2z5odV9VwQNZFR7eww8f4ZFSLS5QGTInKGQzIO608dFD ZA3vrw2UVJYYwTCOH9EGpeZoIZXiM+5BuPuTdxAsFxGqY4m5pcdFDgEbfsQnPafa 4UN/97QNIPqliiyrV1M1EwjXCzduqQSW1lZEa8GpD7NxxQtHMStsf9G+58Q332oF MrzpeJ6v1uHan4QaigbpuKSNp7cfkNGwfb5ohrsw27feKPPYowPrpZxk3m/eUPHo W+Z7fYpiNx9/NIWtFglggiLULdkwIw== =o7mo -----END PGP SIGNATURE----- --=-=-=-- From nobody Thu Aug 1 22:15:28 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 88380120044 for ; Thu, 1 Aug 2019 22:15:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aH__MghlTR7t for ; Thu, 1 Aug 2019 22:15:24 -0700 (PDT) Received: from mail-io1-xd36.google.com (mail-io1-xd36.google.com [IPv6:2607:f8b0:4864:20::d36]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 016B9120135 for ; Thu, 1 Aug 2019 22:15:23 -0700 (PDT) Received: by mail-io1-xd36.google.com with SMTP id f4so149585357ioh.6 for ; Thu, 01 Aug 2019 22:15:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=FpId/3iTVZfTM+a3qGw/C0ONrTsHGgEigQVWgUdT9qo=; b=JPpP5AoJTBG+KWUbV5GAzOG3z+4G1ER/LDmb4mydkj7lNxRPsEkbGQFi8XzGlwWRZv 1iHpOl9Mevgn3f9StuDKkTm8ZTl4YGSDT5Ikd29qPGF9ZaSy3kQ7dXp89B19RcTOafQW P1mIh1VAUvalVnA/93E9+I8nsKR4unjJgjwK4OdicxL4mzVHM/UjnzO0zRsapCur4fv+ KKl4k8JkWcJ+jXqaI4TX3RKucUYzE0sSdGSmEf5f4QQo69XGdzkPN1Qf/TZL5pcelxix DTkSBzCGGnE0Wubxda1a8ESU1PS513MxpUrMVFIgmOT4j0wb1IvLSCyUx/LDPsXlYNzv P8oA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=FpId/3iTVZfTM+a3qGw/C0ONrTsHGgEigQVWgUdT9qo=; b=nGEiRBsIPQaKCTjuHqhy3wCDdEHrbvYIAj+To0WNDDdxaP3xwITLFljNAjxvy2uMwg ZMjjDv1oG0m3kTrAoCtbwY49dj4zNliGy87OrmlOXuGpfQ7uo5xqCkKPB0vDyaMEm4tT dG7wUEDyDU+f0dE+6UHdC14pFHD+JY7m4LJJfflEzaoupxZZ9twen9C2pVmH3+JknXIt wINbyNbH62wyS0WAthNZ8C7j+QxOmBt54ghLC19P/ilLYbQC+mZx7K4xbxancFmofmYE puMshAX6o5DRkpNqF9i1VCiX1mm4ozimhOo9XBA/YU8ktDCDIUdQpy9Jv6NEOdbCMUlB 93uQ== X-Gm-Message-State: APjAAAULQNnAPf484w+NjDWw5HeNUjIU4EsTgz0y88d0H1BG+RvjbiPk w5Q9J3olemDMzaMbyjqn1RDgkzE4I0wd60YrCyptQ2FV X-Google-Smtp-Source: APXvYqx4hjhm+N6hd+Mloc3oorlo/3Wgz5SSHumhGDPwHebKuwzzHczY1bbIMDP8OMDoeoAFpF3uJVTyZgh7fOfjMJ0= X-Received: by 2002:a5e:9515:: with SMTP id r21mr8900810ioj.257.1564722923073; Thu, 01 Aug 2019 22:15:23 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Rob Sayre Date: Thu, 1 Aug 2019 22:15:11 -0700 Message-ID: To: Tommy Jensen Cc: ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000007604058f1b72cb" Archived-At: Subject: Re: [Add] WG wiki X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 02 Aug 2019 05:15:27 -0000 --000000000000007604058f1b72cb Content-Type: text/plain; charset="UTF-8" I don't think the list has gotten to the point of creating infrastructure for a WG, because there isn't a WG yet. One hazard of pressing forward in the face of opposition is that the output of the WG, and the IETF itself, could be viewed as irrelevant. That is why the IETF tends to strive for consensus. thanks, Rob On Thu, Aug 1, 2019 at 2:00 PM Tommy Jensen wrote: > Hey all, > > I checked https://trac.ietf.org/ to see if there was a wiki we could use > to pursue some of the collaboration efforts people are +1ing today, but the > ADD path appears to be blocked/nonexistant. Is there any way for us to > create that so we can start writing down and brainstorming through some of > the document ideas being brought up without having to build them up into > full blown drafts offline first? > > Thanks, > Tommy > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --000000000000007604058f1b72cb Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
I don't think the list has gotten to the point of= creating infrastructure for a WG, because there isn't a WG yet.
<= div>
One hazard of pressing forward in the face of opposition= is that the output of the WG, and the IETF itself, could be viewed as irre= levant.

That is why the IETF tends to strive for c= onsensus.

thanks,
Rob

On Thu, Aug 1, 2019= at 2:00 PM Tommy Jensen <Jensen.Thomas=3D40microsoft.com@dmarc.ietf.org>= ; wrote:
Hey all,

I checked=C2=A0https:/= /trac.ietf.org/=C2=A0to see if there was a wiki we could use to pursue = some of the collaboration efforts people are +1ing today, but the ADD path = appears to be blocked/nonexistant. Is there any way for us to create that so we can start writing down and brainstorming through s= ome of the document ideas being brought up without having to build them up = into full blown drafts offline first?

Thanks,
Tommy
--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--000000000000007604058f1b72cb-- From nobody Thu Aug 1 23:21:53 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6AFE412003E for ; Thu, 1 Aug 2019 23:21:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hq4Xr-bASS6z for ; Thu, 1 Aug 2019 23:21:51 -0700 (PDT) Received: from mx36-out10.antispamcloud.com (mx36-out10.antispamcloud.com [209.126.121.30]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B7F4712002E for ; Thu, 1 Aug 2019 23:21:49 -0700 (PDT) Received: from xse341.mail2web.com ([66.113.197.87] helo=xse.mail2web.com) by mx62.antispamcloud.com with esmtp (Exim 4.89) (envelope-from ) id 1htQwh-0008r5-Kp for add@ietf.org; Fri, 02 Aug 2019 08:21:46 +0200 Received: from xsmtp22.mail2web.com (unknown [10.100.68.61]) by xse.mail2web.com (Postfix) with ESMTPS id 460Gxg53C9z2bj for ; Thu, 1 Aug 2019 23:11:03 -0700 (PDT) Received: from [10.5.2.12] (helo=xmail02.myhosting.com) by xsmtp22.mail2web.com with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.92) (envelope-from ) id 1htQmN-0003Wt-J4 for add@ietf.org; Thu, 01 Aug 2019 23:11:03 -0700 Received: (qmail 11949 invoked from network); 2 Aug 2019 06:11:02 -0000 Received: from unknown (HELO [192.168.1.103]) (Authenticated-user:_huitema@huitema.net@[172.56.38.95]) (envelope-sender ) by xmail02.myhosting.com (qmail-ldap-1.03) with ESMTPA for ; 2 Aug 2019 06:11:02 -0000 To: Jacques Latour , =?UTF-8?Q?=c3=93lafur_Gu=c3=b0mundsson?= , "Livingood, Jason" Cc: "add@ietf.org" , Adam Roach References: <8F094057-DFBC-4732-9DA4-BE46E7914C8A@rfc1035.com> <20190724165951.GB29051@laperouse.bortzmeyer.org> <821B448B-F7EA-46A5-837D-DA0E8C60643A@open-xchange.com> <488E2CE0-73D5-4B9E-A5AD-28FDCB95ED2A@cable.comcast.com> From: Christian Huitema Openpgp: preference=signencrypt Autocrypt: addr=huitema@huitema.net; prefer-encrypt=mutual; keydata= mQENBFIRX8gBCAC26usy/Ya38IqaLBSu33vKD6hP5Yw390XsWLaAZTeQR64OJEkoOdXpvcOS HWfMIlD5s5+oHfLe8jjmErFAXYJ8yytPj1fD2OdSKAe1TccUBiOXT8wdVxSr5d0alExVv/LO I/vA2aU1TwOkVHKSapD7j8/HZBrqIWRrXUSj2f5n9tY2nJzG9KRzSG0giaJWBfUFiGb4lvsy IaCaIU0YpfkDDk6PtK5YYzuCeF0B+O7N9LhDu/foUUc4MNq4K3EKDPb2FL1Hrv0XHpkXeMRZ olpH8SUFUJbmi+zYRuUgcXgMZRmZFL1tu6z9h6gY4/KPyF9aYot6zG28Qk/BFQRtj7V1ABEB AAG0J0NocmlzdGlhbiBIdWl0ZW1hIDxodWl0ZW1hQGh1aXRlbWEubmV0PokBOQQTAQIAIwUC UhFfyAIbLwcLCQgHAwIBBhUIAgkKCwQWAgMBAh4BAheAAAoJEJNDCbJVyA1yhbYH/1ud6x6m VqGIp0JcZUfSQO8w+TjugqxCyGNn+w/6Qb5O/xENxNQ4HaMQ5uSRK9n8WKKDDRSzwZ4syKKf wbkfj05vgFxrjCynVbm1zs2X2aGXh+PxPL/WHUaxzEP7KjYbLtCUZDRzOOrm+0LMktngT/k3 6+EZoLEM52hwwpIAzJoscyEz7QfqMOZtFm6xQnlvDQeIrHx0KUvwo/vgDLK3SuruG1CSHcR0 D24kEEUa044AIUKBS3b0b8AR7f6mP2NcnLpdsibtpabi9BzqAidcY/EjTaoea46HXALk/eJd 6OLkLE6UQe1PPzQC4jB7rErX2BxnSkHDw50xMgLRcl5/b1a5AQ0EUhFfyAEIAKp7Cp8lqKTV CC9QiAf6QTIjW+lie5J44Ad++0k8gRgANZVWubQuCQ71gxDWLtxYfFkEXjG4TXV/MUtnOliG 5rc2E+ih6Dg61Y5PQakm9OwPIsOx+2R+iSW325ngln2UQrVPgloO83QiUoi7mBJPbcHlxkhZ bd3+EjFxSLIQogt29sTcg2oSh4oljUpz5niTt69IOfZx21kf29NfDE+Iw56gfrxI2ywZbu5o G+d0ZSp0lsovygpk4jK04fDTq0vxjEU5HjPcsXC4CSZdq5E2DrF4nOh1UHkHzeaXdYR2Bn1Y wTePfaHBFlvQzI+Li/Q6AD/uxbTM0vIcsUxrv3MNHCUAEQEAAYkCPgQYAQIACQUCUhFfyAIb LgEpCRCTQwmyVcgNcsBdIAQZAQIABgUCUhFfyAAKCRC22tOSFDh1UOlBB/94RsCJepNvmi/c YiNmMnm0mKb6vjv43OsHkqrrCqJSfo95KHyl5Up4JEp8tiJMyYT2mp4IsirZHxz/5lqkw9Az tcGAF3GlFsj++xTyD07DXlNeddwTKlqPRi/b8sppjtWur6Pm+wnAHp0mQ7GidhxHccFCl65w uT7S/ocb1MjrTgnAMiz+x87d48n1UJ7yIdI41Wpg2XFZiA9xPBiDuuoPwFj14/nK0elV5Dvq 4/HVgfurb4+fd74PV/CC/dmd7hg0ZRlgnB5rFUcFO7ywb7/TvICIIaLWcI42OJDSZjZ/MAzz BeXm263lHh+kFxkh2LxEHnQGHCHGpTYyi4Z3dv03HtkH/1SI8joQMQq00Bv+RdEbJXfEExrT u4gtdZAihwvy97OPA2nCdTAHm/phkzryMeOaOztI4PS8u2Ce5lUB6P/HcGtK/038KdX5MYST Fn8KUDt4o29bkv0CUXwDzS3oTzPNtGdryBkRMc9b+yn9+AdwFEH4auhiTQXPMnl0+G3nhKr7 jvzVFJCRif3OAhEm4vmBNDE3uuaXFQnbK56GJrnqVN+KX5Z3M7X3fA8UcVCGOEHXRP/aubiw Ngawj0V9x+43kUapFp+nF69R53UI65YtJ95ec4PTO/Edvap8h1UbdEOc4+TiYwY1TBuIKltY 1cnrjgAWUh/Ucvr++/KbD9tD6C8= Message-ID: Date: Thu, 1 Aug 2019 23:11:02 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/alternative; boundary="------------0120552031A94D3E42D1755F" Content-Language: en-US X-Originating-IP: 66.113.197.87 X-Spampanel-Domain: xsmtpout.mail2web.com X-Spampanel-Username: 66.113.197.0/24 Authentication-Results: antispamcloud.com; auth=pass smtp.auth=66.113.197.0/24@xsmtpout.mail2web.com X-Spampanel-Outgoing-Class: unsure X-Spampanel-Outgoing-Evidence: Combined (0.15) X-Recommended-Action: accept X-Filter-ID: Mvzo4OR0dZXEDF/gcnlw0QR3kh8pms4IGrDTloUGIkypSDasLI4SayDByyq9LIhVUZbR67CQ7/vm /hHDJU4RXkTNWdUk1Ol2OGx3IfrIJKywOmJyM1qr8uRnWBrbSAGDNzOpszOkW3faMySFwG163+fH zJ6mVE7ewsipSVIfs4ZEr3lnunEUlp0vwyUBQHCMgyWFxOA5dILPypvKxNVhWQwOVcNrdpWfEYrY fLBY3+e8hb1lxHddBtWcfnl7xl+wmdySlZou9qHIGOZDEEo7O2nS6C1mWTD2n8BB0gTSSfDtw+Ut ziY+nbU7qa50sEXj8hEv6ylbrSataIASdByf+qyWDcKgIew/Pqmv8CiR0A+Ffy7fEg460Hn2xYnW avStyzAiWbbj13U46jbWFIz21cHX/YzWyFk7762whX3QQ+5uhkPm88V7ziklAaTl19sU919xeAvO xjeQEcL5lNmXdGd9U9Oojh2QY0MMPWjRsTVhMmX9VvKuj6psZloQqgYBwH0r+197ykuYmDR9wbL2 DBEuqNMl4E+tMKMsv/A3u4xFRxF9LSHNsZFl22lrRRn/H0knlMgOQTVp+x1fo2EPmz5tsQu9R3vp aAMkTA7gTKoJngF7rJQgeWTjF5V/EGvRGQi4HrK8ZTIu925tuSDvJBO8u0ag4+i9kLOW9cRnakdu 2lX9U0U/jnlrPw5p8im8gM5yDzctcfgaSyAJ9MhDntZcYflIMbaTJGx1xg/L1K2BpvYkmYpftDod 3ZrrcgNlJwCelAgxI3HE4I5TUXrjZm3rquuB36kDbDIFEdFz8wxczEi6LmG3YiVv9VAljKahZuM7 jUXIESohoO51xWmU8ZNfCyuJJ0v8KnjP4iInSCWi6HKZ+SL4xDPoNEAWE2vO86LodOZj79xdSjzK bqR5XHk0qi1hkw/hDGKWkPVYlXF3BhZxGgZFOwvGprxNGaa6/2rAztFeklLxGNN3KHaPkMjB65Ki hPq1I9TXHnOlSkg/OIORZDl9o+TmclcfPTQwNGP0PwcsocAqk8Y/wQ+e4HndwcgUdq9CmjcVQOst ghA= X-Report-Abuse-To: spam@quarantine9.antispamcloud.com Archived-At: Subject: Re: [Add] [EXT] Re: meeting hum: should the IETF take up this work? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 02 Aug 2019 06:21:52 -0000 This is a multi-part message in MIME format. --------------0120552031A94D3E42D1755F Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On 8/1/2019 10:59 AM, Jacques Latour wrote: > From the department of this-could-be-a-bad-idea and the department of > omg-this-goes-against-everything-we=E2=80=99re-trying-do, but here it g= oes: a > DoH operator should have a policy to blacklist IP address as requested > by the network operator, since we can=E2=80=99t effectively block DoH a= t the > edge of the enterprise network, an enterprise network should have the > ability to request the well behaved DoH recursive operators to block > requests coming from their network IP address.=C2=A0 Perhaps have some = sort > of trusted clearing house of IP addresses that the well behaved DoH > recursive operators should blacklist from. Enterprises can block non > well behaving DoH recursive operators. Not only does this come from the bad ideas department, but blocking at the DoH operator is not going to scale, given the number of enterprise policies. It also assumes the DoH operator can identify the enterprise network from which the query originated, which is non trivial -- what if the query arrives with DoH over Tor, for example? If you want to enforce an enterprise policy, you are much more likely to succeed at the local end point. I understand that Mozilla is willing to use an heuristic to detect enterprise networks that would require blocking DoH. If you don't trust that, your best bet is to enforce your blocked lists through a browser plug-in, the same kind of plugin that is also used for parental control. I suppose that security software companies will be willing to provide such plug-ins. -- Christian Huitema --------------0120552031A94D3E42D1755F Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 8bit

On 8/1/2019 10:59 AM, Jacques Latour wrote:

From the department of this-could-be-a-bad-idea and the department of omg-this-goes-against-everything-we’re-trying-do, but here it goes: a DoH operator should have a policy to blacklist IP address as requested by the network operator, since we can’t effectively block DoH at the edge of the enterprise network, an enterprise network should have the ability to request the well behaved DoH recursive operators to block requests coming from their network IP address.  Perhaps have some sort of trusted clearing house of IP addresses that the well behaved DoH recursive operators should blacklist from. Enterprises can block non well behaving DoH recursive operators.

Not only does this come from the bad ideas department, but blocking at the DoH operator is not going to scale, given the number of enterprise policies. It also assumes the DoH operator can identify the enterprise network from which the query originated, which is non trivial -- what if the query arrives with DoH over Tor, for example?

If you want to enforce an enterprise policy, you are much more likely to succeed at the local end point. I understand that Mozilla is willing to use an heuristic to detect enterprise networks that would require blocking DoH. If you don't trust that, your best bet is to enforce your blocked lists through a browser plug-in, the same kind of plugin that is also used for parental control. I suppose that security software companies will be willing to provide such plug-ins.

-- Christian Huitema


--------------0120552031A94D3E42D1755F-- From nobody Thu Aug 1 23:49:27 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BA63F12013A for ; Thu, 1 Aug 2019 23:49:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=swm.pp.se Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oQv1Cvxxb6wH for ; Thu, 1 Aug 2019 23:49:23 -0700 (PDT) Received: from uplift.swm.pp.se (swm.pp.se [212.247.200.143]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 89253120137 for ; Thu, 1 Aug 2019 23:49:22 -0700 (PDT) Received: by uplift.swm.pp.se (Postfix, from userid 501) id 54096B0; Fri, 2 Aug 2019 08:49:19 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=swm.pp.se; s=mail; t=1564728559; bh=BEq61y9CDM8FTEmVO3WbxbANrduqLqdSKWnH/6tEmwI=; h=Date:From:To:cc:Subject:In-Reply-To:References:From; b=DGNQ6MwZJEs1zO/XehI5AKMSzFsbfAX/ot7AFvwg7AfRRVyin88zxfN3qdQix7Lmt onUoEaem02zEyw9lLU3HvG0s2BwgSz0OLrvm/jUghJuGyBWxcil6OPfUo7YtoRsVIx rsDlX574BOuDm9RxdzHo+94h13NVd1K3YGF25X+M= Received: from localhost (localhost [127.0.0.1]) by uplift.swm.pp.se (Postfix) with ESMTP id 5165BAF; Fri, 2 Aug 2019 08:49:19 +0200 (CEST) Date: Fri, 2 Aug 2019 08:49:19 +0200 (CEST) From: Mikael Abrahamsson To: Christian Huitema cc: Jacques Latour , =?ISO-8859-15?Q?=D3lafur_Gu=F0mundsson?= , "Livingood, Jason" , "add@ietf.org" , Adam Roach In-Reply-To: Message-ID: References: <8F094057-DFBC-4732-9DA4-BE46E7914C8A@rfc1035.com> <20190724165951.GB29051@laperouse.bortzmeyer.org> <821B448B-F7EA-46A5-837D-DA0E8C60643A@open-xchange.com> <488E2CE0-73D5-4B9E-A5AD-28FDCB95ED2A@cable.comcast.com> User-Agent: Alpine 2.20 (DEB 67 2015-01-07) Organization: People's Front Against WWW MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII; format=flowed Archived-At: Subject: Re: [Add] [EXT] Re: meeting hum: should the IETF take up this work? X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 02 Aug 2019 06:49:25 -0000 On Thu, 1 Aug 2019, Christian Huitema wrote: > If you want to enforce an enterprise policy, you are much more likely to > succeed at the local end point. I understand that Mozilla is willing to > use an heuristic to detect enterprise networks that would require > blocking DoH. If you don't trust that, your best bet is to enforce your > blocked lists through a browser plug-in, the same kind of plugin that is > also used for parental control. I suppose that security software > companies will be willing to provide such plug-ins. I don't see any way that any heuristic can work with the use-cases. You either trust the network or you don't. There is no way to say this with heuristics based on what the network says, GEO-IP or anything else. 1. Devices under Parental / enterprise control: You don't get to do that choice (choose if you trust the network or not, that's been chosen by the administrator) 2. Networks with pervasive surveillence due to local laws : Of course you want to be able to make that choice on your device, and either follow local law or not 3. Most other cases: There is no sensible default because we have no idea if the user trusts their ISP / network or not, or if they want to send their queries to a 3rd party DoH operator or not. I'm in 3 and I want to be able to choose this based on network attachment (SSID for instance). This means the operating system network connection manager comes into play. I don't see any other way to do all of this than to get the operating system vendor involved. This means to me that Android/Google, Windows/Microsoft, and Apple needs to come up with APIs to communicate this choice to the application if the application doesn't want to ask the user on a case-by-case basis. -- Mikael Abrahamsson email: swmike@swm.pp.se From nobody Fri Aug 2 02:52:23 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3369D120088 for ; Fri, 2 Aug 2019 02:52:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.199 X-Spam-Level: X-Spam-Status: No, score=-4.199 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_NONE=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9PfwT0At59SE for ; Fri, 2 Aug 2019 02:52:19 -0700 (PDT) Received: from ppsw-30.csi.cam.ac.uk (ppsw-30.csi.cam.ac.uk [131.111.8.130]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C67F512004E for ; Fri, 2 Aug 2019 02:52:19 -0700 (PDT) X-Cam-AntiVirus: no malware found X-Cam-ScannerInfo: http://help.uis.cam.ac.uk/email-scanner-virus Received: from grey.csi.cam.ac.uk ([131.111.57.57]:45368) by ppsw-30.csi.cam.ac.uk (ppsw.cam.ac.uk [131.111.8.136]:25) with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) id 1htUEQ-000weZ-fp (Exim 4.92.1) (return-path ); Fri, 02 Aug 2019 10:52:14 +0100 Date: Fri, 2 Aug 2019 10:52:14 +0100 From: Tony Finch To: =?UTF-8?B?56We5piO6YGU5ZOJ?= cc: Stephane Bortzmeyer , "add@ietf.org" , Barry Leiba , "STARK, BARBARA H" , Rob Sayre In-Reply-To: Message-ID: References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <20190724171549.GD29051@laperouse.bortzmeyer.org> User-Agent: Alpine 2.20 (DEB 67 2015-01-07) MIME-Version: 1.0 Content-Type: multipart/mixed; BOUNDARY="1870870841-303312886-1564739534=:11612" Archived-At: Subject: Re: [Add] point of deploying DoH in access network (Re: meeting hum: should the IETF take up this work?) X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 02 Aug 2019 09:52:22 -0000 This message is in MIME format. The first part should be readable text, while the remaining parts are likely unreadable without MIME-aware tools. --1870870841-303312886-1564739534=:11612 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: QUOTED-PRINTABLE =E7=A5=9E=E6=98=8E=E9=81=94=E5=93=89 wrote: > Stephane Bortzmeyer wrote: > > > > I'm tempted to say that I don't see the point for an access network to > > deploy DoH. > > I've been wondering about this, too. University not access network, but providing encrypted DNS to my users means DoT for most cases and DoH for Firefox users. There's also the vague notion from the early days of DoH that javascript in the browser might make DNS queries but I haven't seen any evidence of that or even any signs of interest in the idea. Tony. --=20 f.anthony.n.finch http://dotat.at/ West Viking: Northerly 3 to 5. Slight or moderate. Mainly fair. Good, occasionally poor at first. --1870870841-303312886-1564739534=:11612-- From nobody Fri Aug 2 04:18:50 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 92E59120096 for ; Fri, 2 Aug 2019 04:18:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, HTML_NONELEMENT_30_40=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=scramworks.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qN1gHbu1KD50 for ; Fri, 2 Aug 2019 04:18:46 -0700 (PDT) Received: from knid.scramworks.net (knid.scramworks.net [IPv6:2a01:4f8:c17:50eb::2]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AAAE0120033 for ; Fri, 2 Aug 2019 04:18:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=scramworks.net; s=bofh; h=References:In-Reply-To:To:From:Subject:Message-ID :Date:MIME-Version:Content-Type; bh=g+jf7D2v6AydYbD9yYVV7/Phfx66YFyA6qxH0LssLWc=; b=Sb3WWp5pzFgZmbZ84BQrurGS4W AHID8z+7Nylqh0M99iq73I4ZXOSyJe7yHnGOmipUgb8ny9838zrygORBtxK/J3BGURIQezwC1hOaz 4jotnwMzXMWmwq1EwmInSx2ZyVrO+u1vmAAAMjPQW2K7cNpuHS7LDiW9dB3vBeOU/EbY=; Received: from [90.240.166.166] (helo=[192.168.1.6]) by knid.scramworks.net with esmtpsa (TLS1.1:ECDHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.86_2) (envelope-from ) id 1htVa9-00052D-1f for add@ietf.org; Fri, 02 Aug 2019 12:18:45 +0100 Content-Type: multipart/alternative; boundary="----=_NextPart_27581608.602884925896" MIME-Version: 1.0 Date: Fri, 02 Aug 2019 12:17:19 +0100 Message-ID: <26e4fa63-f50d-42d6-bcda-4d7e62b95704@getmailbird.com> From: "Robert Mortimer" To: "" In-Reply-To: References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <20190724171549.GD29051@laperouse.bortzmeyer.org> User-Agent: Mailbird/2.6.1.0 X-Mailbird-ID: 26e4fa63-f50d-42d6-bcda-4d7e62b95704@getmailbird.com X-Spam-Score-SW: -1.0 (-) X-SW-Scan: bdace1d3122527610c608ab96d92af77 X-Clacks-Overhead: GNU Terry Pratchett Archived-At: Subject: Re: [Add] point of deploying DoH in access network (Re: meeting hum: should the IETF take up this work?) X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 02 Aug 2019 11:18:49 -0000 ------=_NextPart_27581608.602884925896 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Tony, =C2=A0Just on the javascript in browser making DNS queries, already been do= ne to control a spam campaign. https://www.bleepingcomputer.com/news/security/new-spam-campaign-controlled= -by-attackers-via-dns-txt-records/ [https://www.bleepingcomputer.com/news/s= ecurity/new-spam-campaign-controlled-by-attackers-via-dns-txt-records/] So the bad guys at least are already doing this. They could of course use o= ther methods etc. etc. --=C2=A0 Robm 873 =C2=A0 "Ask not what I can do for the stupid,=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0but what the stupid can do for me" - Grae= me Garden On 02/08/2019 10:53:31, Tony Finch wrote: =E7=A5=9E=E6=98=8E=E9=81=94=E5=93=89 wrote: > Stephane Bortzmeyer wrote: > > > > I'm tempted to say that I don't see the point for an access network to > > deploy DoH. > > I've been wondering about this, too. University not access network, but providing encrypted DNS to my users means DoT for most cases and DoH for Firefox users. There's also the vague notion from the early days of DoH that javascript in the browser might make DNS queries but I haven't seen any evidence of that or even any signs of interest in the idea. Tony. -- f.anthony.n.finch http://dotat.at/ West Viking: Northerly 3 to 5. Slight or moderate. Mainly fair. Good, occasionally poor at first.-- Add mailing list Add@ietf.org https://www.ietf.org/mailman/listinfo/add ------=_NextPart_27581608.602884925896 Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable
=0A =0A = =0A = =0A =0A = =0A Tony,

 Just on the javascript in brow= ser making DNS queries, already been done to control a spam campaign.
https://www.bleepingcomputer.com/news/security/new-spam-= campaign-controlled-by-attackers-via-dns-txt-records/

So = the bad guys at least are already doing this. They could of course use othe= r methods etc. etc.

-- 
Robm
<= div>873
  "Ask not what I can do for the stupid, 
=
         but what the stupid can do for me" -= Graeme Garden
=0A On 02/08/2019 10:53:31, Tony F= inch <dot@dotat.at> wrote:

=E7=A5=9E=E6=98=8E=E9=81=94=E5=93=89 wro= te:=0A
> Stephane Bortzmeyer wrote:=0A
> &g= t;=0A
> > I'm tempted to say that I don't see the point for an acc= ess network to=0A
> > deploy DoH.=0A
>=0A
> I've been = wondering about this, too.=0A
=0A
University not access network, but = providing encrypted DNS to my users=0A
means DoT for most cases and DoH = for Firefox users. There's also the vague=0A
notion from the early days = of DoH that javascript in the browser might=0A
make DNS queries but I ha= ven't seen any evidence of that or even any=0A
signs of interest in the = idea.=0A
=0A
Tony.=0A
-- =0A
f.anthony.n.finch = http://dotat.at/=0A
West Viking: Northerly 3 to 5. Slight or moderate. = Mainly fair. Good,=0A
occasionally poor at first.-- =0A
Add mailing l= ist=0A
Add@ietf.org=0A
https://www.ietf.org/mailman/listinfo/add=0A
=0A =0A =
------=_NextPart_27581608.602884925896-- From nobody Fri Aug 2 04:38:32 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E427C120096 for ; Fri, 2 Aug 2019 04:38:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EuYHgraybFo7 for ; Fri, 2 Aug 2019 04:38:26 -0700 (PDT) Received: from mail-yb1-xb34.google.com (mail-yb1-xb34.google.com [IPv6:2607:f8b0:4864:20::b34]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5013E120033 for ; Fri, 2 Aug 2019 04:38:26 -0700 (PDT) Received: by mail-yb1-xb34.google.com with SMTP id s41so4586270ybe.12 for ; Fri, 02 Aug 2019 04:38:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=Ru5OWoUsBV+haBMZYty7PSBBmHoZHLXJP2pcvE5bHn4=; b=bfXriFmGyLwgGdsXZL1AjFfNeIVVwGH33clrKV8W3PjcTC24P8GJA3IDOAcYfvNsWf ZsJsRegRe+gLjWebzLcl+oE8zq90xRIXoslOxpB8iHrxZS3dbndh5UCFhD9Opwy3UKvI uu5PWR/i+WShjmoiVvmkFbIorhk0DX4CTUeR9k2dg8Sq4jhzGSDgHkfnQP9f2MTF1Ix6 cyAoVYMTMMtnmbYfaDm5lwsoEBrb1i6g5vZUpszsK537LMLavd3d2FIHBH62b1al+M+Q qw0inlML1rz/MOtbMG//BymdQak0jqZdknlzAkzOt5JA5ooPJFiuxnCkuJpxZgo0chqF e8kg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=Ru5OWoUsBV+haBMZYty7PSBBmHoZHLXJP2pcvE5bHn4=; b=FuPl498ulJ8ZluAP4It+cQQhGrwpE/v7WHbmaZYV/G1+3mf53iuFSwoLoHxUQsLEbc 5ov4BR5uzQ6zLHPu+PR9/VJ5gMzqBrlIf+Eecrkx5tzLL2QKaz9S8ecQhE0dudTzNof7 K0uZNTvvakdkwO2ZThAqxUBmtExLH1Sk3X2SGw57EBlCMX1TpcAo8a9wdI2FZSKeKE7e WVfCvibLG5E0dQ8Y2gN6WvAbM9QQP8k4x8unc+ghw51mUdldoWeRlpZXS/UEXRrf7D6m PpoL+kwsvyG8yQ9kTHwmv7/gXRn/7kVNiqHjLXT4JkbDFr8l5pRLuJdm/lCiZPBp9S3o 1J6Q== X-Gm-Message-State: APjAAAX/M4e7kaQJpn2nRXTD5q/AJUf+GiaJ8yrxpu+CMzXt0GuyihE3 iw5Wk3nsDKVUsoOrQs9F8yDP6h1Z2lEhg3Kj3nJTDNs/r7k= X-Google-Smtp-Source: APXvYqzzD1NZ/30O6FVobjFGVZbA3ERn3oC7O2EetUFPBvZqHRCG5Ni++yau8sJmJI3kgCWfMflj5S2IUdWuxuQvBko= X-Received: by 2002:a25:f20d:: with SMTP id i13mr29922536ybe.170.1564745905244; Fri, 02 Aug 2019 04:38:25 -0700 (PDT) MIME-Version: 1.0 References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <20190724171549.GD29051@laperouse.bortzmeyer.org> <26e4fa63-f50d-42d6-bcda-4d7e62b95704@getmailbird.com> In-Reply-To: <26e4fa63-f50d-42d6-bcda-4d7e62b95704@getmailbird.com> From: Alec Muffett Date: Fri, 2 Aug 2019 12:37:48 +0100 Message-ID: To: Robert Mortimer Cc: ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000d88df8058f20cb57" Archived-At: Subject: Re: [Add] point of deploying DoH in access network (Re: meeting hum: should the IETF take up this work?) X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 02 Aug 2019 11:38:29 -0000 --000000000000d88df8058f20cb57 Content-Type: text/plain; charset="UTF-8" On Fri, 2 Aug 2019 at 12:18, Robert Mortimer wrote: > Just on the javascript in browser making DNS queries, already been done > to control a spam campaign. > > https://www.bleepingcomputer.com/news/security/new-spam-campaign-controlled-by-attackers-via-dns-txt-records/ > > So the bad guys at least are already doing this. They could of course use > other methods etc. etc. > For anyone else who hasn't been through the archives, this one has already been discussed on this maillist: https://mailarchive.ietf.org/arch/msg/add/6lkOu-0D6OWNfHwnsK7S1NkG6Oo https://mailarchive.ietf.org/arch/msg/add/OoEVkT3IdLnTqhBuE777MKPAlRo - alec -- http://dropsafe.crypticide.com/aboutalecm --000000000000d88df8058f20cb57 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Fri,= 2 Aug 2019 at 12:18, Robert Mortimer <robm=3D40scramworks.net@dmarc.ietf.org> wrote:
=
=C2=A0Just on th= e javascript in browser making DNS queries, already been done to control a = spam campaign.
= https://www.bleepingcomputer.com/news/security/new-spam-campaign-controlled= -by-attackers-via-dns-txt-records/

So the bad guys at least a= re already doing this. They could of course use other methods etc. etc.

For anyone else who hasn't been through the ar= chives, this one has already been discussed on this maillist:

=C2=A0= =C2=A0 https://mailarchive.ietf.org/arch/msg/add/6lkOu-0D6OWNfHwnsK= 7S1NkG6Oo

=C2=A0 =C2=A0 https://mailarchive.ietf.org/arch/msg/add/OoEV= kT3IdLnTqhBuE777MKPAlRo
=C2=A0
- alec

--
http:/= /dropsafe.crypticide.com/aboutalecm
--000000000000d88df8058f20cb57-- From nobody Fri Aug 2 05:25:38 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 66ECF1200A3 for ; Fri, 2 Aug 2019 05:25:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kMvNQVsAUGVk for ; Fri, 2 Aug 2019 05:25:34 -0700 (PDT) Received: from mail-qt1-x835.google.com (mail-qt1-x835.google.com [IPv6:2607:f8b0:4864:20::835]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2AE89120033 for ; Fri, 2 Aug 2019 05:25:34 -0700 (PDT) Received: by mail-qt1-x835.google.com with SMTP id r6so69396216qtt.0 for ; Fri, 02 Aug 2019 05:25:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=eb615BGLl4cCblnvhsE2yceKEmTCge1rDZMd2r1QoCo=; b=QiJME09fmO7CnALazKBei3GiUVL+3X32CTMpcj1JUyp1O5QTG2hY0pUI73qH24UcTe PZ86HFDIfBUAY0ktTT4mBnXhv9e3OryN9qesGS2QmIpt+I0Fm2pTBJQQTV7mN5nzC3Ib 4iLsgIwbvpkMC1FoACS6gVpJ0LvdIYnEhfA4kyHVk2KRwUGv3u5cQwub14jfvG4yNNFH sHd6K5PwCGOTQSE5iBjZkGJMdVuCyFEL/xs9EcChBYvxE7gloLAe1SRbMPrntzdNG8+P s+YVgGWvUvLC1moEjFUEvnFRwv0ODEyiokQOulVw9uAExE3i2EYtOprmukzsCC+rU/5l yYCg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=eb615BGLl4cCblnvhsE2yceKEmTCge1rDZMd2r1QoCo=; b=mvVL99EoJXbb3HO1BoZSMd6pb3zqDr4dZuQVc04bOtb7XB5NOsvjXlX8W0BwySxL8a e2PQFU550tKghxsKAiQ69AAq1O0XB/Qny3yIOi8hKL0vdQQSPx81y6subtuwylaqaWcN FfZGbiSj8q6sE8P3dkRYJ4+qT0M8n81dHTNAyZii2Vh4G0UkmanhXdCKshRCLL6qoahj MNyNAq+7IOft2mrqF09YfO6AqNBD/oHj+iJnXYUOFuZI8XD04qUV1X8CwAeTDf4o6VTD SRRw7bjnOy26NLZTETfPcbm4arhK/7EGBjYGZH/prY01AEl/6b+v1TUxDX8hUdUonLXV BHYw== X-Gm-Message-State: APjAAAXuM2kmSa5Qns6A7e/ZK6fbgL6wgm1AEQEsVaKRuoFDjeMAigCH HMxftF0JGA7EE5QVysZcA6wSug== X-Google-Smtp-Source: APXvYqyGfqJ4aTdwtgpeJ0CRu9p/ueDw/GFR8g3rhjzbwh8T7eIvoEGG4rDpW3EW1grbMkRlJqRXLA== X-Received: by 2002:ad4:5283:: with SMTP id v3mr96990153qvr.207.1564748733213; Fri, 02 Aug 2019 05:25:33 -0700 (PDT) Received: from [10.0.30.11] (c-73-186-137-119.hsd1.nh.comcast.net. [73.186.137.119]) by smtp.gmail.com with ESMTPSA id c74sm32601808qke.128.2019.08.02.05.25.32 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 02 Aug 2019 05:25:32 -0700 (PDT) Content-Type: multipart/alternative; boundary=Apple-Mail-AD0CF0FD-4990-431C-96C2-79F03254CCF6 Mime-Version: 1.0 (1.0) From: Ted Lemon X-Mailer: iPhone Mail (16G77) In-Reply-To: Date: Fri, 2 Aug 2019 08:25:32 -0400 Cc: Tommy Jensen , ADD Mailing list Content-Transfer-Encoding: 7bit Message-Id: References: To: Rob Sayre Archived-At: Subject: Re: [Add] WG wiki X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 02 Aug 2019 12:25:37 -0000 --Apple-Mail-AD0CF0FD-4990-431C-96C2-79F03254CCF6 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable A wiki is a good place to collect ideas and organize them so that we can see= what we have talked about. It=E2=80=99s a much better tool for reaching con= sensus than a mailing list.=20 Sent from my iPhone > On Aug 2, 2019, at 1:15 AM, Rob Sayre wrote: >=20 > I don't think the list has gotten to the point of creating infrastructure f= or a WG, because there isn't a WG yet. >=20 > One hazard of pressing forward in the face of opposition is that the outpu= t of the WG, and the IETF itself, could be viewed as irrelevant. >=20 > That is why the IETF tends to strive for consensus. >=20 > thanks, > Rob >=20 >> On Thu, Aug 1, 2019 at 2:00 PM Tommy Jensen wrote: >> Hey all, >>=20 >> I checked https://trac.ietf.org/ to see if there was a wiki we could use t= o pursue some of the collaboration efforts people are +1ing today, but the A= DD path appears to be blocked/nonexistant. Is there any way for us to create= that so we can start writing down and brainstorming through some of the doc= ument ideas being brought up without having to build them up into full blown= drafts offline first? >>=20 >> Thanks, >> Tommy >> --=20 >> Add mailing list >> Add@ietf.org >> https://www.ietf.org/mailman/listinfo/add > --=20 > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add --Apple-Mail-AD0CF0FD-4990-431C-96C2-79F03254CCF6 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable A wiki is a good place to collect ideas and= organize them so that we can see what we have talked about. It=E2=80=99s a m= uch better tool for reaching consensus than a mailing list. 

Sent from my iPhone

On Aug 2, 2019, at 1:15 AM, Rob Sayre <sayrer@gmail.com> wrote:

I don't think the list has got= ten to the point of creating infrastructure for a WG, because there isn't a W= G yet.

One hazard of pressing forward in the face o= f opposition is that the output of the WG, and the IETF itself, could be vie= wed as irrelevant.

That is why the IETF tends to st= rive for consensus.

thanks,
Rob

=
On Thu, Aug= 1, 2019 at 2:00 PM Tommy Jensen <Jensen.Thomas=3D40microsoft.com@dmarc.ietf.org<= /a>> wrote:
Hey all,

I checked https://= trac.ietf.org/ to see if there was a wiki we could use to pursue so= me of the collaboration efforts people are +1ing today, but the ADD path app= ears to be blocked/nonexistant. Is there any way for us to create that so we can start writing down and brainstorming through so= me of the document ideas being brought up without having to build them up in= to full blown drafts offline first?

Thanks,
Tommy
--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
= --Apple-Mail-AD0CF0FD-4990-431C-96C2-79F03254CCF6-- From nobody Fri Aug 2 05:35:58 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4D00012009E for ; Fri, 2 Aug 2019 05:35:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id garrMc2CmSL9 for ; Fri, 2 Aug 2019 05:35:55 -0700 (PDT) Received: from mail-qt1-x834.google.com (mail-qt1-x834.google.com [IPv6:2607:f8b0:4864:20::834]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 23F25120033 for ; Fri, 2 Aug 2019 05:35:55 -0700 (PDT) Received: by mail-qt1-x834.google.com with SMTP id w17so29354235qto.10 for ; Fri, 02 Aug 2019 05:35:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=c1SruKf0PHPXeyjSxG7OlQuQFWOVzkM3jEAN1NbDONA=; b=qVFBZUB5UofBE1JK1IgOR9R+3uBpvWfNFIdTwHmhmoUmLJxSS+9Lf4ogeMCEsxAR1j fuaYydd5JBLYhONRWJUJo8+tnKJlYunfOXs0L0ErsoNgyQV6UYApLfwon1DNoB+hgLjZ /0fJZi7OPK5w7TTcWkQr7eY5JjmQ4LgEUIAhEMjcaW7hyrHT2rgLtAqrfrjoraIZpocr v8xHnqYS3Yneyq65Syyirihfoh0rLBDrRkYg5sOANYTS8VvkLz9G6qVdvzIMS3Plk3B4 Qh7YKg/IRqvhwveQtK/YO9JHGA5XwaAWuOLnfzYqithjWMfaaPIMc0PeQw30GDgutWNI uCuQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=c1SruKf0PHPXeyjSxG7OlQuQFWOVzkM3jEAN1NbDONA=; b=C9n37kX7XopEwU74CtRwl9FI5f2X4VIHyGh5/ljwHV9glJ4xTnH9fCZ7ctlldy10So UNVJs8VtwUjyKfko4aFQ+auHFH5tXL4BI/we5+Ng6ho+YQmLs5hmyOvQNv6WmrBTaZ2H b1JeJfqmAMoGK0gsNTw9ErvmcbkmO5hTvLiBs+AlOgrC/YTTvo0bMDgHOXbE4L6ZvqaQ +PhihjBXUodrPbUwOPDCtJNSMifhP+S3qiddbr7gayy+oNZKYbMoPmW8dS5l6AFGfaxi IqKSCkEnzvS/K2Q3bV9G8ZBe5cCKqs7oGIThRqLCK4uAyAzbOhjR3Ne0/OyockIoCAz3 jJeQ== X-Gm-Message-State: APjAAAWEcBoSCKHY8JzLgSSDPp8S59eziY7pR2zJd/k74WPcsZYu3j2H PRatMK6+jqS4y4IWvbSXn/5sjA== X-Google-Smtp-Source: APXvYqzLCFN7KSoovw6EmQmqmV5GpvkAnPmUamNxTl+SPNDV514eZyc5JTsW2q/vPZXf7VBMusOo+w== X-Received: by 2002:a0c:f788:: with SMTP id s8mr91467077qvn.35.1564749354150; Fri, 02 Aug 2019 05:35:54 -0700 (PDT) Received: from [10.0.30.11] (c-73-186-137-119.hsd1.nh.comcast.net. [73.186.137.119]) by smtp.gmail.com with ESMTPSA id q56sm37962588qtq.64.2019.08.02.05.35.53 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 02 Aug 2019 05:35:53 -0700 (PDT) Content-Type: multipart/alternative; boundary=Apple-Mail-C1604306-DA5D-4BC2-92E1-145A6A9AECC5 Mime-Version: 1.0 (1.0) From: Ted Lemon X-Mailer: iPhone Mail (16G77) In-Reply-To: Date: Fri, 2 Aug 2019 08:35:52 -0400 Cc: Robert Mortimer , ADD Mailing list Content-Transfer-Encoding: 7bit Message-Id: References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <20190724171549.GD29051@laperouse.bortzmeyer.org> <26e4fa63-f50d-42d6-bcda-4d7e62b95704@getmailbird.com> To: Alec Muffett Archived-At: Subject: Re: [Add] point of deploying DoH in access network (Re: meeting hum: should the IETF take up this work?) X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 02 Aug 2019 12:35:57 -0000 --Apple-Mail-C1604306-DA5D-4BC2-92E1-145A6A9AECC5 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Someone in another thread pointed out that it=E2=80=99s too soon to create a= wiki. This discussion is a clear example of why a wiki would be good.=20 It=E2=80=99s fairly clear to me that there isn=E2=80=99t a clear understandi= ng of the threat models for which mitigations are being discussed. Clearly d= escribing the threat models we believe exist in a wiki would allow us to eva= luate proposed solutions to see if they address these threat models.=20 Right now we are discussing mitigations that have already been shown not to a= ddress actual threats, but because we aren=E2=80=99t documenting the discuss= ion, that has been forgotten and so we are repeating ourselves.=20 Sent from my iPhone > On Aug 2, 2019, at 7:37 AM, Alec Muffett wrote: >=20 >> On Fri, 2 Aug 2019 at 12:18, Robert Mortimer wrote: >=20 >> Just on the javascript in browser making DNS queries, already been done t= o control a spam campaign. >> https://www.bleepingcomputer.com/news/security/new-spam-campaign-controll= ed-by-attackers-via-dns-txt-records/ >>=20 >> So the bad guys at least are already doing this. They could of course use= other methods etc. etc. >=20 > For anyone else who hasn't been through the archives, this one has already= been discussed on this maillist: >=20 > https://mailarchive.ietf.org/arch/msg/add/6lkOu-0D6OWNfHwnsK7S1NkG6Oo >=20 > https://mailarchive.ietf.org/arch/msg/add/OoEVkT3IdLnTqhBuE777MKPAlRo > =20 > - alec >=20 > -- > http://dropsafe.crypticide.com/aboutalecm > --=20 > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add --Apple-Mail-C1604306-DA5D-4BC2-92E1-145A6A9AECC5 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable Someone in another thread pointed out that i= t=E2=80=99s too soon to create a wiki. This discussion is a clear example of= why a wiki would be good. 

It=E2=80=99s fairly clea= r to me that there isn=E2=80=99t a clear understanding of the threat models f= or which mitigations are being discussed. Clearly describing the threat mode= ls we believe exist in a wiki would allow us to evaluate proposed solutions t= o see if they address these threat models. 

Ri= ght now we are discussing mitigations that have already been shown not to ad= dress actual threats, but because we aren=E2=80=99t documenting the discussi= on, that has been forgotten and so we are repeating ourselves. 

=
Sent from my iPhone

On Aug 2, 2019, at 7:37 AM, Alec Muffett <alec.muffett@gmail.com> wrote:

<= blockquote type=3D"cite">
=
On Fri, 2 Aug 2019 at 12:18, Robert Mortim= er <robm=3D40scramwork= s.net@dmarc.ietf.org> wrote:
 Just on the javascript in browser making DNS queries= , already been done to control a spam campaign.
ht= tps://www.bleepingcomputer.com/news/security/new-spam-campaign-controlled-by= -attackers-via-dns-txt-records/
=
So the bad guys at least are al= ready doing this. They could of course use other methods etc. etc.

For anyone else who hasn't been through the archives, thi= s one has already been discussed on this maillist:

    https://mailarchive.ietf.org/arch/msg/add/6lkOu-0D6OWNfHwnsK7S1NkG6Oo<= /div>

  &= nbsp; https://mailarchive.ietf.org/arch/msg/add/OoEVkT3IdLnTqhBuE777MK= PAlRo
 
- alec

--
http://dropsafe.crypticide= .com/aboutalecm
= --Apple-Mail-C1604306-DA5D-4BC2-92E1-145A6A9AECC5-- From nobody Fri Aug 2 05:42:22 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2E36912009E for ; Fri, 2 Aug 2019 05:42:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=culture.gov.uk Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8nnEvP0Md8Xx for ; Fri, 2 Aug 2019 05:42:18 -0700 (PDT) Received: from mail-lj1-x236.google.com (mail-lj1-x236.google.com [IPv6:2a00:1450:4864:20::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7CB8D120033 for ; Fri, 2 Aug 2019 05:42:17 -0700 (PDT) Received: by mail-lj1-x236.google.com with SMTP id d24so72693905ljg.8 for ; Fri, 02 Aug 2019 05:42:17 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=culture.gov.uk; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to; bh=Ucw6VyaaXOFWNViaOVdSgtkwyLFd9OpTAMNwCC9bBQY=; b=VTLtY81u9yzq4fmKtHxrM7EMjTX92xQcEyl4avkUsl7cKI3t+xFomIvTlRaTt3nLh5 YvibiE6kw5/RDyySBZenJpDdLREbTcCumKbr0nFbFP2wMxmsSVtgyf44wq74uJFtNm8N KX1eJqzeENrcsdF2th+QLjhLTwQksvqoAHx+TSrr9EVmrIQdQM1BYYzZOHx9rjOr2H1H oTArUGovgs50gcTAN6E6cLCsuDEycih5GqECXDXUHRyvuteCi3QoLZDX9fHW7MRDu+An eQgy6PP0fO9TqpkXpBGflwxzr7jeXH+qkD5QGOXPdSJOqYthrqWwBNULsAec56DfUdRG AC/A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to; bh=Ucw6VyaaXOFWNViaOVdSgtkwyLFd9OpTAMNwCC9bBQY=; b=qj67Z0J0+7mQJ9uVwBrVBdWSWUJdPEUDbC5gRzgkqtbEh3JITNHXT2JnL1028NzK8b lJHDaQFD/epIpe+C9LHocWdEGX3KYcuTe/RsXHbVh+jpS80uYDQ96g6wx1Z4iToQ4ATA OkOV46nn5D225CEErmtlMgMUpJaz9jtm32skVbNNvzVzubsBKepKONVC6/bgbM93SlCy 5RPASP6VAEHoH221sBM8DThsKbvsnpFJRU5CjufRkovZbYOljZIgjrqLPsecqYxLR/TG QmAKg1nJKgQ5dMcm4Kh4t3MBUrq+2sIvQcX7do7ffSBFGJ1WQgP71lD0+mocVE94vVuW PFmQ== X-Gm-Message-State: APjAAAVn8grMZLERWzGTQgp9sp4jYHWk/bZwZ63qy8M617zmB84swCgX EkiQEGY0/4f5MnDhvAwcqJMfWtqj3pLNGveu2lBnqyo9 X-Google-Smtp-Source: APXvYqxCG/RRni/7MZNc0QIwoK3s2Z6iQ0biy+vBcgE4SDdjMYbfrVU8HhTPB51Os16mppAZ6x3FX8CertSDPrVLyuc= X-Received: by 2002:a2e:8396:: with SMTP id x22mr73296446ljg.135.1564749734702; Fri, 02 Aug 2019 05:42:14 -0700 (PDT) MIME-Version: 1.0 References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <20190724171549.GD29051@laperouse.bortzmeyer.org> <26e4fa63-f50d-42d6-bcda-4d7e62b95704@getmailbird.com> In-Reply-To: From: Simon Hicks Date: Fri, 2 Aug 2019 13:42:03 +0100 Message-ID: To: ADD Mailing list Content-Type: multipart/alternative; boundary="00000000000019916c058f21b0d9" Archived-At: Subject: Re: [Add] point of deploying DoH in access network (Re: meeting hum: should the IETF take up this work?) X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 02 Aug 2019 12:42:21 -0000 --00000000000019916c058f21b0d9 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable > > Indeed, a wiki allows us to assemble material and thoughts in one place, > rather than repeat (and forget) the same arguments in an email chain. I= t > does not presuppose the need, or not, for a group. It just gets on one > page the arguments and allows us to see what a group could do > Regards Simon On Fri, 2 Aug 2019 at 13:36, Ted Lemon wrote: > Someone in another thread pointed out that it=E2=80=99s too soon to creat= e a wiki. > This discussion is a clear example of why a wiki would be good. > > It=E2=80=99s fairly clear to me that there isn=E2=80=99t a clear understa= nding of the > threat models for which mitigations are being discussed. Clearly describi= ng > the threat models we believe exist in a wiki would allow us to evaluate > proposed solutions to see if they address these threat models. > > Right now we are discussing mitigations that have already been shown not > to address actual threats, but because we aren=E2=80=99t documenting the > discussion, that has been forgotten and so we are repeating ourselves. > > Sent from my iPhone > > On Aug 2, 2019, at 7:37 AM, Alec Muffett wrote: > > On Fri, 2 Aug 2019 at 12:18, Robert Mortimer 40scramworks.net@dmarc.ietf.org> wrote: > >> Just on the javascript in browser making DNS queries, already been done >> to control a spam campaign. >> >> https://www.bleepingcomputer.com/news/security/new-spam-campaign-control= led-by-attackers-via-dns-txt-records/ >> >> So the bad guys at least are already doing this. They could of course us= e >> other methods etc. etc. >> > > For anyone else who hasn't been through the archives, this one has alread= y > been discussed on this maillist: > > https://mailarchive.ietf.org/arch/msg/add/6lkOu-0D6OWNfHwnsK7S1NkG6Oo > > https://mailarchive.ietf.org/arch/msg/add/OoEVkT3IdLnTqhBuE777MKPAlRo > > - alec > > -- > http://dropsafe.crypticide..com/aboutalecm > > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --00000000000019916c058f21b0d9 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Indeed, a wiki allows us to= assemble material and thoughts in one place, rather than repeat (and forge= t) the same arguments in an=C2=A0 email chain.=C2=A0 It does not presuppose= the need, or not, for a group.=C2=A0 =C2=A0It just gets on one page the ar= guments and allows us to see what a group could do
=

Regards= =C2=A0
Simon






=
=
On Fri, 2 Aug 2019 at 13:36, Ted Lemon <mellon@fugue.com> wrote:
Someone in another thread pointed ou= t that it=E2=80=99s too soon to create a wiki. This discussion is a clear e= xample of why a wiki would be good.=C2=A0

It=E2=80=99s f= airly clear to me that there isn=E2=80=99t a clear understanding of the thr= eat models for which mitigations are being discussed. Clearly describing th= e threat models we believe exist in a wiki would allow us to evaluate propo= sed solutions to see if they address these threat models.=C2=A0
<= br>
Right now we are discussing mitigations that have already bee= n shown not to address actual threats, but because we aren=E2=80=99t docume= nting the discussion, that has been forgotten and so we are repeating ourse= lves.=C2=A0

Sent from my iPhone

On Aug 2, 2019= , at 7:37 AM, Alec Muffett <alec.muffett@gmail.com> wrote:

On Fri, 2 Aug 2019 at 12:18, Robert Mortimer &l= t;robm=3D40scramworks.net@dmarc.ietf.org> wrote:
=C2=A0Just on the javascript in browser making DNS= queries, already been done to control a spam campaign.
= https://www.bleepingcomputer.com/news/security/new-spam-campaign-controlled= -by-attackers-via-dns-txt-records/

So the bad guys at least a= re already doing this. They could of course use other methods etc. etc.

For anyone else who hasn't been through the ar= chives, this one has already been discussed on this maillist:

=C2=A0= =C2=A0 https://mailarchive.ietf.org/arch/msg/add/= 6lkOu-0D6OWNfHwnsK7S1NkG6Oo

<= div class=3D"gmail_quote">=C2=A0 =C2=A0 https://ma= ilarchive.ietf.org/arch/msg/add/OoEVkT3IdLnTqhBuE777MKPAlRo
=C2=A0- alec

--
http://dropsafe.crypticide.= .com/aboutalecm
--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--00000000000019916c058f21b0d9-- From nobody Fri Aug 2 05:46:16 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4E0C212009E for ; Fri, 2 Aug 2019 05:46:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.499 X-Spam-Level: X-Spam-Status: No, score=-2.499 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aZ5I_W9mLee9 for ; Fri, 2 Aug 2019 05:46:12 -0700 (PDT) Received: from mx0a-00191d01.pphosted.com (mx0a-00191d01.pphosted.com [67.231.149.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6B5291200B1 for ; Fri, 2 Aug 2019 05:46:12 -0700 (PDT) Received: from pps.filterd (m0049287.ppops.net [127.0.0.1]) by m0049287.ppops.net-00191d01. (8.16.0.27/8.16.0.27) with SMTP id x72CZlth042277; Fri, 2 Aug 2019 08:46:09 -0400 Received: from alpi154.enaf.aldc.att.com (sbcsmtp6.sbc.com [144.160.229.23]) by m0049287.ppops.net-00191d01. with ESMTP id 2u4n5h0bjx-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 02 Aug 2019 08:46:09 -0400 Received: from enaf.aldc.att.com (localhost [127.0.0.1]) by alpi154.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id x72Ck7sW022415; Fri, 2 Aug 2019 08:46:08 -0400 Received: from zlp30485.vci.att.com (zlp30485.vci.att.com [135.47.91.178]) by alpi154.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id x72CjxlW021520 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Fri, 2 Aug 2019 08:45:59 -0400 Received: from zlp30485.vci.att.com (zlp30485.vci.att.com [127.0.0.1]) by zlp30485.vci.att.com (Service) with ESMTP id 5305E400AE35; Fri, 2 Aug 2019 12:45:59 +0000 (GMT) Received: from GAALPA1MSGHUBAH.ITServices.sbc.com (unknown [130.8.218.157]) by zlp30485.vci.att.com (Service) with ESMTPS id 406CB40006C2; Fri, 2 Aug 2019 12:45:59 +0000 (GMT) Received: from GAALPA1MSGUSRBF.ITServices.sbc.com ([169.254.5.84]) by GAALPA1MSGHUBAH.ITServices.sbc.com ([130.8.218.157]) with mapi id 14.03.0439.000; Fri, 2 Aug 2019 08:45:58 -0400 From: "STARK, BARBARA H" To: "'Tommy Jensen'" , "'ADD Mailing list'" CC: "'dprive-chairs@tools.ietf.org'" Thread-Topic: WG wiki Thread-Index: AQHVSKv0HsJsgbG0FUilNBeWjdXxn6bnylFw Date: Fri, 2 Aug 2019 12:45:58 +0000 Message-ID: <2D09D61DDFA73D4C884805CC7865E6114E2506C4@GAALPA1MSGUSRBF.ITServices.sbc.com> References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [130.10.229.233] Content-Type: multipart/alternative; boundary="_000_2D09D61DDFA73D4C884805CC7865E6114E2506C4GAALPA1MSGUSRBF_" MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-08-02_06:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_policy_notspam policy=outbound_policy score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1011 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1906280000 definitions=main-1908020130 Archived-At: Subject: Re: [Add] WG wiki X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 02 Aug 2019 12:46:14 -0000 --_000_2D09D61DDFA73D4C884805CC7865E6114E2506C4GAALPA1MSGUSRBF_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable I think the ideas you're talking about would fall within the current charte= r of dprive. It has "defining operational, policy, and security considerati= ons for DNS operators offering DNS privacy services". So maybe we can discu= ss this there? In fact, there's already https://tools.ietf.org/html/draft-i= etf-dprive-bcp-op-03, which has an excellent start on some (but certainly n= ot all) of the items that have been discussed on this ADD list. Barbara I checked https://trac.ietf.org/ to see if there was a wiki we = could use to pursue some of the collaboration efforts people are +1ing toda= y, but the ADD path appears to be blocked/nonexistant. Is there any way for= us to create that so we can start writing down and brainstorming through s= ome of the document ideas being brought up without having to build them up = into full blown drafts offline first? Thanks, Tommy --_000_2D09D61DDFA73D4C884805CC7865E6114E2506C4GAALPA1MSGUSRBF_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

I think the ideas you’re talking about would f= all within the current charter of dprive. It has “defining operationa= l, policy, and security considerations for DNS operators offering DNS priva= cy services”. So maybe we can discuss this there? In fact, there’s already https://tools.ietf.org/html/draft-ietf-dprive-bcp-op-03, which has an e= xcellent start on some (but certainly not all) of the items that have been = discussed on this ADD list.

Barbara

 

I checked https://trac.ietf.org/ to see if there was a wiki we could use to pursue some of the collaboration e= fforts people are +1ing today, but the ADD path appears to be blocked/n= onexistant. Is there any way for us to create that so we can start writing = down and brainstorming through some of the document ideas being brought up without having to build them up int= o full blown drafts offline first?

 

Thanks,

Tommy

--_000_2D09D61DDFA73D4C884805CC7865E6114E2506C4GAALPA1MSGUSRBF_-- From nobody Fri Aug 2 07:28:36 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D381F1202B6 for ; Fri, 2 Aug 2019 07:28:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Ehc2KBHM7YbG for ; Fri, 2 Aug 2019 07:28:32 -0700 (PDT) Received: from mail.hardakers.net (mail.hardakers.net [168.150.192.181]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E374A1202B1 for ; Fri, 2 Aug 2019 07:28:32 -0700 (PDT) Received: from localhost (unknown [10.0.0.3]) by mail.hardakers.net (Postfix) with ESMTPA id 9353B2A19C; Fri, 2 Aug 2019 07:28:31 -0700 (PDT) From: Wes Hardaker To: Rob Sayre Cc: Tommy Jensen , ADD Mailing list References: Date: Fri, 02 Aug 2019 07:28:31 -0700 In-Reply-To: (Rob Sayre's message of "Thu, 1 Aug 2019 22:15:11 -0700") Message-ID: User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/26.1 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain Archived-At: Subject: Re: [Add] WG wiki X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 02 Aug 2019 14:28:35 -0000 Rob Sayre writes: > I don't think the list has gotten to the point of creating infrastructure for a WG, > because there isn't a WG yet. The ADD BOF was a "non-WG forming BOF". The ADs were collecting information about if the work is needed and where to conduct it. If anyone wants to know the status of their thinking, you could just ask them :-) -- Wes Hardaker USC/ISI From nobody Fri Aug 2 08:17:19 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 40CB412041B for ; Fri, 2 Aug 2019 08:17:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.997 X-Spam-Level: X-Spam-Status: No, score=-6.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FROM_EXCESS_BASE64=0.001, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nic.cz Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UBWo50odg2Ep for ; Fri, 2 Aug 2019 08:17:15 -0700 (PDT) Received: from mail.nic.cz (mail.nic.cz [IPv6:2001:1488:800:400::400]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 81CD1120423 for ; Fri, 2 Aug 2019 08:17:14 -0700 (PDT) Received: from [IPv6:2001:1488:fffe:6:ec42:c216:630e:b9c] (unknown [IPv6:2001:1488:fffe:6:ec42:c216:630e:b9c]) by mail.nic.cz (Postfix) with ESMTPSA id 6275D1407C7; Fri, 2 Aug 2019 17:17:12 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=nic.cz; s=default; t=1564759032; bh=Rmq02ddnfES/rZ6mwLkZzx9/iIKhuu2W3rNe1QZs0pk=; h=To:From:Date; b=EDzCSplp8LJfBTc4NbuY/fmw2W5vDp10r4/bRr5B1f696+ugqRe4G20M86JfVgWVe ua+UhgsFsI/2ZrFQmJ3S9qoRk8K2XGb0Njt8+UGp4Kpp626ZzHlL/vfBZKhMUzR5Zs hj4NW4cjWEKFORlRoOqQilbiuGpAgme44EHUOrNw= To: Tony Finch References: <2D09D61DDFA73D4C884805CC7865E6114E23910C@GAALPA1MSGUSRBF.ITServices.sbc.com> <20190724171549.GD29051@laperouse.bortzmeyer.org> Cc: add@ietf.org From: =?UTF-8?B?VmxhZGltw61yIMSMdW7DoXQ=?= Openpgp: preference=signencrypt Autocrypt: addr=vladimir.cunat+ietf@nic.cz; prefer-encrypt=mutual; keydata= mQINBFgDknYBEADHEQwLBlfqbVCzq7qYcBFFTc1WCAFtqiKehOrsITnKusZw4nhYwlKQxcum gj01xJOhbfHBCBeGlDydYqemKg4IfY2nwSyPwZZYMJn7L7AGrCeytr4VMvDJ7o7qDZjjim4i fv+GUwdk3plXx6oMF4nctesI8aAOuLUHAn0PfrGfNhWoaglOKgdOI6DGjhI/aGkvy+jrI/+X sdMV+3f1RuEOfI+Yu4SXFjJyhAmqEOBRxxdHqKreIIpz3Lg38yWwiVGfwgQT+nFIz9BpHH3l Wg1uS8xM3ezceBmRYV8zT9PvbeZ57BlaTR6rLae5RYwV397PSLBqqLkB5H0TDRUFBnwBsUob LebYHmJCOydvyNv5AFkLmLZ7O4j2jFo1WPSMt3ThM6wRwqrnB4Gi+6onyrZfE1DnVZMqbxZ3 VXa+E4S5YwrfCLUErGEn+d40OtoRZmQXhRPVAsdjimMj9oFM9RoxSgUrDg6Ia3n0IrKFb++z HAFbqkR5g4qzXiOMEG621GYEex2sDEKz/PD4CVKlNI9eld4ToH592kAwzJmd+sAi+Rfos0NE zxuFd0ekAOeWoURo0zoYTSWPlMOmFMvcpH6LP3leJmY7x4z/b1ng/+7UnKonVALVPFbRbElO kIfAtLKcUEofwV1jr7DyYGPalJtiDJPomB041ZHCj2RxyXY/oQARAQABtDBWbGFkaW3DrXIg xIx1bsOhdCAod29yaykgPHZsYWRpbWlyLmN1bmF0QG5pYy5jej6JAlQEEwEIAD4CGyMFCQlm AYAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AWIQS2AGRgtgqA54IGJEnnR98flXWjqgUCWg3w 3gAKCRDnR98flXWjqmD6D/96U4cDZBrHQ5LhqybocZr/N2IS5Wr2SLLB4k2F5/W/wbL05gq6 Ha9/2TMqXoxRkhug+EAHFHxylPR43yN9rz0pjBXHrra87FAPHMqq/qqrOEUdhkytEqa6WIho aoEkdhaMhUyctjVjL2WZ0+MWeRjqedLQX+VCrOVPcVbLreRRhA9N3KPgNwbp9zCg6hEPi4l2 zZKedHkTNjKIAwJ0xZoMwFa1Y+vL8Em8Or+IBZuGBMP/ZMtasPOIQaT/Gvsyx1DDorwsoCdX 6zaTZy5DOWP3FIrMzus/YDbzwAYxSpWk/jF44ySbnJzdjU67EfG3UrsK+RRGw8aJqs3/4qHK ZMZZnNL+4wJpEdnZyFic/MXcw6FBszQEwrIOaM1WEfwzn2ExUYk2pM5zaBwq76OgrmGMzMEi cfMDyqLodwEQqR70PvRbkrh+R02LphwQ9c5AFXcrLjKMmeQlbQVarTUsrELcTK6rElC1ojS7 M37j0XzFE+kgNWn2fyBRgtnGDWEa7r+oDaueXJnEf0/4Ww28IwxakNc7r0N41GIBekwSxKdk epKFZgtVGGSDlFei5hb5LLWFljA1OS7CRVJKpbHafQjdPdb1vNqZAj4y2SJXvVVpI1KO5kq+ dFdYipORv0N2Iho6MNYbQUT1EBeU46G5N0viCoLS15/PxLhIAo+PzKpW97kCDQRYA5J2ARAA yHww3huLEtsdyqgjiGMhtEKOLmp7yFl450HY9oPcHS02U5BC1370ssNShrdOCi2ACDbe41Zx x85WcuaO1OVqung2umX047mj2xQsiTAFRDLZsQu8cQFoEy/DBL2bk7ThfK1Lh+NyZAs0UaPp DkGodS0De9osA+4T6Nf4POYaeavbYVFSdDKS4lUboBqApKnD/TzKFxFcpuFx6FN92lteTbOo jGMiLoZvELY86Kn9KuFZ8FM2ZSNHx1Z75KouufGrdkeCoZYVYiuzT+fnt2it4dIpIlnF+yxM t5LB/MSrmECB5CAFJtxzuMccm6yDUZQSWWi9vUgxIJwvt5w0CIBT353DGeP4WnH0r5YoBKoR bh7i4fT0lWvMXTG/V2lqyzBdClMebyHffMgba26Kj6oeDygDfC5aGsVaqw1Ue/qQ5QRqTJcJ V7xVLTtS1EamVqkfKwPS0zTfnrF1jQtnO/P4qkfgBRRG9BXGGrykHpXOyqmX6Z0wbV2P4j+p 02oSecDl5yVXplJfsXfbS/xXnaSkaN/7mCU29ul26cAVNxDkDPunztSFi9K9LM2T/XWYJQGX M71OpmONQJGF24lx7Wp/kobnHtbjGDzjDPC4eSL7MA56qtrWaLM+4ePKANct2q0q6c0uSLs0 Q2zochS64Mcg0YzL1sinWPN1rXLDk3lwpIsAEQEAAYkCJQQYAQgADwUCWAOSdgIbDAUJCWYB gAAKCRDnR98flXWjqn4yEACA0f1XBAg+WMaNPtIt0k15yFPfhdbOg9GhDcYGgvFIOxRuaFWw 9SLUt7OGuUnIpKxKRXtQJss98fHkijo70ONYWPuLhfRGK/wg9Ao6MuFw5G8m431CBS/awrie b6iPjvAARXJCPTTBZk/NC988jiKdCh8PbTCHDsl+gSDytP15QUrdqSfS2Wf4653ej7+jtuTj xZzmGgvNSi6JDlb9KNtmBQKQAgpnOQM46ItESmzHDnmdcvhPLUDsjwkpIJ6clasOzaObwxJi ba7iFPcGwcClCSwYjMNXFtneCGUnEAa5RBIx+i+LV1iqB3VRvTC6tMIUueoQ7cdTy6afNkhw QYXm4/pDmNT8UMdnzwnlTpFQ0CegDQRDWc+dIDDBHGEEEYBh2vTOE04KrmYUp1bQsNegPfvL woHib0jEvohPMJ2fJtZAd1SJElgwPbM8H7emKBiTsHwF8gL7G2jo7AoGpqYjqXkCRS0tSLTN r+qHh+7Ltrkbu/ZVTTfh4Q/qw3VaLYQh4C0tBma/YevQy1O2c3TZXXFz1QF8b9/Hj/3sq2Kg T1AcZ51E+xG+cb6cUqgkihmgm39xx24GPlNAdCRuq01+iILol+Wox6OwF6hmqx1EMSmxcmGo UREr0rkMnFVsWeAYeVoE4q689qxCPu9iCMJMJnkRe1o9oQYSN7my+S98gA== Message-ID: <1f8ae5d0-6a4a-fb72-413a-2be95968a11b@nic.cz> Date: Fri, 2 Aug 2019 17:17:12 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit Content-Language: en-US X-Virus-Scanned: clamav-milter 0.100.3 at mail.nic.cz X-Virus-Status: Clean Archived-At: Subject: Re: [Add] point of deploying DoH in access network (Re: meeting hum: should the IETF take up this work?) X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 02 Aug 2019 15:17:17 -0000 On 8/2/19 11:52 AM, Tony Finch wrote: > There's also the vague > notion from the early days of DoH that javascript in the browser might > make DNS queries but I haven't seen any evidence of that or even any > signs of interest in the idea. RFC 8484 lists "two primary use cases", and this is one of the two, though most of the DoH discussions have been around unblockability (i.e. the other primary use case). We (cz.nic) plan to soon release a new version of a browser plugin reworked to utilize DoH: https://dnssec-validator.cz  The original in-browser validation of DNSSEC got unfortunately killed by Firefox 57+ API changes, and we found it very difficult to do something like that again with the new APIs, which is why DoH will be used instead to out-source validation. --Vladimir From nobody Tue Aug 6 08:40:53 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 70627120255 for ; Tue, 6 Aug 2019 08:40:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=bt.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Xt0-I2Jy5vLG for ; Tue, 6 Aug 2019 08:40:49 -0700 (PDT) Received: from smtpe1.intersmtp.com (smtpe1.intersmtp.com [62.239.224.234]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AD7FC12036A for ; Tue, 6 Aug 2019 08:40:36 -0700 (PDT) Received: from tpw09926dag11h.domain1.systemhost.net (10.9.212.35) by RDW083A012ED68.bt.com (10.187.98.38) with Microsoft SMTP Server (TLS) id 14.3.439.0; Tue, 6 Aug 2019 16:40:10 +0100 Received: from tpw09926dag15g.domain1.systemhost.net (10.9.212.31) by tpw09926dag11h.domain1.systemhost.net (10.9.212.35) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Tue, 6 Aug 2019 16:40:32 +0100 Received: from bwp09926085.bt.com (10.36.82.116) by tpw09926dag15g.domain1.systemhost.net (10.9.212.31) with Microsoft SMTP Server (TLS) id 15.0.1395.4 via Frontend Transport; Tue, 6 Aug 2019 16:40:32 +0100 Received: from GBR01-CWL-obe.outbound.protection.outlook.com (104.47.20.52) by smtpe1.intersmtp.com (10.36.82.116) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.1.1713.5; Tue, 6 Aug 2019 16:40:12 +0100 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=agek396Pi8/VIMrmsN0e+N5YSgJK8t58bvqPobb/MsH+nND7HKZrsIAtc79RiE7D1x/ziG6Zu0hNOJg554Anjd1vlTHhl95OMp83GHfaO7U0MD3LiEcjcjVyebGfYKn9dkFI9cXOoYCqMX0poCfzc4T9QNLZnt3e8X0jHZ0yxTK21wNta0PBZpeYlw9XQOZYHRv/ClVxJMRJmYZCJRz/S63caHycXDy4QEXkiT3j8MpP0W/lClcucQX89L3LaKmTuGbynA97VK7E3dh4x4hyXX/j/pSlQiJAJiV/PciL55GdOJpXPf8Qx3pcF2IYHQJb4g/ndjb8lybqlmE3IPHvnw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=1duxUWXePGgJ1yHII2qdcmzpY5VSpRydNC/TtzJlrb8=; b=jV+/8aXO3Y2buRNCbuZag4/3DrtvBO+Fiwf2CGCyxs2UCSHVrZTMlmsAQ1b7/dI3ZBNdKgB76zAlT/wNSt9A5n7dU2uRrl/hvz72OitEgCI8zrdEcIAIGFlxd0g/h/Bn1RQit5TkYY3tGXPVeFWLI8TMMsy6snvZbKQGW8Hl5EMatu50UT2AVR5x0GbIS9v3xnvVguXe3g+lFucXFcCuCq5VCifWw18XpOxUfum+od3CZW+UXe7Ko/DQfVyoZZiVafj0Nfl9Sac1hB9rTxUMt43UTsYNeZKkjMqyPB+fUrZlCpSkDL/mheQEvfe3C3Cr947+zxR5/cr2W0SOUtdmmg== ARC-Authentication-Results: i=1; mx.microsoft.com 1;spf=pass smtp.mailfrom=bt.com;dmarc=pass action=none header.from=bt.com;dkim=pass header.d=bt.com;arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bt.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=1duxUWXePGgJ1yHII2qdcmzpY5VSpRydNC/TtzJlrb8=; b=m8EgaH00z6gsUCPwFH+WDPIB+PRcceQOEh6/PbHPcWPuXvSpcIe+RnSZwpQ18v4jB9WdCir8AOgcHYjk+Kq+bNQkbKryqQCDlyF4TD1nclSReUQB+983CMDE2+2y0nAEUrpOp8WSysmLYG2jjt3zNQARy/XRVOXC+G+RvSFbz38= Received: from LO2P123MB2256.GBRP123.PROD.OUTLOOK.COM (20.176.158.15) by LO2P123MB1871.GBRP123.PROD.OUTLOOK.COM (20.176.154.18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2136.16; Tue, 6 Aug 2019 15:40:31 +0000 Received: from LO2P123MB2256.GBRP123.PROD.OUTLOOK.COM ([fe80::4061:47b7:52f1:6836]) by LO2P123MB2256.GBRP123.PROD.OUTLOOK.COM ([fe80::4061:47b7:52f1:6836%3]) with mapi id 15.20.2157.011; Tue, 6 Aug 2019 15:40:31 +0000 From: To: Thread-Topic: IETF 105 Highlights Thread-Index: AdVMbKtwOF5kZSwUTdWRT+v95rsj2w== Date: Tue, 6 Aug 2019 15:40:31 +0000 Message-ID: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=chris.box@bt.com; x-originating-ip: [217.39.12.54] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 8e116b20-3aad-4a52-fc15-08d71a846a53 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:LO2P123MB1871; x-ms-traffictypediagnostic: LO2P123MB1871: x-ms-exchange-purlcount: 1 x-microsoft-antispam-prvs: x-antispam-2: 1 x-ms-oob-tlc-oobclassifiers: OLM:9508; x-forefront-prvs: 0121F24F22 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(979002)(4636009)(346002)(39860400002)(376002)(136003)(366004)(396003)(199004)(189003)(66446008)(25786009)(33656002)(2501003)(66946007)(486006)(7736002)(53936002)(2906002)(102836004)(6306002)(55016002)(9686003)(236005)(54896002)(478600001)(6916009)(64756008)(7116003)(26005)(81166006)(76116006)(66476007)(86362001)(3846002)(1730700003)(186003)(81156014)(790700001)(71190400001)(74316002)(66556008)(6116002)(316002)(99286004)(5640700003)(6506007)(52536014)(68736007)(476003)(8676002)(66066001)(8936002)(5660300002)(14454004)(256004)(7696005)(2351001)(966005)(4744005)(71200400001)(606006)(6436002)(969003)(989001)(999001)(1009001)(1019001); DIR:OUT; SFP:1101; SCL:1; SRVR:LO2P123MB1871; H:LO2P123MB2256.GBRP123.PROD.OUTLOOK.COM; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: bt.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: 9gRPdginIrK7WdsB1UDSNgiHpfPunN13GlevrjWiQVEJY25VA0KoZr71B7AHdB0VoRLB8GgYWtHs29u6aOij88hiWG2D51TJIrBDEQ/5vrgqL0Q2FTxlGsBmqik3fHR+bBmdvk4AesRK+LJRKw6TKsnBPJ2aZncLhD+8BT0BpjSbOQLJ5ZW9dp/uDE+OISm+C78PSQ97Xp0yvPpabzEDS/j4DesH/CVnxmNnUetLAGD7F29WOBtEejvOZxAqUV1cgG1VPqaUb+1Jmq493ofFh4XHI958H0DVZLeebQCBrLal/MaqqStz2bgWHVZhLQWr8GDZNn8ETM6bfwwMoIYWV0r5/9eobynsJwQ+d5ZWs6pQw0ziJWTU5jR/hXlfbcaXqd5T4GDO4zntNWPc0e78Y7v6ow5GMBtOkuiPdTJ75f8= Content-Type: multipart/alternative; boundary="_000_LO2P123MB225613E30FAFAA45A6F812629BD50LO2P123MB2256GBRP_" MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: 8e116b20-3aad-4a52-fc15-08d71a846a53 X-MS-Exchange-CrossTenant-originalarrivaltime: 06 Aug 2019 15:40:31.7059 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: a7f35688-9c00-4d5e-ba41-29f146377ab0 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: 8a1aqenCL5ZfWH9G2JqQMeQ0lNi5jEzxxPIm2Fbx1RGo7tWqrx5lEBR3WOs1CRcc9zjfp3e4GQY5V1bkmDytzw== X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO2P123MB1871 X-NAI-Spam-Flag: NO X-NAI-Spam-Level: X-NAI-Spam-Threshold: 5 X-NAI-Spam-Score: 0.6 X-NAI-Spam-Report: 4 Rules triggered * 0.6 -- TS_MSG_REP_20 * 0 -- EDT_SDHA_ADR_FRG * 0 -- EDT_SDHA_DMN_FRG * 0 -- RV6605 X-NAI-Spam-Version: 2.2.0.9309 : core <6605> : inlines <7131> : streams <1829538> : uri <2879215> X-OriginatorOrg: bt.com Archived-At: Subject: [Add] IETF 105 Highlights X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 06 Aug 2019 15:40:52 -0000 --_000_LO2P123MB225613E30FAFAA45A6F812629BD50LO2P123MB2256GBRP_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable As you'll have seen from 105-attendees, Alissa has posted https://www.ietf.= org/blog/ietf-105-highlights/ which I'll repeat here as it includes this statement on the outcome of the = BoF: The ADD BoF sought to identify areas where the IETF community might be inte= rested in working on protocol standardization or best practices related to = applications doing their own DNS resolution. The wide-ranging discussion to= uched on a few such nascent areas, including DNS-over-HTTPS (DoH) server di= scovery, means of advertising DNS resolver properties, and operational best= practices. The most conclusive outcome, though, was a collective realizati= on that it may be time to reorganize DNS-related work in the IETF to ensure= that broad-based participation, cross-area review, and sufficient agenda a= nd chair time can be dedicated to what is obviously a pressing set of topic= s for the industry. Discussions continue on the mailing list. Chris --_000_LO2P123MB225613E30FAFAA45A6F812629BD50LO2P123MB2256GBRP_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

As you’ll have seen from 105-attendees, Alissa= has posted https://www.ietf.org/blog/ietf-105-highlights/

which I’ll repeat here as it includes this sta= tement on the outcome of the BoF:

 

The ADD BoF sought to identify areas where the IE= TF community might be interested in working on protocol standardization or = best practices related to applications doing their own DNS resolution. The wide-ranging discussion touched on a few such nasc= ent areas, including DNS-over-HTTPS (DoH) server discovery, means of advert= ising DNS resolver properties, and operational best practices. The most con= clusive outcome, though, was a collective realization that it may be time to reorganize DNS-related work in the IETF= to ensure that broad-based participation, cross-area review, and sufficien= t agenda and chair time can be dedicated to what is obviously a pressing se= t of topics for the industry. Discussions continue on the mailing list.

 

Chris

--_000_LO2P123MB225613E30FAFAA45A6F812629BD50LO2P123MB2256GBRP_-- From nobody Tue Aug 6 09:50:23 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EE378120480 for ; Tue, 6 Aug 2019 09:50:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.119 X-Spam-Level: X-Spam-Status: No, score=-1.119 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NEUTRAL=0.779] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hsV1YFazCOOu for ; Tue, 6 Aug 2019 09:50:20 -0700 (PDT) Received: from smtp73.iad3b.emailsrvr.com (smtp73.iad3b.emailsrvr.com [146.20.161.73]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 89D7212023F for ; Tue, 6 Aug 2019 09:50:20 -0700 (PDT) X-Auth-ID: matt@kahlerlarson.org Received: by smtp18.relay.iad3b.emailsrvr.com (Authenticated sender: matt-AT-kahlerlarson.org) with ESMTPSA id 94221E02B1 for ; Tue, 6 Aug 2019 12:50:19 -0400 (EDT) X-Sender-Id: matt@kahlerlarson.org Received: from [10.96.9.179] (44-2.dc.icann.org [192.0.44.2]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384) by 0.0.0.0:25 (trex/5.7.12); Tue, 06 Aug 2019 12:50:19 -0400 From: Matt Larson Content-Type: multipart/alternative; boundary="Apple-Mail=_7DABAA2A-DFBF-4F48-B4A0-DA09871AF8CC" X-Mao-Original-Outgoing-Id: 586803019.107613-fd464d451ca8a2347700705128812fef Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Message-Id: <59D6E135-E1D3-4782-945B-98FC96A52F94@kahlerlarson.org> Date: Tue, 6 Aug 2019 12:50:19 -0400 References: <112384FB-C68D-4308-8ED9-C0BBF615751D@frobbit.se> <1C02AB5B-D01E-49F6-86CE-BAEF4779E776@frobbit.se> <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> <64bcfc51-6f3d-ae24-4de5-d0eb89975c66@cs.tcd.ie> <539D6F9D-137C-4F68-A8DE-EA3DFAF4D827@huitema.net> <73C24907-048A-46C8-812A-C45483C607D4@frobbit.se> <2BF62C0F-B2E9-4E09-9B50-4E592EF6691F@cable.comcast.com> To: ADD Mailing list In-Reply-To: X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] Historical analogy: Site Finder (forking thread with new subject) X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 06 Aug 2019 16:50:22 -0000 --Apple-Mail=_7DABAA2A-DFBF-4F48-B4A0-DA09871AF8CC Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii > On Aug 1, 2019, at 2:31 PM, Brian Dickson = > = wrote: >=20 > Also of note was the impact on SMTP traffic, since mail transport = relies on using both MX and A records, while the wildcard A record = wasn't answering on the SMTP port. Speaking as someone who was there at the time and has the scars and hate = mail to prove it, there was indeed an SMTP agent answering on tcp/25 at = the IP address returned by the .com and .net wildcard A records. This = agent returned a 550 response code to RCPT commands. (Well, it was a bit = more complicated than that. The high-level details are in the public = record; see = http://www.circleid.com/posts/site_finder_the_technical_legal_privacy_conc= erns/ = .) I am not defending Site Finder nor commenting on its merits or = shortcomings; I'm just making this neutral comment in the interest of = technical accuracy. Matt --Apple-Mail=_7DABAA2A-DFBF-4F48-B4A0-DA09871AF8CC Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii
On Aug 1, 2019, at 2:31 PM, Brian Dickson <brian.peter.dickson@gmail.com> wrote:

Also of note was the impact on SMTP traffic, since = mail transport relies on using both MX and A records, while the wildcard = A record wasn't answering on the SMTP = port.

Speaking as someone who was there at the time and has the = scars and hate mail to prove it, there was indeed an SMTP agent = answering on tcp/25 at the IP address returned by the .com and .net = wildcard A records. This agent returned a 550 response code to RCPT = commands. (Well, it was a bit more complicated than that. The high-level = details are in the public record; see http://www.circleid.com/posts/site_finder_the_technical_legal_p= rivacy_concerns/.)

I am not defending Site Finder nor commenting on its merits = or shortcomings; I'm just making this neutral comment in the interest of = technical accuracy.

Matt

= --Apple-Mail=_7DABAA2A-DFBF-4F48-B4A0-DA09871AF8CC-- From nobody Tue Aug 6 21:33:55 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5957D120104 for ; Tue, 6 Aug 2019 21:33:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.996 X-Spam-Level: X-Spam-Status: No, score=-1.996 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PeEfegcsoBLp for ; Tue, 6 Aug 2019 21:33:51 -0700 (PDT) Received: from mail-ot1-x330.google.com (mail-ot1-x330.google.com [IPv6:2607:f8b0:4864:20::330]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 56F6612010E for ; Tue, 6 Aug 2019 21:33:51 -0700 (PDT) Received: by mail-ot1-x330.google.com with SMTP id l15so41893687oth.7 for ; Tue, 06 Aug 2019 21:33:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=2eOW0vCzDHH/OqNDBTGvzOeh0W8SsT6emK7U+MTgABY=; b=WSHBWYJ8Ddex/fVfApQQ5WoudB3jn4L9Z8ec9Hj+R6uMM8OhK8zEXfqhSopCLP5CmY cZGGT0EMl7lWuN4w/Kzgaryj1ZSeMBip0lZUXaHquPlXiIAe5FGLIH/L8CqVzgWZfzgZ Tcvkv3Ch/daNbKC1+6rLYl6afWtay3LzpW3mVxCMN8TOkRt8E1vTVQrjsnBaAtPWcMeO wC5ccCD5CJpCK0hXfZ1nmwHSKOgAsz03Z2Por43AaaxQR/V3gM+PwJKo51RdmQSHueyd 0plqhtwJhGiUsUSOJz3vFo75nzvmWNsUarn5WUwfvZ0d4ysv9YcRB3jdKNjlGxj+7be9 2wsg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=2eOW0vCzDHH/OqNDBTGvzOeh0W8SsT6emK7U+MTgABY=; b=O1XxQE0AbgHjKBAIBbxBOHf4JcUHKznEzC177rtu7hz37RYUnqBReuapTSFBokrBZq tH0TGDX1LTQpl5FXCRxT5ZDSk2AQSSCtCfJYPxJe0fvuAs/tNp9QKyqj0wHmMfOi02mi JBgyAmlzu5hDPpguaC1WTksGnK//VkfiK64a6P9qdPJzY69+ZTOJ2O+9Y/Y6zXrlTYel PEk5pfJvpRvcnLjKFq0jtCX6yKMxgLaz00x967p8ykbD5Rk1ZkeYY/aY8puYWrFvQQlB qsLbsFJOy3exCqXoGXysqDJI6tXykcET95qJAL9iDRjQv2rsOwJ8QIq4GZklQqy9FYb2 QOpA== X-Gm-Message-State: APjAAAUXxDU+lfAAt/bRJ04mcFNe71QMJh+0cEtN665F0SvHqeXBupzB Asrb2mXzTHc/bRs/zlrHGceNucaG X-Google-Smtp-Source: APXvYqzuHEuGacSqScXJYRNx+0JwRJ9VeM/bE0V2vN0LMiPaEW1/4OmFcd6pFM8NammamkUYLFFl6A== X-Received: by 2002:a02:3b62:: with SMTP id i34mr8203247jaf.91.1565152430478; Tue, 06 Aug 2019 21:33:50 -0700 (PDT) Received: from [10.249.201.239] (67-128-146-21.dia.static.qwest.net. [67.128.146.21]) by smtp.gmail.com with ESMTPSA id p63sm86458624iof.45.2019.08.06.21.33.49 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 06 Aug 2019 21:33:49 -0700 (PDT) Content-Type: multipart/alternative; boundary=Apple-Mail-304D78CE-4703-4E2A-B46F-5BE687C88A69 Mime-Version: 1.0 (1.0) From: Bret Jordan X-Mailer: iPhone Mail (16G77) In-Reply-To: Date: Tue, 6 Aug 2019 22:33:48 -0600 Cc: add@ietf.org Content-Transfer-Encoding: 7bit Message-Id: References: To: chris.box@bt.com Archived-At: Subject: Re: [Add] IETF 105 Highlights X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Aug 2019 04:33:53 -0000 --Apple-Mail-304D78CE-4703-4E2A-B46F-5BE687C88A69 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable I think that sums things up pretty well. Bret=20 Sent from my Commodore 64 PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 > On Aug 6, 2019, at 9:40 AM, wrote: >=20 > As you=E2=80=99ll have seen from 105-attendees, Alissa has posted https://= www.ietf.org/blog/ietf-105-highlights/ > which I=E2=80=99ll repeat here as it includes this statement on the outcom= e of the BoF: > =20 > The ADD BoF sought to identify areas where the IETF community might be int= erested in working on protocol standardization or best practices related to a= pplications doing their own DNS resolution. The wide-ranging discussion touc= hed on a few such nascent areas, including DNS-over-HTTPS (DoH) server disco= very, means of advertising DNS resolver properties, and operational best pra= ctices. The most conclusive outcome, though, was a collective realization th= at it may be time to reorganize DNS-related work in the IETF to ensure that b= road-based participation, cross-area review, and sufficient agenda and chair= time can be dedicated to what is obviously a pressing set of topics for the= industry. Discussions continue on the mailing list. > =20 > Chris > --=20 > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add --Apple-Mail-304D78CE-4703-4E2A-B46F-5BE687C88A69 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable I think that sums things up pretty well.
Bret 

Sent from my Commodore 64

PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE= 7415 0050

On Aug 6, 20= 19, at 9:40 AM, <chris.box@bt.com= > <chris.box@bt.com> wrote:=

=

As you=E2=80=99ll have seen from 105-attendees, Aliss= a has posted https://www.ietf.org/blog/ietf-105-highlights/

which I=E2=80=99ll repeat here as it includes this st= atement on the outcome of the BoF:

 

The ADD BoF sought to identify areas where the IETF= community might be interested in working on protocol standardization or bes= t practices related to applications doing their own DNS resolution. The wide-ranging discussion touched on a few such nasce= nt areas, including DNS-over-HTTPS (DoH) server discovery, means of advertis= ing DNS resolver properties, and operational best practices. The most conclu= sive outcome, though, was a collective realization that it may be time to reorganize DNS-related work in the IETF t= o ensure that broad-based participation, cross-area review, and sufficient a= genda and chair time can be dedicated to what is obviously a pressing set of= topics for the industry. Discussions continue on the mailing list.

 

Chris

= --Apple-Mail-304D78CE-4703-4E2A-B46F-5BE687C88A69-- From nobody Tue Aug 6 21:48:47 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A9AD7120121 for ; Tue, 6 Aug 2019 21:48:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.996 X-Spam-Level: X-Spam-Status: No, score=-1.996 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id b_F9s60kqYfb for ; Tue, 6 Aug 2019 21:48:44 -0700 (PDT) Received: from mail-ot1-x32f.google.com (mail-ot1-x32f.google.com [IPv6:2607:f8b0:4864:20::32f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D97A0120120 for ; Tue, 6 Aug 2019 21:48:43 -0700 (PDT) Received: by mail-ot1-x32f.google.com with SMTP id d17so99321792oth.5 for ; Tue, 06 Aug 2019 21:48:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=e4iksVMqZbjSTYrhlMnlWVEatq2H+/OXTQXmmiIZOjE=; b=aG7NQxDOceUmvf7yszS4HgmdtZI6QEIe/36gTaLUURYpgnKAxrysUWSlbQHaNbDv95 1rQ41AIaW+UoayRPNgj5r5dhC9244ho5j2OUGUyLc2Ov9Dj0z7hrt8OcTENKkTbSLNPU ZZnSto/UXEfhqxRWZL7BaWF4YAiqG0wt/fJsOLSBTqQFiVhjJX1LiNvbTD6UMM6VYr9l 4l2IQwEfWFTHUYjsXeAzBz2G/tbL6qH9yDqGCKeDmUQjS9ZjHXwTiK+NTnZdK7tRvmbT wJoPbRa77uxSGDHQZsreFamHHgQFY+0hy9DxkbG6pUwHENg1cZAnY6Hxs70qSYdUvh8A MM6Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=e4iksVMqZbjSTYrhlMnlWVEatq2H+/OXTQXmmiIZOjE=; b=s6SG2ekW5f2paF91BfDknN8pKQsLEDgjuyXNStydkkcLc1QZ/7GKvZ+4ZVwSbZPr/2 SHhTdF6cuk4XNM+nyGwjwqx/ELwz7zyBr3uY6H6/6H8L1mzusQfkcFqhZxvQDivsUoGk /t8TZ3VB9R0b2EnxAi237NQ20j2YL/U+0d1hraSPmxkzUM/yhekdtJlQl4SvJSDmYwkw GDJQyL4F57wj4DAaeERS9vIrBauLTCf/uq2lLqcyxFQPunwZjTnoCeZKHRtIoRAZaHlv bzGRNPlxpcDEv1rBdNprT48oaGs658267p/0GU1QgDsPK8PUiA0q+/H1/qeHVWVWDFSI yu2A== X-Gm-Message-State: APjAAAUrwJok7KHWlyAxTQLSB7Z9o5VWZ4S0l33/JaL9QGCiqiB1cU9j xj+AcYsZQ3Mxft8TK4ImXDA= X-Google-Smtp-Source: APXvYqzDSAYfACuyqyuaUoJ9qdt1GNrrlwO9YuCRR2mgwom50dNAza+HZIbHsGCuiEXt8rEE5cF6mA== X-Received: by 2002:a5d:8997:: with SMTP id m23mr2760512iol.198.1565153323177; Tue, 06 Aug 2019 21:48:43 -0700 (PDT) Received: from [10.249.201.239] (67-128-146-21.dia.static.qwest.net. [67.128.146.21]) by smtp.gmail.com with ESMTPSA id b20sm68172182ios.44.2019.08.06.21.48.42 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 06 Aug 2019 21:48:42 -0700 (PDT) Content-Type: multipart/alternative; boundary=Apple-Mail-BCC010B1-2DD9-47A6-BB3B-41B05BE1418A Mime-Version: 1.0 (1.0) From: Bret Jordan X-Mailer: iPhone Mail (16G77) In-Reply-To: Date: Tue, 6 Aug 2019 22:48:41 -0600 Cc: Stephen Farrell , Mikael Abrahamsson , Paul Wouters , ADD Mailing list , Ralf Weber , Alec Muffett Content-Transfer-Encoding: 7bit Message-Id: References: <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> <64bcfc51-6f3d-ae24-4de5-d0eb89975c66@cs.tcd.ie> <539D6F9D-137C-4F68-A8DE-EA3DFAF4D827@huitema.net> <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> To: Tommy Jensen Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Aug 2019 04:48:47 -0000 --Apple-Mail-BCC010B1-2DD9-47A6-BB3B-41B05BE1418A Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable I for one am terrified of the possibility of mass centralization of DNS traf= fic. Especially given this is will be over http now and an app or client co= uld include a plethora of other http headers that could give guaranteed per u= ser tracking. Further, once all DNS is in one place, that makes a great tar= get. =20 Bret=20 Sent from my Commodore 64 PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 > On Aug 1, 2019, at 10:41 AM, Tommy Jensen wrote: >=20 > +1 for different valid use cases regarding default choice. Such a document= , even attempted, would give a more concrete framework for this discussion a= nyway. I'd happily collaborate. >=20 > Thanks, > Tommy > From: Add on behalf of Stephen Farrell > Sent: Thursday, August 1, 2019 5:54 AM > To: Mikael Abrahamsson > Cc: Paul Wouters ; ADD Mailing list ; Ralf W= eber ; Alec Muffett > Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partia= l distribution at the MIC] > =20 >=20 > Hiya, >=20 > On 01/08/2019 13:12, Mikael Abrahamsson wrote: > >=20 > > One thing that would be good to get agreement on is that there are valid= > > use-cases for both using the system resolver by default and using a > > (remote, non-ISP) DoH resolver by default, and my estimation is that > > these are close to equally large/important. If we can agree on that and > > the discussion stops being on whose use-case is most important and > > instead being on how to solve this problem, then the discussion might be= > > more fruitful and productive. >=20 > Ah, interesting. FWIW I personally agree there are valid > use-cases for both, and maybe more too, e.g. cases where > an application may try DoH but fall back to the OS because > of . But I don't think documenting that'd remove the > disagreements. I wonder would it help to try to separately > describe the main abuse-cases as well? If we had objective > descriptions of both use- and abuse- cases maybe it'd be > easier to figure out what kinds of defaults and/or inputs > (e.g. user or admin or app selection) would be needed to > indicate that a particular setup was reasonable? >=20 > (Could end up a bit theoretical I guess, but I'm interested > in the general question of whether considering abuse-cases > might help in situations like this.) >=20 > Cheers, > S. > --=20 > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add --Apple-Mail-BCC010B1-2DD9-47A6-BB3B-41B05BE1418A Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable I for one am terrified of the possibility o= f mass centralization of DNS traffic.  Especially given this is will be= over http now and an app or client could include a plethora of other http h= eaders that could give guaranteed per user tracking.  Further, once all= DNS is in one place, that makes a great target.  

<= div>Bret 


= Sent from my Commodore 64

PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7= 415 0050

On Aug 1, 2019= , at 10:41 AM, Tommy Jensen <Jensen.Thomas=3D40microsoft.com@dmarc.ietf.org>= wrote:

=
+1 for different valid use cases regarding default choice. Such a document, e= ven attempted, would give a more concrete framework for this discussion anyw= ay. I'd happily collaborate.

Thanks,
Tommy
From: Add <add-bounces@ietf.org> on behalf of Stephen Fa= rrell <stephen.farrell@cs.tc= d.ie>
Sent: Thursday, August 1, 2019 5:54 AM
To: Mikael Abrahamsson <swmike= @swm.pp.se>
Cc: Paul Wouters <paul@nohats.ca= >; ADD Mailing list <add@ietf.org<= /a>>; Ralf Weber <dns@fl1ger.de&g= t;; Alec Muffett <alec.muffett@= gmail.com>
Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from p= artial distribution at the MIC]
 

Hiya,

On 01/08/2019 13:12, Mikael Abrahamsson wrote:
>
> One thing that would be good to get agreement on is that there are vali= d
> use-cases for both using the system resolver by default and using a
= > (remote, non-ISP) DoH resolver by default, and my estimation is that > these are close to equally large/important. If we can agree on that and=
> the discussion stops being on whose use-case is most important and
> instead being on how to solve this problem, then the discussion might b= e
> more fruitful and productive.

Ah, interesting. FWIW I personally agree there are valid
use-cases for both, and maybe more too, e.g. cases where
an application may try DoH but fall back to the OS because
of <foo>. But I don't think documenting that'd remove the
disagreements. I wonder would it help to try to separately
describe the main abuse-cases as well? If we had objective
descriptions of both use- and abuse- cases maybe it'd be
easier to figure out what kinds of defaults and/or inputs
(e.g. user or admin or app selection) would be needed to
indicate that a particular setup was reasonable?

(Could end up a bit theoretical I guess, but I'm interested
in the general question of whether considering abuse-cases
might help in situations like this.)

Cheers,
S.
= --Apple-Mail-BCC010B1-2DD9-47A6-BB3B-41B05BE1418A-- From nobody Tue Aug 6 23:34:30 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B95FD12010F for ; Tue, 6 Aug 2019 23:34:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mkhVHuH4FZHt for ; Tue, 6 Aug 2019 23:34:25 -0700 (PDT) Received: from mail-ot1-x335.google.com (mail-ot1-x335.google.com [IPv6:2607:f8b0:4864:20::335]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C1971120024 for ; Tue, 6 Aug 2019 23:34:25 -0700 (PDT) Received: by mail-ot1-x335.google.com with SMTP id d17so100121671oth.5 for ; Tue, 06 Aug 2019 23:34:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=wXKhqnUdsUb1e0bAmaI1JiMDYNoW6OGZySQFcX/fEOk=; b=DBGEc3iijuKJkJQLkoNptkgs60QRua5Vrk1Q/syizyu614d6PfXGiiJD/9hFh/SSSA 0KhtB3RdANgh7nFnHKDuZHf7L34AhYjOVphv+ZWJm5IVvom2z7ktPKRhD5F/QxIEev8g 8+xdm9lYVYaikhp9QxxSTrICSBIjTHHH93gLKwnjHNH/GFjoQmQmdkBe+PNX7dYgjmVy MEeIrOdgFyB5q4HunXCZzK/0nsg18D+1AvJEcdDUFStuxPF2nyjlppbbnAqdWp+qLnZT njFewn2ssIPcvh/9Tsxijk4sddrlqjypmkZrhfn6cT6k7yervxIrKeraD8mFHpASyo4Q zq8Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=wXKhqnUdsUb1e0bAmaI1JiMDYNoW6OGZySQFcX/fEOk=; b=Wy+n+bsmrn3nTZL3/y8qfSqiGRplIvpOGriUDCagurv25bohdJ1eIROOd8pg3BPqtr UgCELRmKpGKr3ZZbffGeAQqMTuRCQXucxldmn3JyO91G6fji5x4/hoR7i3+pddo815U7 0eXyKBl+bVAstJxy4ovjBISlW2VxC+jxaTtDnGN8burIMcwoBRI3dmO1DgQyOeJZqMLH OJuL7MufQ4ggcT+9MaxnXiBcKWavCEOrYtrQYCzzALzIrdWoH5DN52vV5rqvzf9VtKSl DPBIW9PDIw9AKBpEvcRR5LPuBUjXVizVX0SXIc7dHrEW1J5FdMJrxVdXdQHKJGSEQ5w1 jTCw== X-Gm-Message-State: APjAAAXSRJTG8fQqcmFBrRMoHfhoWG32TiJn0TE4Q9L2M9iCLF3buKtb XOTjdywLUdd2QRc/fYYoFGiuaIKgc1XlGr5iHlA= X-Google-Smtp-Source: APXvYqztXLUiCZGgIjwPm4yns+Po1sRshI4bSP1nCy9JQjCu+kMJHMJDi3GrPtrKLq2WFhgGL2gRP7xdlu6/gcNeno4= X-Received: by 2002:a6b:b602:: with SMTP id g2mr7535750iof.54.1565159664914; Tue, 06 Aug 2019 23:34:24 -0700 (PDT) MIME-Version: 1.0 References: <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> <64bcfc51-6f3d-ae24-4de5-d0eb89975c66@cs.tcd.ie> <539D6F9D-137C-4F68-A8DE-EA3DFAF4D827@huitema.net> <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> In-Reply-To: From: Rob Sayre Date: Tue, 6 Aug 2019 23:34:13 -0700 Message-ID: To: Bret Jordan Cc: Tommy Jensen , Stephen Farrell , Alec Muffett , ADD Mailing list , Ralf Weber , Paul Wouters , Mikael Abrahamsson Content-Type: multipart/alternative; boundary="000000000000d82686058f812127" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Aug 2019 06:34:28 -0000 --000000000000d82686058f812127 Content-Type: text/plain; charset="UTF-8" On Tue, Aug 6, 2019 at 9:48 PM Bret Jordan wrote: > I for one am terrified of the possibility of mass centralization of DNS > traffic. > https://tools.ietf.org/html/rfc1958#section-6 "Confidentiality and authentication are the responsibility of end users and must be implemented in the protocols used by the end users." Obviously, the various DNS working groups haven't done very well on this point. How would you differentiate confidentiality and encryption from centralization? I mean, I guess the ability to intercept and change a DNS response is decentralization in some sense, but it doesn't seem clear that it's a good thing. > Especially given this is will be over http now and an app or client could > include a plethora of other http headers that could give guaranteed per > user tracking. > I am not sure this is a valid point. Most HTTP header fingerprinting uses features that needn't be included in a DoH query. Further, once all DNS is in one place, that makes a great target. > It's certainly a new target, but DNS is in the clear for the most part. It seems strange to imply this is a new weakness. thanks, Rob --000000000000d82686058f812127 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Tue, Aug 6, 2019 at 9:48 PM Bret Jorda= n <jordan.iet= f@gmail.com> wrote:
I for one am terrif= ied of the possibility of mass centralization of DNS traffic.

"C= onfidentiality and authentication are the responsibility of end users and m= ust be implemented in the protocols used by the end users."
=
Obviously, the various DNS working groups haven't done v= ery well on this point. How would you differentiate confidentiality and enc= ryption from centralization? I mean, I guess the ability to intercept and c= hange a DNS response is decentralization in some sense, but it doesn't = seem clear that it's a good thing.
=C2=A0
Especially given this= is will be over http now and an app or client could include a plethora of = other http headers that could give guaranteed per user tracking.

I am not sure this is a valid point. Most HTTP = header fingerprinting uses features that needn't be included in a DoH q= uery.

Further, once all DNS is in one place, that makes a grea= t target.

It's certainly a new ta= rget, but DNS is in the clear for the most part. It seems strange to imply = this is a new weakness.

thanks,
Rob
--000000000000d82686058f812127-- From nobody Tue Aug 6 23:52:44 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9377912012B for ; Tue, 6 Aug 2019 23:52:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.299 X-Spam-Level: X-Spam-Status: No, score=-4.299 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=swm.pp.se Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id a1LIUWyZj8GI for ; Tue, 6 Aug 2019 23:52:40 -0700 (PDT) Received: from uplift.swm.pp.se (swm.pp.se [212.247.200.143]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6ABB8120024 for ; Tue, 6 Aug 2019 23:52:40 -0700 (PDT) Received: by uplift.swm.pp.se (Postfix, from userid 501) id 2E675B4; Wed, 7 Aug 2019 08:52:38 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=swm.pp.se; s=mail; t=1565160758; bh=NeFCAlU0GJHONSo4sz3PPp8JFSvNE9PbDMD8tj+D81U=; h=Date:From:To:cc:Subject:In-Reply-To:References:From; b=n0BX6fat/wZPMYFm94/xNnnp/DBDLmrEET12FgkTp3CaNO5BgErGMCJqb3wyXKtyt RKx40J95Oa/WYcDl7Gyk45wmttl7kXm7PlyhRmlvcmmn4UtMg06TMdcT/sJCNRS4ei gjXSnJHToQIHZhMKZiBBIHDEVuS2K52Q87u7EgHk= Received: from localhost (localhost [127.0.0.1]) by uplift.swm.pp.se (Postfix) with ESMTP id 2C7EAB1; Wed, 7 Aug 2019 08:52:38 +0200 (CEST) Date: Wed, 7 Aug 2019 08:52:38 +0200 (CEST) From: Mikael Abrahamsson To: Rob Sayre cc: ADD Mailing list In-Reply-To: Message-ID: References: <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> User-Agent: Alpine 2.20 (DEB 67 2015-01-07) Organization: People's Front Against WWW MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII; format=flowed Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Aug 2019 06:52:43 -0000 On Tue, 6 Aug 2019, Rob Sayre wrote: > Obviously, the various DNS working groups haven't done very well on this > point. How would you differentiate confidentiality and encryption from > centralization? I mean, I guess the ability to intercept and change a > DNS response is decentralization in some sense, but it doesn't seem > clear that it's a good thing. Of the people I talk to, nobody/few seem to be opposed to transport encryption of DNS queries. I hear from multiple other operators "sure, we can DoT enable our existing resolvers". DoH-enablement is typically also viewed as ok. What people are opposed to is to steer away the resolver duty from the ISPs (typically handed out via DHCP) to something else without asking the user. Having the entire world of browser users all of a sudden use a quad-X service run by a handful of cloud providers makes a lot of people very concerned. This is the decentralisation point we're talking about when it comes to DNS. Today there are probably tens/hundreds of thousands of entities running recursive DNS resolvers. In the proposed future of "all browsers will use one of a few DoH providers" this is no longer the case. If the lookups are encrypted or not, is less of a concern point. -- Mikael Abrahamsson email: swmike@swm.pp.se From nobody Wed Aug 7 00:02:21 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E55DE120142 for ; Wed, 7 Aug 2019 00:02:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OJnjkH19vRJk for ; Wed, 7 Aug 2019 00:02:18 -0700 (PDT) Received: from mail-ot1-x32f.google.com (mail-ot1-x32f.google.com [IPv6:2607:f8b0:4864:20::32f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 64F20120024 for ; Wed, 7 Aug 2019 00:02:18 -0700 (PDT) Received: by mail-ot1-x32f.google.com with SMTP id b7so50077757otl.11 for ; Wed, 07 Aug 2019 00:02:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=cCkX98t8TjT9RF9Y1rC8vWs1C8viiexYhMFxUuV6f/Q=; b=RPabcCzEbFmmC6lmG8k1RwkPkmCeYi5JLjzy6B99LBI5HqMxwty/V4A3lEGZoaNuwU TFneB32EwkqjUIsIcwc4Pyn1LFqnbXQoHSalZPQuMxTLohRXzMT+acC+HHyHs6w+xjQy pAy6Wxv6bF6wu/Nkt+CZ3KeeGRGt2rLvYH+AdoGHXvIPL7TSqPEdQu0M8E1nNq13YfmW QkaDmlorMgPwtcYrfNEjq13puOjLXhiodtHZ39RNeEfDEV1JLiLT6DhxU1wJ2LmUazUi Xp6tVyNa3BrIJYbdGks6VB3rgfXajdpMhkhMVfPU2ypiFij6VZJhdKiD4b4b2LPnTl6F xr9A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=cCkX98t8TjT9RF9Y1rC8vWs1C8viiexYhMFxUuV6f/Q=; b=q3xaXhYfcA50ar1LaBLoiYOI3Ewl3E40gVYuWVRoAULAjqPh6MU54PL9sqlQEMvF5R MRe3SF8e/GAKnBNPJ4UPWfeVOxt0rs1emmg+W9RgN3d3dFp4tZg+urQL1Ug1SKVrj5qP olGpkwvk3bElb3ArvtwyOX9ZXNYHkNOnSjbxQY+JtZ0rbCkCTUlqEvRD9FK+gUH4dcaq BKoJWOiP3s36gQIlznamBTEHK9MA2ncIlUUY0j/By3lY7UgSFGLOG2iGnvS4Pj8Ur5cC 5OhIwuT+3DN2uClT5hkTqF4EbbkcGwyeci8pR+xbtg2XYShieIf+KSYUwdJVY90RNaMK p9og== X-Gm-Message-State: APjAAAVvqSD5UDO8saAu+kYJ4wf4TNSmJl4oSe2zDxWQfbI+ZBSJBJZo uDFYFUVezilrE4/Ct3v2JSPSum40OD58yWPx08Q= X-Google-Smtp-Source: APXvYqxCVrRNIsfYPkaTUBNq6eUJqNk3d0eDICZWHEmtHjQGyK4CXuUMnbQDYmnym64gerJx0byd5Yo2PJ3Pka5CLDU= X-Received: by 2002:a5e:d618:: with SMTP id w24mr7802881iom.73.1565161337587; Wed, 07 Aug 2019 00:02:17 -0700 (PDT) MIME-Version: 1.0 References: <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> In-Reply-To: From: Rob Sayre Date: Wed, 7 Aug 2019 00:02:05 -0700 Message-ID: To: Mikael Abrahamsson Cc: ADD Mailing list Content-Type: multipart/alternative; boundary="0000000000008b0b42058f818544" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Aug 2019 07:02:20 -0000 --0000000000008b0b42058f818544 Content-Type: text/plain; charset="UTF-8" On Tue, Aug 6, 2019 at 11:52 PM Mikael Abrahamsson wrote: > What people are opposed to is to steer away the resolver duty from the > ISPs > That does seem like the main issue. But, the IETF defines protocols. It doesn't standardize which endpoints must be consulted. thanks, Rob --0000000000008b0b42058f818544 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Tue, Aug 6, 2019 at 11:52 PM Mikael Ab= rahamsson <swmike@swm.pp.se> = wrote:
What people are opposed to is to steer away the resolver duty from the
ISPs=C2=A0

That does seem like the main= issue.

But, the IETF defines protocols. It doesn&= #39;t standardize which endpoints must be consulted.

thanks,
Rob
--0000000000008b0b42058f818544-- From nobody Wed Aug 7 00:25:20 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0CE321201FA for ; Wed, 7 Aug 2019 00:25:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CW7BowY72ZEN for ; Wed, 7 Aug 2019 00:25:17 -0700 (PDT) Received: from mx43-out1.antispamcloud.com (mx43-out1.antispamcloud.com [138.201.61.189]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C7ABC120043 for ; Wed, 7 Aug 2019 00:25:16 -0700 (PDT) Received: from xse304.mail2web.com ([66.113.197.50] helo=xse.mail2web.com) by mx128.antispamcloud.com with esmtp (Exim 4.89) (envelope-from ) id 1hvGJs-0005nB-JI for add@ietf.org; Wed, 07 Aug 2019 09:25:14 +0200 Received: from xsmtp21.mail2web.com (unknown [10.100.68.60]) by xse.mail2web.com (Postfix) with ESMTPS id 463NLt0GMbz4m2M for ; Wed, 7 Aug 2019 00:25:10 -0700 (PDT) Received: from [10.5.2.16] (helo=xmail06.myhosting.com) by xsmtp21.mail2web.com with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.92) (envelope-from ) id 1hvGJp-000577-Tn for add@ietf.org; Wed, 07 Aug 2019 00:25:09 -0700 Received: (qmail 4128 invoked from network); 7 Aug 2019 07:25:09 -0000 Received: from unknown (HELO [192.168.1.108]) (Authenticated-user:_huitema@huitema.net@[172.58.43.192]) (envelope-sender ) by xmail06.myhosting.com (qmail-ldap-1.03) with ESMTPA for ; 7 Aug 2019 07:25:09 -0000 To: Rob Sayre , Bret Jordan Cc: Mikael Abrahamsson , Alec Muffett , ADD Mailing list , Tommy Jensen , Ralf Weber , Paul Wouters , Stephen Farrell References: <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> From: Christian Huitema Openpgp: preference=signencrypt Autocrypt: addr=huitema@huitema.net; prefer-encrypt=mutual; keydata= mQENBFIRX8gBCAC26usy/Ya38IqaLBSu33vKD6hP5Yw390XsWLaAZTeQR64OJEkoOdXpvcOS HWfMIlD5s5+oHfLe8jjmErFAXYJ8yytPj1fD2OdSKAe1TccUBiOXT8wdVxSr5d0alExVv/LO I/vA2aU1TwOkVHKSapD7j8/HZBrqIWRrXUSj2f5n9tY2nJzG9KRzSG0giaJWBfUFiGb4lvsy IaCaIU0YpfkDDk6PtK5YYzuCeF0B+O7N9LhDu/foUUc4MNq4K3EKDPb2FL1Hrv0XHpkXeMRZ olpH8SUFUJbmi+zYRuUgcXgMZRmZFL1tu6z9h6gY4/KPyF9aYot6zG28Qk/BFQRtj7V1ABEB AAG0J0NocmlzdGlhbiBIdWl0ZW1hIDxodWl0ZW1hQGh1aXRlbWEubmV0PokBOQQTAQIAIwUC UhFfyAIbLwcLCQgHAwIBBhUIAgkKCwQWAgMBAh4BAheAAAoJEJNDCbJVyA1yhbYH/1ud6x6m VqGIp0JcZUfSQO8w+TjugqxCyGNn+w/6Qb5O/xENxNQ4HaMQ5uSRK9n8WKKDDRSzwZ4syKKf wbkfj05vgFxrjCynVbm1zs2X2aGXh+PxPL/WHUaxzEP7KjYbLtCUZDRzOOrm+0LMktngT/k3 6+EZoLEM52hwwpIAzJoscyEz7QfqMOZtFm6xQnlvDQeIrHx0KUvwo/vgDLK3SuruG1CSHcR0 D24kEEUa044AIUKBS3b0b8AR7f6mP2NcnLpdsibtpabi9BzqAidcY/EjTaoea46HXALk/eJd 6OLkLE6UQe1PPzQC4jB7rErX2BxnSkHDw50xMgLRcl5/b1a5AQ0EUhFfyAEIAKp7Cp8lqKTV CC9QiAf6QTIjW+lie5J44Ad++0k8gRgANZVWubQuCQ71gxDWLtxYfFkEXjG4TXV/MUtnOliG 5rc2E+ih6Dg61Y5PQakm9OwPIsOx+2R+iSW325ngln2UQrVPgloO83QiUoi7mBJPbcHlxkhZ bd3+EjFxSLIQogt29sTcg2oSh4oljUpz5niTt69IOfZx21kf29NfDE+Iw56gfrxI2ywZbu5o G+d0ZSp0lsovygpk4jK04fDTq0vxjEU5HjPcsXC4CSZdq5E2DrF4nOh1UHkHzeaXdYR2Bn1Y wTePfaHBFlvQzI+Li/Q6AD/uxbTM0vIcsUxrv3MNHCUAEQEAAYkCPgQYAQIACQUCUhFfyAIb LgEpCRCTQwmyVcgNcsBdIAQZAQIABgUCUhFfyAAKCRC22tOSFDh1UOlBB/94RsCJepNvmi/c YiNmMnm0mKb6vjv43OsHkqrrCqJSfo95KHyl5Up4JEp8tiJMyYT2mp4IsirZHxz/5lqkw9Az tcGAF3GlFsj++xTyD07DXlNeddwTKlqPRi/b8sppjtWur6Pm+wnAHp0mQ7GidhxHccFCl65w uT7S/ocb1MjrTgnAMiz+x87d48n1UJ7yIdI41Wpg2XFZiA9xPBiDuuoPwFj14/nK0elV5Dvq 4/HVgfurb4+fd74PV/CC/dmd7hg0ZRlgnB5rFUcFO7ywb7/TvICIIaLWcI42OJDSZjZ/MAzz BeXm263lHh+kFxkh2LxEHnQGHCHGpTYyi4Z3dv03HtkH/1SI8joQMQq00Bv+RdEbJXfEExrT u4gtdZAihwvy97OPA2nCdTAHm/phkzryMeOaOztI4PS8u2Ce5lUB6P/HcGtK/038KdX5MYST Fn8KUDt4o29bkv0CUXwDzS3oTzPNtGdryBkRMc9b+yn9+AdwFEH4auhiTQXPMnl0+G3nhKr7 jvzVFJCRif3OAhEm4vmBNDE3uuaXFQnbK56GJrnqVN+KX5Z3M7X3fA8UcVCGOEHXRP/aubiw Ngawj0V9x+43kUapFp+nF69R53UI65YtJ95ec4PTO/Edvap8h1UbdEOc4+TiYwY1TBuIKltY 1cnrjgAWUh/Ucvr++/KbD9tD6C8= Message-ID: Date: Wed, 7 Aug 2019 02:25:08 -0500 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/alternative; boundary="------------BE1BA266908E4302F874732A" Content-Language: en-US X-Originating-IP: 66.113.197.50 X-Spampanel-Domain: xsmtpout.mail2web.com X-Spampanel-Username: 66.113.197.0/24 Authentication-Results: antispamcloud.com; auth=pass smtp.auth=66.113.197.0/24@xsmtpout.mail2web.com X-Spampanel-Outgoing-Class: unsure X-Spampanel-Outgoing-Evidence: Combined (0.15) X-Recommended-Action: accept X-Filter-ID: Mvzo4OR0dZXEDF/gcnlw0YiRRkpbHZ8F3zevhEShTfypSDasLI4SayDByyq9LIhVUZbR67CQ7/vm /hHDJU4RXkTNWdUk1Ol2OGx3IfrIJKywOmJyM1qr8uRnWBrbSAGDNzOpszOkW3faMySFwG163+fH zJ6mVE7ewsipSVIfs4ZuGjHfsSArDYvJG6JcBjqigyWFxOA5dILPypvKxNVhWQwOVcNrdpWfEYrY fLBY3+ef7heanb/rBmrs7JMJfZdiPM2DmctUkuqITdPZ8a3LuY6jSvfpO+1kZkomjtjB6X5Q5Q9f RUeIpTIC2ySfqvnqLwoxlgatmaBb0rBiK9xbkDrUqzcKIief90MVLZY9LbIZh9+IQ1oS9LBn3VIP 95Jz7ujRlJ9wSMlhvaudJXZ9EIBG/qaR+8r9SKFMmPJLf850OvZYsmoVQuOIhwKLK6IKBNB4LZ0v UHHKTzJX7b1JhMjx7v77N42Z/zX3DQBtZa/0j9rMdVQseW3F+doIupqmER9E+btGG8Xk1uugE/FU 4J9TrjYo22Tif+7yfJXbGyN6EipRzMVZ5LqwTx7Vvn9SP+LiFhV9TEgXGI3XmDfDnFIqCLCdAp1y ZulYn20NGB12Yb/vIh25WdNEuByaThX0euv7S+SAeIupBduL8b1m1yh5KGb7ROvbHiVm7vBxpr58 g2fGU86cSswil+kDetUfttbLHdNhiUq2jBEvMVLlZ4GThCScvU0cCIiHSQbmcVI9K9XmsnX/hquy YoXuWPGQWDvBhuNO4tpnc980Bg7nraX1ClsKnu8bsKu+3RocdLsu+nj4xcNEMKT/A6FsBUk8XPWl FdaGOH191uXjgjQN/bk/tOvsMDZmQNfeGxdXg4EpYSGiAK25AeP3LEywb5Nq83g9ueTJOU6a76yp yxjdeg8YhWenlMfuvb1mNY5/IPiuedK/Z3MvnAyDmuOaA5CGZRWsGw8ac2InzcAP/gmxwNpms+rB 6wJM+NNhN3aT35NSU/fjw6KbqLw80r1gDO3m6U0LjBzYuQztdAThgtWSU3qCINKqlAdh+ePAcEwD s/8= X-Report-Abuse-To: spam@quarantine9.antispamcloud.com Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Aug 2019 07:25:19 -0000 This is a multi-part message in MIME format. --------------BE1BA266908E4302F874732A Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On 8/7/2019 1:34 AM, Rob Sayre wrote: > > Further, once all DNS is in one place, that makes a great target. > > > It's certainly a new target, but DNS is in the clear for the most > part. It seems strange to imply this is a new weakness. That's true. But then, centralization would have other consequences, such as a go-to place for censorship. We have to assume that DoH and application level DNS is happening, just like application level transport is happening. But we should also look at ways to defeat centralization even when DoH is happening. That probably mean relying more on the individual web sites, which have a vested business interest in not providing their metadata streams to the central services (or at least not for free). It probably also means some form of caching and recursive resolving in the applications themselves. To give an example, suppose that applications cache the ESNI record for a particular "hidden" server. Suppose also that the record is not short lived. For the duration of the record's TTL, the application does not need to emit a DNS request for the hidden server. It just need to do real time queries for the fronting server. And when it does that, it does not expose anything more than what can be revealed with the TLS connection through the fronting server. Then go one step further. Suppose that the application knows the preferred DoH server for the fronting server. Then it can send the real time requests for that fronting server there, instead of relying on any big centralized service. Do that for enough destination, and the central service will only see a rather unteresting fraction of the DNS traffic. There are probably many holes in my back-of-the-envelope design. But it shows at least one thing: if we set up to find mitigations for the centralization, we can most probably find some. And we may be able to roll out these mitigation before the dreaded centralization happens. -- Christian Huitema --------------BE1BA266908E4302F874732A Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 8bit

On 8/7/2019 1:34 AM, Rob Sayre wrote:


Further, once all DNS is in one place, that makes a great target.

It's certainly a new target, but DNS is in the clear for the most part. It seems strange to imply this is a new weakness.


That's true. But then, centralization would have other consequences, such as a go-to place for censorship.

We have to assume that DoH and application level DNS is happening, just like application level transport is happening. But we should also look at ways to defeat centralization even when DoH is happening. That probably mean relying more on the individual web sites, which have a vested business interest in not providing their metadata streams to the central services (or at least not for free). It probably also means some form of caching and recursive resolving in the applications themselves.

To give an example, suppose that applications cache the ESNI record for a particular "hidden" server. Suppose also that the record is not short lived. For the duration of the record's TTL, the application does not need to emit a DNS request for the hidden server. It just need to do real time queries for the fronting server. And when it does that, it does not expose anything more than what can be revealed with the TLS connection through the fronting server.

Then go one step further. Suppose that the application knows the preferred DoH server for the fronting server. Then it can send the real time requests for that fronting server there, instead of relying on any big centralized service. Do that for enough destination, and the central service will only see a rather unteresting fraction of the DNS traffic.

There are probably many holes in my back-of-the-envelope design. But it shows at least one thing: if we set up to find mitigations for the centralization, we can most probably find some. And we may be able to roll out these mitigation before the dreaded centralization happens.

-- Christian Huitema


--------------BE1BA266908E4302F874732A-- From nobody Wed Aug 7 00:44:33 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9C4CB120288 for ; Wed, 7 Aug 2019 00:44:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GdHBBbmIis84 for ; Wed, 7 Aug 2019 00:44:29 -0700 (PDT) Received: from mail-ot1-x330.google.com (mail-ot1-x330.google.com [IPv6:2607:f8b0:4864:20::330]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BABD7120043 for ; Wed, 7 Aug 2019 00:44:27 -0700 (PDT) Received: by mail-ot1-x330.google.com with SMTP id z23so72327319ote.13 for ; Wed, 07 Aug 2019 00:44:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=gfGGJc15dsvK/NuzjCS2fhemiAbxKJhB73bpkQB9iRg=; b=O09ApFbNG1kcudPvYrMMH7xroYJNXK3suCE7PQV0f6X99ONxGbee+oF6/AmdPosWxX J1yESSLjXityPBiPou2Ucrx0JLiXGDielJ2hSjQNklmC+60o0CFEiD2EEDx83CuCX/Zj RVXngclIzc73qEtE4IuMy+ey1Xr1BQ5wzAPlokqw62WdZlhvv9Q73lWt5zDsUJChTSYN g+KzuoU9wtIVtS7aCShnAp7g1hcx6coJovXAECFL27m/EOKIfnKdQas07AaR+tvAR2Ic RIqQenDxUaVr4XYJuc5VLSRN5i3T6bEWfmB6CVXLjAIQaJZ1GybgjldQgne725lge2r4 bSbg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=gfGGJc15dsvK/NuzjCS2fhemiAbxKJhB73bpkQB9iRg=; b=NAX7BtWwaGolLuZUzUoR2EJyLFR9hbtCdb+1knWlAtMgZ35xSluP3/7lTnEwwXMvoM LdxaoPzHLOZsgwM31IfFACSJAyQ1Swp8VnMffJ+x4JWy2TsMQAya+K1j3RHqh76HLYrh kbgbagGIw+RXAmI4Vrz9jak/w/JTKD64+Qw9nu4UMlIO7yxc4Se8XZogq4HSCMMugdF9 7W+f5FS4/sSxNQYugM0hWMaqhsrPZzWAoD7zf3RiQegQOHrtINzffCfUxqHLzRAJ3yCq 3xE0EjuxBDp5LkckcxROg/EUCVDVRytQjmIlaja/FIBnhidSi2KkeTQzVC+NwCJ5Gkb1 9igQ== X-Gm-Message-State: APjAAAWqV6arED2TfYb2J92hg33OldQB9IdG7l+ciUjvDPg0x525zjDn sGz+wg9b6FI43MIFblMOKlb1iB5PVkpt1oBNjfc= X-Google-Smtp-Source: APXvYqyKj7Uyb3mkETIPEVC6apzW4s2c1qxM5GsHSVvzehRZMPiZgDCgVoilJT7QI6VFJS1jAffYV30JAP6iSznp0Ec= X-Received: by 2002:a6b:b602:: with SMTP id g2mr7760025iof.54.1565163866883; Wed, 07 Aug 2019 00:44:26 -0700 (PDT) MIME-Version: 1.0 References: <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> In-Reply-To: From: Rob Sayre Date: Wed, 7 Aug 2019 00:44:14 -0700 Message-ID: To: Christian Huitema Cc: Bret Jordan , Mikael Abrahamsson , Alec Muffett , ADD Mailing list , Tommy Jensen , Ralf Weber , Paul Wouters , Stephen Farrell Content-Type: multipart/alternative; boundary="0000000000004d0cee058f821c18" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Aug 2019 07:44:31 -0000 --0000000000004d0cee058f821c18 Content-Type: text/plain; charset="UTF-8" On Wed, Aug 7, 2019 at 12:25 AM Christian Huitema wrote: > On 8/7/2019 1:34 AM, Rob Sayre wrote: > > > Further, once all DNS is in one place, that makes a great target. >> > > It's certainly a new target, but DNS is in the clear for the most part. It > seems strange to imply this is a new weakness. > > > That's true. But then, centralization would have other consequences, such > as a go-to place for censorship. > I don't think that's the case. As Mozilla's presentation stated: DNS is not an effective control surface. Even in an environment with ubiquitous, application-specific DoH, the PKI system would still be fairly centralized. That would be the go-to place for censorship, not that I think it's a particularly relevant issue for a DNS mailing list. thanks, Rob --0000000000004d0cee058f821c18 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Wed, Aug 7, 2019 at 12:25 AM Chris= tian Huitema <h= uitema@huitema.net> wrote:
=20 =20 =20

On 8/7/2019 1:34 AM, Rob Sayre wrote:


Further, once all DNS is in one place, that makes a great target.

It's certainly a new target, but DNS is in the clear for the most part. It seems strange to imply this is a new weakness.


That's true. But then, centralization would have other consequences, such as a go-to place for censorship.


I don't think that's the case. As Mozilla&= #39;s presentation stated: DNS is not an effective control surface.

Even in an environment with ubiquitous, application-speci= fic DoH, the PKI system would still be fairly centralized. That would be th= e=C2=A0go-to place for censorship, not that I think it's a particularly= relevant issue for a DNS mailing list.

thanks,
Rob

--0000000000004d0cee058f821c18-- From nobody Wed Aug 7 03:11:29 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2FDC112062E for ; Wed, 7 Aug 2019 03:11:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=netorgft5189650.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9hQajRWm5xBb for ; Wed, 7 Aug 2019 03:11:26 -0700 (PDT) Received: from GBR01-LO2-obe.outbound.protection.outlook.com (mail-eopbgr100055.outbound.protection.outlook.com [40.107.10.55]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D72051205D5 for ; Wed, 7 Aug 2019 03:11:25 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=WI9apHgUcdGQ+3BqGf/XV9C1tXoknvr7/6AkGxVsHgAIoVjqbsasagB/qdCxIebtmWD5h7nRCf0tk68d+H3DkHTZQIsrcdxe7rikfdh7WMhWfE9YEwaWXx28uqx7DjNFF5JuwY75eBFBIazJyP/v66Kf478kBFYt/Ms83LFrutD20ID3EIxZanUnCwVOGsjVOZRXF4yUEJW7my70tWLD7GWj0MNLGAtDTJymxKym7kpUimguJmuAmEVD/FW4Ksc5TqwYfrz6HJI43DMPvtzMNvTIETGdI+vM+ED1SsVCLULNrpZVstD3rXFEFgUwfAAdJJMl0WAAzS5a2+7Ohb9n6A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=5Dsi7f4zd/gE/hOhNinKaiUMjfJ1aq5mwal4lsMcpn0=; b=UJacyeRTC4P9ODLenG6XEGw5zDjiEfWtZJAEB6kTH0NPH10YHWDrf25P5VSsMKCwEEsYYJrFK4jODk7zz1Dt+RKJWH4PT89/ZrvVlvqZPE0j6vLGKgruyNyUvIG0HuQnQT6W7BZp6yg/0YrVRlOBDWfGbyAdpHe5969K6msSleQ4gpeoDEbBBaTFUjp1Jc1qfHeT1oH9hHzoPz3eoNLnWggftrT1i7fj3rTpXSF7K8XwGvM0yDoXhEdlVM5voPw+f3F8SKOfypqw6jU9FNYHjX68IZH0xQIei7lwqxeWc894WXrH+z/zu8IDE0Z+qe2BHoYYh+7/WiLW4m/Jkz63Sg== ARC-Authentication-Results: i=1; mx.microsoft.com 1;spf=pass smtp.mailfrom=419.consulting;dmarc=pass action=none header.from=419.consulting;dkim=pass header.d=419.consulting;arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=NETORGFT5189650.onmicrosoft.com; s=selector1-NETORGFT5189650-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=5Dsi7f4zd/gE/hOhNinKaiUMjfJ1aq5mwal4lsMcpn0=; b=TT0FWzLQO8iZXLBm9Ok0pSpboiAM6vbpXNKkmyWPIXTyP3POghD/s7ega9T4Ct+ld6lhoZigOkPVMQIUad0BlccsVFfH2nSxIli/IVgSlJyXrTcrsy7k3aIFWuE1JtxQZnNfREpI+9S3gN8Z/lVVNEwr+6IJoKZh3+LB5FNTGMw= Received: from LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM (20.176.138.146) by LO2P265MB0061.GBRP265.PROD.OUTLOOK.COM (10.166.85.138) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2136.16; Wed, 7 Aug 2019 10:11:22 +0000 Received: from LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM ([fe80::64e9:9b9e:59fc:26f]) by LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM ([fe80::64e9:9b9e:59fc:26f%5]) with mapi id 15.20.2136.018; Wed, 7 Aug 2019 10:11:22 +0000 From: Andrew Campling To: Rob Sayre , Christian Huitema CC: ADD Mailing list Thread-Topic: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] Thread-Index: AQHVRidGMO+qM2WT5EmEKYuoHiytFKbvdlJg Date: Wed, 7 Aug 2019 10:11:22 +0000 Message-ID: References: <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=andrew.campling@419.consulting; x-originating-ip: [81.141.76.158] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 1dc78ea2-655b-4257-4c82-08d71b1f9934 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(7021145)(8989299)(4534185)(7022145)(4603075)(4627221)(201702281549075)(8990200)(7048125)(7024125)(7027125)(7023125)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:LO2P265MB0061; x-ms-traffictypediagnostic: LO2P265MB0061: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:1091; x-forefront-prvs: 01221E3973 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(39830400003)(136003)(376002)(346002)(396003)(366004)(189003)(199004)(6436002)(7736002)(74316002)(229853002)(14454004)(8936002)(3846002)(6116002)(790700001)(2906002)(66066001)(558084003)(8676002)(33656002)(81166006)(81156014)(86362001)(44832011)(68736007)(4326008)(446003)(476003)(486006)(11346002)(25786009)(256004)(6246003)(316002)(26005)(110136005)(186003)(6506007)(53546011)(76176011)(99286004)(7696005)(508600001)(102836004)(66946007)(53936002)(66446008)(64756008)(66556008)(66476007)(5660300002)(76116006)(55016002)(52536014)(71200400001)(71190400001)(9686003)(54896002)(6306002)(46492003)(148743002); DIR:OUT; SFP:1101; SCL:1; SRVR:LO2P265MB0061; H:LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: 419.consulting does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: NSEEijrlHXuWsjVFhGaRSYTHyBjd3aJHuR0cbv6qB1Fzy8Phyow9t0P6IrjsrfKWDq98irygzZTZT5j4RAn+raFXE9OLOlO+RhixfWfqdQEczBYW4QyTG6Iz5c4OXN7n4xTT5fvVMkiqKJL1HGP484zwhKoxKZ6aSPzJby1tTzD02jd/4w15q9Dh2bfnHNqr16Na0pZAPhvEPfsRGFxRPSnlhZWjG5uozj2+5TQL8KZhHjUg5zYcsndzLh1X2eYCkIU/mGFbvMtBwxi3Mfx/a/yfjoE8qFbkmAEIZ0sYAUelo3spkNTNpq0pxr8W36bPNZrvnBS78lWev9aNs4wF+48vS98beoVz2GRIEZrwEZb6NdlQKwoKGhLO20IvL68Gwb7zjYdfL6yVxo8wrZybPki6sBvR9bSqarnda7utDOI= Content-Type: multipart/alternative; boundary="_000_LO2P265MB1327F1E0797B168558AAC42DC2D40LO2P265MB1327GBRP_" MIME-Version: 1.0 X-OriginatorOrg: 419.consulting X-MS-Exchange-CrossTenant-Network-Message-Id: 1dc78ea2-655b-4257-4c82-08d71b1f9934 X-MS-Exchange-CrossTenant-originalarrivaltime: 07 Aug 2019 10:11:22.3322 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 9c2ced3e-7522-4755-87dc-f983abc66ec3 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: andrew.campling@419.consulting X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO2P265MB0061 Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Aug 2019 10:11:28 -0000 --_000_LO2P265MB1327F1E0797B168558AAC42DC2D40LO2P265MB1327GBRP_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 DQpPbiBXZWQsIEF1ZyA3LCAyMDE5IGF0IDA4OjQ0IEFNIFJvYiBTYXlyZSA8c2F5cmVyQGdtYWls LmNvbT4gd3JvdGU6DQoNCj4gQXMgTW96aWxsYSdzIHByZXNlbnRhdGlvbiBzdGF0ZWQ6IEROUyBp cyBub3QgYW4gZWZmZWN0aXZlIGNvbnRyb2wgc3VyZmFjZS4NCg0KSXQgbWF5IGhhdmUgc3RhdGVk IHRoYXQsIGhvd2V2ZXIgdGhhdCBkb2VzbuKAmXQgbWFrZSBpdCB0cnVlLg0KDQoNCkFuZHJldw0K DQo= --_000_LO2P265MB1327F1E0797B168558AAC42DC2D40LO2P265MB1327GBRP_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBjbTsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQph OmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xv cjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFuLk1z b0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpwdXJw bGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwLk1zb0xpc3RQYXJhZ3JhcGgsIGxp Lk1zb0xpc3RQYXJhZ3JhcGgsIGRpdi5Nc29MaXN0UGFyYWdyYXBoDQoJe21zby1zdHlsZS1wcmlv cml0eTozNDsNCgltYXJnaW4tdG9wOjBjbTsNCgltYXJnaW4tcmlnaHQ6MGNtOw0KCW1hcmdpbi1i b3R0b206MGNtOw0KCW1hcmdpbi1sZWZ0OjM2LjBwdDsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7 DQoJZm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9 DQpwLm1zb25vcm1hbDAsIGxpLm1zb25vcm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHls ZS1uYW1lOm1zb25vcm1hbDsNCgltc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmln aHQ6MGNtOw0KCW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBjbTsN Cglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30N CnNwYW4uRW1haWxTdHlsZTE5DQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZv bnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOndpbmRvd3RleHQ7fQ0KLk1z b0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1mYW1pbHk6 IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJbXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVM7fQ0KQHBh Z2UgV29yZFNlY3Rpb24xDQoJe3NpemU6NjEyLjBwdCA3OTIuMHB0Ow0KCW1hcmdpbjo3Mi4wcHQg NzIuMHB0IDcyLjBwdCA3Mi4wcHQ7fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0 aW9uMTt9DQotLT48L3N0eWxlPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVkZWZh dWx0cyB2OmV4dD0iZWRpdCIgc3BpZG1heD0iMTAyNiIgLz4NCjwveG1sPjwhW2VuZGlmXS0tPjwh LS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVsYXlvdXQgdjpleHQ9ImVkaXQiPg0KPG86 aWRtYXAgdjpleHQ9ImVkaXQiIGRhdGE9IjEiIC8+DQo8L286c2hhcGVsYXlvdXQ+PC94bWw+PCFb ZW5kaWZdLS0+DQo8L2hlYWQ+DQo8Ym9keSBsYW5nPSJFTi1HQiIgbGluaz0iYmx1ZSIgdmxpbms9 InB1cnBsZSI+DQo8ZGl2IGNsYXNzPSJXb3JkU2VjdGlvbjEiPg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj5PbiBXZWQsIEF1ZyA3LCAyMDE5IGF0IDA4OjQ0IEFNIDxzcGFuIGxhbmc9IkVO LVVTIj5Sb2IgU2F5cmUgJmx0O3NheXJlckBnbWFpbC5jb20mZ3Q7DQo8L3NwYW4+d3JvdGU6PG86 cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjEyLjBwdCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+Jmd0OyBBcyBNb3ppbGxhJ3MgcHJlc2VudGF0aW9uIHN0YXRlZDog RE5TIGlzIG5vdCBhbiBlZmZlY3RpdmUgY29udHJvbCBzdXJmYWNlLjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5JdCBtYXkgaGF2ZSBzdGF0ZWQg dGhhdCwgaG93ZXZlciB0aGF0IGRvZXNu4oCZdCBtYWtlIGl0IHRydWUuJm5ic3A7DQo8bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7 PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox Mi4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPkFuZHJldyA8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4N CjwvZGl2Pg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_LO2P265MB1327F1E0797B168558AAC42DC2D40LO2P265MB1327GBRP_-- From nobody Wed Aug 7 05:12:02 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DCAF512001A for ; Wed, 7 Aug 2019 05:12:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PrbLI5L4DEmQ for ; Wed, 7 Aug 2019 05:11:58 -0700 (PDT) Received: from smtp.guxx.net (smtp.guxx.net [IPv6:2a01:4f8:a0:322c::25:42]) by ietfa.amsl.com (Postfix) with ESMTP id 27B4D120018 for ; Wed, 7 Aug 2019 05:11:58 -0700 (PDT) Received: by nyx.guxx.net (Postfix, from userid 107) id EF93A5F43251; Wed, 7 Aug 2019 14:11:56 +0200 (CEST) Received: from [192.168.2.190] (p4FF5367C.dip0.t-ipconnect.de [79.245.54.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by nyx.guxx.net (Postfix) with ESMTPSA id 4D7795F42ADB; Wed, 7 Aug 2019 14:11:55 +0200 (CEST) From: "Ralf Weber" To: "Rob Sayre" Cc: "Christian Huitema" , "Stephen Farrell" , "Bret Jordan" , "Alec Muffett" , "ADD Mailing list" , "Tommy Jensen" , "Paul Wouters" , "Mikael Abrahamsson" Date: Wed, 07 Aug 2019 14:11:53 +0200 X-Mailer: MailMate (1.12.5r5635) Message-ID: <0C96CA30-4704-4791-B286-A546106429AE@fl1ger.de> In-Reply-To: References: <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Aug 2019 12:12:01 -0000 Moin! On 7 Aug 2019, at 9:44, Rob Sayre wrote: >> That's true. But then, centralization would have other consequences, >> such >> as a go-to place for censorship. >> > > I don't think that's the case. So there are currently three big providers of globally available DoH servers (Google, Cloudflare, Quad9). All of them are big US companies. Compare that to thousands of ISPs worldwide. Given that behaviour of US organisations caused the increased encryption efforts in the IETF centralising central naming to US companies to me seems the wrong way as it is now much easier for those organisations to get this data. The problem is that there are not a lot of commercial incentives to run a scalable global DNS/DoX service other then mining the data or getting direct interaction with the end user, and none of these are privacy goals. ISPs have a natural interest of supplying a good DNS service as it is a part of the overall Internet service they supply and the faster these are the more attractive they are for users. > As Mozilla's presentation stated: DNS is not > an effective control surface. Well the fact that Mozilla stated it doesn’t make it a true statement. As with all things security there is no 100% effective security solution or control surface. There may be different levels needed to attack the control surface and DNS as a control surface is the sweet spot as: - It is needed for most transactions on the Internet - It is relatively easy to enforce it (redirect/block port 53) - It is possible to circumvent, but with a moderate amount of effort (VPN) Which is why it is used a lot for security (It’s an onion), parental controls, enterprises and governmental use. Having worked with lawmakers in Europe on content control my experiences are that they are usually ok with a solution put into law that isn’t a 100%, but if this solution goes down say 50% they will demand a better solution and given that we already had talks here about government should be able to decrypt transactions I fear that we could be worse off if we are abandoning DNS as a somewhat effective control point. So long -Ralf From nobody Wed Aug 7 06:28:44 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5E06612022B for ; Wed, 7 Aug 2019 06:28:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.299 X-Spam-Level: X-Spam-Status: No, score=-4.299 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id L6lgYFvEyYSo for ; Wed, 7 Aug 2019 06:28:39 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 668DA120253 for ; Wed, 7 Aug 2019 06:28:39 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 95A1FBE3E; Wed, 7 Aug 2019 14:28:37 +0100 (IST) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id N5M580OqOA-9; Wed, 7 Aug 2019 14:28:35 +0100 (IST) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 8B664BE2F; Wed, 7 Aug 2019 14:28:35 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1565184515; bh=mEDJG3t6i6q8C8wI6tNeY4gec/3G9B5yxpPtAdHpGSs=; h=To:Cc:References:From:Subject:Date:In-Reply-To:From; b=oJAH26PYdT52uRSW1v+G3f5fEh1g+182PKpE/6E5OPEzRLQwmhj0QoJMxnAzyOnL7 bVhaFfJQwn8g2E2viVa/0q1Q56p1det1EvgPvgbRXntovvJeQcakkS3CuiZKJKhpcv 2ipb+PJOZxaufEd+VaOp/bU3ZLbN8SuFAzRRLGW8= To: Ralf Weber , Rob Sayre Cc: Christian Huitema , Bret Jordan , Alec Muffett , ADD Mailing list , Tommy Jensen , Paul Wouters , Mikael Abrahamsson References: <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <0C96CA30-4704-4791-B286-A546106429AE@fl1ger.de> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: <6494400f-0606-8dda-0628-e1c752a72f7b@cs.tcd.ie> Date: Wed, 7 Aug 2019 14:28:33 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: <0C96CA30-4704-4791-B286-A546106429AE@fl1ger.de> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="s0UMFYplxw3mT2orgFeOdlNZWjjD9poBx" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Aug 2019 13:28:44 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --s0UMFYplxw3mT2orgFeOdlNZWjjD9poBx Content-Type: multipart/mixed; boundary="xD8X7aptLRYQviGDcLYqMF2Qw4z0oSzCJ"; protected-headers="v1" From: Stephen Farrell To: Ralf Weber , Rob Sayre Cc: Christian Huitema , Bret Jordan , Alec Muffett , ADD Mailing list , Tommy Jensen , Paul Wouters , Mikael Abrahamsson Message-ID: <6494400f-0606-8dda-0628-e1c752a72f7b@cs.tcd.ie> Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] References: <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <0C96CA30-4704-4791-B286-A546106429AE@fl1ger.de> In-Reply-To: <0C96CA30-4704-4791-B286-A546106429AE@fl1ger.de> --xD8X7aptLRYQviGDcLYqMF2Qw4z0oSzCJ Content-Type: multipart/mixed; boundary="------------9FD3CDC9FBF23B4E9B32AD5A" Content-Language: en-GB This is a multi-part message in MIME format. --------------9FD3CDC9FBF23B4E9B32AD5A Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hiya, On 07/08/2019 13:11, Ralf Weber wrote: > So there are currently three big providers of globally available DoH > servers (Google, Cloudflare, Quad9). All of them are big US companies. I don't think those 3 organisations are commensurately sized, nor are they all for-profit if I'm reading [1] correctly. They are all US-homed I guess though IIRC some quad9 funding was from the UK. (All 5eyes nonetheless;-(). [1] https://www.quad9.net/about/ That said, IMO their home location is not at all what matters. Centralisation is a concern that matters, if it results in a situation where turning off one of these might break a lot of things, or where one of them could go rogue but be too big to turn off. The possibility that a large actor could correlate DNS traffic with other traffic is a concern that matters. I think the TRR policy stuff Mozilla are attempting is interesting as a way to handle that. It'd be great if there were ways to audit that, but hard to think of one. (I bet researchers will figure out ways over time though:-) The possibility that a large actor might offer such a service just to ensure that competitors don't get to see the DNS traffic is interesting, but I'm not sure if it's a concern of mine. The possibility that such a service provider might favour some CDNs over others is maybe a concern for me as that may result in inefficient services. I'll not lose sleep over that though if it mostly means slower cat videos. My tentative conclusion is that it'd be good if there were maybe a dozen or so of those, rather than 3, not all of which would need a full-global presence (i.e. they could be somewhat local in the sense of their fine-grained knowledge of CDNs), as applications doing DNS could decide which to use based on the application's own location in the network. I think it'd also be good if applications doing DNS didn't always use the same service, so that failure of one wouldn't need a flag day to get fixed, though figuring out a way to switch sensibly is fairly hard. Cheers, S. PS: As an aside, I worry less about the centralisation in this case than in the web PKI - I'd really love to see another letsencrypt equivalent (no cost, not for profit) CA handling maybe 10% of what LE does, just in case stuff hits the fan for LE sometime. --------------9FD3CDC9FBF23B4E9B32AD5A Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------9FD3CDC9FBF23B4E9B32AD5A-- --xD8X7aptLRYQviGDcLYqMF2Qw4z0oSzCJ-- --s0UMFYplxw3mT2orgFeOdlNZWjjD9poBx Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAl1K0gIACgkQWrL68XsX K+qa8w//eWqVTfsNVMTfKAN+HMZkqgH1Jszep6aQKcJgW5XJ93odgWgDxfd0yppj 0wrL2iR0iGT3SA/tqYHVUiexzH6WQUFsKyzl6Tl//j7UDIfqz2LbQYbyN4wwyGSh D5s2tfQhd0uQjOvWHzDEaBiGw7F8boLaWtawADD/ftFq3UA2kYd5DngZjRXF4FZY dINkxIoLrmMTlxliFv+KleIWtZjsnGza5Fe6wbFI7cpaygYFFvfHtoFTfZfe1A2Y rPZxZJwh8NipMeCAvS0kV7z8mO3HQ7OagQd9gqfe+PqllFm49naLWcXAjDMJyy/D e45Sn7bQjBWMzbaNMyBShqiGxEI2Zd7Oly/QIno0yZpP8UBwQB0d28hiujkhK8uL IUJ8zeQEiA0fi0MACTNfj3YFXjpRs8hIeNvueJFJzBRVTEXn4OZ+yjnsNsImHqef 2aipnA5ixhe1G3Chhk/htkEYAaZWDbYNwek2HUOpANoSBhQgBJQsn61w3xXi4Pyw deISUjLl517jPI8G9qWF/J2ERerFFU7446d4RAs8hJQ6GkF+edXCWFKTJXBRgmq7 VmX06NjK3nVMxZ4bDyzqnuKZQRpDvIle+/YxibOdJVYhWs/kVa8byeS9S4CJyVT0 FU5MUEvDJkWvIbaY2Ut2hKElb9wUP4OYlSAhaDVkipFpc/smKmI= =Hc45 -----END PGP SIGNATURE----- --s0UMFYplxw3mT2orgFeOdlNZWjjD9poBx-- From nobody Wed Aug 7 06:47:35 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4238C120052 for ; Wed, 7 Aug 2019 06:47:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=hopcount.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id M0Q4Vqfw-Yo8 for ; Wed, 7 Aug 2019 06:47:32 -0700 (PDT) Received: from mail-ot1-x32e.google.com (mail-ot1-x32e.google.com [IPv6:2607:f8b0:4864:20::32e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D1F72120041 for ; Wed, 7 Aug 2019 06:47:32 -0700 (PDT) Received: by mail-ot1-x32e.google.com with SMTP id d17so104566361oth.5 for ; Wed, 07 Aug 2019 06:47:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hopcount.ca; s=google; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=QOFdKuTPHvyr3w2GAOpYupzXm+25B1gI8wz4h+5MKTE=; b=eylGWB9ntt73W0idGKubNINJBKefKh260IbDNPVmj9Jmq9FUw2D722Kv2vp4i2g34r g31mmssOA4UKo/EQeHg7OW5FgJtsafXXtN/ArKv+fYOI4AWQrChHnK1poxUvkuhiEzNq WwvBYzNs6mAQ8LC4wb6Gfi1EW8MjDOQelhcvA= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=QOFdKuTPHvyr3w2GAOpYupzXm+25B1gI8wz4h+5MKTE=; b=DRD2kYudLiGvEFD1g9H7KzbW5dOdNolRGqEvYBqk4h9RILeLfd3IyqlPOfqU7KqP60 RjSpl26V/l4IAnvlfNXXNcCwuBwx2u5HEUR4a6rPat9Rp0LxAjEJnlS71QcZe3l8eAC3 btpC8XjYofAxqgiuzQNQmSCysiXqK+Nq000pO+KJWxUOAF+A7TE3bope2PgcYCxPXtl0 jzAFi0gFT/VROek6brpGQvhobw5/LjT9qXq4084GkijVxYBUADMvUUp9aqKM07ZWmFso Zez7HUuWc8d8lFPEoyRA6bR89UEtpYXKQl8sfMBfvBn85H5jtfMo8kPs4yy79G2o8iPj rQYQ== X-Gm-Message-State: APjAAAWI+W7NTt98DXw+T+XK9p5+HJlkn7pGR3X2QOP4HIfGfwJbCBr4 hxrBTcUITkb25JiU5294lVR/Pw== X-Google-Smtp-Source: APXvYqyJiXG71r/TSIolMp6Gb6EBU9qLRBBMC+HAXNWE4c/G0qVu9uMvl3t+B6lF5Vzt1wRDRWDKcA== X-Received: by 2002:a5e:8913:: with SMTP id k19mr8812381ioj.155.1565185652036; Wed, 07 Aug 2019 06:47:32 -0700 (PDT) Received: from [192.168.1.50] (24-246-23-138.cable.teksavvy.com. [24.246.23.138]) by smtp.gmail.com with ESMTPSA id b14sm101206384iod.33.2019.08.07.06.47.29 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 07 Aug 2019 06:47:30 -0700 (PDT) From: Joe Abley Message-Id: <206EEFEA-178A-462A-B6EE-AC2389D54B43@hopcount.ca> Content-Type: multipart/signed; boundary="Apple-Mail=_9329F85E-E47A-425E-AC16-853CFDF121D3"; protocol="application/pgp-signature"; micalg=pgp-sha1 Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Wed, 7 Aug 2019 09:47:28 -0400 In-Reply-To: Cc: Tommy Jensen , Stephen Farrell , Alec Muffett , ADD Mailing list , Ralf Weber , Paul Wouters , Mikael Abrahamsson To: Bret Jordan References: <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> <64bcfc51-6f3d-ae24-4de5-d0eb89975c66@cs.tcd.ie> <539D6F9D-137C-4F68-A8DE-EA3DFAF4D827@huitema.net> <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Aug 2019 13:47:34 -0000 --Apple-Mail=_9329F85E-E47A-425E-AC16-853CFDF121D3 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii On 7 Aug 2019, at 00:48, Bret Jordan wrote: > I for one am terrified of the possibility of mass centralization of = DNS traffic. Two dozen resolver systems are responsible for some 80% of all traffic = seen at ORG servers, today. Somewhere between 15 and 20% of all end-user = systems use Google Public DNS for resolution. This already feels like = mass centralisation to me. Apologies if I've triggered any terror. Joe --Apple-Mail=_9329F85E-E47A-425E-AC16-853CFDF121D3 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iF0EARECAB0WIQSAt40QkiztAcvphdg0jwy9hlI6LAUCXUrWcAAKCRA0jwy9hlI6 LCxpAJ4iA6w7/Odc9pzB/+JihwD83/52AwCfXEik1qRmllZMjiGtb1niF7Z7VPc= =MHb7 -----END PGP SIGNATURE----- --Apple-Mail=_9329F85E-E47A-425E-AC16-853CFDF121D3-- From nobody Wed Aug 7 07:38:24 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1426912013E for ; Wed, 7 Aug 2019 07:38:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=comcast.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oHJG09mckw8L for ; Wed, 7 Aug 2019 07:38:20 -0700 (PDT) Received: from copdcmhout01.cable.comcast.com (copdcmhout01.cable.comcast.com [162.150.44.71]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D827D12016B for ; Wed, 7 Aug 2019 07:38:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; d=comcast.com; s=20190412; c=relaxed/simple; q=dns/txt; i=@comcast.com; t=1565188663; x=2429102263; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:CC:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=fb4gK0klYZxKuArBdXO6ChUGnj8RtocJUP1PefbP0YM=; b=YR/yu0Y8OqIp90ipOdLxHnlFRSJeSb+u0tc9d9sOYx8FUv30EmSoTUHPmHWHV9tZ GQpfl118i+ogiDUWNcra6v1IdMR/s6AsFQ3/ro56RETLRdrINxK8Y7YynMLMQc7x YdD6EnK9DcM2jetyslJKAgceoWbXlePQj0Ge8ke+6nilpfNP5NM7q9WCqBjyN8xv DTz+DOzqcZ75PZRRvaGsnz8ZmAYqQdlbaX26wLTOnNEOBbe6meMzxxE5LWr9+byl iwNfg8eX9X9XS7YePzgdVeoFDgHlgZATA3CpWy6/HhQ9UWxx1Wy5jQXMj9pNuMZo pEyoROer/iePZa5Ch4mEOw==; X-AuditID: a2962c47-a9fff7000002e144-cf-5d4ae237ab05 Received: from copdcexc39.cable.comcast.com (copdcmhoutvip.cable.comcast.com [96.114.156.147]) (using TLS with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (Client did not present a certificate) by copdcmhout01.cable.comcast.com (SMTP Gateway) with SMTP id AF.FD.57668.732EA4D5; Wed, 7 Aug 2019 08:37:43 -0600 (MDT) Received: from COPDCEXC37.cable.comcast.com (147.191.125.136) by copdcexc39.cable.comcast.com (147.191.125.138) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1713.5; Wed, 7 Aug 2019 10:37:58 -0400 Received: from COPDCEXC37.cable.comcast.com ([fe80::3aea:a7ff:fe36:8a94]) by COPDCEXC37.cable.comcast.com ([fe80::3aea:a7ff:fe36:8a94%15]) with mapi id 15.01.1713.008; Wed, 7 Aug 2019 10:37:58 -0400 From: "Livingood, Jason" To: Rob Sayre CC: ADD Mailing list Thread-Topic: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] Thread-Index: AQHVRBOC3ti8Rb/3OkuCKX8Zf7Korabe21IAgAAO7QCAACA1AIABBgcAgAAx2YCAAccgAIAABO0AgALs5ICAAEqVgIAAFY4AgAnTULqAAGBwgIAADjoAgAAFVgCAADCKAA== Date: Wed, 7 Aug 2019 14:37:58 +0000 Message-ID: <2EF61DAB-8371-4257-82A0-8622A8F2B178@cable.comcast.com> References: <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.1b.0.190715 x-originating-ip: [96.115.73.252] Content-Type: multipart/alternative; boundary="_000_2EF61DAB8371425782A08622A8F2B178cablecomcastcom_" MIME-Version: 1.0 X-CFilter-Loop: Forward X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFtrGKsWRmVeSWpSXmKPExsWSUDRnsq75I69Yg+mbLCz+n17HZtE5awKT A5PHzll32T2WLPnJFMAU1cBoU5JRlJpY4pKalppXnGrHpYABbJJS0/KLUl0Ti3Iqg1JzUhOx KwOpTEnNySxLLdLHaow+VnMSrjBl7Dp7lqXgnFrFpZUzWBoYd6p2MXJySAiYSLTNuMvaxcjF ISRwhEnizINtLBBOM5PE0rl32CCcU4wSD/88YwVpYRMwk7i78AoziC0ioCDx9dp9sDizgLJE y5O7YHFhgTSJ15O6mSBq0iU+zj7GCGFPYpTY8DkWxGYRUJG40LoMLM4r4CLx9OxMqGV/OSTu fd0LNohTIFDi64/D7CA2o4CYxPdTa5gglolL3HoynwniBwGJJXvOM0PYohIvH/8DO0hUQF/i y7lNLBBxRYl/s9ezQPSmS+zc/YkZYrGgxMmZT6BqxCUOH9nBOoFRfBaSFbOQtMxC0jKLkQMo rimxfpc+RImixJTuh+wQtoZE65y5ULaVROO0G+zIahYwcqxi5DU0M9IzNDXQMzHRMzfcxAhM TYum6bjvYPxwPvYQowAHoxIPr/x5r1gh1sSy4srcQ4wSHMxKIrz3yjxjhXhTEiurUovy44tK c1KLDzFKc7AoifMenqwRKySQnliSmp2aWpBaBJNl4uCUamBkb10if2Z9r/bPw2mLC+d3bH/9 Ztc2ra1xuvIR2kuDeP5fvrL62VLDD6ty9cvT5qnkHA38MdFj49YZrZ2aS2VkrsvMVLltkTDl duHCr0t3vZEQ6rjYdX2+c9jHPTcuzn4p16bx6WruBOPcKZM8j7AvbBTLX/1Z+pz4rImHZqQ9 N5O7Kro0xLWuWImlOCPRUIu5qDgRAMdFDT9JAwAA Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Aug 2019 14:38:22 -0000 --_000_2EF61DAB8371425782A08622A8F2B178cablecomcastcom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 RnJvbTogQWRkIDxhZGQtYm91bmNlc0BpZXRmLm9yZz4gb24gYmVoYWxmIG9mIFJvYiBTYXlyZSA8 c2F5cmVyQGdtYWlsLmNvbT4NCg0KPiBJIGRvbid0IHRoaW5rIHRoYXQncyB0aGUgY2FzZS4gQXMg TW96aWxsYSdzIHByZXNlbnRhdGlvbiBzdGF0ZWQ6IEROUyBpcyBub3QgYW4gZWZmZWN0aXZlIGNv bnRyb2wgc3VyZmFjZS4NCg0KWW91IGNhbiBzYXkgdGhhdCwgYXMgY2FuIE1vemlsbGEsIGJ1dCB0 aGUgbWFya2V0ICYgZGVwbG95bWVudCBkYXRhIHN1Z2dlc3RzIHRoZSBjb21wbGV0ZSBvcHBvc2l0 ZS4gSSBrbm93IHlvdSBoYXZlIGEgc3Ryb25nbHkgaGVsZCBjb250cmFyeSB2aWV3IGJ1dCBJIHRo aW5rIHlvdSBhcmUgaW4gdGhlIHJvdWdoIG9uIHRoaXMgb25lIGFuZCBob3BlIHdlIGNhbiBtb3Zl IG9uLg0KDQpKYXNvbg0KDQo= --_000_2EF61DAB8371425782A08622A8F2B178cablecomcastcom_ Content-Type: text/html; charset="utf-8" Content-ID: <78CF5DFED934F94F9604EA6F5A940589@comcast.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2 IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToy IDE1IDUgMiAyIDIgNCAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OiJUaW1lcyBO ZXcgUm9tYW4gXChCb2R5IENTXCkiOw0KCXBhbm9zZS0xOjIgMTEgNiA0IDIgMiAyIDIgMiA0O30N Ci8qIFN0eWxlIERlZmluaXRpb25zICovDQpwLk1zb05vcm1hbCwgbGkuTXNvTm9ybWFsLCBkaXYu TXNvTm9ybWFsDQoJe21hcmdpbjowaW47DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQt c2l6ZToxMS4wcHQ7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0KYTpsaW5r LCBzcGFuLk1zb0h5cGVybGluaw0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6Ymx1 ZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCmE6dmlzaXRlZCwgc3Bhbi5Nc29IeXBl cmxpbmtGb2xsb3dlZA0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6cHVycGxlOw0K CXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KcC5Nc29MaXN0UGFyYWdyYXBoLCBsaS5Nc29M aXN0UGFyYWdyYXBoLCBkaXYuTXNvTGlzdFBhcmFncmFwaA0KCXttc28tc3R5bGUtcHJpb3JpdHk6 MzQ7DQoJbWFyZ2luLXRvcDowaW47DQoJbWFyZ2luLXJpZ2h0OjBpbjsNCgltYXJnaW4tYm90dG9t OjBpbjsNCgltYXJnaW4tbGVmdDouNWluOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250 LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCnAubXNv bm9ybWFsMCwgbGkubXNvbm9ybWFsMCwgZGl2Lm1zb25vcm1hbDANCgl7bXNvLXN0eWxlLW5hbWU6 bXNvbm9ybWFsOw0KCW1zby1tYXJnaW4tdG9wLWFsdDphdXRvOw0KCW1hcmdpbi1yaWdodDowaW47 DQoJbXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87DQoJbWFyZ2luLWxlZnQ6MGluOw0KCWZvbnQt c2l6ZToxMS4wcHQ7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0Kc3Bhbi5F bWFpbFN0eWxlMTkNCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWwtcmVwbHk7DQoJZm9udC1mYW1p bHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6d2luZG93dGV4dDt9DQouTXNvQ2hwRGVm YXVsdA0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250LXNpemU6MTAuMHB0O30N CkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjguNWluIDExLjBpbjsNCgltYXJnaW46MS4waW4g MS4waW4gMS4waW4gMS4waW47fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9u MTt9DQotLT48L3N0eWxlPg0KPC9oZWFkPg0KPGJvZHkgbGFuZz0iRU4tVVMiIGxpbms9ImJsdWUi IHZsaW5rPSJwdXJwbGUiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2NvbG9yOmJsYWNrIj5G cm9tOiA8L3NwYW4+PC9iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2NvbG9yOmJsYWNr Ij5BZGQgJmx0O2FkZC1ib3VuY2VzQGlldGYub3JnJmd0OyBvbiBiZWhhbGYgb2YgUm9iIFNheXJl ICZsdDtzYXlyZXJAZ21haWwuY29tJmd0Ozxicj4NCjxicj4NCjwvc3Bhbj48bzpwPjwvbzpwPjwv cD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mZ3Q7IEkgZG9uJ3QgdGhpbmsgdGhhdCdz IHRoZSBjYXNlLiBBcyBNb3ppbGxhJ3MgcHJlc2VudGF0aW9uIHN0YXRlZDogRE5TIGlzIG5vdCBh biBlZmZlY3RpdmUgY29udHJvbCBzdXJmYWNlLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxNC4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTQuMHB0Ij5Zb3UgY2FuIHNheSB0aGF0LCBhcyBjYW4gTW96aWxsYSwgYnV0IHRoZSBtYXJrZXQg JmFtcDsgZGVwbG95bWVudCBkYXRhIHN1Z2dlc3RzIHRoZSBjb21wbGV0ZSBvcHBvc2l0ZS4gSSBr bm93IHlvdSBoYXZlIGEgc3Ryb25nbHkgaGVsZCBjb250cmFyeSB2aWV3IGJ1dCBJIHRoaW5rIHlv dSBhcmUgaW4gdGhlIHJvdWdoIG9uIHRoaXMgb25lIGFuZCBob3BlIHdlIGNhbg0KIG1vdmUgb24u IDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTQuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjE0LjBwdCI+SmFzb248bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpw PiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_2EF61DAB8371425782A08622A8F2B178cablecomcastcom_-- From nobody Wed Aug 7 07:44:18 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 96264120287 for ; Wed, 7 Aug 2019 07:44:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=comcast.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KbsblkB5v1Vz for ; Wed, 7 Aug 2019 07:44:15 -0700 (PDT) Received: from copdcmhout02.cable.comcast.com (copdcmhout02.cable.comcast.com [96.114.158.212]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DE68612027D for ; Wed, 7 Aug 2019 07:44:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; d=comcast.com; s=20190412; c=relaxed/simple; q=dns/txt; i=@comcast.com; t=1565189055; x=2429102655; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:CC:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=fPwBPFhewgp7MBUYscI0q432SRnRg3NSX7JB8Ak37vk=; b=4Jd1HZA6OacCWEvUPZ8M9vJSXoeIgok2Ift833Jou7B1ToYg1KOIGfoHiOg40twh XKgA9ZJS+G7qcmvwCPzQ4MFwFYr1OHmEPzo7MUFrAD2ADcWgjQ0/fRm2XFecebn0 xGmV9IDoJGL3KtlHNu1Dd0ZddDJxVGKppXvSSKD61+PJ7AiIIcBEdwrLIOsf9607 ApVtyhDuJb1qqTZkxSSTysqfo+EBZwPcTZ45/VUJCmJzOL4qCssGpt2dhfCZHtkw +xoPAuuHutPULQZDTYICpP9pxMYsG2/4LdwSX+ins0eBYCafkuvFFrHEGUJJ3TNx StFZZWyqeJZvPOPyZZu9mQ==; X-AuditID: 60729ed4-20fff700000013e0-d9-5d4ae3bf0654 Received: from COPDCEXC37.cable.comcast.com (copdcmhoutvip.cable.comcast.com [96.114.156.147]) (using TLS with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (Client did not present a certificate) by copdcmhout02.cable.comcast.com (SMTP Gateway) with SMTP id 54.89.05088.FB3EA4D5; Wed, 7 Aug 2019 08:44:15 -0600 (MDT) Received: from COPDCEXC37.cable.comcast.com (147.191.125.136) by COPDCEXC37.cable.comcast.com (147.191.125.136) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1713.5; Wed, 7 Aug 2019 10:44:14 -0400 Received: from COPDCEXC37.cable.comcast.com ([fe80::3aea:a7ff:fe36:8a94]) by COPDCEXC37.cable.comcast.com ([fe80::3aea:a7ff:fe36:8a94%15]) with mapi id 15.01.1713.008; Wed, 7 Aug 2019 10:44:14 -0400 From: "Livingood, Jason" To: Rob Sayre CC: ADD Mailing list Thread-Topic: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] Thread-Index: AQHVRBOC3ti8Rb/3OkuCKX8Zf7Korabe21IAgAAO7QCAACA1AIABBgcAgAAx2YCAAccgAIAABO0AgALs5ICAAEqVgIAAFY4AgAnTULqAAGBwgIAABSUAgAACpICAAD4QgA== Date: Wed, 7 Aug 2019 14:44:14 +0000 Message-ID: <7C8A89C4-FBE9-40B7-8A17-98A247F1F156@cable.comcast.com> References: <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.1b.0.190715 x-originating-ip: [96.115.73.253] Content-Type: multipart/alternative; boundary="_000_7C8A89C4FBE940B78A1798A247F1F156cablecomcastcom_" MIME-Version: 1.0 X-CFilter-Loop: Forward X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFtrGKsWRmVeSWpSXmKPExsWSUDRnsu7+x16xBjsPiVn8P72OzaJz1gQm ByaPnbPusnssWfKTKYApqoHRpiSjKDWxxCU1LTWvONWOSwED2CSlpuUXpbomFuVUBqXmpCZi VwZSmZKak1mWWqSP1Rh9rOYkXGHKWNB0l6nghnZFU2M/cwPjRq0uRk4OCQETibuLWpm7GLk4 hASOMEm0z98F5TQzSay7cZEdwjnFKPGh7TMbSAubgJnE3YVXmEFsEQEFia/X7rOC2MwCyhIt T+6CxYUF0iReT+pmgqhJl/g4+xgjhD2JUWLqIwkQm0VAReLLmonsIDavgItE68abLBDLdnJI XP9yGaiBg4NTIFBi+wEdkBpGATGJ76fWMEHsEpe49WQ+E8QLAhJL9pxnhrBFJV4+/gd2j6iA vsSXc5tYIOKKEvs+rGCG6E2XeHdyKyPEXkGJkzOfQNWISxw+soN1AqP4LCQrZiFpmYWkZRbQ dcwCmhLrd+lDlChKTOl+yA5ha0i0zpkLZVtJXJq0gxFZzQJGjlWMfJZmeoaGJnqGphZ6RoZG mxjBqWnelR2Ml6d7HGIU4GBU4uFVPecVK8SaWFZcmXuIUYKDWUmE916ZZ6wQb0piZVVqUX58 UWlOavEhRmkOFiVx3ry9OrFCAumJJanZqakFqUUwWSYOTqkGxi2LauW7r7w7UuQc+vXYfhah kjiH7PrH3CLXDzr/ztd/WF4y52Dv5K2az0Qc3KztNpjwdtaICaZEfOR6fHPazY0vg5T38jE4 TPcozvj65YO/slSDUqr9e4fP7gukbyjkru0yVJdYy23xYW7Hq/Y4lb9rfZ4tWyO/5oDwkjoj po3HuT37Pi++r8RSnJFoqMVcVJwIACsYvR5JAwAA Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Aug 2019 14:44:17 -0000 --_000_7C8A89C4FBE940B78A1798A247F1F156cablecomcastcom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 RnJvbTogQWRkIDxhZGQtYm91bmNlc0BpZXRmLm9yZz4gb24gYmVoYWxmIG9mIFJvYiBTYXlyZSA8 c2F5cmVyQGdtYWlsLmNvbT4NCj4gQnV0LCB0aGUgSUVURiBkZWZpbmVzIHByb3RvY29scy4gSXQg ZG9lc24ndCBzdGFuZGFyZGl6ZSB3aGljaCBlbmRwb2ludHMgbXVzdCBiZSBjb25zdWx0ZWQuDQoN CkluIGFjdHVhbGl0eSwgdGhlIElFVEYgbmV2ZXIgcmVhbGx5IGlnbm9yZXMgaG93IHByb3RvY29s cyBhcmUgaW1wbGVtZW50ZWQuIFRoZXJlIGlzIGFuIE9wcyBhcmVhIGFuZCB3ZSBoYXZlIGdyb3Vw cyBsaWtlIHY2b3BzIGFuZCBkbnNvcCB0aGF0IGZvY3VzIG9uIGltcGxlbWVudGF0aW9uIG9mIHBy b3RvY29scy4gSW1wb3J0YW50bHksIGR1cmluZyBlYXJseSBzY2FsZSBkZXBsb3ltZW50cyAoZS5n LiBJUHY2KSB0aGUgb3BzL2ltcGxlbWVudGF0aW9uIFdHcyBwcm92aWRlIHByb3RvY29sIGZlZWRi YWNrIHRvIHRoZSBwcm90b2NvbC1kZXNpZ24gV0dzLCB3aGljaCBpcyBhIGdyZWF0ICYgdmlydHVv dXMgZmVlZGJhY2sgbG9vcC4gQWZ0ZXIgYWxsIHRoZSBJRVRGIGlzIGFib3V0IHJvdWdoIGNvbnNl bnN1cyAqYW5kKiBydW5uaW5nIGNvZGUuIEFzIHdpdGggbXkgbGFzdCBlbWFpbCwgSSBob3BlIHdl IGNhbiBub3RlIHlvdXIgZGlzYWdyZWVtZW50IGFuZCBtb3ZlIG9uIOKAkyB0aGVyZSBpcyBlbm91 Z2ggb2YgYSBjcml0aWNhbCBtYXNzIG9mIGZvbGtzIHdpdGggcm91Z2ggY29uc2Vuc3VzIG9uIHRo aXMgc3ViamVjdCBhbmQgaW50ZXJlc3QgaW4gZG9pbmcgcHJvZHVjdGl2ZSB3b3JrLiA6LSkNCg0K SmFzb24NCg0K --_000_7C8A89C4FBE940B78A1798A247F1F156cablecomcastcom_ Content-Type: text/html; charset="utf-8" Content-ID: <0A59FD3CDB938345AA2F45E358B5E010@comcast.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2 IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToy IDE1IDUgMiAyIDIgNCAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OiJUaW1lcyBO ZXcgUm9tYW4gXChCb2R5IENTXCkiOw0KCXBhbm9zZS0xOjIgMTEgNiA0IDIgMiAyIDIgMiA0O30N Ci8qIFN0eWxlIERlZmluaXRpb25zICovDQpwLk1zb05vcm1hbCwgbGkuTXNvTm9ybWFsLCBkaXYu TXNvTm9ybWFsDQoJe21hcmdpbjowaW47DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQt c2l6ZToxMS4wcHQ7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0KYTpsaW5r LCBzcGFuLk1zb0h5cGVybGluaw0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6Ymx1 ZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCmE6dmlzaXRlZCwgc3Bhbi5Nc29IeXBl cmxpbmtGb2xsb3dlZA0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6cHVycGxlOw0K CXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KcC5tc29ub3JtYWwwLCBsaS5tc29ub3JtYWww LCBkaXYubXNvbm9ybWFsMA0KCXttc28tc3R5bGUtbmFtZTptc29ub3JtYWw7DQoJbXNvLW1hcmdp bi10b3AtYWx0OmF1dG87DQoJbWFyZ2luLXJpZ2h0OjBpbjsNCgltc28tbWFyZ2luLWJvdHRvbS1h bHQ6YXV0bzsNCgltYXJnaW4tbGVmdDowaW47DQoJZm9udC1zaXplOjExLjBwdDsNCglmb250LWZh bWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQpzcGFuLkVtYWlsU3R5bGUxOA0KCXttc28tc3R5 bGUtdHlwZTpwZXJzb25hbC1yZXBseTsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJp ZjsNCgljb2xvcjp3aW5kb3d0ZXh0O30NCi5Nc29DaHBEZWZhdWx0DQoJe21zby1zdHlsZS10eXBl OmV4cG9ydC1vbmx5Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJ e3NpemU6OC41aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBpbiAxLjBpbiAxLjBpbiAxLjBpbjt9DQpk aXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi0tPjwvc3R5bGU+DQo8L2hl YWQ+DQo8Ym9keSBsYW5nPSJFTi1VUyIgbGluaz0iYmx1ZSIgdmxpbms9InB1cnBsZSI+DQo8ZGl2 IGNsYXNzPSJXb3JkU2VjdGlvbjEiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Y29sb3I6YmxhY2siPkZyb206IDwvc3Bhbj48L2I+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Y29sb3I6YmxhY2siPkFkZCAmbHQ7YWRkLWJvdW5jZXNA aWV0Zi5vcmcmZ3Q7IG9uIGJlaGFsZiBvZiBSb2IgU2F5cmUgJmx0O3NheXJlckBnbWFpbC5jb20m Z3Q7PGJyPg0KPC9zcGFuPiZndDsgQnV0LCB0aGUgSUVURiBkZWZpbmVzIHByb3RvY29scy4gSXQg ZG9lc24ndCBzdGFuZGFyZGl6ZSB3aGljaCBlbmRwb2ludHMgbXVzdCBiZSBjb25zdWx0ZWQuPG86 cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjE0LjBwdCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxNC4wcHQiPkluIGFjdHVhbGl0eSwgdGhlIElFVEYg bmV2ZXIgcmVhbGx5IGlnbm9yZXMgaG93IHByb3RvY29scyBhcmUgaW1wbGVtZW50ZWQuIFRoZXJl IGlzIGFuIE9wcyBhcmVhIGFuZCB3ZSBoYXZlIGdyb3VwcyBsaWtlIHY2b3BzIGFuZCBkbnNvcCB0 aGF0IGZvY3VzIG9uIGltcGxlbWVudGF0aW9uIG9mIHByb3RvY29scy4gSW1wb3J0YW50bHksIGR1 cmluZyBlYXJseQ0KIHNjYWxlIGRlcGxveW1lbnRzIChlLmcuIElQdjYpIHRoZSBvcHMvaW1wbGVt ZW50YXRpb24gV0dzIHByb3ZpZGUgcHJvdG9jb2wgZmVlZGJhY2sgdG8gdGhlIHByb3RvY29sLWRl c2lnbiBXR3MsIHdoaWNoIGlzIGEgZ3JlYXQgJmFtcDsgdmlydHVvdXMgZmVlZGJhY2sgbG9vcC4g QWZ0ZXIgYWxsIHRoZSBJRVRGIGlzIGFib3V0IHJvdWdoIGNvbnNlbnN1cyAqYW5kKiBydW5uaW5n IGNvZGUuIEFzIHdpdGggbXkgbGFzdCBlbWFpbCwgSSBob3BlIHdlIGNhbiBub3RlDQogeW91ciBk aXNhZ3JlZW1lbnQgYW5kIG1vdmUgb24g4oCTIHRoZXJlIGlzIGVub3VnaCBvZiBhIGNyaXRpY2Fs IG1hc3Mgb2YgZm9sa3Mgd2l0aCByb3VnaCBjb25zZW5zdXMgb24gdGhpcyBzdWJqZWN0IGFuZCBp bnRlcmVzdCBpbiBkb2luZyBwcm9kdWN0aXZlIHdvcmsuIDotKTxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTQuMHB0Ij48 bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjE0LjBwdCI+SmFzb248bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjwv ZGl2Pg0KPC9ib2R5Pg0KPC9odG1sPg0K --_000_7C8A89C4FBE940B78A1798A247F1F156cablecomcastcom_-- From nobody Wed Aug 7 07:56:47 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 88AF21202EB for ; Wed, 7 Aug 2019 07:56:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7GY9eX34iFPP for ; Wed, 7 Aug 2019 07:56:44 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 594491202E5 for ; Wed, 7 Aug 2019 07:56:39 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id D96D2BE24; Wed, 7 Aug 2019 15:56:37 +0100 (IST) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id f9Mh4Ri6oWmy; Wed, 7 Aug 2019 15:56:36 +0100 (IST) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 520B7BE47; Wed, 7 Aug 2019 15:56:36 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1565189796; bh=RdaPc8cxtMW9hIMbiV3vGFjL61PVqSbSN+UiKTVBLDM=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From; b=ups88xeKQf3pyRIvSazez2ymtug0j0iJFVth1sL13T9EWeqo/ZSckwYY3lSU1uKjh rZ6yJ7KAVKF01aiOngGYDFek6mC6mV9yjV4wQX82o1nV7IZ6qNz1UGXrU7ZEw54nVL B/MFDbuidg0N4jNWkrWo5DVLA1VGU/qvvzqph2zg= To: "Livingood, Jason" , Rob Sayre Cc: ADD Mailing list References: <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <7C8A89C4-FBE9-40B7-8A17-98A247F1F156@cable.comcast.com> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: Date: Wed, 7 Aug 2019 15:56:33 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: <7C8A89C4-FBE9-40B7-8A17-98A247F1F156@cable.comcast.com> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="b1Z1s6GIPczFFTDFNNnClIaXTa1YyJ4Qv" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Aug 2019 14:56:47 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --b1Z1s6GIPczFFTDFNNnClIaXTa1YyJ4Qv Content-Type: multipart/mixed; boundary="6qcKVLoSrpZX9HUjYaYuq80v9mF7rbqEN"; protected-headers="v1" From: Stephen Farrell To: "Livingood, Jason" , Rob Sayre Cc: ADD Mailing list Message-ID: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] References: <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <7C8A89C4-FBE9-40B7-8A17-98A247F1F156@cable.comcast.com> In-Reply-To: <7C8A89C4-FBE9-40B7-8A17-98A247F1F156@cable.comcast.com> --6qcKVLoSrpZX9HUjYaYuq80v9mF7rbqEN Content-Type: multipart/mixed; boundary="------------73BEF80A4C581E1F80B17602" Content-Language: en-GB This is a multi-part message in MIME format. --------------73BEF80A4C581E1F80B17602 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hiya, On 07/08/2019 15:44, Livingood, Jason wrote: > there is enough of a critical mass of folks with rough consensus on thi= s subject=20 I don't believe we have a consensus-caller to hand for this so don't see how you can be confident in that. As it happens, and fwiw, I'm pretty sure I see a fair bit of a lack of consensus as well. (Though like us all on this list, I'm just another subscriber, this not being a WG list or anything.) Cheers, S. --------------73BEF80A4C581E1F80B17602 Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------73BEF80A4C581E1F80B17602-- --6qcKVLoSrpZX9HUjYaYuq80v9mF7rbqEN-- --b1Z1s6GIPczFFTDFNNnClIaXTa1YyJ4Qv Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAl1K5qIACgkQWrL68XsX K+qjaBAAsbfuB2+w4IOvzVXQxFR/EXgGu+8RH7FADBPtp7vGCkUHiQd1kvLR492n EZcXGjdztmNviti3PSJ682l8j1Mrx4LXrMjaDBdMJMoZ0hAbgKjLGqhWzev/oz6W GLU4FfigpEpQZSL+gLcQyy4xOhZVYI3VftAKOx5HvdbkXbn2StTwpACUf0Y2lPND aTUkHAx1mOVvjDO0cts3NxcDzKqB2jEMQz0Jeoc+hdwPIS7D7xf7sQOSf+kYE8RP kqkFNICoILCiouVzWf3k6SGp6wjk1rAWzLlC9sKCGL/PUjQ6w5k6O7gizJwGnRIt nrbCDOjUglc8tvIVOY/QCvdZXNoJMK1FnMkl3PTr61jVHme70EUwTX7ECIKQ8F92 gtmAVhGvQWT0r8HK2ab//UUK/UjRNGrrvJIC9JdJCvljDg2orOJovHyYCUmUcxDq hdQ1K1Jw89ftk29QfmVCrGZ4Z2w5kPJtKxWr7fGLuGHmTSQqBw2xdr2KHgzbQ1qq pyl794MLNO0Qqyg3R2C4oSZ7qOb7AB1tts2reInJlk3tFMtORRCGF2/eF/408OLc 6mZhsvDsCBdfqc1KCizMcJIcAhBEDJ4P17RCTaV6h9sx7lRNZXb6cBw4QMv1qga2 BJfrvnv+Ynh0/JiKswtfKjBTVF1isbAP1r9p9yeY5EZCdNCPa3g= =sj4P -----END PGP SIGNATURE----- --b1Z1s6GIPczFFTDFNNnClIaXTa1YyJ4Qv-- From nobody Wed Aug 7 08:23:08 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3387A12036A for ; Wed, 7 Aug 2019 08:23:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id N4Y6bplzdo8w for ; Wed, 7 Aug 2019 08:23:05 -0700 (PDT) Received: from mx0a-00176a04.pphosted.com (mx0b-00176a04.pphosted.com [67.231.157.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4BDDD120366 for ; Wed, 7 Aug 2019 08:23:05 -0700 (PDT) Received: from pps.filterd (m0049465.ppops.net [127.0.0.1]) by mx0b-00176a04.pphosted.com (8.16.0.27/8.16.0.27) with SMTP id x77FMlCM028465 for ; Wed, 7 Aug 2019 11:23:04 -0400 Received: from usushmgip002.mail.tfayd.com ([216.178.109.236]) by mx0b-00176a04.pphosted.com with ESMTP id 2u7yk61v1g-1 (version=TLSv1.2 cipher=RC4-SHA bits=128 verify=NOT) for ; Wed, 07 Aug 2019 11:23:04 -0400 Received: from unknown (HELO potemwp00048.mail.tfayd.com) ([10.40.33.204]) by usushmgip002.mail.tfayd.com with ESMTP; 07 Aug 2019 08:23:02 -0700 Received: from potemwp00029.mail.tfayd.com (100.124.56.53) by potemwp00024.mail.tfayd.com (100.124.56.48) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.669.32; Wed, 7 Aug 2019 09:23:00 -0600 Received: from potemwp00029.mail.tfayd.com (100.124.56.53) by potemwp00029.mail.tfayd.com (100.124.56.53) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.669.32; Wed, 7 Aug 2019 09:22:59 -0600 Received: from potemwp00029.mail.tfayd.com ([100.124.56.53]) by potemwp00029.mail.tfayd.com ([100.124.56.53]) with mapi id 15.01.0669.032; Wed, 7 Aug 2019 09:22:59 -0600 From: "Deen, Glenn (NBCUniversal)" To: Joe Abley CC: Bret Jordan , Mikael Abrahamsson , Alec Muffett , ADD Mailing list , Tommy Jensen , Ralf Weber , Paul Wouters , Stephen Farrell Thread-Topic: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] Thread-Index: AQHVRJA9OEBhy8mKSkG1+AboakEuZqbepjg4gACEyQCAAQYIAIAAMdmAgAHHHwCAAATuAIAC7OSAgABKlICAABWOAIAAGNwAgACJAJqAAHmCAIAACQWAgAALpICAAD92gIAIpseAgACWiQD//7YbGA== Date: Wed, 7 Aug 2019 15:22:59 +0000 Message-ID: References: <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> <64bcfc51-6f3d-ae24-4de5-d0eb89975c66@cs.tcd.ie> <539D6F9D-137C-4F68-A8DE-EA3DFAF4D827@huitema.net> <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> , <206EEFEA-178A-462A-B6EE-AC2389D54B43@hopcount.ca> In-Reply-To: <206EEFEA-178A-462A-B6EE-AC2389D54B43@hopcount.ca> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-exclaimer-md-config: 47edc00f-f2d6-45ef-be83-8a353bd47e45 Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-CFilter-Loop: Forward X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-08-07_03:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=950 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1906280000 definitions=main-1908070161 Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Aug 2019 15:23:07 -0000 On Aug 7, 2019, at 6:48 AM, Joe Abley wrote: >> On 7 Aug 2019, at 00:48, Bret Jordan wrote: >>=20 >> I for one am terrified of the possibility of mass centralization of DNS = traffic. >=20 > Two dozen resolver systems are responsible for some 80% of all traffic se= en at ORG servers, today. Somewhere between 15 and 20% of all end-user syst= ems use Google Public DNS for resolution. This already feels like mass cent= ralisation to me. >=20 > Apologies if I've triggered any terror. Joe While the top 80% being from 2 dozen resolvers there are others statistics = that would be interesting and perhaps a good measurement of current DNS Res= olver diversity.=20 We know there are a great many small resolvers in the world ranging from th= ose run by large and small corporate and organization IT, medium and small = ISPs, all the way down those run by individuals. =20 Individually they don=92t generate a lot of traffic, but they that=92s ok a= s DNS was never designed to be centralized. Broad diversity has long been a= fundamental strength of the system. =20 The actual exact number of these long tail resolvers isn=92t yet known but = some estimates have put it in the 1 million to maybe 5-10 million range. I= t could even be higher. This large number of first level resolvers repres= ents an element of great diversity which strengthens the DNS for users.=20 So if you=92re looking at data is it possible to say how big the tail is? = After the first 80%, how many different resolvers show up in the next 5%, 1= 0%, 15%, 20% buckets? What=92s the total number of diverse resolvers? For while measuring big users is a good measure of centralization, measurin= g small is perhaps a good measure of today=92s infrastructural diversity an= d resiliency.=20 -glenn = From nobody Wed Aug 7 08:42:25 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 41A34120412 for ; Wed, 7 Aug 2019 08:42:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id etQ0JxVpMIfV for ; Wed, 7 Aug 2019 08:42:23 -0700 (PDT) Received: from mail-pl1-x62f.google.com (mail-pl1-x62f.google.com [IPv6:2607:f8b0:4864:20::62f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 645DF12040E for ; Wed, 7 Aug 2019 08:42:21 -0700 (PDT) Received: by mail-pl1-x62f.google.com with SMTP id ay6so41442347plb.9 for ; Wed, 07 Aug 2019 08:42:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=ydp9vr0Q+hVhBXj8bLK12rzp99Eg3gWYCOO+c5EQ4hI=; b=UT1Y4hCt+8r4L0n9NhjtBxhBSMGCipy46UUjybunq7Vqr3hekzmampkx8a4o3mdqnl FhfuB+K/No7AWtoUMJMXG5QcMTdhUCFdlh1cMxp2MR6gBogr0uQM9U7n/DcVPZC19AGt uNP44fee32LNVoVjHd5Qlf4YfQHE23sFYpDAbN3/MmCfEw29pfgtFuup5zL2q4uontu3 JtxO6Dy4PTM501iRr5sWchB9tMTVFhkhbmgCjivbYaX5ubt0kVtrAiXieNn5fGH/twQ+ wGm1BRj4RsK1nX6rWq54LxvdnlSoEDwggKmSoVQaGC+EgzlS1cCr87VO7RBjeit67IEc fKjg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=ydp9vr0Q+hVhBXj8bLK12rzp99Eg3gWYCOO+c5EQ4hI=; b=ZhyowvU/l7OQbvpWmtiHcUviNLqrvunRyuStmMKqDgH1H3gex6oNWQIVrrx0x8OsAX uLIiSVGVWEq4vmRbNb+w/49U957LdfNh8FjwdCQKD+QD6HXZnpeGLZ5+QE7GZEyoebOi GVNqldYz9za2xrjg2g3iHlQmhDPNQj1ZjN6yc0R43wTw7aohf3b5PvR1SFpRMBXyTkTO dWhMyHe77V9c3biTKLi9YKQYrFliWF0EV3fgCEwijeuk6w7rdDIW8NTxwpPN0C88TYXf KHdtiIk700ZwOG0b5MO5Uw+u1glctnTwvHzoAnHLlF0Y47bNplVy1XZdLOXyIbFZS8Mw kOOg== X-Gm-Message-State: APjAAAXTHBpDTfIAJR9FWSYc0AbVZpjxhR+9cVKrpFxjzeLoh65rYdUE N+04VwjPcSmtYd99vupFJzA= X-Google-Smtp-Source: APXvYqw9t3V1wEort9ppMHfFmXnWYW5sViVzY+3LVsidEVfwD4cdSIl42QlxeaxArahJBxJgg+V4rg== X-Received: by 2002:a63:e84a:: with SMTP id a10mr8609440pgk.274.1565192539869; Wed, 07 Aug 2019 08:42:19 -0700 (PDT) Received: from [10.128.64.149] ([136.60.227.81]) by smtp.gmail.com with ESMTPSA id n89sm2236925pjc.0.2019.08.07.08.42.18 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 07 Aug 2019 08:42:19 -0700 (PDT) From: Bret Jordan Message-Id: <841102D9-4B50-4415-8193-FF3766F91958@gmail.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_4366407F-EE37-4F1A-8D72-34551D258C29" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Wed, 7 Aug 2019 09:42:16 -0600 In-Reply-To: Cc: Tommy Jensen , Stephen Farrell , Alec Muffett , ADD Mailing list , Ralf Weber , Paul Wouters , Mikael Abrahamsson To: Rob Sayre References: <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> <64bcfc51-6f3d-ae24-4de5-d0eb89975c66@cs.tcd.ie> <539D6F9D-137C-4F68-A8DE-EA3DFAF4D827@huitema.net> <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Aug 2019 15:42:24 -0000 --Apple-Mail=_4366407F-EE37-4F1A-8D72-34551D258C29 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Thanks, Bret PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 "Without cryptography vihv vivc ce xhrnrw, however, the only thing that = can not be unscrambled is an egg." > =20 > Especially given this is will be over http now and an app or client = could include a plethora of other http headers that could give = guaranteed per user tracking. >=20 > I am not sure this is a valid point. Most HTTP header fingerprinting = uses features that needn't be included in a DoH query. >=20 An app or client could add additional http headers. It could add a = unique ID for each app or client, it could add in geo-location data, it = could all kinds of things. =20 > Further, once all DNS is in one place, that makes a great target. >=20 > It's certainly a new target, but DNS is in the clear for the most = part. It seems strange to imply this is a new weakness. Having DNS data be in the clear, and having it all be centralized are = TWO totally different things. One could easily argue that having all = client talk to an internal DNS servers and having that DNS server talk = to the world provides per user confidentiality. Bret --Apple-Mail=_4366407F-EE37-4F1A-8D72-34551D258C29 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii
Thanks,
Bret
PGP = Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 = 0050
"Without = cryptography vihv vivc ce xhrnrw, however, the only thing that can not = be unscrambled is an = egg."

 
Especially= given this is will be over http now and an app or client could include = a plethora of other http headers that could give guaranteed per user = tracking.

I am not sure this is a valid point. Most HTTP header = fingerprinting uses features that needn't be included in a DoH = query.


An app or client could add additional http = headers.  It could add a unique ID for each app or client, it could = add in geo-location data, it could all kinds of things. =  


Further, = once all DNS is in one place, that makes a great = target.

It's certainly a new target, but DNS is in the clear for the = most part. It seems strange to imply this is a new = weakness.

Having = DNS data be in the clear, and having it all be centralized are TWO = totally different things.  One could easily argue that having all = client talk to an internal DNS servers and having that DNS server talk = to the world provides per user confidentiality.

Bret

= --Apple-Mail=_4366407F-EE37-4F1A-8D72-34551D258C29-- From nobody Wed Aug 7 08:46:50 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 71EA312043C for ; Wed, 7 Aug 2019 08:46:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mCjqKikPYdPe for ; Wed, 7 Aug 2019 08:46:45 -0700 (PDT) Received: from mail-pl1-x62a.google.com (mail-pl1-x62a.google.com [IPv6:2607:f8b0:4864:20::62a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DEF89120421 for ; Wed, 7 Aug 2019 08:46:44 -0700 (PDT) Received: by mail-pl1-x62a.google.com with SMTP id c2so41385395plz.13 for ; Wed, 07 Aug 2019 08:46:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=b5YKF9/NRiMRMwOwVvFTtzcFmuifJt0rnLuo/X2tRcg=; b=ZB8d/U/qupedbUXSXL+KRIqsUmzbH0ieIEFLGy6yzgVcWn52dv79FX/biCI7DE4ssP 6S7FoWwqfMDUOX3HFE/c9nk422D8jstBZZeCKnmp8tI2P3dWwzcYMjELxKtc2f6DyUxv YamezvGtUckab91YUBNIAddDfktWr9NH9I3riocG/IxE9TwkekAaO8YOzBtyk/90fmx/ LyfKGBYICSfvEpVYKhD/ISYzeLwI5kQjV3vxcKbaag0LMG8xGTMlWJKuJvssajjqfBwg GNztCmAHpJMFKUoBqktqPdELMW80BNi3yQoTVoJc3saCePJ2s0ufY5YUsFMl4jVT23rf wjrw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=b5YKF9/NRiMRMwOwVvFTtzcFmuifJt0rnLuo/X2tRcg=; b=TJj0tUHc21kzfe4vzc6+Ss16Js6BjCSK7HpUexqdnYBVO8LO9iGMy/NSWRnY9WjHBx ge/kSibRf02V1ZnxIjaaEQXyr+tuI8Eav9Lhqc9piTZxcwr8xbQdSuCH4YwOIfEC8IHN t6k3NAG17u31DOboLr78qh82py1NEU4HcPbf3GLsuAshzAUhf3e2e3BYXrScMi9L4V6J XtUvRMK3/Wafng+/+LuM1Rexj0DN18cg9uOEwX/TRmJGB2a8MKRJ4ZtfluLK+ReoiOkm m5rNGKga+xAQDpSk9A5scYrNdZQsQh/ybZ6jFu/1hJFY7PNnEuhwv45lAFtsr/BHNLVj LILw== X-Gm-Message-State: APjAAAVyEQdDm4nw98ksHhqkgDvq0GozuQSooO0PyU9WocWGQAtn/Knd NDagT3bzmN4/eIh+EcR3iSY= X-Google-Smtp-Source: APXvYqxB0cPkPLyHpslE1js05xXrQz2I459CjUGr9qXPesXD86srwrhjGabeT9/HI+MC33ujaU0LMQ== X-Received: by 2002:a62:e710:: with SMTP id s16mr10245389pfh.183.1565192804578; Wed, 07 Aug 2019 08:46:44 -0700 (PDT) Received: from [10.128.64.149] ([136.60.227.81]) by smtp.gmail.com with ESMTPSA id t8sm285777pji.24.2019.08.07.08.46.42 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 07 Aug 2019 08:46:43 -0700 (PDT) From: Bret Jordan Message-Id: <5DE8C5D4-826B-4A8A-9757-CEFAE67034EC@gmail.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_2A5C5625-6117-482D-9D41-0294C03EC585" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Wed, 7 Aug 2019 09:46:41 -0600 In-Reply-To: Cc: Christian Huitema , Mikael Abrahamsson , Alec Muffett , ADD Mailing list , Tommy Jensen , Ralf Weber , Paul Wouters , Stephen Farrell To: Rob Sayre References: <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Aug 2019 15:46:48 -0000 --Apple-Mail=_2A5C5625-6117-482D-9D41-0294C03EC585 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Thanks, Bret PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 "Without cryptography vihv vivc ce xhrnrw, however, the only thing that = can not be unscrambled is an egg." >=20 > That's true. But then, centralization would have other consequences, = such as a go-to place for censorship. >=20 >=20 > I don't think that's the case. As Mozilla's presentation stated: DNS = is not an effective control surface. >=20 I heard that presentation as well. But I would like to ask where is the = data and research that backs up that assertion? It seems more like it = is the desire of Mozilla or certain people at Mozilla.=20 Bret --Apple-Mail=_2A5C5625-6117-482D-9D41-0294C03EC585 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii
Thanks,
Bret
PGP = Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 = 0050
"Without = cryptography vihv vivc ce xhrnrw, however, the only thing that can not = be unscrambled is an = egg."


That's true. But then, centralization would = have other consequences, such as a go-to place for = censorship.


I don't think that's the case. As = Mozilla's presentation stated: DNS is not an effective control = surface.


I heard that presentation as well.  But I = would like to ask where is the data and research that backs up that = assertion?  It seems more like it is the desire of Mozilla or = certain people at Mozilla. 

Bret



= --Apple-Mail=_2A5C5625-6117-482D-9D41-0294C03EC585-- From nobody Wed Aug 7 08:49:12 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E71FA120445 for ; Wed, 7 Aug 2019 08:49:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.997 X-Spam-Level: X-Spam-Status: No, score=-0.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, FREEMAIL_REPLY=1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0tOSXCz1WOOy for ; Wed, 7 Aug 2019 08:49:08 -0700 (PDT) Received: from mail-pl1-x62c.google.com (mail-pl1-x62c.google.com [IPv6:2607:f8b0:4864:20::62c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CAF31120442 for ; Wed, 7 Aug 2019 08:49:08 -0700 (PDT) Received: by mail-pl1-x62c.google.com with SMTP id a93so41360111pla.7 for ; Wed, 07 Aug 2019 08:49:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=Q7siliADZdfJNxcDcNrDf2EAZkkzkE9HAmaPNICRIIU=; b=oslRDlc2SMn5QUyFZkhUPs3FWp0RtZUVOlXd1eVrX9AhQkNOU9BT6Ff93TDD4EfCj/ Uy/0OLVJZ0j+McBE7Q6IhLcZFFpIHEoPAwEFB7APrrhdlSDZuOcF7f99bxstcr9tUgno BJdM3BOXC31rj1htqsVUsIG7wsca3ThhA2odbtpOsk7UpLVbETduRUtmIanjFQeL1mfb AS2CJFqtKZWdLznbL/dOpguOlA91K3gMANqjoZ74IeCwZCun2hY8hT11V95OATgcHcRn 2obPAehZtaxc7DXMRQmz8Ksj/V6Z7XIGOPcL/d0ot4TN3S7broJrdh6TSzWKmVqSaIwh CYsQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=Q7siliADZdfJNxcDcNrDf2EAZkkzkE9HAmaPNICRIIU=; b=nMb3O5xAhRCT1fYuI4FzDUtivHpTbWA9Sk/mXemsUVAgs+vTOH2uzag/d+KjMTZ4n7 Zgz8ZnwDnxbgAyq/SPPEXxx1MtCr7Erk5maEO+poegTNHeQIOvk0O8cj9Qg9aPoRpz6Y NciQ8JNyQX0xl0zaKpdWcbnoVcEnkToaasvglwVHlr0t2o/hMFSZJR83TDr4ChR0MM5m afv683fOUrmJW2L7rTqaVTcdY5g0O8MeRT+EMZARtPSLW3IjF0Pg9Adx9sX5gGsdIQxs Z/P/rLHtiqu1bxQcRFm3oixSmgAQy0c3KCRGJooJyrfG2z5GZFefvDVFE099tTAr8inF JltA== X-Gm-Message-State: APjAAAXnHOElK6RESfLWCW+/d+VcWSakMKacxXlMAcrpnzFlqIhRRzNi wA/Po5aBv1kNn/NU9gMGSUc= X-Google-Smtp-Source: APXvYqwpM2I5OMRTpLeymF1p4VNkOwTNj+/zxxz85//umdEVD/pRJU6Uf+IDGKd6gEqsrwGBT4DlbQ== X-Received: by 2002:a65:6552:: with SMTP id a18mr8526638pgw.208.1565192948260; Wed, 07 Aug 2019 08:49:08 -0700 (PDT) Received: from [10.128.64.149] ([136.60.227.81]) by smtp.gmail.com with ESMTPSA id 65sm92725858pff.148.2019.08.07.08.49.06 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 07 Aug 2019 08:49:07 -0700 (PDT) From: Bret Jordan Message-Id: <48AD9850-A4EC-46B2-9477-7F8258F0FA48@gmail.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_BE7105B8-0E1F-4800-A3CD-813FB6DA6D53" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Wed, 7 Aug 2019 09:49:04 -0600 In-Reply-To: Cc: Rob Sayre , Christian Huitema , ADD Mailing list To: Andrew Campling References: <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Aug 2019 15:49:10 -0000 --Apple-Mail=_BE7105B8-0E1F-4800-A3CD-813FB6DA6D53 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 > On Aug 7, 2019, at 4:11 AM, Andrew Campling = wrote: >=20 > =20 > On Wed, Aug 7, 2019 at 08:44 AM Rob Sayre > wrote: > =20 > > As Mozilla's presentation stated: DNS is not an effective control = surface. > =20 > It may have stated that, however that doesn=E2=80=99t make it true.=20 > =20 Agreed. At some level I think the browsers are trying to force their = will upon the rest of the world. It kind of feels like the 1990s when a = certain OS tried to force everyone into a certain paradigm.=20 Bret= --Apple-Mail=_BE7105B8-0E1F-4800-A3CD-813FB6DA6D53 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8


On Aug 7, 2019, at 4:11 AM, Andrew Campling <andrew.campling@419.consulting> wrote:

 
On Wed, Aug 7, 2019 at = 08:44 AM Rob Sayre <sayrer@gmail.com> wrote:
 
> As Mozilla's presentation stated: = DNS is not an effective control surface.
 
It may have stated that, however that = doesn=E2=80=99t make it true. 
 
Agreed.  At some level I think the browsers = are trying to force their will upon the rest of the world.  It kind = of feels like the 1990s when a certain OS tried to force everyone into a = certain paradigm. 

Bret
= --Apple-Mail=_BE7105B8-0E1F-4800-A3CD-813FB6DA6D53-- From nobody Wed Aug 7 08:49:26 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DC02D120442 for ; Wed, 7 Aug 2019 08:49:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sky.uk Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hIl_85BGdDdM for ; Wed, 7 Aug 2019 08:49:22 -0700 (PDT) Received: from EUR03-DB5-obe.outbound.protection.outlook.com (mail-db5eur03on0622.outbound.protection.outlook.com [IPv6:2a01:111:f400:fe0a::622]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 971DD120468 for ; Wed, 7 Aug 2019 08:49:22 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=fhJ2MCqpjaIqoGpiLz3yeIlJM28Iqqz85KF/RXGfpZjIZpdyYAZurhzuHVQYwgd1EyJagN9+LEBhxL8wW5UGDZfJjGdt6Phzp8etEQaJpIADblxFDiYShuEMB1yGw/e+QJeqz+pA5TfyDMXjOzAL2k3hP8XnTE0vg3YZRwkV0HuLNZezXg29ThagIZ+f0B9HQlgncicxznz9Z7FbhFJkBiJ7TCTftSTB0Jq2AJGxSAYogRnS4oZeeXvvfK547PA2v4x7rWJ3dRek0MfH9pmjOn7WOVYKFKfNOkXLujLEi4UdXz25WsUc0yCB9S4Uew/mrL9k4xHpkl5Ptxr0i6tidw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=VuYxb+K8Oj4uAltRxUKe3MWwPGht92zTUZ/wmdruOXQ=; b=cpqKrdcITuLaAZAhjGCgGpml6tadFgny0pzxkXfeJ8qRbB4Dl4SWh1g/RwLObwdY7NAFYLU/JU3L5WQDzpSMjl7Ajr8LuL+unw97LdknYp/arvuY7XhT9Q6HHHel7GkFOgWWqeJUfUzVYRKZDfjFVhDl6E2Jd3wkzh8Q2iafX0Ri0dDUzqPsyYgTNfD+cJdFWaMkdJEbe0TASsIhZQdNlKAmQPZ03ZaMntF1F9id1d7jZ7mShPnig0HY+kKovyNsw5HRXauQ9GMVkqk+1h0MFLMQea6GS9/48yqEEWCYLoHGDsjQxEi28lzr+qPC49Hwjt69KaTyL0ImSNaWl74V5w== ARC-Authentication-Results: i=1; mx.microsoft.com 1;spf=pass smtp.mailfrom=sky.uk;dmarc=pass action=none header.from=sky.uk;dkim=pass header.d=sky.uk;arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sky.uk; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=VuYxb+K8Oj4uAltRxUKe3MWwPGht92zTUZ/wmdruOXQ=; b=cH9XMIN2RAwjnRruLw5ax0RC1Aju/zONf75ttpIkW64IqacFJYvN5isLO5nISYne9aq9Cy/veIXZH5DD2hqVoPAJ01H+r7txB5WF/bn54dFDC0ZmXd5N1wCXDr22PShHt8UkhOEKcsp9zEGJt4pxG6fbBWpcaoqPbuZH10BO0gM= Received: from DB6PR0602MB2805.eurprd06.prod.outlook.com (10.172.248.15) by DB6PR0602MB3254.eurprd06.prod.outlook.com (10.170.209.155) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2136.17; Wed, 7 Aug 2019 15:49:20 +0000 Received: from DB6PR0602MB2805.eurprd06.prod.outlook.com ([fe80::2c1d:d6ef:47e:a83e]) by DB6PR0602MB2805.eurprd06.prod.outlook.com ([fe80::2c1d:d6ef:47e:a83e%7]) with mapi id 15.20.2136.018; Wed, 7 Aug 2019 15:49:20 +0000 From: "Dixon, Hugh" To: "Deen, Glenn (NBC Universal - Guest)" , ADD Mailing list Thread-Topic: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] Thread-Index: AQHVRBOGFz8q/VqkokCglR+VwfsXbKbemEMAgAAO7gCAACA1AIABBgcAgAAx2YCAAccgAIAABO0AgALs5ICAAEqUgIAAFY8AgAAY2wCAABS6gIAACREAgADPuwCAABT8AIAACQWAgAALpICAAD92gIAIpseAgACWiQCAABqwgIAAGB+A Date: Wed, 7 Aug 2019 15:49:20 +0000 Message-ID: <3D9F172D-12D1-4CEC-8392-D408FE2D0905@sky.uk> References: <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> <64bcfc51-6f3d-ae24-4de5-d0eb89975c66@cs.tcd.ie> <539D6F9D-137C-4F68-A8DE-EA3DFAF4D827@huitema.net> <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <206EEFEA-178A-462A-B6EE-AC2389D54B43@hopcount.ca> In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-GB X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.1c.0.190804 authentication-results: spf=none (sender IP is ) smtp.mailfrom=Hugh.Dixon@sky.uk; x-originating-ip: [90.216.150.239] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: a056d77b-192e-4bc7-8f6e-08d71b4ecfcb x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(5600148)(711020)(4605104)(1401327)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(2017052603328)(7193020); SRVR:DB6PR0602MB3254; x-ms-traffictypediagnostic: DB6PR0602MB3254: x-ms-exchange-purlcount: 1 x-ld-processed: 68b865d5-cf18-4b2b-82a4-a4eddb9c5237,ExtAddr x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:8882; x-forefront-prvs: 01221E3973 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(4636009)(136003)(366004)(376002)(396003)(39860400002)(346002)(199004)(189003)(71190400001)(8936002)(6506007)(66446008)(53546011)(229853002)(66556008)(64756008)(71200400001)(102836004)(66476007)(14444005)(68736007)(256004)(5024004)(6512007)(2906002)(36756003)(6116002)(6486002)(316002)(6436002)(110136005)(76116006)(58126008)(99286004)(76176011)(3846002)(91956017)(966005)(486006)(26005)(45080400002)(478600001)(2616005)(476003)(66066001)(53936002)(305945005)(446003)(7736002)(186003)(81156014)(25786009)(8676002)(81166006)(86362001)(6306002)(66946007)(33656002)(6246003)(5660300002)(14454004)(11346002)(148743002); DIR:OUT; SFP:1101; SCL:1; SRVR:DB6PR0602MB3254; H:DB6PR0602MB2805.eurprd06.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:0; MX:1; received-spf: None (protection.outlook.com: sky.uk does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: bFIUttf7apkoKUrkyS4ovsLkrPywYaRCT+EtTbhjnE6Ht3vdNmkRypdClpU8N4VRD6v1T8SHkPsAYM79TNide8YM3J1CI/H5Sm3W+b5GzEakvcleX8Zy23pE+UTr5ewkJ2Z6P1gT9Fb8yxN3c1+h0mANqU7BZw2bFRSWgTOE3HhybwzZZNVbgPj5Da/sZeU/rl2cz0wvBTX5pyQYurVd9D00BzWwg1igDvHfQxoppFrNcMgRRPxw2UqmSyHSPP1vKmmlGUZn+87BgVuNkmfZP/pPf99ojYZebwfJTlYaXeKZwLXSi1cd1Inb9j/uCZPDy6z9AveE88MKgSiwomfiT28Iq3PJCeUXryIz0oVLwmvVrtrW4uqUATglmQM1nMK6bd2EmWa0RsSph4nhvxDx//fAD98YcCSKZWVnLDgHXoI= Content-Type: text/plain; charset="utf-8" Content-ID: <5C224C1A5B3EC64FB17CE0DBF8732385@eurprd06.prod.outlook.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: sky.uk X-MS-Exchange-CrossTenant-Network-Message-Id: a056d77b-192e-4bc7-8f6e-08d71b4ecfcb X-MS-Exchange-CrossTenant-originalarrivaltime: 07 Aug 2019 15:49:20.2608 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 68b865d5-cf18-4b2b-82a4-a4eddb9c5237 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: hugh.dixon@sky.uk X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB6PR0602MB3254 Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Aug 2019 15:49:26 -0000 Sm9lIC0gSXMgeW91ciAub3JnIGRhdGEgcHVibGlzaGVkIHZpYSBETlNPQVJDID8NCkhvdyBkbyB5 b3UgZGVkdWNlIHRoZSAlIG9mIGVuZCB1c2VyIHN5c3RlbXMgdXNpbmcgOC44LjguOCA/DQoNCkh1 Z2gNCg0K77u/T24gMDcvMDgvMjAxOSwgMTY6MjMsICJEZWVuLCBHbGVubiAoTkJDVW5pdmVyc2Fs KSIgPEdsZW5uLkRlZW5AbmJjdW5pLmNvbT4gd3JvdGU6DQoNCg0KDQogICAgT24gQXVnIDcsIDIw MTksIGF0IDY6NDggQU0sIEpvZSBBYmxleSA8amFibGV5QGhvcGNvdW50LmNhPiB3cm90ZToNCg0K ICAgID4+IE9uIDcgQXVnIDIwMTksIGF0IDAwOjQ4LCBCcmV0IEpvcmRhbiA8am9yZGFuLmlldGZA Z21haWwuY29tPiB3cm90ZToNCiAgICA+Pg0KICAgID4+IEkgZm9yIG9uZSBhbSB0ZXJyaWZpZWQg b2YgdGhlIHBvc3NpYmlsaXR5IG9mIG1hc3MgY2VudHJhbGl6YXRpb24gb2YgRE5TIHRyYWZmaWMu DQogICAgPg0KICAgID4gVHdvIGRvemVuIHJlc29sdmVyIHN5c3RlbXMgYXJlIHJlc3BvbnNpYmxl IGZvciBzb21lIDgwJSBvZiBhbGwgdHJhZmZpYyBzZWVuIGF0IE9SRyBzZXJ2ZXJzLCB0b2RheS4g U29tZXdoZXJlIGJldHdlZW4gMTUgYW5kIDIwJSBvZiBhbGwgZW5kLXVzZXIgc3lzdGVtcyB1c2Ug R29vZ2xlIFB1YmxpYyBETlMgZm9yIHJlc29sdXRpb24uIFRoaXMgYWxyZWFkeSBmZWVscyBsaWtl IG1hc3MgY2VudHJhbGlzYXRpb24gdG8gbWUuDQogICAgPg0KICAgID4gQXBvbG9naWVzIGlmIEkn dmUgdHJpZ2dlcmVkIGFueSB0ZXJyb3IuDQoNCiAgICBKb2UNCg0KICAgIFdoaWxlIHRoZSB0b3Ag ODAlIGJlaW5nIGZyb20gMiBkb3plbiByZXNvbHZlcnMgdGhlcmUgYXJlIG90aGVycyBzdGF0aXN0 aWNzIHRoYXQgd291bGQgYmUgaW50ZXJlc3RpbmcgYW5kIHBlcmhhcHMgYSBnb29kIG1lYXN1cmVt ZW50IG9mIGN1cnJlbnQgRE5TIFJlc29sdmVyIGRpdmVyc2l0eS4NCg0KICAgIFdlIGtub3cgdGhl cmUgYXJlIGEgZ3JlYXQgbWFueSBzbWFsbCByZXNvbHZlcnMgaW4gdGhlIHdvcmxkIHJhbmdpbmcg ZnJvbSB0aG9zZSBydW4gYnkgbGFyZ2UgYW5kIHNtYWxsIGNvcnBvcmF0ZSBhbmQgb3JnYW5pemF0 aW9uIElULCBtZWRpdW0gYW5kIHNtYWxsIElTUHMsIGFsbCB0aGUgIHdheSBkb3duIHRob3NlIHJ1 biBieSBpbmRpdmlkdWFscy4NCg0KICAgIEluZGl2aWR1YWxseSB0aGV5IGRvbuKAmXQgZ2VuZXJh dGUgYSBsb3Qgb2YgdHJhZmZpYywgYnV0IHRoZXkgdGhhdOKAmXMgb2sgYXMgRE5TIHdhcyBuZXZl ciBkZXNpZ25lZCB0byBiZSBjZW50cmFsaXplZC4gQnJvYWQgZGl2ZXJzaXR5IGhhcyBsb25nIGJl ZW4gYSBmdW5kYW1lbnRhbCBzdHJlbmd0aCBvZiB0aGUgc3lzdGVtLg0KDQogICAgVGhlIGFjdHVh bCBleGFjdCBudW1iZXIgb2YgdGhlc2UgbG9uZyB0YWlsIHJlc29sdmVycyBpc27igJl0IHlldCBr bm93biBidXQgc29tZSBlc3RpbWF0ZXMgaGF2ZSBwdXQgaXQgaW4gdGhlIDEgbWlsbGlvbiB0byBt YXliZSA1LTEwIG1pbGxpb24gcmFuZ2UuICBJdCBjb3VsZCBldmVuIGJlIGhpZ2hlci4gICBUaGlz IGxhcmdlIG51bWJlciBvZiBmaXJzdCBsZXZlbCByZXNvbHZlcnMgcmVwcmVzZW50cyBhbiBlbGVt ZW50IG9mIGdyZWF0IGRpdmVyc2l0eSB3aGljaCBzdHJlbmd0aGVucyB0aGUgRE5TIGZvciB1c2Vy cy4NCg0KICAgIFNvIGlmIHlvdeKAmXJlIGxvb2tpbmcgYXQgZGF0YSBpcyBpdCBwb3NzaWJsZSB0 byBzYXkgaG93IGJpZyB0aGUgdGFpbCBpcz8gIEFmdGVyIHRoZSBmaXJzdCA4MCUsIGhvdyBtYW55 IGRpZmZlcmVudCByZXNvbHZlcnMgc2hvdyB1cCBpbiB0aGUgbmV4dCA1JSwgMTAlLCAxNSUsIDIw JSBidWNrZXRzPyAgV2hhdOKAmXMgdGhlIHRvdGFsIG51bWJlciBvZiBkaXZlcnNlIHJlc29sdmVy cz8NCg0KICAgIEZvciB3aGlsZSBtZWFzdXJpbmcgYmlnIHVzZXJzIGlzIGEgZ29vZCBtZWFzdXJl IG9mIGNlbnRyYWxpemF0aW9uLCBtZWFzdXJpbmcgc21hbGwgaXMgcGVyaGFwcyBhIGdvb2QgbWVh c3VyZSBvZiB0b2RheeKAmXMgaW5mcmFzdHJ1Y3R1cmFsIGRpdmVyc2l0eSBhbmQgcmVzaWxpZW5j eS4NCg0KICAgIC1nbGVubg0KICAgIC0tDQogICAgQWRkIG1haWxpbmcgbGlzdA0KICAgIEFkZEBp ZXRmLm9yZw0KICAgIGh0dHBzOi8vZXVyMDEuc2FmZWxpbmtzLnByb3RlY3Rpb24ub3V0bG9vay5j b20vP3VybD1odHRwcyUzQSUyRiUyRnd3dy5pZXRmLm9yZyUyRm1haWxtYW4lMkZsaXN0aW5mbyUy RmFkZCZhbXA7ZGF0YT0wMiU3QzAxJTdDaHVnaC5kaXhvbiU0MHNreS51ayU3QzEwODM1MDQyYzE2 NTRkMjViODk3MDhkNzFiNGIyZWQxJTdDNjhiODY1ZDVjZjE4NGIyYjgyYTRhNGVkZGI5YzUyMzcl N0MwJTdDMCU3QzYzNzAwNzg4MjA0MzM3MDc0MSZhbXA7c2RhdGE9MTJkb1BXcWVzVXFGSTUlMkZl U0J2ZWEwSGoxTHJzSmUwMGJKa2gwOEJ4cnQwJTNEJmFtcDtyZXNlcnZlZD0wDQoNCg0KSW5mb3Jt YXRpb24gaW4gdGhpcyBlbWFpbCBpbmNsdWRpbmcgYW55IGF0dGFjaG1lbnRzIG1heSBiZSBwcml2 aWxlZ2VkLCBjb25maWRlbnRpYWwgYW5kIGlzIGludGVuZGVkIGV4Y2x1c2l2ZWx5IGZvciB0aGUg YWRkcmVzc2VlLiBUaGUgdmlld3MgZXhwcmVzc2VkIG1heSBub3QgYmUgb2ZmaWNpYWwgcG9saWN5 LCBidXQgdGhlIHBlcnNvbmFsIHZpZXdzIG9mIHRoZSBvcmlnaW5hdG9yLiBJZiB5b3UgaGF2ZSBy ZWNlaXZlZCBpdCBpbiBlcnJvciwgcGxlYXNlIG5vdGlmeSB0aGUgc2VuZGVyIGJ5IHJldHVybiBl LW1haWwgYW5kIGRlbGV0ZSBpdCBmcm9tIHlvdXIgc3lzdGVtLiBZb3Ugc2hvdWxkIG5vdCByZXBy b2R1Y2UsIGRpc3RyaWJ1dGUsIHN0b3JlLCByZXRyYW5zbWl0LCB1c2Ugb3IgZGlzY2xvc2UgaXRz IGNvbnRlbnRzIHRvIGFueW9uZS4gUGxlYXNlIG5vdGUgd2UgcmVzZXJ2ZSB0aGUgcmlnaHQgdG8g bW9uaXRvciBhbGwgZS1tYWlsIGNvbW11bmljYXRpb24gdGhyb3VnaCBvdXIgaW50ZXJuYWwgYW5k IGV4dGVybmFsIG5ldHdvcmtzLiBTS1kgYW5kIHRoZSBTS1kgbWFya3MgYXJlIHRyYWRlbWFya3Mg b2YgU2t5IExpbWl0ZWQgYW5kIFNreSBJbnRlcm5hdGlvbmFsIEFHIGFuZCBhcmUgdXNlZCB1bmRl ciBsaWNlbmNlLg0KDQpTa3kgVUsgTGltaXRlZCAoUmVnaXN0cmF0aW9uIE5vLiAyOTA2OTkxKSwg U2t5LUluLUhvbWUgU2VydmljZSBMaW1pdGVkIChSZWdpc3RyYXRpb24gTm8uIDIwNjcwNzUpLCBT a3kgU3Vic2NyaWJlcnMgU2VydmljZXMgTGltaXRlZCAoUmVnaXN0cmF0aW9uIE5vLiAyMzQwMTUw KSBhbmQgU2t5IENQIExpbWl0ZWQgKFJlZ2lzdHJhdGlvbiBOby4gOTUxMzI1OSkgYXJlIGRpcmVj dCBvciBpbmRpcmVjdCBzdWJzaWRpYXJpZXMgb2YgU2t5IExpbWl0ZWQgKFJlZ2lzdHJhdGlvbiBO by4gMjI0NzczNSkuIEFsbCBvZiB0aGUgY29tcGFuaWVzIG1lbnRpb25lZCBpbiB0aGlzIHBhcmFn cmFwaCBhcmUgaW5jb3Jwb3JhdGVkIGluIEVuZ2xhbmQgYW5kIFdhbGVzIGFuZCBzaGFyZSB0aGUg c2FtZSByZWdpc3RlcmVkIG9mZmljZSBhdCBHcmFudCBXYXksIElzbGV3b3J0aCwgTWlkZGxlc2V4 IFRXNyA1UUQNCg== From nobody Wed Aug 7 08:50:34 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 76886120445 for ; Wed, 7 Aug 2019 08:50:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=hopcount.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5Bs395o2AKex for ; Wed, 7 Aug 2019 08:50:31 -0700 (PDT) Received: from mail-ot1-x342.google.com (mail-ot1-x342.google.com [IPv6:2607:f8b0:4864:20::342]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3DBD612012D for ; Wed, 7 Aug 2019 08:50:31 -0700 (PDT) Received: by mail-ot1-x342.google.com with SMTP id j11so5790463otp.10 for ; Wed, 07 Aug 2019 08:50:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hopcount.ca; s=google; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=b3bF3PyRThV8EmYSoKY4LmMzb+MC1aOxEhtrOOgm2F0=; b=J58Z7TkSavyDf3mmuu19lvPV7Ktny+4EVLRG01qZRxGhj9oScbJut3zL4AIStG6AWt Tf9TYinm3t9uXneg3StfA0oIvkxo7XdDI1yK6jvSa+LdpDwH4GsW9dahVmCpX8VChtP/ KIk+PC5l5z6F0WelsMAH8MbOMzX+uBWRmuT5I= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=b3bF3PyRThV8EmYSoKY4LmMzb+MC1aOxEhtrOOgm2F0=; b=PCU8S8CkxzQlUZkG+Y/OsgC1h0rTTe7LpVGM4YS/Nx7EWs/+mvs//oAVAWq0K4Ptlh 9VyabHpuaxpor9xJvUIUELcCMRylJZd0/oJ0DtGxqPbQ579S1YcB/Jo7Z4qP9Y3TznI6 /IJPKNo5cYDD+opNpfDuNi+CTOxBggEEw5mN78FnoRhUw43mMB/JmehjoRZMQqsgVZar jEpijW85FDRivXi6d2ARpj/JuG98DElP+bdnr9QOZXHS2IWSNxySxCvILT1eNwARVjn4 VakJAWM7F8U72uiHJmU/Dag98eKHy0R/xyKpDBUsSCxWTbsbAqm4Iipa5dVU9/pjrwhk QhuQ== X-Gm-Message-State: APjAAAWOavljG4DZ7tbRcxLiAFot3ui7UoleGmLXpgNyZ4h3kFIrwiUB s4tvS4J8IgtUY5GTtNW+zkvDPQ== X-Google-Smtp-Source: APXvYqwpjNtykGwyn7FHC1++tJXjxhCfqbX6qgbn5ZhSOiHXAozVobCYKGLe5UQ1hMnShpG3tf3JhQ== X-Received: by 2002:a02:b68f:: with SMTP id i15mr10957685jam.107.1565193030308; Wed, 07 Aug 2019 08:50:30 -0700 (PDT) Received: from [192.168.1.50] (24-246-23-138.cable.teksavvy.com. [24.246.23.138]) by smtp.gmail.com with ESMTPSA id m20sm89275952ioh.4.2019.08.07.08.50.28 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 07 Aug 2019 08:50:29 -0700 (PDT) From: Joe Abley Message-Id: <6940822E-8702-4CD0-99CE-49CAE38225D1@hopcount.ca> Content-Type: multipart/signed; boundary="Apple-Mail=_B9A26FA1-904C-401C-8F00-90EA624E7363"; protocol="application/pgp-signature"; micalg=pgp-sha1 Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Wed, 7 Aug 2019 11:50:27 -0400 In-Reply-To: Cc: Bret Jordan , Mikael Abrahamsson , Alec Muffett , ADD Mailing list , Tommy Jensen , Ralf Weber , Paul Wouters , Stephen Farrell To: "Deen, Glenn (NBCUniversal)" References: <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> <64bcfc51-6f3d-ae24-4de5-d0eb89975c66@cs.tcd.ie> <539D6F9D-137C-4F68-A8DE-EA3DFAF4D827@huitema.net> <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <206EEFEA-178A-462A-B6EE-AC2389D54B43@hopcount.ca> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Aug 2019 15:50:34 -0000 --Apple-Mail=_B9A26FA1-904C-401C-8F00-90EA624E7363 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Hi Glen! On 7 Aug 2019, at 11:22, Deen, Glenn (NBCUniversal) = wrote: > While the top 80% being from 2 dozen resolvers there are others = statistics that would be interesting and perhaps a good measurement of = current DNS Resolver diversity. >=20 > We know there are a great many small resolvers in the world ranging = from those run by large and small corporate and organization IT, medium = and small ISPs, all the way down those run by individuals. >=20 > Individually they don=E2=80=99t generate a lot of traffic, but they = that=E2=80=99s ok as DNS was never designed to be centralized. Broad = diversity has long been a fundamental strength of the system. >=20 > The actual exact number of these long tail resolvers isn=E2=80=99t yet = known but some estimates have put it in the 1 million to maybe 5-10 = million range. It could even be higher. This large number of first = level resolvers represents an element of great diversity which = strengthens the DNS for users. >=20 > So if you=E2=80=99re looking at data is it possible to say how big the = tail is? After the first 80%, how many different resolvers show up in = the next 5%, 10%, 15%, 20% buckets? What=E2=80=99s the total number of = diverse resolvers? I agree with you though that the data does show a very long tail. The = number of resolvers observed depends on the time base of the = observation, since there are a great number that only send queries very = occasionally. While the top talkers are easy enough to identify as = resolvers, that becomes a little more speculative when you consider the = nature of initiators who send one query every two weeks, for example: = are those really resolvers with a population of stub resolvers behind = them? Is the population just really small? Are the resolvers hopping = between addresses? Are they doing something else? The rapid descent of the histogram into the noise floor still provides = good support to the idea that *traffic* is centralised to a small number = of clients, though, as viewed from the authoritative server. More generally, you're not the only one who is interested in more = specific details about the traffic we see at ORG, and I hope to be able = to publish something less anecdotal before too long. We have a DNS-OARC = meeting coming up in November -- perhaps we can slice and dice our = traffic stats and have something useful to show the class, there. Joe --Apple-Mail=_B9A26FA1-904C-401C-8F00-90EA624E7363 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iF0EARECAB0WIQSAt40QkiztAcvphdg0jwy9hlI6LAUCXUrzQwAKCRA0jwy9hlI6 LOQJAJ4peE+RiUrbunruFWPQJ7ZAuKeKDACgsNVGr+MIJPwSSnw4dcSH/9JlfmI= =cq6A -----END PGP SIGNATURE----- --Apple-Mail=_B9A26FA1-904C-401C-8F00-90EA624E7363-- From nobody Wed Aug 7 08:51:16 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 13E47120442 for ; Wed, 7 Aug 2019 08:51:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9OIsg88c18uq for ; Wed, 7 Aug 2019 08:51:08 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9E3C312044C for ; Wed, 7 Aug 2019 08:51:08 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id CEE20BE47; Wed, 7 Aug 2019 16:51:06 +0100 (IST) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id r6S974HUml1n; Wed, 7 Aug 2019 16:51:05 +0100 (IST) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 3D660BE2E; Wed, 7 Aug 2019 16:51:05 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1565193065; bh=aDDq/to1s8izxQz9AZOUCv5RxKoti30SL/PEK2qRoEk=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From; b=t4ayFdOUGQpfZxxVBMeVnL8LV8mC3c92qM5Hz7ghii27rhsPx7Yd5MrbD3gG1o2xm zqURAkQwR+6nypeULb7+RzcN1Jl7Lk4lFK5m9/IxiKgxoT06QXHbmsVO/r/Oo+Dtum Zbln7iKmFCW3xryWk7aRSdfIxWoqKA82EpFrs9NE= To: Bret Jordan , Rob Sayre Cc: Mikael Abrahamsson , Alec Muffett , ADD Mailing list , Tommy Jensen , Ralf Weber , Paul Wouters References: <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <841102D9-4B50-4415-8193-FF3766F91958@gmail.com> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: <51f18426-d2fd-1be9-5556-fe079992acce@cs.tcd.ie> Date: Wed, 7 Aug 2019 16:51:03 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: <841102D9-4B50-4415-8193-FF3766F91958@gmail.com> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="Z3VadjTIbKnoy6X26Es90shAZTQql0Fkq" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Aug 2019 15:51:11 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --Z3VadjTIbKnoy6X26Es90shAZTQql0Fkq Content-Type: multipart/mixed; boundary="stObXKHSo492pfsVQ0v5oW42tC3KrM0Oz"; protected-headers="v1" From: Stephen Farrell To: Bret Jordan , Rob Sayre Cc: Mikael Abrahamsson , Alec Muffett , ADD Mailing list , Tommy Jensen , Ralf Weber , Paul Wouters Message-ID: <51f18426-d2fd-1be9-5556-fe079992acce@cs.tcd.ie> Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] References: <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> <64bcfc51-6f3d-ae24-4de5-d0eb89975c66@cs.tcd.ie> <539D6F9D-137C-4F68-A8DE-EA3DFAF4D827@huitema.net> <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <841102D9-4B50-4415-8193-FF3766F91958@gmail.com> In-Reply-To: <841102D9-4B50-4415-8193-FF3766F91958@gmail.com> --stObXKHSo492pfsVQ0v5oW42tC3KrM0Oz Content-Type: multipart/mixed; boundary="------------3720BB7C6FC38EEB7AE6EFAC" Content-Language: en-GB This is a multi-part message in MIME format. --------------3720BB7C6FC38EEB7AE6EFAC Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On 07/08/2019 16:42, Bret Jordan wrote: > An app or client could add additional http headers. It could add a > unique ID for each app or client, it could add in geo-location data, > it could all kinds of things. An application could as easily leverage qnames and answers to get as good tracking or covert channel via DoT. So, again, this is down to trusting the application code as a DNS client that's allowed to talk to it's selected recursive... or not. It's not really a DoT/DoH distinction. That said, I do agree it'd be easier to accidentally enable tracking via DoH, if one used some library or re-used some code that did send cookies etc. And as the fine presentation in pearg demonstrated, http session or other ancialliary information may make it easier to do traffic analysis on DoH vs. DoT. I'm not convinced either factor is a long term thing though. Cheers, S. --------------3720BB7C6FC38EEB7AE6EFAC Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------3720BB7C6FC38EEB7AE6EFAC-- --stObXKHSo492pfsVQ0v5oW42tC3KrM0Oz-- --Z3VadjTIbKnoy6X26Es90shAZTQql0Fkq Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAl1K82gACgkQWrL68XsX K+p27hAAwosPhoCVuvetfaubfmHjFdsA/YvD2jlCbD5Jaw06zROAZXJhxXAOfaCy A50ItpJbeQqo/LuvlbQCb58TqEWl7cocHIQidiP1HzA4wyjpR2pi6vLm9Lkl8fgi vu/9JdMc8QPVoFCHbcB3XLG8yyMkuOS8GE2R2pbDHBQcEU48G5rwaTU8D4WqNFxF xSwgXc1E8EwP1UnZ7SZj8zCf24+j/MV6VOtwIctAw1lbuo6ggU3E2IqYQUnGJXi7 porkI32Tj1eyoWAYnXTUNVI8Zmf9PNzum11J5Kb6Qt4h63MPk37cXVW5KIM+7SV+ kO12VqmSxqT1SCFv/2B/TYSgyLCyukm9XDgH2IZrzj899OM6pCzZGUzE96r8fS1k 8qweS091ZaOztfSGFrNH+lsrf2nScNyvnQwpC9niWQR87CpzOe9/1vtsDJfZUdcp tNdQ9AXPoT7WwFFeo1ppou1p2HzXFNSS1tpS5CE7kCR8tLnTrApbB0n/oLSTpg6a o/xdrB0WmU/39/07MdKP9HAgt45A2nk3gWIQ435FXWJYBPiwv8iVautv2qlykA8j TXgfXvki6ifWiEMu/HBMOSWKeVRgxLFfSTVUuCLJG5JfEjHpuLQPD7q3QIEzr1s+ OyPvqScb4sTepqQIdNwMbCWRfba7vexs1JYkuBtIow3P+N/f4d4= =2H6M -----END PGP SIGNATURE----- --Z3VadjTIbKnoy6X26Es90shAZTQql0Fkq-- From nobody Wed Aug 7 08:56:04 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D59E012044C for ; Wed, 7 Aug 2019 08:56:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=hopcount.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zeiOowf46DuM for ; Wed, 7 Aug 2019 08:55:59 -0700 (PDT) Received: from mail-ot1-x32e.google.com (mail-ot1-x32e.google.com [IPv6:2607:f8b0:4864:20::32e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 11D85120446 for ; Wed, 7 Aug 2019 08:55:59 -0700 (PDT) Received: by mail-ot1-x32e.google.com with SMTP id n5so106340662otk.1 for ; Wed, 07 Aug 2019 08:55:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hopcount.ca; s=google; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=5r4FEm9QbaB38ZXtA05QZ0GfzNgXKG5/kXYCId4KPzA=; b=nkOXuAsIZsuzqM7eVQVrFOtcvKIjvNkLWCOn3A0QFURIrELllCtAcxRIMxaYtUEgc3 7nmlVlkRn3+cd1C/RQgN+bGwq/2xUuBG2R+H1oJwVydGsDOJrJygnBhKrtpmxA1zAAGw 85CBK9uy8RAeab2AciyWZGGZ9OPCtaCzOAo0c= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=5r4FEm9QbaB38ZXtA05QZ0GfzNgXKG5/kXYCId4KPzA=; b=dckrQesEKFS3bReCBVx03ps5lQm4PL5D5SH2X0V6mBvlOGjXumBjm78vanoiq+nMlt /HgrO8MXjrfgAg2dxGe5b+LPrOH1zoVknAmnpKYbzMySaFsWaZy4clH57fx6lG0p/lvo q/hIJVOkAmHgcQ2GyL3IPiY0z00paF310izO1LNROxyAmp9vdhKb+74Ue8aF2nNf269s u5x6KLNbEgYFBl6WrU4U7B12FXIehrnPZ5hXM7J1w2kTPFKp2DInskM1XGNm6HfQmesj UgaNBPdey5ren3zipLZFI+F2VO6I3prhGNfTzNFuqAZ8m2FOb+xzpz5vX4b56zzA0ksJ Gimw== X-Gm-Message-State: APjAAAWNUoyoHBrwuXD9Boc51M6+R+u6pNqPvOGdw73XuuDduq7Bogx1 rXHK4K2NSHnzIb6dl9PEtxMAMk3eH4n4+djd X-Google-Smtp-Source: APXvYqxHI+zPIOOUtIDQMq3cFvZmYZpesArYrHe5kWQJKG7lg1mcSnpX/LI910bbEf6CqH6S0cCktQ== X-Received: by 2002:a5d:9386:: with SMTP id c6mr3259927iol.81.1565193358183; Wed, 07 Aug 2019 08:55:58 -0700 (PDT) Received: from [192.168.1.50] (24-246-23-138.cable.teksavvy.com. [24.246.23.138]) by smtp.gmail.com with ESMTPSA id t5sm69509660iol.55.2019.08.07.08.55.56 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 07 Aug 2019 08:55:57 -0700 (PDT) From: Joe Abley Message-Id: <3DB6C7D2-A982-4CE8-9ABF-2FCE247DA859@hopcount.ca> Content-Type: multipart/signed; boundary="Apple-Mail=_567E4829-D4B4-4C65-88AE-FD84B8D86010"; protocol="application/pgp-signature"; micalg=pgp-sha1 Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Wed, 7 Aug 2019 11:55:55 -0400 In-Reply-To: <3D9F172D-12D1-4CEC-8392-D408FE2D0905@sky.uk> Cc: "Deen, Glenn (NBC Universal - Guest)" , ADD Mailing list To: "Dixon, Hugh" References: <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> <64bcfc51-6f3d-ae24-4de5-d0eb89975c66@cs.tcd.ie> <539D6F9D-137C-4F68-A8DE-EA3DFAF4D827@huitema.net> <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <206EEFEA-178A-462A-B6EE-AC2389D54B43@hopcount.ca> <3D9F172D-12D1-4CEC-8392-D408FE2D0905@sky.uk> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Aug 2019 15:56:03 -0000 --Apple-Mail=_567E4829-D4B4-4C65-88AE-FD84B8D86010 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Hi Hugh, I don't want to hijack the thread with a tangent, but identification of = traffic that originates at Google and lands at Afilias (the back-end = registry provider for PIR) is straightforward, as is confirmation that = of that DNS traffic the queries that don't relate to Google Public is a = rounding error. Afilias is not the only provider of authoritative DNS services for PIR, = and it's certainly possible that there is some systematic bias in the = distribution of query originators observed in just Afilias anycast = nodes. However, the elephants are so big and the mice are so small that = I remain fairly confident that the observation made is representative of = the system as a whole. As I mentioned before these observations have all been made internally = within PIR and Afilias and we don't currently publish them in any way. I = am certainly in favour of publishing things, though, so long as we can = do so with some degree of rigour and not promote ambiguity. Joe > On 7 Aug 2019, at 11:49, Dixon, Hugh = wrote: >=20 > Joe - Is your .org data published via DNSOARC ? > How do you deduce the % of end user systems using 8.8.8.8 ? >=20 > Hugh >=20 > =EF=BB=BFOn 07/08/2019, 16:23, "Deen, Glenn (NBCUniversal)" = wrote: >=20 >=20 >=20 > On Aug 7, 2019, at 6:48 AM, Joe Abley wrote: >=20 >>> On 7 Aug 2019, at 00:48, Bret Jordan wrote: >>>=20 >>> I for one am terrified of the possibility of mass centralization of = DNS traffic. >>=20 >> Two dozen resolver systems are responsible for some 80% of all = traffic seen at ORG servers, today. Somewhere between 15 and 20% of all = end-user systems use Google Public DNS for resolution. This already = feels like mass centralisation to me. >>=20 >> Apologies if I've triggered any terror. >=20 > Joe >=20 > While the top 80% being from 2 dozen resolvers there are others = statistics that would be interesting and perhaps a good measurement of = current DNS Resolver diversity. >=20 > We know there are a great many small resolvers in the world ranging = from those run by large and small corporate and organization IT, medium = and small ISPs, all the way down those run by individuals. >=20 > Individually they don=E2=80=99t generate a lot of traffic, but they = that=E2=80=99s ok as DNS was never designed to be centralized. Broad = diversity has long been a fundamental strength of the system. >=20 > The actual exact number of these long tail resolvers isn=E2=80=99t = yet known but some estimates have put it in the 1 million to maybe 5-10 = million range. It could even be higher. This large number of first = level resolvers represents an element of great diversity which = strengthens the DNS for users. >=20 > So if you=E2=80=99re looking at data is it possible to say how big = the tail is? After the first 80%, how many different resolvers show up = in the next 5%, 10%, 15%, 20% buckets? What=E2=80=99s the total number = of diverse resolvers? >=20 > For while measuring big users is a good measure of centralization, = measuring small is perhaps a good measure of today=E2=80=99s = infrastructural diversity and resiliency. >=20 > -glenn > -- > Add mailing list > Add@ietf.org > = https://eur01.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fwww.ie= tf.org%2Fmailman%2Flistinfo%2Fadd&data=3D02%7C01%7Chugh.dixon%40sky.uk= %7C10835042c1654d25b89708d71b4b2ed1%7C68b865d5cf184b2b82a4a4eddb9c5237%7C0= %7C0%7C637007882043370741&sdata=3D12doPWqesUqFI5%2FeSBvea0Hj1LrsJe00bJ= kh08Bxrt0%3D&reserved=3D0 >=20 >=20 > Information in this email including any attachments may be privileged, = confidential and is intended exclusively for the addressee. The views = expressed may not be official policy, but the personal views of the = originator. If you have received it in error, please notify the sender = by return e-mail and delete it from your system. You should not = reproduce, distribute, store, retransmit, use or disclose its contents = to anyone. Please note we reserve the right to monitor all e-mail = communication through our internal and external networks. SKY and the = SKY marks are trademarks of Sky Limited and Sky International AG and are = used under licence. >=20 > Sky UK Limited (Registration No. 2906991), Sky-In-Home Service Limited = (Registration No. 2067075), Sky Subscribers Services Limited = (Registration No. 2340150) and Sky CP Limited (Registration No. 9513259) = are direct or indirect subsidiaries of Sky Limited (Registration No. = 2247735). All of the companies mentioned in this paragraph are = incorporated in England and Wales and share the same registered office = at Grant Way, Isleworth, Middlesex TW7 5QD > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add --Apple-Mail=_567E4829-D4B4-4C65-88AE-FD84B8D86010 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iF0EARECAB0WIQSAt40QkiztAcvphdg0jwy9hlI6LAUCXUr0iwAKCRA0jwy9hlI6 LD1JAKCQTRNs2YHfbcRE0zmVMVt3vCEh/QCgu3wDNdJ/31tFZYIZk8IH5nG441o= =HQSa -----END PGP SIGNATURE----- --Apple-Mail=_567E4829-D4B4-4C65-88AE-FD84B8D86010-- From nobody Wed Aug 7 08:58:44 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 52F49120451 for ; Wed, 7 Aug 2019 08:58:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id E_dMboFlCpsM for ; Wed, 7 Aug 2019 08:58:39 -0700 (PDT) Received: from mail-pl1-x62f.google.com (mail-pl1-x62f.google.com [IPv6:2607:f8b0:4864:20::62f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2329D12045C for ; Wed, 7 Aug 2019 08:58:39 -0700 (PDT) Received: by mail-pl1-x62f.google.com with SMTP id b3so41494650plr.4 for ; Wed, 07 Aug 2019 08:58:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=kaomtj595wExiXvYwBB/s3holreq2EecGYlSkYnCx+I=; b=lZr+u/BkBWsgtuW4vWrr4llFYtXKZHgROe4m41ohGLUn+tLyjJeZbhvdkN1LNudTnU sHXwsMGtAl1hULe5p1naBuQ7DakIaz6tW9v224TILRIqrJWPU/e0xrMSBm9STtXmNiUO H2y/9Z5UrJE234AtawD6Bh/lv2PHVDiQb/Vo49m2Icx/toker/PoR9AwNSd7b1gRWXGt Shlapyo1G/P175WmmA7avXMtUtxm/8/pWx6DtkHEv5E/LS/aRkaSx98RGkk743QjZCdm 3acYKAgwO4L28h+MDiAW500wb9sTptzguMnuVQEhWioa7x23eyzE2RAu7lyDP2tDQ/FB +/1g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=kaomtj595wExiXvYwBB/s3holreq2EecGYlSkYnCx+I=; b=m/GDd1FBhNahKb+lguz1NdbVGypHWIqqNTe4ie9nxTJuETpBOAEdh7o7TGAuW2yaiO 9YFY/H7PgqJkCkNaqpRGqFeDV9ZucW4zOCzqECRYxNJkBhU254itzmQr+PswsVHuM9Ub QiMJMf+5B9yg1BwWd6a0dNl410vncwO2EgeTEVJYrNvUK/oXjPTeHMnF7tBrRMCNBNtH 0olxkZjsPKYiug0YnbwgAS5Qrc1zJ9CKm2mJQ+smBpy9FRx8HG5OLK5NNTx2jspPusHP jfgISKe9sYEd4By81PKzccvAONF2EWeaoNsBTDITAwS9jj8jj5cLP5syjVBDRdPisH1T potw== X-Gm-Message-State: APjAAAWXWmnTc6lfEsSqTJP6FsXjnHcCdUEjGc1ZNWW/qbpQNUQefUQf lr2TyaXGIinZoj9t54eeK1c= X-Google-Smtp-Source: APXvYqwe0MAMsJV3tx3d7ATm0IHWjBwTcTq8reGe9jUAInE/CHaohM4QfefnP5DgQQiX2oa9DVkM6w== X-Received: by 2002:a65:448a:: with SMTP id l10mr8152208pgq.327.1565193518576; Wed, 07 Aug 2019 08:58:38 -0700 (PDT) Received: from [10.128.64.149] ([136.60.227.81]) by smtp.gmail.com with ESMTPSA id s20sm103523699pfe.169.2019.08.07.08.58.37 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 07 Aug 2019 08:58:37 -0700 (PDT) From: Bret Jordan Message-Id: Content-Type: multipart/alternative; boundary="Apple-Mail=_86965A6D-F66D-4A47-8066-27978CBFC2E4" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Wed, 7 Aug 2019 09:58:35 -0600 In-Reply-To: Cc: Joe Abley , Mikael Abrahamsson , Alec Muffett , ADD Mailing list , Tommy Jensen , Ralf Weber , Paul Wouters , Stephen Farrell To: "Deen, Glenn (NBCUniversal)" References: <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> <64bcfc51-6f3d-ae24-4de5-d0eb89975c66@cs.tcd.ie> <539D6F9D-137C-4F68-A8DE-EA3DFAF4D827@huitema.net> <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <206EEFEA-178A-462A-B6EE-AC2389D54B43@hopcount.ca> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Aug 2019 15:58:42 -0000 --Apple-Mail=_86965A6D-F66D-4A47-8066-27978CBFC2E4 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Really great points Glenn. Thanks, Bret PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 "Without cryptography vihv vivc ce xhrnrw, however, the only thing that = can not be unscrambled is an egg." > On Aug 7, 2019, at 9:22 AM, Deen, Glenn (NBCUniversal) = wrote: >=20 >=20 >=20 > On Aug 7, 2019, at 6:48 AM, Joe Abley wrote: >=20 >>> On 7 Aug 2019, at 00:48, Bret Jordan wrote: >>>=20 >>> I for one am terrified of the possibility of mass centralization of = DNS traffic. >>=20 >> Two dozen resolver systems are responsible for some 80% of all = traffic seen at ORG servers, today. Somewhere between 15 and 20% of all = end-user systems use Google Public DNS for resolution. This already = feels like mass centralisation to me. >>=20 >> Apologies if I've triggered any terror. >=20 > Joe >=20 > While the top 80% being from 2 dozen resolvers there are others = statistics that would be interesting and perhaps a good measurement of = current DNS Resolver diversity.=20 >=20 > We know there are a great many small resolvers in the world ranging = from those run by large and small corporate and organization IT, medium = and small ISPs, all the way down those run by individuals. =20 >=20 > Individually they don=E2=80=99t generate a lot of traffic, but they = that=E2=80=99s ok as DNS was never designed to be centralized. Broad = diversity has long been a fundamental strength of the system. =20 >=20 > The actual exact number of these long tail resolvers isn=E2=80=99t yet = known but some estimates have put it in the 1 million to maybe 5-10 = million range. It could even be higher. This large number of first = level resolvers represents an element of great diversity which = strengthens the DNS for users.=20 >=20 > So if you=E2=80=99re looking at data is it possible to say how big the = tail is? After the first 80%, how many different resolvers show up in = the next 5%, 10%, 15%, 20% buckets? What=E2=80=99s the total number of = diverse resolvers? >=20 > For while measuring big users is a good measure of centralization, = measuring small is perhaps a good measure of today=E2=80=99s = infrastructural diversity and resiliency.=20 >=20 > -glenn --Apple-Mail=_86965A6D-F66D-4A47-8066-27978CBFC2E4 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Really great points Glenn.


Thanks,
Bret
PGP = Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 = 0050
"Without = cryptography vihv vivc ce xhrnrw, however, the only thing that can not = be unscrambled is an = egg."

On Aug 7, 2019, at 9:22 AM, Deen, Glenn (NBCUniversal) <Glenn.Deen@nbcuni.com> wrote:



On Aug 7, 2019, at 6:48 AM, Joe Abley <jabley@hopcount.ca> = wrote:

On 7 Aug 2019, at 00:48, = Bret Jordan <jordan.ietf@gmail.com> wrote:

I for one am terrified of the possibility of mass = centralization of DNS traffic.

Two dozen resolver systems are responsible for some 80% of = all traffic seen at ORG servers, today. Somewhere between 15 and 20% of = all end-user systems use Google Public DNS for resolution. This already = feels like mass centralisation to me.

Apologies if I've triggered any terror.

Joe

While the top 80% being from 2 dozen resolvers there are = others statistics that would be interesting and perhaps a good = measurement of current DNS Resolver diversity.

We know there are a great many small resolvers in the world = ranging from those run by large and small corporate and organization IT, = medium and small ISPs, all the  way down those run by individuals. =   

Individually they don=E2=80=99t = generate a lot of traffic, but they that=E2=80=99s ok as DNS was never = designed to be centralized. Broad diversity has long been a fundamental = strength of the system.  

The actual = exact number of these long tail resolvers isn=E2=80=99t yet known but = some estimates have put it in the 1 million to maybe 5-10 million range. =  It could even be higher.   This large number of first = level resolvers represents an element of great diversity which = strengthens the DNS for users.

So if = you=E2=80=99re looking at data is it possible to say how big the tail = is?  After the first 80%, how many different resolvers show up in = the next 5%, 10%, 15%, 20% buckets?  What=E2=80=99s the total = number of diverse resolvers?

For while = measuring big users is a good measure of centralization, measuring small = is perhaps a good measure of today=E2=80=99s infrastructural diversity = and resiliency.

-glenn =

= --Apple-Mail=_86965A6D-F66D-4A47-8066-27978CBFC2E4-- From nobody Wed Aug 7 09:07:18 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B95E01203DC for ; Wed, 7 Aug 2019 09:07:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aGRCaVpjAt4a for ; Wed, 7 Aug 2019 09:07:15 -0700 (PDT) Received: from shaun.rfc1035.com (shaun.rfc1035.com [93.186.33.42]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3E9B412012D for ; Wed, 7 Aug 2019 09:07:15 -0700 (PDT) Received: from gromit.rfc1035.com (gromit.rfc1035.com [195.54.233.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by shaun.rfc1035.com (Postfix) with ESMTPSA id D537E242109D; Wed, 7 Aug 2019 16:07:12 +0000 (UTC) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) From: Jim Reid In-Reply-To: <841102D9-4B50-4415-8193-FF3766F91958@gmail.com> Date: Wed, 7 Aug 2019 17:07:12 +0100 Cc: ADD Mailing list Content-Transfer-Encoding: quoted-printable Message-Id: References: <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> <64bcfc51-6f3d-ae24-4de5-d0eb89975c66@cs.tcd.ie> <539D6F9D-137C-4F68-A8DE-EA3DFAF4D827@huitema.net> <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <841102D9-4B50-4415-8193-FF3766F91958@gmail.com> To: Bret Jordan X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: [Add] HTTP privacy considerations for DoH Clients X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Aug 2019 16:07:17 -0000 > On 7 Aug 2019, at 16:42, Bret Jordan wrote: >=20 > An app or client could add additional http headers. It could add a = unique ID for each app or client, it could add in geo-location data, it = could all kinds of things. =20 Indeed. IMO this sort of behaviour is something the IETF should work on: = some do=E2=80=99s and don=E2=80=99ts on privacy issues for DoH clients. = Which WG is most appropriate? Apologies yet again for another meaningful and relevant Subject: header. = I=E2=80=99m hoping that practice will catch on. :-) From nobody Wed Aug 7 09:10:49 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4AEDB1205DA for ; Wed, 7 Aug 2019 09:10:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3ng7DQZ5PxHI for ; Wed, 7 Aug 2019 09:10:38 -0700 (PDT) Received: from mx0a-00191d01.pphosted.com (mx0b-00191d01.pphosted.com [67.231.157.136]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7104D1205B4 for ; Wed, 7 Aug 2019 09:10:38 -0700 (PDT) Received: from pps.filterd (m0049459.ppops.net [127.0.0.1]) by m0049459.ppops.net-00191d01. (8.16.0.27/8.16.0.27) with SMTP id x77FkM3B022732; Wed, 7 Aug 2019 12:10:34 -0400 Received: from alpi154.enaf.aldc.att.com (sbcsmtp6.sbc.com [144.160.229.23]) by m0049459.ppops.net-00191d01. with ESMTP id 2u81cq15re-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 07 Aug 2019 12:10:33 -0400 Received: from enaf.aldc.att.com (localhost [127.0.0.1]) by alpi154.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id x77GAWiS001569; Wed, 7 Aug 2019 12:10:33 -0400 Received: from zlp30484.vci.att.com (zlp30484.vci.att.com [135.47.91.179]) by alpi154.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id x77GAJTi000988 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Wed, 7 Aug 2019 12:10:19 -0400 Received: from zlp30484.vci.att.com (zlp30484.vci.att.com [127.0.0.1]) by zlp30484.vci.att.com (Service) with ESMTP id 5F3884009E7D; Wed, 7 Aug 2019 16:10:19 +0000 (GMT) Received: from GAALPA1MSGHUBAE.ITServices.sbc.com (unknown [130.8.218.154]) by zlp30484.vci.att.com (Service) with ESMTPS id 4A4854009E7A; Wed, 7 Aug 2019 16:10:19 +0000 (GMT) Received: from GAALPA1MSGUSRBF.ITServices.sbc.com ([169.254.5.84]) by GAALPA1MSGHUBAE.ITServices.sbc.com ([130.8.218.154]) with mapi id 14.03.0439.000; Wed, 7 Aug 2019 12:10:18 -0400 From: "STARK, BARBARA H" To: "'Stephen Farrell'" , "'Livingood, Jason'" , "'Rob Sayre'" CC: "'ADD Mailing list'" Thread-Topic: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] Thread-Index: AQHVRBOF/sVF1Z+bs0apA0BYlPIZrabe21EAgAAO7gCAACA1AIABBgcAgAAx2YCAAccgAIAABO0AgALs5ICAAEqVgIAAFY4AgAAY2wCAABS6gIAACREAgADPuwCAABT8AIAACQWAgAALpICAAD92gIAIpseAgAAdfYCAAAUlAIAAAqSAgACBHwCAAANxgP//x7Xw Date: Wed, 7 Aug 2019 16:10:18 +0000 Message-ID: <2D09D61DDFA73D4C884805CC7865E6114E258238@GAALPA1MSGUSRBF.ITServices.sbc.com> References: <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <7C8A89C4-FBE9-40B7-8A17-98A247F1F156@cable.comcast.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [135.70.248.192] Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-08-07_03:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_policy_notspam policy=outbound_policy score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1011 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1906280000 definitions=main-1908070162 Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Aug 2019 16:10:45 -0000 PiA+IHRoZXJlIGlzIGVub3VnaCBvZiBhIGNyaXRpY2FsIG1hc3Mgb2YgZm9sa3Mgd2l0aCByb3Vn aCBjb25zZW5zdXMgb24NCj4gPiB0aGlzIHN1YmplY3QNCj4gDQo+IEkgZG9uJ3QgYmVsaWV2ZSB3 ZSBoYXZlIGEgY29uc2Vuc3VzLWNhbGxlciB0byBoYW5kIGZvciB0aGlzIHNvIGRvbid0IHNlZSBo b3cNCj4geW91IGNhbiBiZSBjb25maWRlbnQgaW4gdGhhdC4gQXMgaXQgaGFwcGVucywgYW5kIGZ3 aXcsIEknbSBwcmV0dHkgc3VyZSBJIHNlZSBhDQo+IGZhaXIgYml0IG9mIGEgbGFjayBvZiBjb25z ZW5zdXMgYXMgd2VsbC4gKFRob3VnaCBsaWtlIHVzIGFsbCBvbiB0aGlzIGxpc3QsIEknbSBqdXN0 DQo+IGFub3RoZXIgc3Vic2NyaWJlciwgdGhpcyBub3QgYmVpbmcgYSBXRyBsaXN0IG9yIGFueXRo aW5nLikNCg0KQW5kIGdpdmVuIElFVEYgc3RydWN0dXJlICh3aGVyZSBXRyBjaGFpcnMgZ2V0IGZp cnN0IGNyYWNrIGF0IGNhbGxpbmcgY29uc2Vuc3VzIHdpdGhpbiBhIFdHKSwgdGhpcyBpcyB3aHkg SSBzdWdnZXN0ZWQgc29tZW9uZSB3aG8gYWN0dWFsbHkgb3BlcmF0ZXMgYSBuZXR3b3JrIHNob3Vs ZCBiZSBhIGNoYWlyICh3aGVyZXZlciB3b3JrIGdldHMgZG9uZSkuIEdpdmVuIGhvdyBsaXR0bGUg aW5mbHVlbmNlIG5ldHdvcmsgb3BlcmF0b3JzIGhhdmUgaW4gSUVURiwgaG93IGZyZXF1ZW50bHkg b3BlcmF0aW9uYWwgY29uY2VybnMgYXJlIGlnbm9yZWQgb3IgZGlzbWlzc2VkIGFzIG5vdCBiZWlu ZyB3b3J0aHkgb2YgY29uc2lkZXJhdGlvbiwgYW5kIGhvdyBpbnN1bHRpbmcgYW5kIGluZmxhbW1h dG9yeSBsYW5ndWFnZSB0b3dhcmRzIGFsbCBvcGVyYXRvcnMgKGFuZCwgYnkgYXNzb2NpYXRpb24s IGFsbCBwZW9wbGUgZW1wbG95ZWQgYnkgYWxsIG9wZXJhdG9ycykgaXMgb2Z0ZW4gdG9sZXJhdGVk IGFuZCBub3QgY2FsbGVkIG91dCBvciBkaXNjb3VyYWdlZCBieSBsaXN0IG1vZGVyYXRvcnMsIEkg YWdyZWUgdGhhdCB3ZSBuZWVkIHRvIHdhaXQgYW5kIHNlZSB3aGF0IHRoZSBJRVNHIGRlY2lkZXMg YmVmb3JlIHN1Z2dlc3RpbmcgdGhlcmUgaGFzIGJlZW4gYSBkZWNpc2lvbiByZWdhcmRpbmcgImNv bnNlbnN1cyIuIA0KDQpCYXJiYXJhDQo= From nobody Wed Aug 7 09:21:28 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2D3671204AC for ; Wed, 7 Aug 2019 09:21:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YzPb7N0tToYU for ; Wed, 7 Aug 2019 09:21:21 -0700 (PDT) Received: from mail-pl1-x635.google.com (mail-pl1-x635.google.com [IPv6:2607:f8b0:4864:20::635]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C91BA1203ED for ; Wed, 7 Aug 2019 09:21:21 -0700 (PDT) Received: by mail-pl1-x635.google.com with SMTP id 4so34545365pld.10 for ; Wed, 07 Aug 2019 09:21:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=l2PV44t4q6mBplYVmB0C8CneKbpw3vm9DMiAcqFY5Ns=; b=shexyg5/lpklxO7076AOBSlXlOg/zNuYwJMdwYUOWXNYgv035jQlhbBns462Ca5Ys6 oDnmcnT0ezAxmwK7z+QIksKuhXyQcsH8urAasISPFkPz6Jzr5MdRAbY9QxGynr51ZLAy Sv0ekz/y3uPARlJNtY0CbLEKQPPjjGyEII1/KbLuuueGfTXCR+xvQSRgOXGxODktkXSN CIZrTWLoytek/iBDqogOsL1R717o34B6hPol9Vnsnw86eFsHeg/bmux30GZxLfDTKmfA om+DOlPKKc1pTEdAb7eejCnQ6k77bz66R8e/t+rRnCnadeFfsJRwrvX/AVXgBTszY9tN PT5g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=l2PV44t4q6mBplYVmB0C8CneKbpw3vm9DMiAcqFY5Ns=; b=ohlwk0y4Efk9+lTNHQa9DHCxJQiNrLioz6XlQ/X/VrwIR0TkTMYX7Jqby4/kqUiUVG kj3GokXZBW6WnMpGDy5uMOYPCaerKI0I80dtSlevJ9/VO/AuqdUpsFGuwBfgo1aTcmsD qxfVjQrhJfk5HPw0Z+FT8brrUwN3dRRYmByyUkTxlE9hoG6J0vKw6nc+94APaa3yert3 AXyWtnQwzM9tsBUDahKO+sZau5PFqUxHCp/cFSRO8ytilQc3ZWmmlwtr9i5frtzJtzKd bpkJ5DfpsgsBumKK0PM1t4P57GHxFtqBI8oR9YE+YKaIEhNmLEjnDEYY5y7tui4IAaDB DEOA== X-Gm-Message-State: APjAAAVv/s3Fdkhmgdpqex8g1pSs4djoCivMfHAvifh35OraDszhi56l YvAQpIabZplmGHsGaXCPoUI= X-Google-Smtp-Source: APXvYqx4RrlOBAZSoJS6Ig1zJH/sGunPongYU+oWzmzIOTtA39Oy/LpKymTbdWNF1hS8kZI4NAGNhw== X-Received: by 2002:a63:5945:: with SMTP id j5mr8357253pgm.452.1565194881309; Wed, 07 Aug 2019 09:21:21 -0700 (PDT) Received: from [10.128.64.149] ([136.60.227.81]) by smtp.gmail.com with ESMTPSA id x25sm125403932pfa.90.2019.08.07.09.21.20 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 07 Aug 2019 09:21:20 -0700 (PDT) From: Bret Jordan Message-Id: <9CDC84AE-9F09-45F1-8186-B16B530145EB@gmail.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_6A912D6B-0E12-4465-94B1-3389E7B687E0" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Wed, 7 Aug 2019 10:21:18 -0600 In-Reply-To: <2D09D61DDFA73D4C884805CC7865E6114E258238@GAALPA1MSGUSRBF.ITServices.sbc.com> Cc: Stephen Farrell , "Livingood, Jason" , Rob Sayre , ADD Mailing list To: "STARK, BARBARA H" References: <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <7C8A89C4-FBE9-40B7-8A17-98A247F1F156@cable.comcast.com> <2D09D61DDFA73D4C884805CC7865E6114E258238@GAALPA1MSGUSRBF.ITServices.sbc.com> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Aug 2019 16:21:24 -0000 --Apple-Mail=_6A912D6B-0E12-4465-94B1-3389E7B687E0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii I agree 100% Barbara.=20 Thanks, Bret PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 "Without cryptography vihv vivc ce xhrnrw, however, the only thing that = can not be unscrambled is an egg." > On Aug 7, 2019, at 10:10 AM, STARK, BARBARA H wrote: >=20 >>> there is enough of a critical mass of folks with rough consensus on >>> this subject >>=20 >> I don't believe we have a consensus-caller to hand for this so don't = see how >> you can be confident in that. As it happens, and fwiw, I'm pretty = sure I see a >> fair bit of a lack of consensus as well. (Though like us all on this = list, I'm just >> another subscriber, this not being a WG list or anything.) >=20 > And given IETF structure (where WG chairs get first crack at calling = consensus within a WG), this is why I suggested someone who actually = operates a network should be a chair (wherever work gets done). Given = how little influence network operators have in IETF, how frequently = operational concerns are ignored or dismissed as not being worthy of = consideration, and how insulting and inflammatory language towards all = operators (and, by association, all people employed by all operators) is = often tolerated and not called out or discouraged by list moderators, I = agree that we need to wait and see what the IESG decides before = suggesting there has been a decision regarding "consensus".=20 >=20 > Barbara > --=20 > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add --Apple-Mail=_6A912D6B-0E12-4465-94B1-3389E7B687E0 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii I = agree 100% Barbara. 


Thanks,
Bret
PGP = Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 = 0050
"Without = cryptography vihv vivc ce xhrnrw, however, the only thing that can not = be unscrambled is an = egg."

On Aug 7, 2019, at 10:10 AM, STARK, BARBARA H <bs7652@att.com> = wrote:

there is enough of a critical mass of folks with rough = consensus on
this subject

I don't believe we have a consensus-caller to hand for this = so don't see how
you can be confident in that. As it = happens, and fwiw, I'm pretty sure I see a
fair bit of a = lack of consensus as well. (Though like us all on this list, I'm just
another subscriber, this not being a WG list or anything.)

And given IETF structure (where = WG chairs get first crack at calling consensus within a WG), this is why = I suggested someone who actually operates a network should be a chair = (wherever work gets done). Given how little influence network operators = have in IETF, how frequently operational concerns are ignored or = dismissed as not being worthy of consideration, and how insulting and = inflammatory language towards all operators (and, by association, all = people employed by all operators) is often tolerated and not called out = or discouraged by list moderators, I agree that we need to wait and see = what the IESG decides before suggesting there has been a decision = regarding "consensus".

Barbara
--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add

= --Apple-Mail=_6A912D6B-0E12-4465-94B1-3389E7B687E0-- From nobody Wed Aug 7 09:22:37 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5296A12062B for ; Wed, 7 Aug 2019 09:22:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id B2weKsW9qTtD for ; Wed, 7 Aug 2019 09:22:23 -0700 (PDT) Received: from mx0a-00176a04.pphosted.com (mx0b-00176a04.pphosted.com [67.231.157.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 196B912063A for ; Wed, 7 Aug 2019 09:22:23 -0700 (PDT) Received: from pps.filterd (m0048208.ppops.net [127.0.0.1]) by m0048208.ppops.net-00176a04. (8.16.0.27/8.16.0.27) with SMTP id x77GHusx017647 for ; Wed, 7 Aug 2019 12:22:22 -0400 Received: from usushmgip001.mail.tfayd.com ([216.178.109.235]) by m0048208.ppops.net-00176a04. with ESMTP id 2u7yk7jtug-1 (version=TLSv1.2 cipher=RC4-SHA bits=128 verify=NOT) for ; Wed, 07 Aug 2019 12:22:21 -0400 Received: from unknown (HELO potemwp00026.mail.tfayd.com) ([10.40.33.204]) by usushmgip001.mail.tfayd.com with ESMTP; 07 Aug 2019 09:22:19 -0700 Received: from potemwp00031.mail.tfayd.com (100.124.56.55) by potemwp00041.mail.tfayd.com (100.124.56.65) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.669.32; Wed, 7 Aug 2019 10:22:18 -0600 Received: from potemwp00029.mail.tfayd.com (100.124.56.53) by potemwp00031.mail.tfayd.com (100.124.56.55) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.669.32; Wed, 7 Aug 2019 10:22:17 -0600 Received: from potemwp00029.mail.tfayd.com ([100.124.56.53]) by potemwp00029.mail.tfayd.com ([100.124.56.53]) with mapi id 15.01.0669.032; Wed, 7 Aug 2019 10:22:17 -0600 From: "Deen, Glenn (NBCUniversal)" To: Joe Abley CC: Bret Jordan , Mikael Abrahamsson , Alec Muffett , ADD Mailing list , Tommy Jensen , Ralf Weber , Paul Wouters , Stephen Farrell Thread-Topic: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] Thread-Index: AQHVRJA9OEBhy8mKSkG1+AboakEuZqbepjg4gACEyQCAAQYIAIAAMdmAgAHHHwCAAATuAIAC7OSAgABKlICAABWOAIAAGNwAgACJAJqAAHmCAIAACQWAgAALpICAAD92gIAIpseAgACWiQD//7YbGIAAbEGA//+kUEk= Date: Wed, 7 Aug 2019 16:22:17 +0000 Message-ID: <832A64ED-1BC7-4C28-9B7E-F14A6BF66C41@nbcuni.com> References: <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> <64bcfc51-6f3d-ae24-4de5-d0eb89975c66@cs.tcd.ie> <539D6F9D-137C-4F68-A8DE-EA3DFAF4D827@huitema.net> <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <206EEFEA-178A-462A-B6EE-AC2389D54B43@hopcount.ca> , <6940822E-8702-4CD0-99CE-49CAE38225D1@hopcount.ca> In-Reply-To: <6940822E-8702-4CD0-99CE-49CAE38225D1@hopcount.ca> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-exclaimer-md-config: 47edc00f-f2d6-45ef-be83-8a353bd47e45 Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-CFilter-Loop: Forward X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-08-07_04:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1906280000 definitions=main-1908070164 Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Aug 2019 16:22:25 -0000 Hi Joe > On Aug 7, 2019, at 8:50 AM, Joe Abley wrote: >=20 > While the top talkers are easy enough to identify as resolvers, that beco= mes a little more speculative when you consider the nature of initiators wh= o send one query every two weeks, for example: are those really resolvers w= ith a population of stub resolvers behind them? Is the population just real= ly small? Are the resolvers hopping between addresses? Are they doing somet= hing else? If we are asking the question of what=92s centralized and what=92s diversif= ied then it doesn=92t matter what they are - they aren=92t coming in via a = centralized pathway.=20 If we were to do this scientifically we might find the mean TTL of the reso= lved in each bucket and use a bracketed range of that (1,2 and 3 standard d= eviations) that to find a set of time intervals to look at.=20 >=20 > The rapid descent of the histogram into the noise floor still provides go= od support to the idea that *traffic* is centralised to a small number of c= lients, though, as viewed from the authoritative server. It does show that there is a number of big players - I=92m guessing it will= have mobile operators and some of the large ISPs in it, but that noise als= o tells us that there is an existing ecosystem of many diverse resolvers. =20 However this would be very very different from what the patterns form DoH w= ould look like. Diversity will drop off even lower and the long tail may co= mpletely vanish.=20 Glenn = From nobody Wed Aug 7 09:31:01 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7A13C120466 for ; Wed, 7 Aug 2019 09:31:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.499 X-Spam-Level: X-Spam-Status: No, score=-17.499 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SX7AkWjWPYeu for ; Wed, 7 Aug 2019 09:30:58 -0700 (PDT) Received: from mail-wr1-x434.google.com (mail-wr1-x434.google.com [IPv6:2a00:1450:4864:20::434]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0F8CA12015D for ; Wed, 7 Aug 2019 09:30:58 -0700 (PDT) Received: by mail-wr1-x434.google.com with SMTP id n9so92127865wru.0 for ; Wed, 07 Aug 2019 09:30:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=cRKbpd/+/T4hIdJeeNvRPW/gwFj7BhfThQg6VPg1kmg=; b=BPOHhwvz8zS2lRgZb+IlsiyPHiJQmH4DWE4O0QKjz8NniU/ZWSxRtfdtOj+3z4fDAC hUK+z6gakj6Hv746au8JO/wg96RyTyEbhrNH5SDNckERY1AWOzjKaOuO0cd3T8CMmprE lfTDKElneGg/gIrmFro/nYfs9j96s7R9hvZID9am91Rudn7ampFzUs1T0/lA5qsSnOtk s3SCg009jZH8LPqf15fD1QJ0cy5TxdJPUOtM/4ovTmVRuk4C85dFGPOWOTY0KOWCO3QI XskiCRg+BfKhSlqh35U4pzh/oZNwcDukCU/y3YYq8xuMgQpqvHsJLYICViwhXPiPjYnb P4ug== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=cRKbpd/+/T4hIdJeeNvRPW/gwFj7BhfThQg6VPg1kmg=; b=i+UQbOsqhWp4TrtF34ufKoAeOPIbA9/QJydfEir1z2ezQvOSnMmzvVJKiur67F/TUw NodHDj4wdxh4JrDJ26P4orSdwBijcbFDeGPC0cXp8fZ0L96HzfUUXNp5GGFiXsUrsVwf /2h3k0CpiSQcPumpiNdD1YFbgQviP5Xsv5gTRlhAmS6wALmhbEjXgyOQEivjUGXsgqj4 OSEyk+creKDc+ayRdD3kXZ1xN0lG4jF3Hbd6R4/Zq/p0OunCPLBMVk4TPQyvq1m1HVwY U+o21II2bgDtGxJgcKlqW1sJKotU0BvpvvOdRylvbj3Gf9QR0Y+YrLhShCPNvxL7bcpR nf5g== X-Gm-Message-State: APjAAAWvkzyKn6shJ1GJOi9nUoqn6hztrJzJnw+DhGJZlEQnOdrKpO+d fz0AdMOoYQmfcTlLM50fyHWQWnmQskESzcUWvoSHuw== X-Google-Smtp-Source: APXvYqzkuBRshqAS4drBnNv9U1YDJ1nLepUOeWOsVhAbWkwgGgzxTJECsyBDl0IjCylvgP5lJHHtzfl48vrmWtb5R+g= X-Received: by 2002:adf:80e1:: with SMTP id 88mr11496204wrl.127.1565195456205; Wed, 07 Aug 2019 09:30:56 -0700 (PDT) MIME-Version: 1.0 References: <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> <64bcfc51-6f3d-ae24-4de5-d0eb89975c66@cs.tcd.ie> <539D6F9D-137C-4F68-A8DE-EA3DFAF4D827@huitema.net> <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <841102D9-4B50-4415-8193-FF3766F91958@gmail.com> In-Reply-To: From: Eric Orth Date: Wed, 7 Aug 2019 12:30:44 -0400 Message-ID: To: Jim Reid Cc: Bret Jordan , ADD Mailing list Content-Type: multipart/alternative; boundary="0000000000002c34c4058f8977f9" Archived-At: Subject: Re: [Add] HTTP privacy considerations for DoH Clients X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Aug 2019 16:31:00 -0000 --0000000000002c34c4058f8977f9 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable (Thanks for branching off to another subject. I wanted to respond in the other thread when this was brought up, but it was kinda off-topic for most of what was being discussed there.) Agreed. There is certainly lots of room for a DoT or DoH client to unintentionally make bad privacy decisions. Publishing guidance and information can help ensure they have thought things through before they make privacy-affecting decisions. This is a very actionable area for IETF. I think there would be enough consensus on many areas of guidance (but obviously not all) to get a decent sized document. Not everything would necessarily be a hard and fast do or don't, as different tradeoffs may be relevant for different applications and use cases. That's okay since the important part is providing the information to help applications make the correct decisions for themselves. E.g., accepting cookies is one of the areas already briefly discussed in RFC8484, and I think it took the right approach: "HTTP cookies SHOULD NOT be accepted by DOH clients unless they are explicitly required by a use case." I think we need more guidance like that with more detail on the tradeoffs and considerations. It may seem obvious that applications should never send or accept cookies with DoH, but some special-purpose application may want to use DoH to send authentication information to a special-purpose DNS server that will only return information to authorized users. DoH and DNS are not limited just to the use case of browsers requesting addresses of all hostnames to be visited. On Wed, Aug 7, 2019 at 12:07 PM Jim Reid wrote: > > > > On 7 Aug 2019, at 16:42, Bret Jordan wrote: > > > > An app or client could add additional http headers. It could add a > unique ID for each app or client, it could add in geo-location data, it > could all kinds of things. > > Indeed. IMO this sort of behaviour is something the IETF should work on: > some do=E2=80=99s and don=E2=80=99ts on privacy issues for DoH clients. W= hich WG is most > appropriate? > > Apologies yet again for another meaningful and relevant Subject: header. > I=E2=80=99m hoping that practice will catch on. :-) > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --0000000000002c34c4058f8977f9 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
(Thanks for branching off to another subject.=C2=A0 I= wanted to respond in the other thread when this was brought up, but it was= kinda off-topic for most of what was being discussed there.)
Agreed.=C2=A0 There is certainly lots of room for a DoT or DoH clien= t to unintentionally make bad privacy decisions.=C2=A0 Publishing guidance = and information can help ensure they have thought things through before the= y make privacy-affecting decisions.=C2=A0 This is a very actionable area fo= r IETF.=C2=A0 I think there would be enough consensus on many areas of guid= ance (but obviously not all) to get a decent sized document.

=
Not everything would necessarily be a hard and fast do or don't, a= s different tradeoffs may be relevant for different applications and use ca= ses.=C2=A0 That's okay since the important part is providing the inform= ation to help applications make the correct decisions for themselves.=C2=A0= E.g., accepting cookies is one of the areas already briefly discussed in R= FC8484, and I think it took the right approach: "HTTP cookies SHOULD N= OT be accepted by DOH clients unless they are explicitly required by a use = case."=C2=A0 I think we need more guidance like that with more detail = on the tradeoffs and considerations.=C2=A0 It may seem obvious that applica= tions should never send or accept cookies with DoH, but some special-purpos= e application may want to use DoH to send authentication information to a s= pecial-purpose DNS server that will only return information to authorized u= sers.=C2=A0 DoH and DNS are not limited just to the use case of browsers re= questing addresses of all hostnames to be visited.

On Wed, Aug 7, 2019= at 12:07 PM Jim Reid <jim@rfc1035.co= m> wrote:


> On 7 Aug 2019, at 16:42, Bret Jordan <jordan.ietf@gmail.com> wrote:
>
> An app or client could add additional http headers.=C2=A0 It could add= a unique ID for each app or client, it could add in geo-location data, it = could all kinds of things.=C2=A0

Indeed. IMO this sort of behaviour is something the IETF should work on: so= me do=E2=80=99s and don=E2=80=99ts on privacy issues for DoH clients. Which= WG is most appropriate?

Apologies yet again for another meaningful and relevant Subject: header. I= =E2=80=99m hoping that practice will catch on. :-)

--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--0000000000002c34c4058f8977f9-- From nobody Wed Aug 7 09:32:30 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A37BF120466 for ; Wed, 7 Aug 2019 09:32:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=hopcount.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id K0h5CsugXgC3 for ; Wed, 7 Aug 2019 09:32:25 -0700 (PDT) Received: from mail-ot1-x32d.google.com (mail-ot1-x32d.google.com [IPv6:2607:f8b0:4864:20::32d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8461C12015D for ; Wed, 7 Aug 2019 09:32:25 -0700 (PDT) Received: by mail-ot1-x32d.google.com with SMTP id l15so106748575otn.9 for ; Wed, 07 Aug 2019 09:32:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hopcount.ca; s=google; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=kqlYgHM9iBtyOrpQGslbObV7AnN5blzt44vDwbX6Bsg=; b=dstsX64RhoFBDuUNUiAWACvOJDmmOZCTF4rBapNP3gpV9DaLCbATNMT2ccYqNWNuDq h7WkcyA50AehRRaOWEvSLdkebL8m0nesLVHyhIOf13Wf6WBFyhtI5vOFYndgK0FBrBmQ da8+wLNkvG8bRSKxi9o5N2z9EPiZYII2qgleg= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=kqlYgHM9iBtyOrpQGslbObV7AnN5blzt44vDwbX6Bsg=; b=GhlqXmHw0v2Fue489ZvmHlZ0U3Gpox9VWUlddyLdkmrziRwtBvWwgsIQCUCH2gnTuA W2/gvOEGt8mVjGnLkA3tIvPURsrkNOnNibqBvSZIOdwHWPV43XHE41LinEDz6rmV10Yi RDcS1bfKYKzwPf4VSk5wtaMq8vFYYNCuZexkOvRDxOPn1meqt0nyFJd2L10+u0RY+MmM Vc1oOoFsRipHIZxeOxsX5AE/abJ+K/5UYuXwURApo67MdkyRM8I7pE5DAW3Ny7dxhZLi wwXNkIyUnWQo827eE52tr+J5IvsszNNAdF+kyu83gaVOmTL7hUWKOOJ1NqZ9oLs2c9yg CLGg== X-Gm-Message-State: APjAAAVVot4GStPdQyfbWqRHdaIJnbQArdcj1XPHa7e6bWbLnrNsuDk5 fdm92AOAYyyEfASOSDLO4TAP+Q== X-Google-Smtp-Source: APXvYqyVPKArWTizeQEEAJamR6qNrddstUTqj2884K+whz2hGqyc5g5X1LmWj/oirgp5dGzcfopV2Q== X-Received: by 2002:a5d:8447:: with SMTP id w7mr10551374ior.197.1565195544610; Wed, 07 Aug 2019 09:32:24 -0700 (PDT) Received: from [192.168.1.50] (24-246-23-138.cable.teksavvy.com. [24.246.23.138]) by smtp.gmail.com with ESMTPSA id d25sm75196046iom.52.2019.08.07.09.32.22 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 07 Aug 2019 09:32:23 -0700 (PDT) From: Joe Abley Message-Id: Content-Type: multipart/signed; boundary="Apple-Mail=_08BD4CDD-10FC-4669-95A4-F5C6D5E1D605"; protocol="application/pgp-signature"; micalg=pgp-sha1 Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Wed, 7 Aug 2019 12:32:18 -0400 In-Reply-To: <832A64ED-1BC7-4C28-9B7E-F14A6BF66C41@nbcuni.com> Cc: Bret Jordan , Mikael Abrahamsson , Alec Muffett , ADD Mailing list , Tommy Jensen , Ralf Weber , Paul Wouters , Stephen Farrell To: "Deen, Glenn (NBCUniversal)" References: <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> <64bcfc51-6f3d-ae24-4de5-d0eb89975c66@cs.tcd.ie> <539D6F9D-137C-4F68-A8DE-EA3DFAF4D827@huitema.net> <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <206EEFEA-178A-462A-B6EE-AC2389D54B43@hopcount.ca> <6940822E-8702-4CD0-99CE-49CAE38225D1@hopcount.ca> <832A64ED-1BC7-4C28-9B7E-F14A6BF66C41@nbcuni.com> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Aug 2019 16:32:28 -0000 --Apple-Mail=_08BD4CDD-10FC-4669-95A4-F5C6D5E1D605 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Hey Glen, On 7 Aug 2019, at 12:22, Deen, Glenn (NBCUniversal) = wrote: > On Aug 7, 2019, at 8:50 AM, Joe Abley wrote: >=20 >> While the top talkers are easy enough to identify as resolvers, that = becomes a little more speculative when you consider the nature of = initiators who send one query every two weeks, for example: are those = really resolvers with a population of stub resolvers behind them? Is the = population just really small? Are the resolvers hopping between = addresses? Are they doing something else? >=20 > If we are asking the question of what=E2=80=99s centralized and = what=E2=80=99s diversified then it doesn=E2=80=99t matter what they are = - they aren=E2=80=99t coming in via a centralized pathway. For sure. The point I was trying to make (badly :-) was that the = relationship between observed upstream traffic and size of downstream = client base is not necessarily the same for clusters that we identify as = systems acting as resolvers as they are for clusters that might be doing = something else. > If we were to do this scientifically we might find the mean TTL of the = resolved in each bucket and use a bracketed range of that (1,2 and 3 = standard deviations) that to find a set of time intervals to look at. TTLs and re-query rates are certainly interesting, as are = diurnal/calendar effects, label counts in QNAMEs, QTYPE distribution, = ... Sebastian Castro used a large number of predictors in their work = doing cluster analysis of clients in NZ, trying to distinguish between = resolvers and non-resolvers. I found over 30 predictors were relevant in = trying to distinguish between actual resolvers with different end-user = populations without reference to source address. The patterns exist over = more dimensions than I was expecting, but they are there. >> The rapid descent of the histogram into the noise floor still = provides good support to the idea that *traffic* is centralised to a = small number of clients, though, as viewed from the authoritative = server. >=20 > It does show that there is a number of big players - I=E2=80=99m = guessing it will have mobile operators and some of the large ISPs in it, = but that noise also tells us that there is an existing ecosystem of many = diverse > resolvers. Of many diverse clients, certainly. > However this would be very very different from what the patterns form = DoH would look like. Diversity will drop off even lower and the long = tail may completely vanish. There's certainly much less variety in the population of clients doing = DoH today, and without a coherent discovery mechanism for DoH services, = most clients' selection of DoH service I think will be naturally biased = towards those that are well-known (those that are blessed by Mozilla, = for example; those that exist as examples in the stubby configuration = file). Transport between the application and the resolver is going to be hard = to determine using measurement at the authoritative server, however. The = lack of measurement points outside the DoH service provider and = application is kind of why everybody keeps getting their pitchforks out. Joe --Apple-Mail=_08BD4CDD-10FC-4669-95A4-F5C6D5E1D605 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iF0EARECAB0WIQSAt40QkiztAcvphdg0jwy9hlI6LAUCXUr9EgAKCRA0jwy9hlI6 LIZjAJ9o6s7Io2gFZCO+2DeYNLqRxY0RbwCgp6yy7MIl4nDfw5jWolL+BRXNkHw= =YdPD -----END PGP SIGNATURE----- --Apple-Mail=_08BD4CDD-10FC-4669-95A4-F5C6D5E1D605-- From nobody Wed Aug 7 09:33:31 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CC18F12063E for ; Wed, 7 Aug 2019 09:33:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yK-vgEU7JAfN for ; Wed, 7 Aug 2019 09:33:26 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0D494120439 for ; Wed, 7 Aug 2019 09:33:26 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 3A1FABE3E; Wed, 7 Aug 2019 17:33:24 +0100 (IST) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PWA1_8ErHcY7; Wed, 7 Aug 2019 17:33:22 +0100 (IST) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 9B6BBBE2F; Wed, 7 Aug 2019 17:33:22 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1565195602; bh=siMhqY3IqDXePWpvssbPrOVBiwRflUgo5Pu/XDlaqYY=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From; b=2ouIpfoFGUWkrHPwGPOZwk7q41D79TshLwx03uLzVnZP+BpM1NpjzY24UAITaw2uU 0L3X70/Fyq5vqTt5hsFWD0aJ5hF9J51YEbZMKn1iDJ9hy0+27hlId6wWFjklZLRG2x zN13M1rENbLCPCapBKk1b5NDPMxQAB/bJfP1wIkg= To: "Deen, Glenn (NBCUniversal)" , Joe Abley Cc: Bret Jordan , Alec Muffett , ADD Mailing list , Tommy Jensen , Ralf Weber , Paul Wouters , Mikael Abrahamsson References: <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <206EEFEA-178A-462A-B6EE-AC2389D54B43@hopcount.ca> <6940822E-8702-4CD0-99CE-49CAE38225D1@hopcount.ca> <832A64ED-1BC7-4C28-9B7E-F14A6BF66C41@nbcuni.com> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: <0f7559bf-cea5-8dc0-2ecd-838183905ef7@cs.tcd.ie> Date: Wed, 7 Aug 2019 17:33:19 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: <832A64ED-1BC7-4C28-9B7E-F14A6BF66C41@nbcuni.com> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="QiD1Oj67K3XtEHQ8TNafkj34GJul6op2Q" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Aug 2019 16:33:29 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --QiD1Oj67K3XtEHQ8TNafkj34GJul6op2Q Content-Type: multipart/mixed; boundary="bUoxiO9yTkY8hiMP2vNINjc2nfkhgmO7P"; protected-headers="v1" From: Stephen Farrell To: "Deen, Glenn (NBCUniversal)" , Joe Abley Cc: Bret Jordan , Alec Muffett , ADD Mailing list , Tommy Jensen , Ralf Weber , Paul Wouters , Mikael Abrahamsson Message-ID: <0f7559bf-cea5-8dc0-2ecd-838183905ef7@cs.tcd.ie> Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] References: <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> <64bcfc51-6f3d-ae24-4de5-d0eb89975c66@cs.tcd.ie> <539D6F9D-137C-4F68-A8DE-EA3DFAF4D827@huitema.net> <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <206EEFEA-178A-462A-B6EE-AC2389D54B43@hopcount.ca> <6940822E-8702-4CD0-99CE-49CAE38225D1@hopcount.ca> <832A64ED-1BC7-4C28-9B7E-F14A6BF66C41@nbcuni.com> In-Reply-To: <832A64ED-1BC7-4C28-9B7E-F14A6BF66C41@nbcuni.com> --bUoxiO9yTkY8hiMP2vNINjc2nfkhgmO7P Content-Type: multipart/mixed; boundary="------------CB6400871E47B34B56C661D4" Content-Language: en-GB This is a multi-part message in MIME format. --------------CB6400871E47B34B56C661D4 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hi Glenn, I'm confused sorry... On 07/08/2019 17:22, Deen, Glenn (NBCUniversal) wrote: > However this would be very very different from what the patterns form > DoH would look like. Diversity will drop off even lower and the long > tail may completely vanish. Joe's data was for traffic seen at some authoritative servers for .org IIUC. DoH is stub to recursive only. So I don't see how the use of DoH would or would not be reliably visible from those vantage points. (It may be visible now due to some specifics in how different DoH servers recurse I guess but presumably that'd be fairly brittle.) That said, 80% of queries to .org being from two dozen systems is fairly sad/scary/surprising so I'd love to see more info on that whenever that's ready. Cheers, S. --------------CB6400871E47B34B56C661D4 Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------CB6400871E47B34B56C661D4-- --bUoxiO9yTkY8hiMP2vNINjc2nfkhgmO7P-- --QiD1Oj67K3XtEHQ8TNafkj34GJul6op2Q Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAl1K/U8ACgkQWrL68XsX K+pakA//cAthyuvXnFpS5XAcYha0UQk7fYMRyr2hkW16hj1K5rFnhYKafqIMmuCE OFyN3Wz5jD2jhtmbyzNKc28Wvi32xI0tnQqegOvfXY6zM525t2b6BKbZWZXcr5C0 jaRg7k2JmK9LHxY8mlRfFesgu9yuYupyVzG6Z/LtXtnObJvllqpw91jhe+3bWAKm MjYFFQyNjW05P5vxgFRSpPTOJw1VBuEgTTShJH9f4w6H0zR4KnQTi2DYrlDMhzgW m8J1j7n0jMhgbtF56WCysvsuPwmVSDe88YKCqMf4gzSMLiMoP6pSzA2v8Ok2Q0+f WlBah1xdnuEFvXmrprghHfHCN6cIM59+uxWnTwcVrBoIddfiEcSMAfjr5f0JZqbo TeSejnEz4ZBa6ZEXbrtTiMSXg9rfyZFu5U05EovooOB4c38plFU8ERb9HYhGNRtu 1W7i0iuFfwe0dsN9b4gMuLymEw9fK6KQsI73RXo5Af7wom8PC+ZdrPR6g5DTmKYo DHExzxBq2/1LqNJ9I4lx418IP0j5YgXkpT0zhGYU0KuUMVP3beuhLLREEwF1VTco RCq5h5rHPI8IwbwZdkD1QucoCawnt5iJ1/1ChTnzP38e7WJvvn/KD2Zg8hl4IX/0 C3HDrk7gR1Df0sfV+LeFPTEkga5Hkd6qs+4EChe23JIObSAL7nE= =/6UM -----END PGP SIGNATURE----- --QiD1Oj67K3XtEHQ8TNafkj34GJul6op2Q-- From nobody Wed Aug 7 09:41:43 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A530A120683 for ; Wed, 7 Aug 2019 09:41:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pewArcLHkT3H for ; Wed, 7 Aug 2019 09:41:40 -0700 (PDT) Received: from mx0a-00176a04.pphosted.com (mx0a-00176a04.pphosted.com [67.231.149.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4C1C5120681 for ; Wed, 7 Aug 2019 09:41:40 -0700 (PDT) Received: from pps.filterd (m0047964.ppops.net [127.0.0.1]) by m0047964.ppops.net-00176a04. (8.16.0.27/8.16.0.27) with SMTP id x77Gblsb036851 for ; Wed, 7 Aug 2019 12:41:38 -0400 Received: from usaoamgip002.mail.tfayd.com ([173.213.212.136]) by m0047964.ppops.net-00176a04. with ESMTP id 2u7yknu6jw-1 (version=TLSv1.2 cipher=RC4-SHA bits=128 verify=NOT) for ; Wed, 07 Aug 2019 12:41:38 -0400 Received: from unknown (HELO potemwp00048.mail.tfayd.com) ([10.40.78.204]) by usaoamgip002.mail.tfayd.com with ESMTP; 07 Aug 2019 12:37:50 -0400 Received: from potemwp00028.mail.tfayd.com (100.124.56.52) by potemwp00025.mail.tfayd.com (100.124.56.49) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.669.32; Wed, 7 Aug 2019 10:41:35 -0600 Received: from potemwp00029.mail.tfayd.com (100.124.56.53) by potemwp00028.mail.tfayd.com (100.124.56.52) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.669.32; Wed, 7 Aug 2019 10:41:34 -0600 Received: from potemwp00029.mail.tfayd.com ([100.124.56.53]) by potemwp00029.mail.tfayd.com ([100.124.56.53]) with mapi id 15.01.0669.032; Wed, 7 Aug 2019 10:41:34 -0600 From: "Deen, Glenn (NBCUniversal)" To: Stephen Farrell CC: Bret Jordan , Rob Sayre , "Alec Muffett" , ADD Mailing list , "Tommy Jensen" , Ralf Weber , Paul Wouters , Mikael Abrahamsson Thread-Topic: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] Thread-Index: AQHVRJA9OEBhy8mKSkG1+AboakEuZqbepjg4gACEyQCAAQYIAIAAMdmAgAHHHwCAAATuAIAC7OSAgABKlICAABWOAIAAGNwAgACJAJqAAHmCAIAACQWAgAALpICAAD92gIAIpseAgAAdfICAAJkgAIAAAnSA//+piUc= Date: Wed, 7 Aug 2019 16:41:34 +0000 Message-ID: <576BC95C-7F00-45C9-9A43-BC184147E8DE@nbcuni.com> References: <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <841102D9-4B50-4415-8193-FF3766F91958@gmail.com>, <51f18426-d2fd-1be9-5556-fe079992acce@cs.tcd.ie> In-Reply-To: <51f18426-d2fd-1be9-5556-fe079992acce@cs.tcd.ie> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-exclaimer-md-config: 47edc00f-f2d6-45ef-be83-8a353bd47e45 Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-CFilter-Loop: Forward X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-08-07_04:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1906280000 definitions=main-1908070165 Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Aug 2019 16:41:42 -0000 > On Aug 7, 2019, at 8:51 AM, Stephen Farrell w= rote: >=20 > So, again, this is down to trusting the application code > as a DNS client that's allowed to talk to it's selected > recursive... or not. It's not really a DoT/DoH distinction. >=20 > That said, I do agree it'd be easier to accidentally enable > tracking via DoH, if one used some library or re-used some > code that did send cookies etc. And as the fine presentation > in pearg demonstrated, http session or other ancialliary > information may make it easier to do traffic analysis on > DoH vs. DoT. I'm not convinced either factor is a long term > thing though. One of the downsides of encryption is it will be much harder to actually au= dit the data being sent by applications to resolvers. =20 I=92m not against encryption, but I=92m bothered when things are encrypted = for my protection but are also invisible to me. =20 I=92m relatively sure there will be researchers who will make the effort = to keep the big browser makers honest, but the ability for others apps to a= dd DoH and undisclosed http headers for tracking is likely something we sho= uld expect to see in the future. This is a specific worry to DoH since it= =92s over http.=20 My point is that we shouldn=92t be complacent here and be too quick to dism= iss worries. Instead it would be nice if researchers were engaging now up f= ront to poke at things and explore where the abuse opportunities are.=20 Glenn=20 From nobody Wed Aug 7 09:51:25 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8B927120689 for ; Wed, 7 Aug 2019 09:51:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.299 X-Spam-Level: X-Spam-Status: No, score=-4.299 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3dY7ekCXQgO8 for ; Wed, 7 Aug 2019 09:51:22 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EDBAC120691 for ; Wed, 7 Aug 2019 09:51:20 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id CD062BE5B; Wed, 7 Aug 2019 17:51:18 +0100 (IST) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0RyK_cdbg6PA; Wed, 7 Aug 2019 17:51:16 +0100 (IST) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 82A19BE56; Wed, 7 Aug 2019 17:51:16 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1565196676; bh=X5AwjEwQ4Tl0gJShgJyscaJxFsw+T0IjzlXq08/7BeY=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From; b=whguqAtXD77wktA9kRIaC3aSChafWJlUKfit7JQuWEWNkk4+Gmy0vTREtEABqG37y vzb/p8s75x7PACuQXkdvwiYV729TK96SG2iXVD1NXcKjCFQUpDQJwoJftfiBl128lF MRI02uYK9WoHPcha5YIJkoWWDCuVue85i++fOCbA= To: "Deen, Glenn (NBCUniversal)" Cc: Paul Wouters , Bret Jordan , Alec Muffett , ADD Mailing list , Tommy Jensen , Ralf Weber , Rob Sayre , Mikael Abrahamsson References: <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <841102D9-4B50-4415-8193-FF3766F91958@gmail.com> <51f18426-d2fd-1be9-5556-fe079992acce@cs.tcd.ie> <576BC95C-7F00-45C9-9A43-BC184147E8DE@nbcuni.com> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: Date: Wed, 7 Aug 2019 17:51:15 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: <576BC95C-7F00-45C9-9A43-BC184147E8DE@nbcuni.com> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="yHa5aMzY7GJMODamcflC4sG9qBbLlgA6N" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Aug 2019 16:51:24 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --yHa5aMzY7GJMODamcflC4sG9qBbLlgA6N Content-Type: multipart/mixed; boundary="yIgd6pxVDJUJ811tIsmkrtlwct5XtIOwT"; protected-headers="v1" From: Stephen Farrell To: "Deen, Glenn (NBCUniversal)" Cc: Paul Wouters , Bret Jordan , Alec Muffett , ADD Mailing list , Tommy Jensen , Ralf Weber , Rob Sayre , Mikael Abrahamsson Message-ID: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] References: <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <841102D9-4B50-4415-8193-FF3766F91958@gmail.com> <51f18426-d2fd-1be9-5556-fe079992acce@cs.tcd.ie> <576BC95C-7F00-45C9-9A43-BC184147E8DE@nbcuni.com> In-Reply-To: <576BC95C-7F00-45C9-9A43-BC184147E8DE@nbcuni.com> --yIgd6pxVDJUJ811tIsmkrtlwct5XtIOwT Content-Type: multipart/mixed; boundary="------------D8428DE6DA8BAB580EE921EE" Content-Language: en-GB This is a multi-part message in MIME format. --------------D8428DE6DA8BAB580EE921EE Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hiya, On 07/08/2019 17:41, Deen, Glenn (NBCUniversal) wrote: >=20 >=20 >> On Aug 7, 2019, at 8:51 AM, Stephen Farrell >> wrote: >>=20 >> So, again, this is down to trusting the application code as a DNS >> client that's allowed to talk to it's selected recursive... or not. >> It's not really a DoT/DoH distinction. >>=20 >> That said, I do agree it'd be easier to accidentally enable=20 >> tracking via DoH, if one used some library or re-used some code >> that did send cookies etc. And as the fine presentation in pearg >> demonstrated, http session or other ancialliary information may >> make it easier to do traffic analysis on DoH vs. DoT. I'm not >> convinced either factor is a long term thing though. >=20 > One of the downsides of encryption is it will be much harder to > actually audit the data being sent by applications to resolvers. TBH I think you're badly conflating two independent things there. - concentration of sources for traffic to a TLD authoritative as reported by Joe - use of encrypted transports for DNS between stub and recursive Given the history of people claiming the sky is about to fall "because encryption," such conflation is IMO fairly unhelpful given we want a rational analysis of all this ADD stuff. Cheers, S. >=20 > I=E2=80=99m not against encryption, but I=E2=80=99m bothered when thing= s are > encrypted for my protection but are also invisible to me. >=20 > I=E2=80=99m relatively sure there will be researchers who will make the= > effort to keep the big browser makers honest, but the ability for > others apps to add DoH and undisclosed http headers for tracking is > likely something we should expect to see in the future. This is a > specific worry to DoH since it=E2=80=99s over http. >=20 > My point is that we shouldn=E2=80=99t be complacent here and be too qui= ck to > dismiss worries. Instead it would be nice if researchers were > engaging now up front to poke at things and explore where the abuse > opportunities are. >=20 > Glenn >=20 --------------D8428DE6DA8BAB580EE921EE Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------D8428DE6DA8BAB580EE921EE-- --yIgd6pxVDJUJ811tIsmkrtlwct5XtIOwT-- --yHa5aMzY7GJMODamcflC4sG9qBbLlgA6N Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAl1LAYMACgkQWrL68XsX K+q1gw/+PjslHMhsGFhBEW4YaOxoyoNiPEDfSfXZrPciqp57w6PUr1QoqI3du73m HEyIqetnnYNl4wKTbc0E4ma5QXandBqkND3TWz/2Lrpqhw1wBJi2r5lkDQyMG+kl gTaFb0LES8onrIonmHOp/nDrRHpJMFdLYqFg2dyr0QhracBZj3O2/RF5vR35JiTn ywjGFxRwQH3eOm8Kim1yY8IJkYRtxE4mpyLpY6HjzinjdSoOmvcuhw7GB5/7LIO3 FduCfkuPfkjioksAmJdIrNx2ZA+d32FElEwNyz9i3fymmTxtisgh5ZgiTVqbKoQp WDm9sGREYhgZXHx7vp9WJTl3L6FD5g9PuWGzPVG2Gw4Ytd8K5SDV7bKCr62LyHms eKC4YCDf4qLlcbjpFb1gCRaTbtKmSaUQg7GzTqBoCamfNDf21pQVVraW0CnSboUF gAJo3gGh7HpFjpBq+m+QJUSidKRauA74RxcawicWQAovCHFxywyOsbLepNnW1PP6 NHrx/8vTMB3XcotUyS8S1XW1hQs2Rw95bdGslc8ggI7foWACAnhoRRd0WpBvTH5P hUWo8wmrn7Sg5gUha0ZcMQ18ZlVZjCOQovTmxNFAMowT42PPmCbfmCGSgh+5jZ4i eD/bISDIxy/Us5iHLzrEDMSj1F2qBoDKNSjVUaEHE4q1/I7DSXo= =YXXA -----END PGP SIGNATURE----- --yHa5aMzY7GJMODamcflC4sG9qBbLlgA6N-- From nobody Wed Aug 7 09:55:32 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 65DDB1206A5 for ; Wed, 7 Aug 2019 09:55:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gItWD3TpwMX5 for ; Wed, 7 Aug 2019 09:55:30 -0700 (PDT) Received: from mx0a-00176a04.pphosted.com (mx0b-00176a04.pphosted.com [67.231.157.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 69C8D1206C4 for ; Wed, 7 Aug 2019 09:55:09 -0700 (PDT) Received: from pps.filterd (m0049465.ppops.net [127.0.0.1]) by mx0b-00176a04.pphosted.com (8.16.0.27/8.16.0.27) with SMTP id x77Gbj3q003125 for ; Wed, 7 Aug 2019 12:55:08 -0400 Received: from usushmgip002.mail.tfayd.com ([216.178.109.236]) by mx0b-00176a04.pphosted.com with ESMTP id 2u7yk63c21-1 (version=TLSv1.2 cipher=RC4-SHA bits=128 verify=NOT) for ; Wed, 07 Aug 2019 12:55:08 -0400 Received: from unknown (HELO potemwp00001.mail.tfayd.com) ([10.40.33.204]) by usushmgip002.mail.tfayd.com with ESMTP; 07 Aug 2019 09:55:06 -0700 Received: from potemwp00028.mail.tfayd.com (100.124.56.52) by potemwp00001.mail.tfayd.com (100.124.56.25) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.669.32; Wed, 7 Aug 2019 10:55:05 -0600 Received: from potemwp00029.mail.tfayd.com (100.124.56.53) by potemwp00028.mail.tfayd.com (100.124.56.52) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.669.32; Wed, 7 Aug 2019 10:55:04 -0600 Received: from potemwp00029.mail.tfayd.com ([100.124.56.53]) by potemwp00029.mail.tfayd.com ([100.124.56.53]) with mapi id 15.01.0669.032; Wed, 7 Aug 2019 10:55:04 -0600 From: "Deen, Glenn (NBCUniversal)" To: Stephen Farrell CC: Joe Abley , Bret Jordan , "Alec Muffett" , ADD Mailing list , "Tommy Jensen" , Ralf Weber , Paul Wouters , Mikael Abrahamsson Thread-Topic: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] Thread-Index: AQHVRJA9OEBhy8mKSkG1+AboakEuZqbepjg4gACEyQCAAQYIAIAAMdmAgAHHHwCAAATuAIAC7OSAgABKlICAABWOAIAAGNwAgACJAJqAAHmCAIAACQWAgAALpICAAD92gIAIpseAgACWiQD//7YbGIAAbEGA//+kUEmAAGeqgP//oYD1 Date: Wed, 7 Aug 2019 16:55:04 +0000 Message-ID: <518E4A8E-0A57-426A-A789-0CE8014FF433@nbcuni.com> References: <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <206EEFEA-178A-462A-B6EE-AC2389D54B43@hopcount.ca> <6940822E-8702-4CD0-99CE-49CAE38225D1@hopcount.ca> <832A64ED-1BC7-4C28-9B7E-F14A6BF66C41@nbcuni.com>, <0f7559bf-cea5-8dc0-2ecd-838183905ef7@cs.tcd.ie> In-Reply-To: <0f7559bf-cea5-8dc0-2ecd-838183905ef7@cs.tcd.ie> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-exclaimer-md-config: 47edc00f-f2d6-45ef-be83-8a353bd47e45 Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-CFilter-Loop: Forward X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-08-07_04:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1906280000 definitions=main-1908070165 Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Aug 2019 16:55:31 -0000 > On Aug 7, 2019, at 9:33 AM, Stephen Farrell w= rote: >=20 > I'm confused sorry... >=20 >> On 07/08/2019 17:22, Deen, Glenn (NBCUniversal) wrote: >> However this would be very very different from what the patterns form >> DoH would look like. Diversity will drop off even lower and the long >> tail may completely vanish. > Joe's data was for traffic seen at some authoritative > servers for .org IIUC. DoH is stub to recursive only. > So I don't see how the use of DoH would or would not > be reliably visible from those vantage points. (It may > be visible now due to some specifics in how different > DoH servers recurse I guess but presumably that'd be > fairly brittle.) >=20 > That said, 80% of queries to .org being from two dozen > systems is fairly sad/scary/surprising so I'd love to > see more info on that whenever that's ready. What I meant was that if the browsers are directing all their queries to a = small set of =93approved=94 DoH services then there traffic Joe observes wi= ll reduce that 2 dozen top senders down to 3, 4 ? approved DoH services wi= th quad 8 being the lions share? Glenn = From nobody Wed Aug 7 10:07:21 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F062F120437 for ; Wed, 7 Aug 2019 09:49:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=hopcount.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZQhvAf6mwWEa for ; Wed, 7 Aug 2019 09:49:12 -0700 (PDT) Received: from mail-ot1-x32a.google.com (mail-ot1-x32a.google.com [IPv6:2607:f8b0:4864:20::32a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A9426120689 for ; Wed, 7 Aug 2019 09:49:12 -0700 (PDT) Received: by mail-ot1-x32a.google.com with SMTP id b7so56745640otl.11 for ; Wed, 07 Aug 2019 09:49:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hopcount.ca; s=google; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=SnB9Y+StfIWTd3IHdPJViuqMNsjZXEG911SthbVQJas=; b=Q0d4FSydK69xEwO5y/5Ma8pbSuxlzNUpSZBDXIhhjqWLzO1EZ0ya76c7c5MS0lqG3X Ilfi8JsBrR47eytT8X2ouge1BwCr8H4VQfWZYT3yQfJyfutqANpn3LVkLdPbuvEhzoEB +xyrcr1a7tx0D962JRkNPGVoo0mbT450qEtUY= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=SnB9Y+StfIWTd3IHdPJViuqMNsjZXEG911SthbVQJas=; b=MIsJ8t8vIeuFsx62CD1W2Z3//asu0Ujh1FN10U6mmSV/N93Y7DwNf0qvr7ubDq26N5 SclLgEQVqz8NlQ1FnvoYfdjtrAmXbjsPxlK2nJ67PhUIK0P9OogfWuN/4j//0X7M8pY8 wikhXmpkHebgtwZwCGFryeOb/WNNnbqlTVaDe7dc7mmXiYwxy1b4i0TXNoqzb21Oh4Gy Nu28b6QuhlCxNUbdBCGvRqHkg0O1kbu8Xit8CHRIsnCG+OyCoNfBqkRkcAgVpLwzxfar 7cmsT8Ii93xDty4lX5A7k13m1zTWxzYaUhhK0Tj6sITEgYSR0QG675bFjV1Pu5tu0boN mLEQ== X-Gm-Message-State: APjAAAWtA1xluO95vZWmrmABqmavqBqZ84r3rB+XaLaZ9Et2WDvwaNTS cZWmjEebV35kElOKGDbrdYDKyg== X-Google-Smtp-Source: APXvYqwYkIDUbDkT2fgS4j7cnun7LhkmZQGQz1WesMEHrwmGfX7/lRFn1hMIEHX1Ygq9j9OigBQrVw== X-Received: by 2002:a02:9f07:: with SMTP id z7mr11087162jal.29.1565196551760; Wed, 07 Aug 2019 09:49:11 -0700 (PDT) Received: from [192.168.1.50] (24-246-23-138.cable.teksavvy.com. [24.246.23.138]) by smtp.gmail.com with ESMTPSA id m20sm89471063ioh.4.2019.08.07.09.49.09 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 07 Aug 2019 09:49:10 -0700 (PDT) From: Joe Abley Message-Id: <1651559C-E885-466D-994F-C9F8629672DE@hopcount.ca> Content-Type: multipart/signed; boundary="Apple-Mail=_1527A2A3-FF88-4A09-8D71-FDC9CC753498"; protocol="application/pgp-signature"; micalg=pgp-sha1 Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Wed, 7 Aug 2019 12:49:08 -0400 In-Reply-To: <576BC95C-7F00-45C9-9A43-BC184147E8DE@nbcuni.com> Cc: Stephen Farrell , Paul Wouters , Bret Jordan , Alec Muffett , ADD Mailing list , Tommy Jensen , Ralf Weber , Rob Sayre , Mikael Abrahamsson To: "Deen, Glenn (NBCUniversal)" References: <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <841102D9-4B50-4415-8193-FF3766F91958@gmail.com> <51f18426-d2fd-1be9-5556-fe079992acce@cs.tcd.ie> <576BC95C-7F00-45C9-9A43-BC184147E8DE@nbcuni.com> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: X-Mailman-Approved-At: Wed, 07 Aug 2019 10:07:20 -0700 Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Aug 2019 16:49:15 -0000 --Apple-Mail=_1527A2A3-FF88-4A09-8D71-FDC9CC753498 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 On 7 Aug 2019, at 12:41, Deen, Glenn (NBCUniversal) = wrote: > One of the downsides of encryption is it will be much harder to = actually audit the data being sent by applications to resolvers. >=20 > I=E2=80=99m not against encryption, but I=E2=80=99m bothered when = things are encrypted for my protection but are also invisible to me. >=20 > I=E2=80=99m relatively sure there will be researchers who will make = the effort to keep the big browser makers honest, but the ability for = others apps to add DoH and undisclosed http headers for tracking is = likely something we should expect to see in the future. This is a = specific worry to DoH since it=E2=80=99s over http. >=20 > My point is that we shouldn=E2=80=99t be complacent here and be too = quick to dismiss worries. Instead it would be nice if researchers were = engaging now up front to poke at things and explore where the abuse = opportunities are. Nicely put. Centralisation of resolution is already upon us (I claim, without = presenting right now to back it up, film in Austin). DoH may or may not make things more centralised, depending on how it is = implemented and used; however, I don't find a shift from almost entirely = centralised (now) to a bit more centralised (possible future) that much = of a concern. Relatively speaking, it's kind of the same thing. However, the nature of the data that is available for collection is (a) = potentially different and (b) hard to quantify if you're not a generator = or a collector. That's a change from today. I think that's interesting. Joe --Apple-Mail=_1527A2A3-FF88-4A09-8D71-FDC9CC753498 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iF0EARECAB0WIQSAt40QkiztAcvphdg0jwy9hlI6LAUCXUsBBAAKCRA0jwy9hlI6 LEaLAJwLldVZltAaEeAaiCELYRnbgfpIDQCfYJ7y9sOzMR9+vx8m6P+7exITC1U= =LdEi -----END PGP SIGNATURE----- --Apple-Mail=_1527A2A3-FF88-4A09-8D71-FDC9CC753498-- From nobody Wed Aug 7 10:07:28 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D01991206B5 for ; Wed, 7 Aug 2019 09:55:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.597 X-Spam-Level: X-Spam-Status: No, score=-2.597 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vDKgzXOJyIwT for ; Wed, 7 Aug 2019 09:55:25 -0700 (PDT) Received: from mx36-out10.antispamcloud.com (mx36-out10.antispamcloud.com [209.126.121.30]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3C80C1206A5 for ; Wed, 7 Aug 2019 09:54:42 -0700 (PDT) Received: from xse127.mail2web.com ([66.113.196.127] helo=xse.mail2web.com) by mx148.antispamcloud.com with esmtp (Exim 4.89) (envelope-from ) id 1hvPCF-000OlG-C4 for add@ietf.org; Wed, 07 Aug 2019 18:54:34 +0200 Received: from xsmtp22.mail2web.com (unknown [10.100.68.61]) by xse.mail2web.com (Postfix) with ESMTPS id 463cxW0D9Rz4gJt for ; Wed, 7 Aug 2019 09:52:31 -0700 (PDT) Received: from [10.5.2.49] (helo=xmail11.myhosting.com) by xsmtp22.mail2web.com with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.92) (envelope-from ) id 1hvPAs-0003ew-Tf for add@ietf.org; Wed, 07 Aug 2019 09:52:30 -0700 Received: (qmail 16669 invoked from network); 7 Aug 2019 16:52:30 -0000 Received: from unknown (HELO [192.168.1.101]) (Authenticated-user:_huitema@huitema.net@[172.58.43.192]) (envelope-sender ) by xmail11.myhosting.com (qmail-ldap-1.03) with ESMTPA for ; 7 Aug 2019 16:52:30 -0000 Content-Type: multipart/alternative; boundary=Apple-Mail-119C58B4-D2FC-4632-BEEC-6ED15E52C6DD Mime-Version: 1.0 (1.0) From: Christian Huitema X-Mailer: iPhone Mail (16F203) In-Reply-To: <0f7559bf-cea5-8dc0-2ecd-838183905ef7@cs.tcd.ie> Date: Wed, 7 Aug 2019 09:52:29 -0700 Cc: "Deen, Glenn (NBCUniversal)" , Joe Abley , Bret Jordan , Alec Muffett , ADD Mailing list , Tommy Jensen , Ralf Weber , Paul Wouters , Mikael Abrahamsson Content-Transfer-Encoding: 7bit Message-Id: <5519A299-111F-49D6-90EA-92CB96EA44B6@huitema.net> References: <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <206EEFEA-178A-462A-B6EE-AC2389D54B43@hopcount.ca> <6940822E-8702-4CD0-99CE-49CAE38225D1@hopcount.ca> <832A64ED-1BC7-4C28-9B7E-F14A6BF66C41@nbcuni.com> <0f7559bf-cea5-8dc0- 2ecd-838183905ef7@cs.tcd.ie> To: Stephen Farrell X-Originating-IP: 66.113.196.127 X-Spampanel-Domain: xsmtpout.mail2web.com X-Spampanel-Username: 66.113.196.127/32 Authentication-Results: antispamcloud.com; auth=pass smtp.auth=66.113.196.127/32@xsmtpout.mail2web.com X-Spampanel-Outgoing-Class: unsure X-Spampanel-Outgoing-Evidence: Combined (0.15) X-Recommended-Action: accept X-Filter-ID: Mvzo4OR0dZXEDF/gcnlw0YiRRkpbHZ8F3zevhEShTfypSDasLI4SayDByyq9LIhVUZbR67CQ7/vm /hHDJU4RXkTNWdUk1Ol2OGx3IfrIJKywOmJyM1qr8uRnWBrbSAGDNzOpszOkW3faMySFwG163+fH zJ6mVE7ewsipSVIfs4ZFWKIfqXGrvdIja00xstJ8gyWFxOA5dILPypvKxNVhWQwOVcNrdpWfEYrY fLBY3+fyO3R7+MmLKUvLY+RGMRrtPM2DmctUkuqITdPZ8a3LuY6jSvfpO+1kZkomjtjB6X5Q5Q9f RUeIpTIC2ySfqvnqLwoxlgatmaBb0rBiK9xbkDrUqzcKIief90MVLZY9LbIZh9+IQ1oS9LBn3VIP 95Jz7ujRlJ9wSMlhvaudJXZ9EIBG/qaR+8r9SKFMmPJLf850OvZYsmoVQuOIhwKLK6IKBNB4LZ0v UHHKTzJX7b1JhMjx7v77N42Z/zX3DQBtZa/0j9rMdVQseW3F+doIupqmER9E+btGG8Xk1uugE/FU 4J9TrjYo22Tif+7yfJXbGyN6EipRzMVZ5LqwTx7Vvn9SP+LiFhV9TEgXGI3XmDfDnMW3OYyuYMLR 58Y0/2y47glQ/tPi2EEKXkCs9GpwdRVQtUXTEHSY8JoJ0uYl+kFpnzKR6RgQ6scM/oDJnhhySxkZ M6TpO7gdhmtCfBcLOq9jmhlKb/lC+C9AijoWgc8vkIGThCScvU0cCIiHSQbmcVJ6Cyt+e5qL1vj4 zjUrENfqN+qh3YF7t/lvtNmPz3Nh3qX1ClsKnu8bsKu+3RocdLvq4idb3ogtFUoyerx6ROu4XPWl FdaGOH191uXjgjQN/RTaYTLUj/RFhcnr3QktcdhfT0PKkYgq2bf8VggE/O1M1vEjHyvS2QZiR+AZ YvfxEvZFKu+ZM2mB1CpThxyaBpbeNHk15VolAGHS5rCXQKDyCQUljhSWDhWh87HBSLhNUo4qiB0X MVQG2R7iUfOzATaF5R3hQJk8CwyURYKQ0Ye0iR3bHfnMCIEU+nrglojKwJanfcoq9IsR6l/OZb9V MEM= X-Report-Abuse-To: spam@quarantine9.antispamcloud.com Archived-At: X-Mailman-Approved-At: Wed, 07 Aug 2019 10:07:20 -0700 Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Aug 2019 16:55:28 -0000 --Apple-Mail-119C58B4-D2FC-4632-BEEC-6ED15E52C6DD Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable =20 > On Aug 7, 2019, at 9:33 AM, Stephen Farrell wr= ote: >=20 > That said, 80% of queries to .org being from two dozen > systems is fairly sad/scary/surprising so I'd love to > see more info on that whenever that's ready. The ICANN/ITHI project has been collecting a variety of metrics since 2018. O= ne of those is an analysis of resolver behavior, in cooperation with APNIC: h= ttps://ithi.research.icann.org/graph-m5.html. The figures that we have confi= rm the long tailed nature of the resolver distribution. The 10000 largest re= solvers account for 92.5% of eyeballs. We are working to provide better characterization of the resolver population= , such as grouping resolvers based on autonomous system number. Note that the %of eyeballs numbers that we collect are different from the % o= f queries mentioned here. The fraction of queries seen by servers depends he= avily on resolver behaviors such as caching and proactive fetching. It is no= t an unbiased estimator of resolver market share. -- Christian Huitema=20= --Apple-Mail-119C58B4-D2FC-4632-BEEC-6ED15E52C6DD Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable  

On Aug 7, 20= 19, at 9:33 AM, Stephen Farrell <stephen.farrell@cs.tcd.ie> wrote:

That said, 80% of queries to .org being from t= wo dozen
systems is fairly sad/scary/surprising so I'd love t= o
see more info on that whenever that's ready.
<= /blockquote>
The ICANN/ITHI project has been collecting a variety of= metrics since 2018. One of those is an analysis of resolver behavior, in co= operation with APNIC: https://ithi.research.icann.org/graph-m5.html. The figures that= we have confirm the long tailed nature of the resolver distribution. The 10= 000 largest resolvers account for 92.5% of eyeballs.

We are working to provide better characterization of the resolver populati= on, such as grouping resolvers based on autonomous system number.
=
Note that the %of eyeballs numbers that we collect are differ= ent from the % of queries mentioned here. The fraction of queries seen by se= rvers depends heavily on resolver behaviors such as caching and proactive fe= tching. It is not an unbiased estimator of resolver market share.
=
-- Christian Huitema 
= --Apple-Mail-119C58B4-D2FC-4632-BEEC-6ED15E52C6DD-- From nobody Wed Aug 7 10:07:35 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EA58412068B for ; Wed, 7 Aug 2019 10:06:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.679 X-Spam-Level: X-Spam-Status: No, score=-1.679 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_INVALID=0.1, DKIM_SIGNED=0.1, T_SPF_HELO_PERMERROR=0.01, T_SPF_PERMERROR=0.01, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=fail (1024-bit key) reason="fail (message has been altered)" header.d=nostrum.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HRtX6wKAkbkD for ; Wed, 7 Aug 2019 10:06:08 -0700 (PDT) Received: from nostrum.com (raven-v6.nostrum.com [IPv6:2001:470:d:1130::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 220D7120689 for ; Wed, 7 Aug 2019 10:06:08 -0700 (PDT) Received: from [10.0.0.205] (c-24-9-76-58.hsd1.co.comcast.net [24.9.76.58]) (authenticated bits=0) by nostrum.com (8.15.2/8.15.2) with ESMTPSA id x77H5vO8049731 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NO); Wed, 7 Aug 2019 12:05:58 -0500 (CDT) (envelope-from adam@nostrum.com) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=nostrum.com; s=default; t=1565197559; bh=/nl0qqtkqaDkyskVg7pctofI9CxfMZVUMEFJdK6mpCk=; h=Subject:From:In-Reply-To:Date:Cc:References:To; b=WGwgqB6iY6sYoKabOltaa9QND+lmDBWN53e1UHJ0FXBqaoSA44hXm44ZGuWom2N7y /2YNs26OMaVR8tsofLrB+KhTvhgHMATrjCqiJNszt0PGibq9IZ6cRartk4G6D9AH6o ENL79AMY9xKK2JoA/QFVWLay7Dk2rAtR6emkK4Qo= X-Authentication-Warning: raven.nostrum.com: Host c-24-9-76-58.hsd1.co.comcast.net [24.9.76.58] claimed to be [10.0.0.205] Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (1.0) From: Adam Roach X-Mailer: iPhone Mail (16F203) In-Reply-To: <576BC95C-7F00-45C9-9A43-BC184147E8DE@nbcuni.com> Date: Wed, 7 Aug 2019 11:05:52 -0600 Cc: Stephen Farrell , Paul Wouters , Bret Jordan , Alec Muffett , ADD Mailing list , Tommy Jensen , Ralf Weber , Rob Sayre , Mikael Abrahamsson Content-Transfer-Encoding: quoted-printable Message-Id: References: <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <841102D9-4B50-4415-8193-FF3766F91958@gmail.com> <51f18426-d2fd-! 1be9-5556-fe079992acce@cs.tcd.ie> <576BC95C-7F00-45C9-9A43-BC184147E8DE@nbcuni.com> To: "Deen, Glenn (NBCUniversal)" Archived-At: X-Mailman-Approved-At: Wed, 07 Aug 2019 10:07:20 -0700 Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Aug 2019 17:06:09 -0000 > On Aug 7, 2019, at 10:41, Deen, Glenn (NBCUniversal) wrote: >=20 > I=E2=80=99m relatively sure there will be researchers who will make the ef= fort to keep the big browser makers honest, but the ability for others apps t= o add DoH and undisclosed http headers for tracking is likely something we s= hould expect to see in the future. This is a specific worry to DoH since i= t=E2=80=99s over http. Thanks, Glenn. I think this is the first time I=E2=80=99ve seen this explain= ed clearly (outside of the malware case). Can you say more about these appli= cations and what the worst-case outcomes might be? My (possibly na=C3=AFve) v= iew is that such apps are typically vertically integrated and therefore have= much more damaging ways to track users, but it=E2=80=99s quite possible tha= t we=E2=80=99re thinking of two very different kinds of applications.=20 /a= From nobody Wed Aug 7 10:11:13 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C6FEF12027B for ; Wed, 7 Aug 2019 10:11:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OsG1dF0tFp2n for ; Wed, 7 Aug 2019 10:11:09 -0700 (PDT) Received: from mx0a-00176a04.pphosted.com (mx0a-00176a04.pphosted.com [67.231.149.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B17E6120192 for ; Wed, 7 Aug 2019 10:11:09 -0700 (PDT) Received: from pps.filterd (m0048276.ppops.net [127.0.0.1]) by m0048276.ppops.net-00176a04. (8.16.0.27/8.16.0.27) with SMTP id x77Gw5Nx003199 for ; Wed, 7 Aug 2019 13:11:09 -0400 Received: from usaoamgip002.mail.tfayd.com ([173.213.212.136]) by m0048276.ppops.net-00176a04. with ESMTP id 2u7yjxuwca-1 (version=TLSv1.2 cipher=RC4-SHA bits=128 verify=NOT) for ; Wed, 07 Aug 2019 13:11:09 -0400 Received: from unknown (HELO potemwp00034.mail.tfayd.com) ([10.40.78.204]) by usaoamgip002.mail.tfayd.com with ESMTP; 07 Aug 2019 13:07:18 -0400 Received: from potemwp00027.mail.tfayd.com (100.124.56.51) by potemwp00024.mail.tfayd.com (100.124.56.48) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.669.32; Wed, 7 Aug 2019 11:11:03 -0600 Received: from potemwp00029.mail.tfayd.com (100.124.56.53) by potemwp00027.mail.tfayd.com (100.124.56.51) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.669.32; Wed, 7 Aug 2019 11:11:02 -0600 Received: from potemwp00029.mail.tfayd.com ([100.124.56.53]) by potemwp00029.mail.tfayd.com ([100.124.56.53]) with mapi id 15.01.0669.032; Wed, 7 Aug 2019 11:11:02 -0600 From: "Deen, Glenn (NBCUniversal)" To: Stephen Farrell CC: Paul Wouters , Bret Jordan , "Alec Muffett" , ADD Mailing list , "Tommy Jensen" , Ralf Weber , Rob Sayre , Mikael Abrahamsson Thread-Topic: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] Thread-Index: AQHVRJA9OEBhy8mKSkG1+AboakEuZqbepjg4gACEyQCAAQYIAIAAMdmAgAHHHwCAAATuAIAC7OSAgABKlICAABWOAIAAGNwAgACJAJqAAHmCAIAACQWAgAALpICAAD92gIAIpseAgAAdfICAAJkgAIAAAnSA//+piUeAAGdJgP//oPIq Date: Wed, 7 Aug 2019 17:11:02 +0000 Message-ID: References: <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <841102D9-4B50-4415-8193-FF3766F91958@gmail.com> <51f18426-d2fd-1be9-5556-fe079992acce@cs.tcd.ie> <576BC95C-7F00-45C9-9A43-BC184147E8DE@nbcuni.com>, In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-exclaimer-md-config: 47edc00f-f2d6-45ef-be83-8a353bd47e45 Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-CFilter-Loop: Forward X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-08-07_04:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1906280000 definitions=main-1908070166 Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Aug 2019 17:11:11 -0000 > On Aug 7, 2019, at 9:51 AM, Stephen Farrell w= rote: >=20 > TBH I think you're badly conflating two independent things > there. >=20 > - concentration of sources for traffic to a TLD authoritative > as reported by Joe >=20 > - use of encrypted transports for DNS between stub and > recursive And between recursive resolvers too.=20 >=20 > Given the history of people claiming the sky is about to fall > "because encryption," such conflation is IMO fairly unhelpful > given we want a rational analysis of all this ADD stuff. I don=92t think I am conflating - certainly that=92s not my intent.=20 Encryption of dns traffic can be done without accompanying centralization. = It=92s some deployment plans that have conflated the two by linking doing = the later as part of the former. =20 As I said I=92m not trying to fire up anti-encryption arguments. =20 For the record: I am not against encryption.=20 However I do worry that it removes the ability for security researchers to = poke and prod and examine what=92s being sent and that takes away valuable = assurances we get from researchers doing their thing.=20 I also worry that it removes my ability to see what=92s being sent on my be= half, thought this isn=92t specific to DoH - I have long had this issue wit= h IoT devices when they talk back to their home using encrypted flows. =20 But I don=92t want to digress this thread any further than I have already.= =20 Glenn = From nobody Wed Aug 7 10:18:23 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CF64C1206F3 for ; Wed, 7 Aug 2019 10:18:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nX-mItejBHys for ; Wed, 7 Aug 2019 10:18:18 -0700 (PDT) Received: from mail-pl1-x62d.google.com (mail-pl1-x62d.google.com [IPv6:2607:f8b0:4864:20::62d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3BEEB1206C6 for ; Wed, 7 Aug 2019 10:18:05 -0700 (PDT) Received: by mail-pl1-x62d.google.com with SMTP id k8so41786882plt.3 for ; Wed, 07 Aug 2019 10:18:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=Uvcyy7oDdiHGInkfmktXby5wA8k28yS66Bqb4HwsUcY=; b=m22TadDtEI6cI2COhl80ET+fGrE/+P7fOPgfg7Uc+KA4fZWMLmqXnxQoxqE/5Z+eG4 vk1iNEn1W0LDVt6i2llXVQvQHN2hb93WBDu8QEodpcM5zzxdGALXPRJcqAnEjNZmKyPE seV8A0SQge2P1XB1fnoG68uiSvr7/akuQ85wkVsagB8MTwSosQ2wvUk/CFd7/8AIyvlX E3rTxvODlkjrRvZjolk3JIX3INry6VvS9SHzn11UWzWBzWfXduxxRXXAZlvnSbGrPeMP xG57LaOvZBKDC+OkTyICE1d1BTt8/pJ0nHtph2Yr1LMq3ny/HRWNc+G9x5ap3EBf3bH6 X0Wg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=Uvcyy7oDdiHGInkfmktXby5wA8k28yS66Bqb4HwsUcY=; b=iuld9sjw0ZFnDiJNhqeL4G1Ad5Pg9iN3UcTD3cED2+2E5JtG7kv6rEG5LQwEE6sRrD 8Zoan+CzIsnsKn8dP8mpc4JkegAa6wSP8vxOrMMwvOrmwl9p1hSHZRDQsZAPt6Jv2TLk jU7uLhPp6qVqqvg/DGwjax7K+1MPmniqnZ9DG017F3kAaFtBIIVQpw4dTMHJdQ4sQC+t uAzyg6YFh2P8U9uUoriMUm2WSnwBUi8mD3DKYhP6Gdezh5fkGnIF/2nGSkFRxw7sGvAh dd9yA7Ru+dC36/Og8wJp0ZZteOmGnMxzqRigPQEYwpAlyYPchEibpZu9TcbFP7cUGnrk rX8g== X-Gm-Message-State: APjAAAXwecBtEadCWpW8W/UXYOBl37VY4v4Z7VI6q5u4UJY5Up3ZgBQ2 W9d01RGFrWQyVCFQdDm3osI= X-Google-Smtp-Source: APXvYqxD43DSDWSivYOM+e2qho6s84Z50bqI5Kib0u+Ik6jTqtrwNBFPZuQiUIUh80T2+qUTiyix/A== X-Received: by 2002:a62:8745:: with SMTP id i66mr10217975pfe.259.1565198284799; Wed, 07 Aug 2019 10:18:04 -0700 (PDT) Received: from [10.128.64.149] ([136.60.227.81]) by smtp.gmail.com with ESMTPSA id u7sm88518099pfm.96.2019.08.07.10.18.03 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 07 Aug 2019 10:18:03 -0700 (PDT) From: Bret Jordan Message-Id: <41BFA10B-231E-4694-A498-442B5B0BF9DE@gmail.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_19F37AAD-496B-4F3D-BEEF-E99199E57020" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Wed, 7 Aug 2019 11:18:02 -0600 In-Reply-To: Cc: Jim Reid , ADD Mailing list To: Eric Orth References: <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> <64bcfc51-6f3d-ae24-4de5-d0eb89975c66@cs.tcd.ie> <539D6F9D-137C-4F68-A8DE-EA3DFAF4D827@huitema.net> <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <841102D9-4B50-4415-8193-FF3766F91958@gmail.com> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] HTTP privacy considerations for DoH Clients X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Aug 2019 17:18:21 -0000 --Apple-Mail=_19F37AAD-496B-4F3D-BEEF-E99199E57020 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 You mean both =E2=80=9Cunintentionally and intentionally=E2=80=9D.=20 The privacy consideration and security consideration sections need to be = written for end-users / organizations / enterprises as well as for = developers. They need to say, hey, if you let this protocol through = your network, here are the new risks you need to worry about. Here is = the increased attack surface. Here are the new risks to privacy. Or = maybe what we need is a =E2=80=9CPrivacy and Risk=E2=80=9D section in = every RFC. Something that calls out how this new fangled thing is going = to impact operational security. =20 Thanks, Bret PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 "Without cryptography vihv vivc ce xhrnrw, however, the only thing that = can not be unscrambled is an egg." > On Aug 7, 2019, at 10:30 AM, Eric Orth wrote: >=20 > (Thanks for branching off to another subject. I wanted to respond in = the other thread when this was brought up, but it was kinda off-topic = for most of what was being discussed there.) >=20 > Agreed. There is certainly lots of room for a DoT or DoH client to = unintentionally make bad privacy decisions. Publishing guidance and = information can help ensure they have thought things through before they = make privacy-affecting decisions. This is a very actionable area for = IETF. I think there would be enough consensus on many areas of guidance = (but obviously not all) to get a decent sized document. >=20 > Not everything would necessarily be a hard and fast do or don't, as = different tradeoffs may be relevant for different applications and use = cases. That's okay since the important part is providing the = information to help applications make the correct decisions for = themselves. E.g., accepting cookies is one of the areas already briefly = discussed in RFC8484, and I think it took the right approach: "HTTP = cookies SHOULD NOT be accepted by DOH clients unless they are explicitly = required by a use case." I think we need more guidance like that with = more detail on the tradeoffs and considerations. It may seem obvious = that applications should never send or accept cookies with DoH, but some = special-purpose application may want to use DoH to send authentication = information to a special-purpose DNS server that will only return = information to authorized users. DoH and DNS are not limited just to = the use case of browsers requesting addresses of all hostnames to be = visited. >=20 > On Wed, Aug 7, 2019 at 12:07 PM Jim Reid > wrote: >=20 >=20 > > On 7 Aug 2019, at 16:42, Bret Jordan > wrote: > >=20 > > An app or client could add additional http headers. It could add a = unique ID for each app or client, it could add in geo-location data, it = could all kinds of things. =20 >=20 > Indeed. IMO this sort of behaviour is something the IETF should work = on: some do=E2=80=99s and don=E2=80=99ts on privacy issues for DoH = clients. Which WG is most appropriate? >=20 > Apologies yet again for another meaningful and relevant Subject: = header. I=E2=80=99m hoping that practice will catch on. :-) >=20 > --=20 > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add = --Apple-Mail=_19F37AAD-496B-4F3D-BEEF-E99199E57020 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 You = mean both =E2=80=9Cunintentionally and intentionally=E2=80=9D. 

The privacy = consideration and security consideration sections need to be written for = end-users / organizations / enterprises as well as for developers. =  They need to say, hey, if you let this protocol through your = network, here are the new risks you need to worry about.  Here is = the increased attack surface.  Here are the new risks to privacy. =  Or maybe what we need is a =E2=80=9CPrivacy and Risk=E2=80=9D = section in every RFC.  Something that calls out how this new = fangled thing is going to impact operational security.  

Thanks,
Bret
PGP = Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 = 0050
"Without = cryptography vihv vivc ce xhrnrw, however, the only thing that can not = be unscrambled is an = egg."

On Aug 7, 2019, at 10:30 AM, Eric Orth <ericorth@google.com>= wrote:

(Thanks for branching off to = another subject.  I wanted to respond in the other thread when this = was brought up, but it was kinda off-topic for most of what was being = discussed there.)

Agreed.  = There is certainly lots of room for a DoT or DoH client to = unintentionally make bad privacy decisions.  Publishing guidance = and information can help ensure they have thought things through before = they make privacy-affecting decisions.  This is a very actionable = area for IETF.  I think there would be enough consensus on many = areas of guidance (but obviously not all) to get a decent sized = document.

Not = everything would necessarily be a hard and fast do or don't, as = different tradeoffs may be relevant for different applications and use = cases.  That's okay since the important part is providing the = information to help applications make the correct decisions for = themselves.  E.g., accepting cookies is one of the areas already = briefly discussed in RFC8484, and I think it took the right approach: = "HTTP cookies SHOULD NOT be accepted by DOH clients unless they are = explicitly required by a use case."  I think we need more guidance = like that with more detail on the tradeoffs and considerations.  It = may seem obvious that applications should never send or accept cookies = with DoH, but some special-purpose application may want to use DoH to = send authentication information to a special-purpose DNS server that = will only return information to authorized users.  DoH and DNS are = not limited just to the use case of browsers requesting addresses of all = hostnames to be visited.

On Wed, Aug = 7, 2019 at 12:07 PM Jim Reid <jim@rfc1035.com> wrote:


> On 7 Aug 2019, at 16:42, Bret Jordan <jordan.ietf@gmail.com> wrote:
>
> An app or client could add additional http headers.  It could = add a unique ID for each app or client, it could add in geo-location = data, it could all kinds of things. 

Indeed. IMO this sort of behaviour is something the IETF should work on: = some do=E2=80=99s and don=E2=80=99ts on privacy issues for DoH clients. = Which WG is most appropriate?

Apologies yet again for another meaningful and relevant Subject: header. = I=E2=80=99m hoping that practice will catch on. :-)

--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add

= --Apple-Mail=_19F37AAD-496B-4F3D-BEEF-E99199E57020-- From nobody Wed Aug 7 10:18:40 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6AACC120690 for ; Wed, 7 Aug 2019 10:18:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eM3X1ihpzR1M for ; Wed, 7 Aug 2019 10:18:38 -0700 (PDT) Received: from mx0a-00176a04.pphosted.com (mx0a-00176a04.pphosted.com [67.231.149.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 547211206F6 for ; Wed, 7 Aug 2019 10:18:38 -0700 (PDT) Received: from pps.filterd (m0047964.ppops.net [127.0.0.1]) by m0047964.ppops.net-00176a04. (8.16.0.27/8.16.0.27) with SMTP id x77HHrMW007930 for ; Wed, 7 Aug 2019 13:18:37 -0400 Received: from usushmgip001.mail.tfayd.com ([216.178.109.235]) by m0047964.ppops.net-00176a04. with ESMTP id 2u7yknux0s-1 (version=TLSv1.2 cipher=RC4-SHA bits=128 verify=NOT) for ; Wed, 07 Aug 2019 13:18:37 -0400 Received: from unknown (HELO potemwp00033.mail.tfayd.com) ([10.40.33.204]) by usushmgip001.mail.tfayd.com with ESMTP; 07 Aug 2019 10:18:37 -0700 Received: from potemwp00031.mail.tfayd.com (100.124.56.55) by potemwp00041.mail.tfayd.com (100.124.56.65) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.669.32; Wed, 7 Aug 2019 11:18:36 -0600 Received: from potemwp00029.mail.tfayd.com (100.124.56.53) by potemwp00031.mail.tfayd.com (100.124.56.55) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.669.32; Wed, 7 Aug 2019 11:18:35 -0600 Received: from potemwp00029.mail.tfayd.com ([100.124.56.53]) by potemwp00029.mail.tfayd.com ([100.124.56.53]) with mapi id 15.01.0669.032; Wed, 7 Aug 2019 11:18:35 -0600 From: "Deen, Glenn (NBCUniversal)" To: Adam Roach CC: ADD Mailing list Thread-Topic: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] Thread-Index: AQHVRJA9OEBhy8mKSkG1+AboakEuZqbepjg4gACEyQCAAQYIAIAAMdmAgAHHHwCAAATuAIAC7OSAgABKlICAABWOAIAAGNwAgACJAJqAAHmCAIAACQWAgAALpICAAD92gIAIpseAgAAdfICAAJkgAIAAAnSA//+piUeAAGtfAP//nZl5 Date: Wed, 7 Aug 2019 17:18:35 +0000 Message-ID: <903B8ABD-B507-4688-AE75-3574EAE1E1D9@nbcuni.com> References: <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <841102D9-4B50-4415-8193-FF3766F91958@gmail.com> <51f18426-d2fd-! 1be9-5556-fe079992acce@cs.tcd.ie> <576BC95C-7F00-45C9-9A43-BC184147E8DE@nbcuni.com>, In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-exclaimer-md-config: 47edc00f-f2d6-45ef-be83-8a353bd47e45 Content-Type: text/plain; charset="utf-8" Content-ID: <86731865370E2F4CADA3878E8ED70E01@NBCUNI.COM> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-CFilter-Loop: Forward X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-08-07_04:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1906280000 definitions=main-1908070167 Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Aug 2019 17:18:39 -0000 DQoNCk9uIEF1ZyA3LCAyMDE5LCBhdCAxMDowNiBBTSwgQWRhbSBSb2FjaCA8YWRhbUBub3N0cnVt LmNvbT4gd3JvdGU6DQoNCj4+IA0KPj4gSeKAmW0gcmVsYXRpdmVseSBzdXJlIHRoZXJlIHdpbGwg YmUgcmVzZWFyY2hlcnMgd2hvIHdpbGwgbWFrZSB0aGUgZWZmb3J0IHRvIGtlZXAgdGhlIGJpZyBi cm93c2VyIG1ha2VycyBob25lc3QsIGJ1dCB0aGUgYWJpbGl0eSBmb3Igb3RoZXJzIGFwcHMgdG8g YWRkIERvSCBhbmQgdW5kaXNjbG9zZWQgaHR0cCBoZWFkZXJzIGZvciB0cmFja2luZyBpcyBsaWtl bHkgc29tZXRoaW5nIHdlIHNob3VsZCBleHBlY3QgdG8gc2VlIGluIHRoZSBmdXR1cmUuICAgVGhp cyBpcyBhIHNwZWNpZmljIHdvcnJ5IHRvIERvSCBzaW5jZSBpdOKAmXMgb3ZlciBodHRwLg0KPiAN Cj4gVGhhbmtzLCBHbGVubi4gSSB0aGluayB0aGlzIGlzIHRoZSBmaXJzdCB0aW1lIEnigJl2ZSBz ZWVuIHRoaXMgZXhwbGFpbmVkIGNsZWFybHkgKG91dHNpZGUgb2YgdGhlIG1hbHdhcmUgY2FzZSku IENhbiB5b3Ugc2F5IG1vcmUgYWJvdXQgdGhlc2UgYXBwbGljYXRpb25zIGFuZCB3aGF0IHRoZSB3 b3JzdC1jYXNlIG91dGNvbWVzIG1pZ2h0IGJlPyBNeSAocG9zc2libHkgbmHDr3ZlKSB2aWV3IGlz IHRoYXQgc3VjaCBhcHBzIGFyZSB0eXBpY2FsbHkgdmVydGljYWxseSBpbnRlZ3JhdGVkIGFuZCB0 aGVyZWZvcmUgaGF2ZSBtdWNoIG1vcmUgZGFtYWdpbmcgd2F5cyB0byB0cmFjayB1c2VycywgYnV0 IGl04oCZcyBxdWl0ZSBwb3NzaWJsZSB0aGF0IHdl4oCZcmUgdGhpbmtpbmcgb2YgdHdvIHZlcnkg ZGlmZmVyZW50IGtpbmRzIG9mIGFwcGxpY2F0aW9ucy4NCg0KQWRhbSwNCg0KSSB3YXMgdGhpbmtp bmcgYWJvdXQgYXBwbGljYXRpb25zIG91dHNpZGUgb2YgYnJvd3NlcnMsIGVpdGhlciBkZXNrdG9w IGFwcHMgb3IgbW9yZSBsaWtlbHkgbW9iaWxlIGFwcHMuIEl0IHNlZW1zIHRoYXQgbW9iaWxlIGFw cHMgYXJlIHRoZSBvbmVzIHRoYXQgc2VlayB0byBwdXNoIHRoZSBib3VuZGFyaWVzIGFuZCBjb2xs ZWN0IGRhdGEgb24gdXNlcnMgYW5kIHRyYWNrIHRoZW0uIA0KDQpHbGVubg== From nobody Wed Aug 7 10:19:07 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1B021120232 for ; Wed, 7 Aug 2019 10:10:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=kumari-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 51kxfNPbS_CR for ; Wed, 7 Aug 2019 10:10:55 -0700 (PDT) Received: from mail-qt1-x830.google.com (mail-qt1-x830.google.com [IPv6:2607:f8b0:4864:20::830]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8DADC1200F8 for ; Wed, 7 Aug 2019 10:10:55 -0700 (PDT) Received: by mail-qt1-x830.google.com with SMTP id h21so89045065qtn.13 for ; Wed, 07 Aug 2019 10:10:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kumari-net.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc:content-transfer-encoding; bh=elwAjvW73dgHCrYcoE6UZgIN2UK8bIz8oix7bWT6F7k=; b=P4iPSWhc0YjCF2azeWUDJ11XoOuQIAhA/SMW4oTQdIkig47Yf1vlX1z1QqUFlArqCB vW5CBZhojELAyQULxki6Y40RUMpb7GNADuY/OQ13deenFJXaBHrFpmKLmWzKDK8WN/g+ 2umGlvxdo/9ki35hFEdWgYKIbKaEte5fKUeBX1RmdvAYn7SncnNjtozy7gTrkdCm1i5k IMWTXUTJF/qHcCKA5kmJp/WG9Jk6d/+isFezb4ZSlFjG2IuCf7GNNMJDtNjYQC9YQMtL 476gWxb7UoCqTPKnEmFFfYOC5vR82sF1SYJY2kCQzhAmE3EL6whahhVLbe92ZjE6q7oO I4+w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc:content-transfer-encoding; bh=elwAjvW73dgHCrYcoE6UZgIN2UK8bIz8oix7bWT6F7k=; b=ubdhZjtlgRzyuLkeVb6nyMgjhdiTO/ZEvWiDKNyc2fdIYQTYGOkxFdixzv6uNU+Vhg LCOFd32P3upLshKjBvj79Fkmc1c2KKrJ2vlRjw4c8VIdRU/pymtZ80ZzUmgSmzQmQtS2 Z6M/CHDpTcAfsaxWoNXEFP1k659pmHht2dX6MNIqfsobzkBuK4p+dCavvlNZQDjhiZ4c BtimwZWGaKQsIxpT/9wf2lDufFN0y1q38HGLqq6oYhriMNUAfjYarHugCMgBeoBVkL/Q 5ohe+KlFELaeO+czxAE45qGc9HEFvg3eX5k1C3fcYpvef+Xebt2HYm1qdVD4czEB9X8z /Pdg== X-Gm-Message-State: APjAAAXV6YmSuaTbxCAe4eVGEI9nU2LQ5J82EcAqWG4b0bohs/oCghq8 exIEzwyZRkQzrzST0GazQNsNU4moWyIvwhU9KlPUKA== X-Google-Smtp-Source: APXvYqzuy2N6E1h0ayboaqzYQ8oRe9oqD9EMFJnek4PDLOH46hPMOlrVT9Ddvd+RnWyKZjRyYQWfiIfBMaQG2ZEo7n4= X-Received: by 2002:ac8:5294:: with SMTP id s20mr8983350qtn.279.1565197853725; Wed, 07 Aug 2019 10:10:53 -0700 (PDT) MIME-Version: 1.0 References: <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <841102D9-4B50-4415-8193-FF3766F91958@gmail.com> <51f18426-d2fd-1be9-5556-fe079992acce@cs.tcd.ie> <576BC95C-7F00-45C9-9A43-BC184147E8DE@nbcuni.com> <1651559C-E885-466D-994F-C9F8629672DE@hopcount.ca> In-Reply-To: <1651559C-E885-466D-994F-C9F8629672DE@hopcount.ca> From: Warren Kumari Date: Wed, 7 Aug 2019 13:10:17 -0400 Message-ID: To: Joe Abley Cc: "Deen, Glenn (NBCUniversal)" , Ralf Weber , Mikael Abrahamsson , Alec Muffett , ADD Mailing list , Tommy Jensen , Bret Jordan , Paul Wouters , Rob Sayre , Stephen Farrell Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Archived-At: X-Mailman-Approved-At: Wed, 07 Aug 2019 10:19:05 -0700 Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Aug 2019 17:10:58 -0000 [ TOP-POST] Please trim the 'To:' list -- this has now exceeded mailman's "Too many recipients" trigger and I'm having to go approve each email, which causes delays (and makes me kvetch too!). W P.S: I'm sending this with the original To: harder so everyone gets it :-P On Wed, Aug 7, 2019 at 1:07 PM Joe Abley wrote: > > On 7 Aug 2019, at 12:41, Deen, Glenn (NBCUniversal) wrote: > > > One of the downsides of encryption is it will be much harder to actuall= y audit the data being sent by applications to resolvers. > > > > I=E2=80=99m not against encryption, but I=E2=80=99m bothered when thing= s are encrypted for my protection but are also invisible to me. > > > > I=E2=80=99m relatively sure there will be researchers who will make the= effort to keep the big browser makers honest, but the ability for others a= pps to add DoH and undisclosed http headers for tracking is likely somethin= g we should expect to see in the future. This is a specific worry to DoH = since it=E2=80=99s over http. > > > > My point is that we shouldn=E2=80=99t be complacent here and be too qui= ck to dismiss worries. Instead it would be nice if researchers were engagin= g now up front to poke at things and explore where the abuse opportunities = are. > > Nicely put. > > Centralisation of resolution is already upon us (I claim, without present= ing right now to back it up, film in Austin). > > DoH may or may not make things more centralised, depending on how it is i= mplemented and used; however, I don't find a shift from almost entirely cen= tralised (now) to a bit more centralised (possible future) that much of a c= oncern. Relatively speaking, it's kind of the same thing. > > However, the nature of the data that is available for collection is (a) p= otentially different and (b) hard to quantify if you're not a generator or = a collector. That's a change from today. I think that's interesting. > > > Joe > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add --=20 I don't think the execution is relevant when it was obviously a bad idea in the first place. This is like putting rabid weasels in your pants, and later expressing regret at having chosen those particular rabid weasels and that pair of pants. ---maf From nobody Wed Aug 7 10:19:14 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 976EC1206CA for ; Wed, 7 Aug 2019 10:14:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ETjsPeiYnsZ7 for ; Wed, 7 Aug 2019 10:14:23 -0700 (PDT) Received: from mx0a-00176a04.pphosted.com (mx0b-00176a04.pphosted.com [67.231.157.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C3A32120703 for ; Wed, 7 Aug 2019 10:14:03 -0700 (PDT) Received: from pps.filterd (m0049465.ppops.net [127.0.0.1]) by mx0b-00176a04.pphosted.com (8.16.0.27/8.16.0.27) with SMTP id x77Gw4v9034653 for ; Wed, 7 Aug 2019 13:14:02 -0400 Received: from usaoamgip002.mail.tfayd.com ([173.213.212.136]) by mx0b-00176a04.pphosted.com with ESMTP id 2u7yk63rkr-1 (version=TLSv1.2 cipher=RC4-SHA bits=128 verify=NOT) for ; Wed, 07 Aug 2019 13:14:02 -0400 Received: from unknown (HELO potemwp00023.mail.tfayd.com) ([10.40.78.204]) by usaoamgip002.mail.tfayd.com with ESMTP; 07 Aug 2019 13:10:14 -0400 Received: from potemwp00031.mail.tfayd.com (100.124.56.55) by potemwp00001.mail.tfayd.com (100.124.56.25) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.669.32; Wed, 7 Aug 2019 11:13:41 -0600 Received: from potemwp00029.mail.tfayd.com (100.124.56.53) by potemwp00031.mail.tfayd.com (100.124.56.55) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.669.32; Wed, 7 Aug 2019 11:13:41 -0600 Received: from potemwp00029.mail.tfayd.com ([100.124.56.53]) by potemwp00029.mail.tfayd.com ([100.124.56.53]) with mapi id 15.01.0669.032; Wed, 7 Aug 2019 11:13:40 -0600 From: "Deen, Glenn (NBCUniversal)" To: Adam Roach CC: Stephen Farrell , Paul Wouters , Bret Jordan , Alec Muffett , ADD Mailing list , Tommy Jensen , Ralf Weber , Rob Sayre , Mikael Abrahamsson Thread-Topic: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] Thread-Index: AQHVRJA9OEBhy8mKSkG1+AboakEuZqbepjg4gACEyQCAAQYIAIAAMdmAgAHHHwCAAATuAIAC7OSAgABKlICAABWOAIAAGNwAgACJAJqAAHmCAIAACQWAgAALpICAAD92gIAIpseAgAAdfICAAJkgAIAAAnSA//+piUeAAGtfAP//nZl5 Date: Wed, 7 Aug 2019 17:13:40 +0000 Message-ID: References: <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <841102D9-4B50-4415-8193-FF3766F91958@gmail.com> <51f18426-d2fd-! 1be9-5556-fe079992acce@cs.tcd.ie> <576BC95C-7F00-45C9-9A43-BC184147E8DE@nbcuni.com>, In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-exclaimer-md-config: 47edc00f-f2d6-45ef-be83-8a353bd47e45 Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-CFilter-Loop: Forward X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-08-07_04:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1906280000 definitions=main-1908070166 Archived-At: X-Mailman-Approved-At: Wed, 07 Aug 2019 10:19:05 -0700 Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Aug 2019 17:14:34 -0000 On Aug 7, 2019, at 10:06 AM, Adam Roach wrote: >>=20 >> I=92m relatively sure there will be researchers who will make the effort= to keep the big browser makers honest, but the ability for others apps to = add DoH and undisclosed http headers for tracking is likely something we sh= ould expect to see in the future. This is a specific worry to DoH since i= t=92s over http. >=20 > Thanks, Glenn. I think this is the first time I=92ve seen this explained = clearly (outside of the malware case). Can you say more about these applica= tions and what the worst-case outcomes might be? My (possibly na=EFve) view= is that such apps are typically vertically integrated and therefore have m= uch more damaging ways to track users, but it=92s quite possible that we=92= re thinking of two very different kinds of applications. Adam, I was thinking about applications outside of browsers, either desktop apps = or more likely mobile apps. It seems that mobile apps are the ones that see= k to push the boundaries and collect data on users and track them.=20 Glenn = From nobody Wed Aug 7 10:23:00 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E2FF9120693 for ; Wed, 7 Aug 2019 10:21:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Au36c4Bokqgt for ; Wed, 7 Aug 2019 10:21:31 -0700 (PDT) Received: from mail-pl1-x62c.google.com (mail-pl1-x62c.google.com [IPv6:2607:f8b0:4864:20::62c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C790A12068E for ; Wed, 7 Aug 2019 10:21:31 -0700 (PDT) Received: by mail-pl1-x62c.google.com with SMTP id t14so41758088plr.11 for ; Wed, 07 Aug 2019 10:21:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=NmNAtljYnuJPhMGkHdV06uV9EN0XGzlBKtkLm/5p6DA=; b=h2jvsrR63FhyD+LlaG1gfnuhqenwvtcYWdBLIntg0JRzGW3rqSxOp+E9Ni86r5yd4Q ks1vMuXKKfUnwTt8fPV6+pKX22rf3E0zF0POulsiZsqHsBAkwZE8y5ubWpvjOY9zUorH KUHyxKkX+9JuDxTIVv1mSPBQgw9MCaI/qypjvII2612veaFpn8ZA0qia1VGhWibMjiwK kH07aqX0C/jv6KoummcMA/qlnnCf+pNDpklc2QAWkJ++Q1NmccvvhSdIrsJJIqDKTTjJ BI5BKPFI0moaRn+BkQF6fCzdShUj4LDELaoa+Y2j80mbScmKyou2hr/ucdPq1OPOiYBP 1AtA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=NmNAtljYnuJPhMGkHdV06uV9EN0XGzlBKtkLm/5p6DA=; b=HO/xtJE/Y3Vai0kqocgsQKzVwnxgohnjboeulpx9HVSBRAgiaqrPXTUSf0LoWTjP/Z wiJ/HUW2WuCOkt+gTLUkf4cb2kgUpniGhyp+iDrD5eTXQXN2T9ZFplvXZWkJBzHzRupd 4jda/70xdOGbXYo2dl7IhhN0Dpygj36tzlYIflgbzy+XoH1MQWm+XDjvSCjc9RiLHhjQ aOCzOD0aP/nKXStTFyzPvaErXyITDeMmDAimN5TN8sgZdAnN/LowNf7u8lIz9xKOkH4O Oor/ku7Zz/2piLWbnWhEAoKvJXhAyEacjg585urE0z1iHAJwkq8TXWs1KfaOfotgqkU9 BPHQ== X-Gm-Message-State: APjAAAVDecnvaoZdEo4UPYOTtEElRLENK5oTw4SeZiETJMsSHQ0HL5mD pddwUCv1JhBWi7IhONSNT0s= X-Google-Smtp-Source: APXvYqwNzTc+OnRo6i5FKZFH62o5l8tOpH8xkkR/4GOLWb+TE/gKIgE39MxtCuy4bhzokgEmpKkS+g== X-Received: by 2002:a62:6dc2:: with SMTP id i185mr10626981pfc.40.1565198491470; Wed, 07 Aug 2019 10:21:31 -0700 (PDT) Received: from [10.128.64.149] ([136.60.227.81]) by smtp.gmail.com with ESMTPSA id i126sm110545797pfb.32.2019.08.07.10.21.30 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 07 Aug 2019 10:21:30 -0700 (PDT) From: Bret Jordan Message-Id: Content-Type: multipart/alternative; boundary="Apple-Mail=_6FC20471-7998-4A41-9D09-ACF105080149" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Wed, 7 Aug 2019 11:21:29 -0600 In-Reply-To: <1651559C-E885-466D-994F-C9F8629672DE@hopcount.ca> Cc: "Deen, Glenn (NBCUniversal)" , Stephen Farrell , Paul Wouters , Alec Muffett , ADD Mailing list , Tommy Jensen , Ralf Weber , Rob Sayre , Mikael Abrahamsson To: Joe Abley References: <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <841102D9-4B50-4415-8193-FF3766F91958@gmail.com> <51f18426-d2fd-1be9-5556-fe079992acce@cs.tcd.ie> <576BC95C-7F00-45C9-9A43-BC184147E8DE@nbcuni.com> <1651559C-E885-466D-994F-C9F8629672DE@hopcount.ca> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: X-Mailman-Approved-At: Wed, 07 Aug 2019 10:22:59 -0700 Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Aug 2019 17:21:34 -0000 --Apple-Mail=_6FC20471-7998-4A41-9D09-ACF105080149 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Joe, I would push back a bit. Right now it is super easy for an = organization, enterprise, managed network, or secure network to block = TCP/UDP 53 outbound accept for your internal DNS server. So it makes it = really easy to prevent clients and apps from using a centralized source.=20= Just like we wrote an RFC about how pervasive monitoring is bad. We = should write an RFC for how centralization of data is bad and how = tracking of users inside of sessions is bad.=20 Thanks, Bret PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 "Without cryptography vihv vivc ce xhrnrw, however, the only thing that = can not be unscrambled is an egg." > On Aug 7, 2019, at 10:49 AM, Joe Abley wrote: >=20 > On 7 Aug 2019, at 12:41, Deen, Glenn (NBCUniversal) = wrote: >=20 >> One of the downsides of encryption is it will be much harder to = actually audit the data being sent by applications to resolvers. >>=20 >> I=E2=80=99m not against encryption, but I=E2=80=99m bothered when = things are encrypted for my protection but are also invisible to me. >>=20 >> I=E2=80=99m relatively sure there will be researchers who will make = the effort to keep the big browser makers honest, but the ability for = others apps to add DoH and undisclosed http headers for tracking is = likely something we should expect to see in the future. This is a = specific worry to DoH since it=E2=80=99s over http. >>=20 >> My point is that we shouldn=E2=80=99t be complacent here and be too = quick to dismiss worries. Instead it would be nice if researchers were = engaging now up front to poke at things and explore where the abuse = opportunities are. >=20 > Nicely put. >=20 > Centralisation of resolution is already upon us (I claim, without = presenting right now to back it up, film in Austin). >=20 > DoH may or may not make things more centralised, depending on how it = is implemented and used; however, I don't find a shift from almost = entirely centralised (now) to a bit more centralised (possible future) = that much of a concern. Relatively speaking, it's kind of the same = thing. >=20 > However, the nature of the data that is available for collection is = (a) potentially different and (b) hard to quantify if you're not a = generator or a collector. That's a change from today. I think that's = interesting. >=20 >=20 > Joe >=20 --Apple-Mail=_6FC20471-7998-4A41-9D09-ACF105080149 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Joe,

I = would push back a bit.  Right now it is super easy for an = organization, enterprise, managed network, or secure network to block = TCP/UDP 53 outbound accept for your internal DNS server. So it makes it = really easy to prevent clients and apps from using a centralized = source. 

Just like we wrote an RFC about how pervasive monitoring is = bad.  We should write an RFC for how centralization of data is bad = and how tracking of users inside of sessions is bad. 


Thanks,
Bret
PGP = Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 = 0050
"Without = cryptography vihv vivc ce xhrnrw, however, the only thing that can not = be unscrambled is an = egg."

On Aug 7, 2019, at 10:49 AM, Joe Abley <jabley@hopcount.ca> = wrote:

On 7 Aug 2019, at 12:41, Deen, Glenn (NBCUniversal) <Glenn.Deen@nbcuni.com> wrote:

One of the downsides of = encryption is it will be much harder to actually audit the data being = sent by applications to resolvers.

I=E2=80=99= m not against encryption, but I=E2=80=99m bothered when things are = encrypted for my protection but are also invisible to me.

I=E2=80=99m relatively sure there will be = researchers who will make the effort to keep the big browser makers = honest, but the ability for others apps to add DoH and undisclosed http = headers for tracking is likely something we should expect to see in the = future.   This is a specific worry to DoH since it=E2=80=99s = over http.

My point is that we shouldn=E2=80=99= t be complacent here and be too quick to dismiss worries. Instead it = would be nice if researchers were engaging now up front to poke at = things and explore where the abuse opportunities are.

Nicely put.

Centralisation of resolution is already upon us (I claim, = without presenting right now to back it up, film in Austin).

DoH may or may not make things more = centralised, depending on how it is implemented and used; however, I = don't find a shift from almost entirely centralised (now) to a bit more = centralised (possible future) that much of a concern. Relatively = speaking, it's kind of the same thing.

However, the nature of the data that is available for = collection is (a) potentially different and (b) hard to quantify if = you're not a generator or a collector. That's a change from today. I = think that's interesting.


Joe


= --Apple-Mail=_6FC20471-7998-4A41-9D09-ACF105080149-- From nobody Wed Aug 7 10:26:38 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 39A24120689 for ; Wed, 7 Aug 2019 10:26:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id g4BtsYK9pzvC for ; Wed, 7 Aug 2019 10:26:34 -0700 (PDT) Received: from mail-pl1-x62c.google.com (mail-pl1-x62c.google.com [IPv6:2607:f8b0:4864:20::62c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AE7B41204AE for ; Wed, 7 Aug 2019 10:26:34 -0700 (PDT) Received: by mail-pl1-x62c.google.com with SMTP id 4so34803193pld.10 for ; Wed, 07 Aug 2019 10:26:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:mime-version:subject:date:references:to:in-reply-to:message-id; bh=hvIKtDb6haXVvdPfzVa3deU8OFv67OXnpOKHDo4MeLU=; b=BT/IXzYV5iLnpINict0XPFRRdsq5FmU3RP6DQWKh78ZQhSWp1v4OCpYMFas/WQJB8D JL/hnub4DFhMBt7FOToILGgt0o8oMqzgsjqDYcztENTj8r2mSUmtny544i3trwREyZ/a 2DV9Y7HV+mZcPGTkzZLEzChhUxY+aCDYkKsivDylyWtLn95KZSfV3ZqXlRmvWL1hz+gm l+6LBNJVHH3sVH23x0iV6Mc2wBc8WQW2hzSCiR2VFNh30VrFRG+2W5R0l7K3hY2C+dsQ R2DaH42N3guzf94JlXJvFHTt6hbgRxeui8NOafAKikMe5tVRR8Ac+O8skJixEz2fWmyi E6nQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:mime-version:subject:date:references:to :in-reply-to:message-id; bh=hvIKtDb6haXVvdPfzVa3deU8OFv67OXnpOKHDo4MeLU=; b=nhygWmoN+79i4IJknFIhSwWD9n7z8ZXT/h5ZlBFnBH8qR1k3xW8BdBWgKz0xHl8FRf nL24ix6uzo0KU/OiGFMJcqrN8FfGzs4c6wLoFfjnq9XMfeBgh5nWU0IC/QV4XsT0UF51 5zCWorJJEXbQcRA2YmV3aN67gNB7teYmUZdpQe9EMxWWBTt/co+9OTxFSUwWcThOpknm 6L192cDs6/EhI2ERoX1ujlaWq4TPcJTegSTCAHX/xziK5D9b0NIALqN8KOzedtzB/evk xC2YdoDjB/SNM0aSpgWu8i40nSGFFXbOW5QXlr9vQtOvWQtzmE2U6LIR6XE1eOS8yDmA +i1w== X-Gm-Message-State: APjAAAWuNMWGbt6G9P0gSZRvk3FO/xaaUscafgUJMtm/Z2nLiU+tPk3Q M+NQYB0eLAkRJFfIKXNgzeJXtuhq X-Google-Smtp-Source: APXvYqyO+MBMVlE76orPZnSRxA12rTIr2qv9t2FM7l6Y4kvKNzYFCoca0Mtc/gp5B8Z1ceXEqdzs6A== X-Received: by 2002:a63:fe52:: with SMTP id x18mr9039102pgj.344.1565198793696; Wed, 07 Aug 2019 10:26:33 -0700 (PDT) Received: from [10.128.64.149] ([136.60.227.81]) by smtp.gmail.com with ESMTPSA id v27sm130247179pgn.76.2019.08.07.10.26.32 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 07 Aug 2019 10:26:32 -0700 (PDT) From: Bret Jordan Content-Type: multipart/alternative; boundary="Apple-Mail=_994D207D-1934-4B60-91C7-ECAD42F02DD4" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Wed, 7 Aug 2019 11:26:31 -0600 References: <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <841102D9-4B50-4415-8193-FF3766F91958@gmail.com> <51f18426-d2fd-! 1be9-5556-fe079992acce@cs.tcd.ie> <576BC95C-7F00-45C9-9A43-BC184147E8DE@nbcuni.com> To: ADD Mailing list In-Reply-To: Message-Id: <66F37AD2-1BCB-486F-82A4-125722ECEF4A@gmail.com> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Aug 2019 17:26:37 -0000 --Apple-Mail=_994D207D-1934-4B60-91C7-ECAD42F02DD4 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Glenn, This is my thinking as well. It would be so easy to have unique IDs per = client install, grab all of the geo-location information, you would have = time information, you could then correlate this data in really scary = ways.=20 Thanks, Bret PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 "Without cryptography vihv vivc ce xhrnrw, however, the only thing that = can not be unscrambled is an egg." > On Aug 7, 2019, at 11:13 AM, Deen, Glenn (NBCUniversal) = wrote: >=20 >=20 >=20 > On Aug 7, 2019, at 10:06 AM, Adam Roach wrote: >=20 >>>=20 >>> I=E2=80=99m relatively sure there will be researchers who will make = the effort to keep the big browser makers honest, but the ability for = others apps to add DoH and undisclosed http headers for tracking is = likely something we should expect to see in the future. This is a = specific worry to DoH since it=E2=80=99s over http. >>=20 >> Thanks, Glenn. I think this is the first time I=E2=80=99ve seen this = explained clearly (outside of the malware case). Can you say more about = these applications and what the worst-case outcomes might be? My = (possibly na=C3=AFve) view is that such apps are typically vertically = integrated and therefore have much more damaging ways to track users, = but it=E2=80=99s quite possible that we=E2=80=99re thinking of two very = different kinds of applications. >=20 > Adam, >=20 > I was thinking about applications outside of browsers, either desktop = apps or more likely mobile apps. It seems that mobile apps are the ones = that seek to push the boundaries and collect data on users and track = them.=20 >=20 > Glenn --Apple-Mail=_994D207D-1934-4B60-91C7-ECAD42F02DD4 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Glenn,

This= is my thinking as well.  It would be so easy to have unique IDs = per client install, grab all of the geo-location information, you would = have time information, you could then correlate this data in really = scary ways. 


Thanks,
Bret
PGP = Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 = 0050
"Without = cryptography vihv vivc ce xhrnrw, however, the only thing that can not = be unscrambled is an = egg."

On Aug 7, 2019, at 11:13 AM, Deen, Glenn (NBCUniversal) = <Glenn.Deen@nbcuni.com> wrote:



On Aug 7, 2019, at 10:06 AM, Adam Roach <adam@nostrum.com> = wrote:


I=E2=80=99m= relatively sure there will be researchers who will make the effort to = keep the big browser makers honest, but the ability for others apps to = add DoH and undisclosed http headers for tracking is likely something we = should expect to see in the future.   This is a specific worry = to DoH since it=E2=80=99s over http.

Thanks, Glenn. I think this is the first time I=E2=80=99ve = seen this explained clearly (outside of the malware case). Can you say = more about these applications and what the worst-case outcomes might be? = My (possibly na=C3=AFve) view is that such apps are typically vertically = integrated and therefore have much more damaging ways to track users, = but it=E2=80=99s quite possible that we=E2=80=99re thinking of two very = different kinds of applications.

Adam,

I was thinking about = applications outside of browsers, either desktop apps or more likely = mobile apps. It seems that mobile apps are the ones that seek to push = the boundaries and collect data on users and track them.

Glenn

= --Apple-Mail=_994D207D-1934-4B60-91C7-ECAD42F02DD4-- From nobody Wed Aug 7 10:29:21 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 943A11200F8 for ; Wed, 7 Aug 2019 10:27:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YTwoOQVEJJ_y for ; Wed, 7 Aug 2019 10:27:34 -0700 (PDT) Received: from mail-vs1-xe2d.google.com (mail-vs1-xe2d.google.com [IPv6:2607:f8b0:4864:20::e2d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1548B12027B for ; Wed, 7 Aug 2019 10:27:34 -0700 (PDT) Received: by mail-vs1-xe2d.google.com with SMTP id u124so61213537vsu.2 for ; Wed, 07 Aug 2019 10:27:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=+0Or3wcESsUfE49uccdBnX2OnJw1VpZPj8YaquT8+eQ=; b=FJu2VgxE8JTP3WzbsYpPFY8uCxtpvzmvNkWth/tryg29HEKCg3fBAr1s1uYu1wkJXe 6sh+03MRL5e/rAJAimaComDjVr/tsa0WHImovuuQEo5HuoVnHoe7lrYXuUgxoU4xLFfd 7RkgMi241dpjWSPqevofpwgs2uMsuKgd25TpOIam660upul3nX7cp4lFd1RrcXKq+YyR uqx3N/dw4SsYMNFlM76SbBZghvNGT2n6Z8C7Tv9jUEn+KCapV2aB7Yi0ytxtMjfGxDDX V6LbilBi+DiwJI7XUC8UvUGmMrjmXLxV4QvEQp9Hpdw+rNNReL/2MWT/8ZSL+S68iGRp 4+pw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=+0Or3wcESsUfE49uccdBnX2OnJw1VpZPj8YaquT8+eQ=; b=k+cciNJQMxvp43Jg6nX4NFAAhkhbvsOoO1ngdfSyoyqo7mJK9JrVyDWD6y1Ik7XoLp Fpge1NdZga7FJMzZVXeORk40ooS5lp5pahvKy7RyLyJSQT5qOYbdYLKW+tipeTOjWhit u12Pdm7Yz0eC1KT7vNOZ7nx40Fk0WiKTBLwUiPQ9Sx1HPdySOb3qCEfT259DSvuYScbO vLwisAomQY1tn0FVyVXvZBCd3M2O+BemEA6OT/oYRfxxMpmDtRBiDZUE464eWJerPonj D/01YGbmnhveNGdkMBY5ekAGpTe6r/UMLteENtedaPnkYI8rSKLAcMWNKrkwYW/YcCEd mL/A== X-Gm-Message-State: APjAAAXesBHkmKudUzqjbXcIIaUVxPcbN28W9e8nP1OS9yUbxedCTSSm BVrbJRVuLPgm9dlxKw6bBHcC5hZTARPORYxJnQI= X-Google-Smtp-Source: APXvYqyAQtnynd3cAnuyYGKB7l1yCsbP9G4gsJXjkT6gkIfHESm/49EP5/rAjgFteMaR0/FaTh0woJ45ateseJX/14s= X-Received: by 2002:a67:8701:: with SMTP id j1mr6778422vsd.199.1565198853064; Wed, 07 Aug 2019 10:27:33 -0700 (PDT) MIME-Version: 1.0 References: <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <841102D9-4B50-4415-8193-FF3766F91958@gmail.com> <51f18426-d2fd-1be9-5556-fe079992acce@cs.tcd.ie> <576BC95C-7F00-45C9-9A43-BC184147E8DE@nbcuni.com> In-Reply-To: From: Brian Dickson Date: Wed, 7 Aug 2019 10:27:22 -0700 Message-ID: To: "Deen, Glenn (NBCUniversal)" Cc: Stephen Farrell , Bret Jordan , Alec Muffett , ADD Mailing list , Tommy Jensen , Ralf Weber , Paul Wouters , Rob Sayre , Mikael Abrahamsson Content-Type: multipart/alternative; boundary="000000000000a3cf8b058f8a4171" Archived-At: X-Mailman-Approved-At: Wed, 07 Aug 2019 10:29:20 -0700 Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Aug 2019 17:27:37 -0000 --000000000000a3cf8b058f8a4171 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Wed, Aug 7, 2019 at 10:11 AM Deen, Glenn (NBCUniversal) < Glenn.Deen@nbcuni.com> wrote: > > > > > > On Aug 7, 2019, at 9:51 AM, Stephen Farrell > wrote: > > > > TBH I think you're badly conflating two independent things > > there. > > > > - concentration of sources for traffic to a TLD authoritative > > as reported by Joe > > > > - use of encrypted transports for DNS between stub and > > recursive > > And between recursive resolvers too. > > > > Given the history of people claiming the sky is about to fall > > "because encryption," such conflation is IMO fairly unhelpful > > given we want a rational analysis of all this ADD stuff. > > I don=E2=80=99t think I am conflating - certainly that=E2=80=99s not my i= ntent. > > Encryption of dns traffic can be done without accompanying > centralization. It=E2=80=99s some deployment plans that have conflated t= he two by > linking doing the later as part of the former. > > As I said I=E2=80=99m not trying to fire up anti-encryption arguments. > > For the record: I am not against encryption. > > However I do worry that it removes the ability for security researchers t= o > poke and prod and examine what=E2=80=99s being sent and that takes away v= aluable > assurances we get from researchers doing their thing. > > I also worry that it removes my ability to see what=E2=80=99s being sent = on my > behalf, thought this isn=E2=80=99t specific to DoH - I have long had this= issue > with IoT devices when they talk back to their home using encrypted flows. > > I think this is a very valid point, and one thing that is probably valid to consider at the full "ADD" scope, i.e. applicable to all encrypted DNS traffic from any/all applications. And, I think, is architectural in nature. The initial DoH spec may have been overly prescriptive in how to implement, or at least is being implemented without thought to the above issues. It basically boils down to: if there is no on-host place to inspect the DNS traffic before it goes out an encrypted transport, it becomes problematic to try to see what is being sent. If it were feasible to separate the TLS portion, architecturally, from the DNS portion, in a way that facilitated this visibility, those concerns would be alleviated. For example, if the app wrote to a unix-domain socket, where the other end of the socket was a "service" that did all the TLS set-up and encrypt/decrypt stuff for DoH/DoT, possibly for multiple client apps, that might provide enough of a monitoring "surface". It's not perfect, and I'm still opposed to DoH and in favor of DoT for the general use scenarios, but it does give security folks (researchers and operators) enough to work with at an app vs host level. Brian --000000000000a3cf8b058f8a4171 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Wed, Aug 7, 2019 at 10:11 AM Deen,= Glenn (NBCUniversal) <Glenn.De= en@nbcuni.com> wrote:




> On Aug 7, 2019, at 9:51 AM, Stephen Farrell <stephen.farrell@cs.tcd.ie> = wrote:
>
> TBH I think you're badly conflating two independent things
> there.
>
> - concentration of sources for traffic to a TLD authoritative
>=C2=A0 as reported by Joe
>
> - use of encrypted transports for DNS between stub and
>=C2=A0 recursive

And between recursive resolvers too.
>
> Given the history of people claiming the sky is about to fall
> "because encryption," such conflation is IMO fairly unhelpfu= l
> given we want a rational analysis of all this ADD stuff.

I don=E2=80=99t think I am conflating - certainly that=E2=80=99s not my int= ent.

Encryption of dns traffic can be done without accompanying centralization.= =C2=A0 It=E2=80=99s some deployment plans that have conflated the two by li= nking doing the later as part of the former.=C2=A0

As I said I=E2=80=99m not trying to fire up anti-encryption arguments.=C2= =A0

For the record: I am not against encryption.

However I do worry that it removes the ability for security researchers to = poke and prod and examine what=E2=80=99s being sent and that takes away val= uable assurances we get from researchers doing their thing.

I also worry that it removes my ability to see what=E2=80=99s being sent on= my behalf, thought this isn=E2=80=99t specific to DoH - I have long had th= is issue with IoT devices when they talk back to their home using encrypted= flows.=C2=A0


I think this is a ve= ry valid point, and one thing that is probably valid to consider at the ful= l "ADD" scope, i.e. applicable to all encrypted DNS traffic from = any/all applications.

And, I think, is architectur= al in nature.

The initial DoH spec may have been o= verly prescriptive in how to implement, or at least is being implemented wi= thout thought to the above issues.

It basically bo= ils down to: if there is no on-host place to inspect the DNS traffic before= it goes out an encrypted transport, it becomes problematic to try to see w= hat is being sent.

If it were feasible to separate= the TLS portion, architecturally, from the DNS portion, in a way that faci= litated this visibility, those concerns would be alleviated.

=
For example, if the app wrote to a unix-domain socket, where the= other end of the socket was a "service" that did all the TLS set= -up and encrypt/decrypt stuff for DoH/DoT, possibly for multiple client app= s, that might provide enough of a monitoring "surface".

It's not perfect, and I'm still opposed to DoH and = in favor of DoT for the general use scenarios, but it does give security fo= lks (researchers and operators) enough to work with at an app vs host level= .

Brian
=C2=A0
--000000000000a3cf8b058f8a4171-- From nobody Wed Aug 7 10:40:18 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 279E912072B for ; Wed, 7 Aug 2019 10:40:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id P4g8LrIgtxt9 for ; Wed, 7 Aug 2019 10:40:09 -0700 (PDT) Received: from mx0a-00176a04.pphosted.com (mx0a-00176a04.pphosted.com [67.231.149.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6CCC012072C for ; Wed, 7 Aug 2019 10:40:09 -0700 (PDT) Received: from pps.filterd (m0047964.ppops.net [127.0.0.1]) by m0047964.ppops.net-00176a04. (8.16.0.27/8.16.0.27) with SMTP id x77HHsN1007942 for ; Wed, 7 Aug 2019 13:40:09 -0400 Received: from usaoamgip001.mail.tfayd.com ([173.213.212.135]) by m0047964.ppops.net-00176a04. with ESMTP id 2u7yknvap0-1 (version=TLSv1.2 cipher=RC4-SHA bits=128 verify=NOT) for ; Wed, 07 Aug 2019 13:40:08 -0400 Received: from unknown (HELO potemwp00015.mail.tfayd.com) ([10.40.78.204]) by usaoamgip001.mail.tfayd.com with ESMTP; 07 Aug 2019 13:38:19 -0400 Received: from potemwp00031.mail.tfayd.com (100.124.56.55) by potemwp00024.mail.tfayd.com (100.124.56.48) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.669.32; Wed, 7 Aug 2019 11:40:06 -0600 Received: from potemwp00029.mail.tfayd.com (100.124.56.53) by potemwp00031.mail.tfayd.com (100.124.56.55) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.669.32; Wed, 7 Aug 2019 11:40:05 -0600 Received: from potemwp00029.mail.tfayd.com ([100.124.56.53]) by potemwp00029.mail.tfayd.com ([100.124.56.53]) with mapi id 15.01.0669.032; Wed, 7 Aug 2019 11:40:05 -0600 From: "Deen, Glenn (NBCUniversal)" To: Brian Dickson CC: ADD Mailing list Thread-Topic: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] Thread-Index: AQHVRJA9OEBhy8mKSkG1+AboakEuZqbepjg4gACEyQCAAQYIAIAAMdmAgAHHHwCAAATuAIAC7OSAgABKlICAABWOAIAAGNwAgACJAJqAAHmCAIAACQWAgAALpICAAD92gIAIpseAgAAdfICAAJkgAIAAAnSA//+piUeAAGdJgP//oPIqgABpJQD//575dw== Date: Wed, 7 Aug 2019 17:40:05 +0000 Message-ID: <2D0D6DE0-59BA-41B7-96F3-92FDD2111106@nbcuni.com> References: <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <841102D9-4B50-4415-8193-FF3766F91958@gmail.com> <51f18426-d2fd-1be9-5556-fe079992acce@cs.tcd.ie> <576BC95C-7F00-45C9-9A43-BC184147E8DE@nbcuni.com> , In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-exclaimer-md-config: 47edc00f-f2d6-45ef-be83-8a353bd47e45 Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-CFilter-Loop: Forward X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-08-07_04:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1906280000 definitions=main-1908070167 Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Aug 2019 17:40:17 -0000 > On Aug 7, 2019, at 10:27 AM, Brian Dickson wrote: >=20 > It basically boils down to: if there is no on-host place to inspect the D= NS traffic before it goes out an encrypted transport, it becomes problemati= c to try to see what is being sent. >=20 > If it were feasible to separate the TLS portion, architecturally, from th= e DNS portion, in a way that facilitated this visibility, those concerns wo= uld be alleviated. >=20 > For example, if the app wrote to a unix-domain socket, where the other en= d of the socket was a "service" that did all the TLS set-up and encrypt/dec= rypt stuff for DoH/DoT, possibly for multiple client apps, that might provi= de enough of a monitoring "surface". Thanks for writing that up. It helped me recognize that part of my ongoing = uneasiness with the DoH functionality being in the browser and not the OS Is that it pulls the dns logs out of the system logs into only the browser = tab. =20 It also pulls it out of any device wide policy settings that I manage today= at the OS.=20 While I see the ease of deployment putting it in the application brings, it= would be so much better from a device administration standpoint if it were= better integrated at with the OS as a distinct service outside browser. I= f you can=92t do that, perhaps the browsers could write dns errors to the d= evice logs.=20 On device log data is so useful in debugging. Yes, I still use syslog when= fixing things.=20 Glenn =20 From nobody Wed Aug 7 10:51:22 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E8CD5120284 for ; Wed, 7 Aug 2019 10:51:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cl24h-SZ7rIQ for ; Wed, 7 Aug 2019 10:51:18 -0700 (PDT) Received: from mx0a-00191d01.pphosted.com (mx0b-00191d01.pphosted.com [67.231.157.136]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EF7891200F8 for ; Wed, 7 Aug 2019 10:51:17 -0700 (PDT) Received: from pps.filterd (m0049463.ppops.net [127.0.0.1]) by m0049463.ppops.net-00191d01. (8.16.0.27/8.16.0.27) with SMTP id x77HUoOK039733; Wed, 7 Aug 2019 13:51:17 -0400 Received: from alpi154.enaf.aldc.att.com (sbcsmtp6.sbc.com [144.160.229.23]) by m0049463.ppops.net-00191d01. with ESMTP id 2u833ugjfn-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 07 Aug 2019 13:51:17 -0400 Received: from enaf.aldc.att.com (localhost [127.0.0.1]) by alpi154.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id x77HpGIU022676; Wed, 7 Aug 2019 13:51:16 -0400 Received: from zlp30485.vci.att.com (zlp30485.vci.att.com [135.47.91.178]) by alpi154.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id x77Hp4Sl022425 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Wed, 7 Aug 2019 13:51:12 -0400 Received: from zlp30485.vci.att.com (zlp30485.vci.att.com [127.0.0.1]) by zlp30485.vci.att.com (Service) with ESMTP id 255024009E74; Wed, 7 Aug 2019 17:51:04 +0000 (GMT) Received: from GAALPA1MSGHUBAA.ITServices.sbc.com (unknown [130.8.218.150]) by zlp30485.vci.att.com (Service) with ESMTPS id 112CF4009E78; Wed, 7 Aug 2019 17:51:04 +0000 (GMT) Received: from GAALPA1MSGUSRBF.ITServices.sbc.com ([169.254.5.84]) by GAALPA1MSGHUBAA.ITServices.sbc.com ([130.8.218.150]) with mapi id 14.03.0439.000; Wed, 7 Aug 2019 13:51:03 -0400 From: "STARK, BARBARA H" To: "'ADD Mailing list'" , "'Deen, Glenn (NBCUniversal)'" Thread-Topic: Auditing apps Thread-Index: AdVNRRbh8b0IoWFxT+aqWbK8u0xmqwAA1Hdg Date: Wed, 7 Aug 2019 17:51:02 +0000 Message-ID: <2D09D61DDFA73D4C884805CC7865E6114E258909@GAALPA1MSGUSRBF.ITServices.sbc.com> References: <2D09D61DDFA73D4C884805CC7865E6114E25886C@GAALPA1MSGUSRBF.ITServices.sbc.com> In-Reply-To: <2D09D61DDFA73D4C884805CC7865E6114E25886C@GAALPA1MSGUSRBF.ITServices.sbc.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [135.70.248.192] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-08-07_04:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_policy_notspam policy=outbound_policy score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1906280000 definitions=main-1908070167 Archived-At: Subject: [Add] Auditing apps X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Aug 2019 17:51:21 -0000 > One of the downsides of encryption is it will be much harder to=20 > actually audit the data being sent by applications to resolvers. >=20 > I'm not against encryption, but I'm bothered when things are encrypted=20 > for my protection but are also invisible to me. >=20 > I'm relatively sure there will be researchers who will make the=20 > effort to keep the big browser makers honest, but the ability for=20 > others apps to add DoH and undisclosed http headers for tracking is likel= y something we should > expect to see in the future. This is a specific worry to DoH since it's= over > http. >=20 > My point is that we shouldn't be complacent here and be too quick to=20 > dismiss worries. Instead it would be nice if researchers were engaging=20 > now up front to poke at things and explore where the abuse opportunities = are. I'm concerned with this too. Lenovo at one time was shipping laptops with a= MS OS and IE browser they had customized to insert a "trusted" certificate= that allowed Superfish to break browser encryption and insert ads. They ha= d to stop that (but defended it) because of public backlash [1], but not be= cause there was any rule against it [2]. From what I can see, there is noth= ing that would prevent a laptop/tablet manufacturer/provider from including= a custom browser that is branded and looks just like the non-customized ve= rsion of the same browser, but uses DoH to send all DNS traffic to the manu= facturer's 3rd party partner DoH provider -- complete with lots of headers,= cookies, and everything else needed to thoroughly track a user. This doesn= 't even break encryption. It's clear there's nothing the honest browser and= DoH providers can do to prevent this. But this is a problem created by IET= F standards, that IETF has an obligation (IMO) to try to fix before the abu= ses become rampant. [1] https://www.theverge.com/2015/2/19/8067505/lenovo-installs-adware-priva= te-data-hackers [2] https://cdt.org/insight/is-breaking-web-encryption-legal/=20 =20 From nobody Wed Aug 7 10:51:47 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B873D120689 for ; Wed, 7 Aug 2019 10:51:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 092j8VwEjkLJ for ; Wed, 7 Aug 2019 10:51:44 -0700 (PDT) Received: from mail-ot1-x331.google.com (mail-ot1-x331.google.com [IPv6:2607:f8b0:4864:20::331]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0CFD51204AE for ; Wed, 7 Aug 2019 10:51:44 -0700 (PDT) Received: by mail-ot1-x331.google.com with SMTP id l15so107732202otn.9 for ; Wed, 07 Aug 2019 10:51:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=YlkkBaHtmRRYa7KdrMBm2Nfjv+20ohgBVnYnlbzA7W4=; b=iLRh8ANMWP13GGUg6wtUyN8SgiGLRSLdvsE5I1LfTR0bVDQgsDErANURFem9u3zbHF UdYoAXsElYGeOumoSlF9d9mbGzNgWVvJUQ8Bs4tvHgXj9wUbTtuWu7FCdspG24Dxz6nx Z9Ev1Ey0nW5OeLmB/jmC59s/SlV+fuq8sn4QymKF3WfemJyVe/ucgMMx1ev8jun7fZZ4 JVc9MhM69saPduZ0vViHZgDdmVvbdIyPcO6mqH/rO4JGRvxfocnXD8eO5c2MWJ5VwoBg gX70yyyF2cz9qjzWIa1MsEyaYPE6r07Xe5+qqohzAZz3z65taANH6rrQA5hqaq/SQHaA bdBQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=YlkkBaHtmRRYa7KdrMBm2Nfjv+20ohgBVnYnlbzA7W4=; b=q7EN5CavsS4P1Pxko+QMl2TvTZV1heNBS9fTU7mLiEq5FTGYBMECf1mJznvcOVYC0h KcBd2nX7NIxJxVT/9Cr8d5kZhoqi5Rr1odIH7xZRffg6WxDnbLPztuDWisJDLpDa7SPy pg1gUN1/PZynACs/WjaVx/BaU7hK0tODTRZWr4f2SeDZGrzNnYKQQ/TnRzh9omrAnLox JIFyCSuJ+24DtoDZLQ7mCBQ4wQhFtph46BZPI/FnqTvoPHPwQm2mhoA6OvAw9k5NFQuG Uk/wDh398cktS91R4u4/SE5k1AFl8e1nLpa3Iy/TVEwk4EAd9b3HCt50tU+HvDxyWPJZ 5cUw== X-Gm-Message-State: APjAAAX8PqPBAWh7hmsf6F904bSxCwk+WA2roDp0MD0awdsGUNyiOo8U T5AjAOQXLDFJw7sBroox/OYhw69VGHlpZuXgQWM= X-Google-Smtp-Source: APXvYqx5Cf+8lKGnJCSCEnX65MPScRLlgG8qHzY61rch6EgnTq9VJf+p7fmaI8HETrSSSFU6algaH+84uKPPrzoGRS4= X-Received: by 2002:a5e:c00e:: with SMTP id u14mr11076436iol.196.1565200303258; Wed, 07 Aug 2019 10:51:43 -0700 (PDT) MIME-Version: 1.0 References: <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <841102D9-4B50-4415-8193-FF3766F91958@gmail.com> <51f18426-d2fd-1be9-5556-fe079992acce@cs.tcd.ie> <576BC95C-7F00-45C9-9A43-BC184147E8DE@nbcuni.com> <2D0D6DE0-59BA-41B7-96F3-92FDD2111106@nbcuni.com> In-Reply-To: <2D0D6DE0-59BA-41B7-96F3-92FDD2111106@nbcuni.com> From: Rob Sayre Date: Wed, 7 Aug 2019 10:51:31 -0700 Message-ID: To: "Deen, Glenn (NBCUniversal)" Cc: Brian Dickson , ADD Mailing list Content-Type: multipart/alternative; boundary="0000000000001401ea058f8a986b" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Aug 2019 17:51:46 -0000 --0000000000001401ea058f8a986b Content-Type: text/plain; charset="UTF-8" On Wed, Aug 7, 2019 at 10:40 AM Deen, Glenn (NBCUniversal) < Glenn.Deen@nbcuni.com> wrote: > It also pulls it out of any device wide policy settings that I manage > today at the OS. > I don't think this is true (anyone in control of the OS can intercept TLS). It's not a topic for the IETF, though. thanks, Rob --0000000000001401ea058f8a986b Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Wed, Aug 7, 2019 at 10:40 AM Deen, Gle= nn (NBCUniversal) <Glenn.Deen@n= bcuni.com> wrote:
It also pulls it out of any device wide policy settings that I manage today= at the OS.

I don't think this is = true (anyone in control of the OS can intercept TLS). It's not a topic = for the IETF, though.

thanks,
Rob
<= div>=C2=A0
--0000000000001401ea058f8a986b-- From nobody Wed Aug 7 10:54:58 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 329FB1204AE for ; Wed, 7 Aug 2019 10:54:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Fhhuw3FBgsqK for ; Wed, 7 Aug 2019 10:54:55 -0700 (PDT) Received: from mail-lf1-x131.google.com (mail-lf1-x131.google.com [IPv6:2a00:1450:4864:20::131]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E3DD1120284 for ; Wed, 7 Aug 2019 10:54:54 -0700 (PDT) Received: by mail-lf1-x131.google.com with SMTP id s19so2014144lfb.9 for ; Wed, 07 Aug 2019 10:54:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=nJRb0AXtD9YtANd7YyXy2/DHX3C3VegYX4YmmXXWlrI=; b=pMB/UGzNI7A8cTO+v3dwe1Sum3tow9AS3hQjYaZ4uX/NWIPbgx5RCiEbM603CHWYXE tloatxWjeBaHEUu4BfcG9rQWnVTTwiUuEpI8PeZygemA1EFiVi7J7z4X7Li/bZUS69yK EZ4lzyliwXO0xE1O1byx0KXJnafEc5tAtFwVlXs2t3+x8sX3yLas9ouwz3NqlLy5irT0 mJn4DZVQ5Hqbq0d2YoNZJfNpQRiy84dYQS2zHNyu7UdA9rTGXFnMVtVhlSjh4ZEYRzor mtZMqgvbWxYrrn0Z8HdCBPwixXC+MW5R5pGeXBziao4MuGyYLGbS6Xiy8mjLoBr5jdLf P1HQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=nJRb0AXtD9YtANd7YyXy2/DHX3C3VegYX4YmmXXWlrI=; b=cK7O+lVpuMJHA8xQWDVneYuzKcc9kPHx+4ojZeUjlteAYfql8BmZNB12pg86oqDvrt xBRtK/RY46ujj8z/KXcF2/mbDdWCxbXBJmxTvu5lNTVU0jzPLex7S5JIKC/TfVwFD+Hy gxwhdBpwnnKE0/0vH9fVhIg1UrTbX6vrzekwSXTzInakFyatRFxZNgd8erJorXQH6SmV 4gSS5yMFvt7UiIvCtVjldqlBng/46yHwjK8QLW5533nn9fWXy9KpKOhMOPKUqL2HWDD3 SsKp7aKqOhHbyT3dA84qUnZErRsRMulx6ViYMYapCzF5kM6vJ6eaxeoAnnR0SZhAE/W0 zPNw== X-Gm-Message-State: APjAAAVdjgblP1PYqKlXHDnWtFrFW+EpKr23OEByFwlLouqlJVK6pD3y efDLJrmiqki2Dd4As7AHkyod6AlMFYqHw+PTHqF3lA== X-Google-Smtp-Source: APXvYqz2Lqv4vjEfLTLIwMdrY8rGUkSXNI9b2FeovIukDBkKYMWWprV31+vdzhTNvnmEr27DBq19vJSOW7YdU4ehFQU= X-Received: by 2002:ac2:51a3:: with SMTP id f3mr6369986lfk.94.1565200493158; Wed, 07 Aug 2019 10:54:53 -0700 (PDT) MIME-Version: 1.0 References: <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <2EF61DAB-8371-4257-82A0-8622A8F2B178@cable.comcast.com> In-Reply-To: <2EF61DAB-8371-4257-82A0-8622A8F2B178@cable.comcast.com> From: Eric Rescorla Date: Wed, 7 Aug 2019 10:54:16 -0700 Message-ID: To: "Livingood, Jason" Cc: Rob Sayre , ADD Mailing list Content-Type: multipart/alternative; boundary="00000000000065b310058f8aa368" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Aug 2019 17:54:57 -0000 --00000000000065b310058f8aa368 Content-Type: text/plain; charset="UTF-8" On Wed, Aug 7, 2019 at 7:38 AM Livingood, Jason wrote: > *From: *Add on behalf of Rob Sayre < > sayrer@gmail.com> > > > I don't think that's the case. As Mozilla's presentation stated: DNS is > not an effective control surface. > > > > You can say that, as can Mozilla, but the market & deployment data > suggests the complete opposite. > I know you have a strongly held contrary view but I think you are in the > rough on this one and hope we can move on. > I read Martin's presentation as saying that DNS is not a good control point (for the reasons he indicates) and that it is going to become increasingly less effective. That's not really something which the data you are referring to speaks to, and I don't actually think there's consensus on the contrary point. -Ekr > > Jason > > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --00000000000065b310058f8aa368 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable

On Wed, Aug 7, 2019 at 7:38 AM Livingood, Jason <<= a href=3D"mailto:Jason_Livingood@comcast.com">Jason_Livingood@comcast.com> wrote:

From: = Add <add-bounces@ietf.org> o= n behalf of Rob Sayre <sayrer@gmail.com>

> I don't think that's the case. As Mozil= la's presentation stated: DNS is not an effective control surface.

=C2=A0<= /span>

You can say that, as = can Mozilla, but the market & deployment data suggests the complete opp= osite.

I know you have a strongly held contrary view but I think you are i= n the rough on this one and hope we can move on.


I r= ead Martin's presentation as saying that DNS is not a good control poin= t (for the reasons he indicates) and that it is going to become increasingl= y less effective. That's not really something which the data you are re= ferring to speaks to, and I don't actually think there's consensus = on the contrary point.

-Ekr



=C2=A0<= /span>

Jason

=C2=A0

--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--00000000000065b310058f8aa368-- From nobody Wed Aug 7 10:57:35 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E68D4120284 for ; Wed, 7 Aug 2019 10:57:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.499 X-Spam-Level: X-Spam-Status: No, score=-17.499 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vIirAhYr7l2C for ; Wed, 7 Aug 2019 10:57:30 -0700 (PDT) Received: from mail-wm1-x32c.google.com (mail-wm1-x32c.google.com [IPv6:2a00:1450:4864:20::32c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E1D5F1204AE for ; Wed, 7 Aug 2019 10:57:29 -0700 (PDT) Received: by mail-wm1-x32c.google.com with SMTP id v19so899894wmj.5 for ; Wed, 07 Aug 2019 10:57:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=PhTGdYokCv41QGYaZaTcEyBp2OiQ06K4lPbFxcDhXE0=; b=ekbNv6GqWic+F62MqbZmxy0wbZ6oqDTekN6wErPTybW8YXGyiD3uccYIWUdKHMhTZ+ YY3QMdV1suP2d7qJ+zSlKL7a+BGo0apZTHsT3z5z1Ll/65PYyMtMckOX4hMD/+TdgbZe WGDDFmpgvm9KOpOkNOXgRdzh64/7sDGVPf0zO7Q7xYz7NvE1Z/nw4p8pTf8CnNS0t2y8 BKK89ggUqArad5o4zVpRo7nHrIXno0zOPjDlYKKjvWFI4oqeh/JHeGvE8XEkHJtY4+6+ 0Wg0vu/Vec0o3YCrcM+Fp3XhvT67TRhONWfKYRRntBcB1wIvYsE8eK7foGQ3iLXU7S2w pg/g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=PhTGdYokCv41QGYaZaTcEyBp2OiQ06K4lPbFxcDhXE0=; b=kDoS6dP8kmEu7FW3ViEwgM70+NbKxZCXxhhoac56ShJeIn+VIUuwaIxfmm9KdvuB2G nDLLBhNPGMQOpf4M3sbsVG4WV1r7Pwpup1dzI6Ohhpg/HQl1vbtQh8LOqKVifWH7zb7+ qz6EOCjaf9X8GjUyNrT9ZwjdTN5A8FhPymk/mdBJMsh+Y2/spNac9kRMKoO/TCgXMVqL 3ge8jr/qCe3mszUdnb2oWEQNTHGAqbXnXD4nNXm4rbyPF5XwFCkAGBWnahrt5WbBa5wI ol/D8L5O0oXvCXFwK+cKf9D4kWfH/NGImLBpYlLgnQerxF6aHS4cERSfszjAdcZwIcv3 Vzcg== X-Gm-Message-State: APjAAAUYGRAXwsbM+OflIpntSAfRkpfhcVD/ArPP5kdJXU+ahfDyHw1P Md+4thEiKmKtI1L0vsFFrOUe3GcdaFhdjnDDwrkw8A== X-Google-Smtp-Source: APXvYqxaYmZq5aGgJCHWRWntz9XWtsvA20dja2IQyePCJYNVtAsNhlsM2Ts9P4/bIZeDw1WFWCkcOCz2cPHRNIVwsZo= X-Received: by 2002:a7b:c051:: with SMTP id u17mr1033759wmc.25.1565200647982; Wed, 07 Aug 2019 10:57:27 -0700 (PDT) MIME-Version: 1.0 References: <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> <64bcfc51-6f3d-ae24-4de5-d0eb89975c66@cs.tcd.ie> <539D6F9D-137C-4F68-A8DE-EA3DFAF4D827@huitema.net> <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <841102D9-4B50-4415-8193-FF3766F91958@gmail.com> <41BFA10B-231E-4694-A498-442B5B0BF9DE@gmail.com> In-Reply-To: <41BFA10B-231E-4694-A498-442B5B0BF9DE@gmail.com> From: Eric Orth Date: Wed, 7 Aug 2019 13:57:16 -0400 Message-ID: To: Bret Jordan Cc: Jim Reid , ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000a065d7058f8aaced" Archived-At: Subject: Re: [Add] HTTP privacy considerations for DoH Clients X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Aug 2019 17:57:33 -0000 --000000000000a065d7058f8aaced Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Depends on the scope of the particular documents. If we're talking a document of privacy guidance/considerations specifically for protocol implementers, only unintentional is in scope, since malware developers would obviously ignore such guidance. If a document for multiple audiences (such as the protocol specs themselves), or separate documents for other audiences, then yes, guidance for network operators on dealing with intentional action is also important. I would argue that guidance documents on DoH/DoT privacy considerations should be separate documents for implementer guidance and guidance for network operators dealing with the traffic in their networks. Somebody seeking such guidance is very likely going to be one or the other and the guidance will be much better communicated if targeted to them. We should certainly have many different parties helping write all such documents to provide valuable feedback, but I think we should separate and target the intended audiences of such documents. On Wed, Aug 7, 2019 at 1:18 PM Bret Jordan wrote: > You mean both =E2=80=9Cunintentionally and intentionally=E2=80=9D. > > The privacy consideration and security consideration sections need to be > written for end-users / organizations / enterprises as well as for > developers. They need to say, hey, if you let this protocol through your > network, here are the new risks you need to worry about. Here is the > increased attack surface. Here are the new risks to privacy. Or maybe > what we need is a =E2=80=9CPrivacy and Risk=E2=80=9D section in every RFC= . Something that > calls out how this new fangled thing is going to impact operational > security. > > Thanks, > Bret > PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 > "Without cryptography vihv vivc ce xhrnrw, however, the only thing that > can not be unscrambled is an egg." > > On Aug 7, 2019, at 10:30 AM, Eric Orth wrote: > > (Thanks for branching off to another subject. I wanted to respond in the > other thread when this was brought up, but it was kinda off-topic for mos= t > of what was being discussed there.) > > Agreed. There is certainly lots of room for a DoT or DoH client to > unintentionally make bad privacy decisions. Publishing guidance and > information can help ensure they have thought things through before they > make privacy-affecting decisions. This is a very actionable area for > IETF. I think there would be enough consensus on many areas of guidance > (but obviously not all) to get a decent sized document. > > Not everything would necessarily be a hard and fast do or don't, as > different tradeoffs may be relevant for different applications and use > cases. That's okay since the important part is providing the information > to help applications make the correct decisions for themselves. E.g., > accepting cookies is one of the areas already briefly discussed in RFC848= 4, > and I think it took the right approach: "HTTP cookies SHOULD NOT be > accepted by DOH clients unless they are explicitly required by a use > case." I think we need more guidance like that with more detail on the > tradeoffs and considerations. It may seem obvious that applications shou= ld > never send or accept cookies with DoH, but some special-purpose applicati= on > may want to use DoH to send authentication information to a special-purpo= se > DNS server that will only return information to authorized users. DoH an= d > DNS are not limited just to the use case of browsers requesting addresses > of all hostnames to be visited. > > On Wed, Aug 7, 2019 at 12:07 PM Jim Reid wrote: > >> >> >> > On 7 Aug 2019, at 16:42, Bret Jordan wrote: >> > >> > An app or client could add additional http headers. It could add a >> unique ID for each app or client, it could add in geo-location data, it >> could all kinds of things. >> >> Indeed. IMO this sort of behaviour is something the IETF should work on: >> some do=E2=80=99s and don=E2=80=99ts on privacy issues for DoH clients. = Which WG is most >> appropriate? >> >> Apologies yet again for another meaningful and relevant Subject: header. >> I=E2=80=99m hoping that practice will catch on. :-) >> >> -- >> Add mailing list >> Add@ietf.org >> https://www.ietf.org/mailman/listinfo/add >> > > --000000000000a065d7058f8aaced Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Depends on the scope of the particular documents.=C2=A0 If= we're talking a document of privacy guidance/considerations specifical= ly for protocol implementers, only unintentional is in scope, since malware= developers would obviously ignore such guidance.=C2=A0 If a document for m= ultiple audiences (such as the protocol specs themselves), or separate docu= ments for other audiences, then yes, guidance for network operators on deal= ing with intentional action is also important.

I would a= rgue that guidance documents on DoH/DoT privacy considerations should be se= parate documents for implementer guidance and guidance for network operator= s dealing with the traffic in their networks.=C2=A0 Somebody seeking such g= uidance is very likely going to be one or the other and the guidance will b= e much better communicated if targeted to them.=C2=A0 We should certainly h= ave many different parties helping write all such documents to provide valu= able feedback, but I think we should separate and target the intended audie= nces of such documents.

On Wed, Aug 7, 2019 at 1:18 PM Bret Jordan &l= t;jordan.ietf@gmail.com> wr= ote:
You mean both =E2=80=9Cunintentionally and = intentionally=E2=80=9D.=C2=A0

The privacy consideration = and security consideration sections need to be written for end-users / orga= nizations / enterprises as well as for developers.=C2=A0 They need to say, = hey, if you let this protocol through your network, here are the new risks = you need to worry about.=C2=A0 Here is the increased attack surface.=C2=A0 = Here are the new risks to privacy.=C2=A0 Or maybe what we need is a =E2=80= =9CPrivacy and Risk=E2=80=9D section in every RFC.=C2=A0 Something that cal= ls out how this new fangled thing is going to impact operational security. = =C2=A0

Thanks,
Bret
= PGP Fingerprint:=C2=A063B4 FC53 680A 6B7D 1447 =C2=A0F2C0 74F8 ACAE 7415 0050<= /span>
"Without= cryptography vihv vivc ce xhrnrw, however, the only thing that can not be = unscrambled is an egg."
<= /div>

On Aug 7, 2019, at 10:30 AM, Eric O= rth <ericorth@g= oogle.com> wrote:

(Thanks for br= anching off to another subject.=C2=A0 I wanted to respond in the other thre= ad when this was brought up, but it was kinda off-topic for most of what wa= s being discussed there.)

Agreed.=C2=A0 There is certai= nly lots of room for a DoT or DoH client to unintentionally make bad privac= y decisions.=C2=A0 Publishing guidance and information can help ensure they= have thought things through before they make privacy-affecting decisions.= =C2=A0 This is a very actionable area for IETF.=C2=A0 I think there would b= e enough consensus on many areas of guidance (but obviously not all) to get= a decent sized document.

Not everything would necessari= ly be a hard and fast do or don't, as different tradeoffs may be releva= nt for different applications and use cases.=C2=A0 That's okay since th= e important part is providing the information to help applications make the= correct decisions for themselves.=C2=A0 E.g., accepting cookies is one of = the areas already briefly discussed in RFC8484, and I think it took the rig= ht approach: "HTTP cookies SHOULD NOT be accepted by DOH clients unles= s they are explicitly required by a use case."=C2=A0 I think we need m= ore guidance like that with more detail on the tradeoffs and considerations= .=C2=A0 It may seem obvious that applications should never send or accept c= ookies with DoH, but some special-purpose application may want to use DoH t= o send authentication information to a special-purpose DNS server that will= only return information to authorized users.=C2=A0 DoH and DNS are not lim= ited just to the use case of browsers requesting addresses of all hostnames= to be visited.

On Wed, Aug 7, 2019 at 12:07 PM Jim Reid <jim@rfc1035.com> wrote= :


> On 7 Aug 2019, at 16:42, Bret Jordan <jordan.ietf@gmail.com> wrote:
>
> An app or client could add additional http headers.=C2=A0 It could add= a unique ID for each app or client, it could add in geo-location data, it = could all kinds of things.=C2=A0

Indeed. IMO this sort of behaviour is something the IETF should work on: so= me do=E2=80=99s and don=E2=80=99ts on privacy issues for DoH clients. Which= WG is most appropriate?

Apologies yet again for another meaningful and relevant Subject: header. I= =E2=80=99m hoping that practice will catch on. :-)

--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add

--000000000000a065d7058f8aaced-- From nobody Wed Aug 7 10:59:37 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AD4E4120695 for ; Wed, 7 Aug 2019 10:59:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FzfPpwxwbF7j for ; Wed, 7 Aug 2019 10:59:33 -0700 (PDT) Received: from mail-lf1-x133.google.com (mail-lf1-x133.google.com [IPv6:2a00:1450:4864:20::133]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 70B6A1204D1 for ; Wed, 7 Aug 2019 10:59:33 -0700 (PDT) Received: by mail-lf1-x133.google.com with SMTP id p197so64656801lfa.2 for ; Wed, 07 Aug 2019 10:59:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=sZyB18zqnQVTDj8HWHLx1wvHF6tMlpQFuLur+lAoXxA=; b=cqtTkrunH1XoOYSmvBJMMI1zANlGOwA3vG9QZw/vHoJjso2zWQuz5VXl9+sjoDfjqf PYzcchYWO5SiCqrXtlwO/aZP9Apxs+IwNS6FIaroZmwrVigrDA5sd4VjD6b5oYHUWZ/v nf4FGYZHaShAg3af+LyMtRYntw95uJ1ECoCcxK8uAOhHNiMSqPO25ejIlYMnF+qdZYmv acwCXy/XsdqgoCF8Oi5qpecbBAhO0v54cXqVvgFBe9LlSnhrnzFFfKwTgxLxMinSHmay U8JWryQR2SkI0NteRDw6lPxh5KvCRKmwwpjYtCBL05suTTwcU/0dYXNND8a4w0qRHWRM xlXw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=sZyB18zqnQVTDj8HWHLx1wvHF6tMlpQFuLur+lAoXxA=; b=o5QhnfqlU6G/2KtxeithsWjZ2JBUUJrc/8scigbYpZx51JSyU0MXe0Xdoe0nvZrbye Fl5r0WfemIgQn8gvAJt7pTOHOeJuX2Wgm4r1d/1v7/3UNKKwWLelj/7lCW5a8TD3CXRr o4jDp99ivUnV+7JNd7cCxs6KmUjgM21BA6zSdGVHOcAcwkgJQyYQ8veClub1CHI0wzF0 M+MAz6ue73zjWP8Xg4+y45n3j/M+AHqviHM8f/j9laFkS39iKWqW7Uen8SocGS0MGv1T 3JXw/7MBG/NsuI92ddmCOrYAsYMGc1X8owy0BA+v9N1vWaLJeylQKPRoXYSaGKICwq7v t8DQ== X-Gm-Message-State: APjAAAUjOwK03mwmG4G2R2LslXb6k6GhRkoBOy9VAER20rBLmAT8oO4M rkuAUxBKHtHmmi1IGHf/IsBaLQeJiUVh6ZpvV0cvQA== X-Google-Smtp-Source: APXvYqz1dvk7LrOF0RZvK7hpK8GlYRVj60hetaQbr0aMAA/uWz7ruhRARZq9JSj0i1MDlBvAGffXlS5qDhrUm8TNZws= X-Received: by 2002:a19:4a50:: with SMTP id x77mr6433463lfa.91.1565200771733; Wed, 07 Aug 2019 10:59:31 -0700 (PDT) MIME-Version: 1.0 References: <2D09D61DDFA73D4C884805CC7865E6114E25886C@GAALPA1MSGUSRBF.ITServices.sbc.com> <2D09D61DDFA73D4C884805CC7865E6114E258909@GAALPA1MSGUSRBF.ITServices.sbc.com> In-Reply-To: <2D09D61DDFA73D4C884805CC7865E6114E258909@GAALPA1MSGUSRBF.ITServices.sbc.com> From: Eric Rescorla Date: Wed, 7 Aug 2019 10:58:55 -0700 Message-ID: To: "STARK, BARBARA H" Cc: ADD Mailing list , "Deen, Glenn (NBCUniversal)" Content-Type: multipart/alternative; boundary="0000000000000070ac058f8ab4ae" Archived-At: Subject: Re: [Add] Auditing apps X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Aug 2019 17:59:36 -0000 --0000000000000070ac058f8ab4ae Content-Type: text/plain; charset="UTF-8" On Wed, Aug 7, 2019 at 10:51 AM STARK, BARBARA H wrote: > > One of the downsides of encryption is it will be much harder to > > actually audit the data being sent by applications to resolvers. > > > > I'm not against encryption, but I'm bothered when things are encrypted > > for my protection but are also invisible to me. > > > > I'm relatively sure there will be researchers who will make the > > effort to keep the big browser makers honest, but the ability for > > others apps to add DoH and undisclosed http headers for tracking is > likely something we should > > expect to see in the future. This is a specific worry to DoH since > it's over > > http. > > > > My point is that we shouldn't be complacent here and be too quick to > > dismiss worries. Instead it would be nice if researchers were engaging > > now up front to poke at things and explore where the abuse opportunities > are. > > I'm concerned with this too. Lenovo at one time was shipping laptops with > a MS OS and IE browser they had customized to insert a "trusted" > certificate that allowed Superfish to break browser encryption and insert > ads. They had to stop that (but defended it) because of public backlash > [1], but not because there was any rule against it [2]. From what I can > see, there is nothing that would prevent a laptop/tablet > manufacturer/provider from including a custom browser that is branded and > looks just like the non-customized version of the same browser, but uses > DoH to send all DNS traffic to the manufacturer's 3rd party partner DoH > provider -- complete with lots of headers, cookies, and everything else > needed to thoroughly track a user. This doesn't even break encryption. It's > clear there's nothing the honest browser and DoH providers can do to > prevent this. But this is a problem created by IETF standards, that IETF > has an obligation (IMO) to try to fix before the abuses become rampant. > I certainly agree that fake malicious versions of common applications are a risk, but that risk exists with or without DoH. If you have a malicious browser which wants to track the user, it doesn't need to send it via DoH but can just form an ordinary connection back to the manufacturer and send the user's data. -Ekr > [1] > https://www.theverge.com/2015/2/19/8067505/lenovo-installs-adware-private-data-hackers > [2] https://cdt.org/insight/is-breaking-web-encryption-legal/ > > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --0000000000000070ac058f8ab4ae Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Wed, Aug 7, 2019 at 10:51 AM STARK= , BARBARA H <bs7652@att.com> wr= ote:
> One of= the downsides of encryption is it will be much harder to
> actually audit the data being sent by applications to resolvers.
>
> I'm not against encryption, but I'm bothered when things are e= ncrypted
> for my protection but are also invisible to me.
>
>=C2=A0 =C2=A0I'm relatively sure there will be researchers who will= make the
> effort to keep the big browser makers honest, but the ability for
> others apps to add DoH and undisclosed http headers for tracking is li= kely something we should
> expect to see in the future.=C2=A0 =C2=A0This is a specific worry to D= oH since it's over
> http.
>
> My point is that we shouldn't be complacent here and be too quick = to
> dismiss worries. Instead it would be nice if researchers were engaging=
> now up front to poke at things and explore where the abuse opportuniti= es are.

I'm concerned with this too. Lenovo at one time was shipping laptops wi= th a MS OS and IE browser they had customized to insert a "trusted&quo= t; certificate that allowed Superfish to break browser encryption and inser= t ads. They had to stop that (but defended it) because of public backlash [= 1], but not because there was any rule against it [2]. From what I can see,= there is nothing that would prevent a laptop/tablet manufacturer/provider = from including a custom browser that is branded and looks just like the non= -customized version of the same browser, but uses DoH to send all DNS traff= ic to the manufacturer's 3rd party partner DoH provider -- complete wit= h lots of headers, cookies, and everything else needed to thoroughly track = a user. This doesn't even break encryption. It's clear there's = nothing the honest browser and DoH providers can do to prevent this. But th= is is a problem created by IETF standards, that IETF has an obligation (IMO= ) to try to fix before the abuses become rampant.

=
I certainly agree that fake malicious versions of common applica= tions are a risk, but that risk exists with or without DoH. If you have a m= alicious browser which wants to track the user, it doesn't need to send= it via DoH but can just form an ordinary connection back to the manufactur= er and send the user's data.

-Ekr



[1] https://ww= w.theverge.com/2015/2/19/8067505/lenovo-installs-adware-private-data-hacker= s
[2] https://cdt.org/insight/is-breaking-web= -encryption-legal/


--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--0000000000000070ac058f8ab4ae-- From nobody Wed Aug 7 11:00:24 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 86F201206BB for ; Wed, 7 Aug 2019 11:00:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zjdxu3XQXwny for ; Wed, 7 Aug 2019 11:00:21 -0700 (PDT) Received: from mail-lj1-x233.google.com (mail-lj1-x233.google.com [IPv6:2a00:1450:4864:20::233]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2CF9F1206B5 for ; Wed, 7 Aug 2019 11:00:21 -0700 (PDT) Received: by mail-lj1-x233.google.com with SMTP id m23so86244660lje.12 for ; Wed, 07 Aug 2019 11:00:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=Fs16h7jc+8+FztqCsn0lZvzMawAJ17AS/jUo66mbex0=; b=1Velodl+J+xYfRHBR2sDnYy0/O+3dx3pBnlBkrzpctrfrPNhghKM4KsTo8aOXBNWvv /WUIqzrIW7QTmujKrniVj2aIyXxlyIhWRlCcb/3gp8q496gi4Lq7dHwP4q0KKrlhZkOX D2pI7r6lhlQ/PW3REDesVDcoxgiRlH5Gyq2J7ouI0Ba3mLiO4MIdJG/0kNfJ+KiH7G6h +/AV1SiLnuW5cHMKWRrraDY7w9wfrHJmnvKJN80NyONP/FME5yOSOVcLZSMx80dGfLUS /RfyIjv4Qg4avRzQeto8qz/ZNnocJ7oxW6pGU+WQTkEI81u4X44oh69lIe7RFLS8cetH xgFA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=Fs16h7jc+8+FztqCsn0lZvzMawAJ17AS/jUo66mbex0=; b=qjo1VXl0dZan9WU1IVNw6lN9s82qtZElmZWW5j0w+eQHLLLmprthurgcgrJWv2Hvls CZXIaQ3wARz0ssz4xj1mGYAtUZUxK3/G1QyjxAms85Tc4Ib3l5E3ACoGgrdqfO7A8X1E 1zzfqrrcvVXuvyrX87Y4F/DtiA1mZBLa6HLX/eNKgy1ascfM2edQMSRRx4m2EdZ9SWgU TwhyzePgdCdUmLkgTYj/unXxHM8NWsccJOiIEtjwIyu2oYqyWZaHwL2BTmRcZ1hzCGIa in+cLAbSUUVLjHpfZaIFBCmFGRv571KBwvIbLIgglisxH8R0FA12QFnIs9kPUcM5N07v C5fQ== X-Gm-Message-State: APjAAAX801KP1QtvSjovaaiFFmqwKPNfkA30Q85ZbYRCn0j5F0w7J4mR 1BtIyEDwlsZgv5y+zAXHLWO0nOo2yNQwXqYSlb4zIA== X-Google-Smtp-Source: APXvYqyIlqTm0QHFvL603WMVICgUuFEtW+ly1miOq5pCZgtOTm5T3c6ruAF+QVxK0VEB8q10cW+1RfMXZ/yyZQA9VUM= X-Received: by 2002:a2e:9cd4:: with SMTP id g20mr5185595ljj.205.1565200819402; Wed, 07 Aug 2019 11:00:19 -0700 (PDT) MIME-Version: 1.0 References: <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> <64bcfc51-6f3d-ae24-4de5-d0eb89975c66@cs.tcd.ie> <539D6F9D-137C-4F68-A8DE-EA3DFAF4D827@huitema.net> <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <841102D9-4B50-4415-8193-FF3766F91958@gmail.com> In-Reply-To: From: Eric Rescorla Date: Wed, 7 Aug 2019 10:59:43 -0700 Message-ID: To: Jim Reid Cc: Bret Jordan , ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000d801a5058f8ab63b" Archived-At: Subject: Re: [Add] HTTP privacy considerations for DoH Clients X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Aug 2019 18:00:23 -0000 --000000000000d801a5058f8ab63b Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Wed, Aug 7, 2019 at 9:07 AM Jim Reid wrote: > > > > On 7 Aug 2019, at 16:42, Bret Jordan wrote: > > > > An app or client could add additional http headers. It could add a > unique ID for each app or client, it could add in geo-location data, it > could all kinds of things. > > Indeed. IMO this sort of behaviour is something the IETF should work on: > some do=E2=80=99s and don=E2=80=99ts on privacy issues for DoH clients. W= hich WG is most > appropriate? > How would this be different from https://tools.ietf.org/rfcmarkup?doc=3D8484#section-8? -Ekr > Apologies yet again for another meaningful and relevant Subject: header. > I=E2=80=99m hoping that practice will catch on. :-) > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --000000000000d801a5058f8ab63b Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Wed, Aug 7, 2019 at 9:07 AM Jim Re= id <jim@rfc1035.com> wrote:


> On 7 Aug 2019, at 16:42, Bret Jordan <jordan.ietf@gmail.com> wrote:
>
> An app or client could add additional http headers.=C2=A0 It could add= a unique ID for each app or client, it could add in geo-location data, it = could all kinds of things.=C2=A0

Indeed. IMO this sort of behaviour is something the IETF should work on: so= me do=E2=80=99s and don=E2=80=99ts on privacy issues for DoH clients. Which= WG is most appropriate?

<= div>
-Ekr


Apologies yet again for another meaningful and relevant Subject: header. I= =E2=80=99m hoping that practice will catch on. :-)

--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--000000000000d801a5058f8ab63b-- From nobody Wed Aug 7 11:10:13 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 88194120697 for ; Wed, 7 Aug 2019 11:10:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ijK63Th5yHxa for ; Wed, 7 Aug 2019 11:10:08 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 158251202E1 for ; Wed, 7 Aug 2019 11:10:08 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 4C47ABE3E; Wed, 7 Aug 2019 19:10:06 +0100 (IST) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iPNPJCBrjoB5; Wed, 7 Aug 2019 19:10:05 +0100 (IST) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id E5215BE2F; Wed, 7 Aug 2019 19:10:04 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1565201405; bh=leWGQClwbUEAV0y0t0hC4s6h7uW6i7uHLgQxi2iy+K4=; h=To:References:From:Subject:Date:In-Reply-To:From; b=RlcYIhEItAFHdoyisY4HoXUWiSPOFw1tmLEC+DC8w2b0OurvoFb1cr8IHkSX64qqS +akexueqKfGko85FsI9of19sI/Eho1YTTieWKbTswI5knNY4pQzf9YwpmLntJGpU4p ksPQItJf61RzPo0mwhxdPPDFwFyH/ZgN/ywywTVo= To: "'Deen, Glenn (NBCUniversal)'" , 'ADD Mailing list' References: <2D09D61DDFA73D4C884805CC7865E6114E25886C@GAALPA1MSGUSRBF.ITServices.sbc.com> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: Date: Wed, 7 Aug 2019 19:10:04 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: <2D09D61DDFA73D4C884805CC7865E6114E25886C@GAALPA1MSGUSRBF.ITServices.sbc.com> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="fBDnuBXNFgJdhY3h7ED19A9RFvcfJ9d21" Archived-At: Subject: Re: [Add] Auditing apps X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Aug 2019 18:10:11 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --fBDnuBXNFgJdhY3h7ED19A9RFvcfJ9d21 Content-Type: multipart/mixed; boundary="8PEYeDAeWArk9npCfPk864QDCX17up9C4"; protected-headers="v1" From: Stephen Farrell To: "'Deen, Glenn (NBCUniversal)'" , 'ADD Mailing list' Message-ID: Subject: Re: Auditing apps References: <2D09D61DDFA73D4C884805CC7865E6114E25886C@GAALPA1MSGUSRBF.ITServices.sbc.com> In-Reply-To: <2D09D61DDFA73D4C884805CC7865E6114E25886C@GAALPA1MSGUSRBF.ITServices.sbc.com> --8PEYeDAeWArk9npCfPk864QDCX17up9C4 Content-Type: multipart/mixed; boundary="------------48759BAEAA2D86FDFB71C029" Content-Language: en-GB This is a multi-part message in MIME format. --------------48759BAEAA2D86FDFB71C029 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hiya, On 07/08/2019 18:46, STARK, BARBARA H wrote: > But this is a problem created by IETF standards, that IETF has an > obligation (IMO) to try to fix before the abuses become rampant. Do53 can be used in DDoS reflection attacks. We don't plan to not use DNS because of that. We do try to document the issues and maybe reduce the amplification factors. Doing analogously in the case of ADD would seem reasonable but I'm not at all sure this is well-described as a case where there's a thing to simply "fix." And talk of abuses becoming rampant seems to ignore the real existence of other benefits. Anyway, I figure many recent mails to this list are really people repeating their starting positions. (So I'll also shut up for a bit:-) Cheers, S. --------------48759BAEAA2D86FDFB71C029 Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------48759BAEAA2D86FDFB71C029-- --8PEYeDAeWArk9npCfPk864QDCX17up9C4-- --fBDnuBXNFgJdhY3h7ED19A9RFvcfJ9d21 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAl1LE/wACgkQWrL68XsX K+pM2g//aDfsnmhCE/BUtEGb6a4ZGf4TYKVNti4OP8htp/PMd60ZOd+c6awP/ez4 VfpK2h261QDDTajpCEjV5LfpAyDsicZuD/+KJSTKBJnTFSpeKZuR+kvW6JqCNKkC BSorHnSvIVZkblxGa8NuKxxUNWKGYhVmBobsLO/k5hlurK5J/ZLbutlo6uF1xROA hKr4+LgStkSIl/cQ2qhWGJGCpbilwmjGo24TZ/Bby8XFZlWOKIqmQNCJ6J5bxzlP wwHB1TxoNLLRDcXdCnI73sZmVAovyON0a6llcM+DsBujy/BGQeiWlPBHZwRui9jF mKIDQMwq4KuImuLURMQO7hkF3bp3phoJ7BEFk+bYoEf2XL32g72ahgG8c3rsI/Ve XUacr66c8vujs4rjXE5Epo02FuaPjdAaokIFCYiM5rXfAI+8b6WqvUj3rH1jmM8z U6nHHxZsbAMq/q9bqErIJMN3YsEElBnEKHOBMhvvL0YxvTnUFGV5CjA9ygsh5Jvo mwQKsM5zEWDLXmaUKpqqyw0iJ5npUDGfg+0ab4JOyIC4HVaYtfYlVWByqJINi/VH gasyPS5FiTr7KGtw145lUBKqY5qJKhMq/4RKTuR3is5DTBcYFGqcA3Y8yV10qNxg uCdbbfkd5GIUnt/3B6GVDN0E6cXcsajCyotHUZbxxejRHfCwGso= =nWa2 -----END PGP SIGNATURE----- --fBDnuBXNFgJdhY3h7ED19A9RFvcfJ9d21-- From nobody Wed Aug 7 11:16:30 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 28A63120275 for ; Wed, 7 Aug 2019 11:16:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.499 X-Spam-Level: X-Spam-Status: No, score=-17.499 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VF65EE6Cxyzt for ; Wed, 7 Aug 2019 11:16:26 -0700 (PDT) Received: from mail-wr1-x432.google.com (mail-wr1-x432.google.com [IPv6:2a00:1450:4864:20::432]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 33095120693 for ; Wed, 7 Aug 2019 11:16:23 -0700 (PDT) Received: by mail-wr1-x432.google.com with SMTP id p13so17727470wru.10 for ; Wed, 07 Aug 2019 11:16:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=ZlRitxYWPszt7Txb8vQ8CYOPfgmFLwFuE6diWUlYGYU=; b=ec6YZxCk3VSWlcp5CuI5+XBUElG05kKbM8L7l/Aeq8aJAgyBlg1D8u+hf6w8kkhfHV FWBLZiRMkQeSiDeh65x2Mv1eU2WhLC4Q6Yk8KSMXrlS4fe70XQOjrR+N24ZkawyZtNyF 9R8Of1sWuVhupRgeMFEG044aGXOGanpO1E92eodWmDO4co4al9xoDG/KshROuPfiB6Sj NzT1QLRZ/cI1ar5itg8fiCJF//NU5FT3ouZmQdZwaida6IpPt1hFr8a06zJx57EN8edU 9VKbdGKuyna9en5ge04gdhwJqBXhjQZkJbJwLxqmou3/yO3aQNJmJeq4xcktS3kupd1m 3tEQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=ZlRitxYWPszt7Txb8vQ8CYOPfgmFLwFuE6diWUlYGYU=; b=HDXyWfJrQfMe81SKH9TLYkWV2hvAtI2432FC8WHePtXrD4Jn/3vAk9flj2wD8gJJCC W7g250BwsN2tvObvkfqHqWt5AMPsK0XMctdnv4Akzu+5r5+27MC6eFaKLS8AVnPtgQGb hRZXhXn8/U0LcJC1DcZgRhbrvulFmhtqUyADHjmI/PpJ/oQpc5acGZ01dI8WX/y11XDu fzTnDnc7aEdsYHGzr1gLCwH7eJf2/MAIQlvuHEYL/dUgux92lfnxqwyAT4x/fBPTWJJ6 Wl+U+Nas6EJ8bNlPK+x+QNlovX0As4wgRSMcSpj2kG8oOHEFdZ9xXoniB/fWhpaxwroW 4b8A== X-Gm-Message-State: APjAAAU700UeURHJOWaf5SUBZV3v3UlNlnXgAoet2fR38Ul8+GbkH6Hv dvVi3rrYej4ttlo9MMHjiInSl5/HeGXtoEA/RHWCXw== X-Google-Smtp-Source: APXvYqwAL4UbVb5xAgVRoOYcTgMFHz4CTpKI0mdTWsqcyRYPNMSAxwu1cpviNcMfrl284TOqXPehV8giYL+2/ahz3WY= X-Received: by 2002:adf:d081:: with SMTP id y1mr12859267wrh.34.1565201781449; Wed, 07 Aug 2019 11:16:21 -0700 (PDT) MIME-Version: 1.0 References: <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> <64bcfc51-6f3d-ae24-4de5-d0eb89975c66@cs.tcd.ie> <539D6F9D-137C-4F68-A8DE-EA3DFAF4D827@huitema.net> <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <841102D9-4B50-4415-8193-FF3766F91958@gmail.com> In-Reply-To: From: Eric Orth Date: Wed, 7 Aug 2019 14:16:09 -0400 Message-ID: To: Eric Rescorla Cc: Jim Reid , ADD Mailing list , Bret Jordan Content-Type: multipart/alternative; boundary="0000000000002fddce058f8af0cf" Archived-At: Subject: Re: [Add] HTTP privacy considerations for DoH Clients X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Aug 2019 18:16:28 -0000 --0000000000002fddce058f8af0cf Content-Type: text/plain; charset="UTF-8" On Wed, Aug 7, 2019 at 2:00 PM Eric Rescorla wrote: > > How would this be different from > https://tools.ietf.org/rfcmarkup?doc=8484#section-8? > > I believe the assumption is that informational RFCs could discuss the privacy considerations in more depth and breadth than is appropriate in the protocol RFC (or than is agreeable to the higher bar for a standards RFC). I don't know if that assumption is completely true or not. Depends on what sort of content people can come up with. I think it's certainly worth exploring further. I'd like to see specific ideas/drafts for such a document. Then we can criticize it as redundant with RFC8484 section 8 if it is so. --0000000000002fddce058f8af0cf Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Wed, Aug 7, 2019 at 2:00 PM Eric Resco= rla <ekr@rtfm.com> wrote:
I believe the assumption is that informational RFCs could disc= uss the privacy considerations in more depth and breadth than is appropriat= e in the protocol RFC (or than is agreeable to the higher bar for a standar= ds RFC).=C2=A0 I don't know if that assumption is completely true or no= t.=C2=A0 Depends on what sort of content people can come up with.=C2=A0 I t= hink it's certainly worth exploring further.=C2=A0 I'd like to see = specific ideas/drafts for such a document.=C2=A0 Then we can criticize it a= s redundant with RFC8484 section 8 if it is so.
--0000000000002fddce058f8af0cf-- From nobody Wed Aug 7 11:43:26 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 08C4F12028B for ; Wed, 7 Aug 2019 11:43:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kKCisVXM7vzm for ; Wed, 7 Aug 2019 11:43:23 -0700 (PDT) Received: from shaun.rfc1035.com (smtp.v6.rfc1035.com [IPv6:2001:4b10:100:7::25]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 714D0120152 for ; Wed, 7 Aug 2019 11:43:23 -0700 (PDT) Received: from wallace.rfc1035.com (hutch.rfc1035.com [195.54.233.70]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by shaun.rfc1035.com (Postfix) with ESMTPSA id 8A1AA242109D; Wed, 7 Aug 2019 18:43:15 +0000 (UTC) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) From: Jim Reid In-Reply-To: Date: Wed, 7 Aug 2019 19:43:14 +0100 Cc: ADD Mailing list Content-Transfer-Encoding: quoted-printable Message-Id: <915920CE-49DA-49EC-833A-4B6F54AF7D00@rfc1035.com> References: <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> <64bcfc51-6f3d-ae24-4de5-d0eb89975c66@cs.tcd.ie> <539D6F9D-137C-4F68-A8DE-EA3DFAF4D827@huitema.net> <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <841102D9-4B50-4415-8193-FF3766F91958@gmail.com> To: Eric Rescorla X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: Re: [Add] HTTP privacy considerations for DoH Clients X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Aug 2019 18:43:25 -0000 > On 7 Aug 2019, at 18:59, Eric Rescorla wrote: >=20 > On Wed, Aug 7, 2019 at 9:07 AM Jim Reid wrote: >=20 >=20 >=20 > Indeed. IMO this sort of behaviour is something the IETF should work = on: some do=E2=80=99s and don=E2=80=99ts on privacy issues for DoH = clients. Which WG is most appropriate? >=20 > How would this be different from = https://tools.ietf.org/rfcmarkup?doc=3D8484#section-8? Well for starters, section 8 of RFC8484 says nothing directly about = client-side privacy. Though it does do that for privacy considerations = in the server. RFC8484 mentions there are new considerations because = HTTP offers extra opportunities for correlation. It doesn't clearly say = what those considerations are or how to address them. Saying "DoH is not known to introduce new concerns beyond those = associated with HTTPS." is all very well. [Though perhaps that's the = easy way out.] Even so I think it would be good to have a discrete = document which identified those privacy concerns in a DoH setting and = their trade-offs/consequences. That would be very helpful. IMO it would = also save DoH developers from having to make sense of almost everything = in the HTTP document set before deciding what protocol features would be = good or bad from a privacy perspective in their client-side software. And who knows, maybe those running DoH servers might configure them to = ignore 'naughty' headers or even reject queries that use the = privacy-unfriendly stuff mentioned earlier. It's nice to dream, eh? From nobody Wed Aug 7 11:50:03 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 91DC612028B for ; Wed, 7 Aug 2019 11:44:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.679 X-Spam-Level: X-Spam-Status: No, score=-1.679 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_INVALID=0.1, DKIM_SIGNED=0.1, T_SPF_HELO_PERMERROR=0.01, T_SPF_PERMERROR=0.01, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=fail (1024-bit key) reason="fail (message has been altered)" header.d=nostrum.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ePHPhiK2hd8q for ; Wed, 7 Aug 2019 11:44:19 -0700 (PDT) Received: from nostrum.com (raven-v6.nostrum.com [IPv6:2001:470:d:1130::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D889F120152 for ; Wed, 7 Aug 2019 11:44:19 -0700 (PDT) Received: from Orochi.local (c-24-9-76-58.hsd1.co.comcast.net [24.9.76.58]) (authenticated bits=0) by nostrum.com (8.15.2/8.15.2) with ESMTPSA id x77Ii2Sq067062 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NO); Wed, 7 Aug 2019 13:44:04 -0500 (CDT) (envelope-from adam@nostrum.com) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=nostrum.com; s=default; t=1565203448; bh=+pfAr08BpZCUiCmQHxLe6zrXHudJ6sypYirQHs8YS2Y=; h=Subject:To:Cc:References:From:Date:In-Reply-To; b=RJNhBdE1DQTh2gTqWvsR2SyNww65qKL5Q3HFvovuzrvVnVVj6f1ask+AvmrKfxAF2 fCvhbA1lT1C65XjzkEHlIB+7rR/Q0OptOL5g0HLxLzFbHQjAgDAwueDQw0Qi/+Klwl xstLqWbBE3yi4yxYTYPl7lnBS3iOhTUSIr63UOrY= X-Authentication-Warning: raven.nostrum.com: Host c-24-9-76-58.hsd1.co.comcast.net [24.9.76.58] claimed to be Orochi.local To: "Deen, Glenn (NBCUniversal)" Cc: Stephen Farrell , Paul Wouters , Bret Jordan , Alec Muffett , ADD Mailing list , Tommy Jensen , Ralf Weber , Rob Sayre , Mikael Abrahamsson References: <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <841102D9-4B50-4415-8193-FF3766F91958@gmail.com> <51f18426-d2fd-! 1be9-5556-fe079992acce@cs.tcd.ie> <576BC95C-7F00-45C9-9A43-BC184147E8DE@nbcuni.com> From: Adam Roach Message-ID: Date: Wed, 7 Aug 2019 13:43:57 -0500 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Content-Language: en-US Archived-At: X-Mailman-Approved-At: Wed, 07 Aug 2019 11:50:02 -0700 Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Aug 2019 18:44:21 -0000 On 8/7/19 12:13, Deen, Glenn (NBCUniversal) wrote: > > On Aug 7, 2019, at 10:06 AM, Adam Roach wrote: > >>> I’m relatively sure there will be researchers who will make the effort to keep the big browser makers honest, but the ability for others apps to add DoH and undisclosed http headers for tracking is likely something we should expect to see in the future. This is a specific worry to DoH since it’s over http. >> Thanks, Glenn. I think this is the first time I’ve seen this explained clearly (outside of the malware case). Can you say more about these applications and what the worst-case outcomes might be? My (possibly naïve) view is that such apps are typically vertically integrated and therefore have much more damaging ways to track users, but it’s quite possible that we’re thinking of two very different kinds of applications. > Adam, > > I was thinking about applications outside of browsers, either desktop apps or more likely mobile apps. It seems that mobile apps are the ones that seek to push the boundaries and collect data on users and track them. Oh, I absolutely get that point. If I read things correctly, you're talking about native apps for things like Facebook, Slack, Twitter, and the like, right? The point I was trying to make above is that apps in *that* class can collect extremely detailed information about user behavior using less Rube-Goldbergesque mechanisms than laundering such data through DNS servers. I'm trying to tease out how you think the use of centralized DoH servers makes that particular landscape any different: it's not obvious to me, and so I want to make sure I'm not missing something. /a From nobody Wed Aug 7 11:55:29 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5A5441205DC for ; Wed, 7 Aug 2019 11:55:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uG7HpnqRghlZ for ; Wed, 7 Aug 2019 11:55:24 -0700 (PDT) Received: from mail-ot1-x32a.google.com (mail-ot1-x32a.google.com [IPv6:2607:f8b0:4864:20::32a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 57A67120152 for ; Wed, 7 Aug 2019 11:55:24 -0700 (PDT) Received: by mail-ot1-x32a.google.com with SMTP id o101so108495273ota.8 for ; Wed, 07 Aug 2019 11:55:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=aus3fDfF+SaPyYSr7ONpo905PWhY8Ga0NOC5Ytb98a8=; b=LICe7Pf1XhYVxbd051QlwgxFfS7h3HixLMb995JIsbqdRo9h1QJvRz+2JRDaOZTK2h X3V6HmXzHUBIpEOIgOJL+HSbD1/XiOJ1NYnBfHC+MKhDyqFBTtS3v43lTtV0gqsghO2w rCG37opeA3J7dIkKK8oZSIXti5BVoa2qY1dyEe1mumz2NPG/4Y57VQ0bwEs5oDnr5dCY c4o0F6yPo/igakOO4JKwFfpTV6HfwxPpPbxtvKfmEu0VLJGlqYXCnsdZyGdCXN5C6oNj x+jS54dEIbryOm+X8NKi2gCo7kLgyDhaiWLPu+J8UpL2zJFkTIBR5So2zjQTmQHkV+cO 0MgA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=aus3fDfF+SaPyYSr7ONpo905PWhY8Ga0NOC5Ytb98a8=; b=k8JCjNNVni0PzLp5Oj0Eoibm1R8RFo32h68ACTq/IsaBRSyMsbVpiADhoLp9jNGuho QBTWdarEB793yQcYEhPVLmKOEkTnd61xWnhTPCsO8hkMOlqDTVYNzAQ4wn9xrY3DVrqX wVIETHl1JdMGegc2GOQE/L9TIgi2tEoj4Bu+QwJdfLIrVV8rYOXsi9eKHb8uvMerG3js 4F7U6WPAZa9P+U+VEu6JHeSQu0MUV/hF8ROJ39x7jDUMetdhDAu1pXLSeePD1FcZtBmq fR+L1OIliP+IySpKvl+f7+YSy8j/90tCcOnEV3bXoHNzydXt1Nj0ORIPf6LolUmpdfCV 50UA== X-Gm-Message-State: APjAAAUkMMdcnNw4H1BkL0ULxcimzJ4SgGgOVTgT4nMJyQ/ULYQBuORQ kX6rlWitXS1GuZ4HuFOc+Wk= X-Google-Smtp-Source: APXvYqyOZP9DhRcNRRjcpT9FpXoTOjK5n8fsJpRc+KVb1ciReabSM8BnvLEICROobUlCdu4t/Id2jA== X-Received: by 2002:a5e:9917:: with SMTP id t23mr10841329ioj.23.1565204123543; Wed, 07 Aug 2019 11:55:23 -0700 (PDT) Received: from [10.249.207.252] (67-128-146-21.dia.static.qwest.net. [67.128.146.21]) by smtp.gmail.com with ESMTPSA id s3sm75048726iob.49.2019.08.07.11.55.22 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 07 Aug 2019 11:55:22 -0700 (PDT) From: Bret Jordan Message-Id: Content-Type: multipart/alternative; boundary="Apple-Mail=_AA784565-27CE-4A38-8BFC-6143A64FA6AD" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Wed, 7 Aug 2019 12:55:19 -0600 In-Reply-To: <2D09D61DDFA73D4C884805CC7865E6114E258909@GAALPA1MSGUSRBF.ITServices.sbc.com> Cc: ADD Mailing list , "Deen, Glenn (NBCUniversal)" To: "STARK, BARBARA H" References: <2D09D61DDFA73D4C884805CC7865E6114E25886C@GAALPA1MSGUSRBF.ITServices.sbc.com> <2D09D61DDFA73D4C884805CC7865E6114E258909@GAALPA1MSGUSRBF.ITServices.sbc.com> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] Auditing apps X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Aug 2019 18:55:27 -0000 --Apple-Mail=_AA784565-27CE-4A38-8BFC-6143A64FA6AD Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 You bring up excellent points Barbara. I think it is also important to = note that the application developer may purposefully use embedded DoH to = track users everywhere they go. Right now a threat actor would need to = compromise every network a user uses and the DHCP server that they use, = to be able to track a user. With DoH, and the way it is being deployed, = this becomes so much easier to impact people=E2=80=99s privacy.=20 Thanks, Bret PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 "Without cryptography vihv vivc ce xhrnrw, however, the only thing that = can not be unscrambled is an egg." > On Aug 7, 2019, at 11:51 AM, STARK, BARBARA H wrote: >=20 >> One of the downsides of encryption is it will be much harder to=20 >> actually audit the data being sent by applications to resolvers. >>=20 >> I'm not against encryption, but I'm bothered when things are = encrypted=20 >> for my protection but are also invisible to me. >>=20 >> I'm relatively sure there will be researchers who will make the=20 >> effort to keep the big browser makers honest, but the ability for=20 >> others apps to add DoH and undisclosed http headers for tracking is = likely something we should >> expect to see in the future. This is a specific worry to DoH since = it's over >> http. >>=20 >> My point is that we shouldn't be complacent here and be too quick to=20= >> dismiss worries. Instead it would be nice if researchers were = engaging=20 >> now up front to poke at things and explore where the abuse = opportunities are. >=20 > I'm concerned with this too. Lenovo at one time was shipping laptops = with a MS OS and IE browser they had customized to insert a "trusted" = certificate that allowed Superfish to break browser encryption and = insert ads. They had to stop that (but defended it) because of public = backlash [1], but not because there was any rule against it [2]. =46rom = what I can see, there is nothing that would prevent a laptop/tablet = manufacturer/provider from including a custom browser that is branded = and looks just like the non-customized version of the same browser, but = uses DoH to send all DNS traffic to the manufacturer's 3rd party partner = DoH provider -- complete with lots of headers, cookies, and everything = else needed to thoroughly track a user. This doesn't even break = encryption. It's clear there's nothing the honest browser and DoH = providers can do to prevent this. But this is a problem created by IETF = standards, that IETF has an obligation (IMO) to try to fix before the = abuses become rampant. >=20 > [1] = https://www.theverge.com/2015/2/19/8067505/lenovo-installs-adware-private-= data-hackers > [2] https://cdt.org/insight/is-breaking-web-encryption-legal/=20 >=20 >=20 > --=20 > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add --Apple-Mail=_AA784565-27CE-4A38-8BFC-6143A64FA6AD Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 You = bring up excellent points Barbara.  I think it is also important to = note that the application developer may purposefully use embedded DoH to = track users everywhere they go.   Right now a threat actor would = need to compromise every network a user uses and the DHCP server that = they use, to be able to track a user.  With DoH, and the way it is = being deployed, this becomes so much easier to impact people=E2=80=99s = privacy. 


Thanks,
Bret
PGP = Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 = 0050
"Without = cryptography vihv vivc ce xhrnrw, however, the only thing that can not = be unscrambled is an = egg."

On Aug 7, 2019, at 11:51 AM, STARK, BARBARA H <bs7652@att.com> = wrote:

One of the downsides of = encryption is it will be much harder to
actually audit = the data being sent by applications to resolvers.

I'm not against encryption, but I'm bothered when things are = encrypted
for my protection but are also invisible to = me.

 I'm relatively sure there will = be researchers who will make the
effort to keep the big = browser makers honest, but the ability for
others apps to = add DoH and undisclosed http headers for tracking is likely something we = should
expect to see in the future.   This is a = specific worry to DoH since it's over
http.

My point is that we shouldn't be complacent = here and be too quick to
dismiss worries. Instead it = would be nice if researchers were engaging
now up front = to poke at things and explore where the abuse opportunities are.

I'm concerned with this too. = Lenovo at one time was shipping laptops with a MS OS and IE browser they = had customized to insert a "trusted" certificate that allowed Superfish = to break browser encryption and insert ads. They had to stop that (but = defended it) because of public backlash [1], but not because there was = any rule against it [2]. =46rom what I can see, there is nothing that = would prevent a laptop/tablet manufacturer/provider from including a = custom browser that is branded and looks just like the non-customized = version of the same browser, but uses DoH to send all DNS traffic to the = manufacturer's 3rd party partner DoH provider -- complete with lots of = headers, cookies, and everything else needed to thoroughly track a user. = This doesn't even break encryption. It's clear there's nothing the = honest browser and DoH providers can do to prevent this. But this is a = problem created by IETF standards, that IETF has an obligation (IMO) to = try to fix before the abuses become rampant.

[1] https://www.theverge.com/2015/2/19/8067505/lenovo-installs-adwa= re-private-data-hackers
[2] https://cdt.org/insight/is-breaking-web-encryption-legal/ =


--
Add = mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add

= --Apple-Mail=_AA784565-27CE-4A38-8BFC-6143A64FA6AD-- From nobody Wed Aug 7 12:05:05 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DEA391205DC for ; Wed, 7 Aug 2019 12:05:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TzqjmDhroYME for ; Wed, 7 Aug 2019 12:05:00 -0700 (PDT) Received: from mail-ot1-x329.google.com (mail-ot1-x329.google.com [IPv6:2607:f8b0:4864:20::329]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2D954120152 for ; Wed, 7 Aug 2019 12:05:00 -0700 (PDT) Received: by mail-ot1-x329.google.com with SMTP id b7so58399655otl.11 for ; Wed, 07 Aug 2019 12:05:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=Uo8UXEBiF70EzCE1fnHBvCGpYepduLz5QVSbsEWX+5s=; b=EIMf4c+hHCm3qWRrnkBgqrBaIngWzeGx3qBVKAA8qa/i2ii+tyhlI7C18FQhGxFEI6 NTv0TdM0UADQsbnwbFstRurEZGJcKLIEUBFJ68nhVoW8JyTK9/KKtXLBwNtHkA4Nmkvp SR7O7bAM78U8dtughBD4glMES0I8XGI2fWe6dI+vJjN3MDOMrtTK9zdkABao2elIKdOY 3Z0FZDR838hmozpFyTE+nIoCpnh1SMSr4NecVzPIXeOG5fFXWYZuAuYRQt9xPDmXNHkR /J70O00Fb3q/qfqKPMMvPpxrp2Vwou5NpizFNtB32Blie7d3f2jw+thXQjxzhb8MsNJK wi4g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=Uo8UXEBiF70EzCE1fnHBvCGpYepduLz5QVSbsEWX+5s=; b=pyh26jdeGUXuszAW7AXfetBhvc8SSb7en6yImYqYN7BcFGe7WizeYRLB7saHQcwBTw 993jYBh/C6SGoqNiDWDaR1DKsUiZFmQsdMT8fSis79ypGPasUaLRuj7VwSfexzKJuYWQ wpCWSTCT8Vk9jGyc2K3fBPrGhbWsbEhnGGeHUcztXtTM/ourN84p39WTov76jURa1fAp 2nkpBpAns9nAPvgswu91Z5sz9A0ZY0GNB/hEX1xj1ljpLgjN6mOUfx1CC3RmVHjThHtE UGmIxfUnI4m7bp3xjkG396Bk2caFK0xfNVllEP4NcxLt334B/rP2TkC/EQYSxImPH+T0 CSGQ== X-Gm-Message-State: APjAAAWS92Mr9ciXLzMjnP51JXG0xigYndQaf9i+zZ9mRpggSsBb7sbq Voc27gviyJP5DWEsgAEEllk= X-Google-Smtp-Source: APXvYqwJ0Ke4cVMC9a+h1xxRm4U2i6nmxIq1wVdurhYT9zR4t2QK+zDWWmmwWxKAxqnhdgQf+Vbqkg== X-Received: by 2002:a02:c65a:: with SMTP id k26mr953567jan.18.1565204698170; Wed, 07 Aug 2019 12:04:58 -0700 (PDT) Received: from [10.249.207.252] (67-128-146-21.dia.static.qwest.net. [67.128.146.21]) by smtp.gmail.com with ESMTPSA id l14sm86230180iob.1.2019.08.07.12.04.56 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 07 Aug 2019 12:04:57 -0700 (PDT) From: Bret Jordan Message-Id: Content-Type: multipart/alternative; boundary="Apple-Mail=_FD8DB3AD-7D82-4F75-A12E-623FE4D04362" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Wed, 7 Aug 2019 13:04:55 -0600 In-Reply-To: Cc: Jim Reid , ADD Mailing list To: Eric Orth References: <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> <64bcfc51-6f3d-ae24-4de5-d0eb89975c66@cs.tcd.ie> <539D6F9D-137C-4F68-A8DE-EA3DFAF4D827@huitema.net> <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <841102D9-4B50-4415-8193-FF3766F91958@gmail.com> <41BFA10B-231E-4694-A498-442B5B0BF9DE@gmail.com> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] HTTP privacy considerations for DoH Clients X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Aug 2019 19:05:04 -0000 --Apple-Mail=_FD8DB3AD-7D82-4F75-A12E-623FE4D04362 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 The problem I have with all of this, is when protocol developers go off = and produce designs without fully understanding and documenting how this = is going to impact people and networks. If we do this as a left-hand and = right-hand effort, where the two hands do not know each other, that is a = problem. In some cases, if we had done the research, and involved enough = groups, then the decision might have been, we should not do this at all. = Just because we _can_ do something, does not mean we _should_. I think this discussion, the meeting in Montreal, and the meeting in = Prague is showing that the industry is starting to wake up to the things = people in the IETF are trying to do. I think there is a lot of push = back now. And personally, I think that makes some people uncomfortable. = Maybe RFCs need to back to what they were originally intended to be, = and that is a =E2=80=9Crequest for comments=E2=80=9D on an idea. =20 The industry has moved beyond the 1980s and 90s when people were just = trying to make things work and when you could get a representative from = every group that was doing something with the internet in the same room.=20= Thanks, Bret PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 "Without cryptography vihv vivc ce xhrnrw, however, the only thing that = can not be unscrambled is an egg." > On Aug 7, 2019, at 11:57 AM, Eric Orth wrote: >=20 > Depends on the scope of the particular documents. If we're talking a = document of privacy guidance/considerations specifically for protocol = implementers, only unintentional is in scope, since malware developers = would obviously ignore such guidance. If a document for multiple = audiences (such as the protocol specs themselves), or separate documents = for other audiences, then yes, guidance for network operators on dealing = with intentional action is also important. >=20 > I would argue that guidance documents on DoH/DoT privacy = considerations should be separate documents for implementer guidance and = guidance for network operators dealing with the traffic in their = networks. Somebody seeking such guidance is very likely going to be one = or the other and the guidance will be much better communicated if = targeted to them. We should certainly have many different parties = helping write all such documents to provide valuable feedback, but I = think we should separate and target the intended audiences of such = documents. >=20 > On Wed, Aug 7, 2019 at 1:18 PM Bret Jordan > wrote: > You mean both =E2=80=9Cunintentionally and intentionally=E2=80=9D.=20 >=20 > The privacy consideration and security consideration sections need to = be written for end-users / organizations / enterprises as well as for = developers. They need to say, hey, if you let this protocol through = your network, here are the new risks you need to worry about. Here is = the increased attack surface. Here are the new risks to privacy. Or = maybe what we need is a =E2=80=9CPrivacy and Risk=E2=80=9D section in = every RFC. Something that calls out how this new fangled thing is going = to impact operational security. =20 >=20 > Thanks, > Bret > PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 > "Without cryptography vihv vivc ce xhrnrw, however, the only thing = that can not be unscrambled is an egg." >=20 >> On Aug 7, 2019, at 10:30 AM, Eric Orth > wrote: >>=20 >> (Thanks for branching off to another subject. I wanted to respond in = the other thread when this was brought up, but it was kinda off-topic = for most of what was being discussed there.) >>=20 >> Agreed. There is certainly lots of room for a DoT or DoH client to = unintentionally make bad privacy decisions. Publishing guidance and = information can help ensure they have thought things through before they = make privacy-affecting decisions. This is a very actionable area for = IETF. I think there would be enough consensus on many areas of guidance = (but obviously not all) to get a decent sized document. >>=20 >> Not everything would necessarily be a hard and fast do or don't, as = different tradeoffs may be relevant for different applications and use = cases. That's okay since the important part is providing the = information to help applications make the correct decisions for = themselves. E.g., accepting cookies is one of the areas already briefly = discussed in RFC8484, and I think it took the right approach: "HTTP = cookies SHOULD NOT be accepted by DOH clients unless they are explicitly = required by a use case." I think we need more guidance like that with = more detail on the tradeoffs and considerations. It may seem obvious = that applications should never send or accept cookies with DoH, but some = special-purpose application may want to use DoH to send authentication = information to a special-purpose DNS server that will only return = information to authorized users. DoH and DNS are not limited just to = the use case of browsers requesting addresses of all hostnames to be = visited. >>=20 >> On Wed, Aug 7, 2019 at 12:07 PM Jim Reid > wrote: >>=20 >>=20 >> > On 7 Aug 2019, at 16:42, Bret Jordan > wrote: >> >=20 >> > An app or client could add additional http headers. It could add a = unique ID for each app or client, it could add in geo-location data, it = could all kinds of things. =20 >>=20 >> Indeed. IMO this sort of behaviour is something the IETF should work = on: some do=E2=80=99s and don=E2=80=99ts on privacy issues for DoH = clients. Which WG is most appropriate? >>=20 >> Apologies yet again for another meaningful and relevant Subject: = header. I=E2=80=99m hoping that practice will catch on. :-) >>=20 >> --=20 >> Add mailing list >> Add@ietf.org >> https://www.ietf.org/mailman/listinfo/add = >=20 --Apple-Mail=_FD8DB3AD-7D82-4F75-A12E-623FE4D04362 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 The = problem I have with all of this, is when protocol developers go off and = produce designs without fully understanding and documenting how this is = going to impact people and networks. If we do this as a left-hand and = right-hand effort, where the two hands do not know each other, that is a = problem. In some cases, if we had done the research, and involved enough = groups, then the decision might have been, we should not do this at all. =  Just because we _can_ do something, does not mean we _should_.

I think this discussion, = the meeting in Montreal, and the meeting in Prague is showing that the = industry is starting to wake up to the things people in the IETF are = trying to do.  I think there is a lot of push back now.  And = personally, I think that makes some people uncomfortable.  Maybe = RFCs need to back to what they were originally intended to be, and that = is a =E2=80=9Crequest for comments=E2=80=9D on an idea.  

The industry has moved = beyond the 1980s and 90s when people were just trying to make things = work and when you could get a representative from every group that was = doing something with the internet in the same room. 

Thanks,
Bret
PGP = Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 = 0050
"Without = cryptography vihv vivc ce xhrnrw, however, the only thing that can not = be unscrambled is an = egg."

On Aug 7, 2019, at 11:57 AM, Eric Orth <ericorth@google.com>= wrote:

Depends on the scope of the particular = documents.  If we're talking a document of privacy = guidance/considerations specifically for protocol implementers, only = unintentional is in scope, since malware developers would obviously = ignore such guidance.  If a document for multiple audiences (such = as the protocol specs themselves), or separate documents for other = audiences, then yes, guidance for network operators on dealing with = intentional action is also important.

I would argue that guidance documents = on DoH/DoT privacy considerations should be separate documents for = implementer guidance and guidance for network operators dealing with the = traffic in their networks.  Somebody seeking such guidance is very = likely going to be one or the other and the guidance will be much better = communicated if targeted to them.  We should certainly have many = different parties helping write all such documents to provide valuable = feedback, but I think we should separate and target the intended = audiences of such documents.

On Wed, Aug = 7, 2019 at 1:18 PM Bret Jordan <jordan.ietf@gmail.com> wrote:
You mean both =E2=80=9Cunintentionally and = intentionally=E2=80=9D. 

The privacy consideration and security consideration sections = need to be written for end-users / organizations / enterprises as well = as for developers.  They need to say, hey, if you let this protocol = through your network, here are the new risks you need to worry = about.  Here is the increased attack surface.  Here are the = new risks to privacy.  Or maybe what we need is a =E2=80=9CPrivacy = and Risk=E2=80=9D section in every RFC.  Something that calls out = how this new fangled thing is going to impact operational security. =  

Thanks,
Bret
PGP = Fingerprint: 63B4 FC53 680A = 6B7D 1447  F2C0 74F8 ACAE 7415 0050
"Without cryptography vihv vivc ce = xhrnrw, however, the only thing that can not be unscrambled is an = egg."

On Aug 7, 2019, at 10:30 AM, Eric Orth <ericorth@google.com> wrote:

(Thanks for = branching off to another subject.  I wanted to respond in the other = thread when this was brought up, but it was kinda off-topic for most of = what was being discussed there.)

Agreed.  There is certainly lots of room for a DoT = or DoH client to unintentionally make bad privacy decisions.  = Publishing guidance and information can help ensure they have thought = things through before they make privacy-affecting decisions.  This = is a very actionable area for IETF.  I think there would be enough = consensus on many areas of guidance (but obviously not all) to get a = decent sized document.

Not everything would necessarily be a hard and fast do or = don't, as different tradeoffs may be relevant for different applications = and use cases.  That's okay since the important part is providing = the information to help applications make the correct decisions for = themselves.  E.g., accepting cookies is one of the areas already = briefly discussed in RFC8484, and I think it took the right approach: = "HTTP cookies SHOULD NOT be accepted by DOH clients unless they are = explicitly required by a use case."  I think we need more guidance = like that with more detail on the tradeoffs and considerations.  It = may seem obvious that applications should never send or accept cookies = with DoH, but some special-purpose application may want to use DoH to = send authentication information to a special-purpose DNS server that = will only return information to authorized users.  DoH and DNS are = not limited just to the use case of browsers requesting addresses of all = hostnames to be visited.

On Wed, Aug = 7, 2019 at 12:07 PM Jim Reid <jim@rfc1035.com> wrote:


> On 7 Aug 2019, at 16:42, Bret Jordan <jordan.ietf@gmail.com> wrote:
>
> An app or client could add additional http headers.  It could = add a unique ID for each app or client, it could add in geo-location = data, it could all kinds of things. 

Indeed. IMO this sort of behaviour is something the IETF should work on: = some do=E2=80=99s and don=E2=80=99ts on privacy issues for DoH clients. = Which WG is most appropriate?

Apologies yet again for another meaningful and relevant Subject: header. = I=E2=80=99m hoping that practice will catch on. :-)

--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add


= --Apple-Mail=_FD8DB3AD-7D82-4F75-A12E-623FE4D04362-- From nobody Wed Aug 7 12:07:03 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 38018120699 for ; Wed, 7 Aug 2019 12:07:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gpjC3EtPuuJm for ; Wed, 7 Aug 2019 12:06:59 -0700 (PDT) Received: from mail-lj1-x234.google.com (mail-lj1-x234.google.com [IPv6:2a00:1450:4864:20::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 98892120630 for ; Wed, 7 Aug 2019 12:06:58 -0700 (PDT) Received: by mail-lj1-x234.google.com with SMTP id m8so52906565lji.7 for ; Wed, 07 Aug 2019 12:06:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=0toFa9Wgyjiwmq6VaolE7oqO6B8YxE6JnF3GzndVQKQ=; b=VLj1l7GsoSUFcrNsgirwJHHSR6rtEF1GeqWzEtBMuMN+gRwxNRWf2SFK+rSvjzT9Rm bVfNXmttxNo0QWnU8XXDcQNtrgAluZSzYwZKnJK/wpZih5jxNnM/yia0JhH85ivAs5yh 3IrrZm2jS2kLCpSbHAlD8NyoQO/m+UNc9o127HmPqtW4h0hXBBISmdVDlncDDxicovUy tVtWo5sdSK9aqhYWHWJp/H6do6zTNX1wv6TLcl6bjQjimPBRaXP566T6Kl7YDVXDqk4p P9Bo5PRbOW3VcIZLtOy0Bcxo5Y3suYZqkcI0kbk2dN7KMSUk4cUQrF+cyK60oQDMWig3 JMyQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=0toFa9Wgyjiwmq6VaolE7oqO6B8YxE6JnF3GzndVQKQ=; b=Jha99fAuD/cC787I1+ANIi9rhWofdOYzuRiB79vuIoCYf1oYIZ8B+tL0m6dklbqrGx SkO6zt1F9B55h2pQZ3NVu0UUESazARHOCE7QEdMeq4559wnuNH4ElKQImyEAlbLsDFtq 7wh6nxkPOaTqOLI41QCkdc/8tCjwgYKve7ujazr5sWVY5TVXn95nIHs/6rYXWSm31Lmh wPDrZjLYWXI07DHxFOljjs09RpNI9zztR3tO13X1HZ8sZwD10hEtopRNTYIbxmiJytDK GBM2dLJA8qCvwnJSmuv4C39wiEF1p53ZdF1cZ/k7Px8JadFyL16QufnQGX4dwCnxkw2G Rtkg== X-Gm-Message-State: APjAAAU1Rme9JKDuTvNiLb2j7lgXFzR/ouDCYBMPF4/Xo2ENijzHlMf8 xJ2VNkiIOQ8magHZfWYTJKWu6SesXlttDIfYffTaqFfJkL4Imw== X-Google-Smtp-Source: APXvYqzQq3aQjmoSkcXha9+zwKOtMXmm62GLlwzyCcj0SG3badKU9GP7kYypXr1aOAGFD2F7D5+41ZiYnsyur2sTVDo= X-Received: by 2002:a2e:9cd4:: with SMTP id g20mr5322469ljj.205.1565204816253; Wed, 07 Aug 2019 12:06:56 -0700 (PDT) MIME-Version: 1.0 References: <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> <64bcfc51-6f3d-ae24-4de5-d0eb89975c66@cs.tcd.ie> <539D6F9D-137C-4F68-A8DE-EA3DFAF4D827@huitema.net> <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <841102D9-4B50-4415-8193-FF3766F91958@gmail.com> <915920CE-49DA-49EC-833A-4B6F54AF7D00@rfc1035.com> In-Reply-To: <915920CE-49DA-49EC-833A-4B6F54AF7D00@rfc1035.com> From: Eric Rescorla Date: Wed, 7 Aug 2019 12:06:19 -0700 Message-ID: To: Jim Reid Cc: ADD Mailing list Content-Type: multipart/alternative; boundary="00000000000012f605058f8ba5ef" Archived-At: Subject: Re: [Add] HTTP privacy considerations for DoH Clients X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Aug 2019 19:07:01 -0000 --00000000000012f605058f8ba5ef Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Wed, Aug 7, 2019 at 11:43 AM Jim Reid wrote: > > > > On 7 Aug 2019, at 18:59, Eric Rescorla wrote: > > > > On Wed, Aug 7, 2019 at 9:07 AM Jim Reid wrote: > > > > > > > > Indeed. IMO this sort of behaviour is something the IETF should work on= : > some do=E2=80=99s and don=E2=80=99ts on privacy issues for DoH clients. W= hich WG is most > appropriate? > > > > How would this be different from > https://tools.ietf.org/rfcmarkup?doc=3D8484#section-8? > > Well for starters, section 8 of RFC8484 says nothing directly about > client-side privacy. I don't know what you mean by "client side privacy". Much of S 8.2 seems to be about what information the client leaks to the server. Though it does do that for privacy considerations in the server. RFC8484 > mentions there are new considerations because HTTP offers extra > opportunities for correlation. It doesn't clearly say what those > considerations are or how to address them. > You must have something different in mind than I do. For instance, the following seems on point: HTTP's feature set can also be used for identification and tracking in a number of different ways. For example, Authentication request header fields explicitly identify profiles in use, and HTTP cookies are designed as an explicit state-tracking mechanism between the client and serving site and often are used as an authentication mechanism. -Ekr --00000000000012f605058f8ba5ef Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Wed, Aug 7, 2019 at 11:43 AM Jim R= eid <jim@rfc1035.com> wrote:


> On 7 Aug 2019, at 18:59, Eric Rescorla <ekr@rtfm.com> wrote:
>
> On Wed, Aug 7, 2019 at 9:07 AM Jim Reid <jim@rfc1035.com> wrote:
>
>
>
> Indeed. IMO this sort of behaviour is something the IETF should work o= n: some do=E2=80=99s and don=E2=80=99ts on privacy issues for DoH clients. = Which WG is most appropriate?
>
> How would this be different from https://t= ools.ietf.org/rfcmarkup?doc=3D8484#section-8?

Well for starters, section 8 of RFC8484 says nothing directly about client-= side privacy.

I don't know what you mea= n by "client side privacy". Much of S 8.2 seems to be about
=
what information the client leaks to the server.

<= div>
Though it = does do that for privacy considerations in the server. RFC8484 mentions the= re are new considerations because HTTP offers extra opportunities for corre= lation. It doesn't clearly say what those considerations are or how to = address them.

You must have something d= ifferent in mind than I do. For instance, the following seems on point:
=

=C2= =A0 HTTP's feature set can also be used for identification and tracking=
<= span style=3D"font-family:arial,sans-serif">=C2=A0 in a number of differe= nt ways. For example, Authentication request
=C2=A0 header fields explicitly identify profiles in use, and HT= TP cookies
= =C2=A0 are designed as = an explicit state-tracking mechanism between
=C2=A0 the client and serving site and often are used = as an authentication
=C2=A0 mech= anism.

-Ekr

--00000000000012f605058f8ba5ef-- From nobody Wed Aug 7 12:11:50 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EC3D41206C4 for ; Wed, 7 Aug 2019 12:11:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8vMHuHfyUmbq for ; Wed, 7 Aug 2019 12:11:46 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7C18A1206D1 for ; Wed, 7 Aug 2019 12:11:43 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id F2556BE4D; Wed, 7 Aug 2019 20:11:40 +0100 (IST) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mDXbNdeKz4JE; Wed, 7 Aug 2019 20:11:39 +0100 (IST) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 77440BE3E; Wed, 7 Aug 2019 20:11:39 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1565205099; bh=afo48hJM8x1DFpw9BHuBD18fY/f0/40AeMGath2LVDI=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From; b=QY4aHRH2QDk7F9LWFTjk/J1WANdUyCg0bGzs/M17bTAEUKDJgfYDCyoJh4MkgWAaa GLA2eIViejMuCope6Ao3AGW9VJiejlYyZhngDRuhoTlG0hniutPg/LTiHHBUJG67ED Y92yLE57KHxlAizJOrL0fZPnxC/o8GGLPgUqMqe0= To: Bret Jordan , "STARK, BARBARA H" Cc: ADD Mailing list , "Deen, Glenn (NBCUniversal)" References: <2D09D61DDFA73D4C884805CC7865E6114E25886C@GAALPA1MSGUSRBF.ITServices.sbc.com> <2D09D61DDFA73D4C884805CC7865E6114E258909@GAALPA1MSGUSRBF.ITServices.sbc.com> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: Date: Wed, 7 Aug 2019 20:11:37 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="AiGxpdcSIvpBYbBvbZohr0VNtsJIw07cB" Archived-At: Subject: Re: [Add] Auditing apps X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Aug 2019 19:11:49 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --AiGxpdcSIvpBYbBvbZohr0VNtsJIw07cB Content-Type: multipart/mixed; boundary="D6pXQAhYM6m2YIm44U7eHFDEdRAnQp4L2"; protected-headers="v1" From: Stephen Farrell To: Bret Jordan , "STARK, BARBARA H" Cc: ADD Mailing list , "Deen, Glenn (NBCUniversal)" Message-ID: Subject: Re: [Add] Auditing apps References: <2D09D61DDFA73D4C884805CC7865E6114E25886C@GAALPA1MSGUSRBF.ITServices.sbc.com> <2D09D61DDFA73D4C884805CC7865E6114E258909@GAALPA1MSGUSRBF.ITServices.sbc.com> In-Reply-To: --D6pXQAhYM6m2YIm44U7eHFDEdRAnQp4L2 Content-Type: multipart/mixed; boundary="------------90921320E99C38F14CD534B4" Content-Language: en-GB This is a multi-part message in MIME format. --------------90921320E99C38F14CD534B4 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Ok, I will shut up after this but... On 07/08/2019 19:55, Bret Jordan wrote: > I think it is also important to note that the application developer > may purposefully use embedded DoH to track users everywhere they go. > Right now a threat actor would need to compromise every network a > user uses and the DHCP server that they use, to be able to track a > user. That's pure nonsense. Tracking a user does not require DoH, there are myriad ways to do that without DoH, including all forms of DNS, HTTPS, mail, irc and in fact pretty much any protocol at all, if the two endpoints are colluding for that purpose. And if I've control over an application and a peer with which that communicates I really have no need at all to compromise a network or DHCP server. Can we not stop with the counter-factual fluff? There really has been too much of that. S. --------------90921320E99C38F14CD534B4 Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------90921320E99C38F14CD534B4-- --D6pXQAhYM6m2YIm44U7eHFDEdRAnQp4L2-- --AiGxpdcSIvpBYbBvbZohr0VNtsJIw07cB Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAl1LImkACgkQWrL68XsX K+rdmxAAoqhY3yVZ6myYuU/V69lWgp33ZP8UA+8BBKI+a+RK93aYHI1uxyI9JQoZ 8kjYvKh+0Qgv2QsBGgOQaZ4uPzjW6JHCQtUWj9qe/YOsl8yuS/0yF5Co2hIicnbQ xnUXZnz0L9UvrV6JIw6HxI17O4c4N7M/qtjR5vVQwpV0PUw0jSzCA2Arxy6m8427 eKfVxGc8C6xg8jNSKStdIZWprUnqpSddNqwIVbQ2ioon2ksNIOh3EK+owDhmkyqO aAP6/pyN4W/FPuN4S1CIAFuy2txE9YnY56GB66sSo0EqjIvb6XcWYYh0mJDeWQ+T s1DGTqX0AYBhExU9u3sIW68lTw7rHf527mwFilbkXuXl+TAppC/gv69mQ0s1lMT6 7uVjL0zLjEBT3A5JyHZYL41GOyXGH3F6nYPqYW+WUHP8ix1qTYu7kLfmjQBhs72e 7MmE2kIBzxz9eJi/+RslC+IbvUutpbhnAHRfSL9WihC93H04Z5VU5SdhX1wwic0b g0r5S9S/oCrUiWHoRqcb+ki27O+47bi0LULLWZH0xQcRJlF54KbZleTMQ5yrB8f4 iZujxqpG86vg4X85xNHc0Cls8j3l3EuufFcepRnZbAXl6sp1V2fSMhzinOFjXCqt FD8zFhUWE3TROwJGlR1qOdbI/T5gmLFCY5o53dEdxHFcvMJOoEA= =tQ4s -----END PGP SIGNATURE----- --AiGxpdcSIvpBYbBvbZohr0VNtsJIw07cB-- From nobody Wed Aug 7 12:19:00 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 29B171201C9 for ; Wed, 7 Aug 2019 12:18:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gt-FUamv1mVk for ; Wed, 7 Aug 2019 12:18:57 -0700 (PDT) Received: from mail-lf1-x129.google.com (mail-lf1-x129.google.com [IPv6:2a00:1450:4864:20::129]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 60966120152 for ; Wed, 7 Aug 2019 12:18:57 -0700 (PDT) Received: by mail-lf1-x129.google.com with SMTP id 62so59999164lfa.8 for ; Wed, 07 Aug 2019 12:18:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=Eori/O0UgerX/8wlW2p5aeWt9eq5wYPletH6JUCDbYs=; b=QHRaQrgzSigGe19S42Epw6tGFfqAaWTJ71xQd/pKocuDBfEH3dGKgl2cWP6GzignHk mXaRGyXVFR25QW6Falw+5C4Gr43NPnMJo4f99t0p+pRyxPFAzagOYbHrkJnDfDkXIeUd sJTQBSWu4b4dQcaCcVkQaODfMDEKt+hrbwOZ5rWkfFeILGmJ+H4kzo4pSXI8yk6nDqHa 3Rcn/JSY6gUfeDUTHFxyilBFk+7W6AuL224vtcGyMXsCFPyX5c7YTXYP1JFULUZbeecl GjSKcpjMjWOdlm2/9EDg2D31lWZWO42wgSy8rNtE6ysHp0vJU3eRSjoHtOSSjyLLFLH7 G6CA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=Eori/O0UgerX/8wlW2p5aeWt9eq5wYPletH6JUCDbYs=; b=aVRLZbHfx4UuIy5aMjoe9SbC1pNGNrWbOeol1Oa50+HZsiGg5YZTnm6v0lKpTJ++cw hE4kfZbv6SQPwRepSuHYKp+nHyGTaoDAVh2GG/zW2yG1kv7EoxejtHgJNcjwUoNS6RES D5VzfSnDZQ7yuvLzfaD0x5syEacc8JwSLGKvynFTGJtLXIwiEwzP7mO4Gxn/iL+DO79k 7WNjqsOYL2mtzKNaFDE5mCzIIHFTJlEHIG/qRM5mb3cyA9Xqc8F4FzmTE/d1K9iVfjzU pDDvkS8mq8HZ0U1DQZc9/WHF5UenLyZ94kFIXt+IwyrZAObNnsHl7Q0IVHmII/o/jI5f wPvg== X-Gm-Message-State: APjAAAUPaldtmH2tdk5TkYJ91xm6z5qsJ2TlZQp9mKQUYTglrkmnG191 PR4f48V+wyEga4hg+D0abzspecsPNdcl/OkIBLXR1g== X-Google-Smtp-Source: APXvYqzbTON+HFSAjtQJ8hBw7e/auhPtE8x6XNoedfo53CgeU2NNUT6Ho+OBo6JPRlB64NH/45O71/AcS2OAc/AC3cY= X-Received: by 2002:a19:4a50:: with SMTP id x77mr6608933lfa.91.1565205535681; Wed, 07 Aug 2019 12:18:55 -0700 (PDT) MIME-Version: 1.0 References: <2D09D61DDFA73D4C884805CC7865E6114E25886C@GAALPA1MSGUSRBF.ITServices.sbc.com> <2D09D61DDFA73D4C884805CC7865E6114E258909@GAALPA1MSGUSRBF.ITServices.sbc.com> In-Reply-To: From: Eric Rescorla Date: Wed, 7 Aug 2019 12:18:19 -0700 Message-ID: To: Stephen Farrell Cc: Bret Jordan , "STARK, BARBARA H" , ADD Mailing list , "Deen, Glenn (NBCUniversal)" Content-Type: multipart/alternative; boundary="000000000000f483ca058f8bcfd5" Archived-At: Subject: Re: [Add] Auditing apps X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Aug 2019 19:18:59 -0000 --000000000000f483ca058f8bcfd5 Content-Type: text/plain; charset="UTF-8" Indeed. It's worth noting that many modern apps phone home for various reasons (getting data from the server, checking for software updates, telemetry, etc.) and so if you want to track the user's behavior, there's already a very straightforward channel for that. -Ekr On Wed, Aug 7, 2019 at 12:11 PM Stephen Farrell wrote: > > Ok, I will shut up after this but... > > On 07/08/2019 19:55, Bret Jordan wrote: > > I think it is also important to note that the application developer > > may purposefully use embedded DoH to track users everywhere they go. > > Right now a threat actor would need to compromise every network a > > user uses and the DHCP server that they use, to be able to track a > > user. > > That's pure nonsense. Tracking a user does not require > DoH, there are myriad ways to do that without DoH, > including all forms of DNS, HTTPS, mail, irc and in > fact pretty much any protocol at all, if the two > endpoints are colluding for that purpose. > > And if I've control over an application and a peer > with which that communicates I really have no need > at all to compromise a network or DHCP server. > > Can we not stop with the counter-factual fluff? > There really has been too much of that. > > S. > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --000000000000f483ca058f8bcfd5 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Indeed. It's worth noting that many modern apps p= hone home for various reasons (getting data from the server, checking for s= oftware updates, telemetry, etc.) and so if you want to track the user'= s behavior, there's already a very straightforward channel for that.

-Ekr


On Wed, Aug 7, 2019 at 12:1= 1 PM Stephen Farrell <steph= en.farrell@cs.tcd.ie> wrote:

Ok, I will shut up after this but...

On 07/08/2019 19:55, Bret Jordan wrote:
> I think it is also important to note that the application developer > may purposefully use embedded DoH to track users everywhere they go. > Right now a threat actor would need to compromise every network a
> user uses and the DHCP server that they use, to be able to track a
> user.

That's pure nonsense. Tracking a user does not require
DoH, there are myriad ways to do that without DoH,
including all forms of DNS, HTTPS, mail, irc and in
fact pretty much any protocol at all, if the two
endpoints are colluding for that purpose.

And if I've control over an application and a peer
with which that communicates I really have no need
at all to compromise a network or DHCP server.

Can we not stop with the counter-factual fluff?
There really has been too much of that.

S.

--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--000000000000f483ca058f8bcfd5-- From nobody Wed Aug 7 12:30:35 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0CEEB120694 for ; Wed, 7 Aug 2019 12:30:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ilqYKinZj3nM for ; Wed, 7 Aug 2019 12:30:32 -0700 (PDT) Received: from shaun.rfc1035.com (shaun.rfc1035.com [93.186.33.42]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 63D71120306 for ; Wed, 7 Aug 2019 12:30:32 -0700 (PDT) Received: from wallace.rfc1035.com (hutch.rfc1035.com [195.54.233.70]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by shaun.rfc1035.com (Postfix) with ESMTPSA id EDB08242109D; Wed, 7 Aug 2019 19:30:27 +0000 (UTC) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) From: Jim Reid In-Reply-To: Date: Wed, 7 Aug 2019 20:30:26 +0100 Cc: ADD Mailing list Content-Transfer-Encoding: quoted-printable Message-Id: <801EFF4B-BDBC-4789-A498-36CE1E9AE5C1@rfc1035.com> References: <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> <64bcfc51-6f3d-ae24-4de5-d0eb89975c66@cs.tcd.ie> <539D6F9D-137C-4F68-A8DE-EA3DFAF4D827@huitema.net> <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <841102D9-4B50-4415-8193-FF3766F91958@gmail.com> <915920CE-49DA-49EC-833A-4B6F54AF7D00@rfc1035.com> To: Eric Rescorla X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: Re: [Add] HTTP privacy considerations for DoH Clients X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Aug 2019 19:30:34 -0000 On 7 Aug 2019, at 20:06, Eric Rescorla wrote: >=20 >=20 > You must have something different in mind than I do. Yup.=20 > For instance, the following seems on point: >=20 > HTTP's feature set can also be used for identification and tracking > in a number of different ways. For example, Authentication request > header fields explicitly identify profiles in use, and HTTP cookies > are designed as an explicit state-tracking mechanism between > the client and serving site and often are used as an authentication > mechanism. I said earlier RFC8484 "doesn't clearly say what those considerations = are or how to address them". The text you quoted above doesn't seem to = do that IMO. For instance, what sorts of HTTP header fields should DoH clients use or = not use to enhance or ensure privacy? Why? The RFC says DoH clients = SHOULD only use cookies when "they are explicitly required by a use = case". How is that explicit requirement/signalling done and what use = case(s) does that apply to? What should/shouldn't go in those cookies? I think these sorts of considerations need to be better documented. Or = has that work already been done elsewhere? BTW, section 8.2 is titled "In the Server". A client developer might = well mistakenly conclude they can ignore it because server-side privacy = considerations don't apply to them. YMMV. From nobody Wed Aug 7 12:45:54 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4DD68120306 for ; Wed, 7 Aug 2019 12:45:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id T-R7M7Tiwzce for ; Wed, 7 Aug 2019 12:45:50 -0700 (PDT) Received: from mail-lj1-x22f.google.com (mail-lj1-x22f.google.com [IPv6:2a00:1450:4864:20::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5552C1201C9 for ; Wed, 7 Aug 2019 12:45:50 -0700 (PDT) Received: by mail-lj1-x22f.google.com with SMTP id r9so86597744ljg.5 for ; Wed, 07 Aug 2019 12:45:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=bFjjgD11kXnw454GlS825yVLRtlO3g0WhtrRv73kppw=; b=x0xtepNPNfV2MLQyx/Nr7JV+Zgs/2avVQQpg1Hj+1MNdYGytNERIpuqyEIzfnM5N0J DPF7RwmoJaoKMnog/dleK8uWj6ROn4zYOePPDKG7qX5cvIv8/4o7+PJaqD7x91lxwg8Y dOUWL7m6XM+l1hNtCg330YEpnhrVN3iwh3AOgbkTuzz2CXjoT+1hxBu08/4RA4Qf8o7g 7RBulODwcDNCHO9p2y1C8dIVq19L4Ydz/pdvu3tBhtl3bqC9NKw2VAXOiEUQI2MJxVp0 VR0j/5XgT62rZE7c1+/eifaQ1eX+3VoBivw33gI0hPecPUDTn2+qg6oTYvVuLd33dcnj 0ieQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=bFjjgD11kXnw454GlS825yVLRtlO3g0WhtrRv73kppw=; b=a8OIbTD/51NLDN7fH+lusZKwPEqpvMXEiKw4gu07g77MG5tnBS1WavzqZ8OdneQXGQ K1kp0WQ86aDVP/mqjyhwry49ybqMiwGYdXMnDles89OgiXRYsqGh1RpCqYVRINuymKU7 G9Pj7V68jyZRTJxq6hS8cbtO38ghUFxRnu7BX8gL/FYy+6FtR6uCcufNbYKRbQo43B9k ttmrStcSg1XOpBr+jd85D3VijU/13BJ8m7UWnoxTfkpDzWRDRDpFGwSU+QFGyUpR/hkU 1YBVjk2Stc3y3CPH4cd1aPLtt9b2neZakLwhniizGGMpo3lLLQZf0qxerOdl5rOL9rig 0mvw== X-Gm-Message-State: APjAAAXpQ1vY6BywkA5plV7jEtWZO13gpm+ZuHgDTw12WwYsHzuqeiwm rcoPJuHMI1qdNWvMDbIJBCOWYVpyYogE2GoOAsaWhw== X-Google-Smtp-Source: APXvYqyuEw1oJafRMqDiM135/0O/vW4rDlBNgMwa5w/ZjGepY5Gh2etXzNgWcti4WQlQEPJcTzxoh970Q29mk/1ue/s= X-Received: by 2002:a2e:3008:: with SMTP id w8mr5928920ljw.13.1565207148546; Wed, 07 Aug 2019 12:45:48 -0700 (PDT) MIME-Version: 1.0 References: <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> <64bcfc51-6f3d-ae24-4de5-d0eb89975c66@cs.tcd.ie> <539D6F9D-137C-4F68-A8DE-EA3DFAF4D827@huitema.net> <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <841102D9-4B50-4415-8193-FF3766F91958@gmail.com> <915920CE-49DA-49EC-833A-4B6F54AF7D00@rfc1035.com> <801EFF4B-BDBC-4789-A498-36CE1E9AE5C1@rfc1035.com> In-Reply-To: <801EFF4B-BDBC-4789-A498-36CE1E9AE5C1@rfc1035.com> From: Eric Rescorla Date: Wed, 7 Aug 2019 12:45:12 -0700 Message-ID: To: Jim Reid Cc: ADD Mailing list Content-Type: multipart/alternative; boundary="00000000000016dcb0058f8c30d6" Archived-At: Subject: Re: [Add] HTTP privacy considerations for DoH Clients X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Aug 2019 19:45:52 -0000 --00000000000016dcb0058f8c30d6 Content-Type: text/plain; charset="UTF-8" On Wed, Aug 7, 2019 at 12:30 PM Jim Reid wrote: > On 7 Aug 2019, at 20:06, Eric Rescorla wrote: > > > > > > You must have something different in mind than I do. > > Yup. > > > For instance, the following seems on point: > > > > HTTP's feature set can also be used for identification and tracking > > in a number of different ways. For example, Authentication request > > header fields explicitly identify profiles in use, and HTTP cookies > > are designed as an explicit state-tracking mechanism between > > the client and serving site and often are used as an authentication > > mechanism. > > I said earlier RFC8484 "doesn't clearly say what those considerations are > or how to address them". The text you quoted above doesn't seem to do that > IMO. > Well, indeed YMMV. I think it does in fact say what those considerations are, and leaves it up to the reader to decide how to address them. I would encourage you to try writing some text you think would be more satisfactory and see if it's actually practical to get more specific. With that said, the privacy considerations sections in this RFC are really far better than those in the vast majority of RFCs that I reviewed when I was on the IESG, and we've tolerated the truly terrible DNS privacy situation for quite some time, so the particular focus on the residual privacy impact of the interaction between the DoH client and the DoH server seems a bit incongruous. > > For instance, what sorts of HTTP header fields should DoH clients use or > not use to enhance or ensure privacy? Why? "Implementations are advised to expose the minimal set of data needed to achieve the desired feature set." Honestly, a complete enumeration of every header seems out of place in this document. The RFC says DoH clients SHOULD only use cookies when "they are explicitly > required by a use case". How is that explicit requirement/signalling done > and what use case(s) does that apply to? I'm not really sure what you're looking for here. It's not possible to enumerate every possible use case, so what this text says is "don't do it unless you have to". What should/shouldn't go in those cookies? > Huh? Cookies are opaque at the client. Clients either send or don't send them, so the question of what goes in them doesn't apply. > I think these sorts of considerations need to be better documented. Or has > that work already been done elsewhere? > > BTW, section 8.2 is titled "In the Server". A client developer might well > mistakenly conclude they can ignore it because server-side privacy > considerations don't apply to them. YMMV. > Yeah, I would generally categorize this complaint as in the "nit" category. -Ekr --00000000000016dcb0058f8c30d6 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Wed, Aug 7, 2019 at 12:30 PM Jim R= eid <jim@rfc1035.com> wrote:
On 7 Aug 2019, at= 20:06, Eric Rescorla <ekr@rtfm.com> wrote:
>
>
> You must have something different in mind than I do.

Yup.

> For instance, the following seems on point:
>
>=C2=A0 =C2=A0HTTP's feature set can also be used for identification= and tracking
>=C2=A0 =C2=A0in a number of different ways. For example, Authentication= request
>=C2=A0 =C2=A0header fields explicitly identify profiles in use, and HTT= P cookies
>=C2=A0 =C2=A0are designed as an explicit state-tracking mechanism betwe= en
>=C2=A0 =C2=A0the client and serving site and often are used as an authe= ntication
>=C2=A0 =C2=A0mechanism.

I said earlier RFC8484 "doesn't clearly say what those considerati= ons are or how to address them". The text you quoted above doesn't= seem to do that IMO.

Well, indeed YMMV= . I think it does in fact say what those considerations are, and leaves it = up to the reader to decide how to address them. I would encourage you to tr= y writing some text you think would be more satisfactory and see if it'= s actually practical to get more specific. With that said, the privacy cons= iderations sections in this RFC are really far better than those in the vas= t majority of RFCs that I reviewed when I was on the IESG, and we've to= lerated the truly terrible DNS privacy situation for quite some time, so th= e particular focus on the residual privacy impact of the interaction betwee= n the DoH client and the DoH server seems a bit incongruous.

=
=C2=A0

For instance, what sorts of HTTP header fields should DoH clients use or no= t use to enhance or ensure privacy? Why?

&= quot;Implementations are advised to expose the minimal set of data needed = to achieve the desired feature set."

Honestl= y, a complete enumeration of every header seems out of place in this docume= nt.


The RFC says DoH clients SHOULD only use cookies when "t= hey are explicitly required by a use case". How is that explicit requi= rement/signalling done and what use case(s) does that apply to?

I'm not really sure what you're looking for h= ere. It's not possible to enumerate every possible use case, so what th= is text says is "don't do it unless you have to".
<= div>

What should/shouldn't go in those cookies?
Huh? Cookies are opaque at the client. Clients either send or = don't send them, so the question of what goes in them doesn't apply= .

=C2=A0
I think these sorts of considerations need to be better documented. Or has = that work already been done elsewhere?

BTW, section 8.2 is titled "In the Server". A client developer mi= ght well mistakenly conclude they can ignore it because server-side privacy= considerations don't apply to them. YMMV.

Yeah, I would generally categorize this complaint as in the "n= it" category.

-Ekr

<= br>

--00000000000016dcb0058f8c30d6-- From nobody Wed Aug 7 12:56:51 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 15BE4120306 for ; Wed, 7 Aug 2019 12:56:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.679 X-Spam-Level: X-Spam-Status: No, score=-1.679 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_INVALID=0.1, DKIM_SIGNED=0.1, T_SPF_HELO_PERMERROR=0.01, T_SPF_PERMERROR=0.01, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=fail (1024-bit key) reason="fail (message has been altered)" header.d=nostrum.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id K1FrAbhe0vRA for ; Wed, 7 Aug 2019 12:56:47 -0700 (PDT) Received: from nostrum.com (raven-v6.nostrum.com [IPv6:2001:470:d:1130::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id ADF5A120152 for ; Wed, 7 Aug 2019 12:56:47 -0700 (PDT) Received: from Orochi.local (c-24-9-76-58.hsd1.co.comcast.net [24.9.76.58]) (authenticated bits=0) by nostrum.com (8.15.2/8.15.2) with ESMTPSA id x77JuhJB079647 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NO); Wed, 7 Aug 2019 14:56:44 -0500 (CDT) (envelope-from adam@nostrum.com) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=nostrum.com; s=default; t=1565207805; bh=Ka5m02veEUIsJ0ed+qWmxEc84QANm5dBnutLh9eTfX4=; h=Subject:To:References:From:Date:In-Reply-To; b=B2SZszyo9rEVAu65T2KHphEtqWFEqiczCetLaiOK/nwqJTfSRhrlnPv3MICF4+9cK mugNmgIGmGBdqFQrMJqLhNvlU2G9R3GB8Lr5fPD6SWXWf/FxBuYd1fN5tXDb58UxMs 1YJxx9BsVgJtzjxROCk6gLltw9Sm0R8+WFB/o3eo= X-Authentication-Warning: raven.nostrum.com: Host c-24-9-76-58.hsd1.co.comcast.net [24.9.76.58] claimed to be Orochi.local To: "STARK, BARBARA H" , "'ADD Mailing list'" , "'Deen, Glenn (NBCUniversal)'" References: <2D09D61DDFA73D4C884805CC7865E6114E25886C@GAALPA1MSGUSRBF.ITServices.sbc.com> <2D09D61DDFA73D4C884805CC7865E6114E258909@GAALPA1MSGUSRBF.ITServices.sbc.com> From: Adam Roach Message-ID: <7d07c226-c8c6-f507-6c06-9947f7ab0731@nostrum.com> Date: Wed, 7 Aug 2019 14:56:37 -0500 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: <2D09D61DDFA73D4C884805CC7865E6114E258909@GAALPA1MSGUSRBF.ITServices.sbc.com> Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Content-Language: en-US Archived-At: Subject: Re: [Add] Auditing apps X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Aug 2019 19:56:50 -0000 On 8/7/19 12:51, STARK, BARBARA H wrote: > From what I can see, there is nothing that would prevent a laptop/tablet manufacturer/provider from including a custom browser that is branded and looks just like the non-customized version of the same browser... There is: trademark law. See, e.g., https://www.mozilla.org/en-US/foundation/trademarks/distribution-policy/ /a From nobody Wed Aug 7 13:28:42 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2B82C120120 for ; Wed, 7 Aug 2019 13:28:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lSEo49GaTt1U for ; Wed, 7 Aug 2019 13:28:38 -0700 (PDT) Received: from mx0a-00191d01.pphosted.com (mx0a-00191d01.pphosted.com [67.231.149.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D1194120059 for ; Wed, 7 Aug 2019 13:28:38 -0700 (PDT) Received: from pps.filterd (m0049297.ppops.net [127.0.0.1]) by m0049297.ppops.net-00191d01. (8.16.0.27/8.16.0.27) with SMTP id x77KFeYN011353; Wed, 7 Aug 2019 16:28:36 -0400 Received: from alpi154.enaf.aldc.att.com (sbcsmtp6.sbc.com [144.160.229.23]) by m0049297.ppops.net-00191d01. with ESMTP id 2u85cfghwp-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 07 Aug 2019 16:28:36 -0400 Received: from enaf.aldc.att.com (localhost [127.0.0.1]) by alpi154.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id x77KSZLx027622; Wed, 7 Aug 2019 16:28:35 -0400 Received: from zlp30483.vci.att.com (zlp30483.vci.att.com [135.47.91.189]) by alpi154.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id x77KSTvX027536 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Wed, 7 Aug 2019 16:28:32 -0400 Received: from zlp30483.vci.att.com (zlp30483.vci.att.com [127.0.0.1]) by zlp30483.vci.att.com (Service) with ESMTP id 118454014663; Wed, 7 Aug 2019 20:28:29 +0000 (GMT) Received: from GAALPA1MSGHUBAH.ITServices.sbc.com (unknown [130.8.218.157]) by zlp30483.vci.att.com (Service) with ESMTPS id F3A7B4014661; Wed, 7 Aug 2019 20:28:28 +0000 (GMT) Received: from GAALPA1MSGUSRBF.ITServices.sbc.com ([169.254.5.84]) by GAALPA1MSGHUBAH.ITServices.sbc.com ([130.8.218.157]) with mapi id 14.03.0439.000; Wed, 7 Aug 2019 16:28:28 -0400 From: "STARK, BARBARA H" To: "'Adam Roach'" , "'ADD Mailing list'" , "'Deen, Glenn (NBCUniversal)'" Thread-Topic: [Add] Auditing apps Thread-Index: AdVNRRbh8b0IoWFxT+aqWbK8u0xmqwAA1HdgAAzVvoAAB6k9wA== Date: Wed, 7 Aug 2019 20:28:28 +0000 Message-ID: <2D09D61DDFA73D4C884805CC7865E6114E259149@GAALPA1MSGUSRBF.ITServices.sbc.com> References: <2D09D61DDFA73D4C884805CC7865E6114E25886C@GAALPA1MSGUSRBF.ITServices.sbc.com> <2D09D61DDFA73D4C884805CC7865E6114E258909@GAALPA1MSGUSRBF.ITServices.sbc.com> <7d07c226-c8c6-f507-6c06-9947f7ab0731@nostrum.com> In-Reply-To: <7d07c226-c8c6-f507-6c06-9947f7ab0731@nostrum.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [135.70.248.192] Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-08-07_05:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_policy_notspam policy=outbound_policy score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1011 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1906280000 definitions=main-1908070179 Archived-At: Subject: Re: [Add] Auditing apps X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Aug 2019 20:28:40 -0000 PiBPbiA4LzcvMTkgMTI6NTEsIFNUQVJLLCBCQVJCQVJBIEggd3JvdGU6DQo+ID4gIEZyb20gd2hh dCBJIGNhbiBzZWUsIHRoZXJlIGlzIG5vdGhpbmcgdGhhdCB3b3VsZCBwcmV2ZW50IGEgbGFwdG9w L3RhYmxldA0KPiBtYW51ZmFjdHVyZXIvcHJvdmlkZXIgZnJvbSBpbmNsdWRpbmcgYSBjdXN0b20g YnJvd3NlciB0aGF0IGlzIGJyYW5kZWQgYW5kDQo+IGxvb2tzIGp1c3QgbGlrZSB0aGUgbm9uLWN1 c3RvbWl6ZWQgdmVyc2lvbiBvZiB0aGUgc2FtZSBicm93c2VyLi4uDQo+IA0KPiBUaGVyZSBpczog dHJhZGVtYXJrIGxhdy4gU2VlLCBlLmcuLA0KPiA8dXJsIGRlc3Ryb3llZCBieSBteSBmaXJld2Fs bD4NCg0KVGhlIHZlcnNpb24gb2YgRmlyZWZveCBhbmQgSUUgdGhhdCBJIGhhdmUgb24gbXkgY29y cG9yYXRlIGxhcHRvcCAodGhhdCBoYXZlIGJlZW4gY3VzdG9taXplZCBieSBteSBlbXBsb3llcikg bG9vayBqdXN0IGxpa2UgdGhlIHZlcnNpb25zIG9uIG15IHBlcnNvbmFsIGNvbXB1dGVycyAtLSB1 bmxlc3MgeW91IGdvIGRlZXAgaW4gdGhlIHNldHRpbmdzLiBJJ20gcHJldHR5IHN1cmUgdGhpcyBj dXN0b21pemF0aW9uIGlzIGJlaW5nIGRvbmUgdW5kZXIgbGljZW5zZSBvZiB0aGUgYnJvd3Nlciwg YW5kIG5vdCBpbiB2aW9sYXRpb24gb2YgYW55IGxhdy4NCg0KVG8gZG8gdGhlIGN1c3RvbWl6YXRp b24gSSBkZXNjcmliZWQgaW4gbXkgZXhhbXBsZSAoZGV2aWNlIG1hbnVmYWN0dXJlciBjaGFuZ2lu ZyB0aGUgZGVmYXVsdCBEb0ggc2VydmVyIGluIHByZS1sb2FkZWQgYnJvd3NlciksIHRoZSBvbmx5 IGNoYW5nZSB0aGF0J3MgbmVlZGVkIGlzIHRvIHRoZSBzdXBwbGllZCBEb0ggY29uZmlnIGZpbGUs IGlmIEkgdW5kZXJzdGFuZCB0aGUgRG9IIHNwZWMgY29ycmVjdGx5LiBJJ20gcHJldHR5IHN1cmUg dGhhdCBkb2Vzbid0IGltcGFjdCB0aGUgdHJhZGVtYXJrIG9yIGFueSBsaWNlbnNpbmcgYWdyZWVt ZW50LiBCdXQgaXQgaXMgYSBjdXN0b21pemF0aW9uLg0KQmFyYmFyYQ0K From nobody Wed Aug 7 14:01:57 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9106512030A for ; Wed, 7 Aug 2019 14:01:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.68 X-Spam-Level: X-Spam-Status: No, score=-1.68 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_INVALID=0.1, DKIM_SIGNED=0.1, T_SPF_HELO_PERMERROR=0.01, T_SPF_PERMERROR=0.01] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=fail (1024-bit key) reason="fail (message has been altered)" header.d=nostrum.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 21rS9R0-DElU for ; Wed, 7 Aug 2019 14:01:54 -0700 (PDT) Received: from nostrum.com (raven-v6.nostrum.com [IPv6:2001:470:d:1130::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 744EC120306 for ; Wed, 7 Aug 2019 14:01:54 -0700 (PDT) Received: from Orochi.local (c-24-9-76-58.hsd1.co.comcast.net [24.9.76.58]) (authenticated bits=0) by nostrum.com (8.15.2/8.15.2) with ESMTPSA id x77L1m2e090603 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NO); Wed, 7 Aug 2019 16:01:50 -0500 (CDT) (envelope-from adam@nostrum.com) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=nostrum.com; s=default; t=1565211710; bh=flEsa5si4EicaejZDGRMQ2OFdvDG0W0hU/zVPA6csEk=; h=Subject:To:References:From:Date:In-Reply-To; b=BXXfbssERV8dXJku+x098ptu5Bj5kvpTMpnd+Mm+4ATR4ZDNHMEzWN2IIeZ2+FOF3 ZrK39W/eTPD5lVrppCuw2wj/rzdyejIUWG4Y0aJzfGRs9M6T83ygMrybn91a5f1TI/ N/sJ39Fp1l6CaC/u00IOEvQ1LaSZjJuBLBkVH0XY= X-Authentication-Warning: raven.nostrum.com: Host c-24-9-76-58.hsd1.co.comcast.net [24.9.76.58] claimed to be Orochi.local To: "STARK, BARBARA H" , "'ADD Mailing list'" , "'Deen, Glenn (NBCUniversal)'" References: <2D09D61DDFA73D4C884805CC7865E6114E25886C@GAALPA1MSGUSRBF.ITServices.sbc.com> <2D09D61DDFA73D4C884805CC7865E6114E258909@GAALPA1MSGUSRBF.ITServices.sbc.com> <7d07c226-c8c6-f507-6c06-9947f7ab0731@nostrum.com> <2D09D61DDFA73D4C884805CC7865E6114E259149@GAALPA1MSGUSRBF.ITServices.sbc.com> From: Adam Roach Message-ID: <25fb4a89-b49e-1fd5-eac6-b4fa1aca12e9@nostrum.com> Date: Wed, 7 Aug 2019 16:01:43 -0500 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: <2D09D61DDFA73D4C884805CC7865E6114E259149@GAALPA1MSGUSRBF.ITServices.sbc.com> Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Content-Language: en-US Archived-At: Subject: Re: [Add] Auditing apps X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Aug 2019 21:01:56 -0000 On 8/7/19 15:28, STARK, BARBARA H wrote: >> On 8/7/19 12:51, STARK, BARBARA H wrote: >>> From what I can see, there is nothing that would prevent a laptop/tablet >> manufacturer/provider from including a custom browser that is branded and >> looks just like the non-customized version of the same browser... >> >> There is: trademark law. See, e.g., >> > The version of Firefox and IE that I have on my corporate laptop (that have been customized by my employer) look just like the versions on my personal computers -- unless you go deep in the settings. I'm pretty sure this customization is being done under license of the browser, and not in violation of any law. Right. That's explicitly supported by the enterprise policy feature built into Firefox, to allow the laptop's owner (your employer in this case) to configure the browser. > To do the customization I described in my example (device manufacturer changing the default DoH server in pre-loaded browser), the only change that's needed is to the supplied DoH config file, if I understand the DoH spec correctly. I'm pretty sure that doesn't impact the trademark or any licensing agreement. But it is a customization. IANAL, but I believe that would disqualify that vendor from being allowed to use the Firefox name and logo in the version they distribute. While modified preferences or enterprise policy isn't explicitly cited in the examples, it's clearly an alteration that runs afoul the top-level "You may distribute unaltered copies of Mozilla Firefox..." clause. This is why such agreements typically include phrases like "but are not limited to". /a From nobody Wed Aug 7 14:13:39 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 42D1912030A for ; Wed, 7 Aug 2019 14:13:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id f0HF3lW5EfZL for ; Wed, 7 Aug 2019 14:13:36 -0700 (PDT) Received: from shaun.rfc1035.com (shaun.rfc1035.com [93.186.33.42]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4DDA6120602 for ; Wed, 7 Aug 2019 14:13:35 -0700 (PDT) Received: from gromit.rfc1035.com (gromit.rfc1035.com [195.54.233.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by shaun.rfc1035.com (Postfix) with ESMTPSA id 416312421249; Wed, 7 Aug 2019 21:13:24 +0000 (UTC) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) From: Jim Reid In-Reply-To: Date: Wed, 7 Aug 2019 22:13:23 +0100 Cc: ADD Mailing list Content-Transfer-Encoding: quoted-printable Message-Id: <3CA4D091-5E2C-4059-A1DE-C244E16DAF6E@rfc1035.com> References: <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> <64bcfc51-6f3d-ae24-4de5-d0eb89975c66@cs.tcd.ie> <539D6F9D-137C-4F68-A8DE-EA3DFAF4D827@huitema.net> <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <841102D9-4B50-4415-8193-FF3766F91958@gmail.com> <915920CE-49DA-49EC-833A-4B6F54AF7D00@rfc1035.com> <801EFF4B-BDBC-4789-A498-36CE1E9AE5C1@rfc1035.com> To: Eric Rescorla X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: Re: [Add] HTTP privacy considerations for DoH Clients X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Aug 2019 21:13:38 -0000 > On 7 Aug 2019, at 20:45, Eric Rescorla wrote: >=20 > Well, indeed YMMV.. I think it does in fact say what those = considerations are, and leaves it up to the reader to decide how to = address them. This goes to the heart of our disagreement. IMO leaving these = considerations to the reader to make (and with little context to = understand the consequences or trade-offs) creates a gaping hole with = lots of scope for all sorts of unpleasantness. > I would encourage you to try writing some text you think would be more = satisfactory and see if it's actually practical to get more specific. Thanks, I will. Though this'll be a new I-D - not an effort to update or = change 8484. > we've tolerated the truly terrible DNS privacy situation for quite = some time, so the particular focus on the residual privacy impact of the = interaction between the DoH client and the DoH server seems a bit = incongruous. Maybe. Though if the IETF is going to do something about the truly = terrible DNS privacy situation -- and I agree it=E2=80=99s been truly = terrible since forever -- we have to start somewhere. DoH and DoT are = steps in the right direction of course. The next steps IMO should be how = these protocols get deployed and operated. And further steps will be = needed too, particularly for vanilla DNS. > For instance, what sorts of HTTP header fields should DoH clients use = or not use to enhance or ensure privacy? Why?=20 >=20 > "Implementations are advised to expose the minimal set of data needed = to achieve the desired feature set." >=20 > Honestly, a complete enumeration of every header seems out of place in = this document. I wasn=E2=80=99t suggesting putting that into an updated RFC8484, just = that it gets documented somewhere. > I'm not really sure what you're looking for here. It's not possible to = enumerate every possible use case, so what this text says is "don't do = it unless you have to=E2=80=9D.=20 Indeed. But what would =E2=80=9Cunless you have to=E2=80=9D mean in = practice? For those that have noble privacy ambitions it=E2=80=99ll mean = one thing. For those who don=E2=80=99t, it'll mean something very = different. If my intention is outrageous privacy violation of everyone = on the Internet, the semantics of =E2=80=9Cunless you have to=E2=80=9D = gives me enough scope to achieve my desired feature set. From nobody Wed Aug 7 14:38:56 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 90A49120116 for ; Wed, 7 Aug 2019 14:38:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.979 X-Spam-Level: X-Spam-Status: No, score=-1.979 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, T_SPF_HELO_PERMERROR=0.01, T_SPF_PERMERROR=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nostrum.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id anv6Fx8hT_E4 for ; Wed, 7 Aug 2019 14:38:53 -0700 (PDT) Received: from nostrum.com (raven-v6.nostrum.com [IPv6:2001:470:d:1130::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E42991200DF for ; Wed, 7 Aug 2019 14:38:53 -0700 (PDT) Received: from Orochi.local (c-24-9-76-58.hsd1.co.comcast.net [24.9.76.58]) (authenticated bits=0) by nostrum.com (8.15.2/8.15.2) with ESMTPSA id x77LcpcA096693 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NO); Wed, 7 Aug 2019 16:38:53 -0500 (CDT) (envelope-from adam@nostrum.com) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=nostrum.com; s=default; t=1565213933; bh=CczYXFQKUUDKt6cZpRLMRXVYaHD4F/ZVouCfKYXLxxI=; h=Subject:To:Cc:References:From:Date:In-Reply-To; b=TKJVp2y/JE1RyiJVwicS5fUAqUQnFwP2Ln6OXZ7gDu0yuG2mYZ37VFnsQuB2hTnuU WcQLCpvdqqBgOg7LnnUoeDKrV/vXBeQphNFU9wIAmikUtUW6JrRfCpiAF5snmxqi18 vSYzar/z6q6GGlSmovuoizMC6y5OaKsyZPkswWfs= X-Authentication-Warning: raven.nostrum.com: Host c-24-9-76-58.hsd1.co.comcast.net [24.9.76.58] claimed to be Orochi.local To: Jim Reid , Eric Rescorla Cc: ADD Mailing list References: <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <841102D9-4B50-4415-8193-FF3766F91958@gmail.com> <915920CE-49DA-49EC-833A-4B6F54AF7D00@rfc1035.com> <801EFF4B-BDBC-4789-A498-36CE1E9AE5C1@rfc1035.com> <3CA4D091-5E2C-4059-A1DE-C244E16DAF6E@rfc1035.com> From: Adam Roach Message-ID: Date: Wed, 7 Aug 2019 16:38:46 -0500 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: <3CA4D091-5E2C-4059-A1DE-C244E16DAF6E@rfc1035.com> Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Content-Language: en-US Archived-At: Subject: Re: [Add] HTTP privacy considerations for DoH Clients X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Aug 2019 21:38:56 -0000 On 8/7/19 16:13, Jim Reid wrote: > >> On 7 Aug 2019, at 20:45, Eric Rescorla wrote: >> ... >> Honestly, a complete enumeration of every header seems out of place in this document. > I wasn’t suggesting putting that into an updated RFC8484, just that it gets documented somewhere. I encourage you to understand the scope of what you're proposing; see https://www.iana.org/assignments/message-headers/message-headers.xhtml > >> I'm not really sure what you're looking for here. It's not possible to enumerate every possible use case, so what this text says is "don't do it unless you have to”. > Indeed. But what would “unless you have to” mean in practice? For those that have noble privacy ambitions it’ll mean one thing. For those who don’t, it'll mean something very different. If my intention is outrageous privacy violation of everyone on the Internet, the semantics of “unless you have to” gives me enough scope to achieve my desired feature set. > Sure, and I don't think intentional bad actors are going to change their behavior even with more detailed guidance. What we need is enough explanation of the basic principle that people writing code in good faith end up doing the right thing. "Don't send it unless omitting it breaks your use case" seems like reasonable guidance for those folks. I mean, if you want to put together a DoH-oriented document that analyzes on the order of 200 HTTP header fields to determine which ones might reasonably be sent when, including some description of the privacy implications of doing so, more power to you -- but I suspect it will be a lot of work with little to no practical effect beyond that of the text currently in RFC 8484. /a From nobody Wed Aug 7 14:49:58 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9E6441200DF for ; Wed, 7 Aug 2019 14:49:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=riseup.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pq2AyYnqkxEH for ; Wed, 7 Aug 2019 14:49:55 -0700 (PDT) Received: from mx1.riseup.net (mx1.riseup.net [198.252.153.129]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C19DD12007A for ; Wed, 7 Aug 2019 14:49:55 -0700 (PDT) Received: from capuchin.riseup.net (capuchin-pn.riseup.net [10.0.1.176]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (Client CN "*.riseup.net", Issuer "COMODO RSA Domain Validation Secure Server CA" (verified OK)) by mx1.riseup.net (Postfix) with ESMTPS id 5440E1A01CC for ; Wed, 7 Aug 2019 14:49:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=riseup.net; s=squak; t=1565214595; bh=dcePJkTWSHUDzyp7aSaT6NBK9dxjqqBYmAeimJsrp68=; h=To:References:From:Subject:Date:In-Reply-To:From; b=oCEEjMBpZMjNvDKRyG8a0Ps9eQoza6TOXHYo5eSS2+MVdIZl1W7btJNWoUCL1DYAw Wgi1/dn+l5d/YeOjFOjlwLsjGDk6PRI73Gl3hPx9sKYI2391zFCAOA7O9BaV1NUCfW y9Tiqqo/zRIELqzlRS8Zk2XZBPuRRtYEqPVuhkxg= X-Riseup-User-ID: C60A9AEE190C0A3F8D6FCAC502853546B46EB2265CC78A8A94569962793ECF4A Received: from [127.0.0.1] (localhost [127.0.0.1]) by capuchin.riseup.net (Postfix) with ESMTPSA id A791B1207FC for ; Wed, 7 Aug 2019 14:49:53 -0700 (PDT) To: add@ietf.org References: <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <841102D9-4B50-4415-8193-FF3766F91958@gmail.com> <915920CE-49DA-49EC-833A-4B6F54AF7D00@rfc1035.com> <801EFF4B-BDBC-4789-A498-36CE1E9AE5C1@rfc1035.com> <3CA4D091-5E2C-4059-A1DE-C244E16DAF6E@rfc1035.com> From: nusenu Openpgp: preference=signencrypt Autocrypt: addr=nusenu-lists@riseup.net; prefer-encrypt=mutual; keydata= xsFNBFj53gUBEADYKwT0pW1yiqt6UReZW8T2nXVCyeVT2G6z7AvW69afp82uthRH237pQ7Qs 5vq91DivN6fGN6cVksp0N9Yv+5HEQAwUxpLfcNDcGzmHMd0JMItEtozGv3a4FuiUoHAqeGXM 6Kzi3v5F2PZGF+U4QaGKEZq6u50gO/ZFy4GfC9z9tsO6Cm7s7KldVHMGx/a0MEGMwh6ZI9x2 hGXSSAKu58KRUkEpHzDiQTj+/j58ndNfZRQv6P5BLppHADRPqwEOm4RQcQYskyM0FdKXbJ8E 5GW268meflfv2BASsl3X/Xqxp+LNrstXIbFZ+38hVlQDDmdvaASpPTzIAxf8FxMYZqI+K1UE kP5nU45q84KiZoXwT6YYJDKToLSDnYkKlsrCSnLkE3Nb/IexgNoYO4nE6lT9BDV3athQCWw1 FwB5idRYWnIqbVgUFgYZDUdZBJmeTEeI+Wn5hFz6HvFVc/+haMVTcoEKSkG/tsSGsKOc2mp6 z+71io9JWrVQGmw7OeZeE4TvkF9GhwS8jrKO4E0crfcT/zT6368PZCO6Wpir8+po/ZfOWbbh 1hi3MxmXn4Fki55Zrvhy3sf28U+H/nByQV4CssYv/xVhIZsN/wNQLcDLgVs4JTBUik8eQR0Y Qrq9lG3ZVtbpEi7ZTJ6BOGIn2TKHsVIVGSQA0PdKpKYV45Lc4QARAQABzSBudXNlbnUgPG51 c2VudS1saXN0c0ByaXNldXAubmV0PsLBfQQTAQgAJwUCWPneBQIbAwUJBaOagAULCQgHAgYV CAkKCwIEFgIDAQIeAQIXgAAKCRCtYTjCRc1Cfq/kD/sHx+mnL6OLwJvBj1rVTyoHJYJARajz Go0yRlbrZSH6Z05OD3SDR9UVpWOZeY8JyFoTyCFQjAbIVjKifj0uSmi0j1iahrAgGGfik0cN XUkCxrW6jcJQ37EbvYWu4PryqLuC7IeQW1wCcB1ioyGYKkm2K6LZ9rzZPVYSmPohJ+gVI0Jt EdlNZl4JuZot9eA5w/22uvcStQHzXDsUxfqK8OAJpU8E3iBBdNpLPMDWpFz4g2yw5PD6jZ+K Q39PYMUFULaKe4YCw1O+0MFhZJI4KEcRYHuVy1b3cJjxzgVfEyFctLDsO1sh07vBhoVKUi8W e00pvGtv8QYxxMYIA3iACbsjGEr69GvvZ2pAnu9vT9OUCaES4riDCxbkMxK/Cbwk8F6mo0eq HDQ7sOZWQv81ncdG9ovlA7Pj96cEXgdtbbllF1aUZ8sAmT14YjGzhArGv7kyJ1imH5tX3OXk hBGA9JTk2mDNjEpFaTEajSvDiKyeEhWNTLm15siWkpg1124yjUkhQ3OCkw7aUDMiVn8+DQHo J2pP/84uUvngbhm1jV7nk8mxTUFgppUePkb5hhnRRzeK72QY00EwRdn7qnpNgijMJ3Fpjfy2 EeCEl3nNdcB7U0F+0ijA6P/+DROldxNr4eiP50RvV8XiW/yi2IkKBk50GNB87yYnDETxxx/c 2i00AM7BTQRY+d4FARAAwJZ6U7UT8uB1WCfLK3AOR1Wa9bzOAghlTR4WXbHB4ajQKG7/Fzud 99bnwD0V3/AOVz/SbGDyHe+7HMvd1A0Ll4NgyH6OpxY7wOwCXAYTAbcXLpM7eKTjjsb9A9XG 3FcIGvjcy76OkaewqhiABaShlStEYcPkRusHZuecXtCnfCjJKihU/kinWpBO9gY6SrF2KFCw aeS4r37brXQ9y8uy3gZ168QFuIa5AKfL0r5YN3k4StNSA2p5Z/pufWXMN3B03QC+3fireiz3 dinlHK6XjUW8oWSdNxJhexT/lUw+episNuWTQruy7PD+HeohYGXqjggmPUiWc171Sewb2f8H CHViHMee8QXqo/LSRkYVrtsx0HUSMKsVQOma/u2By03ucroIkQJQQfqX3YpK1i3EpUO2L0/m E8UpBvUm1vrst54EFym4tYNJTj9reVffFKh2cczmPVN5o8v3RrdTF96mGtcb9EJbGV4277ZE LqUspviEBXynqU3yZ48JhIWHj22/ha6TeBpapYZDOJ8lePed8E34J/GYE2YXl65LhpXAKvWz O3KiByGMysb9Li6zqZ9/BYQtg5CA6Q8Oo7pBxK4iiDH3GX2WvymmLoaOBpOaIYdvKr39fajE mzfbg7TdZKXxqp2KDrbw7vUJLDyrmPWpxHyhKHItzoi1Y59wzYSq3h0AEQEAAcLBZQQYAQgA DwUCWPneBQIbDAUJBaOagAAKCRCtYTjCRc1CfpfgEAC3tXZzhgKbF6fx5gMNDp/9MBpialvu k69UaGL3HUqM0/ytiT4FjYUmOK2mk37iop46GivsOC50PykG9gjbg9/QKUqgsZzJ8LJ+ldY4 /GKtiP5JoO59Obj8MJJ5Ta8yPfZiiNx/I8ydqd18E4PmQUCPlEKhett81t3+8R/mGwG72TaA hHwDjZAEjiXdnXh+z0AKpflCnYQafq0V73ofzuw4KovpJWMk/WPs5oSHhuV4TZ8nRkF6BR4y rEvs1kq8Y6DuNqQGwY3yilpnmqfMzzlWo7MlY657domU54bhGOsvNuZZsFDlcBczQo6h9OKq ckkVHUMAw38pX+EghzEfhYVWYmLNv5G9TA/M2s3frO3aN7ukNDq7CKIwfVz71/VfPaLQMY7/ jirzp9yIBZEi4E+PwP38FAGiD+nxzuUJv1rvxf6koqUGoHRvdppju2JLrC2nKW0La7RX7uZJ esCVkamT/XaXPROBTrZZqwbIXh2uSMzgXkC2mE1dsBf2rdsJ4y73+0DYq7YE52OV9MNoCYLH vpkapmD00svsP4sskRsrquPHkBBVCJa22lTaS8Oow9hGQe7BDjEhsVoPol889F0mbTRb3klv mGQ6/B/HA0pGWR9wISY8a7D40/qz6eE6+Yg22mtN1T8FFlNbyVmtBj0R/2HfJYhGBElLPefH jhF0TA== Message-ID: Date: Wed, 07 Aug 2019 21:49:00 +0000 MIME-Version: 1.0 In-Reply-To: <3CA4D091-5E2C-4059-A1DE-C244E16DAF6E@rfc1035.com> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="pU3KsapCzGRt79DhdmlAyCiMVyTEye48M" Archived-At: Subject: Re: [Add] HTTP privacy considerations for DoH Clients X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Aug 2019 21:49:58 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --pU3KsapCzGRt79DhdmlAyCiMVyTEye48M Content-Type: multipart/mixed; boundary="QF3KeAMInoZwMBg493Kztt8xcRuMwUzSS"; protected-headers="v1" From: nusenu To: add@ietf.org Message-ID: Subject: Re: [Add] HTTP privacy considerations for DoH Clients References: <477F76EA-3945-4D77-BEAE-FFCC01B21FF8@nbcuni.com> <64bcfc51-6f3d-ae24-4de5-d0eb89975c66@cs.tcd.ie> <539D6F9D-137C-4F68-A8DE-EA3DFAF4D827@huitema.net> <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <841102D9-4B50-4415-8193-FF3766F91958@gmail.com> <915920CE-49DA-49EC-833A-4B6F54AF7D00@rfc1035.com> <801EFF4B-BDBC-4789-A498-36CE1E9AE5C1@rfc1035.com> <3CA4D091-5E2C-4059-A1DE-C244E16DAF6E@rfc1035.com> In-Reply-To: <3CA4D091-5E2C-4059-A1DE-C244E16DAF6E@rfc1035.com> --QF3KeAMInoZwMBg493Kztt8xcRuMwUzSS Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: quoted-printable Also consider reading the attempts to get clearer wording into RFC8484 from about a year ago - which unfortunately hasn't been accepted. relevant threads: https://mailarchive.ietf.org/arch/msg/doh/vHjITrOMhWSdrozGFe4-eGNMEJc https://mailarchive.ietf.org/arch/msg/doh/5bdW_B1XW1xoVKC5AfAuH40WKfo https://mailarchive.ietf.org/arch/msg/doh/Y1imMm9vJi2D5emVr3SfKkqMzqA Sara started this but didn't have time to continue: https://datatracker.ietf.org/doc/draft-dickinson-doh-dohpe/ relevant to this on the implementation level (Firefox): https://bugzilla.mozilla.org/show_bug.cgi?id=3D1543201 https://bugzilla.mozilla.org/show_bug.cgi?id=3D1544724 --=20 https://twitter.com/nusenu_ https://mastodon.social/@nusenu --QF3KeAMInoZwMBg493Kztt8xcRuMwUzSS-- --pU3KsapCzGRt79DhdmlAyCiMVyTEye48M Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEElpDPH7u0KYWVTfK7rWE4wkXNQn4FAl1LR3cACgkQrWE4wkXN Qn4+aQ/9Edbvatn9YJti4vrlsFe8gPmJ3ronnJX5defPKmREMZ8LNmTwR5Zzy8uu oEKky7xckBO5tHLaslGq46I6wokR5VpbT7JO4Eoc/5jrWLhuchZiRInPzCq1eRTZ +ln65GeBbuir4s/AzFJM4hibHMrNq11LBHLWlzJeK+2H7ZxbHrdTIrWeziO6OYje w27bNBDOjOv+FbhX2GAJ9NJlW0Mr2st/I9NEVBJJfTHcWyv/tmD5zJR0z3R7MZ/e 1SiUhRB8mRwgpOgUxGvZJvdyvRemX6RevQENAoH4U29Uwc4y52j5AXvgoU2Y7fq8 x5RxLHfk7zpI/47/n71QMJ+L6/VdqHspkxtqcJufUOqrTAtGhEjMkNMXHyS7jJZV 1pdv76OKM3InkZayGoz9vlnvvPCQV1kKioEgFhxeI6LkH1AVtj2z5LepaQ2DIjdn 2puSLeUjoTK2aGvb90ZDc5cjoFAHos0Z4Jg2+P4cL4kjt0HDdY/DdFZrsMn3E1nc 62OhRh04UG2wZVC0lR0SF0GiLU9Z7o2Wrzi5rnKFOD+/QPBDsXJgKTMo1DczsZu8 cac3dAMNWx3goKfKmKOXZRHALIGsSY9wUKOvLIyetIZ84miULy/lezj8G3dXdKK+ Xrzfy15YZsOX8pIj3TlXmJH4NaG6PNvYZJcwe4TrYszGOTulNVs= =Ql4V -----END PGP SIGNATURE----- --pU3KsapCzGRt79DhdmlAyCiMVyTEye48M-- From nobody Wed Aug 7 17:06:24 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B988F12006A for ; Wed, 7 Aug 2019 17:06:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8ZxKSRoypZI6 for ; Wed, 7 Aug 2019 17:06:21 -0700 (PDT) Received: from mx0a-00176a04.pphosted.com (mx0b-00176a04.pphosted.com [67.231.157.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 16C00120033 for ; Wed, 7 Aug 2019 17:06:21 -0700 (PDT) Received: from pps.filterd (m0049465.ppops.net [127.0.0.1]) by mx0b-00176a04.pphosted.com (8.16.0.27/8.16.0.27) with SMTP id x7803Hsw041813 for ; Wed, 7 Aug 2019 20:06:19 -0400 Received: from usaoamgip001.mail.tfayd.com ([173.213.212.135]) by mx0b-00176a04.pphosted.com with ESMTP id 2u7yk69p77-1 (version=TLSv1.2 cipher=RC4-SHA bits=128 verify=NOT) for ; Wed, 07 Aug 2019 20:06:18 -0400 Received: from unknown (HELO potemwp00034.mail.tfayd.com) ([10.40.78.204]) by usaoamgip001.mail.tfayd.com with ESMTP; 07 Aug 2019 20:04:29 -0400 Received: from potemwp00027.mail.tfayd.com (100.124.56.51) by potemwp00033.mail.tfayd.com (100.124.56.57) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.669.32; Wed, 7 Aug 2019 18:06:16 -0600 Received: from potemwp00029.mail.tfayd.com (100.124.56.53) by potemwp00027.mail.tfayd.com (100.124.56.51) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.669.32; Wed, 7 Aug 2019 18:06:16 -0600 Received: from potemwp00029.mail.tfayd.com ([100.124.56.53]) by potemwp00029.mail.tfayd.com ([100.124.56.53]) with mapi id 15.01.0669.032; Wed, 7 Aug 2019 18:06:16 -0600 From: "Deen, Glenn (NBCUniversal)" To: Adam Roach CC: ADD Mailing list Thread-Topic: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] Thread-Index: AQHVRJA9OEBhy8mKSkG1+AboakEuZqbepjg4gACEyQCAAQYIAIAAMdmAgAHHHwCAAATuAIAC7OSAgABKlICAABWOAIAAGNwAgACJAJqAAHmCAIAACQWAgAALpICAAD92gIAIpseAgAAdfICAAJkgAIAAAnSA//+piUeAAGtfAP//nZl5gAB9zoD///V5bQ== Date: Thu, 8 Aug 2019 00:06:16 +0000 Message-ID: References: <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <841102D9-4B50-4415-8193-FF3766F91958@gmail.com> <51f18426-d2fd-! 1be9-5556-fe079992acce@cs.tcd.ie> <576BC95C-7F00-45C9-9A43-BC184147E8DE@nbcuni.com> , In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-exclaimer-md-config: 47edc00f-f2d6-45ef-be83-8a353bd47e45 Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-CFilter-Loop: Forward X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-08-07_07:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1906280000 definitions=main-1908070214 Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 Aug 2019 00:06:23 -0000 Hi Adam > On Aug 7, 2019, at 11:44 AM, Adam Roach wrote: >=20 > Oh, I absolutely get that point. If I read things correctly, you're talki= ng about native apps for things like Facebook, Slack, Twitter, and the like= , right? The point I was trying to make above is that apps in *that* class = can collect extremely detailed information about user behavior using less R= ube-Goldbergesque mechanisms than laundering such data through DNS servers.= I'm trying to tease out how you think the use of centralized DoH servers m= akes that particular landscape any different: it's not obvious to me, and s= o I want to make sure I'm not missing something. I=92ve been involved in a set of parallel conversations today on this list = which do not overlap.=20 This particular concern does not involve the concern over centralization.=20 In this particular case, I=92m talking about native OS apps that run on the= desktop or the tablet or the phone. Once the DoH code and infrastructure = is in the wild inside browsers it will start to pop up in non-browser appli= cations. =20 Your point about apps inside browsers does make me think this issue lies there too.=20 The issue I=92m raising in this thread is the question of how researchers w= ill be able to examine what applications are up to with DoH.=20 One suggestion was some form log record which could help in the in browser = app situation and if the DoH access was via a service in the device or the = OS. That maybe behavior the IETF could write up.=20 Glenn = From nobody Wed Aug 7 17:17:07 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4C4AB12006A for ; Wed, 7 Aug 2019 17:17:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eyxb3s8C-Mu1 for ; Wed, 7 Aug 2019 17:17:03 -0700 (PDT) Received: from mail-pg1-x534.google.com (mail-pg1-x534.google.com [IPv6:2607:f8b0:4864:20::534]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1EB04120033 for ; Wed, 7 Aug 2019 17:17:03 -0700 (PDT) Received: by mail-pg1-x534.google.com with SMTP id x15so32675656pgg.8 for ; Wed, 07 Aug 2019 17:17:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=HbQILXiJf5s822hAWqXKw8QkvQsfQbK1fPACc5kiW2M=; b=sS7TaZXBwibCM4JhhIN11W//lJcL+MmHd7kSavkDgtETeVdFZbo+rBEkYd4hIYPPaM BeXx5lB4dGjXBoULcLFzdCEwGrdN+QULRQTT7BZqDvsuzZxJa6FQp/pKCwtXmq5DoCcs pJ7vZIAdg3uDxQ9gGT1k3D0Cj1hhHx95yztjGXfHbKu1j+dYfcm65lB72hc8qIxP6WUJ MDDNYql4Vl3PzsTTj4l4ZSfOf7vI8JyA3lZBDKZkUnjiZs+mPO6queOiC1gcejHnlvAC 4relF07tAiYrH/YBGJwxNoy7EoiNMWhbFJ20PVyksCjPMA6ybTRrgfvJB42A3bo2HA5P iZ9Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=HbQILXiJf5s822hAWqXKw8QkvQsfQbK1fPACc5kiW2M=; b=qqf1aB8tNafsHsFggXufrIYhUfy2UOT+mQPyjaRJV/U9gdACJTZuB4WIohUlWi2meQ zq2hIGk+wVDQEbemIjk2dm5NQTxn9DhQ53I4thr4qpVkvZMbYcSRpEZZGl2UdlRNf74n iAFKYhx8weWgaRdpBj3oMaebk811ml9bBWt07WdUXDrSDB78CZbWl/3V/qQOCYv3LDCO BzVi7Jz1Ev1/nNZYOirF/RWYDhjYdmiQyoQGNzfTZGjYjRUajwPLpU+9DYbCyY78oycq 5bUkpKJCl0N6BVeWP2Lee9pXBOPuhZSx201TmO+m0n1dNz0uS/ocHFKI9o+3J9Fu4hru HJ+w== X-Gm-Message-State: APjAAAUc6ORO390PH+NwNRJDUrpn8kq55tgBILbs7hJJuXqOYZjcBSRF Uil5PP9oHvM/OGqZCRlNxktDlA== X-Google-Smtp-Source: APXvYqw+Euz9KbwnhnKSrDblBrTn13jCJwtf3fMPk+OOkJo1SMU0ZVjq26EehYiAlK0M5N3L8y62cA== X-Received: by 2002:a65:5188:: with SMTP id h8mr10029872pgq.294.1565223422323; Wed, 07 Aug 2019 17:17:02 -0700 (PDT) Received: from [17.230.173.234] ([17.230.173.234]) by smtp.gmail.com with ESMTPSA id t8sm106380047pfq.31.2019.08.07.17.17.01 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 07 Aug 2019 17:17:01 -0700 (PDT) From: Ted Lemon Message-Id: <008F7E11-756C-4AD3-8A2A-EEDFF8EB39C1@fugue.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_E03FE0CC-8EC1-44CF-8BC9-D5F1EE5361A3" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Wed, 7 Aug 2019 17:16:59 -0700 In-Reply-To: Cc: Adam Roach , ADD Mailing list To: "Deen, Glenn (NBCUniversal)" References: <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <841102D9-4B50-4415-8193-FF3766F91958@gmail.com> <51f18426-d2fd-! 1be9-5556-fe079992acce@cs.tcd.ie> <576BC95C-7F00-45C9-9A43-BC184147E8DE@nbcuni.com> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 Aug 2019 00:17:05 -0000 --Apple-Mail=_E03FE0CC-8EC1-44CF-8BC9-D5F1EE5361A3 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 On Aug 7, 2019, at 5:06 PM, Deen, Glenn (NBCUniversal) = wrote: > Once the DoH code and infrastructure is in the wild inside browsers it = will start to pop up in non-browser applications. =20 Glenn, can you explain why this is being presented as a hypothetical? = The status quo is that this is available to apps. It=E2=80=99s trivial = to do. I did my first tunnel over port 443 over a decade ago, and I = was not innovating. Any little bit of malware or privacyware that wants = to do this can do it today. I apologize for being blunt here, but this discussion has gotten really = long, and a lot of it is discussion about stuff that is in no way = actionable. I think that anything based on the above assertion falls = into that category; if you think otherwise, it would help if you could = explain. --Apple-Mail=_E03FE0CC-8EC1-44CF-8BC9-D5F1EE5361A3 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 On = Aug 7, 2019, at 5:06 PM, Deen, Glenn (NBCUniversal) <Glenn.Deen@nbcuni.com> wrote:
Once the DoH code and infrastructure is in the wild inside = browsers it will start to pop up in non-browser applications. =   

Glenn, can you explain why this is being presented as a = hypothetical?   The status quo is that this is available to apps. =   It=E2=80=99s trivial to do.   I did my first tunnel over = port 443 over a decade ago, and I was not innovating. =  Any little bit of malware or privacyware that wants to do this can = do it today.

I = apologize for being blunt here, but this discussion has gotten really long, and a lot of it is discussion about stuff that is = in no way actionable.   I think that anything based on the above = assertion falls into that category; if you think otherwise, it would = help if you could explain.

= --Apple-Mail=_E03FE0CC-8EC1-44CF-8BC9-D5F1EE5361A3-- From nobody Wed Aug 7 17:27:53 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C6251120232 for ; Wed, 7 Aug 2019 17:27:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=lowentropy.net header.b=yEtFD2Fk; dkim=pass (2048-bit key) header.d=messagingengine.com header.b=Dhulo+51 Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zI6q8n6fdrJD for ; Wed, 7 Aug 2019 17:27:51 -0700 (PDT) Received: from wout4-smtp.messagingengine.com (wout4-smtp.messagingengine.com [64.147.123.20]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 52C0B120033 for ; Wed, 7 Aug 2019 17:27:51 -0700 (PDT) Received: from compute1.internal (compute1.nyi.internal [10.202.2.41]) by mailout.west.internal (Postfix) with ESMTP id 6C18E1BD; Wed, 7 Aug 2019 20:27:50 -0400 (EDT) Received: from imap2 ([10.202.2.52]) by compute1.internal (MEProxy); Wed, 07 Aug 2019 20:27:50 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lowentropy.net; h=mime-version:message-id:in-reply-to:references:date:from:to :subject:content-type; s=fm2; bh=tuzvQ07ymSG8RPc/gBzp/qKMjoDvZ1Y UsxQKn7hviC8=; b=yEtFD2FkXmSVceolZNm1LiWCYa8TCsB2JdlHgpLBovIBEHk yVwOX++UNqgvDwGoYr66GZSoYW6BLbD1+FeOl/t39F0kPt8xJOYSKJNEE9/ypNJY L8s1HVKB+6/td9juUXoo/awWPy9A7azsp4R3eMm1LTgoUSdngt7aY4j4zZVa1bgY mUjVyNgtNFYVcDcUDJkXR+xZnIYGv2wV0WqcAPQO92F8sxL8/eqYbvONWhXHVDh/ KncIH+1MUpSo0r7gjhVfo6+4ULaCLCgUGUUU0oarKZavqHtHtKJv+hVauqtMPOW2 KXwuO7tRQCChVfvZLIyKqhk1Fa4dgojkvO2VFfg== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to:x-me-proxy :x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm3; bh=tuzvQ0 7ymSG8RPc/gBzp/qKMjoDvZ1YUsxQKn7hviC8=; b=Dhulo+51fui8nQulsO46dw X/UBJv99yK3f+WnhqfxHaWX/0p102BP76rCI/wF596x/eETEM46Euo4IR8aV0JBL gJKeo9jiRU/ZJrglg6AyLoqKMrNb2cAoagMtWZh+lGGxtBE/rzndIP41i4rjJVSV YgYb+3ZOcTehTmSF2E7ozbmRfNZPyHskR/cjqnQYiaB/Rgulp0MUxJd/2+PH4L7w 53eiq4VEo9k0+OVVDVPgoa6I0n8RSnxExdd+SGin4fDEvkImkCa0rXK43qPOWMq7 bbsRytDLsCMh27yqMHA6J6sQlFiwNwI8CduvpRk/fSBMEYLClN6EOjQXca/jrMMg == X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeduvddruddugedgtdejucetufdoteggodetrfdotf fvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdfqfgfvpdfurfetoffkrfgpnffqhgen uceurghilhhouhhtmecufedttdenucesvcftvggtihhpihgvnhhtshculddquddttddmne cujfgurhepofgfggfkjghffffhvffutgesthdtredtreertdenucfhrhhomhepfdforghr thhinhcuvfhhohhmshhonhdfuceomhhtsehlohifvghnthhrohhphidrnhgvtheqnecurf grrhgrmhepmhgrihhlfhhrohhmpehmtheslhhofigvnhhtrhhophihrdhnvghtnecuvehl uhhsthgvrhfuihiivgeptd X-ME-Proxy: Received: by mailuser.nyi.internal (Postfix, from userid 501) id 83542E00A2; Wed, 7 Aug 2019 20:27:49 -0400 (EDT) X-Mailer: MessagingEngine.com Webmail Interface User-Agent: Cyrus-JMAP/3.1.6-808-g930a1a1-fmstable-20190805v2 Mime-Version: 1.0 Message-Id: In-Reply-To: <2EF61DAB-8371-4257-82A0-8622A8F2B178@cable.comcast.com> References: <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <2EF61DAB-8371-4257-82A0-8622A8F2B178@cable.comcast.com> Date: Thu, 08 Aug 2019 10:27:49 +1000 From: "Martin Thomson" To: add@ietf.org, "Livingood, Jason" Content-Type: text/plain Archived-At: Subject: [Add] Control X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 Aug 2019 00:27:53 -0000 On Thu, Aug 8, 2019, at 00:38, Livingood, Jason wrote: > > DNS is not an effective control surface. > > You can say that, as can Mozilla, but the market & deployment data > suggests the complete opposite. I know you have a strongly held > contrary view but I think you are in the rough on this one and hope we > can move on. I want to unpack this a little, because I think that declaring that view as in the rough is a little presumptive. At least from my perspective. (I don't want to sealion here, so feel free to tell me to go away if these questions seem disingenuous or if I have a gap in my understanding that would be better addressed by myself.) There are three questions bound up in this, each that bears examination: 1. Is DNS an effective control surface? 2. Should DNS be an effective tool for control? ...and for what? 3. Why would someone want to use DNS to exert control? The arguments I presented at the meeting concentrated on the first and partly the second, on the assumption that going to the root of the issue might allow us to avoid the latter questions. That was because these get increasingly difficult to grapple with, especially when it comes to use cases. But I'm happy to talk about them if the first is indeed false, or even merely not absolute. On the first, the argument I offered was fairly simple: Name resolution doesn't exclusively use DNS, nor does it exclusively use network-provided resolvers. That suggests that any solely DNS-based mechanism cannot capture and control all potential paths toward an endpoint. On the second, I looked at captive portals. I know that some networks perform DNS-based interception, but the vast majority of portals use HTTP interception. The former can be destroyed by alternative resolvers and resolution methods (to the first point) and DNSSEC; the latter by HTTPS and HSTS. The entire reason we have a working group is to provide an alternative method (or control point) for getting a captive portal in front of a person in those adverse conditions. I realize now that the first argument might not be considered dispositive, so maybe we can talk more about that some more. In what ways is this control surface still effective, and in what ways does that make the Internet better? Cheers, Martin From nobody Wed Aug 7 17:43:33 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B980512030A for ; Wed, 7 Aug 2019 17:43:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 67ki6bgX_eEZ for ; Wed, 7 Aug 2019 17:43:30 -0700 (PDT) Received: from mail.dragon.net (mail.dragon.net [IPv6:2001:4f8:3:36::235]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2AA11120099 for ; Wed, 7 Aug 2019 17:43:30 -0700 (PDT) Received: from fafnir.remote.dragon.net (localhost [IPv6:::1]) by mail.dragon.net (Postfix) with ESMTP id D4614374022A; Wed, 7 Aug 2019 17:43:29 -0700 (PDT) Received: by fafnir.remote.dragon.net (Postfix, from userid 501) id AA3A11631752; Wed, 7 Aug 2019 18:43:29 -0600 (MDT) Received: from fafnir.local (localhost [127.0.0.1]) by fafnir.remote.dragon.net (Postfix) with ESMTP id A9A931631751; Wed, 7 Aug 2019 18:43:29 -0600 (MDT) From: Paul Ebersman To: "Martin Thomson" cc: add@ietf.org In-reply-to: References: <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <2EF61DAB-8371-4257-82A0-8622A8F2B178@cable.comcast.com> Comments: In-reply-to "Martin Thomson" message dated "Thu, 08 Aug 2019 10:27:49 +1000." X-Mailer: MH-E 7.4.2; nmh 1.7.1; XEmacs 21.4 (patch 22) MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-ID: <57193.1565225009.1@fafnir.local> Date: Wed, 07 Aug 2019 18:43:29 -0600 Message-Id: <20190808004329.AA3A11631752@fafnir.remote.dragon.net> Archived-At: Subject: Re: [Add] Control X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 Aug 2019 00:43:32 -0000 mt> There are three questions bound up in this, each that bears mt> examination: mt> 1. Is DNS an effective control surface? mt> 2. Should DNS be an effective tool for control? ...and for what? mt> 3. Why would someone want to use DNS to exert control? [...] mt> On the first, the argument I offered was fairly simple: Name mt> resolution doesn't exclusively use DNS, nor does it exclusively use mt> network-provided resolvers. That suggests that any solely DNS-based mt> mechanism cannot capture and control all potential paths toward an mt> endpoint. This sounds like the argument that anything less than perfect isn't worth doing. Firewalls miss things. Signature based detection misses things. Anti-virus misses things. Anti-spam misses things. But all have their place. Sometimes whack-a-mole is a win if you whack a high enough percentage of the moles that moles run scared. mt> On the second, I looked at captive portals. I know that some mt> networks perform DNS-based interception, but the vast majority of mt> portals use HTTP interception. All sorts of networks other than captive portals do DNS-based interception. My understanding was that DoH was there primarily to get around DNS-based interception where the end user didn't give their consent freely. In cases where the user did consent (parental controls, the user wants to stay employed, etc), DNS filtering is an effective tool. Not perfect, not sufficient in and of itself but hardly useless and widely deployed. mt> I realize now that the first argument might not be considered mt> dispositive, so maybe we can talk more about that some more. In mt> what ways is this control surface still effective, and in what ways mt> does that make the Internet better? See above. For things like parental control & malware/botnet blocking or as part of a multi-layer employer network security plan, it's in very wide spread use. Even if in some cases (parental blocking) it's more effective at making parents feel better than giving a 100% guarantee that their kids won't get to bad stuff, that still has value and makes the internet "better" for the parents. Blocking malware and botnets makes things better for everyone. Note that in all the above use cases, I mentioned freely given user consent. The reason I am tolerating the incredible volumes of email related to DoT/DoH is because there are cases (like hotel captive portals) where DNS is being filtered/altered/intercepted *without* that consent and a more standardized way of giving users informed choice would be a "good thing" for the internet too. From nobody Wed Aug 7 17:44:22 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E213C120099 for ; Wed, 7 Aug 2019 17:44:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.598 X-Spam-Level: X-Spam-Status: No, score=-2.598 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id htbW8LpBvvsT for ; Wed, 7 Aug 2019 17:44:19 -0700 (PDT) Received: from mx0a-00176a04.pphosted.com (mx0b-00176a04.pphosted.com [67.231.157.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 310E612008A for ; Wed, 7 Aug 2019 17:44:19 -0700 (PDT) Received: from pps.filterd (m0048208.ppops.net [127.0.0.1]) by m0048208.ppops.net-00176a04. (8.16.0.27/8.16.0.27) with SMTP id x780gw34039484 for ; Wed, 7 Aug 2019 20:44:18 -0400 Received: from usaoamgip001.mail.tfayd.com ([173.213.212.135]) by m0048208.ppops.net-00176a04. with ESMTP id 2u7yk7t2m2-1 (version=TLSv1.2 cipher=RC4-SHA bits=128 verify=NOT) for ; Wed, 07 Aug 2019 20:44:17 -0400 Received: from unknown (HELO potemwp00014.mail.tfayd.com) ([10.40.78.204]) by usaoamgip001.mail.tfayd.com with ESMTP; 07 Aug 2019 20:42:28 -0400 Received: from potemwp00027.mail.tfayd.com (100.124.56.51) by potemwp00001.mail.tfayd.com (100.124.56.25) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.669.32; Wed, 7 Aug 2019 18:44:15 -0600 Received: from potemwp00029.mail.tfayd.com (100.124.56.53) by potemwp00027.mail.tfayd.com (100.124.56.51) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.669.32; Wed, 7 Aug 2019 18:44:15 -0600 Received: from potemwp00029.mail.tfayd.com ([100.124.56.53]) by potemwp00029.mail.tfayd.com ([100.124.56.53]) with mapi id 15.01.0669.032; Wed, 7 Aug 2019 18:44:14 -0600 From: "Deen, Glenn (NBCUniversal)" To: Ted Lemon CC: Adam Roach , ADD Mailing list Thread-Topic: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] Thread-Index: AQHVRJA9OEBhy8mKSkG1+AboakEuZqbepjg4gACEyQCAAQYIAIAAMdmAgAHHHwCAAATuAIAC7OSAgABKlICAABWOAIAAGNwAgACJAJqAAHmCAIAACQWAgAALpICAAD92gIAIpseAgAAdfICAAJkgAIAAAnSA//+piUeAAGtfAP//nZl5gAB9zoD///V5bQAM8nyA//+jCHQ= Date: Thu, 8 Aug 2019 00:44:14 +0000 Message-ID: <21252C37-A558-415A-8951-B8015F2055E7@nbcuni.com> References: <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <841102D9-4B50-4415-8193-FF3766F91958@gmail.com> <51f18426-d2fd-! 1be9-5556-fe079992acce@cs.tcd.ie> <576BC95C-7F00-45C9-9A43-BC184147E8DE@nbcuni.com> , <008F7E11-756C-4AD3-8A2A-EEDFF8EB39C1@fugue.com> In-Reply-To: <008F7E11-756C-4AD3-8A2A-EEDFF8EB39C1@fugue.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-exclaimer-md-config: 47edc00f-f2d6-45ef-be83-8a353bd47e45 Content-Type: multipart/alternative; boundary="_000_21252C37A558415A8951B8015F2055E7nbcunicom_" MIME-Version: 1.0 X-CFilter-Loop: Forward X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-08-07_07:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1906280000 definitions=main-1908080002 Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 Aug 2019 00:44:21 -0000 --_000_21252C37A558415A8951B8015F2055E7nbcunicom_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Hi Ted On Aug 7, 2019, at 5:17 PM, Ted Lemon > wrote: On Aug 7, 2019, at 5:06 PM, Deen, Glenn (NBCUniversal) > wrote: Once the DoH code and infrastructure is in the wild inside browsers it will= start to pop up in non-browser applications. Glenn, can you explain why this is being presented as a hypothetical? The= status quo is that this is available to apps. It's trivial to do. I di= d my first tunnel over port 443 over a decade ago, and I was not innovating= . Any little bit of malware or privacyware that wants to do this can do it= today. I did not use the word hypothetical. This is very real and something I'm s= aying we should be talking about in depth and seeking approaches for addres= sing. Logging has been suggestion as one idea, there are no doubt more. Since DoH and DoT are responses to privacy concerns, we should make sure we= are not simply trading one exposure for another. I apologize for being blunt here, but this discussion has gotten really lon= g, and a lot of it is discussion about stuff that is in no way actionable. = I think that anything based on the above assertion falls into that catego= ry; if you think otherwise, it would help if you could explain. I do believe there are actionable tasks here. 1. Get security researchers engage now at analyzing attack methods against = DoH as well as attack methods against users via DoH. 1b document those in an I-D so we can work on them 2. Logging standards and best practices for clients in information that sho= uld be logged. 3. Review and expansion of the current RFC ( sorry don't know from memory) = that Ekr cited earlier. There are likely more that will pop up when the very clever ietf and securi= ty researcher communities put their minds to it. Glenn --_000_21252C37A558415A8951B8015F2055E7nbcunicom_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable
Hi Ted

On Aug 7, 2019, at 5:17 PM, Ted Lemon <mellon@fugue.com> wrote:


I did not use the word hypothetical.  This is very real and somet= hing I’m saying we should be talking about in depth and seeking appro= aches for addressing.  Logging has been suggestion as one idea, there = are no doubt more. 

Since DoH and DoT are responses to privacy concerns, we should make su= re we are not simply trading one exposure for another. 

I apologize for being blunt here, but this discussion has g= otten really long, and a = lot of it is discussion about stuff that is in no way actionable.   I = think that anything based on the above assertion falls into that category; = if you think otherwise, it would help if you could explain.

I do believe there are actionable tasks here.  

1. Get security researchers engage now at analyzing attack methods aga= inst DoH as well as attack methods against users via DoH. 

1b document those in an I-D so we can work on them 

2. Logging standards and best practices for clients in information tha= t should be logged. 

3. Review and expansion of the current RFC ( sorry don’t know fr= om memory) that Ekr cited earlier. 

There are likely more that will pop up when the very clever ietf and s= ecurity researcher communities put
their minds to it. 

Glenn


--_000_21252C37A558415A8951B8015F2055E7nbcunicom_-- From nobody Wed Aug 7 18:10:15 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B387E120232 for ; Wed, 7 Aug 2019 18:10:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DRYDEbHEoBtY for ; Wed, 7 Aug 2019 18:10:11 -0700 (PDT) Received: from mx0a-00176a04.pphosted.com (mx0a-00176a04.pphosted.com [67.231.149.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 747ED120033 for ; Wed, 7 Aug 2019 18:10:11 -0700 (PDT) Received: from pps.filterd (m0047964.ppops.net [127.0.0.1]) by m0047964.ppops.net-00176a04. (8.16.0.27/8.16.0.27) with SMTP id x78188Nk019545 for ; Wed, 7 Aug 2019 21:10:11 -0400 Received: from usaoamgip002.mail.tfayd.com ([173.213.212.136]) by m0047964.ppops.net-00176a04. with ESMTP id 2u7ykp2pd3-1 (version=TLSv1.2 cipher=RC4-SHA bits=128 verify=NOT) for ; Wed, 07 Aug 2019 21:10:10 -0400 Received: from unknown (HELO potemwp00018.mail.tfayd.com) ([10.40.78.204]) by usaoamgip002.mail.tfayd.com with ESMTP; 07 Aug 2019 21:06:22 -0400 Received: from potemwp00032.mail.tfayd.com (100.124.56.56) by potemwp00033.mail.tfayd.com (100.124.56.57) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.669.32; Wed, 7 Aug 2019 19:10:08 -0600 Received: from potemwp00029.mail.tfayd.com (100.124.56.53) by potemwp00032.mail.tfayd.com (100.124.56.56) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.669.32; Wed, 7 Aug 2019 19:10:07 -0600 Received: from potemwp00029.mail.tfayd.com ([100.124.56.53]) by potemwp00029.mail.tfayd.com ([100.124.56.53]) with mapi id 15.01.0669.032; Wed, 7 Aug 2019 19:10:07 -0600 From: "Deen, Glenn (NBCUniversal)" To: Martin Thomson CC: "add@ietf.org" Thread-Topic: [EXTERNAL] [Add] Control Thread-Index: AQHVTYAkOPxf2Q9S6ESmuKEc0lh9kKbwcQgb Date: Thu, 8 Aug 2019 01:10:07 +0000 Message-ID: <1FCF97D5-2A18-4CD2-9072-62D87F819CB0@nbcuni.com> References: <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <2EF61DAB-8371-4257-82A0-8622A8F2B178@cable.comcast.com>, In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-exclaimer-md-config: 47edc00f-f2d6-45ef-be83-8a353bd47e45 Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-CFilter-Loop: Forward X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-08-07_07:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1906280000 definitions=main-1908080007 Archived-At: Subject: Re: [Add] [EXTERNAL] Control X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 Aug 2019 01:10:13 -0000 Hi Martin=20 > On Aug 7, 2019, at 5:28 PM, Martin Thomson wrote: >=20 > Is DNS an effective control surface? Many organizations and legal frameworks have looked at DNS and have decided= , Yes, it is sufficiently effective as a control surface for a variety of i= ssues such as malware and restricting school and library access to things l= ike pornography.=20 Is it perfect? no it is not. =20 Is it effective, yes it is as part of a layered defense.=20 >=20 > 2. Should DNS be an effective tool for control? ...and for what? That=92s trending into a policy question. From a technical perspective it= is. When I needed to manage what my own kids could access on the internet= DNS was and is one of my tools >=20 > 3. Why would someone want to use DNS to exert control? This is very much into the policy territory =20 In exploring the topic I=92ve seen a large gamut of reasons: malware, re= stricting child access to adult and hate material, enforcing corporate poli= cies such as no p2p (sorry folks who want to watch movies at work), gamblin= g sites etc. not to orgs that block access to social media by workers.=20 And let=92s not forget botnet mitigation where known c&c domains are blocke= d.=20 These are all technical controls due to policy choices by the device owner = and in some cases network owner.=20 =97 And DNS is part of defense in depth. It=92s a particularly good component= which reduces the problem surface significantly. It=92s not perfect and = so additional controls are often deployed.=20 I still lock my house and car even though a thief can easily break a window= and steal my valuables.=20 -glenn = From nobody Wed Aug 7 18:35:40 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F21C81206C1 for ; Wed, 7 Aug 2019 18:35:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4mte_7lr49mw for ; Wed, 7 Aug 2019 18:35:30 -0700 (PDT) Received: from mail-pl1-x631.google.com (mail-pl1-x631.google.com [IPv6:2607:f8b0:4864:20::631]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4A27A1206CD for ; Wed, 7 Aug 2019 18:35:30 -0700 (PDT) Received: by mail-pl1-x631.google.com with SMTP id w24so42794196plp.2 for ; Wed, 07 Aug 2019 18:35:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=LAuOaZ/SdRerFWaBI/rnuLMxfrMR7mGoMwqVabYS0bM=; b=kuxmc0D+DbXIixvat3c1gD6WD87+PFE4C06+JXxNmfibKRj5b4XcXzYYi9/iSMAGJf tstlMJLfJ3tpVfgKyXQMUXTjPDITsruoZRbsz4jCzAVrel5lQxn2R0O1lUWwYAGzyINL aJJGa6nCxaFAfqI4a44CDFJm1jAO8KDt7aiJBAwytOATKnpSWxTc7wXQDL8lufldmdNs lejreh8Qrc+jjOMrROqdoh4N/VkORfst+shZg6DJRT2RzFIDhZcVW5E6aOV9X+bYhXd2 xt4MUfeDWKcHDknuJunt632MIXJIN0/QPFLDIUnJjKxDYcr6GIdjcHxWcSlbfFNJYQ6p f5KA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=LAuOaZ/SdRerFWaBI/rnuLMxfrMR7mGoMwqVabYS0bM=; b=C6uJon6S7R/QvS0TAgH+bONglrWnAaU2XiWU9qQw1MmZuf/pgTjBb/Yk+naRg4rshp 2AcHe9zx50BwuXbP9kUKrkoj2UkB6Sa/FFV/ip+oqVr4e2AxiwHVP7AZBZ9rPhO8GzEP TsJedfQ9c5+YLP90ZfRw06jyIwBsygRq9vgoyxq2u2GI+awKWIBW5/IvciG01slOAuyb Qzl2UISUV2GPiX7xaDjOZ4L3/upip9SePB7TyVXnFDjw1ac5uJoiBK5Oi78GHUbTJMK+ b6pHiSnQsvJ27ZSrDkBaWgGnJtfEMxP1UVQljb4uXQ+c34Cc+//sRBjEWtBVZjR7RMUK wvSg== X-Gm-Message-State: APjAAAWpsQHZ3CEKcBvNWc/TVad1WVWkRm4MZt+aImETTAqSEWK3HKhp HJeM7ing944wPPsDUi64NQk= X-Google-Smtp-Source: APXvYqyPL9qYThwqYLc/bG4aoea1UYbV1t3HNKKKazZjOIgS61gxboAZ3I4EZkwfAuzClvYuSf2l/A== X-Received: by 2002:a17:902:f213:: with SMTP id gn19mr11265769plb.35.1565228129868; Wed, 07 Aug 2019 18:35:29 -0700 (PDT) Received: from [10.128.64.149] ([136.60.227.81]) by smtp.gmail.com with ESMTPSA id 137sm118487338pfz.112.2019.08.07.18.35.28 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 07 Aug 2019 18:35:29 -0700 (PDT) From: Bret Jordan Message-Id: <57B9E26F-C1C0-484C-B1B9-8DCDF14B7AD9@gmail.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_56D3791B-952C-4955-BD31-D3A4A7223F23" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Wed, 7 Aug 2019 19:35:26 -0600 In-Reply-To: <1FCF97D5-2A18-4CD2-9072-62D87F819CB0@nbcuni.com> Cc: Martin Thomson , "add@ietf.org" To: "Deen, Glenn (NBCUniversal)" References: <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <2EF61DAB-8371-4257-82A0-8622A8F2B178@cable.comcast.com> <1FCF97D5-2A18-4CD2-9072-62D87F819CB0@nbcuni.com> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] [EXTERNAL] Control X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 Aug 2019 01:35:40 -0000 --Apple-Mail=_56D3791B-952C-4955-BD31-D3A4A7223F23 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Well said Glenn. I completely agree. =20 No solution is perfect, but this represents a layered defense that = organizations rely on. This coupled with other solutions can make a = sound solution. Thanks, Bret PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 "Without cryptography vihv vivc ce xhrnrw, however, the only thing that = can not be unscrambled is an egg." > On Aug 7, 2019, at 7:10 PM, Deen, Glenn (NBCUniversal) = wrote: >=20 > Hi Martin=20 >=20 >> On Aug 7, 2019, at 5:28 PM, Martin Thomson wrote: >>=20 >> Is DNS an effective control surface? >=20 > Many organizations and legal frameworks have looked at DNS and have = decided, Yes, it is sufficiently effective as a control surface for a = variety of issues such as malware and restricting school and library = access to things like pornography.=20 >=20 > Is it perfect? no it is not. =20 >=20 > Is it effective, yes it is as part of a layered defense.=20 >=20 >>=20 >> 2. Should DNS be an effective tool for control? ...and for what? >=20 > That=E2=80=99s trending into a policy question. =46rom a technical = perspective it is. When I needed to manage what my own kids could = access on the internet DNS was and is one of my tools >=20 >=20 >>=20 >> 3. Why would someone want to use DNS to exert control? >=20 > This is very much into the policy territory >=20 > In exploring the topic I=E2=80=99ve seen a large gamut of reasons: = malware, restricting child access to adult and hate material, enforcing = corporate policies such as no p2p (sorry folks who want to watch movies = at work), gambling sites etc. not to orgs that block access to social = media by workers.=20 >=20 > And let=E2=80=99s not forget botnet mitigation where known c&c domains = are blocked.=20 >=20 > These are all technical controls due to policy choices by the device = owner and in some cases network owner.=20 >=20 >=20 > =E2=80=94 >=20 > And DNS is part of defense in depth. It=E2=80=99s a particularly = good component which reduces the problem surface significantly. It=E2=80= =99s not perfect and so additional controls are often deployed.=20 >=20 > I still lock my house and car even though a thief can easily break a = window and steal my valuables.=20 >=20 > -glenn=20 > --=20 > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add --Apple-Mail=_56D3791B-952C-4955-BD31-D3A4A7223F23 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Well = said Glenn.  I completely agree.  

No solution is perfect, but this = represents a layered defense that organizations rely on. This coupled = with other solutions can make a sound solution.


Thanks,
Bret
PGP = Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 = 0050
"Without = cryptography vihv vivc ce xhrnrw, however, the only thing that can not = be unscrambled is an = egg."

On Aug 7, 2019, at 7:10 PM, Deen, Glenn (NBCUniversal) <Glenn.Deen@nbcuni.com> wrote:

Hi = Martin

On Aug 7, 2019, at 5:28 PM, Martin Thomson <mt@lowentropy.net> = wrote:

Is DNS an effective control = surface?

Many organizations = and legal frameworks have looked at DNS and have decided, Yes, it is = sufficiently effective as a control surface for a variety of issues such = as malware and restricting school and library access to things like = pornography.

Is it perfect? no it is not. =  

Is it effective, yes it is as part = of a layered defense.


2. Should DNS be an effective = tool for control?  ...and for what?

That=E2=80=99s trending into a policy question. =   =46rom a technical perspective it is.  When I needed to = manage what my own kids could access on the internet DNS was and is one = of my tools



3. Why would someone want to use = DNS to exert control?

This is = very much into the policy territory

In = exploring the topic I=E2=80=99ve seen a large gamut of reasons: =    malware, restricting child access to adult and hate = material, enforcing corporate policies such as no p2p (sorry folks who = want to watch movies at work), gambling sites etc. not to orgs that = block access to social media by workers.

And= let=E2=80=99s not forget botnet mitigation where known c&c domains = are blocked.

These are all technical = controls due to policy choices by the device owner and in some cases = network owner.


=E2=80=94

And DNS is part of defense in depth. =   It=E2=80=99s a particularly good component which reduces the = problem surface significantly.   It=E2=80=99s not perfect and = so additional controls are often deployed.

I= still lock my house and car even though a thief can easily break a = window and steal my valuables.

-glenn
--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add

= --Apple-Mail=_56D3791B-952C-4955-BD31-D3A4A7223F23-- From nobody Wed Aug 7 18:37:00 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4E86B120116 for ; Wed, 7 Aug 2019 18:36:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id g1t16phHQA7C for ; Wed, 7 Aug 2019 18:36:56 -0700 (PDT) Received: from mail-pl1-x644.google.com (mail-pl1-x644.google.com [IPv6:2607:f8b0:4864:20::644]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9CBFD120033 for ; Wed, 7 Aug 2019 18:36:56 -0700 (PDT) Received: by mail-pl1-x644.google.com with SMTP id i2so42827483plt.1 for ; Wed, 07 Aug 2019 18:36:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=hdBadWjMZvV7egNPMLhp0pRae4sBQcH2aVcoqZ25nGg=; b=XIYb6bOqGTDbt2egbgkvA0evkrIPqiTuMg9gK1MOKTxjLgX+P4K9T5u6NzOoNmfPIA yN4H06gNLeCV9SwukrtJGG9J+T/0eV1h3O7nkEENh3upKCmngGtAjXn1CzRXH0dyXBvq n/fLP0gMOMD5Jfmeu/T7TX9k86l93gSjk5aJ7Z/XydXtR3oiliLkRZ2jmEtpgNzKkUCL lEXMCa+5Utqit26mDc8F+xwnatcP3YTQGhtnqM90UWF2JnzBEy60v5YXLyEPIPsWlwTP mpsCwb8yRjMlZVClF+UTArhXJckoG1IvIwyKrHCE/OlDMBAOo/T79NfE8IDq4B5SqS/J JXuw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=hdBadWjMZvV7egNPMLhp0pRae4sBQcH2aVcoqZ25nGg=; b=YthKI4ZPNu3tjHFd13F8mrOOQj1yZHV2yJiP+v80mI3wEHNoNL/PN4cDBL0NQNW+60 +4eM2TQewhERGd8H50ozmVjKscfvAlHPkfEHApdfIrT0RPru5lhC9vdXyAdxx/63FHit 8PpKTx1C17BdCTzNjsCS16qRi5N2uofytLH38WM5xHd7FnL0ooYaBiQvFYW2GDmVmo8R guAhhpNuAmUzXzIzAEoRcqR+UxOFPGcogoDBgXJXpSzeLw3mGXUX9MEHgrrDj7cirFqI smyGGO9/NVchfK1ygT/OP9b5DhT+QnJOx/t3H1x9/Ec0A4UMhpnhZACXDek0FLszq+Sz QMgA== X-Gm-Message-State: APjAAAWTqMYQR6hvMl4KN3S1NCqwP0kcJQSvHrEf/kgunYIAIYLl4Z0n 2TAHs+WJgjyVF7+51SRxSErJWw== X-Google-Smtp-Source: APXvYqxQeHl1j31q3MdRsLHgirQThzvKoPF+8I1VJHJWw2fDxfJfpN3/U4R1X0WSuOUb8S9qArT41w== X-Received: by 2002:a17:902:b193:: with SMTP id s19mr11086857plr.258.1565228216025; Wed, 07 Aug 2019 18:36:56 -0700 (PDT) Received: from [17.230.173.234] ([17.230.173.234]) by smtp.gmail.com with ESMTPSA id 64sm94524024pfe.128.2019.08.07.18.36.54 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 07 Aug 2019 18:36:55 -0700 (PDT) From: Ted Lemon Message-Id: Content-Type: multipart/alternative; boundary="Apple-Mail=_759C63AD-FD62-48EB-AC27-14F08CE451BF" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Wed, 7 Aug 2019 18:36:52 -0700 In-Reply-To: <21252C37-A558-415A-8951-B8015F2055E7@nbcuni.com> Cc: Adam Roach , ADD Mailing list To: "Deen, Glenn (NBCUniversal)" References: <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <841102D9-4B50-4415-8193-FF3766F91958@gmail.com> <51f18426-d2fd-! 1be9-5556-fe079992acce@cs.tcd.ie> <576BC95C-7F00-45C9-9A43-BC184147E8DE@nbcuni.com> <008F7E11-756C-4AD3-8A2A-EEDFF8EB39C1@fugue.com> <21252C37-A558-415A-8951-B8015F2055E7@nbcuni.com> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 Aug 2019 01:36:59 -0000 --Apple-Mail=_759C63AD-FD62-48EB-AC27-14F08CE451BF Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 On Aug 7, 2019, at 5:44 PM, Deen, Glenn (NBCUniversal) = wrote: > On Aug 7, 2019, at 5:17 PM, Ted Lemon > wrote: >=20 >> On Aug 7, 2019, at 5:06 PM, Deen, Glenn (NBCUniversal) = > wrote: >>> Once the DoH code and infrastructure is in the wild inside browsers = it will start to pop up in non-browser applications. =20 >>=20 >> Glenn, can you explain why this is being presented as a hypothetical? = The status quo is that this is available to apps. It=E2=80=99s = trivial to do. I did my first tunnel over port 443 over a decade ago, = and I was not innovating. Any little bit of malware or privacyware that = wants to do this can do it today. >>=20 >=20 > I did not use the word hypothetical.=20 Glenn, I=E2=80=99m quoting what you said above. You said =E2=80=9Conce = DoH code and infrastructure is in the wild.=E2=80=9D This suggests = that it is not already in the wild, which is not true. That=E2=80=99s = what I mean by =E2=80=9Cpresented as a hypothetical.=E2=80=9D > Since DoH and DoT are responses to privacy concerns, we should make = sure we are not simply trading one exposure for another.=20 This is what I mean by hypothetical. You are stating this as if it=E2=80= =99s a future event that may or may not happen: =E2=80=9Cmake sure we = are not trading X for Y.=E2=80=9D There is not tradeoff to be made, = because the situation is already that we have Y, and that was never = under our control to begin with. We were never in a position to trade. This is what I mean when I ask you to unpack the hypothetical. Do you = think there is something to be prevented or controlled here? How do = you propose to prevent or control it? > 1. Get security researchers engage now at analyzing attack methods = against DoH as well as attack methods against users via DoH.=20 What question would you be asking? Can you state a specific question = that you want answered? I can think of lots of obvious attacks against = users of DoH, and I=E2=80=99m sure you can too. I can=E2=80=99t think = of a lot that wouldn=E2=80=99t also be attacks against Do53. Do you = have reason to believe that there are attacks against users that are = possible with DoH but not with Do53? Are you just talking about = leaking information in HTTP headers? If so, that=E2=80=99s a known = issue and as far as I know is already being worked on. > 1b document those in an I-D so we can work on them=20 >=20 > 2. Logging standards and best practices for clients in information = that should be logged.=20 So these would be cooperating clients? The idea being to be able to = debug problems that are caused by resolvers? What=E2=80=99s the = interface going to be for this? What=E2=80=99s the problem you are = hoping to solve here? How bad a problem is it? Do you know? I ask because the information you=E2=80=99d need to reveal to debug a = problem in a cooperating app would probably violate the user=E2=80=99s = privacy, so there=E2=80=99s a whole bunch of work that would have to be = done to figure out a framework for enabling that. And then you=E2=80=99d= have to have a process for safeguarding the information once collected. = There=E2=80=99s a cost/benefit tradeoff here. If we are going to go = down this path, it would help to know how bad the problem is that we are = trying to solve. Generally speaking, I would expect that if an app fails to contact a DoH = resolver that=E2=80=99s been burned into it, which I wouldn=E2=80=99t = recommend, two things will be true. First, it will have done a DNS = query to find the server, so you can track that. Second, when the = resolver doesn=E2=80=99t answer, it will display something in the UI. = And if it doesn=E2=80=99t, that=E2=80=99s a problem with the app, not a = problem for the ISP to solve. This is why I=E2=80=99m puzzled by what you are asking for. I am not = seeing the problem you are trying to solve that we don=E2=80=99t already = know how to solve. To be clear, I am not saying you are wrong. But if you think there is = a problem, you have a reason for thinking it=E2=80=99s a problem. = It=E2=80=99s either a good reason, or not. If it=E2=80=99s a good = reason, you should be able to explain it in such a way that I understand = it and see that it is a good reason too. If you are asking someone = else to do that, and don=E2=80=99t actually know what the problem is = yourself, we are at a bit of an impasse. > 3. Review and expansion of the current RFC ( sorry don=E2=80=99t know = from memory) that Ekr cited earlier.=20 What would you add to it? --Apple-Mail=_759C63AD-FD62-48EB-AC27-14F08CE451BF Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 On = Aug 7, 2019, at 5:44 PM, Deen, Glenn (NBCUniversal) <Glenn.Deen@nbcuni.com> wrote:
On = Aug 7, 2019, at 5:17 PM, Ted Lemon <mellon@fugue.com> wrote:

On Aug 7, 2019, at 5:06 PM, Deen, Glenn = (NBCUniversal) <Glenn.Deen@nbcuni.com> wrote:
Once the DoH code and = infrastructure is in the wild inside browsers it will start to pop up in = non-browser applications. =   

Glenn, can you explain why this is being presented as a = hypothetical?   The status quo is that this is available to apps. =   It=E2=80=99s trivial to do.   I did my first tunnel over = port 443 over a decade ago, and I was not innovating. =  Any little bit of malware or privacyware that wants to do this can = do it today.


I did = not use the word hypothetical. 

Glenn, I=E2=80=99m quoting what you = said above.   You said =E2=80=9Conce DoH code and infrastructure is = in the wild.=E2=80=9D   This suggests that it is not already in the = wild, which is not true.   That=E2=80=99s what I mean by = =E2=80=9Cpresented as a hypothetical.=E2=80=9D

Since DoH and DoT are responses to privacy concerns, we = should make sure we are not simply trading one exposure for = another. 

This is = what I mean by hypothetical.   You are stating this as if it=E2=80=99= s a future event that may or may not happen: =E2=80=9Cmake sure we are = not trading X for Y.=E2=80=9D   There is not tradeoff to be made, = because the situation is already that we have Y, and that was never = under our control to begin with.   We were never in a position to = trade.

This is = what I mean when I ask you to unpack the hypothetical.   Do you = think there is something to be prevented or controlled here?   How = do you propose to prevent or control it?

1. Get security researchers engage now at analyzing attack = methods against DoH as well as attack methods against users via = DoH. 

What = question would you be asking?  Can you state a specific question = that you want answered?   I can think of lots of obvious attacks = against users of DoH, and I=E2=80=99m sure you can too.   I can=E2=80= =99t think of a lot that wouldn=E2=80=99t also be attacks against Do53. =  Do you have reason to believe that there are attacks against users = that are possible with DoH but not with Do53?   Are you just = talking about leaking information in HTTP headers?   If so, = that=E2=80=99s a known issue and as far as I know is already being = worked on.

1b document those in an I-D so we can work on = them 

2. = Logging standards and best practices for clients in information that = should be logged. 

So these would be cooperating clients?   The idea = being to be able to debug problems that are caused by resolvers?   = What=E2=80=99s the interface going to be for this?   What=E2=80=99s = the problem you are hoping to solve here?   How bad a problem is = it?   Do you know?

I ask because the information you=E2=80=99d need to reveal to = debug a problem in a cooperating app would probably violate the user=E2=80= =99s privacy, so there=E2=80=99s a whole bunch of work that would have = to be done to figure out a framework for enabling that.   And then = you=E2=80=99d have to have a process for safeguarding the information = once collected. There=E2=80=99s a cost/benefit tradeoff here.  If = we are going to go down this path, it would help to know how bad the = problem is that we are trying to solve.

Generally speaking, I would expect that = if an app fails to contact a DoH resolver that=E2=80=99s been burned = into it, which I wouldn=E2=80=99t recommend, two things will be true. =   First, it will have done a DNS query to find the server, so you = can track that.   Second, when the resolver doesn=E2=80=99t answer, = it will display something in the UI.   And if it doesn=E2=80=99t, = that=E2=80=99s a problem with the app, not a problem for the ISP to = solve.

This is = why I=E2=80=99m puzzled by what you are asking for.   I am not = seeing the problem you are trying to solve that we don=E2=80=99t already = know how to solve.

To be clear, I am not saying you are wrong.   But if you = think there is a problem, you have a reason for thinking it=E2=80=99s a = problem.   It=E2=80=99s either a good reason, or not.   If = it=E2=80=99s a good reason, you should be able to explain it in such a = way that I understand it and see that it is a good reason too.   If = you are asking someone else to do that, and don=E2=80=99t actually know = what the problem is yourself, we are at a bit of an impasse.

3. Review and expansion of the current RFC ( sorry don=E2=80=99= t know from memory) that Ekr cited = earlier. 

What= would you add to it?

= --Apple-Mail=_759C63AD-FD62-48EB-AC27-14F08CE451BF-- From nobody Wed Aug 7 18:58:00 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A76911200B1 for ; Wed, 7 Aug 2019 18:57:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.497 X-Spam-Level: X-Spam-Status: No, score=-1.497 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, GB_ABOUTYOU=0.5, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bcFHIRt8-mNs for ; Wed, 7 Aug 2019 18:57:56 -0700 (PDT) Received: from mail-vs1-xe43.google.com (mail-vs1-xe43.google.com [IPv6:2607:f8b0:4864:20::e43]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 15DD1120033 for ; Wed, 7 Aug 2019 18:57:56 -0700 (PDT) Received: by mail-vs1-xe43.google.com with SMTP id 2so61956222vso.8 for ; Wed, 07 Aug 2019 18:57:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=/ygIU/uQaTlpGonzL0vgmQdhWHtBjV5ipRj+F2MJ3XY=; b=gECdBK84xHfWC3C9Zhkv5aGyhFAJqG3ZXlX6UngUA2d9cWCuw/IFrQs36vDkwH/i1D u9NyWB3ymkoGVNDpby5IqkLiytCJF1qpJbiV1X2kn9FV6cxq0LQEJfnkaIvDEGgXdyFH aU5vb/P9I+2fi8YwtPdKYTjAWPlekCsVAVW0Llg80xKGlicIr+pZTOIoF1yC6ZvM0yAM 8AWV6aVlZ+Q/c2fJV5//99tC6nwPhFQ8GBGs5BqPpTJDN6PtpntSl04bfz6OIBNYPTjh aBKR2G3SIp9G4kOWST9mRePMH08pC2m4ytRmJME1oXUJ8hB+8J1im7Qxhlue84AWf8AX +8CA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=/ygIU/uQaTlpGonzL0vgmQdhWHtBjV5ipRj+F2MJ3XY=; b=gA0vXc43C9MGSudJb/eSNDHf1L/xu9fo0eCPeI9/qCndoYlEte55+3rw6wIDZOdTVV AGENTdOP3dJVpnC9m0i2ZxCpwN2bm0PNn+sPwzpfnE8VBT4JRlMHunWV/M1wGzo8kP59 +j/+bFrMhjRSTaQodUCSMJ+4n4kvKKnffKEftoBSC+LglEc5WxKTKx8eJEHIBAYqABZt If9IT9OM7rdgJZzMf6+UzUd43AP5S7zXs9DjJ5PgZO3H25VVGj0C0kHAYgNW79UasZm3 C//UZtX4nGWEcJTQywd4zAlXVSojQomjUIYcqhOcVZ+39s0WTQMYuU8aDZhZBGcXXKlg NSrg== X-Gm-Message-State: APjAAAWzFd9ZRSzFI+6s/Nl15rrTCwmBZMwI/FGSr313dRyQ0qUOKVqj XTcHIoLfUi+fzH9ZYtyp2dpK2DMxEdwUdAreDg8= X-Google-Smtp-Source: APXvYqxlQnFCNcgwKPH/+pYS+V2ZL90RdVYViTrIKbiyyQco4NvT0reXFCeDH3mlzS6RfwDfh45uav9iMtWJ7rNIXRM= X-Received: by 2002:a67:edcf:: with SMTP id e15mr7939215vsp.75.1565229475143; Wed, 07 Aug 2019 18:57:55 -0700 (PDT) MIME-Version: 1.0 References: <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <841102D9-4B50-4415-8193-FF3766F91958@gmail.com> <576BC95C-7F00-45C9-9A43-BC184147E8DE@nbcuni.com> <008F7E11-756C-4AD3-8A2A-EEDFF8EB39C1@fugue.com> In-Reply-To: <008F7E11-756C-4AD3-8A2A-EEDFF8EB39C1@fugue.com> From: Brian Dickson Date: Wed, 7 Aug 2019 18:57:43 -0700 Message-ID: To: Ted Lemon Cc: "Deen, Glenn (NBCUniversal)" , ADD Mailing list , Adam Roach Content-Type: multipart/alternative; boundary="000000000000dba494058f91627f" Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 Aug 2019 01:57:59 -0000 --000000000000dba494058f91627f Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Wed, Aug 7, 2019 at 5:17 PM Ted Lemon wrote: > On Aug 7, 2019, at 5:06 PM, Deen, Glenn (NBCUniversal) < > Glenn.Deen@nbcuni.com> wrote: > > Once the DoH code and infrastructure is in the wild inside browsers it > will start to pop up in non-browser applications. > > > Glenn, can you explain why this is being presented as a hypothetical? > The status quo is that this is available to apps. It=E2=80=99s trivial = to do. I > did my first tunnel over port 443 over a decade ago, and I was *not* > innovating. Any little bit of malware or privacyware that wants to do > this can do it today. > > I apologize for being blunt here, but this discussion has gotten *really*= long, > and a lot of it is discussion about stuff that is in no way actionable. = I > think that anything based on the above assertion falls into that category= ; > if you think otherwise, it would help if you could explain. > > I'm not (explicitly) speaking on anyone's behalf (i.e. Glenn), but I'll bite: Specifically, one important subset of environments is enterprise, i.e. not coffee-shop, not ISP. Managed; possibly trusted or untrusted. The distinction is largely on how {something} knows how to pick a destination IP address for its tunnel to {destination}. Prior to DoH, the options were: hardcode an IP; hardcode an FQDN and use DNS; hardcode a DGA (domain generation algorithm) seed and use DNS. DNS could mean Do53, or later, DoT. The control-plane activity and data-plane activity were discernible. Control-plane =3D=3D DNS, data-plane =3D=3D anything else (or possibly even tunneled over DNS). A hardcoded IP would be conspicuous by its absence from DNS logs prior to the tunnel. The resulting IP could be black-listed if necessary. A hardcoded FQDN could be black-listed if necessary. DGA functionality is a harder thing to respond to, especially if 99% of the names don't exist, and non-existence doesn't break the client functionality (typically malware). In most cases, the DNS logs are very useful in detection, and DNS is useful for mitigation. In all of the previous cases, the managed environment enabled the network to do something to enforce the DNS monitoring. It could block off-net port 53 destinations; it could intercept port 53; it could block off-net port 853. DoT would be possible only to a managed end-point. In an enterprise managed network, it would be fair to say that TOS implicitly or explicitly requiring acceptance of monitoring DNS in order to use the network can be assumed. Here's two points about your "trivial" observation: - How did you configure your 443 tunnel end-points? - Were they hard-coded IPs (no DNS), or did you look up names in DNS? - (Either way, the pre-DoH environment was somewhat manageable in detecting and/or responding to these kinds of tunnels.) - I.e. malware or privacy-ware doing tunnels like this that don't also do their own DNS, would get detected and/or blocked, and those t= hat also do their own DNS would get detected and/or blocked (eventually, = IMHO at least). - This all changes with DoH... (see next bit.) With DoH in use by a browser to an off-site resolver, there is no longer a discernible "control-plane". There is no DNS traffic prior to new data-plane traffic, no clue about why new HTTPS destinations would show up. There are two distinct aspects to this change: - There is no ability to observe DNS queries to a white-listed resolver (or list of resolvers). - There is no way to distinguish vanilla HTTPS traffic hitting some arbitrary web site, and DNS over HTTPS traffic hitting a malicious resol= ver. - There is no ability to interfere with DNS resolution to block traffic to destinations on the basis of FQDN alone. (The RPZ use case.) - When ESNI is added, there will no longer be any way in the data plane to identify the FQDN end-point (no HTTP headers or SNI names) - Without DNS inspection, there would be no specific indication of which source-dest pair among a bunch of sources going to the same destination = IP, is specifically going to a particular FQDN hosted on the destination IP. - Thus, even after discovering an FQDN is hosting malware, there is no easy way to determine which client(s) might have been infected (versus a= ny previous info from DNS logs and such). - Security in the enterprise requires scalability. Scalability in the enterprise means network-level enforcement, DNS monitoring, and DNS blocking. - The alternatives to the above are: give up entirely; Deploy HTTPS MitM; require strictly managed hosts exclusively, and deny access to any others (BTW, necessary but not sufficient); black-list any software with DoH support. The problem with DoH isn't just that it bypasses the local resolver for some users; it is that it bypasses the local resolver for all users, and breaks all the DNS tools currently in use for both detection and prevention= . There is a fundamental issue here; you can't have all the benefits of DoH without the costs of DoH. Using DoT, on the other hand, enables a slightly more limited version of privacy, modulo whatever the available (reachable, non-blocked) DoT services provide, if any DoT services are available. DoT is at least nominally compatible with DNS monitoring and blocking at enterprise scale, so long as the enterprise stands up DoT on their DNS resolvers. The enterprise would then be able to block off-site DNS (again assuming the non-existence of DoH within the enterprise, or globally.) Not everyone agrees that enterprises should be able to block off-site DNS; my opinion is that that is at best a scoff-law attitude, and not really a strong position to build global standards upon. Here's my question: If enterprises were offering guest networks that didn't block off-site DNS, accessible via DoT, would DoH be necessary in those enterprises at all? I think we all agree that there remains a problem that we may not have consensus on a solution for -- the dissident use case -- but given the above re-statement of my analysis, I'm not sure there's strong consensus on the benefits of DoH outweighing the problems caused by DoH. Note that my position is only a current position; I remain open to arguments that there are ways to avoid the problems I see in having DoH-enabled software within enterprise networks. Brian --000000000000dba494058f91627f Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Wed, Aug 7, 2019 at 5:17 PM Ted Le= mon <mellon@fugue.com> wrote:=
On Aug 7, 2019, at 5:06 PM, Deen, Glenn (NBCUniv= ersal) <Glenn= .Deen@nbcuni.com> wrote:
Once the DoH code and infrastru= cture is in the wild inside browsers it will start to pop up in non-browser= applications. =C2=A0=C2=A0

Glenn, = can you explain why this is being presented as a hypothetical? =C2=A0 The s= tatus quo is that this is available to apps. =C2=A0 It=E2=80=99s trivial to= do. =C2=A0 I did my first tunnel over port 443 over a decade ago, and I wa= s not=C2=A0innovating.=C2= =A0 Any little bit of malware or privacyware that wants to do this can do i= t today.

I apologize for being blunt here, but thi= s discussion has gotten really=C2= =A0long, and a lot of it is discussion about stuff that is in no way action= able. =C2=A0 I think that anything based on the above assertion falls into = that category; if you think otherwise, it would help if you could explain.<= /span>


I'm n= ot (explicitly) speaking on anyone's behalf (i.e. Glenn), but I'll = bite:

Specifically, one important subset of enviro= nments is enterprise, i.e. not coffee-shop, not ISP.=C2=A0
Manage= d; possibly trusted or untrusted.

The distinction = is largely on how {something} knows how to pick a destination IP address fo= r its tunnel to {destination}.

Prior to DoH, the o= ptions were: hardcode an IP; hardcode an FQDN and use DNS; hardcode a DGA (= domain generation algorithm) seed and use DNS. DNS could mean Do53, or late= r, DoT.

The control-plane activity and data-plane = activity were discernible. Control-plane =3D=3D DNS, data-plane =3D=3D anyt= hing else (or possibly even tunneled over DNS).

A = hardcoded IP would be conspicuous by its absence from DNS logs prior to the= tunnel.=C2=A0
The resulting IP could be black-listed if necessar= y.
A hardcoded FQDN could be black-listed if necessary.=C2=A0
DGA functionality is a harder thing to respond to, especially if 99%= of the names don't exist, and non-existence doesn't break the clie= nt functionality (typically malware).
In most cases, the DNS logs= are very useful in detection, and DNS is useful for mitigation.
=
In all of the previous cases, the managed environment enable= d the network to do something to enforce the DNS monitoring. It could block= off-net port 53 destinations; it could intercept port 53; it could block o= ff-net port 853. DoT would be possible only to a managed end-point.

In an enterprise managed network, it would be fair to say= that TOS implicitly or explicitly requiring acceptance of monitoring DNS i= n order to use the network can be assumed.

Here= 9;s two points about your "trivial" observation:
    How did you configure your 443 tunnel end-points?=C2=A0
    • Were = they hard-coded IPs (no DNS), or did you look up names in DNS?=C2=A0
      • (Either way, the pre-DoH environment was somewhat manageable in detecting= and/or responding to these kinds of tunnels.)
    • I.e. malware or priv= acy-ware doing tunnels like this that don't also do their own DNS, woul= d get detected and/or blocked, and those that also do their own DNS would g= et detected and/or blocked (eventually, IMHO at least).
  • This a= ll changes with DoH... (see next bit.)
With DoH in use by a b= rowser to an off-site resolver, there is no longer a discernible "cont= rol-plane". There is no DNS traffic prior to new data-plane traffic, n= o clue about why new HTTPS destinations would show up.

=
There are two distinct aspects to this change:
    There is no ability to observe DNS queries to a white-listed resolver (or = list of resolvers).
  • There is no way to distinguish vanilla HTTPS tr= affic hitting some arbitrary web site, and DNS over HTTPS traffic hitting a= malicious resolver.
  • There is no ability to interfere with DNS reso= lution to block traffic to destinations on the basis of FQDN alone. (The RP= Z use case.)
  • When ESNI is added, there will no longer be any way in= the data plane to identify the FQDN end-point (no HTTP headers or SNI name= s)
  • Without DNS inspection, there would be no specific indication of= which source-dest pair among a bunch of sources going to the same destinat= ion IP, is specifically going to a particular FQDN hosted on the destinatio= n IP.
  • Thus, even after discovering an FQDN is hosting malware, ther= e is no easy way to determine which client(s) might have been infected (ver= sus any previous info from DNS logs and such).
  • Security in the ente= rprise requires scalability. Scalability in the enterprise means network-le= vel enforcement, DNS monitoring, and DNS blocking.
  • The alternatives= to the above are: give up entirely; Deploy HTTPS MitM; require strictly ma= naged hosts exclusively, and deny access to any others (BTW, necessary but = not sufficient); black-list any software with DoH support.
Th= e problem with DoH isn't just that it bypasses the local resolver for s= ome users; it is that it bypasses the local resolver for all users, and bre= aks all the DNS tools currently in use for both detection and prevention.
There is a fundamental issue here; you can't have all th= e benefits of DoH without the costs of DoH.

Using = DoT, on the other hand, enables a slightly more limited version of privacy,= modulo whatever the available (reachable, non-blocked) DoT services provid= e, if any DoT services are available. DoT is at least nominally compatible = with DNS monitoring and blocking at enterprise scale, so long as the enterp= rise stands up DoT on their DNS resolvers. The enterprise would then be abl= e to block off-site DNS (again assuming the non-existence of DoH within the= enterprise, or globally.)

Not everyone agrees tha= t enterprises should be able to block off-site DNS; my opinion is that that= is at best a scoff-law attitude, and not really a strong position to build= global standards upon.=C2=A0
Here's my question: If enterpri= ses were offering guest networks that didn't block off-site DNS, access= ible via DoT, would DoH be necessary in those enterprises at all?

I think we all agree that there remains a problem that we m= ay not have consensus on a solution for -- the dissident use case -- but gi= ven the above re-statement of my analysis, I'm not sure there's str= ong consensus on the benefits of DoH outweighing the problems caused by DoH= .

Note that my position is only a current position= ; I remain open to arguments that there are ways to avoid the problems I se= e in having DoH-enabled software within enterprise networks.

=
Brian
--000000000000dba494058f91627f-- From nobody Wed Aug 7 19:06:45 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C039C1200B1 for ; Wed, 7 Aug 2019 19:06:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.598 X-Spam-Level: X-Spam-Status: No, score=-2.598 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ixwShl42hmE8 for ; Wed, 7 Aug 2019 19:06:40 -0700 (PDT) Received: from mx0a-00176a04.pphosted.com (mx0b-00176a04.pphosted.com [67.231.157.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 014CC120033 for ; Wed, 7 Aug 2019 19:06:39 -0700 (PDT) Received: from pps.filterd (m0049465.ppops.net [127.0.0.1]) by mx0b-00176a04.pphosted.com (8.16.0.27/8.16.0.27) with SMTP id x7822tBH038390 for ; Wed, 7 Aug 2019 22:06:38 -0400 Received: from usaoamgip002.mail.tfayd.com ([173.213.212.136]) by mx0b-00176a04.pphosted.com with ESMTP id 2u7yk6auvv-1 (version=TLSv1.2 cipher=RC4-SHA bits=128 verify=NOT) for ; Wed, 07 Aug 2019 22:06:38 -0400 Received: from unknown (HELO potemwp00031.mail.tfayd.com) ([10.40.78.204]) by usaoamgip002.mail.tfayd.com with ESMTP; 07 Aug 2019 22:02:50 -0400 Received: from potemwp00028.mail.tfayd.com (100.124.56.52) by potemwp00025.mail.tfayd.com (100.124.56.49) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.669.32; Wed, 7 Aug 2019 20:06:36 -0600 Received: from potemwp00029.mail.tfayd.com (100.124.56.53) by potemwp00028.mail.tfayd.com (100.124.56.52) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.669.32; Wed, 7 Aug 2019 20:06:35 -0600 Received: from potemwp00029.mail.tfayd.com ([100.124.56.53]) by potemwp00029.mail.tfayd.com ([100.124.56.53]) with mapi id 15.01.0669.032; Wed, 7 Aug 2019 20:06:35 -0600 From: "Deen, Glenn (NBCUniversal)" To: Ted Lemon CC: ADD Mailing list Thread-Topic: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] Thread-Index: AQHVRJA9OEBhy8mKSkG1+AboakEuZqbepjg4gACEyQCAAQYIAIAAMdmAgAHHHwCAAATuAIAC7OSAgABKlICAABWOAIAAGNwAgACJAJqAAHmCAIAACQWAgAALpICAAD92gIAIpseAgAAdfICAAJkgAIAAAnSA//+piUeAAGtfAP//nZl5gAB9zoD///V5bQAM8nyA//+jCHSAAHNJAP//o7nA Date: Thu, 8 Aug 2019 02:06:35 +0000 Message-ID: <300047D4-EA67-4635-8E32-803E3046379E@nbcuni.com> References: <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <841102D9-4B50-4415-8193-FF3766F91958@gmail.com> <51f18426-d2fd-! 1be9-5556-fe079992acce@cs.tcd.ie> <576BC95C-7F00-45C9-9A43-BC184147E8DE@nbcuni.com> <008F7E11-756C-4AD3-8A2A-EEDFF8EB39C1@fugue.com> <21252C37-A558-415A-8951-B8015F2055E7@nbcuni.com>, In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-exclaimer-md-config: 47edc00f-f2d6-45ef-be83-8a353bd47e45 Content-Type: multipart/alternative; boundary="_000_300047D4EA6746358E32803E3046379Enbcunicom_" MIME-Version: 1.0 X-CFilter-Loop: Forward X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-08-07_07:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1906280000 definitions=main-1908080019 Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 Aug 2019 02:06:43 -0000 --_000_300047D4EA6746358E32803E3046379Enbcunicom_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable Hi Ted, There is a lot you wrote here, I=92ll try to address it all but I=92ll like= ly miss some. On Aug 7, 2019, at 6:37 PM, Ted Lemon > wrote: On Aug 7, 2019, at 5:44 PM, Deen, Glenn (NBCUniversal) > wrote: On Aug 7, 2019, at 5:17 PM, Ted Lemon > wrote: On Aug 7, 2019, at 5:06 PM, Deen, Glenn (NBCUniversal) > wrote: Once the DoH code and infrastructure is in the wild inside browsers it will= start to pop up in non-browser applications. Glenn, can you explain why this is being presented as a hypothetical? The= status quo is that this is available to apps. It=92s trivial to do. I = did my first tunnel over port 443 over a decade ago, and I was not innovati= ng. Any little bit of malware or privacyware that wants to do this can do = it today. I did not use the word hypothetical. Glenn, I=92m quoting what you said above. You said =93once DoH code and i= nfrastructure is in the wild.=94 This suggests that it is not already in = the wild, which is not true. That=92s what I mean by =93presented as a hy= pothetical.=94 While DoH is in browser and there are a few resolvers out there, and while = DoH is a point of big discussion inside the IETF it is not a thing that is = there yet to the rest of the world. Hence my qualifying of when it=92s a= vailable. Since DoH and DoT are responses to privacy concerns, we should make sure we= are not simply trading one exposure for another. This is what I mean by hypothetical. You are stating this as if it=92s a = future event that may or may not happen: =93make sure we are not trading X = for Y.=94 There is not tradeoff to be made, because the situation is alre= ady that we have Y, and that was never under our control to begin with. W= e were never in a position to trade. DoH is not yet turned on as the default in Firefox or Chrome. There is sti= ll opportunity to examine, discuss, and make new choices. This is what I mean when I ask you to unpack the hypothetical. Do you thi= nk there is something to be prevented or controlled here? How do you prop= ose to prevent or control it? 1. Get security researchers engage now at analyzing attack methods against = DoH as well as attack methods against users via DoH. What question would you be asking? Can you state a specific question that = you want answered? I can think of lots of obvious attacks against users o= f DoH, and I=92m sure you can too. I can=92t think of a lot that wouldn= =92t also be attacks against Do53. Do you have reason to believe that ther= e are attacks against users that are possible with DoH but not with Do53? = Are you just talking about leaking information in HTTP headers? If so, t= hat=92s a known issue and as far as I know is already being worked on. I learned long ago that asking a narrow question is the wrong approach with= security researchers. They are an inventive and creative lot and often se= e things from perspectives that I could never imagine. So I would not ask = them to verify or deny a simple assertion; instead I would say, here is thi= s things and this is how it works, what can you do with it to compromise s= ecurity or compromise the user? 1b document those in an I-D so we can work on them 2. Logging standards and best practices for clients in information that sho= uld be logged. So these would be cooperating clients? The idea being to be able to debug= problems that are caused by resolvers? What=92s the interface going to b= e for this? What=92s the problem you are hoping to solve here? How bad = a problem is it? Do you know? In the case of apps running in browsers they are subject to the browsers ru= les and controls, for those using OS services the same applies. This is n= ot only debugging, this is exposing to the device admin what the device is = doing. I ask because the information you=92d need to reveal to debug a problem in = a cooperating app would probably violate the user=92s privacy, so there=92s= a whole bunch of work that would have to be done to figure out a framework= for enabling that. And then you=92d have to have a process for safeguard= ing the information once collected. There=92s a cost/benefit tradeoff here.= If we are going to go down this path, it would help to know how bad the p= roblem is that we are trying to solve. How is logging on the users device violating their privacy? Part of what= I=92m trying to solve is to give the user visibility on what their app is = doing on their behalf. If anyone=92s privacy is violated it would be the ap= p=92s privacy to do whatever they want in the name of the user. Generally speaking, I would expect that if an app fails to contact a DoH re= solver that=92s been burned into it, which I wouldn=92t recommend, two thin= gs will be true. First, it will have done a DNS query to find the server,= so you can track that. Second, when the resolver doesn=92t answer, it wi= ll display something in the UI. And if it doesn=92t, that=92s a problem w= ith the app, not a problem for the ISP to solve. This is why I=92m puzzled by what you are asking for. I am not seeing the= problem you are trying to solve that we don=92t already know how to solve. To be clear, I am not saying you are wrong. But if you think there is a p= roblem, you have a reason for thinking it=92s a problem. It=92s either a = good reason, or not. If it=92s a good reason, you should be able to expla= in it in such a way that I understand it and see that it is a good reason t= oo. If you are asking someone else to do that, and don=92t actually know = what the problem is yourself, we are at a bit of an impasse. 3. Review and expansion of the current RFC ( sorry don=92t know from memory= ) that Ekr cited earlier. What would you add to it? As others have discussed today on list today, there are issues that people = want to consider. Regards Glenn --_000_300047D4EA6746358E32803E3046379Enbcunicom_ Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable
Hi Ted, 

There is a lot you wrote here, I=92ll try to address it al= l but I=92ll likely miss some.

On Aug 7, 2019, at 6:37 PM, Ted Lemon <mellon@fugue.com> wrote:

On Aug 7, 2019, at 5:44 PM, Deen, Glenn (NBCUniversal) <= ;Glenn.Deen@nbcuni.com<= /a>> wrote:
On Aug 7, 2019, at 5:17 PM, Ted Lemon <mellon@fugue.com> wrote:

On Aug 7, 2019, at 5:06 PM, Deen, Glenn (NBCUni= versal) <Glenn.Deen@= nbcuni.com> wrote:
Once the DoH code and infrastructure is in the wild inside browsers it will sta= rt to pop up in non-browser applications.   

Glenn, can you explain why this is being presented as a hyp= othetical?   The status quo is that this is available to apps.   = It=92s trivial to do.   I did my first tunnel over port 443 over a dec= ade ago, and I was not innovat= ing.  Any little bit of malware or privacyware that wants to do this can d= o it today.


I did not use the word hypothetical.&= nbsp;

Glenn, I=92m quoting what you said above.   You said = =93once DoH code and infrastructure is in the wild.=94   This suggests= that it is not already in the wild, which is not true.   That=92s wha= t I mean by =93presented as a hypothetical.=94

While DoH is in browser and there are a few resolvers out there, and while = DoH is a point of big discussion inside the IETF it is not a thing that is = there yet to the rest of the world.    Hence my qualifying of whe= n it=92s available.


Since DoH and DoT are responses to pri= vacy concerns, we should make sure we are not simply trading one exposure f= or another. 

This is what I mean by hypothetical.   You are stating= this as if it=92s a future event that may or may not happen: =93make sure = we are not trading X for Y.=94   There is not tradeoff to be made, bec= ause the situation is already that we have Y, and that was never under our control to begin with.   We were never in a = position to trade.

DoH is not yet turned on as the default in Firefox or Chrome.  There i= s still opportunity to examine, discuss, and make new choices.

This is what I mean when I ask you to unpack the hypothetic= al.   Do you think there is something to be prevented or controlled he= re?   How do you propose to prevent or control it?

1. Get security researchers engage now at analyzing attack = methods against DoH as well as attack methods against users via DoH. <= /div>

What question would you be asking?  Can you state a specific question = that you want answered?   I can think of lots of obvious attacks again= st users of DoH, and I=92m sure you can too.   I can=92t think of a lo= t that wouldn=92t also be attacks against Do53.  Do you have reason to believe that there are attacks against users that are possi= ble with DoH but not with Do53?   Are you just talking about leaking i= nformation in HTTP headers?   If so, that=92s a known issue and as far= as I know is already being worked on.


I learned long ago that asking a narrow question is the wrong approach= with security researchers.  They are an inventive and creative lot an= d often see things from perspectives that I could never imagine.  So I= would not ask them to verify or deny a simple assertion; instead I would say, here is this things and this is how it wor= ks,  what can you do with it to compromise security or compromise the = user?


1b document those in an I-D so we can work on them 

2. Logging standards and best practices for clients in info= rmation that should be logged. 

So these would be cooperating clients?   The idea being to be able to = debug problems that are caused by resolvers?   What=92s the interface = going to be for this?   What=92s the problem you are hoping to solve h= ere?   How bad a problem is it?   Do you know?

In the case of apps running in browsers they are subject to the browse= rs rules and controls, for those using OS services the same applies.  = This is not only debugging, this is exposing to the device admin what the = device is doing.


I ask because the information you=92d need to reveal to deb= ug a problem in a cooperating app would probably violate the user=92s priva= cy, so there=92s a whole bunch of work that would have to be done to figure= out a framework for enabling that.   And then you=92d have to have a process for safeguarding the information once = collected. There=92s a cost/benefit tradeoff here.  If we are going to= go down this path, it would help to know how bad the problem is that we ar= e trying to solve.


How is logging on the users device violating their privacy?    Pa= rt of what I=92m trying to solve is to give the user visibility on what the= ir app is doing on their behalf. If anyone=92s privacy is violated it would= be the app=92s privacy to do whatever they want in the name of the user.

Generally speaking, I would expect that if an app fails to = contact a DoH resolver that=92s been burned into it, which I wouldn=92t rec= ommend, two things will be true.   First, it will have done a DNS quer= y to find the server, so you can track that.   Second, when the resolver doesn=92t answer, it will display somethi= ng in the UI.   And if it doesn=92t, that=92s a problem with the app, = not a problem for the ISP to solve.

This is why I=92m puzzled by what you are asking for.  = ; I am not seeing the problem you are trying to solve that we don=92t alrea= dy know how to solve.

To be clear, I am not saying you are wrong.   But if y= ou think there is a problem, you have a reason for thinking it=92s a proble= m.   It=92s either a good reason, or not.   If it=92s a good reas= on, you should be able to explain it in such a way that I understand it and see that it is a good reason too.   If you are as= king someone else to do that, and don=92t actually know what the problem is= yourself, we are at a bit of an impasse.

3. Review and expansion of the current RFC ( sorry don=92t = know from memory) that Ekr cited earlier. 

What would you add to it?

As others have discussed today on list today, there are issues that people = want to consider.  

Regards
Glenn 
--_000_300047D4EA6746358E32803E3046379Enbcunicom_-- From nobody Wed Aug 7 19:13:21 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A16D612069F for ; Wed, 7 Aug 2019 19:13:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vBqahAMku0aj for ; Wed, 7 Aug 2019 19:13:11 -0700 (PDT) Received: from mail-pg1-x52b.google.com (mail-pg1-x52b.google.com [IPv6:2607:f8b0:4864:20::52b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B64D41206CA for ; Wed, 7 Aug 2019 19:13:11 -0700 (PDT) Received: by mail-pg1-x52b.google.com with SMTP id u17so43165376pgi.6 for ; Wed, 07 Aug 2019 19:13:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=njm6LcdfJPC+6fZ+N/Yl+sDN+0OZyu/AdIRoGtN6DKo=; b=PQTteu322OA46iNgJ/0xOlPgzITQ6SX6ysmv2xSax7a6aIp3p6Pmo9l5LnB5Y8f0fh amNWi50fWbn/C2n7U+WL1B/zu2pL1YQG4xSYPfY1FoYEZpRZB8lS973+8ldf9AtQ0lmv 9k5kpHGhk8KLLx8B/K+ujB0sW38ZJ+he+CjaG9UHUSapFvvVtgv+Qsb1QmAmOHHQsq1Q 00ZT8TrgCIAaN6axM+eQF3g/i7eLq6FYg7N3+CaR4yszTR75m0g0/HjsjYAOklOu4l52 rFqD4Mo3bu4YBAeXTb37+S8h4jB+CO5mUfJoVi6+4Gdpr5Wlj5d5PcmapXY8of2awnSG HPrw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=njm6LcdfJPC+6fZ+N/Yl+sDN+0OZyu/AdIRoGtN6DKo=; b=SGyoPng261kCjgD7m14Ko/5LG5Iu7DyL62WSBlDABVfAYBbdIcP5zKFjSgu5x3BoeG noGnAXzuOA3tXba5iU6+kHhCdCiSexkDTicX1ebtLQUiF2xWxSqTAl3eVcNGQunQXvvO ObhxGigigV4KnxCk8viTUtNCoMRtvIoyYvC10qB35iCQbrmaJ9VQUDW1Vw1R5ZJPYYpu 8Rswg/5+oCtI0CFPOU0FsLY1PDHzgLGQA4kZvHGInTAJ5kBOwn0zTg4bgXEJwM31pT8z +/iB3VZtxtKkcHbN1ZL9Je5jAeg3DSSQeiecJLVAk/BjD9r/0tPQ62VTuaCzi2eMRiGV vhEw== X-Gm-Message-State: APjAAAUNlQMYuhASST0Xip6QCbNuzU9e8mvtsv5tLEWimZHxuPnFH/85 8f1gAyrZ/ktMz3hWI7ilIfroIA== X-Google-Smtp-Source: APXvYqxVF+KljR2Pxyj+cL3p1g3UmhbdoFohZ4NYpneUohzJmwG9iWVFe8gbwzHjat149EEiM46U4w== X-Received: by 2002:a62:1807:: with SMTP id 7mr12373282pfy.149.1565230390825; Wed, 07 Aug 2019 19:13:10 -0700 (PDT) Received: from [17.230.173.234] ([17.230.173.234]) by smtp.gmail.com with ESMTPSA id u23sm95603692pfn.140.2019.08.07.19.13.09 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 07 Aug 2019 19:13:10 -0700 (PDT) From: Ted Lemon Message-Id: <8A76AFC2-6045-4689-A022-092C603E5670@fugue.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_FB82E859-1CD8-4492-ADE2-9FD2B6BB6C56" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Wed, 7 Aug 2019 19:13:08 -0700 In-Reply-To: Cc: "Deen, Glenn (NBCUniversal)" , ADD Mailing list , Adam Roach To: Brian Dickson References: <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <841102D9-4B50-4415-8193-FF3766F91958@gmail.com> <576BC95C-7F00-45C9-9A43-BC184147E8DE@nbcuni.com> <008F7E11-756C-4AD3-8A2A-EEDFF8EB39C1@fugue.com> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 Aug 2019 02:13:20 -0000 --Apple-Mail=_FB82E859-1CD8-4492-ADE2-9FD2B6BB6C56 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 I am fairly sure that we all understand that DoH quite effectively = prevents us from using DNS as a control plane. What this means is that = you can no longer use DNS as a control plane. That is a fact of your = life now. What I=E2=80=99m asking is not =E2=80=9Cis there a problem that=E2=80=99s = going to cause you some heartburn?=E2=80=9D There definitely is, and = you have my sympathy. What I=E2=80=99m asking is, =E2=80=9Cwhat can = the IETF do to help you with this problem.=E2=80=9D I think the answer = is =E2=80=9Cnothing.=E2=80=9D If you think the answer is something other than nothing, can you please = state explicitly what you think the answer is? Do you think the IETF = can tell Google and Cloudflare to stop offering DoH, for example? Or = do you want us to write a document explaining how to block port 443 on = public DoH resolvers? Combating malware is a moving target. DNS was a great tool for doing = that, and it probably still is. But the way it=E2=80=99s going to be = used to do that has shifted in the past few years. Most of the work on = mitigating attacks using DNS has been done outside of the IETF, and I = suspect that will continue to be the case. The relationships between = entities that do this work will have to change, and will have to account = for the privacy promises made by DoH operators. There is definitely = work to do here. But it=E2=80=99s not work that can be done in the = IETF. The IETF can=E2=80=99t turn back the clock, any more than we = could have prevented it ticking forward. --Apple-Mail=_FB82E859-1CD8-4492-ADE2-9FD2B6BB6C56 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 I = am fairly sure that we all understand that DoH quite effectively = prevents us from using DNS as a control plane.  What this means is = that you can no longer use DNS as a control plane.   That is a fact = of your life now.

What I=E2=80=99m asking is not =E2=80=9Cis there a problem = that=E2=80=99s going to cause you some heartburn?=E2=80=9D   There = definitely is, and you have my sympathy.   What I=E2=80=99m asking = is, =E2=80=9Cwhat can the IETF do to help you = with this problem.=E2=80=9D   I think the answer is = =E2=80=9Cnothing.=E2=80=9D

If you think the answer is something other than nothing, can = you please state explicitly what you think the answer is?   Do you = think the IETF can tell Google and Cloudflare to stop offering DoH, for = example?   Or do you want us to write a document explaining how to = block port 443 on public DoH resolvers?

Combating malware is a moving target. =   DNS was a great tool for doing that, and it probably still is. =   But the way it=E2=80=99s going to be used to do that has shifted = in the past few years.   Most of the work on mitigating attacks = using DNS has been done outside of the IETF, and I suspect that will = continue to be the case.   The relationships between entities that = do this work will have to change, and will have to account for the = privacy promises made by DoH operators.   There is definitely work = to do here.   But it=E2=80=99s not work that can be done in the = IETF.   The IETF can=E2=80=99t turn back the clock, any more than = we could have prevented it ticking forward.

= --Apple-Mail=_FB82E859-1CD8-4492-ADE2-9FD2B6BB6C56-- From nobody Wed Aug 7 19:14:29 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 04DD9120352 for ; Wed, 7 Aug 2019 19:14:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UsB28LDLdTSp for ; Wed, 7 Aug 2019 19:14:26 -0700 (PDT) Received: from mail-pg1-x52d.google.com (mail-pg1-x52d.google.com [IPv6:2607:f8b0:4864:20::52d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BE4AF120343 for ; Wed, 7 Aug 2019 19:14:26 -0700 (PDT) Received: by mail-pg1-x52d.google.com with SMTP id n190so2354734pgn.0 for ; Wed, 07 Aug 2019 19:14:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=vrAPu7znHBTV/VCku5XvOMD686imlSFbjc+rdqAje8I=; b=ZB/uK1BgCnpHQFbqHdCLS+aY426t5mdBEON+s5YOyedADsi/G+b4btpFAXdjq6XFTd lTqbGcB0AwKQ8aP7L1sCBPawkrQ2oGz1pfeZZZn7hIh3DaB7SFTcwd9gq2cenfx5aoED qhLBzcVk0jy5pMpYHv15yDLu8nJ65513pPckEozpVo0Un+4X4bQMm2pQSHRHgPWQ+O78 c1J1GBxa2mgYZfZ7BI1e8S1D45UkraZg6iC+5ia0XqR99LViFxEaMaeX6z/hSWfYNn1U s58MrPQ25RtejLUpCqQR49cEQuSlRb2IoLVVQPVTuYbI0u5kDct0qgSknbThr0Ju34Jj IMaA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=vrAPu7znHBTV/VCku5XvOMD686imlSFbjc+rdqAje8I=; b=YgiVEofqKYDnz3bucPKXW+1DZWjgAh63aVJuWuQ13tD712OdTd/bHLjdrD55cpc37P IEqu27pAUdV3TrEhxBh03RscIzOQQRKDfsA31DiiGacuQALXXmLqRzV+7thENOUApk4M 0nPfhCiUWHuO0Xwkb7wOiQkmYS6mvYDflyBGAE3HphpbiP1nySY6mgw5G9SMEP6Kf0VE +zJXZxVcdVWb83QGz+hT6olI4R1dSG3oFijPynQDSknU2QCp/L4tTHDvKa96sUFFIJ3v 3W/sI9wG8Hzdiw7SJCiEpSucLYYkvIZHXD/K2XtKRDD+9OGYow5ruv/sfOy2hzvgydRv pLfQ== X-Gm-Message-State: APjAAAWDmwoW+xinpyrSMZxwk28dmjPlWYHQltj1eg6nKcv4N2mTStLp gctiMSY9YYtawFSwqf69sqPXRA== X-Google-Smtp-Source: APXvYqw+N4ZpYRm3GLfSPGiuwH1n/PortCmC60EIngWmlJs+7QtBHutnAJl2h7Bp48g16gSIBZb3ew== X-Received: by 2002:a62:834d:: with SMTP id h74mr13254675pfe.254.1565230466310; Wed, 07 Aug 2019 19:14:26 -0700 (PDT) Received: from [17.230.173.234] ([17.230.173.234]) by smtp.gmail.com with ESMTPSA id j15sm124483866pfn.150.2019.08.07.19.14.24 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 07 Aug 2019 19:14:25 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) From: Ted Lemon In-Reply-To: <300047D4-EA67-4635-8E32-803E3046379E@nbcuni.com> Date: Wed, 7 Aug 2019 19:14:24 -0700 Cc: ADD Mailing list Content-Transfer-Encoding: quoted-printable Message-Id: References: <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <841102D9-4B50-4415-8193-FF3766F91958@gmail.com> <51f18426-d2fd-! 1be9-5556-fe079992acce@cs.tcd.ie> <576BC95C-7F00-45C9-9A43-BC184147E8DE@nbcuni.com> <008F7E11-756C-4AD3-8A2A-EEDFF8EB39C1@fugue.com> <21252C37-A558-415A-8951-B8015F2055E7@nbcuni.com> <300047D4-EA67-4635-8E32-803E3046379E@nbcuni.com> To: "Deen, Glenn (NBCUniversal)" X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 Aug 2019 02:14:28 -0000 On Aug 7, 2019, at 7:06 PM, Deen, Glenn (NBCUniversal) = wrote: > How is logging on the users device violating their privacy? Part of = what I=E2=80=99m trying to solve is to give the user visibility on what = their app is doing on their behalf. If anyone=E2=80=99s privacy is = violated it would be the app=E2=80=99s privacy to do whatever they want = in the name of the user. If the app is going to violate the user=E2=80=99s privacy, why would it = log information that would show that it had done so? From nobody Wed Aug 7 19:15:03 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 80564120343 for ; Wed, 7 Aug 2019 19:15:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PdIcXY1JPk-o for ; Wed, 7 Aug 2019 19:15:00 -0700 (PDT) Received: from mail-ot1-x32c.google.com (mail-ot1-x32c.google.com [IPv6:2607:f8b0:4864:20::32c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DC79B120099 for ; Wed, 7 Aug 2019 19:14:59 -0700 (PDT) Received: by mail-ot1-x32c.google.com with SMTP id n5so112554057otk.1 for ; Wed, 07 Aug 2019 19:14:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=i+ldNihXWo9od5VX0CAJYSJvizcSXHGYgwNCcX632DM=; b=uS/cpM6ugtrIlWZ1Q7ji3kXjmcSZc4k4bn809FyFpC2TjY0vzLdPoP9L5siyN8uQdR I6mZ8sNR0/Qd38Y9DRFEG0eTDmTlV7PpyUZmTzeW77bQjM+ODk+vq8Q8ShPkcfjdzDWp 0oKBb76o99IS3o8pjIoWcQp78YqV0A0HtwEpssSDpyxwl0gtQKc6QuchcnrSrkEKcowT xR6N1Lzal4JdIKT+ze6WD6kKTC1QV/Xs9FzJrjiBxsS3FB67CSg6Tty6tTcQhXQ+ctr+ pEUgq6tdMgnlEqc6IiRywmfYcHBqI5Owdtg6mx59Ww6d6ZbIu9bIhUakTspMVhMAyL6L 02Yw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=i+ldNihXWo9od5VX0CAJYSJvizcSXHGYgwNCcX632DM=; b=LlKz8i2DuLjbEOcTVf84PIMYVQbljaPctYLgNV6duMFex54nOoIg9o5O3NnSqS7qps QXQxzc6DblZlnQq90kaUE1LNr/mUCfdYHpwNkyqGQQ1w0hgw/sZFqv9nieL0gNvlrMQB ObN0llqTi4+p3oFsKkFYJ45AOXKMKYOHL68B8bLe064FQyzHIDtBtJFVqsETCNP5P+5Q YuCfBC/noHFVyNYg3NfpK5/976wEG/wdkBVZagr5TX8UGwA85rKoUKmU3yOi8tMmtvbJ vLYJII63e40PD0Q6ygpLD9u60BOR2NuwFpSxTHWRL93ol7oHfdiAxqpODrA7GT69d81V 2lYg== X-Gm-Message-State: APjAAAWkLcaFub1D5ddenuLnUts1p1e4lH+YVQef4gDOz5dREi3Fwg7z 5jJEi6rJZaL0kjr5KzcuIhv5BXqDiAHbtKflO9A= X-Google-Smtp-Source: APXvYqyc8Xu3oUcuMgmkPisKJ2lpWvCxh0hj0GCxroLg048X1UJKwlZts59d0SOEnJTVS78dszMyVElyq8U07+u7n5A= X-Received: by 2002:a6b:bc42:: with SMTP id m63mr12055911iof.189.1565230499180; Wed, 07 Aug 2019 19:14:59 -0700 (PDT) MIME-Version: 1.0 References: <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <2EF61DAB-8371-4257-82A0-8622A8F2B178@cable.comcast.com> <1FCF97D5-2A18-4CD2-9072-62D87F819CB0@nbcuni.com> <57B9E26F-C1C0-484C-B1B9-8DCDF14B7AD9@gmail.com> In-Reply-To: <57B9E26F-C1C0-484C-B1B9-8DCDF14B7AD9@gmail.com> From: Rob Sayre Date: Wed, 7 Aug 2019 19:14:47 -0700 Message-ID: To: Bret Jordan Cc: "Deen, Glenn (NBCUniversal)" , "add@ietf.org" , Martin Thomson Content-Type: multipart/alternative; boundary="000000000000e533f0058f919f45" Archived-At: Subject: Re: [Add] [EXTERNAL] Control X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 Aug 2019 02:15:02 -0000 --000000000000e533f0058f919f45 Content-Type: text/plain; charset="UTF-8" On Wed, Aug 7, 2019 at 6:35 PM Bret Jordan wrote: > Well said Glenn. I completely agree. > > No solution is perfect, but this represents a layered defense that > organizations rely on. > I think the point of Martin's presentation was that this is a poor decision, and will become increasingly poor. The presentation did acknowledge that people made this decision--it's right there in the slides. So, saying that "organizations rely on" this ineffective technique is not exactly a strong rebuttal. This has come up once in this thread already, but the problem with the "defense in depth" argument is that it can be used to rationalize ineffective measures. thanks, Rob --000000000000e533f0058f919f45 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Wed, Aug 7, 2019 at 6:35 PM Bret Jorda= n <jordan.ietf@gmail.com>= ; wrote:
Well said Gle= nn.=C2=A0 I completely agree. =C2=A0

No solution is perf= ect, but this represents a layered defense that organizations rely on.=C2= =A0

I think the point of Martin'= s presentation was that this is a poor decision, and will become increasing= ly poor. The presentation did acknowledge that people made this decision--i= t's right there in the slides. So, saying that "organizations rely= on" this=C2=A0ineffective technique is not exactly a strong rebuttal.=

This = has come up once in this thread already, but the problem with the "def= ense in depth" argument is that it can be used to rationalize ineffect= ive measures.

thanks,
Rob

--000000000000e533f0058f919f45-- From nobody Wed Aug 7 19:18:08 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D850D120116 for ; Wed, 7 Aug 2019 19:18:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vF3BZ5MxDxeO for ; Wed, 7 Aug 2019 19:18:06 -0700 (PDT) Received: from mx0a-00176a04.pphosted.com (mx0a-00176a04.pphosted.com [67.231.149.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 98F0C120099 for ; Wed, 7 Aug 2019 19:18:06 -0700 (PDT) Received: from pps.filterd (m0047964.ppops.net [127.0.0.1]) by m0047964.ppops.net-00176a04. (8.16.0.27/8.16.0.27) with SMTP id x782DICZ046632 for ; Wed, 7 Aug 2019 22:18:06 -0400 Received: from usaoamgip002.mail.tfayd.com ([173.213.212.136]) by m0047964.ppops.net-00176a04. with ESMTP id 2u7ykp3aur-1 (version=TLSv1.2 cipher=RC4-SHA bits=128 verify=NOT) for ; Wed, 07 Aug 2019 22:18:05 -0400 Received: from unknown (HELO potemwp00041.mail.tfayd.com) ([10.40.78.204]) by usaoamgip002.mail.tfayd.com with ESMTP; 07 Aug 2019 22:14:17 -0400 Received: from potemwp00029.mail.tfayd.com (100.124.56.53) by potemwp00025.mail.tfayd.com (100.124.56.49) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.669.32; Wed, 7 Aug 2019 20:18:03 -0600 Received: from potemwp00029.mail.tfayd.com ([100.124.56.53]) by potemwp00029.mail.tfayd.com ([100.124.56.53]) with mapi id 15.01.0669.032; Wed, 7 Aug 2019 20:18:03 -0600 From: "Deen, Glenn (NBCUniversal)" To: Ted Lemon CC: ADD Mailing list Thread-Topic: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] Thread-Index: AQHVRJA9OEBhy8mKSkG1+AboakEuZqbepjg4gACEyQCAAQYIAIAAMdmAgAHHHwCAAATuAIAC7OSAgABKlICAABWOAIAAGNwAgACJAJqAAHmCAIAACQWAgAALpICAAD92gIAIpseAgAAdfICAAJkgAIAAAnSA//+piUeAAGtfAP//nZl5gAB9zoD///V5bQAM8nyA//+jCHSAAHNJAP//o7nAgABmxAD//5xw5g== Date: Thu, 8 Aug 2019 02:18:03 +0000 Message-ID: <34100ED6-5ED2-4CB2-BDF5-C6A820DBC1F6@nbcuni.com> References: <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <841102D9-4B50-4415-8193-FF3766F91958@gmail.com> <51f18426-d2fd-! 1be9-5556-fe079992acce@cs.tcd.ie> <576BC95C-7F00-45C9-9A43-BC184147E8DE@nbcuni.com> <008F7E11-756C-4AD3-8A2A-EEDFF8EB39C1@fugue.com> <21252C37-A558-415A-8951-B8015F2055E7@nbcuni.com> <300047D4-EA67-4635-8E32-803E3046379E@nbcuni.com>, In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-exclaimer-md-config: 47edc00f-f2d6-45ef-be83-8a353bd47e45 Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-CFilter-Loop: Forward X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-08-07_07:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1906280000 definitions=main-1908080021 Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 Aug 2019 02:18:08 -0000 > On Aug 7, 2019, at 7:14 PM, Ted Lemon wrote: >=20 >> On Aug 7, 2019, at 7:06 PM, Deen, Glenn (NBCUniversal) wrote: >> How is logging on the users device violating their privacy? Part of w= hat I=92m trying to solve is to give the user visibility on what their app = is doing on their behalf. If anyone=92s privacy is violated it would be the= app=92s privacy to do whatever they want in the name of the user. >=20 > If the app is going to violate the user=92s privacy, why would it log inf= ormation that would show that it had done so? >=20 It may not have a choice if it=92s running inside a controlled environment = such as a browser or and OS. Again, is it perfect: no; is it one tool in t= he tool box: yes. Glenn = From nobody Wed Aug 7 19:23:12 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5924A120116 for ; Wed, 7 Aug 2019 19:23:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mUQmGeutyRUE for ; Wed, 7 Aug 2019 19:23:09 -0700 (PDT) Received: from mail-pg1-x52b.google.com (mail-pg1-x52b.google.com [IPv6:2607:f8b0:4864:20::52b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D4E2B120099 for ; Wed, 7 Aug 2019 19:23:09 -0700 (PDT) Received: by mail-pg1-x52b.google.com with SMTP id x15so32825923pgg.8 for ; Wed, 07 Aug 2019 19:23:09 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=Q6XXIqAWOvymgNzY9OJ+O/H6WO8abQF7eDKEB7QSNBg=; b=LpP29mlZswy5P6PF2L2baZTfWa2YzyR+z/frALObDMGKUkemti5TzdttQHyeV/a+/5 ejRVwM4YrVaxu9TM+UjT8ywQrxG9h3CBusCClb8s+m1sbP09tKQWyV9ZyMiukHS+SIYr ml5KMSLLHCxYN95dkRIxttE56IRT3QN9huIrvLk5E7UrO8wgHun11DMKfEWg2jVm53Dg lvNd93PvGy7A54VsdqFnuj+toJXx9cJUFhrP9zPatioUFKHaCxmHEsIIkyxzT10S8jBm fdrwavZHkbg5rPwgHTr1m3Gx0Kgxt4u3J/KWwvqfO3UcWffPcB/n5dFo+UJDCHkFk3fx bfqw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=Q6XXIqAWOvymgNzY9OJ+O/H6WO8abQF7eDKEB7QSNBg=; b=ITBsB8ub31kSel/vX61acD1lmXoR9IXkhSCqcf0OsUvHxDQrdT6lo+UYoBOzkAqnbP wN6fQq/aPuIP1iPHWEc7v2V94LqSb7zxYMxdNdyeqBb8JfwrV6PrsZjYGZnHCHsl3QAf QVnqTHOAEZhSa6P4IooLP/fVvjKkzi2iTBXg0MSQUZ/OtfI/t8HwvXE9Tc8bH3eDttoT Gy2qg9VSweN028rRSAmtOAyYEZ5EfIkmMpXNskTjNpY4mq2LTJnSj2yPisUqbxS5a/LN 2FoIACX+V9P3/f9XL7CpCPjrEbhDzzFjJo3hcU4IfzamBMmmevC5TrBxdffJeGc1dDjm nPFA== X-Gm-Message-State: APjAAAUtRgXsw/qaOIS7MM674EfbK0vbPu3jpa6U3YIKyEaKnqGnFxdL D3MEPNSaf5JuXTUjmESaF00dPg== X-Google-Smtp-Source: APXvYqwr6LvfJScLvHdR0SZwcwMFk38VSPgRRAg5jsUWM+v9/TZPX/pvzJHR1FEkHbKkYNMHAqx0Yw== X-Received: by 2002:a63:62c6:: with SMTP id w189mr10391774pgb.312.1565230989353; Wed, 07 Aug 2019 19:23:09 -0700 (PDT) Received: from [17.230.173.234] ([17.230.173.234]) by smtp.gmail.com with ESMTPSA id f15sm517297pje.17.2019.08.07.19.23.08 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 07 Aug 2019 19:23:08 -0700 (PDT) From: Ted Lemon Message-Id: <22499C5A-DD05-47EF-B382-9558E1615599@fugue.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_EF8FAB73-68D9-4AF4-94A8-A7001F954D1F" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Wed, 7 Aug 2019 19:23:07 -0700 In-Reply-To: <34100ED6-5ED2-4CB2-BDF5-C6A820DBC1F6@nbcuni.com> Cc: ADD Mailing list To: "Deen, Glenn (NBCUniversal)" References: <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <841102D9-4B50-4415-8193-FF3766F91958@gmail.com> <51f18426-d2fd-! 1be9-5556-fe079992acce@cs.tcd.ie> <576BC95C-7F00-45C9-9A43-BC184147E8DE@nbcuni.com> <008F7E11-756C-4AD3-8A2A-EEDFF8EB39C1@fugue.com> <21252C37-A558-415A-8951-B8015F2055E7@nbcuni.com> <300047D4-EA67-4635-8E32-803E3046379E@nbcuni.com> <34100ED6-5ED2-4CB2-BDF5-C6A820DBC1F6@nbcuni.com> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 Aug 2019 02:23:11 -0000 --Apple-Mail=_EF8FAB73-68D9-4AF4-94A8-A7001F954D1F Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 On Aug 7, 2019, at 7:18 PM, Deen, Glenn (NBCUniversal) = wrote: > It may not have a choice if it=E2=80=99s running inside a controlled = environment such as a browser or and OS. Again, is it perfect: no; is = it one tool in the tool box: yes. Okay. So you want the IETF to tell browser vendors and O.S. vendors = how to do logging? --Apple-Mail=_EF8FAB73-68D9-4AF4-94A8-A7001F954D1F Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 On = Aug 7, 2019, at 7:18 PM, Deen, Glenn (NBCUniversal) <Glenn.Deen@nbcuni.com> wrote:
It may not have a choice if it=E2=80=99s running inside a = controlled environment such as a browser or and OS.  Again, is it = perfect: no; is it one tool in the tool box: = yes.

Okay. =   So you want the IETF to tell browser vendors and O.S. vendors how = to do logging?

= --Apple-Mail=_EF8FAB73-68D9-4AF4-94A8-A7001F954D1F-- From nobody Wed Aug 7 19:23:34 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F3CE0120116 for ; Wed, 7 Aug 2019 19:23:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UmRnimIAQr84 for ; Wed, 7 Aug 2019 19:23:31 -0700 (PDT) Received: from mx0a-00176a04.pphosted.com (mx0a-00176a04.pphosted.com [67.231.149.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DB7F8120099 for ; Wed, 7 Aug 2019 19:23:31 -0700 (PDT) Received: from pps.filterd (m0047965.ppops.net [127.0.0.1]) by m0047965.ppops.net-00176a04. (8.16.0.27/8.16.0.27) with SMTP id x782NDuh048993 for ; Wed, 7 Aug 2019 22:23:31 -0400 Received: from usushmgip001.mail.tfayd.com ([216.178.109.235]) by m0047965.ppops.net-00176a04. with ESMTP id 2u7yk73c96-1 (version=TLSv1.2 cipher=RC4-SHA bits=128 verify=NOT) for ; Wed, 07 Aug 2019 22:23:31 -0400 Received: from unknown (HELO potemwp00045.mail.tfayd.com) ([10.40.33.204]) by usushmgip001.mail.tfayd.com with ESMTP; 07 Aug 2019 19:23:30 -0700 Received: from potemwp00032.mail.tfayd.com (100.124.56.56) by potemwp00001.mail.tfayd.com (100.124.56.25) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.669.32; Wed, 7 Aug 2019 20:23:29 -0600 Received: from potemwp00029.mail.tfayd.com (100.124.56.53) by potemwp00032.mail.tfayd.com (100.124.56.56) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.669.32; Wed, 7 Aug 2019 20:23:28 -0600 Received: from potemwp00029.mail.tfayd.com ([100.124.56.53]) by potemwp00029.mail.tfayd.com ([100.124.56.53]) with mapi id 15.01.0669.032; Wed, 7 Aug 2019 20:23:28 -0600 From: "Deen, Glenn (NBCUniversal)" To: Rob Sayre CC: Bret Jordan , "add@ietf.org" , Martin Thomson Thread-Topic: [Add] [EXTERNAL] Control Thread-Index: AQHVTY8VyK5Pe+uIZUeP9qbQcx+pNqbwhWm0 Date: Thu, 8 Aug 2019 02:23:28 +0000 Message-ID: References: <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <2EF61DAB-8371-4257-82A0-8622A8F2B178@cable.comcast.com> <1FCF97D5-2A18-4CD2-9072-62D87F819CB0@nbcuni.com> <57B9E26F-C1C0-484C-B1B9-8DCDF14B7AD9@gmail.com>, In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-exclaimer-md-config: 47edc00f-f2d6-45ef-be83-8a353bd47e45 Content-Type: multipart/alternative; boundary="_000_BCE29DF43F6847A48FC315C2BA4B420Enbcunicom_" MIME-Version: 1.0 X-CFilter-Loop: Forward X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-08-07_07:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1906280000 definitions=main-1908080023 Archived-At: Subject: Re: [Add] [EXTERNAL] Control X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 Aug 2019 02:23:33 -0000 --_000_BCE29DF43F6847A48FC315C2BA4B420Enbcunicom_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Hi Rob, On Aug 7, 2019, at 7:15 PM, Rob Sayre > wrote: On Wed, Aug 7, 2019 at 6:35 PM Bret Jordan > wrote: Well said Glenn. I completely agree. No solution is perfect, but this represents a layered defense that organiza= tions rely on. I think the point of Martin's presentation was that this is a poor decision= , and will become increasingly poor. The presentation did acknowledge that = people made this decision--it's right there in the slides. So, saying that = "organizations rely on" this ineffective technique is not exactly a strong = rebuttal. I'm still very much missing the why and the supporting facts on this assert= ion. This has come up once in this thread already, but the problem with the "def= ense in depth" argument is that it can be used to rationalize ineffective m= easures. Again, where is the data to show they are ineffective? I get that there is a view that doesn't like this approach, but I also get= that there are a heck of lot of people and organizations globally that are= quite satisfied with the results they currently get from these controls. . . . I'm going to follow Stephen F's example and self silence for a bit on this= list. I've made my points heard and anything else will be me repeating my= self. -Glenn --_000_BCE29DF43F6847A48FC315C2BA4B420Enbcunicom_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Hi Rob,

On Aug 7, 2019, at 7:15 PM, Rob Sayre <sayrer@gmail.com> wrote:

On Wed, Aug 7, 2019 at 6:35 PM Bret Jordan <jordan.ietf@gmail.com> wrote:
Well said Glenn.  I complete= ly agree.  

No solution is perfect, but this represents a layered defense that org= anizations rely on. 

I think the point of Martin's presentation was that this is a poor decision= , and will become increasingly poor. The presentation did acknowledge that = people made this decision--it's right there in the slides. So, saying that = "organizations rely on" this ineffective technique is not exactly a strong rebuttal.

I’m still very much missing the why and the supporting facts on this = assertion.

This has come up once in this thread already, bu= t the problem with the "defense in depth" argument is that it can= be used to rationalize ineffective measures.

Again, where is the data to show they are ineffective? 

 I get that there is a view that doesn’t like this approach= , but I also get that there are a heck of lot of people and organizations g= lobally that are quite satisfied with the results they currently get from t= hese controls.

.
.
.

I’m going to follow Stephen F’s  example and self sil= ence for a bit on this list. I’ve made my points heard and anything e= lse  will be me repeating myself.

-Glenn 


--_000_BCE29DF43F6847A48FC315C2BA4B420Enbcunicom_-- From nobody Wed Aug 7 19:27:59 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5F314120116 for ; Wed, 7 Aug 2019 19:27:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1PEoOib-KlrP for ; Wed, 7 Aug 2019 19:27:57 -0700 (PDT) Received: from mail.dragon.net (mail.dragon.net [IPv6:2001:4f8:3:36::235]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 54E41120099 for ; Wed, 7 Aug 2019 19:27:57 -0700 (PDT) Received: from fafnir.remote.dragon.net (localhost [IPv6:::1]) by mail.dragon.net (Postfix) with ESMTP id 2711E374029C; Wed, 7 Aug 2019 19:27:57 -0700 (PDT) Received: by fafnir.remote.dragon.net (Postfix, from userid 501) id F02A9163266B; Wed, 7 Aug 2019 20:27:56 -0600 (MDT) Received: from fafnir.local (localhost [127.0.0.1]) by fafnir.remote.dragon.net (Postfix) with ESMTP id EA7B3163266A; Wed, 7 Aug 2019 20:27:56 -0600 (MDT) From: Paul Ebersman To: Rob Sayre cc: add@ietf.org In-reply-to: References: <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <2EF61DAB-8371-4257-82A0-8622A8F2B178@cable.comcast.com> <1FCF97D5-2A18-4CD2-9072-62D87F819CB0@nbcuni.com> <57B9E26F-C1C0-484C-B1B9-8DCDF14B7AD9@gmail.com> Comments: In-reply-to Rob Sayre message dated "Wed, 07 Aug 2019 19:14:47 -0700." X-Mailer: MH-E 7.4.2; nmh 1.7.1; XEmacs 21.4 (patch 22) MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-ID: <61042.1565231276.1@fafnir.local> Date: Wed, 07 Aug 2019 20:27:56 -0600 Message-Id: <20190808022756.F02A9163266B@fafnir.remote.dragon.net> Archived-At: Subject: Re: [Add] [EXTERNAL] Control X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 Aug 2019 02:27:58 -0000 bjordon> No solution is perfect, but this represents a layered defense bjordon> that organizations rely on. sayrer> I think the point of Martin's presentation was that this is a sayrer> poor decision, and will become increasingly poor. And you base this on what beyond your own personal opinion? Have you had extensive experience supporting large enterprise security customers? Have you worked at a large ISP with customers using these services? Do you have data showing that the efficacy has decreased, where and how much? There are vendors and ISP operators on this list who have all said that this is effective and useful. Not 100% effective, but effective. Effective for millions of users today. Sure, all defenses get less effective with time. Not news. But you haven't shown that DNS filtering isn't an effective tool right now. Can we move on? From nobody Wed Aug 7 19:37:29 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 60BA41200DF for ; Wed, 7 Aug 2019 19:37:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Z0HCpnujhTCX for ; Wed, 7 Aug 2019 19:37:25 -0700 (PDT) Received: from mail-ot1-x32e.google.com (mail-ot1-x32e.google.com [IPv6:2607:f8b0:4864:20::32e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9B3E8120099 for ; Wed, 7 Aug 2019 19:37:25 -0700 (PDT) Received: by mail-ot1-x32e.google.com with SMTP id q20so112520043otl.0 for ; Wed, 07 Aug 2019 19:37:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=UCjCJCw/GimxK5jlub0+dgaZVP4e9ONYfCU32tGhLAU=; b=TW43Naq2y3Jz8ycjAdVZQbJHccLc0Iu+sEdDDdjlS3dCXI//uXrMjNi0fe2l9GllEc yamy1RKbZpqCqXJIC3rsKbyWLs1XGNmFKEpMHHH9DX9QAnDgDXNew4qQ3Lz59RW2J1+V PldPR5xsHQMIN+YHXCD+QVdXtUYApf7+upXuHY7djFbd45mN2COn3fhwAG1lxhXUGkIE eHEj0XBGBAKdkVsLsH9UXeDCVuxIXgH/z7ohwqm/HXmv+TXNP70Iu57Ffis0YJc5GAqD Kx5cgM5oXnjrry3cFheBlHXiuCl0/yJTlMvIxO7aiikMoxinXDzyHYeO5XIdo6JXssdD dBJQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=UCjCJCw/GimxK5jlub0+dgaZVP4e9ONYfCU32tGhLAU=; b=Ay1BVQ1tBOEYfCuVPSTwR9fVvw/lj+G2O4Rb//Z2/Z7r10GyjWnLJK2By68oGrW07B MYCrnQwG9JGe7cZhKEq5FrKWTLzwSiJeVEdvU5QFBAtfMwhjRPyRsQG17asq89rtllfG rf0NJfxXoQbJvl4cVyxf2Umjen2O3ET5qQIyoy6j/Yo2XG68La+TAh7R1XppPhPYrnN0 x1R1MwLEmTGhZxDuGhTJkJ4KJ3XLOHGumZU6tXOh5hZp9AcdnDGVjKL9Zk4s3hgpR5lf sP0znPIUOrpleyL550CWwvXjby1JYZKhM2swvJqEUR0D0SQM5fW2+JjqToC0yZfYNnvX wkXA== X-Gm-Message-State: APjAAAU1ZV5s6YWPuc9rYtbN1W2TzzOUKT5ypNv4SsyOENGvws5lLSOe 5f5eyTYxKgWFlWR5sxMYOol5yS2ZjY2ImM4pBTH0L6igGlwEbw== X-Google-Smtp-Source: APXvYqwr15wUFMXZmzFe+NUwu9Avb5dZYR8GicbMK3OPCK4g8GiH0JmPsqIz+gxa1KWiLji3ZAMsvrHpxG3cb92fZJc= X-Received: by 2002:a6b:bc42:: with SMTP id m63mr12127295iof.189.1565231844874; Wed, 07 Aug 2019 19:37:24 -0700 (PDT) MIME-Version: 1.0 References: <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <2EF61DAB-8371-4257-82A0-8622A8F2B178@cable.comcast.com> <1FCF97D5-2A18-4CD2-9072-62D87F819CB0@nbcuni.com> <57B9E26F-C1C0-484C-B1B9-8DCDF14B7AD9@gmail.com> <20190808022756.F02A9163266B@fafnir.remote.dragon.net> In-Reply-To: <20190808022756.F02A9163266B@fafnir.remote.dragon.net> From: Rob Sayre Date: Wed, 7 Aug 2019 19:37:13 -0700 Message-ID: To: Paul Ebersman Cc: ADD Mailing list Content-Type: multipart/alternative; boundary="0000000000001aded5058f91f070" Archived-At: Subject: Re: [Add] [EXTERNAL] Control X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 Aug 2019 02:37:28 -0000 --0000000000001aded5058f91f070 Content-Type: text/plain; charset="UTF-8" On Wed, Aug 7, 2019 at 7:27 PM Paul Ebersman wrote: > bjordon> No solution is perfect, but this represents a layered defense > bjordon> that organizations rely on. > > sayrer> I think the point of Martin's presentation was that this is a > sayrer> poor decision, and will become increasingly poor. > > And you base this on what beyond your own personal opinion? That's what the slides say. One slide says "is an effective control surface", the next one crosses it out and says "was an effective control surface". Or, do you need more data on this? > Have you had > extensive experience supporting large enterprise security customers? > I have worked at them, and they do not rely on DNS. > Can we move on? > Firstly, this not a particularly polite way of telling someone to shut up. Secondly, move on to what? Some document that says "you MUST use the ISP DNS"? No thanks. thanks, Rob --0000000000001aded5058f91f070 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Wed, Aug 7, 2019 at 7:27 PM Paul E= bersman <list-add@dragon.net&= gt; wrote:
bjord= on> No solution is perfect, but this represents a layered defense
bjordon> that organizations rely on.

sayrer> I think the point of Martin's presentation was that this is = a
sayrer> poor decision, and will become increasingly poor.

And you base this on what beyond your own personal opinion?

That's what the slides say. One slide says "is a= n effective control surface", the next one crosses it out and says &qu= ot;was=C2=A0an effective control surface".

Or= , do you need more data on this?

=C2=A0
Have you had
extensive experience supporting large enterprise security customers?

I have worked at them, and they do not rely o= n DNS.
=C2=A0
Can we move on?

Firstly, this not a par= ticularly polite way of telling someone to shut up. Secondly, move on to wh= at? Some document that says "you MUST use the ISP DNS"? No thanks= .

thanks,
Rob
=C2=A0
--0000000000001aded5058f91f070-- From nobody Wed Aug 7 20:18:25 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B49A4120091 for ; Wed, 7 Aug 2019 20:18:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.996 X-Spam-Level: X-Spam-Status: No, score=-1.996 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Op_1_h_s1S_O for ; Wed, 7 Aug 2019 20:18:21 -0700 (PDT) Received: from mail-pf1-x432.google.com (mail-pf1-x432.google.com [IPv6:2607:f8b0:4864:20::432]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D04BA120033 for ; Wed, 7 Aug 2019 20:18:21 -0700 (PDT) Received: by mail-pf1-x432.google.com with SMTP id t16so43214902pfe.11 for ; Wed, 07 Aug 2019 20:18:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=z3KXzkRkE5yGIC/aEKTstvZ4vpawEnYzM/gU01x8k1I=; b=kNzJmsD3Fd6/buv9/AJCpUacscryFG9ZUmReoehTeA7rqvJSI9cELu+6uyE4KlvdJm UsZ0YU4iKwE4BKj5mPRm9amAXvW2IJpN2vL9eM5PP3KOLAMk0EpOqESD7egmJe43anKM RVHfM/cW77Xgtc1T3Vnt/3+J2O0wiEncr8uk2yQJUnNVMfCIT1Ju/AaeBVKQWc4sF0Ca bdRUMnY3PsGeBvyPEgTk3FXoUugFQa+ya6PV8hmmMgwCI0jkDQh0cOPFypNJYHZGiude TRduFnXczc2Q+Pak0SM3vnw3bH+Ga6asdJYAlPYWMBnbvg71Z6xXZ8SN6/UgN7BMGrsX 51Ow== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=z3KXzkRkE5yGIC/aEKTstvZ4vpawEnYzM/gU01x8k1I=; b=Htr0prKkRwOJzN43kkWv/igOkhN6HmlfvZ9lRDVFRGXkT3HSapxZgL6OXrb3nnuVu8 M2L66fBpAOMLHPSDOueFcfyNm7my5rpMUShsQ/9uycVkKS6dmEUCc2kA4mQS6Iekf6GH iGZknTty2/rwADDYkh8NAWJPngecWV3BXjjV/CZA49Tdp5z0IDvEwC6OIq58HAwoafRP 0ESYaNr2AnQVaVyr1XYC1IH4F5fgKlKsuGke/FdLQ0Xpa990MeG/lgM03MzNwUnRU6Wc 9y/RspH/7HI2A3rKHiqby3/SpGg2yjfFcaZCkBk6z+F6vYjaAguBieuWo5U8FmdmAiRm yF8Q== X-Gm-Message-State: APjAAAU+GIlxIir7vpWtb5a1SzYHjmuFyUS0gAKbYquOhV/iNpCIVhD7 Mok18pcoRO/oefx9UOICpXWL/0Sn X-Google-Smtp-Source: APXvYqy2x9feStlQAqPeq1RAyYMBqZYife6SltAEbytBIoZeipiDaRF84udina09Cc42z6o0oRZgfg== X-Received: by 2002:aa7:989a:: with SMTP id r26mr12451851pfl.232.1565234300984; Wed, 07 Aug 2019 20:18:20 -0700 (PDT) Received: from [10.128.64.169] ([136.60.227.81]) by smtp.gmail.com with ESMTPSA id n128sm47877038pfn.46.2019.08.07.20.18.20 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 07 Aug 2019 20:18:20 -0700 (PDT) Content-Type: multipart/alternative; boundary=Apple-Mail-C088DC69-4AC6-4F82-9D8A-93BFEE9878A6 Mime-Version: 1.0 (1.0) From: Bret Jordan X-Mailer: iPhone Mail (16G77) In-Reply-To: Date: Wed, 7 Aug 2019 21:18:19 -0600 Cc: Rob Sayre , "add@ietf.org" , Martin Thomson Content-Transfer-Encoding: 7bit Message-Id: <5A0C04E5-1F77-4EF5-BB61-B1C1FF739DF1@gmail.com> References: <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <2EF61DAB-8371-4257-82A0-8622A8F2B178@cable.comcast.com> <1FCF97D5-2A18-4CD2-9072-62D87F819CB0@nbcuni.com> <57B9E26F-C1C0-484C-B1B9-8DCDF14B7AD9@gmail.com> To: "Deen, Glenn (NBCUniversal)" Archived-At: Subject: Re: [Add] [EXTERNAL] Control X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 Aug 2019 03:18:24 -0000 --Apple-Mail-C088DC69-4AC6-4F82-9D8A-93BFEE9878A6 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable I agree fully with what Glenn has stated. For those that day DNS is not a g= ood control plan, where is your research and data to back that up?=20 Bret=20 Sent from my Commodore 128D PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 > On Aug 7, 2019, at 8:23 PM, Deen, Glenn (NBCUniversal) wrote: >=20 >=20 > Hi Rob, >=20 > On Aug 7, 2019, at 7:15 PM, Rob Sayre wrote: >=20 >> On Wed, Aug 7, 2019 at 6:35 PM Bret Jordan wrote:= >>> Well said Glenn. I completely agree. =20 >>>=20 >>> No solution is perfect, but this represents a layered defense that organ= izations rely on.=20 >>=20 >> I think the point of Martin's presentation was that this is a poor decisi= on, and will become increasingly poor. The presentation did acknowledge that= people made this decision--it's right there in the slides. So, saying that "= organizations rely on" this ineffective technique is not exactly a strong re= buttal. >=20 > I=E2=80=99m still very much missing the why and the supporting facts on th= is assertion. >>=20 >> This has come up once in this thread already, but the problem with the "d= efense in depth" argument is that it can be used to rationalize ineffective m= easures. >=20 > Again, where is the data to show they are ineffective?=20 >=20 > I get that there is a view that doesn=E2=80=99t like this approach, but I= also get that there are a heck of lot of people and organizations globally t= hat are quite satisfied with the results they currently get from these contr= ols. >=20 > . > . > . >=20 > I=E2=80=99m going to follow Stephen F=E2=80=99s example and self silence f= or a bit on this list. I=E2=80=99ve made my points heard and anything else w= ill be me repeating myself. >=20 > -Glenn=20 >=20 >=20 --Apple-Mail-C088DC69-4AC6-4F82-9D8A-93BFEE9878A6 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable I agree fully with what Glenn has stated. &= nbsp; For those that day DNS is not a good control plan, where is your resea= rch and data to back that up? 

Bret 

Sent from my Commodore 128D

PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 &n= bsp;F2C0 74F8 ACAE 7415 0050

On Aug 7, 2019, at 8:23 PM, Deen, Glenn (NBCUniversal) <Glenn.Deen@nbcuni.com> wrote:

=

Hi Rob,

On Aug 7, 2019, at 7:15 PM, Rob Sayre <sayrer@gmail.com> wrote:

On Wed, Aug 7, 2019 at 6:35 PM Bret Jordan <jordan.ietf@gmail.com> wrote:
Well said Glenn.  I completel= y agree.  

No solution is perfect, but this represents a layered defense that orga= nizations rely on. 

I think the point of Martin's presentation was that this is a poor decision,= and will become increasingly poor. The presentation did acknowledge that pe= ople made this decision--it's right there in the slides. So, saying that "or= ganizations rely on" this ineffective technique is not exactly a strong rebuttal.

I=E2=80=99m still very much missing the why and the supporting facts on this= assertion.

This has come up once in this thread already, but= the problem with the "defense in depth" argument is that it can be used to r= ationalize ineffective measures.

Again, where is the data to show they are ineffective? 

 I get that there is a view that doesn=E2=80=99t like this approac= h, but I also get that there are a heck of lot of people and organizations g= lobally that are quite satisfied with the results they currently get from th= ese controls.

.
.
.

I=E2=80=99m going to follow Stephen F=E2=80=99s  example and self s= ilence for a bit on this list. I=E2=80=99ve made my points heard and anythin= g else  will be me repeating myself.

-Glenn 


= --Apple-Mail-C088DC69-4AC6-4F82-9D8A-93BFEE9878A6-- From nobody Wed Aug 7 20:32:44 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4A35B120094 for ; Wed, 7 Aug 2019 20:32:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vcorUyiY6V5X for ; Wed, 7 Aug 2019 20:32:41 -0700 (PDT) Received: from mail-pf1-x42e.google.com (mail-pf1-x42e.google.com [IPv6:2607:f8b0:4864:20::42e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E528B120033 for ; Wed, 7 Aug 2019 20:32:40 -0700 (PDT) Received: by mail-pf1-x42e.google.com with SMTP id g2so43265644pfq.0 for ; Wed, 07 Aug 2019 20:32:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:content-transfer-encoding:mime-version:date:subject:message-id :to; bh=jmI/W2XDJK2X/xNemVe18Y3X3nUVvGYXDHyGJkS7mcg=; b=hrI/KcXRPQYP4qwMeC7YwWyBWDSgVFgCq+a/e6BeNo7zHTUc4iA2lCMlbpon0CYIX9 0aslZylR4/yiTsGMMg64JeDxGrAnHJaAUnGVIsYzRhbSUqwDfIg4IVsI7B+RBHq74+xv udl4Qhs06JteltH/n47dw7GG/7A57qxsDZxo/IGfHUoNAZ3bv9KwYtAmqHC3JoIdUqz8 UxC549RR4Ieuo6P3gFdCXMWM/2IPa25NpvizQv9CXnENyb784cvHwd80tsLaKAZWCftI Ikx3sDuQELWrMKicMQXQZMedIE2kQalEOmmYyzPyzR3nWAziy7Xs1kHYNAKk1E8Qcv3J /cEA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:content-transfer-encoding:mime-version:date :subject:message-id:to; bh=jmI/W2XDJK2X/xNemVe18Y3X3nUVvGYXDHyGJkS7mcg=; b=hrKsno1n5OCdfenQlHveDadEEsyxW0jlEWlr+FnfYUNQZqQX0M09LAv+/g2dHw8DkL smSyo+nsxNlIf0RrcW/59hQsereu+wLyWY3L1v6zjjUa2VkEMsPOkWAlatJCRG9wHuiy vgHy690sJKPUZadrl9Zu+vnJmAV4dpPNLNhlgMQd1uOU/upRBcPFL6Zn+Q+ZeufWIRSW DUjuKvHG4hzgHix37RDQ7wVrUUk2gqrOTEjRJl5V0SU1nHQhPeKDGsD1skKy3WP1s/RR pwDS/1X02xb5xnKRSJjPGIVfTDefao/qP0ct7HfUbum/Lh/AiGoP+ocWr1oFh/9ysVs3 jyRA== X-Gm-Message-State: APjAAAXEgDPZPF1eiIksIfiQTUmV5DQZ9+2XH4VM2ngO4F83vYee8UJP GeTn43G4WfESBtMXY1aopQGtL/yY X-Google-Smtp-Source: APXvYqykE9HqyLzqyWErpLF2uqH/KxfrEgHwbP6j7s7Y1SkVOk3B5u3RyA7u/xpUm3G2TRvdPRPHaA== X-Received: by 2002:a63:20a:: with SMTP id 10mr10576727pgc.226.1565235160093; Wed, 07 Aug 2019 20:32:40 -0700 (PDT) Received: from [10.128.64.169] ([136.60.227.81]) by smtp.gmail.com with ESMTPSA id f12sm77774884pgq.52.2019.08.07.20.32.38 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 07 Aug 2019 20:32:39 -0700 (PDT) From: Bret Jordan Content-Type: multipart/alternative; boundary=Apple-Mail-892548BC-5689-444F-BB24-D6F7CCF16862 Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (1.0) Date: Wed, 7 Aug 2019 21:32:38 -0600 Message-Id: To: add@ietf.org X-Mailer: iPhone Mail (16G77) Archived-At: Subject: [Add] New WG or new Area X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 Aug 2019 03:32:42 -0000 --Apple-Mail-892548BC-5689-444F-BB24-D6F7CCF16862 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable I would like to see either a consolidated WG for all DNS related work, or a n= ew Area just for for DNS.=20 Further I would move that Glenn and Barbara either by chairs of this new wor= king group or the ADs.=20 Bret=20 Sent from my Commodore 128D PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050= --Apple-Mail-892548BC-5689-444F-BB24-D6F7CCF16862 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable I would like to see either a consolidated W= G for all DNS related work, or a new Area just for for DNS. 

Further I would move that Glenn and Barbara either by chairs of thi= s new working group or the ADs. 

Bret 

Sent from my Commodore 128D
=
<= div>PGP Fingerprint: 63B4 FC53 680= A 6B7D 1447  F2C0 74F8 ACAE 7415 0050
<= /div>= --Apple-Mail-892548BC-5689-444F-BB24-D6F7CCF16862-- From nobody Wed Aug 7 21:36:23 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8A238120096 for ; Wed, 7 Aug 2019 21:36:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=hopcount.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fy1v3CZXV9GE for ; Wed, 7 Aug 2019 21:36:20 -0700 (PDT) Received: from mail-ot1-x329.google.com (mail-ot1-x329.google.com [IPv6:2607:f8b0:4864:20::329]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 53C0412000E for ; Wed, 7 Aug 2019 21:36:20 -0700 (PDT) Received: by mail-ot1-x329.google.com with SMTP id n5so113541382otk.1 for ; Wed, 07 Aug 2019 21:36:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hopcount.ca; s=google; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=bQ7giyKxHqKiANLi2RQhkzambg4u9f0Ha4qQYcPeLLA=; b=Ks3Q0Jd5J4QaFMDw1Ct3rS+Qh3cxUl9xrR4E8kvikwQW7w2whSWEljxbfHJUh9gM37 vUf9bKT4yV7EHhLLn9LhY/6U+4nS5a2F58Urne1JtbfWDtvNjYr+giEZj3e0GKsHiIY2 m+YqzBRsPJXlZyctAsGPodlZlxnx++zohtiFE= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=bQ7giyKxHqKiANLi2RQhkzambg4u9f0Ha4qQYcPeLLA=; b=mSYrceYE5vuSGQchh3Epb+qGWUQnZpZNHFG7gh5vXSglXw4CHLKsz4tzMC7BIm6OZ3 Anbi5LO7Amt7nZ0UkMv3V6J7clXC/KWUM7gCyFgX21s+nCXK3k642GFPNFFV2xan9YGr x6jSNlB4esbgpZG8TpzJ9d0XQJTuuHTGRRGxi3OGsKZPeePTQxwlMh6QB4s73wqEV7kJ WDp6QsoAayn2dhvhUQQa36ZBKGygt5HYMpwDzwi8QMnt3rRSDNgPUmK2/C0ahpZNZjBa DIP9hDxEDzz8r02tGS+wyXsx/W0IeIuBoPZZmYsNznIRTV1YqjYcQfi7flMfLQrjjO49 hsNw== X-Gm-Message-State: APjAAAVMWHTl29FFZ/cISAV2ITIPttPpCynK0+6FGXQotm5X8RF3wjFh TDQjCIFPbjWzQPjEyB4OVkH3nfdIcMzbk5k2 X-Google-Smtp-Source: APXvYqwnjivc3EPZGbgPqWjXjbHD6qulzF2PZf5WyoXtOs7YercC+xcnN9y/2xyV6yv1cgEfxVhlJQ== X-Received: by 2002:a6b:3b03:: with SMTP id i3mr13005314ioa.302.1565238979159; Wed, 07 Aug 2019 21:36:19 -0700 (PDT) Received: from [192.168.1.69] (24-246-23-138.cable.teksavvy.com. [24.246.23.138]) by smtp.gmail.com with ESMTPSA id a8sm67617720ioh.29.2019.08.07.21.36.17 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 07 Aug 2019 21:36:17 -0700 (PDT) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (1.0) From: Joe Abley X-Mailer: iPad Mail (16G77) In-Reply-To: Date: Thu, 8 Aug 2019 00:36:16 -0400 Cc: add@ietf.org Content-Transfer-Encoding: quoted-printable Message-Id: <6474D9D5-4AD0-4A98-8926-F38600F9D8AE@hopcount.ca> References: To: Bret Jordan Archived-At: Subject: Re: [Add] New WG or new Area X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 Aug 2019 04:36:21 -0000 Hi Bret, On Aug 7, 2019, at 23:32, Bret Jordan wrote: > I would like to see either a consolidated WG for all DNS related work, or a= new Area just for for DNS.=20 Can you explain why? Joe= From nobody Wed Aug 7 21:39:55 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0005D12009C for ; Wed, 7 Aug 2019 21:39:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3yslbIlTGfFX for ; Wed, 7 Aug 2019 21:39:52 -0700 (PDT) Received: from mail-ot1-x32e.google.com (mail-ot1-x32e.google.com [IPv6:2607:f8b0:4864:20::32e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9310A12000E for ; Wed, 7 Aug 2019 21:39:52 -0700 (PDT) Received: by mail-ot1-x32e.google.com with SMTP id o101so113472158ota.8 for ; Wed, 07 Aug 2019 21:39:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=DY2lL+wg5ejOXAupcERuVK8debPzNc4IYBi8+hWAUnM=; b=WIMkRqzpOO0jo1ODRfzGTThuM19QMhJsgcDXcPGiWHwICRkHjJSQiMOl/6oucUY7NX LFeMGSnBZKNh2I8IXAMZDsydMjWtsMYbrnVBATDDFj9WaHhpyl+gb0UTLc56bUIEYk0l kjcRid2tD6aIQr1yjQ8AlIWaUne/2m0eTEnQ16gQ8WtZ2/381cZYDhDrmXqSRgTP3ip+ kkguRnGPLzTcTYUpsHwQAC8XkxrLb5xJD2UahYmao3KCy1VrXumingrB93MoBjjAlTHY dLsaBahhK0ozGjJmnH6Rt4fbcYJNwNTCTSDsQFtzn8u3Tlt+0YJjHY9kwU7nvx4r85Mb GdhQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=DY2lL+wg5ejOXAupcERuVK8debPzNc4IYBi8+hWAUnM=; b=nxr6eVnzA+G9UF6EkS1OFXwiGqc4o6vUf2Yoi6w6z78O7hlKCOGKSqZ5p9t4MJN8q5 Y/UfwFN0eJ4ZnJPX5Cj7hfNyKxTSWiR1wbdwHNe6z1l9u7O9jp9eHmET2J4TQOvE0t6k pmkWcBVryhCoO5o82ysPR+jialFQ0syHBJHvjQLEiU0bjCxF/tZbSAOfGktO+a4TYnv2 go4rDY49SSBi8uRStiPodkXyd+T4bPGLDEKTWui3yBOGxBi04VPcZgLXEFnHfPx2Qykp GtAsu3AR33HDkW45b6+GE6bQv/svJZGZXtMoh94xvEKSK/IFT3KcyrqjYxUsUBmBeHpb Yi0A== X-Gm-Message-State: APjAAAULpmJCw0CIjmxF/RRNeDZbyiNlovgyQTfw6f5Hc9m2Nqv+c+3R s5GlLuEO82K8TMT2ss1n38Tw5Lvo1MQ+4SbVrOliQD8+tLg= X-Google-Smtp-Source: APXvYqw5Eqik70CKSWDUH+Qbk0BToaE16bMDTy7VnvN9afqsYMUd+UX5V4PxPsLO0Vmmk82Jpeg8aFb407zsHEp+gy4= X-Received: by 2002:a6b:bc42:: with SMTP id m63mr12543427iof.189.1565239191867; Wed, 07 Aug 2019 21:39:51 -0700 (PDT) MIME-Version: 1.0 References: <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <2EF61DAB-8371-4257-82A0-8622A8F2B178@cable.comcast.com> <1FCF97D5-2A18-4CD2-9072-62D87F819CB0@nbcuni.com> <57B9E26F-C1C0-484C-B1B9-8DCDF14B7AD9@gmail.com> In-Reply-To: From: Rob Sayre Date: Wed, 7 Aug 2019 21:39:40 -0700 Message-ID: To: "Deen, Glenn (NBCUniversal)" Cc: Bret Jordan , "add@ietf.org" , Martin Thomson Content-Type: multipart/alternative; boundary="000000000000051618058f93a693" Archived-At: Subject: Re: [Add] [EXTERNAL] Control X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 Aug 2019 04:39:54 -0000 --000000000000051618058f93a693 Content-Type: text/plain; charset="UTF-8" On Wed, Aug 7, 2019 at 7:23 PM Deen, Glenn (NBCUniversal) < Glenn.Deen@nbcuni.com> wrote: > This has come up once in this thread already, but the problem with the > "defense in depth" argument is that it can be used to rationalize > ineffective measures. > > > Again, where is the data to show they are ineffective? > I'm not sure the burden of proof should be on me. The arguments I hear basically amount to "well, people made a decision to use DNS for these purposes". But every time I look at a claim, I find other solutions that do the job much better. Parental controls: see Apple or Microsoft. Enterprise: see all of the various management tools that root the OS and all browsers. Malware: OS and browser security. Access control: people just use VPNs--they are high-grossing apps. So, there's your data. Perhaps we should shift the burden of proof to the DNS policy fans. What's so great about using DNS for any of these purposes? thanks, Rob --000000000000051618058f93a693 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Wed, Aug 7, 2019 at 7:23 PM Deen, Glen= n (NBCUniversal) <Glenn.Deen@nb= cuni.com> wrote:
This has come up once in this thread already, bu= t the problem with the "defense in depth" argument is that it can= be used to rationalize ineffective measures.

Again, where is the data to show they are ineffective?=C2=A0

I'm not sure the burden of proof sho= uld be on me.

The arguments I hear basically amoun= t to "well, people made a decision to use DNS for these purposes"= . But every time I look at a claim, I find other solutions that do the job = much better. Parental controls: see Apple or Microsoft. Enterprise: see all= of the various management tools that root the OS and all browsers. Malware= : OS and browser security. Access control: people just use VPNs--they are h= igh-grossing apps. So, there's your data.

Perh= aps we should shift the burden of proof to the DNS policy fans. What's = so great about using DNS for any of these purposes?

thanks,
Rob
=C2=A0
--000000000000051618058f93a693-- From nobody Wed Aug 7 21:56:55 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 28E07120096 for ; Wed, 7 Aug 2019 21:56:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=hopcount.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cCd_66ZAYC1z for ; Wed, 7 Aug 2019 21:56:53 -0700 (PDT) Received: from mail-ot1-x32f.google.com (mail-ot1-x32f.google.com [IPv6:2607:f8b0:4864:20::32f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D8EA112000E for ; Wed, 7 Aug 2019 21:56:52 -0700 (PDT) Received: by mail-ot1-x32f.google.com with SMTP id r6so113560156oti.3 for ; Wed, 07 Aug 2019 21:56:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hopcount.ca; s=google; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=BJOEjhcKRvNSoYlSloszrs6F4TeLCIwiOyw4FiJeJrI=; b=E1P/6b6yDuT+9WJDft4PeACjmqlo/IRsyARzdMmTSy1WyTu8T0tatA0XkZ9zxFg/qD QVQSbf3stsspwE5TFtw6yr2udZU8ymg+/E0v8fAcI7TRwiXojhaMwMRWt+yWojXjrnJB imoVVDdTmL7ffhj2EOEXF95uCCFEjkw/4poJc= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=BJOEjhcKRvNSoYlSloszrs6F4TeLCIwiOyw4FiJeJrI=; b=Di4iivY4YrqLCAnQcdUexxZAHRTyt+Ukxp1rGH+Pgfg8FqJ9Kq7v+NjUeZ/C9nkUZO MZSVub7EQuW1mvqSBl9zfCabjU2Ky5Zxqf4owG8LZsZZoqBJXaiNPggmDp8xZHrdkBt3 iEk+/3YkA/vNzNlgznzscCnCjhyJALH10a0ufcH3bS3kxz7PeQ7cqQKVyTZbYdGCewnq bp2D5k+xbaXRW0lstN2EI7UGAcRslPGn+Uak7uft72lQkrtlnGScRWvCiwqehlj0nwN+ b5kkQLoA1jD88galy9P7gtUbEDNkePb/YHKQiiBWKS1BAOBXzl+Ogf1GdIthg6BhJp5v hPyA== X-Gm-Message-State: APjAAAXxD3FaFGDfZLBc293M00TbOVtfiaosVcS4YRAMb8RIxYJX0jtS OxHpr8djkfzyJX97yNBYiytbDI2feFLv4G3R X-Google-Smtp-Source: APXvYqxRHeOrA/zjJnW96eoxD/n907q3rLKzUh9yC8CWy/F1v6AYhFW7/xJ4m14QWjChkXDQxwtWiQ== X-Received: by 2002:a02:cc6c:: with SMTP id j12mr14134572jaq.102.1565240211604; Wed, 07 Aug 2019 21:56:51 -0700 (PDT) Received: from [192.168.1.69] (24-246-23-138.cable.teksavvy.com. [24.246.23.138]) by smtp.gmail.com with ESMTPSA id o3sm93640ioo.74.2019.08.07.21.56.50 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 07 Aug 2019 21:56:50 -0700 (PDT) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (1.0) From: Joe Abley X-Mailer: iPad Mail (16G77) In-Reply-To: Date: Thu, 8 Aug 2019 00:56:49 -0400 Cc: add@ietf.org, "Livingood, Jason" Content-Transfer-Encoding: quoted-printable Message-Id: <848E4388-BDD3-4B36-838D-15703AAFE543@hopcount.ca> References: <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <2EF61DAB-8371-4257-82A0-8622A8F2B178@cable.comcast.com> To: Martin Thomson Archived-At: Subject: Re: [Add] Control X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 Aug 2019 04:56:54 -0000 Hi Martin, On Aug 7, 2019, at 20:27, Martin Thomson wrote: > There are three questions bound up in this, each that bears examination: >=20 > 1. Is DNS an effective control surface? >=20 > 2. Should DNS be an effective tool for control? ...and for what? >=20 > 3. Why would someone want to use DNS to exert control? Why are these useful questions, given the (surely indisputable) knowledge th= at DNS is widely used as a control plane today, and that many organisations a= nd end-users spend non-trivial amounts of time and money to do so? Is there a benefit I'm not seeing to returning to architectural first princi= ples and ignoring actual deployed infrastructure? If so, we should also thro= w out BGP which is frankly quite the dog's breakfast. Joe= From nobody Wed Aug 7 22:02:37 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B69A6120096 for ; Wed, 7 Aug 2019 22:02:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.299 X-Spam-Level: X-Spam-Status: No, score=-4.299 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=swm.pp.se Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2JvCkIQUKXOb for ; Wed, 7 Aug 2019 22:02:33 -0700 (PDT) Received: from uplift.swm.pp.se (swm.pp.se [212.247.200.143]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 21ACE12000E for ; Wed, 7 Aug 2019 22:02:33 -0700 (PDT) Received: by uplift.swm.pp.se (Postfix, from userid 501) id 86EFDB4; Thu, 8 Aug 2019 07:02:30 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=swm.pp.se; s=mail; t=1565240550; bh=GKE9yKsxLUEjKYrBwopgsWOggLa5Er4ER5A7i0tFksI=; h=Date:From:To:cc:Subject:In-Reply-To:References:From; b=4OQeZWmDlV1U34+KLFpSuTx49S2CQ+st+LV/NZsPR21KsHHkEbLYj+YQbXseeyxfq oqyIyRsZkPgVTzUtAmzJzFzaMgkalgfAps++aYeHcrdq/PdFZwJrwYvvVbar+sMk5l oddbW3qityTrDM/OHPXHV2rXkUy6vhhkWHzl1gOc= Received: from localhost (localhost [127.0.0.1]) by uplift.swm.pp.se (Postfix) with ESMTP id 843ECB1; Thu, 8 Aug 2019 07:02:30 +0200 (CEST) Date: Thu, 8 Aug 2019 07:02:30 +0200 (CEST) From: Mikael Abrahamsson To: Rob Sayre cc: "Deen, Glenn (NBCUniversal)" , "add@ietf.org" , Martin Thomson , Bret Jordan In-Reply-To: Message-ID: References: <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <2EF61DAB-8371-4257-82A0-8622A8F2B178@cable.comcast.com> <1FCF97D5-2A18-4CD2-9072-62D87F819CB0@nbcuni.com> <57B9E26F-C1C0-484C-B1B9-8DCDF14B7AD9@gmail.com> User-Agent: Alpine 2.20 (DEB 67 2015-01-07) Organization: People's Front Against WWW MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII; format=flowed Archived-At: Subject: Re: [Add] [EXTERNAL] Control X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 Aug 2019 05:02:36 -0000 On Wed, 7 Aug 2019, Rob Sayre wrote: > Perhaps we should shift the burden of proof to the DNS policy fans. > What's so great about using DNS for any of these purposes? It keeps the regulator happy. Do not make the regulator angry. Bad things happen then. A lot worse than we have today. See Ralf Webers email from yesterday. DNS based blocking is deemed "good enough" by regulator today. They want blocking or policy implemented. If DNS stops being "good enough", they will demand more intrusive measures to make things work. https://www.engadget.com/2019/07/31/how-ag-barr-is-going-to-get-encryption-backdoors/ https://www.techradar.com/news/uk-porn-block-everything-you-need-to-know https://www.telenor.com/media/press-release/telenor-introduces-child-pornography-filter-in-sweden Better give them a blunt tool that kind of works and is not super intrusive, than the alternative. If browser vendors change the default to DoH via some quad-X without the agreed policies between industry and regulator, the regulator (and other bodies) will wake up in a lot of countries. Some already have. I'd prefer not to get regulators involved and solve this as an industry. Things typically get very complicated when regulators and politicians get involved. -- Mikael Abrahamsson email: swmike@swm.pp.se From nobody Wed Aug 7 22:26:15 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0FF0212009C for ; Wed, 7 Aug 2019 22:26:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4bLxNcp0iGMX for ; Wed, 7 Aug 2019 22:26:12 -0700 (PDT) Received: from mail-lj1-x231.google.com (mail-lj1-x231.google.com [IPv6:2a00:1450:4864:20::231]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DCBCD12000E for ; Wed, 7 Aug 2019 22:26:11 -0700 (PDT) Received: by mail-lj1-x231.google.com with SMTP id k18so87621105ljc.11 for ; Wed, 07 Aug 2019 22:26:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=CuYGyA4s//9R2zU3//26eEwpFVtj9x29A4vbRPv2Mmo=; b=t8HFba4TYtZdPM78jFGSzb3P9jdhsPHofXsh4wKRJ5I4yZvPjN//X/J2GNXU+I5Q/k cOXIsIFQKyoQgp38H3o8/RmII0IATu0q22S9pIkYuJGRzdc5BRYF826mPeS98+6jdog5 jGs8CclTJt2784tI2mzWzfbqHQGVuJAarKAZWw0V9lpi6L771CuuEgz/l9pYTYj1AaTH LkZkpMhzicWGbb15SE/n/mxoTzdllAXU3uUx9A2tWaEtNsZEBXn6huWS0b/V3RiCjkif aJrjHzXOinCVC3AJ8drxl+AHTSciTok6kLELByDPTov6S6fXqXiTWCjFcmbE8NyQQ8zj cH+w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=CuYGyA4s//9R2zU3//26eEwpFVtj9x29A4vbRPv2Mmo=; b=kPXUtZT1B0GFkU/4zK8zlIiKz0MDdLDL6BgJpGLmF/LLUihW1bx2yW3FQ2h+2Z1enT GK0TmM6adbSTVZDfmdOi88E42FG4K4mibpxCJQegBrmyttpYHd6ydsR3ooaKVTBnEect ccDApLmDlol+DqRrmooqJ23kHIGad/9MrmsWvi9cEQpU+rgiJFZbgnZdPbq8TZdiethq ZPhzHdxZfjN35ZFdyeixBhvmkAUOD1bdjXffPqZG9+ZGhBb+SCN43KnBM1iMT5migI0l sxVYvQGDz4rhHmpPAkqUL4Kpn8oxn3TJgjXkUUFIorrR7bKpIY7dFvtPFmjFPYgCtsfx URtg== X-Gm-Message-State: APjAAAXMnECI9ix28/enrL2+IU2suB2P5YCyzzBaq8vVuGo8xAwOIS7x vaIAGr3eI/T3Kt7OEly/3T+aXbQCWG+cLqmt5O1eNg== X-Google-Smtp-Source: APXvYqz6UivD8X2krV4Hxa5ToW4befjuXvTC1gRi6LRdypz0KpzOalmD206/4SgtOhFmESgOsNgntVepwPaBZrxWBP8= X-Received: by 2002:a2e:9cd4:: with SMTP id g20mr6459754ljj.205.1565241970191; Wed, 07 Aug 2019 22:26:10 -0700 (PDT) MIME-Version: 1.0 References: <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <2EF61DAB-8371-4257-82A0-8622A8F2B178@cable.comcast.com> <1FCF97D5-2A18-4CD2-9072-62D87F819CB0@nbcuni.com> <57B9E26F-C1C0-484C-B1B9-8DCDF14B7AD9@gmail.com> In-Reply-To: From: Eric Rescorla Date: Wed, 7 Aug 2019 22:25:32 -0700 Message-ID: To: "Deen, Glenn (NBCUniversal)" Cc: Rob Sayre , "add@ietf.org" , Martin Thomson , Bret Jordan Content-Type: multipart/alternative; boundary="0000000000009f0369058f944bc7" Archived-At: Subject: Re: [Add] [EXTERNAL] Control X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 Aug 2019 05:26:14 -0000 --0000000000009f0369058f944bc7 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Wed, Aug 7, 2019 at 7:23 PM Deen, Glenn (NBCUniversal) < Glenn.Deen@nbcuni.com> wrote: > > Hi Rob, > > On Aug 7, 2019, at 7:15 PM, Rob Sayre wrote: > > On Wed, Aug 7, 2019 at 6:35 PM Bret Jordan wrote: > >> Well said Glenn. I completely agree. >> >> No solution is perfect, but this represents a layered defense that >> organizations rely on. >> > > I think the point of Martin's presentation was that this is a poor > decision, and will become increasingly poor. The presentation did > acknowledge that people made this decision--it's right there in the slide= s. > So, saying that "organizations rely on" this ineffective technique is not > exactly a strong rebuttal. > > > I=E2=80=99m still very much missing the why and the supporting facts on t= his > assertion. > > > This has come up once in this thread already, but the problem with the > "defense in depth" argument is that it can be used to rationalize > ineffective measures. > > > Again, where is the data to show they are ineffective? > Isn't the entire premise of this conversation that people who use this technique are unhappy that DoH allows people to evade it? -Ekr > I get that there is a view that doesn=E2=80=99t like this approach, but = I also > get that there are a heck of lot of people and organizations globally tha= t > are quite satisfied with the results they currently get from these contro= ls. > > . > . > . > > I=E2=80=99m going to follow Stephen F=E2=80=99s example and self silence= for a bit on > this list. I=E2=80=99ve made my points heard and anything else will be m= e > repeating myself. > > -Glenn > > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --0000000000009f0369058f944bc7 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Wed, Aug 7, 2019 at 7:23 PM Deen, = Glenn (NBCUniversal) <Glenn.Dee= n@nbcuni.com> wrote:

Hi Rob,

On Aug 7, 2019, at 7:15 PM, Rob Sayre <sayrer@gmail.com> wrote:

On Wed, Aug 7, 2019 at 6:35 PM Bret Jordan <jordan.ietf@gmail.com&g= t; wrote:
Well said Glenn.=C2=A0 I completely agree. =C2=A0

No solution is perfect, but this represents a layered defense that org= anizations rely on.=C2=A0

I think the point of Martin's presentation was that this is a poor deci= sion, and will become increasingly poor. The presentation did acknowledge t= hat people made this decision--it's right there in the slides. So, sayi= ng that "organizations rely on" this=C2=A0ineffective technique is not exactly a strong rebuttal.

I=E2=80=99m still very much missing the why and the supporting facts on thi= s assertion.

This has come up once in this thread already, bu= t the problem with the "defense in depth" argument is that it can= be used to rationalize ineffective measures.

Again, where is the data to show they are ineffective?=C2=A0

Isn't the entire premise of this con= versation that people who use this technique are unhappy that DoH allows pe= ople to evade it?

-Ekr


=C2=A0I get that there is a view that doesn=E2=80=99t like this approa= ch, but I also get that there are a heck of lot of people and organizations= globally that are quite satisfied with the results they currently get from= these controls.

.
.
.

I=E2=80=99m going to follow Stephen F=E2=80=99s =C2=A0example and self= silence for a bit on this list. I=E2=80=99ve made my points heard and anyt= hing else =C2=A0will be me repeating myself.

-Glenn=C2=A0


--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--0000000000009f0369058f944bc7-- From nobody Wed Aug 7 23:01:02 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D5F96120100 for ; Wed, 7 Aug 2019 22:58:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.996 X-Spam-Level: X-Spam-Status: No, score=-1.996 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZnWL7LJOUFT4 for ; Wed, 7 Aug 2019 22:58:49 -0700 (PDT) Received: from mail-pl1-x633.google.com (mail-pl1-x633.google.com [IPv6:2607:f8b0:4864:20::633]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 44DDC1200DF for ; Wed, 7 Aug 2019 22:58:49 -0700 (PDT) Received: by mail-pl1-x633.google.com with SMTP id k8so43068063plt.3 for ; Wed, 07 Aug 2019 22:58:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=SOLOU+bdE8PZIvKcnLKIfL3cvqsLdR7MZ0Q8lP0By6I=; b=pD1aem8Z17ZbivOGF6qMJyTRIGKr7lNGjf2IDWECWDF18lIHJGSWXw/mr8MamcNOqm y+JjvRDQKkXsq5XrHGYEFURcNHbZkkza8VxXRSRI90Y4WDyFKOpGIBNqqGlTwAL4rcrf MIdpmvIgF1miAQ8AhErndvYhSbZHxqo47ozBjJ5YgUz7hs1MsGWDDpuvAC8DuX0lUBkc D14gyBiRFe3pW5QCh9fmuryW1/Oz4hxx9Y0h0ciI4BvDNZnKbXs6JCHFOyJSX/vI7SDx UnGE/z7mjFqB1X8rWpjZJ+Yj2QaSdHha3Ws6X+couBSqiz/R02B+9lxzD0am6mCFj+Y2 uD6w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=SOLOU+bdE8PZIvKcnLKIfL3cvqsLdR7MZ0Q8lP0By6I=; b=CCl9SJ9icPsqSPH1D5AAH1rbiz4acDI9Qh+S9OEDhwxyI4qs1yTERgOYgzkzXcw7kX 98B3TtY7EVTiJ8hBqGLpSJfmajJqFIaFA7sHXld7qEyalji6RtY7oHIO7aiEuKRSBEN+ Tkd0pcr5VsRj1vPgYYdyWsvCLeViDdjKNGxjFvtFb5iEuli990rHmsrdzfPAzc3JrKtS R2ssaKmN2xwCBbd3CpaOl0W73Ig2SL5XwF4slGDNnus9ny49yyExfn/tJqmicEHp4n44 tA1RZt5LwtW5+EUOz1TIMcovLH2I9+YghWg/b0vh6emdoMvUlSToTI53A+1QHPOmRavJ bsgg== X-Gm-Message-State: APjAAAWIXJ3SaVFc64YBF6+oxd8ElDekk0EIzY6iole0O8cXXgmCStri udeKNgPstqfeTC11UzGn6MU= X-Google-Smtp-Source: APXvYqyRTcIZQqd+QfwQcOyohO8c7v3NxpFw71qdZfbTgKFEFYNklJB3gvGf0hJ+29Au03ZLHLaa4g== X-Received: by 2002:a17:902:9b94:: with SMTP id y20mr11903604plp.260.1565243928707; Wed, 07 Aug 2019 22:58:48 -0700 (PDT) Received: from ?IPv6:2601:646:8881:1fb4:ecbd:7f0:cf55:a816? ([2601:646:8881:1fb4:ecbd:7f0:cf55:a816]) by smtp.gmail.com with ESMTPSA id w197sm117693640pfd.41.2019.08.07.22.58.47 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 07 Aug 2019 22:58:47 -0700 (PDT) Content-Type: multipart/alternative; boundary=Apple-Mail-866D7C53-CC73-4C09-AB03-6CA60E045A29 Mime-Version: 1.0 (1.0) From: Brian Dickson X-Mailer: iPhone Mail (16F203) In-Reply-To: <8A76AFC2-6045-4689-A022-092C603E5670@fugue.com> Date: Wed, 7 Aug 2019 22:58:46 -0700 Cc: "Deen, Glenn (NBCUniversal)" , ADD Mailing list , Adam Roach Content-Transfer-Encoding: 7bit Message-Id: <3A7B9F8A-CABC-493D-80DE-31C5A1DFC9E3@gmail.com> References: <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <841102D9-4B50-4415-8193-FF3766F91958@gmail.com> <576BC95C-7F00-45C9-9A43-BC184147E8DE@nbcuni.com> <008F7E11-756C-4AD3-8A2A-EEDFF8EB39C1@fugue.com> <8A76AFC2-6045-4689-A022-092C603E5670@fugue.com> To: Ted Lemon Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 Aug 2019 05:58:52 -0000 --Apple-Mail-866D7C53-CC73-4C09-AB03-6CA60E045A29 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Sent from my iPhone > On Aug 7, 2019, at 7:13 PM, Ted Lemon wrote: >=20 > I am fairly sure that we all understand that DoH quite effectively prevent= s us from using DNS as a control plane. What this means is that you can no l= onger use DNS as a control plane. That is a fact of your life now. >=20 > What I=E2=80=99m asking is not =E2=80=9Cis there a problem that=E2=80=99s g= oing to cause you some heartburn?=E2=80=9D There definitely is, and you ha= ve my sympathy. What I=E2=80=99m asking is, =E2=80=9Cwhat can the IETF do t= o help you with this problem.=E2=80=9D I think the answer is =E2=80=9Cnoth= ing.=E2=80=9D What I think the IETF can do is document this, so it is quite explicit and c= rystal clear. > DoH quite effectively prevents us from using DNS as a control plane. This sums it up. >=20 > If you think the answer is something other than nothing, can you please st= ate explicitly what you think the answer is? Do you think the IETF can tel= l Google and Cloudflare to stop offering DoH, for example? Or do you want u= s to write a document explaining how to block port 443 on public DoH resolve= rs? The problem isn=E2=80=99t entirely the public resolvers, although DoH using t= hem does cause some breakage in some enterprise environments. The bigger pro= blem is that any server can stand up DoH, including malicious DoH servers re= sponding with forged responses. The IETF could mandate (as in, mandatory to implement) client DNSSEC validat= ion. That would go a long way to mitigation of the malicious server problem.= >=20 > Combating malware is a moving target. DNS was a great tool for doing tha= t, and it probably still is. But the way it=E2=80=99s going to be used to d= o that has shifted in the past few years. Most of the work on mitigating a= ttacks using DNS has been done outside of the IETF, and I suspect that will c= ontinue to be the case. The relationships between entities that do this wo= rk will have to change, and will have to account for the privacy promises ma= de by DoH operators. =20 I=E2=80=99m not sure I=E2=80=99d classify those entities as DoH operators. Y= es, they make DNS available via DoH, but also do so via DoT, as well as Do53= . I=E2=80=99d prefer to call them public resolvers over encrypted transports. > There is definitely work to do here. But it=E2=80=99s not work that can b= e done in the IETF. The IETF can=E2=80=99t turn back the clock, any more t= han we could have prevented it ticking forward. I think there are lots of things that can be done in various venues, with di= fferent impact and perceptions.=20 Currently the DoH bus is being driven by the browser folks. The perception f= rom the outside is that DoH was atypical in how it went through the IETF pro= cess, and not enough attention was given to these issues before 8484 was pub= lished, IMNSHO. Any re-bottling would have to be driven by the browser folks. If, and it is a= n enormous if, they decide to abandon DoH, there would be no residual need f= or the quad X folks to serve DoH, since DoT meets all the privacy needs for D= NS. The IETF can=E2=80=99t turn back the clock, but the browsers can. The IETF should provide guidance to enterprise networks on the new issues th= at DoH has created, so the they can develop responses on an expedited basis.= IMHO, the IETF has to own DoH, which means it needs to provide this advice b= efore the browsers turn on DoH by default. Brian= --Apple-Mail-866D7C53-CC73-4C09-AB03-6CA60E045A29 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable

Sent from my iPhone

On Aug 7, 2019, at 7:13 P= M, Ted Lemon <mellon@fugue.com>= ; wrote:

I am fairly su= re that we all understand that DoH quite effectively prevents us from using D= NS as a control plane.  What this means is that you can no longer use D= NS as a control plane.   That is a fact of your life now.

What I=E2=80=99m aski= ng is not =E2=80=9Cis there a problem that=E2=80=99s going to cause you some= heartburn?=E2=80=9D   There definitely is, and you have my sympathy. &= nbsp; What I=E2=80=99m asking is, =E2=80=9Cwhat can the IETF do to help you with this problem.=E2=80=9D   I think the answer= is =E2=80=9Cnothing.=E2=80=9D

=
What I think the IETF can do is document this, so it is quite explicit a= nd crystal clear.

DoH quite effectively prevents us from using DNS a= s a control plane.

This sums it up.=


If you think the answer is som= ething other than nothing, can you please state explicitly what you think th= e answer is?   Do you think the IETF can tell Google and Cloudflare to s= top offering DoH, for example?   Or do you want us to write a document e= xplaining how to block port 443 on public DoH resolvers?

The problem isn=E2=80=99t entirely the public= resolvers, although DoH using them does cause some breakage in some enterpr= ise environments. The bigger problem is that any server can stand up DoH, in= cluding malicious DoH servers responding with forged responses.
The IETF could mandate (as in, mandatory to implement) client D= NSSEC validation. That would go a long way to mitigation of the malicious se= rver problem.


Combating malware is a moving tar= get.   DNS was a great tool for doing that, and it probably still is. &= nbsp; But the way it=E2=80=99s going to be used to do that has shifted in th= e past few years.   Most of the work on mitigating attacks using DNS ha= s been done outside of the IETF, and I suspect that will continue to be the c= ase.   The relationships between entities that do this work will have t= o change, and will have to account for the privacy promises made by DoH oper= ators.  

I=E2=80=99m not s= ure I=E2=80=99d classify those entities as DoH operators. Yes, they make DNS= available via DoH, but also do so via DoT, as well as Do53.

<= /div>
I=E2=80=99d prefer to call them public resolvers over encrypted tr= ansports.


There is definitely work to do here.   But it=E2=80=99= s not work that can be done in the IETF.   The IETF can=E2=80=99t turn b= ack the clock, any more than we could have prevented it ticking forward.

I think there are lots of things that can be d= one in various venues, with different impact and perceptions. 

Currently the DoH bus is being driven by the browser folks.= The perception from the outside is that DoH was atypical in how it went thr= ough the IETF process, and not enough attention was given to these issues be= fore 8484 was published, IMNSHO.

Any re-bottling wo= uld have to be driven by the browser folks. If, and it is an enormous if, th= ey decide to abandon DoH, there would be no residual need for the quad X fol= ks to serve DoH, since DoT meets all the privacy needs for DNS. The IETF can= =E2=80=99t turn back the clock, but the browsers can.

The IETF should provide guidance to enterprise networks on the new issues= that DoH has created, so the they can develop responses on an expedited bas= is.

IMHO, the IETF has to own DoH, which means it n= eeds to provide this advice before the browsers turn on DoH by defaul= t.

Brian
= --Apple-Mail-866D7C53-CC73-4C09-AB03-6CA60E045A29-- From nobody Wed Aug 7 23:02:17 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9CFFD1200CC for ; Wed, 7 Aug 2019 23:02:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.98 X-Spam-Level: X-Spam-Status: No, score=-1.98 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, T_SPF_HELO_PERMERROR=0.01, T_SPF_PERMERROR=0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nostrum.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lccPYaTnFx9f for ; Wed, 7 Aug 2019 23:02:13 -0700 (PDT) Received: from nostrum.com (raven-v6.nostrum.com [IPv6:2001:470:d:1130::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7E0E51200B9 for ; Wed, 7 Aug 2019 23:02:13 -0700 (PDT) Received: from Orochi.local (c-24-9-76-58.hsd1.co.comcast.net [24.9.76.58]) (authenticated bits=0) by nostrum.com (8.15.2/8.15.2) with ESMTPSA id x7862B7r081057 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NO); Thu, 8 Aug 2019 01:02:12 -0500 (CDT) (envelope-from adam@nostrum.com) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=nostrum.com; s=default; t=1565244133; bh=hjbCGT96Uwd9KPRwqwt+9PFNmD29px9O1SBXnTQd8KE=; h=Subject:To:Cc:References:From:Date:In-Reply-To; b=HF268SKm//rX0ydpJG02P4Rhv/uINLhWcQVaE/gktlIJlB8qKtcO2bUzibceghrgi hQM69dCapGAUkOy8gQGEGwDAKlNn0faxvSuGsrvqXvW09V8laTYhDgRRajZ+DNRRUA 4I0RvrOlRDviCIXfpGmTtKcxN7tjb/3/oIjLLEb8= X-Authentication-Warning: raven.nostrum.com: Host c-24-9-76-58.hsd1.co.comcast.net [24.9.76.58] claimed to be Orochi.local To: "Deen, Glenn (NBCUniversal)" Cc: ADD Mailing list References: <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <841102D9-4B50-4415-8193-FF3766F91958@gmail.com> <51f18426-d2fd-! 1be9-5556-fe079992acce@cs.tcd.ie> <576BC95C-7F00-45C9-9A43-BC184147E8DE@nbcuni.com> From: Adam Roach Message-ID: <64dc7330-1f73-49df-fa19-c9ea0273703d@nostrum.com> Date: Thu, 8 Aug 2019 01:02:06 -0500 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Content-Language: en-US Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 Aug 2019 06:02:16 -0000 On 8/7/19 19:06, Deen, Glenn (NBCUniversal) wrote: > The issue I’m raising in this thread is the question of how researchers will be able to examine what applications are up to with DoH. I see that. You seem to be assuming that non-browser native apps would be using DoH to collect information about user behavior. My line of questioning is trying to figure out why you think they would do that, since they currently collect information about user behavior and send it back using their own, non-DoH protocols today. Those bespoke protocols are at least as opaque as DoH, and infinitely more flexible in terms of data that can be sent back. /a From nobody Wed Aug 7 23:25:31 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7C5E11200D8 for ; Wed, 7 Aug 2019 23:25:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.996 X-Spam-Level: X-Spam-Status: No, score=-1.996 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ilQl_zKRZn4j for ; Wed, 7 Aug 2019 23:25:27 -0700 (PDT) Received: from mail-pf1-x433.google.com (mail-pf1-x433.google.com [IPv6:2607:f8b0:4864:20::433]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8C26D1200CC for ; Wed, 7 Aug 2019 23:25:27 -0700 (PDT) Received: by mail-pf1-x433.google.com with SMTP id i189so43500004pfg.10 for ; Wed, 07 Aug 2019 23:25:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=XKafdngsbdEKIQi4ZBM+6tUSDyEuFMOq9P7j+b5ox1U=; b=riotBztiz2vgmbMOTYfFmF2t3XF/aHbcjZgj0T0xU+Gx5Mw6lr+uOr73ZTDSze/YuI N/HLia5quFVti+NaxMe4lL1oFUdnwnvkG9Kh0xdqC7vIt6QKmPgrpLyjpeCUJiyyRn5l JVfU3OVXoOEddbDUjPOPqnDB97ef0nfUo78ZQUCZCGTk8RaP0A9nYHSdtbqDFNpUruD7 aKGEXt+P8ZLIyiGzDO2S1DBZe1fUhCRuBo3esr3O35/93TzMYtsFqen065Wpi2/LwR1D sss9hQCEuhXM+8/q7qTRSrFh5HOobA09xrF8BUiwQ9RsZ+7Y4NvedUVcQUB54IYQwLEM ZmJQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=XKafdngsbdEKIQi4ZBM+6tUSDyEuFMOq9P7j+b5ox1U=; b=NWGnEI0hgdiIFKlZHrFhL7auKy558F5Jn31S2zL8/ZD1G/QlpMfFc+Whh98Pg+fCws mk0tnikP4M0rSAy7nmRYjFVFCONUPuEhpjojwHZ8KvkX5Qm9KqFblw+ImKwC1gfcTcJa faTjeOiqe/b65muZnuYyNl3rL5zraoLMDcXRwB7LWYbLtsEkCcrZASXkK5olv3JJm2Mq 4Ub4GzyH7XbqivQw0gkL2L6G/Ok0pCLKtTnU3i3sb1cXrfKeXdmhmgcdV9cERb3dhgYv 2AGwZ9jZv9Q2YqutPFi7fPVVEWyWk9D5UUGrnedHiOwQGJ8KWXNGyhgFQ+yFPPkwK1dk f4pQ== X-Gm-Message-State: APjAAAUzmTy7TveLwAxSJ8h2MvBwwZaWmlSUQpCenqVbMcLpDydpOi52 kBfoeY5+jLcnDeiKODI8zw8= X-Google-Smtp-Source: APXvYqyNKq4456IvnUtV1pBuMbKtRyqW+8Mv4Wela9p2WDbpp1w3HnPuByS47SqTMhl3eEiwFtKTuw== X-Received: by 2002:a65:6102:: with SMTP id z2mr11186746pgu.391.1565245526969; Wed, 07 Aug 2019 23:25:26 -0700 (PDT) Received: from ?IPv6:2601:646:8881:1fb4:ecbd:7f0:cf55:a816? ([2601:646:8881:1fb4:ecbd:7f0:cf55:a816]) by smtp.gmail.com with ESMTPSA id y128sm114464387pgy.41.2019.08.07.23.25.26 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 07 Aug 2019 23:25:26 -0700 (PDT) Content-Type: multipart/alternative; boundary=Apple-Mail-2F22833E-800D-47ED-B24B-2BC3A5D6B848 Mime-Version: 1.0 (1.0) From: Brian Dickson X-Mailer: iPhone Mail (16F203) In-Reply-To: Date: Wed, 7 Aug 2019 23:25:25 -0700 Cc: "Deen, Glenn (NBCUniversal)" , "add@ietf.org" , Bret Jordan , Martin Thomson , Rob Sayre Content-Transfer-Encoding: 7bit Message-Id: <19E9C1A2-B542-4DAA-8B55-9F38C8AE2C58@gmail.com> References: <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <2EF61DAB-8371-4257-82A0-8622A8F2B178@cable.comcast.com> <1FCF97D5-2A18-4CD2-9072-62D87F819CB0@nbcuni.com> <57B9E26F-C1C0-484C-B1B9-8DCDF14B7AD9@gmail.com> To: Eric Rescorla Archived-At: Subject: Re: [Add] [EXTERNAL] Control X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 Aug 2019 06:25:29 -0000 --Apple-Mail-2F22833E-800D-47ED-B24B-2BC3A5D6B848 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Sent from my iPhone > On Aug 7, 2019, at 10:25 PM, Eric Rescorla wrote: >=20 >=20 >=20 >> On Wed, Aug 7, 2019 at 7:23 PM Deen, Glenn (NBCUniversal) wrote: >>=20 >> Hi Rob, >>=20 >> On Aug 7, 2019, at 7:15 PM, Rob Sayre wrote: >>=20 >>> On Wed, Aug 7, 2019 at 6:35 PM Bret Jordan wrote= : >>>> Well said Glenn. I completely agree. =20 >>>>=20 >>>> No solution is perfect, but this represents a layered defense that orga= nizations rely on.=20 >>>=20 >>> I think the point of Martin's presentation was that this is a poor decis= ion, and will become increasingly poor. The presentation did acknowledge tha= t people made this decision--it's right there in the slides. So, saying that= "organizations rely on" this ineffective technique is not exactly a strong r= ebuttal. >>=20 >> I=E2=80=99m still very much missing the why and the supporting facts on t= his assertion. >>>=20 >>> This has come up once in this thread already, but the problem with the "= defense in depth" argument is that it can be used to rationalize ineffective= measures. >>=20 >> Again, where is the data to show they are ineffective?=20 >=20 > Isn't the entire premise of this conversation that people who use this tec= hnique are unhappy that DoH allows people to evade it? >=20 > -Ekr No. People are unhappy that browsers switching to DoH-on-by-default without info= rmed user consent forces all users to bypass any and all DNS-as-control-and-= detection-plane without the impacted users necessarily having any understand= ing of the implications or even being aware. In theory, some of those implic= ations can be personal, especially in restrictive environments. It is an opt= -out vs opt-in situation. The exposure of the control enabling opt-in or opt-out to non-admin users we= akens the overall host security model. The refusal to do client dnssec validation further weakens the resulting hos= t+app combo. Putting this inside enterprise networks with no ability to detect the genera= l situation, or to detect aberrant behavior, or identify what resolver is be= ing used makes some people particularly cranky. It=E2=80=99s not just one aspect of this, it is the sum total. Hope this clarifies things. Brian=20 >=20 >>=20 >> I get that there is a view that doesn=E2=80=99t like this approach, but I= also get that there are a heck of lot of people and organizations globally t= hat are quite satisfied with the results they currently get from these contr= ols. >>=20 >> . >> . >> . >>=20 >> I=E2=80=99m going to follow Stephen F=E2=80=99s example and self silence= for a bit on this list. I=E2=80=99ve made my points heard and anything else= will be me repeating myself. >>=20 >> -Glenn=20 >>=20 >>=20 >> --=20 >> Add mailing list >> Add@ietf.org >> https://www.ietf.org/mailman/listinfo/add > --=20 > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add --Apple-Mail-2F22833E-800D-47ED-B24B-2BC3A5D6B848 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable

Sent from my iPhone

On Aug 7, 2019, at 10:25= PM, Eric Rescorla <ekr@rtfm.com> w= rote:



On Wed, Aug 7, 2019 at 7:23 PM Deen, Glenn (NBCUniver= sal) <Glenn.Deen@nbcuni.com&= gt; wrote:

Hi Rob,

On Aug 7, 2019, at 7:15 PM, Rob Sayre <sayrer@gmail.com> wrote:

On Wed, Aug 7, 2019 at 6:35 PM Bret Jordan <jordan.ietf@gmail.com>= wrote:
Well said Glenn.  I completely agree.  

No solution is perfect, but this represents a layered defense that orga= nizations rely on. 

I think the point of Martin's presentation was that this is a poor decision,= and will become increasingly poor. The presentation did acknowledge that pe= ople made this decision--it's right there in the slides. So, saying that "or= ganizations rely on" this ineffective technique is not exactly a strong rebuttal.

I=E2=80=99m still very much missing the why and the supporting facts on this= assertion.

This has come up once in this thread already, but= the problem with the "defense in depth" argument is that it can be used to r= ationalize ineffective measures.

Again, where is the data to show they are ineffective? 

Isn't the entire premise of this conversat= ion that people who use this technique are unhappy that DoH allows people to= evade it?

-Ekr

No.

People are unhappy that br= owsers switching to DoH-on-by-default without informed user consent forces&n= bsp;all users to bypass any and all DNS-as-control-and-detection-plan= e without the impacted users necessarily having any understanding of the imp= lications or even being aware. In theory, some of those implications can be p= ersonal, especially in restrictive environments. It is an opt-out vs opt-in s= ituation.

The exposure of the control enabling opt-= in or opt-out to non-admin users weakens the overall host security model.

The refusal to do client dnssec validation further we= akens the resulting host+app combo.

Putting this in= side enterprise networks with no ability to detect the general situation, or= to detect aberrant behavior, or identify what resolver is being used makes s= ome people particularly cranky.

It=E2=80=99s not ju= st one aspect of this, it is the sum total.

Hope th= is clarifies things.

Brian 



 I get that there is a view that doesn=E2=80=99t like this approac= h, but I also get that there are a heck of lot of people and organizations g= lobally that are quite satisfied with the results they currently get from th= ese controls.

.
.
.

I=E2=80=99m going to follow Stephen F=E2=80=99s  example and self s= ilence for a bit on this list. I=E2=80=99ve made my points heard and anythin= g else  will be me repeating myself.

-Glenn 


--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
= --Apple-Mail-2F22833E-800D-47ED-B24B-2BC3A5D6B848-- From nobody Wed Aug 7 23:32:19 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 84C551200D8 for ; Wed, 7 Aug 2019 23:32:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VRWtNUAkHOu8 for ; Wed, 7 Aug 2019 23:32:17 -0700 (PDT) Received: from mail-ot1-x32b.google.com (mail-ot1-x32b.google.com [IPv6:2607:f8b0:4864:20::32b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 465CE1200CC for ; Wed, 7 Aug 2019 23:32:17 -0700 (PDT) Received: by mail-ot1-x32b.google.com with SMTP id b7so64089483otl.11 for ; Wed, 07 Aug 2019 23:32:17 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=8zUPGNwjkDNvdXXpVximrpC2Vgh/xhISTEthMce6wfA=; b=JjadPJKe4s077khy37mp3FtFnHt2rmMiiFtawy5nTXH4/h8iW64bshfAmm3dLFHlof 6Ytd1mZa/gA5EjLQtV55szwk2e/oz+LRQw95xX3ZW9O0jWtdShERyTyO9/V9HnGDeouR yNHbiRBnTRJQwzJZutR+QwzEZgeUVtb+HY9ivXjvEsRBPawkY+5MW8AP1Odgya/j1DwG U+DhJFENU9V53I9S/BhPmaE8hiqRfYpX/cqDMVdMm7F1YFeaQ+JuBUYqbkUsTgwQgsni XscatfSHtXqJQtMck3wLzpbcJ3+Ll3Xf/SZxDUnDdc/rIyzmC82VOFWz4W58aeEW1dQ2 6ydg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=8zUPGNwjkDNvdXXpVximrpC2Vgh/xhISTEthMce6wfA=; b=PJXr0wsuOEYqlh7EW7ug3XJ3ZGMvMs6oPjjb+yOBXrIPIt8Chb6IpLRtwQ0Su4iy5l RfeN27SitdbQPYZLAQtffNY8ogW/ZqoD8Y3yzyKqF4nwm9M//MPKX3j3DfVBKQ6JBLMS Vms0EPir9cBGoxeKTR1A8MfRHK9rw5ixycjgRYh8OEvEoEjez+BqWi/5RLC1EhNpmp3n vGb55niDfZ+V8Dy6xJxqtxx5MG89jgvhPZ05rq/3IPe0gM/dDDl3lQAAHuDKmsS+dEpG yQARddW9fr/vcaL2gxzv01y/g3vLxXsTZfXW2UJA2Vgp1udn2SaSitiVAFZeteu9x7Vi Q87w== X-Gm-Message-State: APjAAAUF8jURTzSbq0fxhALnaPES1CASYG5iy/RzWycxH4nBxTVDPgta M4HB43FHmnA/+hSbTn69dYtHoPE8Anv5+Jn4uFI= X-Google-Smtp-Source: APXvYqx9FZZUMO70doEfovAD4jdpUjeZd3XMN+88TvwtsZTow/ekLeOZSfIYblJs4FdyWXEVKm/t4OctPVYGVytD7WA= X-Received: by 2002:a02:2245:: with SMTP id o66mr15198491jao.53.1565245936455; Wed, 07 Aug 2019 23:32:16 -0700 (PDT) MIME-Version: 1.0 References: <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <2EF61DAB-8371-4257-82A0-8622A8F2B178@cable.comcast.com> <1FCF97D5-2A18-4CD2-9072-62D87F819CB0@nbcuni.com> <57B9E26F-C1C0-484C-B1B9-8DCDF14B7AD9@gmail.com> <19E9C1A2-B542-4DAA-8B55-9F38C8AE2C58@gmail.com> In-Reply-To: <19E9C1A2-B542-4DAA-8B55-9F38C8AE2C58@gmail.com> From: Rob Sayre Date: Wed, 7 Aug 2019 23:32:05 -0700 Message-ID: To: Brian Dickson Cc: Eric Rescorla , "Deen, Glenn (NBCUniversal)" , "add@ietf.org" , Bret Jordan , Martin Thomson Content-Type: multipart/alternative; boundary="0000000000000756a7058f953873" Archived-At: Subject: Re: [Add] [EXTERNAL] Control X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 Aug 2019 06:32:18 -0000 --0000000000000756a7058f953873 Content-Type: text/plain; charset="UTF-8" On Wed, Aug 7, 2019 at 11:25 PM Brian Dickson wrote: > Putting this inside enterprise networks with no ability to detect the > general situation, or to detect aberrant behavior, or identify what > resolver is being used makes some people particularly cranky. > The issue with this argument is that any secure network doesn't allow random devices. can we do better?, Rob --0000000000000756a7058f953873 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Wed, Aug 7, 2019 at 11:25 PM Brian Dic= kson <brian.peter.dicks= on@gmail.com> wrote:
Putting this = inside enterprise networks with no ability to detect the general situation,= or to detect aberrant behavior, or identify what resolver is being used ma= kes some people particularly cranky.

The issue with this argument is that any secure network doesn't a= llow random devices.

can we do better?,
= Rob
--0000000000000756a7058f953873-- From nobody Wed Aug 7 23:51:24 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 106FA1200D8 for ; Wed, 7 Aug 2019 23:51:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pM9_yE5xciGb for ; Wed, 7 Aug 2019 23:51:20 -0700 (PDT) Received: from mail-ot1-x330.google.com (mail-ot1-x330.google.com [IPv6:2607:f8b0:4864:20::330]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5A41E1200CC for ; Wed, 7 Aug 2019 23:51:20 -0700 (PDT) Received: by mail-ot1-x330.google.com with SMTP id s20so48964504otp.4 for ; Wed, 07 Aug 2019 23:51:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=ab4FfJ4hoxse3sDRGvZfdnGfghMvRU8bJ3WD/y7bNTA=; b=qTdDDDzGMc0+DkbrOmZCSK8Ngme+qE0IP5c4r+lcxURWdemwIyBaGHZIV4vRz9dzJY xBES3H7/7A7qRt5sROK7irmBjK+aQ2gadPqy2s4XpPtGsIXw/BBpFuY6DyXRW4JkVeO2 7EbjlpYgkJIOhqTrPJyGKJLjagM8UFhgzjcp5cOHU+O41BI/Jkpeg5dLPf98GlPPwMYS FsTszcxjDWLxJ3jJJil4EGnLgvdGrhtiA4piBQTH0VHnYqeFDKA/3ZwXnNAHtlnf0IfX wDNqLbiEGS0KV1O8Jg3JRimhqdPwiBay0872js4fZBFkUi7VfvTxLCVsjX2s2/icpOVv 1flg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=ab4FfJ4hoxse3sDRGvZfdnGfghMvRU8bJ3WD/y7bNTA=; b=mVbxC/ds/kVFhbMxD/uBoD6wz72M0mXX7d8Vw+KnOMfdjeBvO7Cnsh9f36J9LJlXBD +M+Pg/A2AJ+5zdoEpNysConN++O7Ym00DzZYC3Fet2irH54MO3xRKq7m3RLHbERdqLxc 1utUXgixPNZdTlTZxkQFlMeR03pa9GjzplbNMhp7DkIAY3co6UOal1dYvVpMx5i063tF 7/03v8gphuqpD3Gscj36iS57S48lTlhtQ8eZMpRuLCGj48pAMkeOP6m/IWnsZar1ycI1 QdILtHHUL1i1u5yjnljHQfLhS18pRaTOztZImNf0pYI9gfOi0ea7eE9hOxv7d7s/Gjvp i5mg== X-Gm-Message-State: APjAAAXMNFXncWKCg+Oc5cuaNPjzFW5UQLFbE+Cz/atrL+2Da4lZncZ4 iYGmWJLiq/NtjNzUN9cZgeKpwcoz26yh2ls5IHI= X-Google-Smtp-Source: APXvYqwvWWGEYZIWiTSRKvYX8nIhnGNnlfitNJsBuTQtxHNEP8Q2W6sCaeL/GhuD5VJrIVKcnhR+/lPQ6NvrR4alhaU= X-Received: by 2002:a6b:7e07:: with SMTP id i7mr3977413iom.254.1565247079610; Wed, 07 Aug 2019 23:51:19 -0700 (PDT) MIME-Version: 1.0 References: <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <2EF61DAB-8371-4257-82A0-8622A8F2B178@cable.comcast.com> <1FCF97D5-2A18-4CD2-9072-62D87F819CB0@nbcuni.com> <57B9E26F-C1C0-484C-B1B9-8DCDF14B7AD9@gmail.com> In-Reply-To: From: Rob Sayre Date: Wed, 7 Aug 2019 23:51:08 -0700 Message-ID: To: Eric Rescorla Cc: "Deen, Glenn (NBCUniversal)" , "add@ietf.org" , Martin Thomson , Bret Jordan Content-Type: multipart/alternative; boundary="0000000000002a8180058f957c92" Archived-At: Subject: Re: [Add] [EXTERNAL] Control X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 Aug 2019 06:51:23 -0000 --0000000000002a8180058f957c92 Content-Type: text/plain; charset="UTF-8" On Wed, Aug 7, 2019 at 10:26 PM Eric Rescorla wrote: > Isn't the entire premise of this conversation that people who use this > technique are unhappy that DoH allows people to evade it? > Let's be fair. Encrypted DNS will disrupt some lines of business. Shouldn't we allow anyone with an accidental ad network to say "policy" or "operational concerns"? No one is obligated to listen, but they should still be able to have their voice heard. thanks, Rob --0000000000002a8180058f957c92 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Wed, Aug 7, 2019 at 10:26 PM Eric Resc= orla <ekr@rtfm.com> wrote:
Isn't the entire = premise of this conversation that people who use this technique are unhappy= that DoH allows people to evade it?
Let's be fair. Encrypted DNS will disrupt some lines of bus= iness. Shouldn't we allow anyone with an accidental ad network to say &= quot;policy" or "operational concerns"?

=
No one is obligated to listen, but they should still be able to have t= heir voice heard.

thanks,
Rob
=
--0000000000002a8180058f957c92-- From nobody Thu Aug 8 00:23:39 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D04F912010E for ; Thu, 8 Aug 2019 00:23:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=scramworks.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id B7KMex5E1Emf for ; Thu, 8 Aug 2019 00:23:35 -0700 (PDT) Received: from knid.scramworks.net (knid.scramworks.net [IPv6:2a01:4f8:c17:50eb::2]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A1CA1120105 for ; Thu, 8 Aug 2019 00:23:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=scramworks.net; s=bofh; h=References:In-Reply-To:To:From:Subject:Message-ID :Date:MIME-Version:Content-Type:Sender:Reply-To:Cc:Content-Transfer-Encoding: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=n557ZsQW9SBDByLan7tv7j2n3W4/KfFWu0PeFQem1es=; b=BbeiQKrdeXI8HvoHgiPTS/cIzP /PrTSYDCpZe1F1N+Bi67H9cmsppJrldlmW34kxRgOLEmN/HFLlf7eh+DywPWl+VFCkCjy1VuJ7/fE 3GnnAw1/FXJWDVqdbWQjoNIO5qqdm8tiDMv2FyPdkRhHbULYsXZzsrB7246dMJtjdTvY=; Received: from [90.240.166.166] (helo=[192.168.1.6]) by knid.scramworks.net with esmtpsa (TLS1.1:ECDHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.90_1) (envelope-from ) id 1hvclo-0004Lo-5c; Thu, 08 Aug 2019 08:23:32 +0100 Content-Type: multipart/alternative; boundary="----=_NextPart_44890343.406451971735" MIME-Version: 1.0 Date: Thu, 08 Aug 2019 08:22:32 +0100 Message-ID: <3cb7e6d8-66e2-4e24-86d0-dbce2e3632f2@getmailbird.com> From: "Robert Mortimer" To: "Deen, Glenn (NBCUniversal)" , "" In-Reply-To: References: <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <841102D9-4B50-4415-8193-FF3766F91958@gmail.com> <51f18426-d2fd-!1be9-5556-fe079992acce@cs.tcd.ie> <576BC95C-7F00-45C9-9A43-BC184147E8DE@nbcuni.com> <,> User-Agent: Mailbird/2.6.1.0 X-Mailbird-ID: 3cb7e6d8-66e2-4e24-86d0-dbce2e3632f2@getmailbird.com X-Spam-Score-SW: -1.0 (-) X-SW-Scan: f526acecb4b8e3595854452230a83dde X-Clacks-Overhead: GNU Terry Pratchett Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 Aug 2019 07:23:38 -0000 ------=_NextPart_44890343.406451971735 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable On 08/08/2019 01:07:29, Deen, Glenn (NBCUniversal) = wrote: This particular concern does not involve the concern over centralization. In this particular case, I=E2=80=99m talking about native OS apps that run = on the desktop or the tablet or the phone. Once the DoH code and infrastruc= ture is in the wild inside browsers it will start to pop up in non-browser = applications.=C2=A0 DoH code is already in use in non-browser mobile applications (at least), n= ot all of which are doing certificate verification and not all of which are= using DoH purely for "normal" DNS lookups. These are applications availabl= e in the main google and apple app stores, so not overtly dodgy downloads. I've seen about half a dozen or so identifiable mobile applications that fa= ll into the category of not-browser apps, not=C2=A0doing=C2=A0certificate v= erification. I'd assume that there are more that actually do certificate ve= rification and so I don't=C2=A0have visibility of them. --=C2=A0 Robm 873 =C2=A0 "Ask not what I can do for the stupid,=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0but what the stupid can do for me" - Grae= me Garden ------=_NextPart_44890343.406451971735 Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable
=0A =0A = =0A = =0A =0A = =0A


=0A

On 08/08/2019 01:07:29, Deen, Glen= n (NBCUniversal) <glenn.deen@nbcuni.com> wrote:


This particular c= oncern does not involve the concern over centralization. =0A
In this par= ticular case, I=E2=80=99m talking about native OS apps that run on the desk= top or the tablet or the phone. Once the DoH code and infrastructure is in= the wild inside browsers it will start to pop up in non-browser applicatio= ns. 

DoH code is alre= ady in use in non-browser mobile applications (at least), not all of which = are doing certificate verification and not all of which are using DoH purel= y for "normal" DNS lookups. These are applications available in the main go= ogle and apple app stores, so not overtly dodgy downloads.

I've seen about half a dozen= or so identifiable mobile applications that fall into the category of not-= browser apps, not doing ce= rtificate verification. I'd assume that there are more that actually do cer= tificate verification and so I don't have visibility of them.
-- 
Robm<= /div>
873
  "Ask not what I can do for the stupid, =
         but what the stupid can do for= me" - Graeme Garden


=
=0A =0A =
------=_NextPart_44890343.406451971735-- From nobody Thu Aug 8 04:46:54 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D5FC812014F for ; Thu, 8 Aug 2019 04:46:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Je4GehiqKo74 for ; Thu, 8 Aug 2019 04:46:35 -0700 (PDT) Received: from smtp.guxx.net (nyx.guxx.net [85.10.208.173]) by ietfa.amsl.com (Postfix) with ESMTP id AF76E12006F for ; Thu, 8 Aug 2019 04:46:35 -0700 (PDT) Received: by nyx.guxx.net (Postfix, from userid 107) id AA58D5F43280; Thu, 8 Aug 2019 13:46:34 +0200 (CEST) Received: from [192.168.2.190] (p4FF5367C.dip0.t-ipconnect.de [79.245.54.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by nyx.guxx.net (Postfix) with ESMTPSA id ABCC55F43250; Thu, 8 Aug 2019 13:46:33 +0200 (CEST) From: "Ralf Weber" To: "Ted Lemon" Cc: "Brian Dickson" , "ADD Mailing list" , "Adam Roach" , "Deen, Glenn" Date: Thu, 08 Aug 2019 13:46:33 +0200 X-Mailer: MailMate (1.12.5r5635) Message-ID: In-Reply-To: <8A76AFC2-6045-4689-A022-092C603E5670@fugue.com> References: <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <841102D9-4B50-4415-8193-FF3766F91958@gmail.com> <576BC95C-7F00-45C9-9A43-BC184147E8DE@nbcuni.com> <008F7E11-756C-4AD3-8A2A-EEDFF8EB39C1@fugue.com> <8A76AFC2-6045-4689-A022-092C603E5670@fugue.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 Aug 2019 11:46:38 -0000 On 8 Aug 2019, at 4:13, Ted Lemon wrote: > I am fairly sure that we all understand that DoH quite effectively > prevents us from using DNS as a control plane. What this means is > that you can no longer use DNS as a control plane. That is a fact of > your life now. As stated by me and others that depends on what you see as effective and of course how DoH servers are deployed. It is no longer a 100% effective control plane, but to be honest it never was. > What I’m asking is not “is there a problem that’s going to cause > you some heartburn?” There definitely is, and you have my > sympathy. What I’m asking is, “what can the IETF do to help you > with this problem.” I think the answer is “nothing.” Well we could describe deployment considerations/guidelines for DoH clients/servers. We could work on mechanisms to discover local DoH servers. There is a lot of stuff we could work on and most of it already has been brough up in the add bof or mailing lists. > If you think the answer is something other than nothing, can you > please state explicitly what you think the answer is? Do you think > the IETF can tell Google and Cloudflare to stop offering DoH, for > example? Or do you want us to write a document explaining how to > block port 443 on public DoH resolvers? Well if Google (who I believe have stated that) and Cloudflare deploy there DoH servers in a way that e.g enterprises could block them via IP filtering and we could maybe write that up as a guideline for DoH server operators it would surely help enterprises. Similar to if we had a protocol to discover local DoH server or the presence of split namespaces or policies which DoH clients would follow this would also help a lot of use cases where DNS is used as a control plane. So long -Ralf From nobody Thu Aug 8 08:03:33 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B851F120163 for ; Thu, 8 Aug 2019 08:03:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gDbSGGt5li6X for ; Thu, 8 Aug 2019 08:03:29 -0700 (PDT) Received: from mail-pl1-x62d.google.com (mail-pl1-x62d.google.com [IPv6:2607:f8b0:4864:20::62d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6C23A1200A3 for ; Thu, 8 Aug 2019 08:03:29 -0700 (PDT) Received: by mail-pl1-x62d.google.com with SMTP id c2so43635128plz.13 for ; Thu, 08 Aug 2019 08:03:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:mime-version:subject:date:references:to:in-reply-to:message-id; bh=dPtrC+mSRvnFSdgbmsyB2DSs9t3nKRn4+Ke9u8f+SNo=; b=N43goVsWt7yXeV+/wHOldfTQHhFlmASx3NYiwzp/a4wWa7AR8gll08HvVdxCqV2FYw jMlZzQrDAteYtHjK4WHeY+dIOnFHlS91m6wtJ+uQrxanv0CJqgEeFOs4lwOjFXBMbI9Q R5c6ohNebVLHdwGKEDN05pQyltDdzhbytORuXa+ERGiVqd3zXoxfNjyfUTmVvY/U5lfj 3zxcGHqflIqoE5ed6ULcCEFbiGr69aDchxHsiAoXrPGqdoX/OICcUvSyBp2Pis3NXhwE CQQ2DVThGPy6MkZUgiSt5N7WIeuip/0XR1qUgjc4J/TNLRPIu4Pdwsnyeq/o5Wgx6qnP HnmA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:mime-version:subject:date:references:to :in-reply-to:message-id; bh=dPtrC+mSRvnFSdgbmsyB2DSs9t3nKRn4+Ke9u8f+SNo=; b=t6dHRzcqAQL6xoftXX5HKe18zEqbxiI9VHSy98doOUFxV7QCk3096s3CN8g5jYhl4l oDq34tLiIFF3be4eaSDHCk6CV0cVjYs5vtC7Pn8R1skXaz0DYuyjOKM2z4QroXV/lqBE KVJXbobJpWktjS/SOZ6qjl+TOAt7JKGFw1C+BoDuh6FGVzp3r8jvagZ0h88RkA6AMF7T xI0+pPK1I7l7tDtde2Cu2nYPVNfK7UgADdZaVvGc+x5Ju4GhbS0FrA+gS8Be7MwJz/BL hy9RbHrP4jxZBgavsFwjCRHUXkIoro+XI4sNlqztjKhuSeHFDfjosyTELEYkSaTTJ44+ JFwA== X-Gm-Message-State: APjAAAXwaJorfOenHcZ1nRq0Ncs6KlbiR6g2l7eTgoEI0M7r5u2vnupO h37SpoWgl2VzGuGQoI4PHdrgStHB X-Google-Smtp-Source: APXvYqwEO/1dQcxOtSU6xAs0+C6R8qzweTy1K+NsrUxfV4f2W+xYkm8oeu5271sg0XD3/U2aitAj8g== X-Received: by 2002:a17:902:7288:: with SMTP id d8mr14228548pll.133.1565276609014; Thu, 08 Aug 2019 08:03:29 -0700 (PDT) Received: from [10.128.64.149] ([136.60.227.81]) by smtp.gmail.com with ESMTPSA id m4sm106928675pgs.71.2019.08.08.08.03.27 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 08 Aug 2019 08:03:28 -0700 (PDT) From: Bret Jordan Content-Type: multipart/alternative; boundary="Apple-Mail=_7680103C-3A4E-4A7E-B009-54DAA455297B" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Thu, 8 Aug 2019 09:03:25 -0600 References: <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <2EF61DAB-8371-4257-82A0-8622A8F2B178@cable.comcast.com> <1FCF97D5-2A18-4CD2-9072-62D87F819CB0@nbcuni.com> <57B9E26F-C1C0-484C-B1B9-8DCDF14B7AD9@gmail.com> To: Mikael Abrahamsson , "add@ietf.org" In-Reply-To: Message-Id: <546B2178-F768-4717-89CB-9B4E761675B8@gmail.com> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] [EXTERNAL] Control X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 Aug 2019 15:03:32 -0000 --Apple-Mail=_7680103C-3A4E-4A7E-B009-54DAA455297B Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii You are correct Mikael.=20 Thanks, Bret PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 "Without cryptography vihv vivc ce xhrnrw, however, the only thing that = can not be unscrambled is an egg." > On Aug 7, 2019, at 11:02 PM, Mikael Abrahamsson = wrote: >=20 > On Wed, 7 Aug 2019, Rob Sayre wrote: >=20 >> Perhaps we should shift the burden of proof to the DNS policy fans. = What's so great about using DNS for any of these purposes? >=20 > It keeps the regulator happy. Do not make the regulator angry. Bad = things happen then. A lot worse than we have today. >=20 > See Ralf Webers email from yesterday. DNS based blocking is deemed = "good enough" by regulator today. They want blocking or policy = implemented. If DNS stops being "good enough", they will demand more = intrusive measures to make things work. >=20 > = https://www.engadget.com/2019/07/31/how-ag-barr-is-going-to-get-encryption= -backdoors/ > = https://www.techradar.com/news/uk-porn-block-everything-you-need-to-know > = https://www.telenor.com/media/press-release/telenor-introduces-child-porno= graphy-filter-in-sweden >=20 > Better give them a blunt tool that kind of works and is not super = intrusive, than the alternative. >=20 > If browser vendors change the default to DoH via some quad-X without = the agreed policies between industry and regulator, the regulator (and = other bodies) will wake up in a lot of countries. Some already have. >=20 > I'd prefer not to get regulators involved and solve this as an = industry. Things typically get very complicated when regulators and = politicians get involved. >=20 > --=20 > Mikael Abrahamsson email: swmike@swm.pp.se --Apple-Mail=_7680103C-3A4E-4A7E-B009-54DAA455297B Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii
You are correct Mikael. 

Thanks,
Bret
PGP = Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 = 0050
"Without = cryptography vihv vivc ce xhrnrw, however, the only thing that can not = be unscrambled is an = egg."

On Aug 7, 2019, at 11:02 PM, Mikael Abrahamsson <swmike@swm.pp.se> = wrote:

On Wed, 7 Aug 2019, Rob Sayre wrote:

Perhaps we should shift = the burden of proof to the DNS policy fans. What's so great about using = DNS for any of these purposes?

It keeps the regulator happy. Do not make the regulator = angry. Bad things happen then. A lot worse than we have today.

See Ralf Webers email from yesterday. DNS = based blocking is deemed "good enough" by regulator today. They want = blocking or policy implemented. If DNS stops being "good enough", they = will demand more intrusive measures to make things work.
https://www.engadget.com/2019/07/31/how-ag-barr-is-going-to-get= -encryption-backdoors/
https://www.techradar.com/news/uk-porn-block-everything-you-nee= d-to-know
https://www.telenor.com/media/press-release/telenor-introduces-= child-pornography-filter-in-sweden

Better = give them a blunt tool that kind of works and is not super intrusive, = than the alternative.

If browser vendors = change the default to DoH via some quad-X without the agreed policies = between industry and regulator, the regulator (and other bodies) will = wake up in a lot of countries. Some already have.

I'd prefer not to get regulators involved and solve this as = an industry. Things typically get very complicated when regulators and = politicians get involved.

--
Mikael Abrahamsson    email: = swmike@swm.pp.se

= --Apple-Mail=_7680103C-3A4E-4A7E-B009-54DAA455297B-- From nobody Thu Aug 8 08:39:22 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 18CF512006D for ; Thu, 8 Aug 2019 08:39:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4JdDkSJac2le for ; Thu, 8 Aug 2019 08:39:20 -0700 (PDT) Received: from mail-pl1-x62a.google.com (mail-pl1-x62a.google.com [IPv6:2607:f8b0:4864:20::62a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CB158120041 for ; Thu, 8 Aug 2019 08:39:20 -0700 (PDT) Received: by mail-pl1-x62a.google.com with SMTP id ay6so43743758plb.9 for ; Thu, 08 Aug 2019 08:39:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=KmxhXaCeHC+R7d+76RyCr86pTsgLVo7+GnXLc1VjN/E=; b=fbA43qA8r9lnvLOJM/lvtEubN5NeKfRJNGyD2FZYRdlTleeer0lmbASI+pyuUjRZ9Z N2oZ9/fWJMst0QpudJEyKhNCtXVUaPZdxFH4WXShpYmwpXp4C3cquK70C9MQEKCaWKM1 Ri+lNbjgMCWMA9RP7i8DMj99vHNyzo2TJ3OaHq7UtNB6Hslq7VcFbEtJ7lpHwqAZ/D8J KAbnKnpax3qjapMLYCElo4YZBYNtwCDOjr8CINtZz5ekVlcPuF6WCRS2p84VcNvNOvr8 TV9njuz+ifJlmopxqoICgU42V5kr0luOQMko7iCeE2oTa0lqeX0Dt+INs+2v/0fV8ZYy tEvA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=KmxhXaCeHC+R7d+76RyCr86pTsgLVo7+GnXLc1VjN/E=; b=puot15NS9ZgONDufpR7YmodAG9MisnLJoPMjkMJG+7xcujvxfoc0K7DnqtxgNkQM3d IuFfkbWCVb6tX6AXV7uv0Pnzypn5ruNiIQ9oP5Y6HM8JEXlceCyoQ9zn71TASM8Mop5Y OVAMh/hBigqohOsDQK975BKotvD3gVITudGl0/sePPw5ZK0UR5JGRu3a2a4v0tnBwcLu CAg4fd+8xLjG4KdyPL93yeQyAlr2JPOLVGbPxIm4CVHguwxKUhD5n8fLBhEZx7L0tdBA EN/hHaPeBVPHKauzN71cFqHil955P8MJ8S24W27EUCU9PTzmNgbbEK3V1fUct4na0L86 a25w== X-Gm-Message-State: APjAAAV1pByYviuYY4ECWxBTrfI2NkrbqCh1tzCsGjJZSCnecLUdVENA STTNLHnwLCpA4OhQnSVjz3Q3j2hO X-Google-Smtp-Source: APXvYqyAYFc2QT/bxNLfyX6tKr4JweeQpmPAcdDymvdvaRhef4tMZNCPLyW69qVWra0tsMJAxe9SQw== X-Received: by 2002:a17:902:8ec7:: with SMTP id x7mr14218109plo.224.1565278760341; Thu, 08 Aug 2019 08:39:20 -0700 (PDT) Received: from [10.128.64.149] ([136.60.227.81]) by smtp.gmail.com with ESMTPSA id k22sm102584389pfk.157.2019.08.08.08.39.18 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 08 Aug 2019 08:39:19 -0700 (PDT) From: Bret Jordan Message-Id: <7FA2E20B-FD25-4BED-9A81-F42000BFDB39@gmail.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_28400A52-19CD-4827-B634-93147B8F8BCB" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Thu, 8 Aug 2019 09:39:17 -0600 In-Reply-To: <6474D9D5-4AD0-4A98-8926-F38600F9D8AE@hopcount.ca> Cc: add@ietf.org To: Joe Abley References: <6474D9D5-4AD0-4A98-8926-F38600F9D8AE@hopcount.ca> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] New WG or new Area X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 Aug 2019 15:39:22 -0000 --Apple-Mail=_28400A52-19CD-4827-B634-93147B8F8BCB Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 There is a lot of moving parts in and around DNS, from the protocol = design side to the operational side. DNS is a critical aspect that = really demands more focus and attention in the IETF. I believe having = its own area would encourage better communication and dialog between the = various groups and various users. It would also get us out of the =E2=80=9C= we design things over here=E2=80=9D and we leave it up to the =E2=80=9Coth= er side=E2=80=9D to deal with operational aspects. We need people = talking and working together. We need everyone to understand both sides = of the problems.=20 I think it is also critical that the leaders (chairs or ADs) be = individuals that are operators, this is why I think people like Glenn = and Barbara would be brilliant for this work.=20 Thanks, Bret PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 "Without cryptography vihv vivc ce xhrnrw, however, the only thing that = can not be unscrambled is an egg." > On Aug 7, 2019, at 10:36 PM, Joe Abley wrote: >=20 > Hi Bret, >=20 > On Aug 7, 2019, at 23:32, Bret Jordan wrote: >=20 >> I would like to see either a consolidated WG for all DNS related = work, or a new Area just for for DNS.=20 >=20 > Can you explain why? >=20 >=20 > Joe --Apple-Mail=_28400A52-19CD-4827-B634-93147B8F8BCB Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 There= is a lot of moving parts in and around DNS, from the protocol design = side to the operational side.  DNS is a critical aspect that really = demands more focus and attention in the IETF.  I believe having its = own area would encourage better communication and dialog between the = various groups and various users. It would also get us out of the =E2=80=9C= we design things over here=E2=80=9D and we leave it up to the =E2=80=9Coth= er side=E2=80=9D to deal with operational aspects. We need people = talking and working together. We need everyone to understand both sides = of the problems. 

I think it is also critical that the leaders (chairs or ADs) = be individuals that are operators, this is why I think people like Glenn = and Barbara would be brilliant for this work. 



Thanks,
Bret
PGP = Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 = 0050
"Without = cryptography vihv vivc ce xhrnrw, however, the only thing that can not = be unscrambled is an = egg."

On Aug 7, 2019, at 10:36 PM, Joe Abley <jabley@hopcount.ca> = wrote:

Hi Bret,

On Aug 7, 2019, at = 23:32, Bret Jordan <jordan.ietf@gmail.com> wrote:

I would like to see = either a consolidated WG for all DNS related work, or a new Area just = for for DNS.

Can you explain = why?


Joe

= --Apple-Mail=_28400A52-19CD-4827-B634-93147B8F8BCB-- From nobody Thu Aug 8 08:43:32 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DEB3A1200A3 for ; Thu, 8 Aug 2019 08:43:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CZEpO-qcCa1Q for ; Thu, 8 Aug 2019 08:43:28 -0700 (PDT) Received: from mail-pl1-x62a.google.com (mail-pl1-x62a.google.com [IPv6:2607:f8b0:4864:20::62a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3D0A912006D for ; Thu, 8 Aug 2019 08:43:28 -0700 (PDT) Received: by mail-pl1-x62a.google.com with SMTP id ay6so43747994plb.9 for ; Thu, 08 Aug 2019 08:43:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=g6GZ4Qc4Wy3pb/02F5HfLaXOSc0jI3u90bToVBpL47c=; b=rCqjHlFH0GgR7t95kfUkjoTKUgpOvXU9lAE0t0QbGU51cG7bhaGueJFr4xyE4VC7TX kIK0vGEPbSeklqw+uq/QME8Ltlw+F2zuwuWhT3GXKp5oY+dWOOEK5wRwy9n1NegTYYUv AqbRJZ/BExDFys3z3yjfsEI+hd+Z9ffuNezqRuhvBM+w0G6gYWE9ERyh/fxsoI6ki1fX I21IcI3BkkO2y+V8rdI5C8gC0i9DtRViNA+3+Q+AQHPD8H0yKacYUCYAoX9zQ+T1i7w0 E28RBf52YTYtkk0SxKO4QPNq4icnVRGHlkc+vy9prEyHOTTZZmNOnVfrFHdrDrHhK3hM bgFg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=g6GZ4Qc4Wy3pb/02F5HfLaXOSc0jI3u90bToVBpL47c=; b=jo0OENdf4uz7jA8tN1Jap7ot2O+XDhgiP8WEzQ+HKKZ66pyxP2s37+HCmlfEMukamU Epjq+9NMNEwBNLKrY1sGCdOg5mu5AMS+Htjv8HMH+Y3oB/+5zz2Mk4WFr47JbGFU+bSS pyRdTAZbz1lK+mFaGVrWE4IuANgg3ZsomrD1WMLy3tDFvdY6Fuseu7Q95wSeXQKscvBC IAbZheUTWBFlCBBRpG0JyvfGP0//xQIXHVUlHi539nSbv2RLuVWmyMqj5lX7I8Ex5Ped NIKtv3/czwHeHy/NqTKpcgWZoWr1r00De47BZypQ4LxtyuM1LEMINVE91/6Tbk1XSOQQ MzTg== X-Gm-Message-State: APjAAAX8IolKAT16TrZTyS7Uvt4U0U4sfp7EKWU5Et8ULKe5IhdVmtFb pWMrQFHFnIVVRfr8CPAnveLgBEg1lLA= X-Google-Smtp-Source: APXvYqzNarjpDMZ7qhRH3sfI6rDvPWFc6D+4fr0EJSlome8z2xzGcCMf5bC9l+l3gEIUQ47GklLbzA== X-Received: by 2002:a17:902:8203:: with SMTP id x3mr14463623pln.304.1565279007671; Thu, 08 Aug 2019 08:43:27 -0700 (PDT) Received: from [17.230.174.59] ([17.230.174.59]) by smtp.gmail.com with ESMTPSA id v27sm137403012pgn.76.2019.08.08.08.43.26 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 08 Aug 2019 08:43:27 -0700 (PDT) From: Ted Lemon Message-Id: <2B980050-9BBC-4333-BE20-2846B8A1B9E7@fugue.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_3D58C092-9578-4CCF-BA82-631E36C8C621" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Thu, 8 Aug 2019 08:43:25 -0700 In-Reply-To: <19E9C1A2-B542-4DAA-8B55-9F38C8AE2C58@gmail.com> Cc: Eric Rescorla , "add@ietf.org" , Rob Sayre , Martin Thomson , Bret Jordan , "Deen, Glenn (NBCUniversal)" To: Brian Dickson References: <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <2EF61DAB-8371-4257-82A0-8622A8F2B178@cable.comcast.com> <1FCF97D5-2A18-4CD2-9072-62D87F819CB0@nbcuni.com> <57B9E26F-C1C0-484C-B1B9-8DCDF14B7AD9@gmail.com> <19E9C1A2-B542-4DAA-8B55-9F38C8AE2C58@gmail.com> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] [EXTERNAL] Control X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 Aug 2019 15:43:31 -0000 --Apple-Mail=_3D58C092-9578-4CCF-BA82-631E36C8C621 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 On Aug 7, 2019, at 11:25 PM, Brian Dickson = wrote: > People are unhappy that browsers switching to DoH-on-by-default = without informed user consent forces all users to bypass any and all = DNS-as-control-and-detection-plane without the impacted users = necessarily having any understanding of the implications or even being = aware. In theory, some of those implications can be personal, especially = in restrictive environments. It is an opt-out vs opt-in situation. This may be true, but two questions come up: - Which people? Users, or operators? - How do the privacy and security properties of DoH compare with the = privacy and security properties of SP recursive DNS? Personally, I don=E2=80=99t actually know on a practical level whether = I=E2=80=99m better off using DoH or SPrDNS, but given some of the = disclosures we=E2=80=99ve seen historically about ISP=E2=80=99s behavior = with respect to passive snooping, it=E2=80=99s certainly not a given = that SPrDNS is better. My point here is not to criticize what you are saying, but just to = encourage you to go a little deeper on your assertions. =E2=80=9CPeople=E2= =80=9D is way too general, for example. I don=E2=80=99t know that it would be a bad thing to write a document = talking about the tradeoffs that we face here. It might be very = difficult, though, if we can=E2=80=99t be crystal clear about what = we=E2=80=99re discussing. --Apple-Mail=_3D58C092-9578-4CCF-BA82-631E36C8C621 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 On = Aug 7, 2019, at 11:25 PM, Brian Dickson <brian.peter.dickson@gmail.com> wrote:
People are unhappy that browsers switching to = DoH-on-by-default without informed user consent forces all users to = bypass any and all DNS-as-control-and-detection-plane without the = impacted users necessarily having any understanding of the implications = or even being aware. In theory, some of those implications can be = personal, especially in restrictive environments. It is an opt-out vs = opt-in situation.

This may be true, but two questions come up:
- Which people?  Users, or operators?
- How do the privacy and security properties of DoH compare = with the privacy and security properties of SP recursive DNS?

Personally, I don=E2=80=99= t actually know on a practical level whether I=E2=80=99m better off = using DoH or SPrDNS, but given some of the disclosures we=E2=80=99ve = seen historically about ISP=E2=80=99s behavior with respect to passive = snooping, it=E2=80=99s certainly not a given that SPrDNS is = better.

My point here is = not to criticize what you are saying, but just to encourage you to go a = little deeper on your assertions.  =E2=80=9CPeople=E2=80=9D is way = too general, for example.

I don=E2=80=99t know that it would be a bad thing to write a = document talking about the tradeoffs that we face here.   It might = be very difficult, though, if we can=E2=80=99t be crystal clear about = what we=E2=80=99re discussing.

= --Apple-Mail=_3D58C092-9578-4CCF-BA82-631E36C8C621-- From nobody Thu Aug 8 08:49:25 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DE7A5120219 for ; Thu, 8 Aug 2019 08:49:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Mj_ELqk2CTjk for ; Thu, 8 Aug 2019 08:49:22 -0700 (PDT) Received: from mail-qt1-x829.google.com (mail-qt1-x829.google.com [IPv6:2607:f8b0:4864:20::829]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C78331201F2 for ; Thu, 8 Aug 2019 08:49:21 -0700 (PDT) Received: by mail-qt1-x829.google.com with SMTP id h21so92579150qtn.13 for ; Thu, 08 Aug 2019 08:49:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=ot4T9m7Yrx4uQ42D4ozmKAwLDc7hgrnxquFueC47riQ=; b=JjJXpscsa/7TAOfFn0KyDUbSq5E5cJWRUzun9BsmiyOGI2WZo4rsEG9efY34SeffIl chEy1sQkIDx5+vDUV0e7QNLgUT0Qxd4v4Z/89wTXqzOriXh4TPhrOV8j6DIwQ0BooeGj KRT6YZ26MFwVwXDPqJkO9afx0GGOajpA0KTl7IYU9r5OueK2a/WeaurZEuh3+id+r3OY ktnbUhWIJRPJcIAtZsd+opqVQKsrLZ4jQgWB4qz7kDQ9wom8HVjBJzvfUn3uBouJ4bXr 2EG1D528LbTdXb4BfZ6rR0yhkvdJVQmgBC2P4OqqFp6gk77Kw5Dfbz3z30+r1wsHIeXU vn+A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=ot4T9m7Yrx4uQ42D4ozmKAwLDc7hgrnxquFueC47riQ=; b=hnGygwv8IKprJ//U+Jo62tNytV8mH2DBfiFSAxjFE+KrmmX+a0tTwldjkWJ5D7LhaG ewUyldNgro8wZ5bu8ORaRJppxm5MBzzWeUB1ANufyhghbLov1aesxITORxsNkUXCzxjW X1q+EGfiy2M9aY4GtfFpdMTH/4EoB5JEFNh/xn7HZmQZkdBuMFpW95KxeJDZwp5IpeAz Ra7cTU+qELpirgWIbT0VlBcmxpZlwpTwgM6DlywAjKwRSdtckCNLg3OtiemBi01x+1I9 hNlrGMqZrA9GSDYtwFIW1xmi2cgvGHqK7onXcFHJg4BjIMdXiKY0SRTMkGd8xMGQj+Xe 5Sdw== X-Gm-Message-State: APjAAAUMqtKcucEVgA6DhnDCF+dHkPs+B4n5lWArjs+8pcHGhc1Vyt3c vGuD9xu4KP9Ek++yEpIGH29tRmbJD80= X-Google-Smtp-Source: APXvYqzZSDJ3yZHV9RL1VYYwz6BRKHA/F3FNyVF4OyWU2p3WnuW+nsuYYlTHd/LyCzi4RT12bQKNvw== X-Received: by 2002:ac8:46cc:: with SMTP id h12mr1439801qto.234.1565279360768; Thu, 08 Aug 2019 08:49:20 -0700 (PDT) Received: from [17.230.174.59] ([17.230.174.59]) by smtp.gmail.com with ESMTPSA id p32sm47435723qtb.67.2019.08.08.08.49.19 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 08 Aug 2019 08:49:20 -0700 (PDT) From: Ted Lemon Message-Id: <4DF3A08C-6632-4428-90CF-40DB62F0B3A4@fugue.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_47040E72-0B84-46DC-8FC4-8E4DA46A2A09" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Thu, 8 Aug 2019 08:49:18 -0700 In-Reply-To: Cc: ADD Mailing list To: Ralf Weber References: <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <841102D9-4B50-4415-8193-FF3766F91958@gmail.com> <576BC95C-7F00-45C9-9A43-BC184147E8DE@nbcuni.com> <008F7E11-756C-4AD3-8A2A-EEDFF8EB39C1@fugue.com> <8A76AFC2-6045-4689-A022-092C603E5670@fugue.com> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] [EXTERNAL] Re: My longer list of questions [from partial distribution at the MIC] X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 Aug 2019 15:49:24 -0000 --Apple-Mail=_47040E72-0B84-46DC-8FC4-8E4DA46A2A09 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 On Aug 8, 2019, at 4:46 AM, Ralf Weber wrote: >> If you think the answer is something other than nothing, can you = please state explicitly what you think the answer is? Do you think the = IETF can tell Google and Cloudflare to stop offering DoH, for example? = Or do you want us to write a document explaining how to block port 443 = on public DoH resolvers? > Well if Google (who I believe have stated that) and Cloudflare deploy = there DoH servers in a way that e.g enterprises could block them via IP = filtering and we could maybe write that up as a guideline for DoH server = operators it would surely help enterprises. Similar to if we had a = protocol to discover local DoH server or the presence of split = namespaces or policies which DoH clients would follow this would also = help a lot of use cases where DNS is used as a control plane. These aren=E2=80=99t unreasonable proposals for new work. I believe we = are already working on the latter project, and I don=E2=80=99t oppose = that in principle as long as we don=E2=80=99t create security = vulnerabilities in the process. As far as a =E2=80=9Cbest practices=E2=80=9D document, we could = certainly write one, and it would make sense for it to say what you are = suggesting. The question I would have is, who is the target audience? = If Google and Cloudflare are already doing it, who are you speaking to? --Apple-Mail=_47040E72-0B84-46DC-8FC4-8E4DA46A2A09 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 On = Aug 8, 2019, at 4:46 AM, Ralf Weber <dns@fl1ger.de> wrote:
If you think the answer is something = other than nothing, can you please state explicitly what you think the = answer is?   Do you think the IETF can tell Google and = Cloudflare to stop offering DoH, for example?   Or do you want = us to write a document explaining how to block port 443 on public DoH = resolvers?
Well if Google (who I believe have stated that) and = Cloudflare deploy there DoH servers in a way that e.g enterprises could = block them via IP filtering and we could maybe write that up as a = guideline for DoH server operators it would surely help enterprises. = Similar to if we had a protocol to discover local DoH server or the = presence of split namespaces or policies which DoH clients would follow = this would also help a lot of use cases where DNS is used as a control = plane.

These aren=E2=80=99t unreasonable proposals for new work. =   I believe we are already working on the latter project, and I = don=E2=80=99t oppose that in principle as long as we don=E2=80=99t = create security vulnerabilities in the process.

As far as a =E2=80=9Cbest practices=E2=80= =9D document, we could certainly write one, and it would make sense for = it to say what you are suggesting.  The question I would have is, = who is the target audience?   If Google and Cloudflare are already = doing it, who are you speaking to?

= --Apple-Mail=_47040E72-0B84-46DC-8FC4-8E4DA46A2A09-- From nobody Thu Aug 8 09:01:11 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 34F651200A3 for ; Thu, 8 Aug 2019 09:01:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id I12QhzTF5CVH for ; Thu, 8 Aug 2019 09:01:07 -0700 (PDT) Received: from mail-qt1-x82b.google.com (mail-qt1-x82b.google.com [IPv6:2607:f8b0:4864:20::82b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8C63312006D for ; Thu, 8 Aug 2019 09:01:07 -0700 (PDT) Received: by mail-qt1-x82b.google.com with SMTP id n11so92658984qtl.5 for ; Thu, 08 Aug 2019 09:01:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=qP3gRObiiAFzvXOl+tCJV07qBtjdcnJgsf/an0whYtY=; b=btAU/l+uML2N4Hh1gNYc2UyoJSHe8R6qMRYuKGVJrOD/lG+43qvvWtfCetHTLlxmB5 mASAXNI9fkqCEHByxN0yomah7cZAVVlQImnFTeiyFd5H5NGJZsUcOCSneLdp3gEBHsDY eI8p3qaQqB67EW7qDfXeEarvqtezBFXtYn/lJYvmYm0NdLBxXcjYHIJQbG9q6+wcIl98 VT1z8+lpxmuzFfHwS8aoTZC5ZYVw1sTtMC3XDltfN/0xU/HlN+Ot/HHk2GXCZAZ/fH/F m3JTYnDeqWkzXQ7hpQT/b+aXz5/deiAutLQ7d2lQVc+SXnot7P6JPV8JA0NU9yfUPC3V 6qaw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=qP3gRObiiAFzvXOl+tCJV07qBtjdcnJgsf/an0whYtY=; b=ncIRblFPR+aaPtTmlawv2BUuCs2kcU7Gnv10vo2+iQF66fPC9ecsH+jQUGIDs95gxc guPTMLLoIlSIe2josLlDVTc+JJzud5Sdigu2fmEx08glbA+OUXELLmfujkj76chXl1fH mQbcX00o3yEutJHC5EWy1FUtcZcFl/dMMELXlqmHzonEo2MmZcCGEJSQbGqKykSR6oDE l6ssf0/fIKG6qwsHBPdLCCeL59uvtbeodzVwM/KyQhaYpIPcS9otqqRdZCHXmoUsFqJA fvLzj/uWZ54UjosLMLOpMKQ+tqRxlblWjXgKzD8HMHveNEkNtAGTPo0HH9x20S8N5Do8 P0Fg== X-Gm-Message-State: APjAAAULsxFy+V8i/RUryO/s3zl+2ViyJmcp08nmq4qAkmBR5K7VoPzp UaKnevHz3KDZwgB+vxDqrbEYODR3au0= X-Google-Smtp-Source: APXvYqwTld8jtY4XFFmsPtlAKp4XGS5n/YvCfaP16Yaq/vSSsJ3jXLDHiKXUHtRjnta/SSlJi3MO/A== X-Received: by 2002:ac8:2c35:: with SMTP id d50mr13446509qta.313.1565280066587; Thu, 08 Aug 2019 09:01:06 -0700 (PDT) Received: from [192.168.70.71] ([66.162.194.58]) by smtp.gmail.com with ESMTPSA id f133sm43378613qke.62.2019.08.08.09.01.05 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 08 Aug 2019 09:01:05 -0700 (PDT) From: Suzanne Woolf Message-Id: Content-Type: multipart/alternative; boundary="Apple-Mail=_402C538A-C3AC-493F-A701-F0F122F63DEB" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Thu, 8 Aug 2019 12:00:59 -0400 In-Reply-To: Cc: add@ietf.org To: chris.box@bt.com References: X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: [Add] Where to do work Re: IETF 105 Highlights X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 Aug 2019 16:01:11 -0000 --Apple-Mail=_402C538A-C3AC-493F-A701-F0F122F63DEB Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Hi, This reminded me of a comment at the mic in ADD about DNSOP taking on = some of the work that was being discussed in the BOF. The mic line was = closed but it=E2=80=99s worth addressing that point, given this comment = from Alissa: > On Aug 6, 2019, at 11:40 AM, = wrote: >=20 > As you=E2=80=99ll have seen from 105-attendees, Alissa has posted = https://www.ietf.org/blog/ietf-105-highlights/ = > which I=E2=80=99ll repeat here as it includes this statement on the = outcome of the BoF: > =20 > The ADD BoF sought to identify areas where the IETF community might be = interested in working on protocol standardization or best practices = related to applications doing their own DNS resolution. The wide-ranging = discussion touched on a few such nascent areas, including DNS-over-HTTPS = (DoH) server discovery, means of advertising DNS resolver properties, = and operational best practices. The most conclusive outcome, though, was = a collective realization that it may be time to reorganize DNS-related = work in the IETF to ensure that broad-based participation, cross-area = review, and sufficient agenda and chair time can be dedicated to what is = obviously a pressing set of topics for the industry. Discussions = continue on the mailing list. =46rom my personal perspective as DNSOP co-chair (not speaking for my = co-chairs or the WG by any means, but based on familiarity with what we = do and what seems to work well): For some years now the DNS work in the IETF has been organized roughly = along the lines that DNSOP handles documents that are intended to = address operational matters and are of primary interest to DNS = implementers and operators, while substantive new protocol is done in = dedicated WGs. (The DNSEXT WG was closed because there didn=E2=80=99t = seem to be a lot of protocol work to do at the time; the assumption was = that new WGs would be chartered to deal with specific new work, which is = more or less what happened.) DNSOP includes operators, implementers, and protocol designers, but the = work is generally driven by the need for improvements to operational = practice in meeting established requirements rather than new protocol = for really novel needs. We try to be a good place for protocol = developers in other areas to get review, and if there=E2=80=99s a large = enough chunk of clearly separate work to do, we help spin up a new WG. Our charter limits us as far as protocol work, and that has seemed = reasonable: substantially new protocol, which tends to require focused = effort and significant cross-area participation, gets its own WGs. The dividing line between operations and protocol is a little bit = tricky, especially in the case of operators trying to document the use = of a new RRtype or agree on an interoperable way to use an EDNS option, = and our current charter is deliberately somewhat loose, so we rely on = our AD to keep us out of the weeds. In my personal view, a couple of the documents discussed in the ADD BoF = could reasonably be discussed and eventually published through DNSOP. = But there=E2=80=99s also work that requires substantial expertise from = other areas, particularly TSV and ART, and experience suggests that for = documents requiring a lot of cross-area review, it=E2=80=99s easier for = people to contribute to them in a dedicated WG, without distraction from = other activities in DNSOP. Best, Suzanne --Apple-Mail=_402C538A-C3AC-493F-A701-F0F122F63DEB Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Hi,

This = reminded me of a comment at the mic in ADD about DNSOP taking on some of = the work that was being discussed in the BOF. The mic line was closed = but it=E2=80=99s worth addressing that point, given this comment from = Alissa:

On Aug 6, 2019, at 11:40 AM, <chris.box@bt.com> = <chris.box@bt.com> wrote:

As = you=E2=80=99ll have seen from 105-attendees, Alissa has posted https://www.ietf.org/blog/ietf-105-highlights/
which = I=E2=80=99ll repeat here as it includes this statement on the outcome of = the BoF:
 
The ADD BoF sought to identify areas where the = IETF community might be interested in working on protocol = standardization or best practices related to applications doing their = own DNS resolution. The wide-ranging discussion touched on a few such = nascent areas, including DNS-over-HTTPS (DoH) server discovery, means of = advertising DNS resolver properties, and operational best practices. The = most conclusive outcome, though, was a collective realization that it = may be time to reorganize DNS-related work in the IETF to ensure that = broad-based participation, cross-area review, and sufficient agenda and = chair time can be dedicated to what is obviously a pressing set of = topics for the industry. Discussions continue on the mailing = list.

=46rom my personal perspective as DNSOP co-chair = (not speaking for my co-chairs or the WG by any means, but based on = familiarity with what we do and what seems to work well):

For some years now the DNS work in the IETF has = been organized roughly along the lines that DNSOP handles documents that = are intended to address operational matters and are of primary interest = to DNS implementers and operators, while substantive new protocol is = done in dedicated WGs. (The DNSEXT WG was closed because there didn=E2=80=99= t seem to be a lot of protocol work to do at the time; the assumption = was that new WGs would be chartered to deal with specific new work, = which is more or less what happened.)

DNSOP includes operators, implementers, and = protocol designers, but the work is generally driven by the need for = improvements to operational practice in meeting established requirements = rather than new protocol for really novel needs. We try to be a good = place for protocol developers in other areas to get review, and if = there=E2=80=99s a large enough chunk of clearly separate work to do, we = help spin up a new WG.

Our charter = limits us as far as protocol work, and that has seemed reasonable: = substantially new protocol, which tends to require focused effort and = significant cross-area participation, gets its own WGs.

The dividing line between operations and protocol = is a little bit tricky, especially in the case of operators trying to = document the use of a new RRtype or agree on an interoperable way to use = an EDNS option, and our current charter is deliberately somewhat loose, = so we rely on our AD to keep us out of the weeds.

In my personal view, a couple of the documents = discussed in the ADD BoF could reasonably be discussed and eventually = published through DNSOP. But there=E2=80=99s also work that requires = substantial expertise from other areas, particularly TSV and ART, and = experience suggests that for documents requiring a lot of cross-area = review, it=E2=80=99s easier for people to contribute to them in a = dedicated WG, without distraction from other activities in = DNSOP.




Best,
Suzanne

= --Apple-Mail=_402C538A-C3AC-493F-A701-F0F122F63DEB-- From nobody Thu Aug 8 09:08:44 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7378C120165 for ; Thu, 8 Aug 2019 09:08:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yFU77N4Li_Rd for ; Thu, 8 Aug 2019 09:08:40 -0700 (PDT) Received: from mail-vs1-xe42.google.com (mail-vs1-xe42.google.com [IPv6:2607:f8b0:4864:20::e42]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7A57C12022E for ; Thu, 8 Aug 2019 09:08:32 -0700 (PDT) Received: by mail-vs1-xe42.google.com with SMTP id u124so63434543vsu.2 for ; Thu, 08 Aug 2019 09:08:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=GPiw9xgPM8TyEvvM1uTgTrsGJKlgfARm9mMzwy1aSk4=; b=PfE0kCd3oTkXCeNbDI/dXOYeWQl08nzsKdKtG0Tis32RXWxrKtGEU4QKtBDMrOubIH PROv9WpyEUMv2y0KAr9P7R+YD7wRSqNEUINcLjU8ClipswNjyFuJRqvEkiRI4Xbh8Ejq vMJY2/DsXGnsRlxkWqZB0F7wrrw+erkwUeX6TLejMnho5Japzn8RG+lnTzZ6zdtkJxAL j1YWJKiiWWfNbJMAPy7AKHrZ8Pf/yyQGiaGTPaMRrcisEqG1+szGcj0U3WfG6RAD8a/b ETz4PgRJ8KbFE6gWLlIYk7Wwh8DTN2FN0WC3jF1IRMkSGK/5bInUiZCuPA2OuWp490dF X1ow== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=GPiw9xgPM8TyEvvM1uTgTrsGJKlgfARm9mMzwy1aSk4=; b=p5m6a7TXGaVsJSQ6AulzJwz/0rWevhePoF8PqYtoSTO+FFm6msZoAbpZeBzqF8REN8 huA09WkTZBpv/fXsVS3Uhg05b4qOC2OQYsLemD499AHzSDPff/QXa/ibt6tiVlG43/dJ rNmfVMuOD8yhYIKeNScneWrokByI8PLTuKAD3eZGr0MnSc3h5qS3RxPIkTbrUoCBJH7A 93u+os1TPFnF7v5cw+HvsEGAFsPloo489VzHYSpUYll5kXdDOGqxsCGwA9PUIEYuTxxb ZH1qUAyDv4UNCwasBKAUKC5to5vr4pa1lmbU6puTXS7LiFcSjXR2RESHFXf3iarIiroz MkgQ== X-Gm-Message-State: APjAAAW5YGBLPMnQE/C1ZVL/Tm4ZBzZUzPSimmf/Q1G6Qs5SggYkIGNY bNpZuLQlSzg2GjGnqhs2Va1oU+WqiwhZGWxzvo4= X-Google-Smtp-Source: APXvYqyHtH6g21MLB8vd0Gn6H09NU832QTd7z85WcxFMoEv+aW3FL9M9ndeMcCkn+NYQ9SNFpzTZN1r9UHMoZjRBNXU= X-Received: by 2002:a67:f043:: with SMTP id q3mr9882981vsm.219.1565280509416; Thu, 08 Aug 2019 09:08:29 -0700 (PDT) MIME-Version: 1.0 References: <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <2EF61DAB-8371-4257-82A0-8622A8F2B178@cable.comcast.com> <1FCF97D5-2A18-4CD2-9072-62D87F819CB0@nbcuni.com> <57B9E26F-C1C0-484C-B1B9-8DCDF14B7AD9@gmail.com> <19E9C1A2-B542-4DAA-8B55-9F38C8AE2C58@gmail.com> <2B980050-9BBC-4333-BE20-2846B8A1B9E7@fugue.com> In-Reply-To: <2B980050-9BBC-4333-BE20-2846B8A1B9E7@fugue.com> From: Brian Dickson Date: Thu, 8 Aug 2019 09:08:17 -0700 Message-ID: To: Ted Lemon Cc: Eric Rescorla , "add@ietf.org" , Rob Sayre , Martin Thomson , Bret Jordan , "Deen, Glenn (NBCUniversal)" Content-Type: multipart/alternative; boundary="000000000000bcd9bb058f9d44b4" Archived-At: Subject: Re: [Add] [EXTERNAL] Control X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 Aug 2019 16:08:43 -0000 --000000000000bcd9bb058f9d44b4 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Thu, Aug 8, 2019 at 8:43 AM Ted Lemon wrote: > On Aug 7, 2019, at 11:25 PM, Brian Dickson > wrote: > > People are unhappy that browsers switching to DoH-on-by-default without > informed user consent forces *all* users to bypass any and all > DNS-as-control-and-detection-plane without the impacted users necessarily > having any understanding of the implications or even being aware. In > theory, some of those implications can be personal, especially in > restrictive environments. It is an opt-out vs opt-in situation. > > > This may be true, but two questions come up: > - Which people? Users, or operators? > So far, everyone to whom I've explained what we (in this list) understand about DoH and its various implications. That list includes users, network operators, security ops folks, authority operators, recursive operators in enterprises. > - How do the privacy and security properties of DoH compare with the > privacy and security properties of SP recursive DNS? > I'm not familiar with the acronym "SP", in this context. But, I'd also suggest DoT as an alternative to DoH, since those are very closely matched, even if DoT is not (yet) natively supported by browsers. The security and privacy of DoT can be achieved by using a DoT resolver in "forwarder" mode on your local host, and pointing to that in whatever the host's DNS resolver choice configuration controls are. The benefit of doing that are, the benefits apply to all apps equally. If the DoT resolver supports DoH clients, then you can configure your browser to point at your local host's resolver/forwarder in the DoH config, and get all the fringe benefits on DoH within the browser (if/when those show up). Plus, you can configure the local resolver to do DNSSEC validation. I'd encourage using forward-only mode, so as to gain all the privacy and scaling benefits of continuing to use a non-local resolver, regardless of choice of resolver. Having enterprise resolvers enabling DoT would be a very good thing, and mostly these days that's just a code upgrade and a config change, for most major resolver packages. > > Personally, I don=E2=80=99t actually know on a practical level whether I= =E2=80=99m better > off using DoH or SPrDNS, but given some of the disclosures we=E2=80=99ve = seen > historically about ISP=E2=80=99s behavior with respect to passive snoopin= g, it=E2=80=99s > certainly not a *given* that SPrDNS is better. > > My point here is not to criticize what you are saying, but just to > encourage you to go a little deeper on your assertions. =E2=80=9CPeople= =E2=80=9D is way > too general, for example. > I understand. I was using "people" generally as an answer to an earlier question. > > I don=E2=80=99t know that it would be a bad thing to write a document tal= king > about the tradeoffs that we face here. It might be very difficult, > though, if we can=E2=80=99t be crystal clear about what we=E2=80=99re dis= cussing. > For sure. Brian --000000000000bcd9bb058f9d44b4 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Thu, Aug 8, 2019 at 8:43 AM Ted Le= mon <mellon@fugue.com> wrote:=
On Aug 7, 2019, at 11:25 PM, Brian Dickson <<= a href=3D"mailto:brian.peter.dickson@gmail.com" target=3D"_blank">brian.pet= er.dickson@gmail.com> wrote:
People are unhappy that browser= s switching to DoH-on-by-default without informed user consent forces=C2=A0= all=C2=A0users t= o bypass any and all DNS-as-control-and-detection-plane without the impacte= d users necessarily having any understanding of the implications or even be= ing aware. In theory, some of those implications can be personal, especiall= y in restrictive environments. It is an opt-out vs opt-in situation.=

This may be true, but two questions come = up:
- Which people?=C2=A0 Users, or operators?

So far, everyone to whom I've explained what = we (in this list) understand about DoH and its various implications. That l= ist includes users, network operators, security ops folks, authority operat= ors, recursive operators in enterprises.=C2=A0
=C2=A0
- How do the privacy and security properties of DoH compare= with the privacy and security properties of SP recursive DNS?
<= /blockquote>

I'm not familiar with the acronym "= ;SP", in this context.

But, I'd also sugg= est DoT as an alternative to DoH, since those are very closely matched, eve= n if DoT is not (yet) natively supported by browsers.

<= div>The security and privacy of DoT can be achieved by using a DoT resolver= in "forwarder" mode on your local host, and pointing to that in = whatever the host's DNS resolver choice configuration controls are.

The benefit of doing that are, the benefits apply to = all apps equally.

If the DoT resolver supports DoH= clients, then you can configure your browser to point at your local host&#= 39;s resolver/forwarder in the DoH config, and get all the fringe benefits = on DoH within the browser (if/when those show up).

Plus, you can configure the local resolver to do DNSSEC validation.
<= div>
I'd encourage using forward-only mode, so as to gain= all the privacy and scaling benefits of continuing to use a non-local reso= lver, regardless of choice of resolver.

Having ent= erprise resolvers enabling DoT would be a very good thing, and mostly these= days that's just a code upgrade and a config change, for most major re= solver packages.
=C2=A0

Personally, I don=E2=80=99t actually know on a practical level whether I= =E2=80=99m better off using DoH or SPrDNS, but given some of the disclosure= s we=E2=80=99ve seen historically about ISP=E2=80=99s behavior with respect= to passive snooping, it=E2=80=99s certainly not a given=C2=A0that SPrDNS is better.

My point here is not to c= riticize what you are saying, but just to encourage you to go a little deep= er on your assertions. =C2=A0=E2=80=9CPeople=E2=80=9D is way too general, f= or example.

I understand. I was= using "people" generally as an answer to an earlier question.
=C2=A0

I don=E2=80=99t kn= ow that it would be a bad thing to write a document talking about the trade= offs that we face here. =C2=A0 It might be very difficult, though, if we ca= n=E2=80=99t be crystal clear about what we=E2=80=99re discussing.

For sure.

Brian= =C2=A0
--000000000000bcd9bb058f9d44b4-- From nobody Thu Aug 8 09:32:03 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 701B7120270 for ; Thu, 8 Aug 2019 09:32:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=hopcount.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Q-peh-tW2Wfx for ; Thu, 8 Aug 2019 09:31:59 -0700 (PDT) Received: from mail-ot1-x32c.google.com (mail-ot1-x32c.google.com [IPv6:2607:f8b0:4864:20::32c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A4EC4120147 for ; Thu, 8 Aug 2019 09:31:59 -0700 (PDT) Received: by mail-ot1-x32c.google.com with SMTP id s20so55514588otp.4 for ; Thu, 08 Aug 2019 09:31:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hopcount.ca; s=google; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=FmK/5eNIMDaue8sw9wij+LMbqjqbCEmQHjUvQ7T6nSU=; b=hjuGnJ/0uGkH0JQ+RzPRqfavIvqiNIAGLuRiQMjwwPLpc6uKu+3y3lAwq5RPN8/Qsv /+twCW4C/3eyjDqQ4EyAkU+qrfg8QcB0iJpSD/ftz89VSVa2lQ2/Vo28QdYGAcSdD7Mx M/RxiWzf3prJYI+NUmC8ylfGrY3aYBJc+LDhs= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=FmK/5eNIMDaue8sw9wij+LMbqjqbCEmQHjUvQ7T6nSU=; b=nGgwua60imFz1ZXwI3jSSurqsWf9QYCUVBuedP9m8zBfjKBZ0aG3wfj2t6YcbZ2fdd 5iOpk/BSTDo+TAkqZetsGmkIQbXpWRdypI4n4dGKu3eXP9wqUgF6BQWZf3QqewDsj2Pa kaSGwaipDcUPnMEiKbXRjU5cL1j08M+9I6UvnxNZ2ek4jN1e6uQzzCjzfgLS+yETkGZE YPAbgscHKoVGxfUeVcO6r+XxDiUyza3EllHskcd8ycxkKIPaUEXrhh+o6TId4n5WvEoA kjdhJz3DR4w5s5bEmzWp7TSZFzitaVFtuLkHcDjU67vHi31RLD76y2CXtT+t2dmPyC7C r/dg== X-Gm-Message-State: APjAAAUldiuCWCsYv3elm7hSMYbX68iRcTN30pZ14A+7YAVB1XeKSD/o N98QBwjW+Jkv60sk2zutHX7yuQ== X-Google-Smtp-Source: APXvYqy8lR6puZ2E4ysNniRAXa6p5/3TKFro1MIL434RNMytA+XNqcSZvBZP0fVDp7wJs3jvRmUWKw== X-Received: by 2002:a6b:621a:: with SMTP id f26mr14437991iog.127.1565281918761; Thu, 08 Aug 2019 09:31:58 -0700 (PDT) Received: from [192.168.1.50] (24-246-23-138.cable.teksavvy.com. [24.246.23.138]) by smtp.gmail.com with ESMTPSA id o3sm1785856ioo.74.2019.08.08.09.31.57 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 08 Aug 2019 09:31:57 -0700 (PDT) From: Joe Abley Message-Id: <3F573261-D6E5-4AC8-B344-BA47B7CA906C@hopcount.ca> Content-Type: multipart/signed; boundary="Apple-Mail=_5CFB4387-A8B2-4E34-A1DA-7EEB3579C66F"; protocol="application/pgp-signature"; micalg=pgp-sha1 Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Thu, 8 Aug 2019 12:31:56 -0400 In-Reply-To: <7FA2E20B-FD25-4BED-9A81-F42000BFDB39@gmail.com> Cc: add@ietf.org To: Bret Jordan References: <6474D9D5-4AD0-4A98-8926-F38600F9D8AE@hopcount.ca> <7FA2E20B-FD25-4BED-9A81-F42000BFDB39@gmail.com> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] New WG or new Area X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 Aug 2019 16:32:02 -0000 --Apple-Mail=_5CFB4387-A8B2-4E34-A1DA-7EEB3579C66F Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Hi Bret, On 8 Aug 2019, at 11:39, Bret Jordan wrote: > There is a lot of moving parts in and around DNS, from the protocol = design side to the operational side. DNS is a critical aspect that = really demands more focus and attention in the IETF. I believe having = its own area would encourage better communication and dialog between the = various groups and various users. It would also get us out of the =E2=80=9C= we design things over here=E2=80=9D and we leave it up to the =E2=80=9Coth= er side=E2=80=9D to deal with operational aspects. We need people = talking and working together. We need everyone to understand both sides = of the problems. >=20 > I think it is also critical that the leaders (chairs or ADs) be = individuals that are operators, this is why I think people like Glenn = and Barbara would be brilliant for this work. There's a very active DNS community at the IETF. We never have a problem = filling rooms, often in multiple sessions per working group. The mailing = lists are active, the community is engaged and diverse, there's a long = history of substantive progress and the leadership (working group chairs = and ADs) is strong and effective. If I was going to point a = constructive, critical finger at any part of the IETF and suggest that = improvements could be made, I don't think the DNS is where I would = start. However, you seem to be suggesting that all of this is insufficient, and = that more is needed. I encourage you to explain that in more detail. I = would certainly hope that any proposal for change acknowledged the = effectiveness of what we already had and took care to preserve and build = on it rather than simply shuffling the org chart and crossing fingers, = or adding additional layers of management for the sake of it. If your conclusion is based on the difficulties evident on this mailing = list to come to consensus, remember that this is a topic which almost by = definition is filled with tension between different interests. Nobody = needs privacy unless there's surveillance or control. Nobody cares if = privacy exists unless they have a reason to circumvent it. We have seen = conflict and communications problems before; we will see more in the = future. Welcome to the IETF. If there's any reasonable conclusion from this group it's to acknowledge = the existence of the different communities of interest, explain why = their individual hopes and dreams are reasonable and self-consistent, = and point out that they are never going to agree. The technical work to = follow is mitigating the conflict between the groups, not imagining that = there is some grand unified solution to what is at its essence an = intractable problem. Joe --Apple-Mail=_5CFB4387-A8B2-4E34-A1DA-7EEB3579C66F Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iF0EARECAB0WIQSAt40QkiztAcvphdg0jwy9hlI6LAUCXUxOfAAKCRA0jwy9hlI6 LPYLAKCy7t0icfjrnNDG/opaAwe/d0SingCfZ8M9Y89+PCwJz14LsKqc3EaAxrI= =Njrg -----END PGP SIGNATURE----- --Apple-Mail=_5CFB4387-A8B2-4E34-A1DA-7EEB3579C66F-- From nobody Thu Aug 8 09:46:53 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A8EDA120172 for ; Thu, 8 Aug 2019 09:46:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.299 X-Spam-Level: X-Spam-Status: No, score=-4.299 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=swm.pp.se Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0lWiW3A3AphE for ; Thu, 8 Aug 2019 09:46:49 -0700 (PDT) Received: from uplift.swm.pp.se (swm.pp.se [212.247.200.143]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5DE72120125 for ; Thu, 8 Aug 2019 09:46:49 -0700 (PDT) Received: by uplift.swm.pp.se (Postfix, from userid 501) id D8C2AB4; Thu, 8 Aug 2019 18:46:46 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=swm.pp.se; s=mail; t=1565282806; bh=eyZY+2Imkijhz2Otce6Stlqwv8kyoe484wz0y4Snd9c=; h=Date:From:To:cc:Subject:In-Reply-To:References:From; b=FyajuFyt/oMlTYvN44wJDOYPqVyD0gdNy9hXS0loKy5qWQ/jD0Zfb4FNK8sNiTs+e gVus4XtlkBEytJ9bZbBaPoTAu/AzIyjjlYeFI+bUbLwouLg62rN7Qyi23S2HWphVmT Ec0gmUDiJBrXSG5k5l5CxCWt7SClb6GYLRwWA3iA= Received: from localhost (localhost [127.0.0.1]) by uplift.swm.pp.se (Postfix) with ESMTP id D61B7B1; Thu, 8 Aug 2019 18:46:46 +0200 (CEST) Date: Thu, 8 Aug 2019 18:46:46 +0200 (CEST) From: Mikael Abrahamsson To: Ted Lemon cc: Brian Dickson , Eric Rescorla , "Deen, Glenn (NBCUniversal)" , Rob Sayre , "add@ietf.org" , Bret Jordan , Martin Thomson In-Reply-To: <2B980050-9BBC-4333-BE20-2846B8A1B9E7@fugue.com> Message-ID: References: <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <2EF61DAB-8371-4257-82A0-8622A8F2B178@cable.comcast.com> <1FCF97D5-2A18-4CD2-9072-62D87F819CB0@nbcuni.com> <57B9E26F-C1C0-484C-B1B9-8DCDF14B7AD9@gmail.com> <19E9C1A2-B542-4DAA-8B55-9F38C8AE2C58@gmail.com> <2B980050-9BBC-4333-BE20-2846B8A1B9E7@fugue.com> User-Agent: Alpine 2.20 (DEB 67 2015-01-07) Organization: People's Front Against WWW MIME-Version: 1.0 Content-Type: multipart/mixed; BOUNDARY="-137064504-1627346043-1565282806=:21828" Archived-At: Subject: Re: [Add] [EXTERNAL] Control X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 Aug 2019 16:46:52 -0000 This message is in MIME format. The first part should be readable text, while the remaining parts are likely unreadable without MIME-aware tools. ---137064504-1627346043-1565282806=:21828 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8BIT On Thu, 8 Aug 2019, Ted Lemon wrote: > Personally, I don’t actually know on a practical level whether I’m > better off using DoH or SPrDNS, but given some of the disclosures we’ve > seen historically about ISP’s behavior with respect to passive snooping, > it’s certainly not a given that SPrDNS is better. That is exactly the point. There is no one-size-fits-all. Speaking from personal view: If I am at home I want to use my ISP provided resolver. If I am at some random open wifi I want to use a cloud DoH resolver. This is not possible today, and I'd like this to be configurable by me. Otoh, if my browser vendor decides to without asking me in a unilateral action during a regular version upgrade change that I should use some (to me) random US based DoH provider with no GDPR protection I'm going to take that as huge betrayal of my trust in that product. -- Mikael Abrahamsson email: swmike@swm.pp.se ---137064504-1627346043-1565282806=:21828-- From nobody Thu Aug 8 09:50:08 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3FB2D12024E for ; Thu, 8 Aug 2019 09:49:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RqcxpsxCFo9s for ; Thu, 8 Aug 2019 09:49:53 -0700 (PDT) Received: from mail-pl1-x62e.google.com (mail-pl1-x62e.google.com [IPv6:2607:f8b0:4864:20::62e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7357112022E for ; Thu, 8 Aug 2019 09:49:53 -0700 (PDT) Received: by mail-pl1-x62e.google.com with SMTP id k8so43786947plt.3 for ; Thu, 08 Aug 2019 09:49:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=vRRMRYwXzZuIi1KzOdELhBmzI20f5SLKsxrAzzNaUrw=; b=BsW5UUGvRUi5AhW87DMZ7xO9HZRxU2N9B6+elzt09FmzeL77DmNz4IlZGCKtZQrcCY RRCjeS0oRhFx/PWn2Vei0I0dNXrIT4qyhyRThNaMplhKATgi72nEnFcjn/O8vkmeMw4Y bRRGjCslR1u+askJ/OwBADXJjoLl8a14g6nj031oZ7lXvF5PCXoOvmNhNLBy9UCldbS/ MVXYZU/sGI+kDq4IhofRKzq33LVad3ZhPWzv+Etxxpn576mCvuuKcUhcEZTRrB0h/3zG 9kinJ8pHRyD7b4Dax2VdOP+Vh0MNQ92y42mmVj9Q8hFf6Vvi0wRQLVx2pC0iV2BL8ZGP ZJ4Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=vRRMRYwXzZuIi1KzOdELhBmzI20f5SLKsxrAzzNaUrw=; b=s/aq1r8pVRUM3rFvxTgSc1/CiNBSGFyB0hM8ScXHlEOFe07gUIAY2T1fDDfSsB7fml cm3qPg0EohQKkAv9i4sliZXe/CNi+muw+1rxiD6W/AABvh+MxykBw4NCTcs0RVwHMk/Z QsipEJDZJS+MfhgH/dXg5FpzmUL/5oyxOYC87MDRzWqx4xHmep4a5V4d05XmcL0ZRxrg fvfzTtiyboLZpBVYqZvOzVxohgwgiXJodZCcRBhHNmXmGW8Hod8MLSuwU+r33RoVU2dm 5gG78/qldu6KdBb/7BOKsD0ht5+Y3rztQkiSDMchR1FVcePWQXxF0/1HGpcG756sQJB+ U93A== X-Gm-Message-State: APjAAAX/T7RpLoi+PgldWvnK5c6C2sAgQd3lmwmHCaHopaBnF89F7t2Q A3kkftOREMAOEph2Hkaif5fOvzwbZ44= X-Google-Smtp-Source: APXvYqwPZmfk0itlknQmJl8ps4z+0lMBNGFxtExLtxHVTb+ot5Hv7ccZBN81iPeNQTerJSzUQLb6UA== X-Received: by 2002:a17:902:a607:: with SMTP id u7mr14728216plq.43.1565282992917; Thu, 08 Aug 2019 09:49:52 -0700 (PDT) Received: from [17.230.1.0] ([17.230.1.0]) by smtp.gmail.com with ESMTPSA id s72sm4960292pgc.92.2019.08.08.09.49.52 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 08 Aug 2019 09:49:52 -0700 (PDT) From: Ted Lemon Message-Id: <339AAAC4-F8DE-42FC-86F9-47970EC94050@fugue.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_3128F196-EB0D-4765-BBEE-01808C13213B" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Thu, 8 Aug 2019 09:49:50 -0700 In-Reply-To: Cc: "add@ietf.org" To: Mikael Abrahamsson References: <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <2EF61DAB-8371-4257-82A0-8622A8F2B178@cable.comcast.com> <1FCF97D5-2A18-4CD2-9072-62D87F819CB0@nbcuni.com> <57B9E26F-C1C0-484C-B1B9-8DCDF14B7AD9@gmail.com> <19E9C1A2-B542-4DAA-8B55-9F38C8AE2C58@gmail.com> <2B980050-9BBC-4333-BE20-2846B8A1B9E7@fugue.com> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] [EXTERNAL] Control X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 Aug 2019 16:50:08 -0000 --Apple-Mail=_3128F196-EB0D-4765-BBEE-01808C13213B Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii On Aug 8, 2019, at 9:46 AM, Mikael Abrahamsson wrote: > This is not possible today, and I'd like this to be configurable by = me. Okay, but people who are going to configure this are a tiny minority. = Is it worth spending time documenting best practices to support this use = case? --Apple-Mail=_3128F196-EB0D-4765-BBEE-01808C13213B Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii On = Aug 8, 2019, at 9:46 AM, Mikael Abrahamsson <swmike@swm.pp.se> = wrote:
This is not = possible today, and I'd like this to be configurable by me.

Okay, but people who are going to configure this are a tiny = minority.   Is it worth spending time documenting best practices to = support this use case?

= --Apple-Mail=_3128F196-EB0D-4765-BBEE-01808C13213B-- From nobody Thu Aug 8 09:54:36 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5C6E0120251 for ; Thu, 8 Aug 2019 09:54:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pYOC0U5SAYIL for ; Thu, 8 Aug 2019 09:54:05 -0700 (PDT) Received: from mail.dragon.net (mail.dragon.net [IPv6:2001:4f8:3:36::235]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4477812022E for ; Thu, 8 Aug 2019 09:53:55 -0700 (PDT) Received: from fafnir.remote.dragon.net (localhost [IPv6:::1]) by mail.dragon.net (Postfix) with ESMTP id DE23837401C0; Thu, 8 Aug 2019 09:53:54 -0700 (PDT) Received: by fafnir.remote.dragon.net (Postfix, from userid 501) id B3EC6163564F; Thu, 8 Aug 2019 10:53:54 -0600 (MDT) Received: from fafnir.local (localhost [127.0.0.1]) by fafnir.remote.dragon.net (Postfix) with ESMTP id AE381163564E; Thu, 8 Aug 2019 10:53:54 -0600 (MDT) From: Paul Ebersman To: Ted Lemon cc: add@ietf.org In-reply-to: <339AAAC4-F8DE-42FC-86F9-47970EC94050@fugue.com> References: <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <2EF61DAB-8371-4257-82A0-8622A8F2B178@cable.comcast.com> <1FCF97D5-2A18-4CD2-9072-62D87F819CB0@nbcuni.com> <57B9E26F-C1C0-484C-B1B9-8DCDF14B7AD9@gmail.com> <19E9C1A2-B542-4DAA-8B55-9F38C8AE2C58@gmail.com> <2B980050-9BBC-4333-BE20-2846B8A1B9E7@fugue.com> <339AAAC4-F8DE-42FC-86F9-47970EC94050@fugue.com> Comments: In-reply-to Ted Lemon message dated "Thu, 08 Aug 2019 09:49:50 -0700." X-Mailer: MH-E 7.4.2; nmh 1.7.1; XEmacs 21.4 (patch 22) MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-ID: <67394.1565283234.1@fafnir.local> Date: Thu, 08 Aug 2019 10:53:54 -0600 Message-Id: <20190808165354.B3EC6163564F@fafnir.remote.dragon.net> Archived-At: Subject: Re: [Add] [EXTERNAL] Control X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 Aug 2019 16:54:17 -0000 swmike> This is not possible today, and I'd like this to be configurable swmike> by me. mellon> Okay, but people who are going to configure this are a tiny mellon> minority. Is it worth spending time documenting best practices mellon> to support this use case? Now we get back into some kind of semi-useful autodiscovery and more thoughtful default values. I think Mikael's use case would be useful to many folks if they didn't have to do a lot of poking around or it was done for them. From nobody Thu Aug 8 10:44:28 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 20B4912021C for ; Thu, 8 Aug 2019 10:44:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.299 X-Spam-Level: X-Spam-Status: No, score=-4.299 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=swm.pp.se Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eXK0yPTubUT5 for ; Thu, 8 Aug 2019 10:44:25 -0700 (PDT) Received: from uplift.swm.pp.se (swm.pp.se [212.247.200.143]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2A15C1201F3 for ; Thu, 8 Aug 2019 10:44:25 -0700 (PDT) Received: by uplift.swm.pp.se (Postfix, from userid 501) id 05720B7; Thu, 8 Aug 2019 19:44:21 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=swm.pp.se; s=mail; t=1565286261; bh=0tEchKcys2UV2T+9G+0IgYy1Q3uaOq4SclJy2jq3MUg=; h=Date:From:To:cc:Subject:In-Reply-To:References:From; b=cbzzwW/5W6X2ompktmoAluUDLjoNmN/ExuirC1O+oLGVG0laS0zLOxwkrQt09eBWi 5d+iWPbpUYqadR1eCq2UQW/IUQPfZh5NYsmg3HtrMcni8DOGEWv2LJ8jQA8XME9Xa0 WIQ/I17HL2GaZqE/crAiwkUKS5KLXADEBsCmtgJQ= Received: from localhost (localhost [127.0.0.1]) by uplift.swm.pp.se (Postfix) with ESMTP id 00BDEB1; Thu, 8 Aug 2019 19:44:20 +0200 (CEST) Date: Thu, 8 Aug 2019 19:44:20 +0200 (CEST) From: Mikael Abrahamsson To: Ted Lemon cc: "add@ietf.org" In-Reply-To: <339AAAC4-F8DE-42FC-86F9-47970EC94050@fugue.com> Message-ID: References: <2EF61DAB-8371-4257-82A0-8622A8F2B178@cable.comcast.com> <1FCF97D5-2A18-4CD2-9072-62D87F819CB0@nbcuni.com> <57B9E26F-C1C0-484C-B1B9-8DCDF14B7AD9@gmail.com> <19E9C1A2-B542-4DAA-8B55-9F38C8AE2C58@gmail.com> <2B980050-9BBC-4333-BE20-2846B8A1B9E7@fugue.com> <339AAAC4-F8DE-42FC-86F9-47970EC94050@fugue.com> User-Agent: Alpine 2.20 (DEB 67 2015-01-07) Organization: People's Front Against WWW MIME-Version: 1.0 Content-Type: text/plain; format=flowed; charset=US-ASCII Archived-At: Subject: Re: [Add] [EXTERNAL] Control X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 Aug 2019 17:44:27 -0000 On Thu, 8 Aug 2019, Ted Lemon wrote: > Okay, but people who are going to configure this are a tiny minority. > Is it worth spending time documenting best practices to support this use > case? I don't know what "this use case" you're refering to out of what I wrote. I want to be asked each network attachment if I trust the operator of this network. In my mind that's the entire thing we're discussing here. Windows is doing this question when I connect somewhere new, and they have a decently large installed base that they probably have some experience with how users handle this. There is no "DoH via cloud-based quad-X provider is the right thing" vs "system resolver is the right thing" heuristic that'll get it right even most of the time. Some people are claiming that ISPs and governments are crooks and not to be trusted. Other people are claiming cloud-based quad-X providers are commercial greedy data-gathering data-suckers. Both and none of this can be true depending on your views, where you are in the world, and a lot of other factors. There is no single answer to this that is correct for all situations and all users. This is not a one-size-fits-all. I can't believe some people are making this extremely complicated issue into "let's use cloud-based quad-X DoH for the entire user-base because that's the right answer". It's just mindboggling. -- Mikael Abrahamsson email: swmike@swm.pp.se From nobody Thu Aug 8 11:43:54 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 43289120165 for ; Thu, 8 Aug 2019 11:43:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2Fvr-xdRmqTK for ; Thu, 8 Aug 2019 11:43:50 -0700 (PDT) Received: from mx43-out1.antispamcloud.com (mx43-out1.antispamcloud.com [138.201.61.189]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 78A281200E9 for ; Thu, 8 Aug 2019 11:43:50 -0700 (PDT) Received: from xse71.mail2web.com ([66.113.196.71] helo=xse.mail2web.com) by mx63.antispamcloud.com with esmtp (Exim 4.89) (envelope-from ) id 1hvnO6-0000SQ-3P for add@ietf.org; Thu, 08 Aug 2019 20:43:46 +0200 Received: from xsmtp22.mail2web.com (unknown [10.100.68.61]) by xse.mail2web.com (Postfix) with ESMTPS id 464HMM568Rz1Qhh for ; Thu, 8 Aug 2019 11:43:43 -0700 (PDT) Received: from [10.5.2.17] (helo=xmail07.myhosting.com) by xsmtp22.mail2web.com with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.92) (envelope-from ) id 1hvnO3-00006n-Ih for add@ietf.org; Thu, 08 Aug 2019 11:43:43 -0700 Received: (qmail 23098 invoked from network); 8 Aug 2019 18:43:43 -0000 Received: from unknown (HELO [192.168.1.108]) (Authenticated-user:_huitema@huitema.net@[172.58.43.143]) (envelope-sender ) by xmail07.myhosting.com (qmail-ldap-1.03) with ESMTPA for ; 8 Aug 2019 18:43:43 -0000 To: add@ietf.org References: <2EF61DAB-8371-4257-82A0-8622A8F2B178@cable.comcast.com> <1FCF97D5-2A18-4CD2-9072-62D87F819CB0@nbcuni.com> <57B9E26F-C1C0-484C-B1B9-8DCDF14B7AD9@gmail.com> <19E9C1A2-B542-4DAA-8B55-9F38C8AE2C58@gmail.com> <2B980050-9BBC-4333-BE20-2846B8A1B9E7@fugue.com> <339AAAC4-F8DE-42FC-86F9-47970EC94050@fugue.com> From: Christian Huitema Openpgp: preference=signencrypt Autocrypt: addr=huitema@huitema.net; prefer-encrypt=mutual; keydata= mQENBFIRX8gBCAC26usy/Ya38IqaLBSu33vKD6hP5Yw390XsWLaAZTeQR64OJEkoOdXpvcOS HWfMIlD5s5+oHfLe8jjmErFAXYJ8yytPj1fD2OdSKAe1TccUBiOXT8wdVxSr5d0alExVv/LO I/vA2aU1TwOkVHKSapD7j8/HZBrqIWRrXUSj2f5n9tY2nJzG9KRzSG0giaJWBfUFiGb4lvsy IaCaIU0YpfkDDk6PtK5YYzuCeF0B+O7N9LhDu/foUUc4MNq4K3EKDPb2FL1Hrv0XHpkXeMRZ olpH8SUFUJbmi+zYRuUgcXgMZRmZFL1tu6z9h6gY4/KPyF9aYot6zG28Qk/BFQRtj7V1ABEB AAG0J0NocmlzdGlhbiBIdWl0ZW1hIDxodWl0ZW1hQGh1aXRlbWEubmV0PokBOQQTAQIAIwUC UhFfyAIbLwcLCQgHAwIBBhUIAgkKCwQWAgMBAh4BAheAAAoJEJNDCbJVyA1yhbYH/1ud6x6m VqGIp0JcZUfSQO8w+TjugqxCyGNn+w/6Qb5O/xENxNQ4HaMQ5uSRK9n8WKKDDRSzwZ4syKKf wbkfj05vgFxrjCynVbm1zs2X2aGXh+PxPL/WHUaxzEP7KjYbLtCUZDRzOOrm+0LMktngT/k3 6+EZoLEM52hwwpIAzJoscyEz7QfqMOZtFm6xQnlvDQeIrHx0KUvwo/vgDLK3SuruG1CSHcR0 D24kEEUa044AIUKBS3b0b8AR7f6mP2NcnLpdsibtpabi9BzqAidcY/EjTaoea46HXALk/eJd 6OLkLE6UQe1PPzQC4jB7rErX2BxnSkHDw50xMgLRcl5/b1a5AQ0EUhFfyAEIAKp7Cp8lqKTV CC9QiAf6QTIjW+lie5J44Ad++0k8gRgANZVWubQuCQ71gxDWLtxYfFkEXjG4TXV/MUtnOliG 5rc2E+ih6Dg61Y5PQakm9OwPIsOx+2R+iSW325ngln2UQrVPgloO83QiUoi7mBJPbcHlxkhZ bd3+EjFxSLIQogt29sTcg2oSh4oljUpz5niTt69IOfZx21kf29NfDE+Iw56gfrxI2ywZbu5o G+d0ZSp0lsovygpk4jK04fDTq0vxjEU5HjPcsXC4CSZdq5E2DrF4nOh1UHkHzeaXdYR2Bn1Y wTePfaHBFlvQzI+Li/Q6AD/uxbTM0vIcsUxrv3MNHCUAEQEAAYkCPgQYAQIACQUCUhFfyAIb LgEpCRCTQwmyVcgNcsBdIAQZAQIABgUCUhFfyAAKCRC22tOSFDh1UOlBB/94RsCJepNvmi/c YiNmMnm0mKb6vjv43OsHkqrrCqJSfo95KHyl5Up4JEp8tiJMyYT2mp4IsirZHxz/5lqkw9Az tcGAF3GlFsj++xTyD07DXlNeddwTKlqPRi/b8sppjtWur6Pm+wnAHp0mQ7GidhxHccFCl65w uT7S/ocb1MjrTgnAMiz+x87d48n1UJ7yIdI41Wpg2XFZiA9xPBiDuuoPwFj14/nK0elV5Dvq 4/HVgfurb4+fd74PV/CC/dmd7hg0ZRlgnB5rFUcFO7ywb7/TvICIIaLWcI42OJDSZjZ/MAzz BeXm263lHh+kFxkh2LxEHnQGHCHGpTYyi4Z3dv03HtkH/1SI8joQMQq00Bv+RdEbJXfEExrT u4gtdZAihwvy97OPA2nCdTAHm/phkzryMeOaOztI4PS8u2Ce5lUB6P/HcGtK/038KdX5MYST Fn8KUDt4o29bkv0CUXwDzS3oTzPNtGdryBkRMc9b+yn9+AdwFEH4auhiTQXPMnl0+G3nhKr7 jvzVFJCRif3OAhEm4vmBNDE3uuaXFQnbK56GJrnqVN+KX5Z3M7X3fA8UcVCGOEHXRP/aubiw Ngawj0V9x+43kUapFp+nF69R53UI65YtJ95ec4PTO/Edvap8h1UbdEOc4+TiYwY1TBuIKltY 1cnrjgAWUh/Ucvr++/KbD9tD6C8= Message-ID: <93ca9201-926e-b9bf-4ced-e2b911829790@huitema.net> Date: Thu, 8 Aug 2019 11:43:42 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: <339AAAC4-F8DE-42FC-86F9-47970EC94050@fugue.com> Content-Type: multipart/alternative; boundary="------------044E04D95736348E883EA602" Content-Language: en-US X-Originating-IP: 66.113.196.71 X-Spampanel-Domain: xsmtpout.mail2web.com X-Spampanel-Username: 66.113.196.71/32 Authentication-Results: antispamcloud.com; auth=pass smtp.auth=66.113.196.71/32@xsmtpout.mail2web.com X-Spampanel-Outgoing-Class: unsure X-Spampanel-Outgoing-Evidence: Combined (0.15) X-Recommended-Action: accept X-Filter-ID: Mvzo4OR0dZXEDF/gcnlw0YiRRkpbHZ8F3zevhEShTfypSDasLI4SayDByyq9LIhVUZbR67CQ7/vm /hHDJU4RXkTNWdUk1Ol2OGx3IfrIJKywOmJyM1qr8uRnWBrbSAGDNzOpszOkW3faMySFwG163+fH zJ6mVE7ewsipSVIfs4ZBY+mcI44RFJ0Dlo3ZZk5bgyWFxOA5dILPypvKxNVhWQwOVcNrdpWfEYrY fLBY3+cNeCzkayK9X+vYtyDmRenUmdySlZou9qHIGOZDEEo7O2nS6C1mWTD2n8BB0gTSSfDtw+Ut ziY+nbU7qa50sEXj8hEv6ylbrSataIASdByf+qyWDcKgIew/Pqmv8CiR0A+Ffy7fEg460Hn2xYnW avStyzAiWbbj13U46jbWFIz21cHX/YzWyFk7762whX3QQ+5uhkPm88V7ziklAaTl19sU919xeAvO xjeQEcL5lNmXdGd9U9Oojh2QY0MMPWjRsTVhMmX9VvKuj6psZloQqgYBwH0r+197ykuYmDR9wbL2 DBEuqNMl4E+tMKMsv/A3u4xFRxF9LSHNsZFl22lrRRn/H0knlMgOQTVp+x1fo2EPmz5tsQu9R3vp aAMkTA7gTKqVGbaBU36estKbCefORKSQA1jwOIpuA4DxfEIBaJncjRO8u0ag4+i9kLOW9cRnakck FLtcpMHjJASZTev3t2s68YhI0T+E7bfVzyzh3DkvygyEZ9MYp5iiF2omUcFCWyED1PPzOsG33yyA 8qXpqrEsJwCelAgxI3HE4I5TUXrjZnHSKQudzvsK8tNWbQ5BDQA2X2UPo8BDG3g1SEKwDE95ZuM7 jUXIESohoO51xWmU8b6nvhh4t4ghrEakeaI2PBbfry5RCeOVi46q5cnBoFUl86LodOZj79xdSjzK bqR5XHk0qi1hkw/hDGKWkPVYlXF3BhZxGgZFOwvGprxNGaa6/2rAztFeklLxGNN3KHaPkMjB65Ki hPq1I9TXHnOlSkg/OIORZDl9o+TmclcfPTQwNGP0PwcsocAqk8Y/wQ+e4HndwcgUdq9CmjcVQOst ghA= X-Report-Abuse-To: spam@quarantine9.antispamcloud.com Archived-At: Subject: Re: [Add] [EXTERNAL] Control X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 Aug 2019 18:43:54 -0000 This is a multi-part message in MIME format. --------------044E04D95736348E883EA602 Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: quoted-printable On 8/8/2019 9:49 AM, Ted Lemon wrote: > On Aug 8, 2019, at 9:46 AM, Mikael Abrahamsson > wrote: >> This is not possible today, and I'd like this to be configurable by me= =2E > > Okay, but people who are going to configure this are a tiny minority. > =A0 Is it worth spending time documenting best practices to support thi= s > use case? Ted, There is actually a similar example in the Windows world. Users who connect to a network are asked whether they consider the network "public" or "private". If the network is private, the system will enable file and print sharing over the network, which is convenient but also significantly increases the attack surface. If the network is public, the system will close that surface by default. There is a system API that exposes the status of the network (https://docs.microsoft.com/en-us/windows/win32/api/netlistmgr/nf-netlist= mgr-inetwork-getcategory), and applications can use that to change their behavior if they wish. It would not be absurd to configure the browser and other applications to use DoH on a public network and the local DNS service on a=A0 private network, or in an enterprise network. -- Christian Huitema --------------044E04D95736348E883EA602 Content-Type: text/html; charset=windows-1252 Content-Transfer-Encoding: 8bit


On 8/8/2019 9:49 AM, Ted Lemon wrote:
On Aug 8, 2019, at 9:46 AM, Mikael Abrahamsson <swmike@swm.pp.se> wrote:
This is not possible today, and I'd like this to be configurable by me.

Okay, but people who are going to configure this are a tiny minority. Is it worth spending time documenting best practices to support this use case?


Ted,

There is actually a similar example in the Windows world. Users who connect to a network are asked whether they consider the network "public" or "private". If the network is private, the system will enable file and print sharing over the network, which is convenient but also significantly increases the attack surface. If the network is public, the system will close that surface by default. There is a system API that exposes the status of the network (https://docs.microsoft.com/en-us/windows/win32/api/netlistmgr/nf-netlistmgr-inetwork-getcategory), and applications can use that to change their behavior if they wish.

It would not be absurd to configure the browser and other applications to use DoH on a public network and the local DNS service on a private network, or in an enterprise network.

-- Christian Huitema

--------------044E04D95736348E883EA602-- From nobody Thu Aug 8 12:14:47 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3E66C120147 for ; Thu, 8 Aug 2019 12:14:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.996 X-Spam-Level: X-Spam-Status: No, score=-1.996 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nohats.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sRDM5AaS1iEG for ; Thu, 8 Aug 2019 12:14:43 -0700 (PDT) Received: from mx.nohats.ca (mx.nohats.ca [193.110.157.68]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7A1DA1200F8 for ; Thu, 8 Aug 2019 12:14:43 -0700 (PDT) Received: from localhost (localhost [IPv6:::1]) by mx.nohats.ca (Postfix) with ESMTP id 464J344qP6zL2w; Thu, 8 Aug 2019 21:14:40 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nohats.ca; s=default; t=1565291680; bh=HiT2NvIKZ/V6iquKwTJyAaruWbhBt41YNEw2PzWof3s=; h=Subject:From:In-Reply-To:Date:Cc:References:To; b=oA6hlZdLgh8Dg/myFrXbEeiv5IAjcy3wW6/GQeSN5wag0jsgnXD+ZtlYA/OhA2Ci3 9VzbPhYOtL7i8pP38teje3AMuV/WOd+iiCkYV6Ix7FeBWpgN4p4+OI1BVbykw4lSDU GCNkXbPaNjoBXTz2PinTuprcJbunSsA8BAPEXrEo= X-Virus-Scanned: amavisd-new at mx.nohats.ca Received: from mx.nohats.ca ([IPv6:::1]) by localhost (mx.nohats.ca [IPv6:::1]) (amavisd-new, port 10024) with ESMTP id kyG5UkH0A7PA; Thu, 8 Aug 2019 21:14:39 +0200 (CEST) Received: from bofh.nohats.ca (bofh.nohats.ca [76.10.157.69]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx.nohats.ca (Postfix) with ESMTPS; Thu, 8 Aug 2019 21:14:37 +0200 (CEST) Received: from [193.111.228.93] (unknown [193.111.228.93]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by bofh.nohats.ca (Postfix) with ESMTPSA id A4A1D3937F5; Thu, 8 Aug 2019 15:14:36 -0400 (EDT) DKIM-Filter: OpenDKIM Filter v2.11.0 bofh.nohats.ca A4A1D3937F5 Content-Type: multipart/alternative; boundary=Apple-Mail-1A014F98-07B5-41D8-B974-A2E158EE72A9 Mime-Version: 1.0 (1.0) From: Paul Wouters X-Mailer: iPhone Mail (16F203) In-Reply-To: <93ca9201-926e-b9bf-4ced-e2b911829790@huitema.net> Date: Thu, 8 Aug 2019 15:14:20 -0400 Cc: add@ietf.org Content-Transfer-Encoding: 7bit Message-Id: References: <2EF61DAB-8371-4257-82A0-8622A8F2B178@cable.comcast.com> <1FCF97D5-2A18-4CD2-9072-62D87F819CB0@nbcuni.com> <57B9E26F-C1C0-484C-B1B9-8DCDF14B7AD9@gmail.com> <19E9C1A2-B542-4DAA-8B55-9F38C8AE2C58@gmail.com> <2B980050-9BBC-4333-BE20-2846B8A1B9E7@fugue.com> <339AAAC4-F8DE-42FC-86F9-47970EC94050@fugue.com> <93ca9201-926e-b9bf-4ced-e2b91 1829790@huitema.net> To: Christian Huitema Archived-At: Subject: Re: [Add] [EXTERNAL] Control X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 Aug 2019 19:14:46 -0000 --Apple-Mail-1A014F98-07B5-41D8-B974-A2E158EE72A9 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable > On Aug 8, 2019, at 14:43, Christian Huitema wrote: >=20 >=20 > It would not be absurd to configure the browser and other applications to u= se DoH on a public network and the local DNS service on a private network, o= r in an enterprise network. >=20 I have said this many times too, for example in relation to updating the sea= rch domains or not. On Linux, you still get starbucks.com in /etc/resolv.con= f The designation of public or private can only be made by a human though as o= ften a coffeshop wifi running WPA cannot be detected as a public network, as= it appears as an enterprise network. Ideally all this would be in the OS hotspot handling code and the browsers w= ould be able to just query the status as known by the OS. Paul= --Apple-Mail-1A014F98-07B5-41D8-B974-A2E158EE72A9 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 7bit

On Aug 8, 2019, at 14:43, Christian Huitema <huitema@huitema.net> wrote:


It would not be absurd to configure the browser and other applications to use DoH on a public network and the local DNS service on a  private network, or in an enterprise network.


I have said this many times too, for example in relation to updating the search domains or not. On Linux, you still get starbucks.com in /etc/resolv.conf

The designation of public or private can only be made by a human though as often a coffeshop wifi running WPA cannot be detected as a public network, as it appears as an enterprise network.

Ideally all this would be in the OS hotspot handling code and the browsers would be able to just query the status as known by the OS.

Paul
--Apple-Mail-1A014F98-07B5-41D8-B974-A2E158EE72A9-- From nobody Thu Aug 8 18:59:01 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8A36A12006A for ; Thu, 8 Aug 2019 18:58:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=lowentropy.net header.b=asMKeRwa; dkim=pass (2048-bit key) header.d=messagingengine.com header.b=AEEXRdNr Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id e3e7nPQEFkpX for ; Thu, 8 Aug 2019 18:58:56 -0700 (PDT) Received: from out1-smtp.messagingengine.com (out1-smtp.messagingengine.com [66.111.4.25]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BD39312002F for ; Thu, 8 Aug 2019 18:58:56 -0700 (PDT) Received: from compute1.internal (compute1.nyi.internal [10.202.2.41]) by mailout.nyi.internal (Postfix) with ESMTP id DE258220AA for ; Thu, 8 Aug 2019 21:58:55 -0400 (EDT) Received: from imap2 ([10.202.2.52]) by compute1.internal (MEProxy); Thu, 08 Aug 2019 21:58:55 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lowentropy.net; h=mime-version:message-id:in-reply-to:references:date:from:to :subject:content-type; s=fm2; bh=uvAKrIAW0UejYxwXCEKE7esZyhlRFhG a+KszjoSJ0Sk=; b=asMKeRwaL/xF8IVU+DF5EbMPj49NFKIKoUaNKixMqvRhozG jbol0+DK1V30QHR9hN12x9EH/I6BGJtVVzvUmMcDg++mNr7/rLZ6HYNKyDszeCcx 6MDPOvIKypOK9aGIOrlpEVOGdLtDkLlk/QF+uBElu5WTvmZ5t8so6WCTWZleMCfH AJuypnKnCz4i+w5I+fiUhwbHsPCDCW5Z4SAbvQ1ywaUakeCabwDTvsQkG+aMuiK4 hjWCXAHHixT+WnmFuFkzcZ55ksJcwrZwlWEqp5gzQ0rcOASBcWjayzeQISwJEJ9p LK7JgwhlUbeCS3EwExCT/QNqxKXPDuyF2rQ36TA== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to:x-me-proxy :x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm3; bh=uvAKrI AW0UejYxwXCEKE7esZyhlRFhGa+KszjoSJ0Sk=; b=AEEXRdNr5uAo2jF+MM46Hl bIC5McWBuEVp3Fyzv33AK8+RHrBlMaKfo/8LAgYCM9hVvDGOxTA5o4wVE27TLML7 tHgdDN0WW2vu77kLqIvO2WFRQ9jVivFK+ADoClNivSxpdUOt6tcbCQ3Az72ubHhx bDrjLZ7j7KsTtudI9Zndeip6O1HaSZ+lUwDm4aisbYCFIopGw0UwGtKEuphmZdG2 e4TAFo4zaUow15VFpwnZzwN8oMVz0d3VX4IAWyjppY4dLmR1NlzjrkIR3RnHF/Xe teo2sefM4G6YdAkczTO6HahTZENp6I0hA+4jVH3AIkVY1LZ8ffA9rrqu5xWdLGxQ == X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeduvddrudduiedgheduucetufdoteggodetrfdotf fvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdfqfgfvpdfurfetoffkrfgpnffqhgen uceurghilhhouhhtmecufedttdenucenucfjughrpefofgggkfgjfhffhffvufgtsehttd ertderredtnecuhfhrohhmpedfofgrrhhtihhnucfvhhhomhhsohhnfdcuoehmtheslhho figvnhhtrhhophihrdhnvghtqeenucffohhmrghinhepihgvthhfrdhorhhgnecurfgrrh grmhepmhgrihhlfhhrohhmpehmtheslhhofigvnhhtrhhophihrdhnvghtnecuvehluhhs thgvrhfuihiivgeptd X-ME-Proxy: Received: by mailuser.nyi.internal (Postfix, from userid 501) id 9D93BE00A2; Thu, 8 Aug 2019 21:58:55 -0400 (EDT) X-Mailer: MessagingEngine.com Webmail Interface User-Agent: Cyrus-JMAP/3.1.6-808-g930a1a1-fmstable-20190805v2 Mime-Version: 1.0 Message-Id: <6a3ad62b-2024-4010-b4d6-c6693309ac2e@www.fastmail.com> In-Reply-To: <848E4388-BDD3-4B36-838D-15703AAFE543@hopcount.ca> References: <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <2EF61DAB-8371-4257-82A0-8622A8F2B178@cable.comcast.com> <848E4388-BDD3-4B36-838D-15703AAFE543@hopcount.ca> Date: Fri, 09 Aug 2019 11:58:50 +1000 From: "Martin Thomson" To: add@ietf.org Content-Type: text/plain Archived-At: Subject: Re: [Add] Control X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 09 Aug 2019 01:58:59 -0000 On Thu, Aug 8, 2019, at 14:57, Joe Abley wrote: > Why are these useful questions, given the (surely indisputable) > knowledge that DNS is widely used as a control plane today, and that > many organisations and end-users spend non-trivial amounts of time and > money to do so? Thanks Joe, that's a salient question. I think that there is a reasonable case for saying that conditions have changed. As you have noted, "OTT" DNS is increasingly prevalent, as is encryption and even DNSSEC. As we've seen, there is a good case to be made for various uses of DNS in protection against different classes of attack. For instance, we've had lengthy discussions with DNS providers about the forensic capabilities that logs provide. As an aside, you can expect to see adjustments to Mozilla policies along those lines. But it's not clear how this example reads on the question, except to the extent that it forms another point in the perpetual debate about where intelligence and responsibility (necessarily) resides. For that specific case however, the resolver that an application chooses might reasonably provide the same capabilities. Indeed, those services is a core value proposition of several "OTT" DNS providers. If the point of this discussion is to dissuade applications from performing their own resolution, or choosing who they partner with to do that, then I suggest it's not going to be productive. We can all, with perfectly defensible reasons, claim to be "for the users" [1] in such a discussion. The approach we've taken with the capport working group, which is looking at a very narrowly targeted piece of this larger puzzle is less naturally adversarial, even if it isn't completely free of contention. The idea there was to acknowledge a specific reason for networks to communicate with endpoints and provide a clear, alternative path for that communication. As an aside, framing that as a channel for information - as opposed to a mechanism for exerting control - had a huge positive impact on those discussions. Part of why I asked these questions was not to be dismissive of the investment that has been made in systems that use DNS to achieve their goals, but to try to better identify what needs to be preserved as opposed to those things that will eventually need to find alternative paths to the same end goal. There's a fair spread here, clearly. For instance, if your use case is pervasive surveillance, then I hope you will find that to be less well-supported in the future. I realize now that with all that is going on in this space, asking very general questions is unproductive. The very general answers I received show that asking in an abstract form was an error. What I really want is to understand specific ways in which networks use DNS to affect specific ends. Understanding those cases in some depth - in the same way that I believe that I appreciate the captive portals case - might reveal how they depend on properties of the system we used to have (that is, open to all forms of surveillance, interception, and modification). You might rightly point out that such an endeavour is foolishly broad in scope. But I don't think that it is necessary to understand the system in totality. Working through a few of the most critical cases might be enough. My hope for today, which may be vain indeed, is that working through the those important cases in some detail will lead to better information about how other cases might be handled. Cheers, Martin p.s., I'm restricting myself to a single email response per day. I apologize for its length, but I hope that spending more time on a single email is more respectful of others' time than a less thoughtful response. [1] https://tools.ietf.org/html/draft-nottingham-for-the-users From nobody Thu Aug 8 19:03:47 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 723F812006A for ; Thu, 8 Aug 2019 19:03:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Dwl8tjk0_TVH for ; Thu, 8 Aug 2019 19:03:45 -0700 (PDT) Received: from out.west.pexch112.icann.org (out.west.pexch112.icann.org [64.78.40.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5441512002F for ; Thu, 8 Aug 2019 19:03:45 -0700 (PDT) Received: from PMBX112-W1-CA-1.pexch112.icann.org (64.78.40.21) by PMBX112-W1-CA-2.pexch112.icann.org (64.78.40.23) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Thu, 8 Aug 2019 19:03:43 -0700 Received: from PMBX112-W1-CA-1.pexch112.icann.org ([64.78.40.21]) by PMBX112-W1-CA-1.PEXCH112.ICANN.ORG ([64.78.40.21]) with mapi id 15.00.1473.005; Thu, 8 Aug 2019 19:03:43 -0700 From: Paul Hoffman To: ADD Mailing list Thread-Topic: Chromecast using 8.8.8.8 Thread-Index: AQHVTlary1EUTWy3tkmOV4cCRz/KQg== Date: Fri, 9 Aug 2019 02:03:42 +0000 Message-ID: <474778E2-BC34-4D87-951E-9CA2174F4F77@icann.org> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [192.0.32.234] Content-Type: text/plain; charset="us-ascii" Content-ID: Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: [Add] Chromecast using 8.8.8.8 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 09 Aug 2019 02:03:46 -0000 Greetings again. Earlier on the list, it was discussed that Google's Chrome= cast device uses 8.8.8.8 for DNS service regardless of the settings that we= re provided by DHCP from the wireless access point. I bought a new one and = captured the DNS traffic, and that statement is oddly approximately half-tr= ue. For every DNS lookup, the Chromecast sends the the same query to 8.8.8.8 *a= nd* the resolver that it was given by DHCP. A popular way to control a Chro= mecast is with the GoogleHome application on a phone. On my iPhone on the s= ame wireless access point, GoogleHome always used the resolver from DHCP. N= ote that GoogleHome gave the Wifi password to the Chromecast during setup, = so it could have passed other settings like the resolver address, but appea= rs not to have. The Chromecast's use of 8.8.8.8 continued after setup and reboot, so it was= not just a fluke of the setup process. There is no way in GoogleHome that = I could find to set the network settings for the Chromecast other than to c= hange the wireless access point. (The tinkerer in me was tempted to set up = a resolver that sometime changes the addresses it sends out and see what th= e Chromecast does with the differing information, but that's beyond the sco= pe of this problem.) For comparison, I installed a new Amazon Firestick, and all DNS went to the= resolver configured from DHCP.=20 I'm not sure how to categorize the Chromecast's odd behavior, but it certai= nly is sending queries to a DNS resolver that is not expected by the networ= k administrator. I'd be interested to hear from folks on this list if they = know of other devices or applications that by default hard-code a different= resolver address than the one that comes from the operating system (for ap= plications) or DHCP (for devices). --Paul Hoffman= From nobody Thu Aug 8 21:12:47 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5EA7D1200FD for ; Thu, 8 Aug 2019 21:12:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tE5yXfJNlQ7i for ; Thu, 8 Aug 2019 21:12:42 -0700 (PDT) Received: from mail-vs1-xe2d.google.com (mail-vs1-xe2d.google.com [IPv6:2607:f8b0:4864:20::e2d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 982731200EF for ; Thu, 8 Aug 2019 21:12:42 -0700 (PDT) Received: by mail-vs1-xe2d.google.com with SMTP id u3so64548762vsh.6 for ; Thu, 08 Aug 2019 21:12:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=IK5AOtrDKddfZnStqYTtaE3HF6K9KGpJUYXfHvLhUSg=; b=b8lZwI61zohb2hUTU7awQqeHYhtg/q171xRtx5rAbxKmFhyszZtqJH8m3iPR2HtX5W 5kIupMfWWqfxJsGi1ohpYxN3Ha3Hm5iHuV9bPpDpM64OvSRqgUD6yP4mrb5yG0DUfBQC tZdxJmDRdH3Yorq05PausU1IONCaHTJCgnTsTApZ64ESh32wHhZ99935tYn80p2Dp91Y pJ2IolaE1ISI4qUDdu491ZMPvtHyQ2xGRKZhqTIlTs7Lrmyxrw2rkbViuUNheGwpMyXe h/eVW/EO7IpYSiqzDIv8VPGIL963wfGATByKevFZ1VcN3+j3U4/WQwcswNOCWajhbFTH kk1w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=IK5AOtrDKddfZnStqYTtaE3HF6K9KGpJUYXfHvLhUSg=; b=ELUrVnJGovyWhYM+zB3Nent/oYWGqicjtzhwVnHasT6p2daAq4JPA0nB+E+uCTzj9R msF2XyHl++sJK04msYHk+N5RNLgUQsPcP7Ho9itq7KEqMK+s1y+YB2Be4ZXpAaSEp7Oc kbpqDkMTg3MA5RPV11iT1MOW8IsyNKF5xs/ELXyhN99L+6B69XhU2k7I+sc1Oqmdb1tJ U27Gax/IShZrpZgx0AqHuwIGPqocxbnZYx+SZFHnx1LejvADeBq91L1k04E3y3d7uWGy NwKSNk6Oig9pgNpB5RsnSDDoc6hyHAK5p9upF6/F/WlbDvEc+a5uw8CpHGanULrcYTFo Pk+w== X-Gm-Message-State: APjAAAW/bDZyPHC5Bdd0slg2OHmEu5x9VnIx6vL+GitIUuKWlCkfEnoI clgZKVL418v8uni77LsK2lmJ4bTHrl45ZrEodkA= X-Google-Smtp-Source: APXvYqwaNS2Y/0i6Ws4keg2i3kP4v9CnVzAa5hV8uO0I8qcsASkOg/vioEDXYs7DVYvNEChreDkSlydHK8o+BMGQaKk= X-Received: by 2002:a67:edcf:: with SMTP id e15mr11878644vsp.75.1565323961689; Thu, 08 Aug 2019 21:12:41 -0700 (PDT) MIME-Version: 1.0 References: <474778E2-BC34-4D87-951E-9CA2174F4F77@icann.org> In-Reply-To: <474778E2-BC34-4D87-951E-9CA2174F4F77@icann.org> From: Brian Dickson Date: Thu, 8 Aug 2019 21:12:30 -0700 Message-ID: To: Paul Hoffman Cc: ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000b1eac6058fa76252" Archived-At: Subject: Re: [Add] Chromecast using 8.8.8.8 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 09 Aug 2019 04:12:45 -0000 --000000000000b1eac6058fa76252 Content-Type: text/plain; charset="UTF-8" See Geoff Huston's excellent presentation on similar/related observations (I saw him present something like this at RIPE this year): https://www.slideshare.net/apnic/oard-30-what-part-of-no-is-so-hard-for-the-dns-to-understand Another presentation at the same RIPE or adjacent OARC meeting, explained the observations: some operators in China are deliberately sending the DNS queries to both the original resolver, and another resolver, so that duplicate answers are received, in order to improve performance. First answer received wins, the second is ignored. It is a pretty weird thing to do, although arguably reduces the need for retries... It only works for UDP/53, BTW. Brian On Thu, Aug 8, 2019 at 7:03 PM Paul Hoffman wrote: > Greetings again. Earlier on the list, it was discussed that Google's > Chromecast device uses 8.8.8.8 for DNS service regardless of the settings > that were provided by DHCP from the wireless access point. I bought a new > one and captured the DNS traffic, and that statement is oddly approximately > half-true. > > For every DNS lookup, the Chromecast sends the the same query to 8.8.8.8 > *and* the resolver that it was given by DHCP. A popular way to control a > Chromecast is with the GoogleHome application on a phone. On my iPhone on > the same wireless access point, GoogleHome always used the resolver from > DHCP. Note that GoogleHome gave the Wifi password to the Chromecast during > setup, so it could have passed other settings like the resolver address, > but appears not to have. > > The Chromecast's use of 8.8.8.8 continued after setup and reboot, so it > was not just a fluke of the setup process. There is no way in GoogleHome > that I could find to set the network settings for the Chromecast other than > to change the wireless access point. (The tinkerer in me was tempted to set > up a resolver that sometime changes the addresses it sends out and see what > the Chromecast does with the differing information, but that's beyond the > scope of this problem.) > > For comparison, I installed a new Amazon Firestick, and all DNS went to > the resolver configured from DHCP. > > I'm not sure how to categorize the Chromecast's odd behavior, but it > certainly is sending queries to a DNS resolver that is not expected by the > network administrator. I'd be interested to hear from folks on this list if > they know of other devices or applications that by default hard-code a > different resolver address than the one that comes from the operating > system (for applications) or DHCP (for devices). > > --Paul Hoffman > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --000000000000b1eac6058fa76252 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
See Geoff Huston's excellent presentation on similar/r= elated observations (I saw him present something like this at RIPE this yea= r):
Another presentation at the same RIPE or adjacent OARC meet= ing, explained the observations: some operators in China are deliberately s= ending the DNS queries to both the original resolver, and another resolver,= so that duplicate answers are received, in order to improve performance. F= irst answer received wins, the second is ignored.

= It is a pretty weird thing to do, although arguably reduces the need for re= tries...

It only works for UDP/53, BTW.
=
Brian

On Thu, Aug 8, 2019 at 7:03 PM Paul Hoffman <<= a href=3D"mailto:paul.hoffman@icann.org">paul.hoffman@icann.org> wro= te:
Greetings ag= ain. Earlier on the list, it was discussed that Google's Chromecast dev= ice uses 8.8.8.8 for DNS service regardless of the settings that were provi= ded by DHCP from the wireless access point. I bought a new one and captured= the DNS traffic, and that statement is oddly approximately half-true.

For every DNS lookup, the Chromecast sends the the same query to 8.8.8.8 *a= nd* the resolver that it was given by DHCP. A popular way to control a Chro= mecast is with the GoogleHome application on a phone. On my iPhone on the s= ame wireless access point, GoogleHome always used the resolver from DHCP. N= ote that GoogleHome gave the Wifi password to the Chromecast during setup, = so it could have passed other settings like the resolver address, but appea= rs not to have.

The Chromecast's use of 8.8.8.8 continued after setup and reboot, so it= was not just a fluke of the setup process. There is no way in GoogleHome t= hat I could find to set the network settings for the Chromecast other than = to change the wireless access point. (The tinkerer in me was tempted to set= up a resolver that sometime changes the addresses it sends out and see wha= t the Chromecast does with the differing information, but that's beyond= the scope of this problem.)

For comparison, I installed a new Amazon Firestick, and all DNS went to the= resolver configured from DHCP.

I'm not sure how to categorize the Chromecast's odd behavior, but i= t certainly is sending queries to a DNS resolver that is not expected by th= e network administrator. I'd be interested to hear from folks on this l= ist if they know of other devices or applications that by default hard-code= a different resolver address than the one that comes from the operating sy= stem (for applications) or DHCP (for devices).

--Paul Hoffman
--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--000000000000b1eac6058fa76252-- From nobody Thu Aug 8 21:16:47 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 87A40120119 for ; Thu, 8 Aug 2019 21:16:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id an4qXXXW7-QS for ; Thu, 8 Aug 2019 21:16:44 -0700 (PDT) Received: from mail-ot1-x32d.google.com (mail-ot1-x32d.google.com [IPv6:2607:f8b0:4864:20::32d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E2DFE1200F6 for ; Thu, 8 Aug 2019 21:16:43 -0700 (PDT) Received: by mail-ot1-x32d.google.com with SMTP id s20so62188518otp.4 for ; Thu, 08 Aug 2019 21:16:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=BnYDvgB03PBxn0orEJV0cZCwwX1TrCC8wMgC57Gte9U=; b=f8JjpJzVKaD5VSt1V+uyhi1rxU5gQQeTKQzWDLMDj09zaZridyzhjf6+4fkw8RLsNN p8Vsef3O3tfqAo4Sn6XTk4hs3Mn8zvtosnKuV/Gn4xFEFKt6YyjZMdpPvmeGHG9SPlKy jccLC6ErJo3bUC081GGVsYikkNDz1bDXMiDsoV1M1rTosxj/Q+dBWgG6IN+YO6iHXqic fYUcs1E5CQTKOTCrVdf8iHCCuduJr0gmonEcrxR9cy1qUACQ5XHpLYj+8hBwGG2NY3HN xC+dmWMhrqNk5mhPOWqi9BeFg0JXtJN9YNpRXeVP5WHvyEqtzw0uVG3F2c7/iL6cqNqA 7CxQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=BnYDvgB03PBxn0orEJV0cZCwwX1TrCC8wMgC57Gte9U=; b=jkz7rs/g3dc/DKBf2mH2anAwfaD7cAPL9NlghPL6sywi3RhPrgjn5o59ThEbpM4ssV Br0vCJ6M6r87rw02x1ZdAp2uhJ+VHCU3m2GphnGiH0KqQ1tp5ZXMedCqdusjJ3IpJf9W xhZqCR7s9I6ud6AcH59A2kRGNmm8D4f6fCIhYqLw52R434AhPznXeZvEB8CKm4h9vHe2 6rLpU0MaxLeIlPFqH3JGwUbVJdPTaWh7fV+DDtKfsprkqa7arJa1ueeVGvKYDtRgApgV kZZZWC541gGgkXrFrIJVp/G0dHeTrJnuGEY289Wy6DKDQ+8SHZeU29z3fZm9/ugDywLl p3eQ== X-Gm-Message-State: APjAAAUFeuzFSkh92q4T1jbHWVXtjL+LcLiarr5X8tOBINPeOzaWlXiX N0RfP7vv3hf6B2REOAwjLT3wziEKUU5gdNNGyqC710EZ X-Google-Smtp-Source: APXvYqxkjsZPZ8UHt874W4MkUyU5NxIdKWCOWjY2OFxG8TdOArVF87rmHdcYaZtkAgoKOv7jKkQHsH6NrBPieoaVfqY= X-Received: by 2002:a6b:bc42:: with SMTP id m63mr18225712iof.189.1565324203131; Thu, 08 Aug 2019 21:16:43 -0700 (PDT) MIME-Version: 1.0 References: <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <2EF61DAB-8371-4257-82A0-8622A8F2B178@cable.comcast.com> <848E4388-BDD3-4B36-838D-15703AAFE543@hopcount.ca> <6a3ad62b-2024-4010-b4d6-c6693309ac2e@www.fastmail.com> In-Reply-To: <6a3ad62b-2024-4010-b4d6-c6693309ac2e@www.fastmail.com> From: Rob Sayre Date: Thu, 8 Aug 2019 21:16:31 -0700 Message-ID: To: Martin Thomson Cc: ADD Mailing list Content-Type: multipart/alternative; boundary="0000000000001605b9058fa771f1" Archived-At: Subject: Re: [Add] Control X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 09 Aug 2019 04:16:46 -0000 --0000000000001605b9058fa771f1 Content-Type: text/plain; charset="UTF-8" On Thu, Aug 8, 2019 at 6:59 PM Martin Thomson wrote: > > You might rightly point out that such an endeavour is foolishly broad in > scope. But I don't think that it is necessary to understand the system in > totality. Working through a few of the most critical cases might be > enough. My hope for today, which may be vain indeed, is that working > through the those important cases in some detail will lead to better > information about how other cases might be handled. > I agree that captive portals are an uncontentious problem to solve here. Something similarly ubiquitous and uncontentious might be resolving intranet resources (phonebooks, wikis, issue trackers, etc). Those often don't resolve outside of the office (or its VPN). It seems like always using Cloudflare et al. would break this use case, although I don't mean to imply anyone is /trying/ to break it. thanks, Rob --0000000000001605b9058fa771f1 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Thu, Aug 8, 2019 at 6:59 PM Martin Tho= mson <mt@lowentropy.net> wro= te:

You might rightly point out that such an endeavour is foolishly broad in sc= ope.=C2=A0 But I don't think that it is necessary to understand the sys= tem in totality.=C2=A0 Working through a few of the most critical cases mig= ht be enough.=C2=A0 My hope for today, which may be vain indeed, is that wo= rking through the those important cases in some detail will lead to better = information about how other cases might be handled.
I agree that captive portals are an uncontentious problem to s= olve here. Something similarly ubiquitous and uncontentious might be resolv= ing intranet resources (phonebooks, wikis, issue trackers, etc). Those ofte= n don't resolve outside of the office (or its VPN). It seems like alway= s using Cloudflare et al. would break this use case, although I don't m= ean to imply anyone is /trying/ to break it.

thank= s,
Rob

--0000000000001605b9058fa771f1-- From nobody Thu Aug 8 23:45:55 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 18388120058 for ; Thu, 8 Aug 2019 23:45:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vYMqVNSDhaI5 for ; Thu, 8 Aug 2019 23:45:51 -0700 (PDT) Received: from mail-ot1-x336.google.com (mail-ot1-x336.google.com [IPv6:2607:f8b0:4864:20::336]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 86BDE12000E for ; Thu, 8 Aug 2019 23:45:51 -0700 (PDT) Received: by mail-ot1-x336.google.com with SMTP id z17so10302036otk.13 for ; Thu, 08 Aug 2019 23:45:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=Lcv9YuY1A2uD6mwsn4L0sv8JXdCJ1VU89rBUGTZdewA=; b=ZC5CmLuyVHAM0/eAH+q712dEml1GJMpQ2zTTvMMnlWGxqHnZ3DBrqdCmssp4tkW/oS rsGK0F30i8HsE8yoI4znznHxaGB7WYw7maq1FMbNlVAVc132//ZaWCCBNTojMFRjnL9O znRLuMWKvNILmiFDnesnFxKSIlAy68tIM4pZYr3flbWugxiP867JJS4iDFXK+bF2ygo/ +yE+TwhSUD1K3UnlhwW2u5gw7svNMZuy8UABRo0vkP1DUBC+yPICZ7P5BwsfWTxbGie5 XnrObJiXmOJ4Y7HYdaDvw9m3aj7jaz9xia/iKfvVsOxyPLNMDVCS/hnqZ+PZXJ4hX1nQ E2MA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=Lcv9YuY1A2uD6mwsn4L0sv8JXdCJ1VU89rBUGTZdewA=; b=jFiTDCVLYwTX+khEHqBuOAE3DzIZUoz/3kR3lhy4OU/ZQ8oNKI0njHHDSK1QDL4ovd ytmb3qdEyDSspX1/tCer/FFNuO8GwJzJHYVaE7gmoYD8dyRQ48Vr+fiyfZ+wWBr8xuuX pi26UZ8H1lXEdVx2+TB9rM2hALqgihyUElV8/2pKfvLuXpmWNlG9/ohT3AUUT2Gqir9t N3Ixv22L1UbObuDZ1j3yHNixoiHIjD9ymqpJ0BssNiZ6/L5Qurd49TvoEujCJU8yPKyx QoMa37cWZpvI6LpKxP1dfcE45knRr6wW5Q9HLyFY8Llcry2GBtA0a4xn5mSl2LO52MW+ jnNw== X-Gm-Message-State: APjAAAVif+VsHu2EpUhDhtXPx0rzhQ9EXCy3Pt9YkZ9qNeFWgcYIAelB KxECUXjz/mULn5fGSzIjb6NyXT91Xxfd7EaP2/8= X-Google-Smtp-Source: APXvYqzNmRqKQVKIvtWVtd43FB+kRaV76lUsmAnMfpdv1vPKM9AITsS8dC0y1KiOnWIKr9Hi3yVCoPiehP09mFIcS+w= X-Received: by 2002:a02:1087:: with SMTP id 129mr21420657jay.131.1565333150658; Thu, 08 Aug 2019 23:45:50 -0700 (PDT) MIME-Version: 1.0 References: <474778E2-BC34-4D87-951E-9CA2174F4F77@icann.org> In-Reply-To: <474778E2-BC34-4D87-951E-9CA2174F4F77@icann.org> From: Rob Sayre Date: Thu, 8 Aug 2019 23:45:39 -0700 Message-ID: To: Paul Hoffman Cc: ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000667dab058fa986f0" Archived-At: Subject: Re: [Add] Chromecast using 8.8.8.8 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 09 Aug 2019 06:45:53 -0000 --000000000000667dab058fa986f0 Content-Type: text/plain; charset="UTF-8" On Thu, Aug 8, 2019 at 7:03 PM Paul Hoffman wrote: > it certainly is sending queries to a DNS resolver that is not expected by > the network administrator. > Thank you for the detailed research. I have an older Chromecast that set me back about $35, and I have yet to get it to work on a captive portal requiring an HTML sign in. I carry it in my luggage--when it works (over WPA etc), it's great. I'm not sure everyone views "network administrator" as a valid role, at least in contexts where the administrator does not also control the device. thanks, Rob --000000000000667dab058fa986f0 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Thu, Aug 8, 2019 at 7:03 PM Paul Hoffm= an <paul.hoffman@icann.org= > wrote:
it certainly is sending queries to a DNS resolver th= at is not expected by the network administrator.=C2=A0

Thank you for the detailed research.

I have an older Chromecast that set me back about $35, and I have yet to= get it to work on a captive portal requiring an HTML sign in. I carry it i= n my luggage--when it works (over WPA etc), it's great.

<= /div>
I'm not sure everyone views "network administrator"= as a valid role, at least in contexts where the administrator does not als= o control the device.

thanks,
Rob
<= /div>
--000000000000667dab058fa986f0-- From nobody Fri Aug 9 00:29:36 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0DA67120099 for ; Fri, 9 Aug 2019 00:29:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tFiaGkYNNXx6 for ; Fri, 9 Aug 2019 00:29:32 -0700 (PDT) Received: from mail-yw1-xc31.google.com (mail-yw1-xc31.google.com [IPv6:2607:f8b0:4864:20::c31]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8C30F120058 for ; Fri, 9 Aug 2019 00:29:32 -0700 (PDT) Received: by mail-yw1-xc31.google.com with SMTP id b143so35163377ywb.7 for ; Fri, 09 Aug 2019 00:29:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=D7HapeRH7DHjTy3ENcCBBHeN40nqNvNl5/+VS/GqfIs=; b=GuqQFdtbV00m91oUFONRm9eJ8aVP3dkRe3jDsdaHN7eG+Qf04MDDkAk7ux21xOZYRh JD/mp338fVBZQF6c2xuSUSiOaIMFWooXgfsaXBzVt9fDr0ImFp4xLdDfy4RSZ2ZCmnDQ IrWp0PrQBVnx+dfY6svXNkFElKdqk8In5+kuITCEsJDvEen6TYQT7n990MA/lyfyO+z3 77eSl4c0pgI7F/gjDApux4SQEazks/X0Rv9HEwpFfi8KGnr6FAZJAXa3Lk6HJWIA3YR3 nImK4DHqwePwhthJ7uLI2Qtd8/vLekKiQpPKHG/fYdcc2apk8yw7Bl9uR0U+aodXRUIq BL3g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=D7HapeRH7DHjTy3ENcCBBHeN40nqNvNl5/+VS/GqfIs=; b=l+8IPHgT8UScMPcrKgw1ESi43AHITg1wROuV1VZWoFxHj6EQs+4jQ3p55b7hhRcyu+ P7A2IcNGJCqZ1C/r3RzQKfXKL5wK1s2ol+YFCicDOGy+JUqZaC3PtKC2MhtxliCkxOye 3CZ7AxL0lCmsUsb4Phi0elOaovPMcU1Z7oRJ7EgHfOdoYHHD+d/zm5DXIPfiw4KcAxJg F9jzzL+zcTQhhE5pY/0l3U07ef729/nbeekXZsCsnsUd0aG9Em4FN05wggv8A5eYRwec gft4bmiLfzBHFN5x6oYOQwjJItMXD24Anaswhu9iGjkJ+PMWCzEAxKAkZdiAI0oeUvLo 3Tqw== X-Gm-Message-State: APjAAAXqUFmJxew9oSLTn7W/SNZhN4Oe303u2HZnlFLq5+HlvLQOkJwT hR7Y5pWbDid0qnTyAJq1qC4QsgAznIThFRstAtw= X-Google-Smtp-Source: APXvYqxxH+vb9HBPSgYViqd2EYi2GydrgoD0EwFB/ZSRetfDDF65ccgR2A/wh7PmI+3bljJpKxnSbNIKKyLvYULEOFA= X-Received: by 2002:a0d:f9c3:: with SMTP id j186mr13257492ywf.116.1565335771534; Fri, 09 Aug 2019 00:29:31 -0700 (PDT) MIME-Version: 1.0 References: <474778E2-BC34-4D87-951E-9CA2174F4F77@icann.org> In-Reply-To: From: Alec Muffett Date: Fri, 9 Aug 2019 08:29:19 +0100 Message-ID: To: Brian Dickson Cc: Paul Hoffman , ADD Mailing list Content-Type: multipart/alternative; boundary="0000000000009dda47058faa2216" Archived-At: Subject: Re: [Add] Chromecast using 8.8.8.8 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 09 Aug 2019 07:29:34 -0000 --0000000000009dda47058faa2216 Content-Type: text/plain; charset="UTF-8" On Fri, 9 Aug 2019, 05:12 Brian Dickson, wrote: > > Another presentation at the same RIPE or adjacent OARC meeting, explained > the observations: some operators in China are deliberately sending the DNS > queries to both the original resolver, and another resolver, so that > duplicate answers are received, in order to improve performance. First > answer received wins, the second is ignored. > > It is a pretty weird thing to do, although arguably reduces the need for > retries... > Um. That's not a performance optimization. That's part of the Great Firewall's enforcement of censorship, tracking, and detection of circumvention. There's a very good video from CCC2015 which explains how this works: https://youtu.be/zcC5K7QTdvM - what you are describing is explained in the first third or so, but the whole thing is worth watching. Doubtless the whole thing has advanced in the past few years. Perhaps for compliant citizens there might be some performance win, but censorship is a high price to pay. Aside: is it bad that I am horrified to be on an IETF maillist where some are railing against the value proposition of DoH, and others believe that the Great Firewall of China is a weird DNS performance hack? - a > --0000000000009dda47058faa2216 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Fri, 9 Aug 2019, 05:12 Brian Dickson, <brian.peter.dickson@gmail.com= > wrote:

<= /div>
Another presentation at the same RIPE or adjacent OARC meeting, e= xplained the observations: some operators in China are deliberately sending= the DNS queries to both the original resolver, and another resolver, so th= at duplicate answers are received, in order to improve performance. First a= nswer received wins, the second is ignored.

It is = a pretty weird thing to do, although arguably reduces the need for retries.= ..


Um. That's not a performance optimizati= on. That's part of the Great Firewall's enforcement of censorship, = tracking, and detection of circumvention.

=
There's a very good video from CCC2015 which explains= how this works:

https://youtu.be/zcC5K7QTdvM

- what you are describing is= explained in the first third or so, but the whole thing is worth watching.= Doubtless the whole thing has advanced in the past few years.

Perhaps for compliant citizens t= here might be some performance win, but censorship is a high price to pay.<= /div>

Aside: is it bad that I = am horrified to be on an IETF maillist where some are railing against the v= alue proposition of DoH, and others believe that the Great Firewall of Chin= a is a weird DNS performance hack?

- a


--0000000000009dda47058faa2216-- From nobody Fri Aug 9 05:25:38 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F21EF12011B for ; Fri, 9 Aug 2019 05:25:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Yu9dNq-R1koH for ; Fri, 9 Aug 2019 05:25:35 -0700 (PDT) Received: from mx0a-00191d01.pphosted.com (mx0b-00191d01.pphosted.com [67.231.157.136]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B84C61200D6 for ; Fri, 9 Aug 2019 05:25:35 -0700 (PDT) Received: from pps.filterd (m0049458.ppops.net [127.0.0.1]) by m0049458.ppops.net-00191d01. (8.16.0.27/8.16.0.27) with SMTP id x79CP5r6007289; Fri, 9 Aug 2019 08:25:33 -0400 Received: from alpi154.enaf.aldc.att.com (sbcsmtp6.sbc.com [144.160.229.23]) by m0049458.ppops.net-00191d01. with ESMTP id 2u97k01phw-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 09 Aug 2019 08:25:33 -0400 Received: from enaf.aldc.att.com (localhost [127.0.0.1]) by alpi154.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id x79CPVvF010487; Fri, 9 Aug 2019 08:25:32 -0400 Received: from zlp30484.vci.att.com (zlp30484.vci.att.com [135.47.91.179]) by alpi154.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id x79CPRib010407 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Fri, 9 Aug 2019 08:25:27 -0400 Received: from zlp30484.vci.att.com (zlp30484.vci.att.com [127.0.0.1]) by zlp30484.vci.att.com (Service) with ESMTP id 9327D4009E7E; Fri, 9 Aug 2019 12:25:27 +0000 (GMT) Received: from GAALPA1MSGHUBAD.ITServices.sbc.com (unknown [130.8.218.153]) by zlp30484.vci.att.com (Service) with ESMTPS id 7A5C24009E62; Fri, 9 Aug 2019 12:25:27 +0000 (GMT) Received: from GAALPA1MSGUSRBF.ITServices.sbc.com ([169.254.5.84]) by GAALPA1MSGHUBAD.ITServices.sbc.com ([130.8.218.153]) with mapi id 14.03.0439.000; Fri, 9 Aug 2019 08:25:26 -0400 From: "STARK, BARBARA H" To: "'Rob Sayre'" CC: "'ADD Mailing list'" Thread-Topic: Validity of network administrator role Thread-Index: AdVOrWbK0+q3QnKfTTiLu5VXNuosZw== Date: Fri, 9 Aug 2019 12:25:26 +0000 Message-ID: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [135.70.201.29] Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-08-09_03:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_policy_notspam policy=outbound_policy score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=758 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1906280000 definitions=main-1908090128 Archived-At: Subject: [Add] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 09 Aug 2019 12:25:37 -0000 PiBJJ20gbm90IHN1cmUgZXZlcnlvbmUgdmlld3MgIm5ldHdvcmsgYWRtaW5pc3RyYXRvciIgYXMg YSB2YWxpZCByb2xlLCBhdCBsZWFzdCBpbiBjb250ZXh0cyB3aGVyZSB0aGUgYWRtaW5pc3RyYXRv ciBkb2VzIG5vdCBhbHNvIGNvbnRyb2wgdGhlIGRldmljZS4NCg0KTWFueSBlbnRlcnByaXNlcyBh bmQgc21hbGwgYnVzaW5lc3NlcyBhbGxvdyBlbXBsb3llZXMgdG8gYXR0YWNoIHBlcnNvbmFsIGRl dmljZXMgdG8gdGhlaXIgbmV0d29ya3MuIEkgdGhpbmsgaXQncyBjb21wbGV0ZWx5IHZhbGlkIGZv ciBidXNpbmVzc2VzIHRvIGFkbWluaXN0ZXIgdGhlaXIgbmV0d29ya3MgYXMgdGhleSB3aXNoIHdp dGhvdXQgYmFubmluZyBwZXJzb25hbCBkZXZpY2VzIG9yIHJlcXVpcmluZyBlbXBsb3llZXMgdG8g dHVybiBvdmVyIGNvbnRyb2wgb2YgcGVyc29uYWwgZGV2aWNlcy4NCg0KUGVyc29uYWxseSwgSSB2 aWV3IG15IHJvbGUgYXMgbmV0d29yayBhZG1pbmlzdHJhdG9yIG9mIG15IGhvbWUgbmV0d29yayB0 byBiZSAqZXh0cmVtZWx5KiB2YWxpZCAtLSBpbmNsdWRpbmcgd2hlbiBJIGFsbG93IGd1ZXN0cycg ZGV2aWNlcyAod2hpY2ggSSBkb24ndCBjb250cm9sKSB0byBhdHRhY2ggdG8gbXkgbmV0d29yay4g QW5kIEkgb2Z0ZW4gZG91YnQgdGhhdCBJIHJlYWxseSBoYXZlICJjb250cm9sIiBvdmVyIG15IFNt YXJ0IFRWcyBhbmQgQ2hyb21lY2FzdCAod2hpY2ggaXMgd2h5IHRoZXkgZ2V0IHRvIGJlIHRvZ2V0 aGVyIG9uIHRoZWlyIG93biBsaXR0bGUgc3VibmV0IHNvIHRoZXkgY2FuJ3Qgc2VlIG9yIGJlIHNl ZW4gYnkgdGhlIHJlc3Qgb2YgdGhlIGhvbWUgbmV0d29yayAtLSBJIGNvbm5lY3QgdG8gdGhlIHN1 Ym5ldCBXaS1GaSBBUCB0byB1c2UgdGhlbSkuIEkgZG9uJ3QgaGF2ZSBhbnkgQW5kcm9pZCBkZXZp Y2VzLCBiZWNhdXNlIEkgZG9uJ3QgYmVsaWV2ZSB0aGVyZSdzIHRoZSByZW1vdGVzdCBwb3NzaWJp bGl0eSBvZiBiZWluZyBpbiAiY29udHJvbCIgb2YgdGhlbS4gSSBmbGFzaGVkIGEgTGludXggT1Mg b24gbXkgTGVub3ZvIGxhcHRvcCB3aGVuIEkgcmVhbGl6ZWQgSSBkaWRuJ3QgY29udHJvbCB0aGUg b3JpZ2luYWwgT1MgdGhhdCBMZW5vdm8gaGFkIGhlYXZpbHkgImN1c3RvbWl6ZWQiLiBJIGV2ZW4g ZmlyZXdhbGwgbXkgSVNQIHJvdXRlciBieSBoYXZpbmcgbXkgb3duIHJvdXRlciBhdCB0aGUgZWRn ZSBvZiAqbXkqIGhvbWUgbmV0d29yay4NCg0KQXBwbGljYXRpb25zIGFuZCBjbG91ZCBzZXJ2aWNl cyB0aGF0IHRyeSB0byB0YWtlIGF3YXkgZnJvbSBtZSB0aGUgYWJpbGl0eSB0byBjb250cm9sIHdo YXQgZ29lcyBvbiBpbnNpZGUgbXkgcGVyc29uYWwgaG9tZSBuZXR3b3JrIHdpbGwgYmUgYWRkZWQg dG8gbXkgImRvIG5vdCB0cnVzdCIgbGlzdC4gIA0KDQpJJ20gdGhpbmtpbmcgd2hhdCBJJ2QgcmVh bGx5IGxpa2UgaXMgZm9yIG15IGhvbWUgcm91dGVyIHRvIGhhdmUgYSBmZWF0dXJlIEkgY2FuIGVu YWJsZSB0aGF0IGxldHMgbWUgYmxvY2sgYWxsIHRyYWZmaWMgdG8ga25vd24gcHVibGljIEROUyBz ZXJ2aWNlcy4gSSdtIHByZXR0eSBzdXJlIHRoYXQgd291bGQgZ28gYSBsb25nIHdheXMgdG8gcmVz dG9yaW5nIG15IGFiaWxpdHkgdG8gdXNlIEROUyBhcyBhIHJlYXNvbmFibHkgZWZmZWN0aXZlIGNv bnRyb2wgc3VyZmFjZS4gSSdtIG5vdCBoYXBweSB0aGF0IHNvbWUgcGVvcGxlIGFyZSBjbGFpbWlu ZyBJIGNhbid0IGNvbnRyb2wgRE5TIGluIG15IG93biBob21lIGJlY2F1c2UgdGhleSd2ZSBzdWNj ZWVkZWQgaW4gdGFraW5nIHRoaXMgY29udHJvbCBhd2F5IGZyb20gbWUuIE15IGhvbWUgbmV0d29y ayBiZWxvbmdzIHRvIG1lLCBhbmQgSSdtIGdvaW5nIHRvIGRvIHdoYXQgSSBjYW4gdG8ga2VlcCBp dCB0aGF0IHdheS4gDQoNCkp1c3QgbGlrZSBpdCB0dXJuZWQgb3V0IHRvIGJlIGdvb2QgZm9yIGV2 ZXJ5b25lIHRvIGhhdmUgYSBnb29kIGRlZmluaXRpb24gb2YgTkFUIGFuZCBETlMgcHJveHksIGl0 IHdvdWxkIHByb2JhYmx5IGJlIGdvb2QgaWYgdGhpcyAicHVibGljIEROUyBibG9ja2luZyIgZnVu Y3Rpb25hbGl0eSB3ZXJlIHRob3VnaHRmdWxseSBkZXNpZ25lZCB0byBhdm9pZCB1bm5lY2Vzc2Fy eSBicmVha2FnZS4gSUVURiBtYXkgb3IgbWF5IG5vdCBiZSB0aGUgcmlnaHQgcGxhY2UgdG8gZGVz aWduIGl0LiBTdWdnZXN0aW9ucyB0aGF0IHBlb3BsZSBnbyBlbHNld2hlcmUgdG8gZGVzaWduIHNv bWV0aGluZyBsaWtlIHRoaXMgbWF5IGJlIGNvcnJlY3QuIE9UT0gsIGlmIGFwcGxpY2F0aW9uIGFu ZCBjbG91ZCBwcm92aWRlcnMgd2FudGVkIHRvIGhhdmUgaW5wdXQgdG8gdGhlIGRlc2lnbiwgSUVU RiBtaWdodCBpbmRlZWQgYmUgdGhlIHJpZ2h0IHBsYWNlLg0KDQpJdCB3b3VsZG4ndCBzdXJwcmlz ZSBtZSBpZiBjb2ZmZWUgc2hvcHMsIGhvdGVscywgYW5kIGVudGVycHJpc2VzIGRpZG4ndCBhbHNv IGNob29zZSB0byBlbmFibGUgc3VjaCBhIGZlYXR1cmUuIFJlZ3VsYXRvcnMgaW4gc29tZSBjb3Vu dHJpZXMgbWlnaHQgZXZlbiBpbnNpc3Qgb24gaXQuDQpCYXJiYXJhDQo= From nobody Fri Aug 9 06:14:39 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B4007120131 for ; Fri, 9 Aug 2019 06:14:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id clj5hDtV_W0q for ; Fri, 9 Aug 2019 06:14:34 -0700 (PDT) Received: from mail-pg1-x531.google.com (mail-pg1-x531.google.com [IPv6:2607:f8b0:4864:20::531]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6291C120140 for ; Fri, 9 Aug 2019 06:14:34 -0700 (PDT) Received: by mail-pg1-x531.google.com with SMTP id w3so8652664pgt.13 for ; Fri, 09 Aug 2019 06:14:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=55m6txej6ugAfIVNoTzIZeuuX1wkPJnzwLKqiR4ZC1g=; b=wcqADszWGWvt6t4CNdMc3hbyMOnPlMJLatCpBZXjIv4edOxC0MjVBr2rrmjue0V1o+ OXbvqLHju2+9IGPLecoL0nzfXVZdu3GpvqK81aIekM2zTVoDMW476X9F6s0X3PEd6xIH tIfQteI6LNLblYrdoozmPmTKtUDbBFcrDSKbrNani/ibFr+9zG6KrlEZnD+d5y5zoQuE N67eF9csRyrg3iuzXJ1ZamzAGtQhfoCxhTXn1KORVHIf6Ptr/fZxtFTRmnCbVij8VZjJ Qh7xHrTA9+hoHpZ47L9/w6jMHKB4P7BXS5f+nNp4sE4egAHj+EtTuYdix5hZ2l84mZJO TvOA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=55m6txej6ugAfIVNoTzIZeuuX1wkPJnzwLKqiR4ZC1g=; b=dlL+0RjV7M2pYflpwaH0q0qymgaGvZbKBAOSlsPEq2dDUYmxP3NuUuOdjlbZ9npoBJ hPpQbJ13YgjhEkDECI/qM23VjAZIV51jGQPMPGV4kUkWcd8hFa5MHljlwZsR+Wyh+dkT P4+rFDHMdDtT8h3t6k+1klC8R+w6jGCNE226zH4ISKNDQO+wcEUr3bJKpHQmHFh4h6T7 5P5+chCLn9RIrMbvzWATUrM8g8lrC8Dq4SEVSiJjEr6PhEKT1lijXbzzr/z3GVOaKHTt CoEdkgUmjDrfz3uzxo2F/00Fi4Q+KCJQYM/5YhdfL5A16kW0H61oZjlKmKFETbmX97qG Y5iQ== X-Gm-Message-State: APjAAAXyM5Y/sEwT7vIA9fKfBmarNa/LZibh+uylWBDvAPE6lAqIK08h sY4aH54ra3mW6snkIHZ7/46ZEA== X-Google-Smtp-Source: APXvYqwgtHTZNlsv/Dfuo1ov4j3KJN5b0kf7UIplfZrDoxweGv4l8rg9n+BA0lCjR0pKGxW8a/aP4g== X-Received: by 2002:aa7:96ee:: with SMTP id i14mr503629pfq.217.1565356473790; Fri, 09 Aug 2019 06:14:33 -0700 (PDT) Received: from ?IPv6:2600:380:c06a:a873:95f4:4967:80d3:2c64? ([2600:380:c06a:a873:95f4:4967:80d3:2c64]) by smtp.gmail.com with ESMTPSA id p3sm1899937pjo.3.2019.08.09.06.14.32 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 09 Aug 2019 06:14:32 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (1.0) From: Ted Lemon X-Mailer: iPhone Mail (16G77) In-Reply-To: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> Date: Fri, 9 Aug 2019 06:14:31 -0700 Cc: Rob Sayre , ADD Mailing list Content-Transfer-Encoding: quoted-printable Message-Id: References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> To: "STARK, BARBARA H" Archived-At: Subject: Re: [Add] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 09 Aug 2019 13:14:37 -0000 For my part, I would rather have the option to use public DNS. DoH lets me d= o that when without it I would have no control, because the SP would be taki= ng that control from me.=20 True, on my home net, I can set up the resolver I want, and in that case I a= m better off if apps use my configured resolver. That=E2=80=99s the use case= you=E2=80=99re talking about. But when I=E2=80=99m in a coffee shop, I have= no reason to trust the local network administrator. In this case, DoH gives= me the assurance that I am talking to the resolver I intended to use.=20 IOW, the administrator role is a bit more nuanced than what you just said, e= ven though I agree with your choice in that particular case. =20 I guess the difference is where you think the edge of the administrative dom= ain is... :) Sent from my iPhone On Aug 9, 2019, at 5:25 AM, STARK, BARBARA H wrote: >> I'm not sure everyone views "network administrator" as a valid role, at l= east in contexts where the administrator does not also control the device. >=20 > Many enterprises and small businesses allow employees to attach personal d= evices to their networks. I think it's completely valid for businesses to ad= minister their networks as they wish without banning personal devices or req= uiring employees to turn over control of personal devices. >=20 > Personally, I view my role as network administrator of my home network to b= e *extremely* valid -- including when I allow guests' devices (which I don't= control) to attach to my network. And I often doubt that I really have "con= trol" over my Smart TVs and Chromecast (which is why they get to be together= on their own little subnet so they can't see or be seen by the rest of the h= ome network -- I connect to the subnet Wi-Fi AP to use them). I don't have a= ny Android devices, because I don't believe there's the remotest possibility= of being in "control" of them. I flashed a Linux OS on my Lenovo laptop whe= n I realized I didn't control the original OS that Lenovo had heavily "custo= mized". I even firewall my ISP router by having my own router at the edge of= *my* home network. >=20 > Applications and cloud services that try to take away from me the ability t= o control what goes on inside my personal home network will be added to my "= do not trust" list. =20 >=20 > I'm thinking what I'd really like is for my home router to have a feature I= can enable that lets me block all traffic to known public DNS services. I'm= pretty sure that would go a long ways to restoring my ability to use DNS as= a reasonably effective control surface. I'm not happy that some people are c= laiming I can't control DNS in my own home because they've succeeded in taki= ng this control away from me. My home network belongs to me, and I'm going t= o do what I can to keep it that way.=20 >=20 > Just like it turned out to be good for everyone to have a good definition o= f NAT and DNS proxy, it would probably be good if this "public DNS blocking"= functionality were thoughtfully designed to avoid unnecessary breakage. IET= F may or may not be the right place to design it. Suggestions that people go= elsewhere to design something like this may be correct. OTOH, if applicatio= n and cloud providers wanted to have input to the design, IETF might indeed b= e the right place. >=20 > It wouldn't surprise me if coffee shops, hotels, and enterprises didn't al= so choose to enable such a feature. Regulators in some countries might even i= nsist on it. > Barbara > --=20 > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add From nobody Fri Aug 9 06:18:50 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BBA15120131 for ; Fri, 9 Aug 2019 06:18:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id a953fbE0jYfM for ; Fri, 9 Aug 2019 06:18:47 -0700 (PDT) Received: from smtp.guxx.net (nyx.guxx.net [85.10.208.173]) by ietfa.amsl.com (Postfix) with ESMTP id CBCC612008F for ; Fri, 9 Aug 2019 06:18:46 -0700 (PDT) Received: by nyx.guxx.net (Postfix, from userid 107) id 641135F40154; Fri, 9 Aug 2019 15:18:45 +0200 (CEST) Received: from [172.19.152.215] (p4FF5367C.dip0.t-ipconnect.de [79.245.54.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by nyx.guxx.net (Postfix) with ESMTPSA id 826555F40027; Fri, 9 Aug 2019 15:18:44 +0200 (CEST) From: "Ralf Weber" To: "Rob Sayre" Cc: "Paul Hoffman" , "ADD Mailing list" Date: Fri, 09 Aug 2019 15:18:42 +0200 X-Mailer: MailMate (1.12.5r5635) Message-ID: <49113481-B086-4B75-8712-919B2CCA9A8E@fl1ger.de> In-Reply-To: References: <474778E2-BC34-4D87-951E-9CA2174F4F77@icann.org> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [Add] Chromecast using 8.8.8.8 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 09 Aug 2019 13:18:49 -0000 Moin! On 9 Aug 2019, at 8:45, Rob Sayre wrote: > I'm not sure everyone views "network administrator" as a valid role, > at > least in contexts where the administrator does not also control the > device. Really. I have been working at ISPs and am used to being told that ISPs are bad for the internet in an IETF context, but that really takes it to a whole new level. I’m pretty sure you would not be able to write this email if all people administering networks where they don’t control the end devices would stop working. And thanks to Paul for investigating this. To me this means that Google sees all your video sites if you use a Chromecast. While I don’t own one I know a couple of people who do and as a network administrator will help them to block that. So long -Ralf —-- Ralf Weber From nobody Fri Aug 9 06:55:05 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 634F8120043 for ; Fri, 9 Aug 2019 06:54:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XfZ2gZ-Qsdwh for ; Fri, 9 Aug 2019 06:54:49 -0700 (PDT) Received: from mx0a-00191d01.pphosted.com (mx0a-00191d01.pphosted.com [67.231.149.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 55D0D12006F for ; Fri, 9 Aug 2019 06:54:49 -0700 (PDT) Received: from pps.filterd (m0049287.ppops.net [127.0.0.1]) by m0049287.ppops.net-00191d01. (8.16.0.27/8.16.0.27) with SMTP id x79DmO3N035642; Fri, 9 Aug 2019 09:54:45 -0400 Received: from alpi154.enaf.aldc.att.com (sbcsmtp6.sbc.com [144.160.229.23]) by m0049287.ppops.net-00191d01. with ESMTP id 2u97614fdg-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 09 Aug 2019 09:54:37 -0400 Received: from enaf.aldc.att.com (localhost [127.0.0.1]) by alpi154.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id x79DsRjx010458; Fri, 9 Aug 2019 09:54:27 -0400 Received: from zlp30485.vci.att.com (zlp30485.vci.att.com [135.47.91.178]) by alpi154.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id x79DsN5m010381 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Fri, 9 Aug 2019 09:54:23 -0400 Received: from zlp30485.vci.att.com (zlp30485.vci.att.com [127.0.0.1]) by zlp30485.vci.att.com (Service) with ESMTP id 5D28E4009E78; Fri, 9 Aug 2019 13:54:23 +0000 (GMT) Received: from GAALPA1MSGHUBAF.ITServices.sbc.com (unknown [130.8.218.155]) by zlp30485.vci.att.com (Service) with ESMTPS id 449114009E63; Fri, 9 Aug 2019 13:54:23 +0000 (GMT) Received: from GAALPA1MSGUSRBF.ITServices.sbc.com ([169.254.5.84]) by GAALPA1MSGHUBAF.ITServices.sbc.com ([130.8.218.155]) with mapi id 14.03.0439.000; Fri, 9 Aug 2019 09:54:22 -0400 From: "STARK, BARBARA H" To: "'Ted Lemon'" CC: "'Rob Sayre'" , "'ADD Mailing list'" Thread-Topic: [Add] Validity of network administrator role Thread-Index: AdVOrWbK0+q3QnKfTTiLu5VXNuosZwAKIGKAAAdlSXA= Date: Fri, 9 Aug 2019 13:54:22 +0000 Message-ID: <2D09D61DDFA73D4C884805CC7865E6114E25D54A@GAALPA1MSGUSRBF.ITServices.sbc.com> References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [135.70.201.29] Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-08-09_03:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_policy_notspam policy=outbound_policy score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1906280000 definitions=main-1908090140 Archived-At: Subject: Re: [Add] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 09 Aug 2019 13:54:52 -0000 DQo+IEZvciBteSBwYXJ0LCBJIHdvdWxkIHJhdGhlciBoYXZlIHRoZSBvcHRpb24gdG8gdXNlIHB1 YmxpYyBETlMuIERvSCBsZXRzIG1lDQo+IGRvIHRoYXQgd2hlbiB3aXRob3V0IGl0IEkgd291bGQg aGF2ZSBubyBjb250cm9sLCBiZWNhdXNlIHRoZSBTUCB3b3VsZCBiZQ0KPiB0YWtpbmcgdGhhdCBj b250cm9sIGZyb20gbWUuDQo+IA0KPiBUcnVlLCBvbiBteSBob21lIG5ldCwgSSBjYW4gc2V0IHVw IHRoZSByZXNvbHZlciBJIHdhbnQsIGFuZCBpbiB0aGF0IGNhc2UgSSBhbQ0KPiBiZXR0ZXIgb2Zm IGlmIGFwcHMgdXNlIG15IGNvbmZpZ3VyZWQgcmVzb2x2ZXIuIFRoYXTigJlzIHRoZSB1c2UgY2Fz ZSB5b3XigJlyZQ0KPiB0YWxraW5nIGFib3V0LiBCdXQgd2hlbiBJ4oCZbSBpbiBhIGNvZmZlZSBz aG9wLCBJIGhhdmUgbm8gcmVhc29uIHRvIHRydXN0IHRoZQ0KPiBsb2NhbCBuZXR3b3JrIGFkbWlu aXN0cmF0b3IuIEluIHRoaXMgY2FzZSwgRG9IIGdpdmVzIG1lIHRoZSBhc3N1cmFuY2UgdGhhdCBJ DQo+IGFtIHRhbGtpbmcgdG8gdGhlIHJlc29sdmVyIEkgaW50ZW5kZWQgdG8gdXNlLg0KDQpPaCwg SSBkb24ndCB0cnVzdCBwdWJsaWMgV2ktRmkgYXQgYWxsLiBJIGF2b2lkIHVzaW5nIGl0IHVubGVz cyBJIGZlZWwgbGlrZSBJIHJlYWxseSBuZWVkIGl0LiBJIGF2b2lkIGNoZWNraW5nIGVtYWlsIG9y IEZCIG9yIGZpbmFuY2lhbCBhcHBzIChtYWtlIHN1cmUgdGhleSdyZSBhbGwgY2xvc2VkLCBhbmQg bm9uZSBhbGxvdyBub3RpZmljYXRpb25zKSBpZiBJIGRvIGF0dGFjaCB0byBvbmUuIEJUVywgSSBk b24ndCB0cnVzdCBWUE4gcHJvdmlkZXJzIGVpdGhlciAtLSBzbyBJIGRvbid0IHBlcnNvbmFsbHkg c2VlIHRoYXQgYXMgYSBnb29kIGFsdGVybmF0aXZlLiBJIGFncmVlIHRoYXQgaWYgSSB3ZXJlIHRv IHVzZSBhIHB1YmxpYyBXaS1GaSwgSSB3b3VsZCBwcmVmZXIgdG8gdXNlIHNvbWV0aGluZyBsaWtl IERvSC4gQnV0IHdoYXQgSSB3YXMgc2F5aW5nLCBpcyBJIGRvbid0IHRoaW5rIHRoZXJlIGlzIGFu eXRoaW5nIEkgKG9yIHlvdSkgY2FuIGRvIHRvIHByZXZlbnQgYSBjb2ZmZWUgc2hvcCBmcm9tIGJs b2NraW5nIHRyYWZmaWMgdG8gcHVibGljIEROUyBwcm92aWRlcnMgLS0gaWYgdGhleSBjaG9zZSB0 byBkbyBzby4gQW5kIGl0IHdvdWxkbid0IHN1cnByaXNlIG1lIGlmIHRoZXkgZGlkIHNvIGNob29z ZS4NCg0KSSdtIG5vdCBhZHZvY2F0aW5nIGZvciB0aGlzLiBJJ20ganVzdCBhIHJlYWxpc3QgYW5k IEkgdGhpbmsgaXQncyBhbiB1bmF2b2lkYWJsZSByZXNwb25zZSB0byB3aGF0J3MgZ29pbmcgb24u DQoNClVsdGltYXRlbHksIG5ldHdvcmsgb3BlcmF0b3JzIChlc3BlY2lhbGx5IG9wZXJhdG9ycyBv ZiBwcml2YXRlIG5ldHdvcmtzIC0tIGFuZCBjb2ZmZWUgc2hvcCBob3RzcG90cywgYSBsb3Qgb2Yg InB1YmxpYyIgV2ktRmksIGFuZCBlbnRlcnByaXNlcyBhcmUgc3RpbGwgcHJpdmF0ZSBuZXR3b3Jr cykgKmRvKiBzdGlsbCBoYXZlIGNvbnRyb2wgb2YgdGhlaXIgbmV0d29ya3MuDQpCYXJiYXJhDQoN Cj4gSU9XLCB0aGUgYWRtaW5pc3RyYXRvciByb2xlIGlzIGEgYml0IG1vcmUgbnVhbmNlZCB0aGFu IHdoYXQgeW91IGp1c3Qgc2FpZCwNCj4gZXZlbiB0aG91Z2ggSSBhZ3JlZSB3aXRoIHlvdXIgY2hv aWNlIGluIHRoYXQgcGFydGljdWxhciBjYXNlLg0KPiANCj4gSSBndWVzcyB0aGUgZGlmZmVyZW5j ZSBpcyB3aGVyZSB5b3UgdGhpbmsgdGhlIGVkZ2Ugb2YgdGhlIGFkbWluaXN0cmF0aXZlDQo+IGRv bWFpbiBpcy4uLiAgOikNCj4gDQo+IFNlbnQgZnJvbSBteSBpUGhvbmUNCj4gDQo+IE9uIEF1ZyA5 LCAyMDE5LCBhdCA1OjI1IEFNLCBTVEFSSywgQkFSQkFSQSBIIDxiczc2NTJAYXR0LmNvbT4gd3Jv dGU6DQo+IA0KPiA+PiBJJ20gbm90IHN1cmUgZXZlcnlvbmUgdmlld3MgIm5ldHdvcmsgYWRtaW5p c3RyYXRvciIgYXMgYSB2YWxpZCByb2xlLCBhdA0KPiBsZWFzdCBpbiBjb250ZXh0cyB3aGVyZSB0 aGUgYWRtaW5pc3RyYXRvciBkb2VzIG5vdCBhbHNvIGNvbnRyb2wgdGhlIGRldmljZS4NCj4gPg0K PiA+IE1hbnkgZW50ZXJwcmlzZXMgYW5kIHNtYWxsIGJ1c2luZXNzZXMgYWxsb3cgZW1wbG95ZWVz IHRvIGF0dGFjaCBwZXJzb25hbA0KPiBkZXZpY2VzIHRvIHRoZWlyIG5ldHdvcmtzLiBJIHRoaW5r IGl0J3MgY29tcGxldGVseSB2YWxpZCBmb3IgYnVzaW5lc3NlcyB0bw0KPiBhZG1pbmlzdGVyIHRo ZWlyIG5ldHdvcmtzIGFzIHRoZXkgd2lzaCB3aXRob3V0IGJhbm5pbmcgcGVyc29uYWwgZGV2aWNl cyBvcg0KPiByZXF1aXJpbmcgZW1wbG95ZWVzIHRvIHR1cm4gb3ZlciBjb250cm9sIG9mIHBlcnNv bmFsIGRldmljZXMuDQo+ID4NCj4gPiBQZXJzb25hbGx5LCBJIHZpZXcgbXkgcm9sZSBhcyBuZXR3 b3JrIGFkbWluaXN0cmF0b3Igb2YgbXkgaG9tZSBuZXR3b3JrIHRvDQo+IGJlICpleHRyZW1lbHkq IHZhbGlkIC0tIGluY2x1ZGluZyB3aGVuIEkgYWxsb3cgZ3Vlc3RzJyBkZXZpY2VzICh3aGljaCBJ IGRvbid0DQo+IGNvbnRyb2wpIHRvIGF0dGFjaCB0byBteSBuZXR3b3JrLiBBbmQgSSBvZnRlbiBk b3VidCB0aGF0IEkgcmVhbGx5IGhhdmUNCj4gImNvbnRyb2wiIG92ZXIgbXkgU21hcnQgVFZzIGFu ZCBDaHJvbWVjYXN0ICh3aGljaCBpcyB3aHkgdGhleSBnZXQgdG8gYmUNCj4gdG9nZXRoZXIgb24g dGhlaXIgb3duIGxpdHRsZSBzdWJuZXQgc28gdGhleSBjYW4ndCBzZWUgb3IgYmUgc2VlbiBieSB0 aGUgcmVzdCBvZg0KPiB0aGUgaG9tZSBuZXR3b3JrIC0tIEkgY29ubmVjdCB0byB0aGUgc3VibmV0 IFdpLUZpIEFQIHRvIHVzZSB0aGVtKS4gSSBkb24ndA0KPiBoYXZlIGFueSBBbmRyb2lkIGRldmlj ZXMsIGJlY2F1c2UgSSBkb24ndCBiZWxpZXZlIHRoZXJlJ3MgdGhlIHJlbW90ZXN0DQo+IHBvc3Np YmlsaXR5IG9mIGJlaW5nIGluICJjb250cm9sIiBvZiB0aGVtLiBJIGZsYXNoZWQgYSBMaW51eCBP UyBvbiBteSBMZW5vdm8NCj4gbGFwdG9wIHdoZW4gSSByZWFsaXplZCBJIGRpZG4ndCBjb250cm9s IHRoZSBvcmlnaW5hbCBPUyB0aGF0IExlbm92byBoYWQgaGVhdmlseQ0KPiAiY3VzdG9taXplZCIu IEkgZXZlbiBmaXJld2FsbCBteSBJU1Agcm91dGVyIGJ5IGhhdmluZyBteSBvd24gcm91dGVyIGF0 IHRoZQ0KPiBlZGdlIG9mICpteSogaG9tZSBuZXR3b3JrLg0KPiA+DQo+ID4gQXBwbGljYXRpb25z IGFuZCBjbG91ZCBzZXJ2aWNlcyB0aGF0IHRyeSB0byB0YWtlIGF3YXkgZnJvbSBtZSB0aGUgYWJp bGl0eSB0bw0KPiBjb250cm9sIHdoYXQgZ29lcyBvbiBpbnNpZGUgbXkgcGVyc29uYWwgaG9tZSBu ZXR3b3JrIHdpbGwgYmUgYWRkZWQgdG8gbXkNCj4gImRvIG5vdCB0cnVzdCIgbGlzdC4NCj4gPg0K PiA+IEknbSB0aGlua2luZyB3aGF0IEknZCByZWFsbHkgbGlrZSBpcyBmb3IgbXkgaG9tZSByb3V0 ZXIgdG8gaGF2ZSBhIGZlYXR1cmUgSSBjYW4NCj4gZW5hYmxlIHRoYXQgbGV0cyBtZSBibG9jayBh bGwgdHJhZmZpYyB0byBrbm93biBwdWJsaWMgRE5TIHNlcnZpY2VzLiBJJ20gcHJldHR5DQo+IHN1 cmUgdGhhdCB3b3VsZCBnbyBhIGxvbmcgd2F5cyB0byByZXN0b3JpbmcgbXkgYWJpbGl0eSB0byB1 c2UgRE5TIGFzIGENCj4gcmVhc29uYWJseSBlZmZlY3RpdmUgY29udHJvbCBzdXJmYWNlLiBJJ20g bm90IGhhcHB5IHRoYXQgc29tZSBwZW9wbGUgYXJlDQo+IGNsYWltaW5nIEkgY2FuJ3QgY29udHJv bCBETlMgaW4gbXkgb3duIGhvbWUgYmVjYXVzZSB0aGV5J3ZlIHN1Y2NlZWRlZCBpbg0KPiB0YWtp bmcgdGhpcyBjb250cm9sIGF3YXkgZnJvbSBtZS4gTXkgaG9tZSBuZXR3b3JrIGJlbG9uZ3MgdG8g bWUsIGFuZCBJJ20NCj4gZ29pbmcgdG8gZG8gd2hhdCBJIGNhbiB0byBrZWVwIGl0IHRoYXQgd2F5 Lg0KPiA+DQo+ID4gSnVzdCBsaWtlIGl0IHR1cm5lZCBvdXQgdG8gYmUgZ29vZCBmb3IgZXZlcnlv bmUgdG8gaGF2ZSBhIGdvb2QgZGVmaW5pdGlvbiBvZg0KPiBOQVQgYW5kIEROUyBwcm94eSwgaXQg d291bGQgcHJvYmFibHkgYmUgZ29vZCBpZiB0aGlzICJwdWJsaWMgRE5TIGJsb2NraW5nIg0KPiBm dW5jdGlvbmFsaXR5IHdlcmUgdGhvdWdodGZ1bGx5IGRlc2lnbmVkIHRvIGF2b2lkIHVubmVjZXNz YXJ5IGJyZWFrYWdlLg0KPiBJRVRGIG1heSBvciBtYXkgbm90IGJlIHRoZSByaWdodCBwbGFjZSB0 byBkZXNpZ24gaXQuIFN1Z2dlc3Rpb25zIHRoYXQgcGVvcGxlDQo+IGdvIGVsc2V3aGVyZSB0byBk ZXNpZ24gc29tZXRoaW5nIGxpa2UgdGhpcyBtYXkgYmUgY29ycmVjdC4gT1RPSCwgaWYNCj4gYXBw bGljYXRpb24gYW5kIGNsb3VkIHByb3ZpZGVycyB3YW50ZWQgdG8gaGF2ZSBpbnB1dCB0byB0aGUg ZGVzaWduLCBJRVRGDQo+IG1pZ2h0IGluZGVlZCBiZSB0aGUgcmlnaHQgcGxhY2UuDQo+ID4NCj4g PiBJdCB3b3VsZG4ndCBzdXJwcmlzZSBtZSBpZiBjb2ZmZWUgc2hvcHMsIGhvdGVscywgYW5kIGVu dGVycHJpc2VzIGRpZG4ndCBhbHNvDQo+IGNob29zZSB0byBlbmFibGUgc3VjaCBhIGZlYXR1cmUu IFJlZ3VsYXRvcnMgaW4gc29tZSBjb3VudHJpZXMgbWlnaHQgZXZlbg0KPiBpbnNpc3Qgb24gaXQu DQo+ID4gQmFyYmFyYQ0K From nobody Fri Aug 9 07:00:54 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E3B93120020 for ; Fri, 9 Aug 2019 07:00:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id irAvYtbE8R1s for ; Fri, 9 Aug 2019 07:00:49 -0700 (PDT) Received: from mail-pf1-x442.google.com (mail-pf1-x442.google.com [IPv6:2607:f8b0:4864:20::442]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CDB0012001B for ; Fri, 9 Aug 2019 07:00:49 -0700 (PDT) Received: by mail-pf1-x442.google.com with SMTP id i189so46118263pfg.10 for ; Fri, 09 Aug 2019 07:00:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=8qHw31eiZr8wgTtqQW1CDxn9y8AsaoCCOkStInvhfCY=; b=KnTj09pcaBADquVvTlxVu1qAoa4HnaiT0NGwMXieFIP1fe8xRmTrb5puGzKq2f1eHV APTVTyfxhu3uS3c39gg5VVegl/yNBIBESj7DxvygnRhMoo/H9KHW4ElF5liLcOSQl7js vBZK3pttfgGSxACqgOkBUDNfPBns4LDfFzl7ZgcareaWJb/dLXx1IevAQhdE+Tc2gx+C nhe5GDjtuT814JBjhl51ldTKJX9qLWqMCm07C4hFFPASyxsxl67JmgbC8e+aTb1/gAnB t7V28UI0jcZaXW3VPc9IwhdQi0DMI1VmLKNj4U9JG7NdDYP9MfuUMbv7IVHyhfyyqSvU P3rQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=8qHw31eiZr8wgTtqQW1CDxn9y8AsaoCCOkStInvhfCY=; b=QXnHBiB34/z5W8dKoEPSFbhzAWL+ERxr8SQczKpXju5pnohBl6NagJgXti73SOPv/J QODTFD+sxO0QMNczvZkDM8T3VMhV3HZbrsLnbDT8tZyd53RVleMvXMrRlXLULkGnfnuc Ho3leQG2khBxqIHc76CZX/fwwr/UpvFATey0ZhMFnAMmFa19GoqTRpxMRyjce4z0Zvsm 4EsupXIY8CaPk+plLunJlej7+BwK8mDiO71GLRyc0rLHaGIde1iTh3Vnkbc/J+oJrOkA N17pRqzBAsBfTWc44hhECEk1du/zPVdMOIUjNkZ6xi5tIGL6WmXXEhweTTH5kczCydMy mA+g== X-Gm-Message-State: APjAAAU/dOlu+bgQviCVwXdtoTsdmpMM/Qni0X2Xx7u/oGgOdvJr8F5B i0oNElPw3IV6V0sYwgw82AucGA== X-Google-Smtp-Source: APXvYqwig8Jz9a9YIW/oA86qGzJlSN4Ou61uiJ4Wl5jqnWhjIJhW6AUcW53SxEwYFl0h2ZykFAS3LQ== X-Received: by 2002:a17:90a:32c7:: with SMTP id l65mr9591986pjb.1.1565359248940; Fri, 09 Aug 2019 07:00:48 -0700 (PDT) Received: from ?IPv6:2600:380:c06a:a873:95f4:4967:80d3:2c64? ([2600:380:c06a:a873:95f4:4967:80d3:2c64]) by smtp.gmail.com with ESMTPSA id 64sm99494233pfe.128.2019.08.09.07.00.47 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 09 Aug 2019 07:00:48 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (1.0) From: Ted Lemon X-Mailer: iPhone Mail (16G77) In-Reply-To: <2D09D61DDFA73D4C884805CC7865E6114E25D54A@GAALPA1MSGUSRBF.ITServices.sbc.com> Date: Fri, 9 Aug 2019 07:00:47 -0700 Cc: Rob Sayre , ADD Mailing list Content-Transfer-Encoding: quoted-printable Message-Id: <4AA11EE0-73B4-40C6-85D7-6054E00504C2@fugue.com> References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <2D09D61DDFA73D4C884805CC7865E6114E25D54A@GAALPA1MSGUSRBF.ITServices.sbc.com> To: "STARK, BARBARA H" Archived-At: Subject: Re: [Add] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 09 Aug 2019 14:00:52 -0000 The point is, with DoH, if that really turns out to be true, the escalation w= ill continue. If you want to not have DoH go completely stealth, then as an o= perator the last thing you want to do is block well known DoH servers.=20 Sent from my iPhone > On Aug 9, 2019, at 6:54 AM, STARK, BARBARA H wrote: >=20 >=20 >> For my part, I would rather have the option to use public DNS. DoH lets m= e >> do that when without it I would have no control, because the SP would be >> taking that control from me. >>=20 >> True, on my home net, I can set up the resolver I want, and in that case I= am >> better off if apps use my configured resolver. That=E2=80=99s the use cas= e you=E2=80=99re >> talking about. But when I=E2=80=99m in a coffee shop, I have no reason to= trust the >> local network administrator. In this case, DoH gives me the assurance tha= t I >> am talking to the resolver I intended to use. >=20 > Oh, I don't trust public Wi-Fi at all. I avoid using it unless I feel like= I really need it. I avoid checking email or FB or financial apps (make sure= they're all closed, and none allow notifications) if I do attach to one. BT= W, I don't trust VPN providers either -- so I don't personally see that as a= good alternative. I agree that if I were to use a public Wi-Fi, I would pre= fer to use something like DoH. But what I was saying, is I don't think there= is anything I (or you) can do to prevent a coffee shop from blocking traffi= c to public DNS providers -- if they chose to do so. And it wouldn't surpris= e me if they did so choose. >=20 > I'm not advocating for this. I'm just a realist and I think it's an unavoi= dable response to what's going on. >=20 > Ultimately, network operators (especially operators of private networks --= and coffee shop hotspots, a lot of "public" Wi-Fi, and enterprises are stil= l private networks) *do* still have control of their networks. > Barbara >=20 >> IOW, the administrator role is a bit more nuanced than what you just said= , >> even though I agree with your choice in that particular case. >>=20 >> I guess the difference is where you think the edge of the administrative >> domain is... :) >>=20 >> Sent from my iPhone >>=20 >> On Aug 9, 2019, at 5:25 AM, STARK, BARBARA H wrote: >>=20 >>>> I'm not sure everyone views "network administrator" as a valid role, at= >> least in contexts where the administrator does not also control the devic= e. >>>=20 >>> Many enterprises and small businesses allow employees to attach personal= >> devices to their networks. I think it's completely valid for businesses t= o >> administer their networks as they wish without banning personal devices o= r >> requiring employees to turn over control of personal devices. >>>=20 >>> Personally, I view my role as network administrator of my home network t= o >> be *extremely* valid -- including when I allow guests' devices (which I d= on't >> control) to attach to my network. And I often doubt that I really have >> "control" over my Smart TVs and Chromecast (which is why they get to be >> together on their own little subnet so they can't see or be seen by the r= est of >> the home network -- I connect to the subnet Wi-Fi AP to use them). I don'= t >> have any Android devices, because I don't believe there's the remotest >> possibility of being in "control" of them. I flashed a Linux OS on my Len= ovo >> laptop when I realized I didn't control the original OS that Lenovo had h= eavily >> "customized". I even firewall my ISP router by having my own router at th= e >> edge of *my* home network. >>>=20 >>> Applications and cloud services that try to take away from me the abilit= y to >> control what goes on inside my personal home network will be added to my >> "do not trust" list. >>>=20 >>> I'm thinking what I'd really like is for my home router to have a featur= e I can >> enable that lets me block all traffic to known public DNS services. I'm p= retty >> sure that would go a long ways to restoring my ability to use DNS as a >> reasonably effective control surface. I'm not happy that some people are >> claiming I can't control DNS in my own home because they've succeeded in >> taking this control away from me. My home network belongs to me, and I'm >> going to do what I can to keep it that way. >>>=20 >>> Just like it turned out to be good for everyone to have a good definitio= n of >> NAT and DNS proxy, it would probably be good if this "public DNS blocking= " >> functionality were thoughtfully designed to avoid unnecessary breakage. >> IETF may or may not be the right place to design it. Suggestions that peo= ple >> go elsewhere to design something like this may be correct. OTOH, if >> application and cloud providers wanted to have input to the design, IETF >> might indeed be the right place. >>>=20 >>> It wouldn't surprise me if coffee shops, hotels, and enterprises didn't a= lso >> choose to enable such a feature. Regulators in some countries might even >> insist on it. >>> Barbara From nobody Fri Aug 9 07:05:58 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6BDE612013B for ; Fri, 9 Aug 2019 07:05:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=hopcount.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TlqDXy9MQRYb for ; Fri, 9 Aug 2019 07:05:54 -0700 (PDT) Received: from mail-ot1-x335.google.com (mail-ot1-x335.google.com [IPv6:2607:f8b0:4864:20::335]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6451D1200F3 for ; Fri, 9 Aug 2019 07:05:54 -0700 (PDT) Received: by mail-ot1-x335.google.com with SMTP id d17so133119115oth.5 for ; Fri, 09 Aug 2019 07:05:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hopcount.ca; s=google; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=joWDMTXFKL6e7MN9e11e1WEpza72nSmJUdrWPeW5ByE=; b=LjL5ca7o4sSZoZ0+nXtlRFHSx72Lz63KHLtqtMa1XK+jcSHQIkb+fqA5Bot0cLmWVx 56fPGKjtk1WNtLG4co7k1ltOuZg6EyN+MtDWqFGPSKzlMGZ2/goXv+bDDwS+PWa5AfJM b0z3VZ9PvzRm/ITCefHrtbZUUXLJ9fXtRj/DQ= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=joWDMTXFKL6e7MN9e11e1WEpza72nSmJUdrWPeW5ByE=; b=Dz/lcW1ScQV/lKQqDNBSLRCn5R0yKOTFNiYiY4Bn0MrxoCCd1pAC+zD4FyNWURKLtH dR3RvXt77+HCvg2A8VaToIxQgCfnMm93OtTJyhhmGR6WB4vjFTHfg12eWTWGC9gsGLIu OZgDGqZAr/lAjiE8cIBh+EO+fOuN+8qvbBSA2Ca6noHsiazRGrQChzHd7cs4jRBZUT2y Bv4heJ3gNb990IpBMPcGxx15FYhauONShIfK/62YnkV+CrpNUe+TnThJzLR1vL7GKSS0 1R8hsUaxC5UCoBPxd5YjmxncdwdSSY8psBcR5PAYdGi3Omv7zNYpCyoLc2k5/yAZkeo3 fJ8Q== X-Gm-Message-State: APjAAAWV1E/OQ1f3naETYxXvUtmSK6Nb4jzp2yIbswFLcsufaU4mqRwl r0P76zkc5wMyx80yt6HDdFkxJw== X-Google-Smtp-Source: APXvYqzRGcdu7cwAUxJgAmDySjVqbaegOLxU7/hrkFVcDyTHIY9SNGub8eBflzhWs6mIsj/eYCZJgQ== X-Received: by 2002:a5d:948f:: with SMTP id v15mr19772826ioj.93.1565359553477; Fri, 09 Aug 2019 07:05:53 -0700 (PDT) Received: from [192.168.1.50] (24-246-23-138.cable.teksavvy.com. [24.246.23.138]) by smtp.gmail.com with ESMTPSA id c17sm72733434ioo.82.2019.08.09.07.05.52 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 09 Aug 2019 07:05:52 -0700 (PDT) From: Joe Abley Message-Id: <7FD76B97-6FCC-4FB8-B894-E93376237994@hopcount.ca> Content-Type: multipart/signed; boundary="Apple-Mail=_79DC2425-7012-4390-96D7-EE509229BE43"; protocol="application/pgp-signature"; micalg=pgp-sha1 Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Fri, 9 Aug 2019 10:05:50 -0400 In-Reply-To: <2D09D61DDFA73D4C884805CC7865E6114E25D54A@GAALPA1MSGUSRBF.ITServices.sbc.com> Cc: Ted Lemon , ADD Mailing list , Rob Sayre To: "STARK, BARBARA H" References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <2D09D61DDFA73D4C884805CC7865E6114E25D54A@GAALPA1MSGUSRBF.ITServices.sbc.com> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 09 Aug 2019 14:05:57 -0000 --Apple-Mail=_79DC2425-7012-4390-96D7-EE509229BE43 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii On 9 Aug 2019, at 09:54, STARK, BARBARA H wrote: > Oh, I don't trust public Wi-Fi at all. I avoid using it unless I feel = like I really need it. Personally I think it's foolish to trust any network, regardless of who = runs it. Assuming that all networks are hostile seems like a much better = starting point. I have no real reason to believe that any particular = WiFi network is better than any particular LTE network, either. My preferred reaction to an end-user indicating that they trust the = local network would be to raise the drawbridge and put the troops on = high alert, since the indicated false sense of security probably means = that the local network is filled with unpatched lightbulbs, printers, = phones and laptops and is about the most unpleasant place to navigate = that you could imagine. At least in a coffeeshop network or attached to = a mobile carrier I have a reasonable expectation that there's just one = person out to get me. =46rom my perspective, however, all networks have an administrator. You = just can't tell who it is, even if it's your network and you think it's = you. Joe --Apple-Mail=_79DC2425-7012-4390-96D7-EE509229BE43 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iF0EARECAB0WIQSAt40QkiztAcvphdg0jwy9hlI6LAUCXU19vgAKCRA0jwy9hlI6 LLW/AKCN6stqdaZO6bmXRWn6ALWgJV91wACgyO3UFjV/jb7pX8dre+B2jJzDovg= =2nFS -----END PGP SIGNATURE----- --Apple-Mail=_79DC2425-7012-4390-96D7-EE509229BE43-- From nobody Fri Aug 9 07:15:30 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4CDF6120020 for ; Fri, 9 Aug 2019 07:15:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6KRsvCwkgu4C for ; Fri, 9 Aug 2019 07:15:26 -0700 (PDT) Received: from mail-pl1-x62f.google.com (mail-pl1-x62f.google.com [IPv6:2607:f8b0:4864:20::62f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EC3BC12004D for ; Fri, 9 Aug 2019 07:15:25 -0700 (PDT) Received: by mail-pl1-x62f.google.com with SMTP id y8so2914274plr.12 for ; Fri, 09 Aug 2019 07:15:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=9OI4J8pgX5v++A7+7itEeFSNJrGU4PxO7NPMrGo+xEY=; b=hFl0h8WKOJi1x/tdC6ikTkIfztCtzc2Bs6rF7Opzg9wiqDNYck2pU6imt1R5Gdhg1X ZcvvlKDmQm12hZNJTJrDVYCDOUUcFG4CqV10k0iyXDK7WsC/LnWHGa5FojKunT7itWj6 6PJ0T1Mi8DUu+lVmch6G733D3SjuiDt2FtGJC3HazYnI2ZjzVehgQ/L4KqN+UtyswMft +WMQXVmmc8+OdOIEUYRRWGVDsV2TStKXq0erQNkPSHttwBnGaQTm2ou6N/bdg2+EJ8VJ QUU69UMzNaRXqWTW91qTOAba7nzqh8sJwCcsW8lzH6eF4L0lUV81h9M+u1Ou2d0gB84G gDVA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=9OI4J8pgX5v++A7+7itEeFSNJrGU4PxO7NPMrGo+xEY=; b=CUjK+MaBNekY3Um6Zfrff2GUGgNLrzgiWRYCdJH/FtA29EF2bUlD4pGKuHiEEqipxO bJtbs83aSUHiMheLw9H5CvQ8Nm690qUCQaMqBiN4uPv/6pa8FJV5ASQ2HHGuDUpo/wet X4uKFSnIm2G8djM8t1visdTKYoRFJjsdPhvU2TZDgkWfn1qDcsOVUgyILlcYY4ccdhMl Z7qcI9AOmamlvbXKadA3GLa59fWSIqT/iX1+3SYmLmTJlJu0MNuo6pO8VuUzK0mtPUcD AaUqKQBApNUNtCKpspMg1wJrhrezaRKSxnHeLV59Q4w/a1hW1hd3rXgQnIHGfwAp/1mg xzqA== X-Gm-Message-State: APjAAAUBiYME8P6XW6EkzmJWJ/AkbWoBkqjr8C0XoGu4sLga8HvpIh/M 8dx7HjAKc+KeZnJEChWzfxo= X-Google-Smtp-Source: APXvYqyxhZZ0IlsL8O9zavpvWd6RmCI2wp65a37PMjB6kzgnV/zPY+BVmaNB6FBnukmt9D6w8plW1g== X-Received: by 2002:a17:902:d715:: with SMTP id w21mr19824945ply.261.1565360125559; Fri, 09 Aug 2019 07:15:25 -0700 (PDT) Received: from [10.128.64.149] ([136.60.227.81]) by smtp.gmail.com with ESMTPSA id q69sm17807206pjb.0.2019.08.09.07.15.23 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 09 Aug 2019 07:15:24 -0700 (PDT) From: Bret Jordan Message-Id: Content-Type: multipart/alternative; boundary="Apple-Mail=_311A342B-423A-4682-B30A-23341E5AF9EE" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Fri, 9 Aug 2019 08:15:22 -0600 In-Reply-To: Cc: Martin Thomson , ADD Mailing list To: Rob Sayre References: <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <2EF61DAB-8371-4257-82A0-8622A8F2B178@cable.comcast.com> <848E4388-BDD3-4B36-838D-15703AAFE543@hopcount.ca> <6a3ad62b-2024-4010-b4d6-c6693309ac2e@www.fastmail.com> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] Control X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 09 Aug 2019 14:15:29 -0000 --Apple-Mail=_311A342B-423A-4682-B30A-23341E5AF9EE Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Split DNS is a critical use case. It is not just development systems = that are not addressable on the outside, but nearly all HR and financial = systems as well. It is very common for organizations to have several = orders of magnitude more internal names than external names. Thanks, Bret PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 "Without cryptography vihv vivc ce xhrnrw, however, the only thing that = can not be unscrambled is an egg." > On Aug 8, 2019, at 10:16 PM, Rob Sayre wrote: >=20 > On Thu, Aug 8, 2019 at 6:59 PM Martin Thomson > wrote: >=20 > You might rightly point out that such an endeavour is foolishly broad = in scope. But I don't think that it is necessary to understand the = system in totality. Working through a few of the most critical cases = might be enough. My hope for today, which may be vain indeed, is that = working through the those important cases in some detail will lead to = better information about how other cases might be handled. >=20 > I agree that captive portals are an uncontentious problem to solve = here. Something similarly ubiquitous and uncontentious might be = resolving intranet resources (phonebooks, wikis, issue trackers, etc). = Those often don't resolve outside of the office (or its VPN). It seems = like always using Cloudflare et al. would break this use case, although = I don't mean to imply anyone is /trying/ to break it. >=20 > thanks, > Rob >=20 > --=20 > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add --Apple-Mail=_311A342B-423A-4682-B30A-23341E5AF9EE Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii Split= DNS is a critical use case.  It is not just development systems = that are not addressable on the outside, but nearly all HR and financial = systems as well.  It is very common for organizations to have = several orders of magnitude more internal names than external names.


Thanks,
Bret
PGP = Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 = 0050
"Without = cryptography vihv vivc ce xhrnrw, however, the only thing that can not = be unscrambled is an = egg."

On Aug 8, 2019, at 10:16 PM, Rob Sayre <sayrer@gmail.com> = wrote:

On Thu, Aug 8, 2019 = at 6:59 PM Martin Thomson <mt@lowentropy.net> wrote:

You might rightly point out that such an endeavour is foolishly broad in = scope.  But I don't think that it is necessary to understand the = system in totality.  Working through a few of the most critical = cases might be enough.  My hope for today, which may be vain = indeed, is that working through the those important cases in some detail = will lead to better information about how other cases might be = handled.

I agree that captive portals are an = uncontentious problem to solve here. Something similarly ubiquitous and = uncontentious might be resolving intranet resources (phonebooks, wikis, = issue trackers, etc). Those often don't resolve outside of the office = (or its VPN). It seems like always using Cloudflare et al. would break = this use case, although I don't mean to imply anyone is /trying/ to = break it.

thanks,
Rob

--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add

= --Apple-Mail=_311A342B-423A-4682-B30A-23341E5AF9EE-- From nobody Fri Aug 9 07:25:01 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0361112001B for ; Fri, 9 Aug 2019 07:25:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Pw0lKh3HfeGw for ; Fri, 9 Aug 2019 07:24:58 -0700 (PDT) Received: from mail-pf1-x435.google.com (mail-pf1-x435.google.com [IPv6:2607:f8b0:4864:20::435]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5DE21120019 for ; Fri, 9 Aug 2019 07:24:58 -0700 (PDT) Received: by mail-pf1-x435.google.com with SMTP id p184so46147842pfp.7 for ; Fri, 09 Aug 2019 07:24:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=7ohug1NNT/s4KD/gdYtcAMTNE7pIZnJJuXzW8DAV+m0=; b=dgcSzNykdClvfwahNPWnq87sO2bs6ThUX1eiuI52pJecKu+ubfatXDUv0Qa36m+fh8 1VH/ExY6fksSvBZyeGLP59CYrMnZxnDzDvcpIdQHxVfRrKx37p2YHf5+SNHWOlXuMq6v RVJLptmPE1QvlVXkxawNshYpxx1+PuL5pACYUeZzNAyeyteUqeE0OxqIcefst+5jLhnL l8S6McJG98zBGACxvbsrarAmtRrMoPiVFV4q6G+Zu92P0wSGzWAlWbKy3jSmpo7R6arj gSdDNASe2m2SeMiRk/9+Ztq0p3z3XJ125kXLpbWJpI1kxamk9Yv/va1e7M67+sC6uPgt IrxA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=7ohug1NNT/s4KD/gdYtcAMTNE7pIZnJJuXzW8DAV+m0=; b=lu1reIYs5bFqmBWdV6QbOW2YEQNud2Y6U2xP/eJBJInB4AmpsNlLQRtvCJ566FKG/p GRY2FgvVrIapRqp/+x0Q87uDDX3okvH5uu7pHIDL3rMhHOpVaAIc1jHgQpEKFRTTyT5G vQKV6kBYcPyHibPWiC6dh/GG9ZGpNRXPp21Y+E4+KA41ougKAKIip6suBgEPxTVXWzxC y3TsEAWuoOK4HhSjYqok83A155J1Prb2QxHZByB0lGf+LEGpNP9zVa5XqVG+2367qoQf zNsviv48Sz7Dn+J1+Uwb70ph0y2HTNquOcn8UGEGKdkR+RCyXTIjjfVmKBhpx5Tuftx6 nplw== X-Gm-Message-State: APjAAAXumI8kHBRjJ7NOvUoL0PDsK9zOfFkFfMuFYQqaA928WcEqrK/g QFvm3ze6A9jxoG+jRQecjRQ= X-Google-Smtp-Source: APXvYqyN+R4VUm5Mgx6I7sws76wCJ3Iq7SpV7ppYuNJmNDGcBCgP6nrNsYTycJJ/JL45UEqkKEmkYA== X-Received: by 2002:a17:90a:ca11:: with SMTP id x17mr9776913pjt.107.1565360697932; Fri, 09 Aug 2019 07:24:57 -0700 (PDT) Received: from [10.128.64.149] ([136.60.227.81]) by smtp.gmail.com with ESMTPSA id d23sm5432046pjv.18.2019.08.09.07.24.56 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 09 Aug 2019 07:24:57 -0700 (PDT) From: Bret Jordan Message-Id: Content-Type: multipart/alternative; boundary="Apple-Mail=_05FE7769-81CE-41B0-89EC-784A71BB75C5" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Fri, 9 Aug 2019 08:24:54 -0600 In-Reply-To: <49113481-B086-4B75-8712-919B2CCA9A8E@fl1ger.de> Cc: Rob Sayre , Paul Hoffman , ADD Mailing list To: Ralf Weber References: <474778E2-BC34-4D87-951E-9CA2174F4F77@icann.org> <49113481-B086-4B75-8712-919B2CCA9A8E@fl1ger.de> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] Chromecast using 8.8.8.8 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 09 Aug 2019 14:25:00 -0000 --Apple-Mail=_05FE7769-81CE-41B0-89EC-784A71BB75C5 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Yeah, there is a lot of very expensive equipment and people that are = needed to make this thing work day-2-day. Lots of people here complain = about the controls hotels put on _their_ network. But have you ever = tried to use one that has 3000 ms latency and 50% packet loss? If not, = I have one for you in Amsterdam that you can go stay at. You tend to be = very _grateful_ for networks that do work, even if they have some hoops = you have to jump through or if you can not access some content.=20 Thanks, Bret PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 "Without cryptography vihv vivc ce xhrnrw, however, the only thing that = can not be unscrambled is an egg." > On Aug 9, 2019, at 7:18 AM, Ralf Weber wrote: >=20 > Moin! >=20 > On 9 Aug 2019, at 8:45, Rob Sayre wrote: >> I'm not sure everyone views "network administrator" as a valid role, = at >> least in contexts where the administrator does not also control the = device. > Really. I have been working at ISPs and am used to being told that = ISPs are bad for the internet in an IETF context, but that really takes = it to a whole new level. I=E2=80=99m pretty sure you would not be able = to write this email if all people administering networks where they = don=E2=80=99t control the end devices would stop working. >=20 > And thanks to Paul for investigating this. To me this means that = Google sees all your video sites if you use a Chromecast. While I = don=E2=80=99t own one I know a couple of people who do and as a network = administrator will help them to block that. >=20 > So long > -Ralf > =E2=80=94-- > Ralf Weber >=20 > --=20 > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add --Apple-Mail=_05FE7769-81CE-41B0-89EC-784A71BB75C5 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Yeah,= there is a lot of very expensive equipment and people that are needed = to make this thing work day-2-day. Lots of people here complain about = the controls hotels put on _their_ network.  But have you ever = tried to use one that has 3000 ms latency and 50% packet loss?  If = not, I have one for you in Amsterdam that you can go stay at.  You = tend to be very _grateful_ for networks that do work, even if they have = some hoops you have to jump through or if you can not access some = content. 

Thanks,
Bret
PGP = Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 = 0050
"Without = cryptography vihv vivc ce xhrnrw, however, the only thing that can not = be unscrambled is an = egg."

On Aug 9, 2019, at 7:18 AM, Ralf Weber <dns@fl1ger.de> = wrote:

Moin!

On 9 Aug 2019, at 8:45, = Rob Sayre wrote:
I'm = not sure everyone views "network administrator" as a valid role, at
least in contexts where the administrator does not also = control the device.
Really. I have been = working at ISPs and am used to being told that ISPs are bad for the = internet in an IETF context, but that really takes it to a whole new = level. I=E2=80=99m pretty sure you would not be able to write this email = if all people administering networks where they don=E2=80=99t control = the end devices would stop working.

And = thanks to Paul for investigating this. To me this means that Google sees = all your video sites if you use a Chromecast. While I don=E2=80=99t own = one I know a couple of people who do and as a network administrator will = help them to block that.

So long
-Ralf
=E2=80=94--
Ralf Weber

--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add

= --Apple-Mail=_05FE7769-81CE-41B0-89EC-784A71BB75C5-- From nobody Fri Aug 9 07:32:31 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8AF1812006A for ; Fri, 9 Aug 2019 07:32:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5famsWIfitK1 for ; Fri, 9 Aug 2019 07:32:26 -0700 (PDT) Received: from mail-pl1-x636.google.com (mail-pl1-x636.google.com [IPv6:2607:f8b0:4864:20::636]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9147D120019 for ; Fri, 9 Aug 2019 07:32:26 -0700 (PDT) Received: by mail-pl1-x636.google.com with SMTP id 4so38042335pld.10 for ; Fri, 09 Aug 2019 07:32:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=dLk+d+6h19i4424AlYKEeZCEXd2M6LuInwphu/H2Auk=; b=bHzzgJN4eeWF8YExsMgUE4UGPOGo8lT43dWo97i8IZCHdwgS0ToGXgM4tf6mxCVvLY KVHp3ziUUCeeB0qvMrKSCeUUv0arKTdOQEJZUWs43pBRLLzyG8hwOrncuhgKzgaPcG7G AFefGnCdYk5uSOfqaQNe/cnkc9cB+2af3ExxKeH+hG9U4qEDqxtEIMlxDezoz+o6YQZq GkpIrg53rwS1K/TY6Gmub3zVUmTdyiaTBtxPRZcAMDTQIWRXNPA+23hQYNl4qXmZStBt JrqnxrvhRBQBNk8UcKMiB0Cyrp/XeYH+wfvqsii9Aw19Rxy29x0FXhu5Nd/BhogVXCcp DImA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=dLk+d+6h19i4424AlYKEeZCEXd2M6LuInwphu/H2Auk=; b=G4cLeeBY5/F/M0zIe5uYI7wPj1Im6MGl9NgYTiNfUNyrW++jVtU9qsmCg9QNLATwCz 1/xyT4OixIBf2InEkmhX0OuqsdeVbj3m4GPmApl/heZul+MXGoubWTHYvXrfiLSeWIFv wyeyZO0c7LBbHAWzJSYZGz8wXDxLrsUAd5GyDveYp/zMF4gPtNjwkdaJU793S6f3SgNq UyKWvjoAYN2efIO+CBtXVKLWwArw8bNIYoqlHu9mNW0A4+m2bb38PLZbpQJZcSEzUND+ dXp2JkKjJX6uWdGtGNZ8fzmZ7KKYsM9myqUSAAFvGC4fyiabvSU83VAlpjfCl+HkmM7b y9sw== X-Gm-Message-State: APjAAAXnz+O0cDtmrKxZeUUfUqxzSKDuIIV4WAE+we88jKFCX3MFYLqY nC58Er0HAHkZPfx8N6S+BZ8= X-Google-Smtp-Source: APXvYqyH+B0DTaFWrEbZeY7utbFv4TUDa7fsQuDy2/u4/432CapOHWWNVoJbUi54V5D1/n20dDTTJg== X-Received: by 2002:a17:902:b285:: with SMTP id u5mr18976672plr.329.1565361146164; Fri, 09 Aug 2019 07:32:26 -0700 (PDT) Received: from [10.128.64.149] ([136.60.227.81]) by smtp.gmail.com with ESMTPSA id u24sm39397530pgk.31.2019.08.09.07.32.24 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 09 Aug 2019 07:32:25 -0700 (PDT) From: Bret Jordan Message-Id: <026A530C-D472-4B46-AD3C-B8F177C65334@gmail.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_7C218C6B-8195-414A-9540-718F9C33852D" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Fri, 9 Aug 2019 08:32:23 -0600 In-Reply-To: Cc: "STARK, BARBARA H" , ADD Mailing list , Rob Sayre To: Ted Lemon References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 09 Aug 2019 14:32:30 -0000 --Apple-Mail=_7C218C6B-8195-414A-9540-718F9C33852D Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Just so I understand correctly. You are upset that a company is = allowing you to use _their_ network, probably for free, and they put = controls on _their_ network?=20 Thanks, Bret PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 "Without cryptography vihv vivc ce xhrnrw, however, the only thing that = can not be unscrambled is an egg." > On Aug 9, 2019, at 7:14 AM, Ted Lemon wrote: >=20 > For my part, I would rather have the option to use public DNS. DoH = lets me do that when without it I would have no control, because the SP = would be taking that control from me.=20 >=20 > True, on my home net, I can set up the resolver I want, and in that = case I am better off if apps use my configured resolver. That=E2=80=99s = the use case you=E2=80=99re talking about. But when I=E2=80=99m in a = coffee shop, I have no reason to trust the local network administrator. = In this case, DoH gives me the assurance that I am talking to the = resolver I intended to use.=20 >=20 > IOW, the administrator role is a bit more nuanced than what you just = said, even though I agree with your choice in that particular case. =20 >=20 > I guess the difference is where you think the edge of the = administrative domain is... :) >=20 > Sent from my iPhone >=20 > On Aug 9, 2019, at 5:25 AM, STARK, BARBARA H wrote: >=20 >>> I'm not sure everyone views "network administrator" as a valid role, = at least in contexts where the administrator does not also control the = device. >>=20 >> Many enterprises and small businesses allow employees to attach = personal devices to their networks. I think it's completely valid for = businesses to administer their networks as they wish without banning = personal devices or requiring employees to turn over control of personal = devices. >>=20 >> Personally, I view my role as network administrator of my home = network to be *extremely* valid -- including when I allow guests' = devices (which I don't control) to attach to my network. And I often = doubt that I really have "control" over my Smart TVs and Chromecast = (which is why they get to be together on their own little subnet so they = can't see or be seen by the rest of the home network -- I connect to the = subnet Wi-Fi AP to use them). I don't have any Android devices, because = I don't believe there's the remotest possibility of being in "control" = of them. I flashed a Linux OS on my Lenovo laptop when I realized I = didn't control the original OS that Lenovo had heavily "customized". I = even firewall my ISP router by having my own router at the edge of *my* = home network. >>=20 >> Applications and cloud services that try to take away from me the = ability to control what goes on inside my personal home network will be = added to my "do not trust" list. =20 >>=20 >> I'm thinking what I'd really like is for my home router to have a = feature I can enable that lets me block all traffic to known public DNS = services. I'm pretty sure that would go a long ways to restoring my = ability to use DNS as a reasonably effective control surface. I'm not = happy that some people are claiming I can't control DNS in my own home = because they've succeeded in taking this control away from me. My home = network belongs to me, and I'm going to do what I can to keep it that = way.=20 >>=20 >> Just like it turned out to be good for everyone to have a good = definition of NAT and DNS proxy, it would probably be good if this = "public DNS blocking" functionality were thoughtfully designed to avoid = unnecessary breakage. IETF may or may not be the right place to design = it. Suggestions that people go elsewhere to design something like this = may be correct. OTOH, if application and cloud providers wanted to have = input to the design, IETF might indeed be the right place. >>=20 >> It wouldn't surprise me if coffee shops, hotels, and enterprises = didn't also choose to enable such a feature. Regulators in some = countries might even insist on it. >> Barbara >> --=20 >> Add mailing list >> Add@ietf.org >> https://www.ietf.org/mailman/listinfo/add >=20 > --=20 > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add --Apple-Mail=_7C218C6B-8195-414A-9540-718F9C33852D Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Just = so I understand correctly.  You are upset that a company is = allowing you to use _their_ network, probably for free, and they put = controls on _their_ network? 


Thanks,
Bret
PGP = Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 = 0050
"Without = cryptography vihv vivc ce xhrnrw, however, the only thing that can not = be unscrambled is an = egg."

On Aug 9, 2019, at 7:14 AM, Ted Lemon <mellon@fugue.com> = wrote:

For my part, I would rather have the option to use public = DNS. DoH lets me do that when without it I would have no control, = because the SP would be taking that control from me.

True, on my home net, I can set up the resolver I want, and = in that case I am better off if apps use my configured resolver. = That=E2=80=99s the use case you=E2=80=99re talking about. But when I=E2=80= =99m in a coffee shop, I have no reason to trust the local network = administrator. In this case, DoH gives me the assurance that I am = talking to the resolver I intended to use.

IOW, the administrator role is a bit more nuanced than what = you just said, even though I agree with your choice in that particular = case.  

I guess the difference is = where you think the edge of the administrative domain is...  :)

Sent from my iPhone

On Aug 9, 2019, at 5:25 AM, STARK, BARBARA H <bs7652@att.com> = wrote:

I'm not sure everyone = views "network administrator" as a valid role, at least in contexts = where the administrator does not also control the device.

Many enterprises and small = businesses allow employees to attach personal devices to their networks. = I think it's completely valid for businesses to administer their = networks as they wish without banning personal devices or requiring = employees to turn over control of personal devices.

Personally, I view my role as network administrator of my = home network to be *extremely* valid -- including when I allow guests' = devices (which I don't control) to attach to my network. And I often = doubt that I really have "control" over my Smart TVs and Chromecast = (which is why they get to be together on their own little subnet so they = can't see or be seen by the rest of the home network -- I connect to the = subnet Wi-Fi AP to use them). I don't have any Android devices, because = I don't believe there's the remotest possibility of being in "control" = of them. I flashed a Linux OS on my Lenovo laptop when I realized I = didn't control the original OS that Lenovo had heavily "customized". I = even firewall my ISP router by having my own router at the edge of *my* = home network.

Applications and cloud = services that try to take away from me the ability to control what goes = on inside my personal home network will be added to my "do not trust" = list.  

I'm thinking what I'd really = like is for my home router to have a feature I can enable that lets me = block all traffic to known public DNS services. I'm pretty sure that = would go a long ways to restoring my ability to use DNS as a reasonably = effective control surface. I'm not happy that some people are claiming I = can't control DNS in my own home because they've succeeded in taking = this control away from me. My home network belongs to me, and I'm going = to do what I can to keep it that way.

Just = like it turned out to be good for everyone to have a good definition of = NAT and DNS proxy, it would probably be good if this "public DNS = blocking" functionality were thoughtfully designed to avoid unnecessary = breakage. IETF may or may not be the right place to design it. = Suggestions that people go elsewhere to design something like this may = be correct. OTOH, if application and cloud providers wanted to have = input to the design, IETF might indeed be the right place.

It wouldn't surprise me if coffee shops, = hotels, and enterprises didn't also choose to enable such a feature. = Regulators in some countries might even insist on it.
Barbara
--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add

--
Add mailing = list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add

= --Apple-Mail=_7C218C6B-8195-414A-9540-718F9C33852D-- From nobody Fri Aug 9 07:36:33 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B9C5B120187 for ; Fri, 9 Aug 2019 07:36:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ESIHMAnmWMp3 for ; Fri, 9 Aug 2019 07:36:23 -0700 (PDT) Received: from mail-pl1-x635.google.com (mail-pl1-x635.google.com [IPv6:2607:f8b0:4864:20::635]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8048A1201E4 for ; Fri, 9 Aug 2019 07:36:23 -0700 (PDT) Received: by mail-pl1-x635.google.com with SMTP id i2so45082364plt.1 for ; Fri, 09 Aug 2019 07:36:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:mime-version:subject:date:references:to:in-reply-to:message-id; bh=XGkI4aRZx3THEhS2wkDB1f425B23b8OToLavgerMPjM=; b=EvBYI51h9TzyBWzYI9tRqGMaLeRh54ZxxpQMnzsquS8aAEeuVzbZhye9AiBXG1mk3B kEtwV8rg6nvqWLl8wgUicv7wXepq+c9dfN/fPLU8LnF7+JX05dLWBox/OdlzxqXlbzu4 u/1HYpcIOSca/7bCvLNCGd5W72RlKpXqWqucWGQ4pBBuvJKPlB8/m7HuZ/kA6DolTfYk 2lfMgPqBlYnyW+DNOrafj2KJJPbWmXNY9jprA2ANx1pjd22Culb6ys/EiM4zmF1y6kME VR07FwUuifZAcb68bq64WnvWwtVs0J69NPk33+r71PtHBNEwHqOuWIh1CsPl4/YdhRdy GIag== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:mime-version:subject:date:references:to :in-reply-to:message-id; bh=XGkI4aRZx3THEhS2wkDB1f425B23b8OToLavgerMPjM=; b=PS+qt8Z1ZWNHnu2T0uIl39kCCWXjQJfQpj69tdsYDkxU0+OS1GdqHubcoPtiNqJt6b YuLQMf1t2Lp5SlSjPu9YCY0IEY/V1Zymsc9DVjCMGlrx39RtisIOWbEpioq8w5vRB6XA iKUYht6t1rEDRr9NowS1FNy9U7M3TcNOQf/EygA+IjXv6qRxeyzzMi0Fl51rX7f8Lhby ciN1DCAxPXSx+PJ+9YX1bjwhty5IIbFQlVhbuGrg6vrNR5AVNlJNT8RL/FVrj9seQCQs F5fJ5rZDY6Irm9ICyz/wQbY8I6R3ObYCYS+x1cCx977RB/+h1kSwHikfecTeI+wTasKY fJow== X-Gm-Message-State: APjAAAVrXMaJ4F1SqEERsALl5uGQ9sY5mChkN+ZLKZ1EjY+wPIdj3OKC Zv50YbgNd63MtYPgT9d52WhEMNsd X-Google-Smtp-Source: APXvYqy2EqdmEfdtKDglA1cXaG6qub6kF93yGWDAlHPuQ9SPwEwSFWiKxiPjjaueVyYNF1cvBH1Sig== X-Received: by 2002:a17:902:23:: with SMTP id 32mr3646386pla.214.1565361382797; Fri, 09 Aug 2019 07:36:22 -0700 (PDT) Received: from [10.128.64.149] ([136.60.227.81]) by smtp.gmail.com with ESMTPSA id o11sm182392529pfh.114.2019.08.09.07.36.21 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 09 Aug 2019 07:36:21 -0700 (PDT) From: Bret Jordan Content-Type: multipart/alternative; boundary="Apple-Mail=_E5FCF438-C6A4-4546-AF33-3C647986887A" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Fri, 9 Aug 2019 08:36:19 -0600 References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> To: ADD Mailing list In-Reply-To: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> Message-Id: X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 09 Aug 2019 14:36:27 -0000 --Apple-Mail=_E5FCF438-C6A4-4546-AF33-3C647986887A Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Barbara, I have done the same for years. Different SSIDs and VLANs for every = class of device on my network. I have even run my own Bind DNS server = since the late 90s. That way when I am remote I can always point back = to my DNS. I hate the idea of some quad X organization tracking all of = my DNS queries.=20 Thanks, Bret PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 "Without cryptography vihv vivc ce xhrnrw, however, the only thing that = can not be unscrambled is an egg." > On Aug 9, 2019, at 6:25 AM, STARK, BARBARA H wrote: >=20 >> I'm not sure everyone views "network administrator" as a valid role, = at least in contexts where the administrator does not also control the = device. >=20 > Many enterprises and small businesses allow employees to attach = personal devices to their networks. I think it's completely valid for = businesses to administer their networks as they wish without banning = personal devices or requiring employees to turn over control of personal = devices. >=20 > Personally, I view my role as network administrator of my home network = to be *extremely* valid -- including when I allow guests' devices (which = I don't control) to attach to my network. And I often doubt that I = really have "control" over my Smart TVs and Chromecast (which is why = they get to be together on their own little subnet so they can't see or = be seen by the rest of the home network -- I connect to the subnet Wi-Fi = AP to use them). I don't have any Android devices, because I don't = believe there's the remotest possibility of being in "control" of them. = I flashed a Linux OS on my Lenovo laptop when I realized I didn't = control the original OS that Lenovo had heavily "customized". I even = firewall my ISP router by having my own router at the edge of *my* home = network. >=20 > Applications and cloud services that try to take away from me the = ability to control what goes on inside my personal home network will be = added to my "do not trust" list. =20 >=20 > I'm thinking what I'd really like is for my home router to have a = feature I can enable that lets me block all traffic to known public DNS = services. I'm pretty sure that would go a long ways to restoring my = ability to use DNS as a reasonably effective control surface. I'm not = happy that some people are claiming I can't control DNS in my own home = because they've succeeded in taking this control away from me. My home = network belongs to me, and I'm going to do what I can to keep it that = way.=20 >=20 > Just like it turned out to be good for everyone to have a good = definition of NAT and DNS proxy, it would probably be good if this = "public DNS blocking" functionality were thoughtfully designed to avoid = unnecessary breakage. IETF may or may not be the right place to design = it. Suggestions that people go elsewhere to design something like this = may be correct. OTOH, if application and cloud providers wanted to have = input to the design, IETF might indeed be the right place. >=20 > It wouldn't surprise me if coffee shops, hotels, and enterprises = didn't also choose to enable such a feature. Regulators in some = countries might even insist on it. > Barbara > --=20 > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add --Apple-Mail=_E5FCF438-C6A4-4546-AF33-3C647986887A Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii Barbara,

I = have done the same for years.  Different SSIDs and VLANs for every = class of device on my network.  I have even run my own  Bind = DNS server since the late 90s.  That way when I am remote I can = always point back to my DNS.  I hate the idea of some quad X = organization tracking all of my DNS queries. 

Thanks,
Bret
PGP = Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 = 0050
"Without = cryptography vihv vivc ce xhrnrw, however, the only thing that can not = be unscrambled is an = egg."

On Aug 9, 2019, at 6:25 AM, STARK, BARBARA H <bs7652@att.com> = wrote:

I'm not sure everyone = views "network administrator" as a valid role, at least in contexts = where the administrator does not also control the device.

Many enterprises and small = businesses allow employees to attach personal devices to their networks. = I think it's completely valid for businesses to administer their = networks as they wish without banning personal devices or requiring = employees to turn over control of personal devices.

Personally, I view my role as network administrator of my = home network to be *extremely* valid -- including when I allow guests' = devices (which I don't control) to attach to my network. And I often = doubt that I really have "control" over my Smart TVs and Chromecast = (which is why they get to be together on their own little subnet so they = can't see or be seen by the rest of the home network -- I connect to the = subnet Wi-Fi AP to use them). I don't have any Android devices, because = I don't believe there's the remotest possibility of being in "control" = of them. I flashed a Linux OS on my Lenovo laptop when I realized I = didn't control the original OS that Lenovo had heavily "customized". I = even firewall my ISP router by having my own router at the edge of *my* = home network.

Applications and cloud = services that try to take away from me the ability to control what goes = on inside my personal home network will be added to my "do not trust" = list.  

I'm thinking what I'd really = like is for my home router to have a feature I can enable that lets me = block all traffic to known public DNS services. I'm pretty sure that = would go a long ways to restoring my ability to use DNS as a reasonably = effective control surface. I'm not happy that some people are claiming I = can't control DNS in my own home because they've succeeded in taking = this control away from me. My home network belongs to me, and I'm going = to do what I can to keep it that way.

Just = like it turned out to be good for everyone to have a good definition of = NAT and DNS proxy, it would probably be good if this "public DNS = blocking" functionality were thoughtfully designed to avoid unnecessary = breakage. IETF may or may not be the right place to design it. = Suggestions that people go elsewhere to design something like this may = be correct. OTOH, if application and cloud providers wanted to have = input to the design, IETF might indeed be the right place.

It wouldn't surprise me if coffee shops, = hotels, and enterprises didn't also choose to enable such a feature. = Regulators in some countries might even insist on it.
Barbara
--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add

= --Apple-Mail=_E5FCF438-C6A4-4546-AF33-3C647986887A-- From nobody Fri Aug 9 07:40:10 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B60AB12007A for ; Fri, 9 Aug 2019 07:40:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WWJ95OR8le10 for ; Fri, 9 Aug 2019 07:40:06 -0700 (PDT) Received: from mail-pg1-x52c.google.com (mail-pg1-x52c.google.com [IPv6:2607:f8b0:4864:20::52c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1F87D12006A for ; Fri, 9 Aug 2019 07:40:06 -0700 (PDT) Received: by mail-pg1-x52c.google.com with SMTP id o13so45951157pgp.12 for ; Fri, 09 Aug 2019 07:40:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:mime-version:subject:date:references:to:in-reply-to:message-id; bh=xaxqD8Oc7+oAaZFRrvh+01UHAkAxDFjcZIbO3b7Mc3g=; b=lfto7L+V0tLNpjoHY24t/61QGBPpxU5qc2WK5CsLrsSABrap6vtNDG1EghaZDe6Nze 9MZ3EBlE4CkKRF949gaPtKQKXvnuTYwHvOl34+ZvJXTHjGYACQiof7tvFr8dex41INia OZWHz5Yla7R/p3h1N/b30Rn7LR7amXHixSiaqxI50yZV2RSAXJxyDth8Y1f20MYKx7YM vKjA3iUEXUKQcWoTX0IIbGpYMgRI3eb3M28SUzwgw9bHKRFvEtrZ60FMDg209z1YDHzQ ckuDryrsOyp+o7xRCC6CEjAGdlzwxRP9VaEY3pHQRHCnmE3wt3AvxX4icwpwb58CLoWl A8PA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:mime-version:subject:date:references:to :in-reply-to:message-id; bh=xaxqD8Oc7+oAaZFRrvh+01UHAkAxDFjcZIbO3b7Mc3g=; b=gibddgguyzgUhQEvjfykJodXv6m8VxkBgn146Coa+GALdKDHxmQmtVuThwygAaJH1V r17p/gMpAheSmj8ihgzP/392+3lrI0k9HhzlhdIFL+jiCAEdB4FbGCz0LGQZSxRytugI pcozVC+iXAW5dHkRhMR04wpbI1INzmRQtP2WTsDqEZ75eHelLoHweDIp7onQsuq3yRyL 6KqLXZCzMuYLm3lU7Xdo2sq4i35vQ8iqBx7sisFyqV82039T5bo3JX4B/6Ld6f4j6v8X t2YUJ/iXm51R/fMzS8YvykSUZluABKorqTIG0uqgEozWwwIBxRZgDd9NWKmu1pLFzA13 3voA== X-Gm-Message-State: APjAAAVlFEMirxlCBVWrHVfAoGQNB4HpkG3l0l1KxAwcAY7ru45Ujv8N VGdgfa+jJuXaMcriglQzW+g= X-Google-Smtp-Source: APXvYqw+lkEUW9dn4lZxpbTfEX8MUI28ykeKACEYJoma1zgS/NjxOquIvHYBc3kX+fnO+Mw/Rh4OTA== X-Received: by 2002:a17:90a:b947:: with SMTP id f7mr2763633pjw.63.1565361605612; Fri, 09 Aug 2019 07:40:05 -0700 (PDT) Received: from [10.128.64.149] ([136.60.227.81]) by smtp.gmail.com with ESMTPSA id k36sm98220996pgl.42.2019.08.09.07.40.04 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 09 Aug 2019 07:40:04 -0700 (PDT) From: Bret Jordan Content-Type: multipart/alternative; boundary="Apple-Mail=_574A047D-CA03-4CA5-8140-73967B29E1B0" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Fri, 9 Aug 2019 08:40:02 -0600 References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <2D09D61DDFA73D4C884805CC7865E6114E25D54A@GAALPA1MSGUSRBF.ITServices.sbc.com> <4AA11EE0-73B4-40C6-85D7-6054E00504C2@fugue.com> To: Ted Lemon , ADD Mailing list In-Reply-To: <4AA11EE0-73B4-40C6-85D7-6054E00504C2@fugue.com> Message-Id: <91DA56FA-D763-40A0-BD60-0511843D0B6D@gmail.com> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 09 Aug 2019 14:40:09 -0000 --Apple-Mail=_574A047D-CA03-4CA5-8140-73967B29E1B0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 The ideological view needs to be careful. If we push to far one way, = organizations may just go back to a no-default-route, and force all = traffic through their full TLS inspection device. They may do this = because the regulator requires them to do so. Once a theory of harm = document gets written for this, because we have backed them in to a = corner, things will get much worse.=20 Thanks, Bret PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 "Without cryptography vihv vivc ce xhrnrw, however, the only thing that = can not be unscrambled is an egg." > On Aug 9, 2019, at 8:00 AM, Ted Lemon wrote: >=20 > The point is, with DoH, if that really turns out to be true, the = escalation will continue. If you want to not have DoH go completely = stealth, then as an operator the last thing you want to do is block well = known DoH servers.=20 >=20 > Sent from my iPhone >=20 >> On Aug 9, 2019, at 6:54 AM, STARK, BARBARA H wrote: >>=20 >>=20 >>> For my part, I would rather have the option to use public DNS. DoH = lets me >>> do that when without it I would have no control, because the SP = would be >>> taking that control from me. >>>=20 >>> True, on my home net, I can set up the resolver I want, and in that = case I am >>> better off if apps use my configured resolver. That=E2=80=99s the = use case you=E2=80=99re >>> talking about. But when I=E2=80=99m in a coffee shop, I have no = reason to trust the >>> local network administrator. In this case, DoH gives me the = assurance that I >>> am talking to the resolver I intended to use. >>=20 >> Oh, I don't trust public Wi-Fi at all. I avoid using it unless I feel = like I really need it. I avoid checking email or FB or financial apps = (make sure they're all closed, and none allow notifications) if I do = attach to one. BTW, I don't trust VPN providers either -- so I don't = personally see that as a good alternative. I agree that if I were to use = a public Wi-Fi, I would prefer to use something like DoH. But what I was = saying, is I don't think there is anything I (or you) can do to prevent = a coffee shop from blocking traffic to public DNS providers -- if they = chose to do so. And it wouldn't surprise me if they did so choose. >>=20 >> I'm not advocating for this. I'm just a realist and I think it's an = unavoidable response to what's going on. >>=20 >> Ultimately, network operators (especially operators of private = networks -- and coffee shop hotspots, a lot of "public" Wi-Fi, and = enterprises are still private networks) *do* still have control of their = networks. >> Barbara >>=20 >>> IOW, the administrator role is a bit more nuanced than what you just = said, >>> even though I agree with your choice in that particular case. >>>=20 >>> I guess the difference is where you think the edge of the = administrative >>> domain is... :) >>>=20 >>> Sent from my iPhone >>>=20 >>> On Aug 9, 2019, at 5:25 AM, STARK, BARBARA H wrote: >>>=20 >>>>> I'm not sure everyone views "network administrator" as a valid = role, at >>> least in contexts where the administrator does not also control the = device. >>>>=20 >>>> Many enterprises and small businesses allow employees to attach = personal >>> devices to their networks. I think it's completely valid for = businesses to >>> administer their networks as they wish without banning personal = devices or >>> requiring employees to turn over control of personal devices. >>>>=20 >>>> Personally, I view my role as network administrator of my home = network to >>> be *extremely* valid -- including when I allow guests' devices = (which I don't >>> control) to attach to my network. And I often doubt that I really = have >>> "control" over my Smart TVs and Chromecast (which is why they get to = be >>> together on their own little subnet so they can't see or be seen by = the rest of >>> the home network -- I connect to the subnet Wi-Fi AP to use them). I = don't >>> have any Android devices, because I don't believe there's the = remotest >>> possibility of being in "control" of them. I flashed a Linux OS on = my Lenovo >>> laptop when I realized I didn't control the original OS that Lenovo = had heavily >>> "customized". I even firewall my ISP router by having my own router = at the >>> edge of *my* home network. >>>>=20 >>>> Applications and cloud services that try to take away from me the = ability to >>> control what goes on inside my personal home network will be added = to my >>> "do not trust" list. >>>>=20 >>>> I'm thinking what I'd really like is for my home router to have a = feature I can >>> enable that lets me block all traffic to known public DNS services. = I'm pretty >>> sure that would go a long ways to restoring my ability to use DNS as = a >>> reasonably effective control surface. I'm not happy that some people = are >>> claiming I can't control DNS in my own home because they've = succeeded in >>> taking this control away from me. My home network belongs to me, and = I'm >>> going to do what I can to keep it that way. >>>>=20 >>>> Just like it turned out to be good for everyone to have a good = definition of >>> NAT and DNS proxy, it would probably be good if this "public DNS = blocking" >>> functionality were thoughtfully designed to avoid unnecessary = breakage. >>> IETF may or may not be the right place to design it. Suggestions = that people >>> go elsewhere to design something like this may be correct. OTOH, if >>> application and cloud providers wanted to have input to the design, = IETF >>> might indeed be the right place. >>>>=20 >>>> It wouldn't surprise me if coffee shops, hotels, and enterprises = didn't also >>> choose to enable such a feature. Regulators in some countries might = even >>> insist on it. >>>> Barbara >=20 > --=20 > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add --Apple-Mail=_574A047D-CA03-4CA5-8140-73967B29E1B0 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8
The ideological view needs to be careful.  If we push to = far one way, organizations may just go back to a no-default-route, and = force all traffic through their full TLS inspection device.  They = may do this because the regulator requires them to do so. Once a theory = of harm document gets written for this, because we have backed them in = to a corner, things will get much worse. 


Thanks,
Bret
PGP = Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 = 0050
"Without = cryptography vihv vivc ce xhrnrw, however, the only thing that can not = be unscrambled is an = egg."

On Aug 9, 2019, at 8:00 AM, Ted Lemon <mellon@fugue.com> = wrote:

The point is, with DoH, if that really turns out to be true, = the escalation will continue. If you want to not have DoH go completely = stealth, then as an operator the last thing you want to do is block well = known DoH servers.

Sent from my iPhone

On Aug 9, = 2019, at 6:54 AM, STARK, BARBARA H <bs7652@att.com> wrote:


For my part, I would = rather have the option to use public DNS. DoH lets me
do = that when without it I would have no control, because the SP would be
taking that control from me.

True,= on my home net, I can set up the resolver I want, and in that case I = am
better off if apps use my configured resolver. That=E2=80= =99s the use case you=E2=80=99re
talking about. But when = I=E2=80=99m in a coffee shop, I have no reason to trust the
local network administrator. In this case, DoH gives me the = assurance that I
am talking to the resolver I intended to = use.

Oh, I don't trust public = Wi-Fi at all. I avoid using it unless I feel like I really need it. I = avoid checking email or FB or financial apps (make sure they're all = closed, and none allow notifications) if I do attach to one. BTW, I = don't trust VPN providers either -- so I don't personally see that as a = good alternative. I agree that if I were to use a public Wi-Fi, I would = prefer to use something like DoH. But what I was saying, is I don't = think there is anything I (or you) can do to prevent a coffee shop from = blocking traffic to public DNS providers -- if they chose to do so. And = it wouldn't surprise me if they did so choose.

I'm not advocating for this. I'm just a realist and I think = it's an unavoidable response to what's going on.

Ultimately, network operators (especially operators of = private networks -- and coffee shop hotspots, a lot of "public" Wi-Fi, = and enterprises are still private networks) *do* still have control of = their networks.
Barbara

IOW, the administrator = role is a bit more nuanced than what you just said,
even = though I agree with your choice in that particular case.
I guess the difference is where you think the edge of the = administrative
domain is...  :)

Sent from my iPhone

On Aug 9, = 2019, at 5:25 AM, STARK, BARBARA H <bs7652@att.com> wrote:

I'm not sure everyone views "network administrator" as a = valid role, at
least in contexts = where the administrator does not also control the device.

Many = enterprises and small businesses allow employees to attach personal
devices to their networks. I think it's = completely valid for businesses to
administer their = networks as they wish without banning personal devices or
requiring employees to turn over control of personal = devices.

Personally, I view my role as network administrator of my = home network to
be *extremely* valid -- = including when I allow guests' devices (which I don't
control) to attach to my network. And I often doubt that I = really have
"control" over my Smart TVs and Chromecast = (which is why they get to be
together on their own little = subnet so they can't see or be seen by the rest of
the = home network -- I connect to the subnet Wi-Fi AP to use them). I = don't
have any Android devices, because I don't believe = there's the remotest
possibility of being in "control" of = them. I flashed a Linux OS on my Lenovo
laptop when I = realized I didn't control the original OS that Lenovo had heavily
"customized". I even firewall my ISP router by having my own = router at the
edge of *my* home network.

Applications and cloud services that try to take away from me = the ability to
control what goes on inside my = personal home network will be added to my
"do not trust" = list.

I'm thinking what I'd really like is for my home router to = have a feature I can
enable that lets me = block all traffic to known public DNS services. I'm pretty
sure that would go a long ways to restoring my ability to use = DNS as a
reasonably effective control surface. I'm not = happy that some people are
claiming I can't control DNS in = my own home because they've succeeded in
taking this = control away from me. My home network belongs to me, and I'm
going to do what I can to keep it that way.

Just like = it turned out to be good for everyone to have a good definition of
NAT and DNS proxy, it would probably be good if = this "public DNS blocking"
functionality were thoughtfully = designed to avoid unnecessary breakage.
IETF may or may = not be the right place to design it. Suggestions that people
go elsewhere to design something like this may be correct. = OTOH, if
application and cloud providers wanted to have = input to the design, IETF
might indeed be the right = place.

It wouldn't surprise me if coffee shops, hotels, and = enterprises didn't also
choose to enable such = a feature. Regulators in some countries might even
insist = on it.
Barbara

--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add

= --Apple-Mail=_574A047D-CA03-4CA5-8140-73967B29E1B0-- From nobody Fri Aug 9 07:42:24 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C9D371200B4 for ; Fri, 9 Aug 2019 07:42:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=umich.edu Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1wSIWHNUQCe9 for ; Fri, 9 Aug 2019 07:42:20 -0700 (PDT) Received: from mail-lj1-x22f.google.com (mail-lj1-x22f.google.com [IPv6:2a00:1450:4864:20::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 639C512008F for ; Fri, 9 Aug 2019 07:42:19 -0700 (PDT) Received: by mail-lj1-x22f.google.com with SMTP id m8so58715548lji.7 for ; Fri, 09 Aug 2019 07:42:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=umich.edu; s=google-2016-06-03; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=BJEP2AjxOwto5ir6o46G7n5hlP+0vsJiyiGyVkvEcqQ=; b=nF/wAGWAKqhYTc7piYVdOn5SXeUg/NxRLjdce09SwOZnuSEXcrrE5RXMdQOs4rlDol e5bJxp+xFxsNQibVjR7MU2j6D4T91dE+p1tWSSatB5C5kU0TXzrVu2DwupMHk6xLqso7 3c2w1lnocxICM/cJIZnZKUJBjWDULARxKvDnQuhge5VuhlUwHCQMS2rBFPy/cEzxU4RV HQ4opOuLjEj6DTXt30Ahh7fxTUUFAZEOwLwGcCMZSf+JKXUwXkhkNY3HiLgcyQZ2ZtWA EUrqEit6QMk1nRvgS0dM9UV+WGxuQuanqFi5dMOwYbtRHl1uf8NAIxJaEd4b+iUnFHQm efiw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=BJEP2AjxOwto5ir6o46G7n5hlP+0vsJiyiGyVkvEcqQ=; b=WKxP5Lm5KJQ+hD8YMFe9iu/1od8wwHQToeJUkinj/WB1UkiFZfyCsu1XhtgdVQDj57 LDDbqq7uoqRmyMroqpBfUBE7VvehDJ4LHqdhW37/LSADUh96y8k6mHxiJFpzL9Xsd4RT 2ATOfUVXzE40yoTHndM3Opxef95rJiq96wTl/dA2EmORXu5Lp8ikkCeOD2SlI4BF9YdY b88WxI1Gi5/ju1ngJrA3gsoSXNjPvqE0vw/dBUuSYjKCLVXvzWnEgaIQaMeuUKCdaWyR TFkr9rQXFU16MdfFZiQClFzyv2evUcqWOKPvW1cHwDNYnV/gIxtGmN9J/uOTl20aeaJV cv0Q== X-Gm-Message-State: APjAAAUgD2jJYvS0SFgsDZcraHULPqn77KLFZLn3B3N74+rgclt4bWK8 HA6B8tMDDcBMyUAzBTzf6T6CmEwQrPUFOOt4b8rBVw== X-Google-Smtp-Source: APXvYqzXjOZJWItYBi8VUlaDoFRquay5KyhUyYW3uPr/X/j8Krfrh4oH5y32VHHMfunq8Gf3jYaSeLfqAAdw2dyTH4I= X-Received: by 2002:a2e:2e0b:: with SMTP id u11mr3675293lju.10.1565361737593; Fri, 09 Aug 2019 07:42:17 -0700 (PDT) MIME-Version: 1.0 References: <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <2EF61DAB-8371-4257-82A0-8622A8F2B178@cable.comcast.com> <848E4388-BDD3-4B36-838D-15703AAFE543@hopcount.ca> <6a3ad62b-2024-4010-b4d6-c6693309ac2e@www.fastmail.com> In-Reply-To: From: Bob Harold Date: Fri, 9 Aug 2019 10:42:06 -0400 Message-ID: To: Bret Jordan Cc: Rob Sayre , ADD Mailing list , Martin Thomson Content-Type: multipart/alternative; boundary="000000000000508f34058fb02e03" Archived-At: Subject: Re: [Add] Control X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 09 Aug 2019 14:42:23 -0000 --000000000000508f34058fb02e03 Content-Type: text/plain; charset="UTF-8" As an example of split DNS: Split DNS is needed when we have a VPN from our internal network to a cloud provider (like AWS) that uses RFC1918 addresses and NAT to public IP addresses. Things that can be reached over the VPN must use the internal RFC1918 address, but everything else needs to use the public address. -- Bob Harold On Fri, Aug 9, 2019 at 10:15 AM Bret Jordan wrote: > Split DNS is a critical use case. It is not just development systems that > are not addressable on the outside, but nearly all HR and financial systems > as well. It is very common for organizations to have several orders of > magnitude more internal names than external names. > > > Thanks, > Bret > PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 > "Without cryptography vihv vivc ce xhrnrw, however, the only thing that > can not be unscrambled is an egg." > > On Aug 8, 2019, at 10:16 PM, Rob Sayre wrote: > > On Thu, Aug 8, 2019 at 6:59 PM Martin Thomson wrote: > >> >> You might rightly point out that such an endeavour is foolishly broad in >> scope. But I don't think that it is necessary to understand the system in >> totality. Working through a few of the most critical cases might be >> enough. My hope for today, which may be vain indeed, is that working >> through the those important cases in some detail will lead to better >> information about how other cases might be handled. >> > > I agree that captive portals are an uncontentious problem to solve here. > Something similarly ubiquitous and uncontentious might be resolving > intranet resources (phonebooks, wikis, issue trackers, etc). Those often > don't resolve outside of the office (or its VPN). It seems like always > using Cloudflare et al. would break this use case, although I don't mean to > imply anyone is /trying/ to break it. > > thanks, > Rob > > --000000000000508f34058fb02e03 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
As an example of split DNS:
Split DNS is ne= eded when we have a VPN from our internal network to a cloud provider (like= AWS) that uses RFC1918 addresses and NAT to public IP addresses.=C2=A0 Thi= ngs that can be reached over the VPN must use the internal RFC1918 address,= but everything else needs to use the public address.

<= div>--=C2=A0
Bob Harold


On Fri, Aug 9, 2019 at 10:15 AM Bret Jordan <jordan.ietf@gmail.com> wrote:
Split DNS is a critical use case.=C2=A0 It is not just developme= nt systems that are not addressable on the outside, but nearly all HR and f= inancial systems as well.=C2=A0 It is very common for organizations to have= several orders of magnitude more internal names than external names.
<= br>

Thanks,
Bret
PGP Fingerprint:=C2=A063B4 FC53 680A 6B7D 1447 =C2=A0F2C0 74F8 ACAE 7415 0050
"With= out cryptography vihv vivc ce xhrnrw, however, the only thing that can not = be unscrambled is an egg."

On Aug 8, 2019, at 10:16 PM, Rob Sa= yre <sayrer@gmail.= com> wrote:

On Thu, Aug 8, 2019 = at 6:59 PM Martin Thomson <mt@lowentropy.net> wrote:

You might rightly point out that such an endeavour is foolishly broad in sc= ope.=C2=A0 But I don't think that it is necessary to understand the sys= tem in totality.=C2=A0 Working through a few of the most critical cases mig= ht be enough.=C2=A0 My hope for today, which may be vain indeed, is that wo= rking through the those important cases in some detail will lead to better = information about how other cases might be handled.
I agree that captive portals are an uncontentious problem to s= olve here. Something similarly ubiquitous and uncontentious might be resolv= ing intranet resources (phonebooks, wikis, issue trackers, etc). Those ofte= n don't resolve outside of the office (or its VPN). It seems like alway= s using Cloudflare et al. would break this use case, although I don't m= ean to imply anyone is /trying/ to break it.

thank= s,
Rob

<= /div>
--000000000000508f34058fb02e03-- From nobody Fri Aug 9 07:44:17 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 44AB91200B4 for ; Fri, 9 Aug 2019 07:44:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nohats.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 07E0Z6_f7tDj for ; Fri, 9 Aug 2019 07:44:14 -0700 (PDT) Received: from mx.nohats.ca (mx.nohats.ca [193.110.157.68]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 80C7012008F for ; Fri, 9 Aug 2019 07:44:14 -0700 (PDT) Received: from localhost (localhost [IPv6:::1]) by mx.nohats.ca (Postfix) with ESMTP id 464p0X2tsLzCvw; Fri, 9 Aug 2019 16:44:12 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nohats.ca; s=default; t=1565361852; bh=kx1RIa3MO/1a6HZvbgJLPifuoCoZ8MpTRqVeISDqfxY=; h=Date:From:To:cc:Subject:In-Reply-To:References; b=KMkFBCnya4UdvpwvTUuJddWF4IdOYeFWeur/Jf8JLS/3MKJn05cgaHngBHWRAq/Yw 65NR+IuikO+88Rm+BxOjJWjBNA0xkDCNXAFzttPTlZdz6sJjrHwjH/yunGKBvocYrd gOGX9CsXyvQFC/puNZ+llacTaO0ZhQXwmcRoPVT0= X-Virus-Scanned: amavisd-new at mx.nohats.ca Received: from mx.nohats.ca ([IPv6:::1]) by localhost (mx.nohats.ca [IPv6:::1]) (amavisd-new, port 10024) with ESMTP id yhywDI-B7xbJ; Fri, 9 Aug 2019 16:44:11 +0200 (CEST) Received: from bofh.nohats.ca (bofh.nohats.ca [76.10.157.69]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx.nohats.ca (Postfix) with ESMTPS; Fri, 9 Aug 2019 16:44:11 +0200 (CEST) Received: by bofh.nohats.ca (Postfix, from userid 1000) id 30AB13540BB; Fri, 9 Aug 2019 10:44:10 -0400 (EDT) DKIM-Filter: OpenDKIM Filter v2.11.0 bofh.nohats.ca 30AB13540BB Received: from localhost (localhost [127.0.0.1]) by bofh.nohats.ca (Postfix) with ESMTP id 2B1EC401AEE6; Fri, 9 Aug 2019 10:44:10 -0400 (EDT) Date: Fri, 9 Aug 2019 10:44:10 -0400 (EDT) From: Paul Wouters To: Paul Hoffman cc: ADD Mailing list In-Reply-To: <474778E2-BC34-4D87-951E-9CA2174F4F77@icann.org> Message-ID: References: <474778E2-BC34-4D87-951E-9CA2174F4F77@icann.org> MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII; format=flowed Archived-At: Subject: Re: [Add] Chromecast using 8.8.8.8 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 09 Aug 2019 14:44:16 -0000 On Fri, 9 Aug 2019, Paul Hoffman wrote: > For every DNS lookup, the Chromecast sends the the same query to 8.8.8.8 *and* the resolver that it was given by DHCP. A popular way to control a Chromecast is with the GoogleHome application on a phone. On my iPhone on the same wireless access point, GoogleHome always used the resolver from DHCP. Note that GoogleHome gave the Wifi password to the Chromecast during setup, so it could have passed other settings like the resolver address, but appears not to have. This is not the behaviour I am seeing on my Chromecast Ultra. Local DNS is completely ignored and never queried, and the only DNS packets I see go to 8.8.8.8. Paul From nobody Fri Aug 9 07:48:52 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2697612008F for ; Fri, 9 Aug 2019 07:48:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GJX0YFmwkSez for ; Fri, 9 Aug 2019 07:48:49 -0700 (PDT) Received: from out.west.pexch112.icann.org (out.west.pexch112.icann.org [64.78.40.7]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 338401200B4 for ; Fri, 9 Aug 2019 07:48:49 -0700 (PDT) Received: from PMBX112-W1-CA-1.pexch112.icann.org (64.78.40.21) by PMBX112-W1-CA-1.pexch112.icann.org (64.78.40.21) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Fri, 9 Aug 2019 07:48:47 -0700 Received: from PMBX112-W1-CA-1.pexch112.icann.org ([64.78.40.21]) by PMBX112-W1-CA-1.PEXCH112.ICANN.ORG ([64.78.40.21]) with mapi id 15.00.1473.005; Fri, 9 Aug 2019 07:48:47 -0700 From: Paul Hoffman To: Paul Wouters CC: ADD Mailing list Thread-Topic: [Ext] [Add] Chromecast using 8.8.8.8 Thread-Index: AQHVTsGMUExfsXhnikmn0oUEmTzs8g== Date: Fri, 9 Aug 2019 14:48:46 +0000 Message-ID: References: <474778E2-BC34-4D87-951E-9CA2174F4F77@icann.org> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [192.0.32.234] Content-Type: text/plain; charset="us-ascii" Content-ID: Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: Re: [Add] [Ext] Chromecast using 8.8.8.8 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 09 Aug 2019 14:48:50 -0000 On Aug 9, 2019, at 7:44 AM, Paul Wouters wrote: >=20 > On Fri, 9 Aug 2019, Paul Hoffman wrote: >=20 >> For every DNS lookup, the Chromecast sends the the same query to 8.8.8.8= *and* the resolver that it was given by DHCP. A popular way to control a C= hromecast is with the GoogleHome application on a phone. On my iPhone on th= e same wireless access point, GoogleHome always used the resolver from DHCP= . Note that GoogleHome gave the Wifi password to the Chromecast during setu= p, so it could have passed other settings like the resolver address, but ap= pears not to have. >=20 > This is not the behaviour I am seeing on my Chromecast Ultra. Local DNS > is completely ignored and never queried, and the only DNS packets I see > go to 8.8.8.8. Thanks for the report! I'll order one now and make some pcaps. I'm still quite interested in other reports of devices and applications tha= t by default don't use the configured resolver. Hopefully they are not too = expensive...=20 --Paul Hoffman= From nobody Fri Aug 9 08:26:12 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F051D120020 for ; Fri, 9 Aug 2019 08:26:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9Cq06EBlie-i for ; Fri, 9 Aug 2019 08:26:08 -0700 (PDT) Received: from mail-pg1-x532.google.com (mail-pg1-x532.google.com [IPv6:2607:f8b0:4864:20::532]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6FB3B120019 for ; Fri, 9 Aug 2019 08:26:08 -0700 (PDT) Received: by mail-pg1-x532.google.com with SMTP id u17so46027120pgi.6 for ; Fri, 09 Aug 2019 08:26:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=KUslYsPTBmj0kk7yLXhHnpzm/etzzO+aAn5du0ckxJ0=; b=LS+iX7z/Zz9U9jzIgEBHnVSnVsYcS/RHBchHO8lZixQz+/SgvokhyFeTzuMWugkggh uIv2SCx4nSghf/urQ0tpqekmPsE1h6hFK6ZUTl/ckGhzmkI9egb/Cyjb0zgSrsc5pNWm KbWQscNPdLiASIVpp9R26rU0Ybzt1p6xihxCMPrHdq69z5I2rIAtzDkQyVHQKPjeNpLj koP8YGFQHjaLBwbnquzXnAlqA0C+1qgpk0GWa7DaveCRDvCb7hNXepY+xJPGPueId7ku 1ECCxoYLYph5SPt10iWa28eLzr06IwvSUU7+P3Jelef/Fj06wjoepbTSf2QUn0qNwVzz GqGQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=KUslYsPTBmj0kk7yLXhHnpzm/etzzO+aAn5du0ckxJ0=; b=O6a3MY6mkBf7TEtBOPuJoj1g6A7hyD7k6ea586D/UQyKA4DugcFrRZsp6cP6p+Tbfe XCGU9W7lerLsLCBnqmHD+o9X6azMyoTTWxDIvVFphTqgPnByzD3IiWdshtryLuM6IPyk 1Cw/5/rHj23WeOylrBWWSScHHsyVCgh2agYET1oNrOaAaW6Vu/t++QZdSThRgXveuoGk qIaxVMMO4d1lU5xyWgivEmbSVxXALun2pNNqBZZG449xbYvYc0Nc559Ck7tJNaMwiI/C d/VBThpDzu/ge/ii6cErksX7t0l30fzD+o5vW5GkaT6QvjBOkX0idZLuCuKh+UZKHuU2 VcyQ== X-Gm-Message-State: APjAAAV2yWMypgNWFaiSHMlvtWr7O5qt4tO4Ry6Pmfu0SmA4S5AY7ai3 njLUKnqaoeRW50sDCUBwMsqSOg== X-Google-Smtp-Source: APXvYqwK+OC/omxnWIXGzb51d6BfUaImEf1Z4vYKOCyjcWdAvKv2bJ60SUZNkL5/M6xIr6BVLJUk3Q== X-Received: by 2002:a17:90a:360b:: with SMTP id s11mr9853433pjb.51.1565364367666; Fri, 09 Aug 2019 08:26:07 -0700 (PDT) Received: from ?IPv6:2600:380:c06a:a873:95f4:4967:80d3:2c64? ([2600:380:c06a:a873:95f4:4967:80d3:2c64]) by smtp.gmail.com with ESMTPSA id a12sm24278362pgv.48.2019.08.09.08.26.06 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 09 Aug 2019 08:26:07 -0700 (PDT) Content-Type: multipart/alternative; boundary=Apple-Mail-039E0E53-8860-4115-872E-DCE7EF520560 Mime-Version: 1.0 (1.0) From: Ted Lemon X-Mailer: iPhone Mail (16G77) In-Reply-To: <026A530C-D472-4B46-AD3C-B8F177C65334@gmail.com> Date: Fri, 9 Aug 2019 08:26:05 -0700 Cc: "STARK, BARBARA H" , ADD Mailing list , Rob Sayre Content-Transfer-Encoding: 7bit Message-Id: <8EB1B35B-4E9C-4C64-8306-CB05F9610882@fugue.com> References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <026A530C-D472-4B46-AD3C-B8F177C65334@gmail.com> To: Bret Jordan Archived-At: Subject: Re: [Add] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 09 Aug 2019 15:26:11 -0000 --Apple-Mail-039E0E53-8860-4115-872E-DCE7EF520560 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Bret, I=E2=80=99m not upset. Please don=E2=80=99t turn this into an emotion= al thing. It=E2=80=99s really hard to converge on understanding if we are ta= lking about how we feel rather than about what works.=20 What I am is aware of the trust relationship. If a network blocks services I= want on order to force me to trust the operator (or for any other reason), I= don=E2=80=99t use it. It=E2=80=99s not emotional. I don=E2=80=99t hold it a= gainst the operator. I just respond appropriately to the situation. =20 Sent from my iPhone > On Aug 9, 2019, at 7:32 AM, Bret Jordan wrote: >=20 > Just so I understand correctly. You are upset that a company is allowing y= ou to use _their_ network, probably for free, and they put controls on _thei= r_ network?=20 >=20 >=20 > Thanks, > Bret > PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 > "Without cryptography vihv vivc ce xhrnrw, however, the only thing that ca= n not be unscrambled is an egg." >=20 >> On Aug 9, 2019, at 7:14 AM, Ted Lemon wrote: >>=20 >> For my part, I would rather have the option to use public DNS. DoH lets m= e do that when without it I would have no control, because the SP would be t= aking that control from me.=20 >>=20 >> True, on my home net, I can set up the resolver I want, and in that case I= am better off if apps use my configured resolver. That=E2=80=99s the use ca= se you=E2=80=99re talking about. But when I=E2=80=99m in a coffee shop, I ha= ve no reason to trust the local network administrator. In this case, DoH giv= es me the assurance that I am talking to the resolver I intended to use.=20 >>=20 >> IOW, the administrator role is a bit more nuanced than what you just said= , even though I agree with your choice in that particular case. =20 >>=20 >> I guess the difference is where you think the edge of the administrative d= omain is... :) >>=20 >> Sent from my iPhone >>=20 >> On Aug 9, 2019, at 5:25 AM, STARK, BARBARA H wrote: >>=20 >>>> I'm not sure everyone views "network administrator" as a valid role, at= least in contexts where the administrator does not also control the device.= >>>=20 >>> Many enterprises and small businesses allow employees to attach personal= devices to their networks. I think it's completely valid for businesses to a= dminister their networks as they wish without banning personal devices or re= quiring employees to turn over control of personal devices. >>>=20 >>> Personally, I view my role as network administrator of my home network t= o be *extremely* valid -- including when I allow guests' devices (which I do= n't control) to attach to my network. And I often doubt that I really have "= control" over my Smart TVs and Chromecast (which is why they get to be toget= her on their own little subnet so they can't see or be seen by the rest of t= he home network -- I connect to the subnet Wi-Fi AP to use them). I don't ha= ve any Android devices, because I don't believe there's the remotest possibi= lity of being in "control" of them. I flashed a Linux OS on my Lenovo laptop= when I realized I didn't control the original OS that Lenovo had heavily "c= ustomized". I even firewall my ISP router by having my own router at the edg= e of *my* home network. >>>=20 >>> Applications and cloud services that try to take away from me the abilit= y to control what goes on inside my personal home network will be added to m= y "do not trust" list. =20 >>>=20 >>> I'm thinking what I'd really like is for my home router to have a featur= e I can enable that lets me block all traffic to known public DNS services. I= 'm pretty sure that would go a long ways to restoring my ability to use DNS a= s a reasonably effective control surface. I'm not happy that some people are= claiming I can't control DNS in my own home because they've succeeded in ta= king this control away from me. My home network belongs to me, and I'm going= to do what I can to keep it that way.=20 >>>=20 >>> Just like it turned out to be good for everyone to have a good definitio= n of NAT and DNS proxy, it would probably be good if this "public DNS blocki= ng" functionality were thoughtfully designed to avoid unnecessary breakage. I= ETF may or may not be the right place to design it. Suggestions that people g= o elsewhere to design something like this may be correct. OTOH, if applicati= on and cloud providers wanted to have input to the design, IETF might indeed= be the right place. >>>=20 >>> It wouldn't surprise me if coffee shops, hotels, and enterprises didn't a= lso choose to enable such a feature. Regulators in some countries might even= insist on it. >>> Barbara >>> --=20 >>> Add mailing list >>> Add@ietf.org >>> https://www.ietf.org/mailman/listinfo/add >>=20 >> --=20 >> Add mailing list >> Add@ietf.org >> https://www.ietf.org/mailman/listinfo/add >=20 --Apple-Mail-039E0E53-8860-4115-872E-DCE7EF520560 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable Bret, I=E2=80=99m not upset.  Please d= on=E2=80=99t turn this into an emotional thing. It=E2=80=99s really hard to c= onverge on understanding if we are talking about how we feel rather than abo= ut what works. 

What I am is aware of the trust rela= tionship. If a network blocks services I want on order to force me to trust t= he operator (or for any other reason), I don=E2=80=99t use it.  It=E2=80= =99s not emotional. I don=E2=80=99t hold it against the operator. I just res= pond appropriately to the situation.  

Sent from my iPhone

On Aug 9, 20= 19, at 7:32 AM, Bret Jordan <jor= dan.ietf@gmail.com> wrote:

Just so I understand correctly.  You are upset that a compan= y is allowing you to use _their_ network, probably for free, and they put co= ntrols on _their_ network? 


Thanks,
Bret
<= div class=3D"" style=3D"word-wrap: break-word; -webkit-nbsp-mode: space; lin= e-break: after-white-space;">
<= span class=3D"" style=3D"font-size: 11px;">PGP Fingerprint: 63B4 FC53 680A 6B7= D 1447  F2C0 74F8 ACAE 7415 0050
"Without cr= yptography vihv vivc ce xhrnrw, however, the only thing that can not be unsc= rambled is an egg."

On A= ug 9, 2019, at 7:14 AM, Ted Lemon <mellon@fugue.com> wrote:

For my part, I would rather have t= he option to use public DNS. DoH lets me do that when without it I would hav= e no control, because the SP would be taking that control from me.

True, on my home net, I can set up the resolver I want,= and in that case I am better off if apps use my configured resolver. That=E2= =80=99s the use case you=E2=80=99re talking about. But when I=E2=80=99m in a= coffee shop, I have no reason to trust the local network administrator. In t= his case, DoH gives me the assurance that I am talking to the resolver I int= ended to use.

IOW, the administrator role is a= bit more nuanced than what you just said, even though I agree with your cho= ice in that particular case.  

I guess the= difference is where you think the edge of the administrative domain is... &= nbsp;:)

Sent from my iPhone

On Aug 9, 2019, at 5:25 AM, STARK, BARBARA H <bs7652@att.com> wrote:

I'm not sure everyone views "network administrator" as a valid role,= at least in contexts where the administrator does not also control the devi= ce.

Many enterprises and small bus= inesses allow employees to attach personal devices to their networks. I thin= k it's completely valid for businesses to administer their networks as they w= ish without banning personal devices or requiring employees to turn over con= trol of personal devices.

Personally, I view my= role as network administrator of my home network to be *extremely* valid --= including when I allow guests' devices (which I don't control) to attach to= my network. And I often doubt that I really have "control" over my Smart TV= s and Chromecast (which is why they get to be together on their own little s= ubnet so they can't see or be seen by the rest of the home network -- I conn= ect to the subnet Wi-Fi AP to use them). I don't have any Android devices, b= ecause I don't believe there's the remotest possibility of being in "control= " of them. I flashed a Linux OS on my Lenovo laptop when I realized I didn't= control the original OS that Lenovo had heavily "customized". I even firewa= ll my ISP router by having my own router at the edge of *my* home network.
Applications and cloud services that try to take= away from me the ability to control what goes on inside my personal home ne= twork will be added to my "do not trust" list.  

I'm thinking what I'd really like is for my home router to have a fea= ture I can enable that lets me block all traffic to known public DNS service= s. I'm pretty sure that would go a long ways to restoring my ability to use D= NS as a reasonably effective control surface. I'm not happy that some people= are claiming I can't control DNS in my own home because they've succeeded i= n taking this control away from me. My home network belongs to me, and I'm g= oing to do what I can to keep it that way.

Jus= t like it turned out to be good for everyone to have a good definition of NA= T and DNS proxy, it would probably be good if this "public DNS blocking" fun= ctionality were thoughtfully designed to avoid unnecessary breakage. IETF ma= y or may not be the right place to design it. Suggestions that people go els= ewhere to design something like this may be correct. OTOH, if application an= d cloud providers wanted to have input to the design, IETF might indeed be t= he right place.

It wouldn't surprise me if coff= ee shops, hotels, and enterprises didn't also choose to enable such a featur= e. Regulators in some countries might even insist on it.
Barba= ra
--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listi= nfo/add

--
Add m= ailing list
Add@iet= f.org
https://www.ietf.org/mailman/listinfo/add

= --Apple-Mail-039E0E53-8860-4115-872E-DCE7EF520560-- From nobody Fri Aug 9 08:29:16 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 06E7F1201B7 for ; Fri, 9 Aug 2019 08:29:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XQKP27qPqbT3 for ; Fri, 9 Aug 2019 08:28:57 -0700 (PDT) Received: from mail-pl1-x631.google.com (mail-pl1-x631.google.com [IPv6:2607:f8b0:4864:20::631]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9C9B912008A for ; Fri, 9 Aug 2019 08:28:57 -0700 (PDT) Received: by mail-pl1-x631.google.com with SMTP id y8so2989958plr.12 for ; Fri, 09 Aug 2019 08:28:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=3t3ZDBe9hrTP2JcCpR9+UhB8kCBdwKPogdlP0G32QPs=; b=S5eKMlCfaAXX/xsBrgFIDEcJ3F2c3V+Yah+NrxKWGUxMQKedoAHYUmQXRsXkc4Fu0T JXxcTNh4eDTOWBpPkH51EDYCQ3gcYn8Q9W/2DuVmMuVaU/unHDaYS6Izmcg512khxDg8 APT3mqFlhZDmyLU9ckgIGVGOssLDePOUqchqCD3Taf5R8nLU+fQ1YmPceuelcylksDzp 2dWZGJI4lJazPl6F/lZwUsXPgyd/wqS5kVmlFTiPYhlHYs9KNepJKCT7uqaHsrbYFGBI pshCpd6zUBQYoG2W138e/Ne/3MW7Ld/IZOtmWFHCHIaLvPhVlEh7r0Ld99w4Gx9nsYYm 8o1Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=3t3ZDBe9hrTP2JcCpR9+UhB8kCBdwKPogdlP0G32QPs=; b=bz5bhcDrccxqQjWUlFzMDsJBuaolE93sRln6VgnDIlBhpYot+SfqUs0lnWy/NnBAJI H2C1brl2OsLY9bXEV3WbNEGbApde8lMW7zH7RzNXO2MIFmF8//AX2I/LGxQdbnGh4tbZ fOGsClipIY0kyJo1p16Ok9fnPX9d59/3V2xtWrMs/i2MdaWkZnA2CgRAvzj1Z/FANDY/ EiaUnFXN9j0IZtfrpIMXo1GLVqPK6zA4/l0Ay35VDNkJ12Pd0xXdsLCcDmLC+/Zh92Yp Y7hphSZXhsZzZ46VK4TqagSiQJHS5yiz5qMuhX0NLZenuwYSbnVtuPxCr9Ksh9OhYCbs 7JHQ== X-Gm-Message-State: APjAAAW59GrFGqHQhMsPYasUcLKmDkreq/hfFFHsY5VOm0IuoRBnRTpL dpoohr7yQTCg3+TpXa9VY7exJVxE6rM= X-Google-Smtp-Source: APXvYqzCrSKKqrSN/iwqNTSyiMetTKR4/k4MM6fdxZoCtdKEm8qejlup6dR3GAf5TzNpLntqvygeng== X-Received: by 2002:a17:902:7d8b:: with SMTP id a11mr19432542plm.306.1565364536911; Fri, 09 Aug 2019 08:28:56 -0700 (PDT) Received: from ?IPv6:2600:380:c06a:a873:95f4:4967:80d3:2c64? ([2600:380:c06a:a873:95f4:4967:80d3:2c64]) by smtp.gmail.com with ESMTPSA id v12sm5337538pjk.13.2019.08.09.08.28.55 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 09 Aug 2019 08:28:56 -0700 (PDT) Content-Type: multipart/alternative; boundary=Apple-Mail-5BC628F4-B23F-438C-B363-980624111C5A Mime-Version: 1.0 (1.0) From: Ted Lemon X-Mailer: iPhone Mail (16G77) In-Reply-To: <91DA56FA-D763-40A0-BD60-0511843D0B6D@gmail.com> Date: Fri, 9 Aug 2019 08:28:55 -0700 Cc: ADD Mailing list Content-Transfer-Encoding: 7bit Message-Id: <0698FC6A-C529-424B-90BC-7CFF1AA26366@fugue.com> References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <2D09D61DDFA73D4C884805CC7865E6114E25D54A@GAALPA1MSGUSRBF.ITServices.sbc.com> <4AA11EE0-73B4-40C6-85D7-6054E00504C2@fugue.com> <91DA56FA-D763-40A0-BD60-0511843D0B6D@gmail.com> To: Bret Jordan Archived-At: Subject: Re: [Add] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 09 Aug 2019 15:29:14 -0000 --Apple-Mail-5BC628F4-B23F-438C-B363-980624111C5A Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Bret, that=E2=80=99s perfectly okay. Nobody will use that network, but that=E2= =80=99s fine. If there is a statutory reason why some use case requires that= degree of intercept, then that network will be used only for use cases that= fall into that regime, and a different network and device will be used for a= ll other traffic. This is a good outcome. Air gaps are also appropriate some= times! It just depends on the use case. I=E2=80=99m not going to air gap my= phone! :) Sent from my iPhone > On Aug 9, 2019, at 7:40 AM, Bret Jordan wrote: >=20 > The ideological view needs to be careful. If we push to far one way, orga= nizations may just go back to a no-default-route, and force all traffic thro= ugh their full TLS inspection device. They may do this because the regulato= r requires them to do so. Once a theory of harm document gets written for th= is, because we have backed them in to a corner, things will get much worse.=20= >=20 >=20 > Thanks, > Bret > PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 > "Without cryptography vihv vivc ce xhrnrw, however, the only thing that ca= n not be unscrambled is an egg." >=20 >> On Aug 9, 2019, at 8:00 AM, Ted Lemon wrote: >>=20 >> The point is, with DoH, if that really turns out to be true, the escalati= on will continue. If you want to not have DoH go completely stealth, then as= an operator the last thing you want to do is block well known DoH servers.=20= >>=20 >> Sent from my iPhone >>=20 >>>> On Aug 9, 2019, at 6:54 AM, STARK, BARBARA H wrote: >>>>=20 >>>>=20 >>>> For my part, I would rather have the option to use public DNS. DoH lets= me >>>> do that when without it I would have no control, because the SP would b= e >>>> taking that control from me. >>>>=20 >>>> True, on my home net, I can set up the resolver I want, and in that cas= e I am >>>> better off if apps use my configured resolver. That=E2=80=99s the use c= ase you=E2=80=99re >>>> talking about. But when I=E2=80=99m in a coffee shop, I have no reason t= o trust the >>>> local network administrator. In this case, DoH gives me the assurance t= hat I >>>> am talking to the resolver I intended to use. >>>=20 >>> Oh, I don't trust public Wi-Fi at all. I avoid using it unless I feel li= ke I really need it. I avoid checking email or FB or financial apps (make su= re they're all closed, and none allow notifications) if I do attach to one. B= TW, I don't trust VPN providers either -- so I don't personally see that as a= good alternative. I agree that if I were to use a public Wi-Fi, I would pre= fer to use something like DoH. But what I was saying, is I don't think there= is anything I (or you) can do to prevent a coffee shop from blocking traffi= c to public DNS providers -- if they chose to do so. And it wouldn't surpris= e me if they did so choose. >>>=20 >>> I'm not advocating for this. I'm just a realist and I think it's an unav= oidable response to what's going on. >>>=20 >>> Ultimately, network operators (especially operators of private networks -= - and coffee shop hotspots, a lot of "public" Wi-Fi, and enterprises are sti= ll private networks) *do* still have control of their networks. >>> Barbara >>>=20 >>>> IOW, the administrator role is a bit more nuanced than what you just sa= id, >>>> even though I agree with your choice in that particular case. >>>>=20 >>>> I guess the difference is where you think the edge of the administrativ= e >>>> domain is... :) >>>>=20 >>>> Sent from my iPhone >>>>=20 >>>> On Aug 9, 2019, at 5:25 AM, STARK, BARBARA H wrote: >>>>=20 >>>>>> I'm not sure everyone views "network administrator" as a valid role, a= t >>>> least in contexts where the administrator does not also control the dev= ice. >>>>>=20 >>>>> Many enterprises and small businesses allow employees to attach person= al >>>> devices to their networks. I think it's completely valid for businesses= to >>>> administer their networks as they wish without banning personal devices= or >>>> requiring employees to turn over control of personal devices. >>>>>=20 >>>>> Personally, I view my role as network administrator of my home network= to >>>> be *extremely* valid -- including when I allow guests' devices (which I= don't >>>> control) to attach to my network. And I often doubt that I really have >>>> "control" over my Smart TVs and Chromecast (which is why they get to be= >>>> together on their own little subnet so they can't see or be seen by the= rest of >>>> the home network -- I connect to the subnet Wi-Fi AP to use them). I do= n't >>>> have any Android devices, because I don't believe there's the remotest >>>> possibility of being in "control" of them. I flashed a Linux OS on my L= enovo >>>> laptop when I realized I didn't control the original OS that Lenovo had= heavily >>>> "customized". I even firewall my ISP router by having my own router at t= he >>>> edge of *my* home network. >>>>>=20 >>>>> Applications and cloud services that try to take away from me the abil= ity to >>>> control what goes on inside my personal home network will be added to m= y >>>> "do not trust" list. >>>>>=20 >>>>> I'm thinking what I'd really like is for my home router to have a feat= ure I can >>>> enable that lets me block all traffic to known public DNS services. I'm= pretty >>>> sure that would go a long ways to restoring my ability to use DNS as a >>>> reasonably effective control surface. I'm not happy that some people ar= e >>>> claiming I can't control DNS in my own home because they've succeeded i= n >>>> taking this control away from me. My home network belongs to me, and I'= m >>>> going to do what I can to keep it that way. >>>>>=20 >>>>> Just like it turned out to be good for everyone to have a good definit= ion of >>>> NAT and DNS proxy, it would probably be good if this "public DNS blocki= ng" >>>> functionality were thoughtfully designed to avoid unnecessary breakage.= >>>> IETF may or may not be the right place to design it. Suggestions that p= eople >>>> go elsewhere to design something like this may be correct. OTOH, if >>>> application and cloud providers wanted to have input to the design, IET= F >>>> might indeed be the right place. >>>>>=20 >>>>> It wouldn't surprise me if coffee shops, hotels, and enterprises didn'= t also >>>> choose to enable such a feature. Regulators in some countries might eve= n >>>> insist on it. >>>>> Barbara >>=20 >> --=20 >> Add mailing list >> Add@ietf.org >> https://www.ietf.org/mailman/listinfo/add >=20 --Apple-Mail-5BC628F4-B23F-438C-B363-980624111C5A Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable Bret, that=E2=80=99s perfectly okay. Nobody= will use that network, but that=E2=80=99s fine. If there is a statutory rea= son why some use case requires that degree of intercept, then that network w= ill be used only for use cases that fall into that regime, and a different n= etwork and device will be used for all other traffic. This is a good outcome= . Air gaps are also appropriate sometimes!  It just depends on the use c= ase. I=E2=80=99m not going to air gap my phone!  :)

Sent from my iPhone
On Aug 9, 2019, at 7:40 AM, Bret Jordan <jordan.ietf@gmail.com> wrote:

The ideological view needs to be car= eful.  If we push to far one way, organizations may just go back to a n= o-default-route, and force all traffic through their full TLS inspection dev= ice.  They may do this because the regulator requires them to do so. On= ce a theory of harm document gets written for this, because we have backed t= hem in to a corner, things will get much worse. 
<= br class=3D"">

Thanks,
Bret
<= div class=3D"" style=3D"word-wrap: break-word; -webkit-nbsp-mode: space; lin= e-break: after-white-space;">
<= span class=3D"" style=3D"font-size: 11px;">PGP Fingerprint: 63B4 FC53 680A 6B7= D 1447  F2C0 74F8 ACAE 7415 0050
"Without cr= yptography vihv vivc ce xhrnrw, however, the only thing that can not be unsc= rambled is an egg."

On A= ug 9, 2019, at 8:00 AM, Ted Lemon <mellon@fugue.com> wrote:

The point is, with DoH, if that re= ally turns out to be true, the escalation will continue. If you want to not h= ave DoH go completely stealth, then as an operator the last thing you want t= o do is block well known DoH servers.

Sent fro= m my iPhone

On Aug 9, 2019, at 6:54 AM, STARK, BARBARA H <bs7652@att.com> wrote:


For my part, I would r= ather have the option to use public DNS. DoH lets me
do that w= hen without it I would have no control, because the SP would be
taking that control from me.

True, on my home= net, I can set up the resolver I want, and in that case I am
= better off if apps use my configured resolver. That=E2=80=99s the use case y= ou=E2=80=99re
talking about. But when I=E2=80=99m in a coffee s= hop, I have no reason to trust the
local network administrator= . In this case, DoH gives me the assurance that I
am talking t= o the resolver I intended to use.

= Oh, I don't trust public Wi-Fi at all. I avoid using it unless I feel like I= really need it. I avoid checking email or FB or financial apps (make sure t= hey're all closed, and none allow notifications) if I do attach to one. BTW,= I don't trust VPN providers either -- so I don't personally see that as a g= ood alternative. I agree that if I were to use a public Wi-Fi, I would prefe= r to use something like DoH. But what I was saying, is I don't think there i= s anything I (or you) can do to prevent a coffee shop from blocking traffic t= o public DNS providers -- if they chose to do so. And it wouldn't surprise m= e if they did so choose.

I'm not advocating for= this. I'm just a realist and I think it's an unavoidable response to what's= going on.

Ultimately, network operators (espec= ially operators of private networks -- and coffee shop hotspots, a lot of "p= ublic" Wi-Fi, and enterprises are still private networks) *do* still have co= ntrol of their networks.
Barbara

=
IOW, the administrator role is a bit mo= re nuanced than what you just said,
even though I agree with y= our choice in that particular case.

I guess the= difference is where you think the edge of the administrative
= domain is...  :)

Sent from my iPhone

On Aug 9, 2019, at 5:25 AM, STARK, BARBARA H <bs7652@att.com> wrote:

I'm not sure everyone views "network administrator" as= a valid role, at
least in contexts w= here the administrator does not also control the device.

Many enterprises and small bu= sinesses allow employees to attach personal
devic= es to their networks. I think it's completely valid for businesses to
administer their networks as they wish without banning personal devi= ces or
requiring employees to turn over control of personal de= vices.

Per= sonally, I view my role as network administrator of my home network to
be *extremely* valid -- including when I allow guests'= devices (which I don't
control) to attach to my network. And I= often doubt that I really have
"control" over my Smart TVs an= d Chromecast (which is why they get to be
together on their ow= n little subnet so they can't see or be seen by the rest of
th= e home network -- I connect to the subnet Wi-Fi AP to use them). I don't
have any Android devices, because I don't believe there's the remo= test
possibility of being in "control" of them. I flashed a Li= nux OS on my Lenovo
laptop when I realized I didn't control th= e original OS that Lenovo had heavily
"customized". I even fir= ewall my ISP router by having my own router at the
edge of *my= * home network.

Applications and cloud services that try to take away from me the abil= ity to
control what goes on inside my personal ho= me network will be added to my
"do not trust" list.

I'm thinking what I'd= really like is for my home router to have a feature I can
enable that lets me block all traffic to known public DNS services= . I'm pretty
sure that would go a long ways to restoring my ab= ility to use DNS as a
reasonably effective control surface. I'= m not happy that some people are
claiming I can't control DNS i= n my own home because they've succeeded in
taking this control= away from me. My home network belongs to me, and I'm
going to= do what I can to keep it that way.

Just like it turned out to be good for everyone to h= ave a good definition of
NAT and DNS proxy, it wo= uld probably be good if this "public DNS blocking"
functionali= ty were thoughtfully designed to avoid unnecessary breakage.
I= ETF may or may not be the right place to design it. Suggestions that people<= br class=3D"">go elsewhere to design something like this may be correct. OTO= H, if
application and cloud providers wanted to have input to t= he design, IETF
might indeed be the right place.

It wouldn't surprise me= if coffee shops, hotels, and enterprises didn't also
choose to enable such a feature. Regulators in some countries might eve= n
insist on it.
Barbara

--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add

= --Apple-Mail-5BC628F4-B23F-438C-B363-980624111C5A-- From nobody Fri Aug 9 08:32:15 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1F49D120019 for ; Fri, 9 Aug 2019 08:32:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Ppz4Ohh8Vj9L for ; Fri, 9 Aug 2019 08:32:12 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [IPv6:2607:f0b0:f:3:216:3eff:fe7c:d1f3]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3B0A712006F for ; Fri, 9 Aug 2019 08:32:12 -0700 (PDT) Received: from sandelman.ca (unknown [IPv6:2607:f0b0:f:2:56b2:3ff:fe0b:d84]) by tuna.sandelman.ca (Postfix) with ESMTP id 7EA243818F for ; Fri, 9 Aug 2019 11:31:31 -0400 (EDT) Received: from localhost (localhost [IPv6:::1]) by sandelman.ca (Postfix) with ESMTP id 4853D1027 for ; Fri, 9 Aug 2019 11:32:11 -0400 (EDT) From: Michael Richardson To: ADD Mailing list In-Reply-To: References: <474778E2-BC34-4D87-951E-9CA2174F4F77@icann.org> X-Mailer: MH-E 8.6; nmh 1.7+dev; GNU Emacs 24.5.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: Re: [Add] Chromecast using 8.8.8.8 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 09 Aug 2019 15:32:14 -0000 --=-=-= Content-Type: text/plain Paul Wouters wrote: >> For every DNS lookup, the Chromecast sends the the same query to >>8.8.8.8 *and* the resolver that it was given by DHCP. A popular way to >>control a Chromecast is with the GoogleHome application on a phone. On >>my iPhone on the same wireless access point, GoogleHome always used the >>resolver from DHCP. Note that GoogleHome gave the Wifi password to the >>Chromecast during setup, so it could have passed other settings like the >>resolver address, but appears not to have. > This is not the behaviour I am seeing on my Chromecast Ultra. Local DNS > is completely ignored and never queried, and the only DNS packets I see > go to 8.8.8.8. I wonder if there was something about your local DNS resolver that it didn't like, and if it "gave up" on it. What happens if you block it's 8.8.8.8 access? Oh, to have a MUD file for these devices. -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAl1NkfoACgkQgItw+93Q 3WVNpggArv4fkkkypc895HXlSS7uJQIkBZG99twDeswKUrR69X7i/c9ElPQBJXdk LzytSJhb6kWTqLBsBfjbuI3ZK44r4VxSGoOaRXZKsv36+SEeMFVJxvofDFuOqsKY AUm+BVdrVbd6IFNu1yq0/ssPzTvgyfgI18SMktoXbUA5040/HLizNOeq0ccYJwqm 1yp+9vkQmxM6tNMTCIhYBQFBp2mFjCCJb6ifp4erxhWRlnT8HnHQ52B8N1sl8P9p RhP7MABOoBdUFWFuUo9irDeEOjTbAhe2s3zuI9VvTLcS6CfKSbx9z07uPTWwCz8z O31mNupvblOHvWy2ieGPtIkYUHhb+A== =a1It -----END PGP SIGNATURE----- --=-=-=-- From nobody Fri Aug 9 08:43:05 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 05F56120229 for ; Fri, 9 Aug 2019 08:42:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DAf5CGms7bMh for ; Fri, 9 Aug 2019 08:42:56 -0700 (PDT) Received: from mail-pf1-x433.google.com (mail-pf1-x433.google.com [IPv6:2607:f8b0:4864:20::433]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CC521120228 for ; Fri, 9 Aug 2019 08:42:56 -0700 (PDT) Received: by mail-pf1-x433.google.com with SMTP id o70so916515pfg.5 for ; Fri, 09 Aug 2019 08:42:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=NdqKdlLfuKQLBSgBIu07vHpym/jf0eCFJaXCXoQi6pc=; b=jmNhNbd1ou/ofdhuZL42CtqWi+k+6WzFGBWbWihgnL5G1KZARIQmGrNEvd+/6pB8O6 vXAr9mwzy7z5+ezt9+W+Ta5i/J81mxOqBPWdxllrw0hbwP5LwtPFGUwG/0vUQ6eWHFQJ l7BLq48lFAsFuEeHiI8WQ+HZ8rHwEPf0VhdGBqMTfwuRCkOPXHY0AjznfF3H4MtGD5xx F1nRLX2gpICVHMkZZicDcKHIYfDW/9akDIJQ0VHAQmXXpSAUSp8YOzL9Ws8WBA8rixfW Kl1mE8Yynz7vBnXRfNULXW4+85IFVoVcrCudMaCchH5cJvUMo7RKH+T9TR03PQWHrsB6 obCQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=NdqKdlLfuKQLBSgBIu07vHpym/jf0eCFJaXCXoQi6pc=; b=pN2aiU2WgDF6auvY6GLyja0u0da3TXt9qDcLQnaBWxAiaxG5ei4EPmonwCGrl2NTY6 2Q8g9tbwRO08dRHCdFsEDlAI/JdIEeNXlZ7rwtsC436cmWsQt5xVs8jwFeJRimH+terU Mm8PpOuTHIyfQz7zrnhI+SDSFEdgJ3MX88Mt/CbPqSKAdeq+I6nFEaGVGGbl7RVVg0+B sm/Fp6EWSjoMm2TUcPMxWUFqEKoNvpsdz+4sqEh546DT9RY2T7IHWwaXiSurq+H6z5Rd lgtigmppP3eA9tbQuRxQksZoMoNd7aSarvUeHK1w51ujf+4xqbMlBcJ5wcrIsrI53Oat NATg== X-Gm-Message-State: APjAAAXZhYFwSo3p8pDX98zK6J7B6hb8lB4q7befgUeeFDXnCtZqdXM3 6ku1wsTc/IGRhDtwX7zySk+/Jg== X-Google-Smtp-Source: APXvYqwn+0wfRE316pdSDReJOgy1EexEzbIV5iz88V6lUpfiLaRsUUcG/XZuRImqQOUsDDqaNUXa9g== X-Received: by 2002:a65:6454:: with SMTP id s20mr17459177pgv.15.1565365376305; Fri, 09 Aug 2019 08:42:56 -0700 (PDT) Received: from ?IPv6:2600:380:c06a:a873:95f4:4967:80d3:2c64? ([2600:380:c06a:a873:95f4:4967:80d3:2c64]) by smtp.gmail.com with ESMTPSA id 124sm101661366pfw.142.2019.08.09.08.42.55 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 09 Aug 2019 08:42:55 -0700 (PDT) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (1.0) From: Ted Lemon X-Mailer: iPhone Mail (16G77) In-Reply-To: Date: Fri, 9 Aug 2019 08:42:54 -0700 Cc: Rob Sayre , ADD Mailing list , Martin Thomson Content-Transfer-Encoding: quoted-printable Message-Id: <8A1F21CD-02D6-4B1A-BA66-20DF28305C0B@fugue.com> References: <4E72E017-96D7-481D-BCF7-89B944A257BC@fl1ger.de> <8DEC22D6-818C-475A-A360-09F05875F5C2@fl1ger.de> <3c789c35-92e4-e37e-75aa-42a7742f956c@cs.tcd.ie> <2EF61DAB-8371-4257-82A0-8622A8F2B178@cable.comcast.com> <848E4388-BDD3-4B36-838D-15703AAFE543@hopcount.ca> <6a3ad62b-2024-4010-b4d6-c6693309ac2e@www.fastmail.com> To: Bret Jordan Archived-At: Subject: Re: [Add] Control X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 09 Aug 2019 15:43:04 -0000 On Aug 9, 2019, at 7:15 AM, Bret Jordan wrote: >=20 > Split DNS is a critical use case. It is not just development systems that= are not addressable on the outside, but nearly all HR and financial systems= as well Yes, indeed, this has to work. Would be nice if it could be trusted based on= authenticity rather than a leap of faith.=20= From nobody Fri Aug 9 09:19:03 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 017A4120131 for ; Fri, 9 Aug 2019 09:18:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SiZvRJIJZpla for ; Fri, 9 Aug 2019 09:18:51 -0700 (PDT) Received: from mx0a-00191d01.pphosted.com (mx0a-00191d01.pphosted.com [67.231.149.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C3988120090 for ; Fri, 9 Aug 2019 09:18:51 -0700 (PDT) Received: from pps.filterd (m0049297.ppops.net [127.0.0.1]) by m0049297.ppops.net-00191d01. (8.16.0.27/8.16.0.27) with SMTP id x79G7DWO018999; Fri, 9 Aug 2019 12:18:50 -0400 Received: from alpi154.enaf.aldc.att.com (sbcsmtp6.sbc.com [144.160.229.23]) by m0049297.ppops.net-00191d01. with ESMTP id 2u9bcqspj0-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 09 Aug 2019 12:18:50 -0400 Received: from enaf.aldc.att.com (localhost [127.0.0.1]) by alpi154.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id x79GImOd008028; Fri, 9 Aug 2019 12:18:49 -0400 Received: from zlp30486.vci.att.com (zlp30486.vci.att.com [135.47.91.177]) by alpi154.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id x79GIjoL007991 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Fri, 9 Aug 2019 12:18:46 -0400 Received: from zlp30486.vci.att.com (zlp30486.vci.att.com [127.0.0.1]) by zlp30486.vci.att.com (Service) with ESMTP id 701F94009E8A; Fri, 9 Aug 2019 16:18:45 +0000 (GMT) Received: from GAALPA1MSGHUBAD.ITServices.sbc.com (unknown [130.8.218.153]) by zlp30486.vci.att.com (Service) with ESMTPS id 5425D4009E79; Fri, 9 Aug 2019 16:18:45 +0000 (GMT) Received: from GAALPA1MSGUSRBF.ITServices.sbc.com ([169.254.5.84]) by GAALPA1MSGHUBAD.ITServices.sbc.com ([130.8.218.153]) with mapi id 14.03.0439.000; Fri, 9 Aug 2019 12:18:45 -0400 From: "STARK, BARBARA H" To: "'Ted Lemon'" CC: "'ADD Mailing list'" , "'Rob Sayre'" Thread-Topic: [Add] Validity of network administrator role Thread-Index: AdVOrWbK0+q3QnKfTTiLu5VXNuosZwAKIGKAAAdlSXD//9HCgIAAJ2Ow Date: Fri, 9 Aug 2019 16:18:44 +0000 Message-ID: <2D09D61DDFA73D4C884805CC7865E6114E25DB06@GAALPA1MSGUSRBF.ITServices.sbc.com> References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <2D09D61DDFA73D4C884805CC7865E6114E25D54A@GAALPA1MSGUSRBF.ITServices.sbc.com> <4AA11EE0-73B4-40C6-85D7-6054E00504C2@fugue.com> In-Reply-To: <4AA11EE0-73B4-40C6-85D7-6054E00504C2@fugue.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [135.70.201.29] Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-08-09_04:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_policy_notspam policy=outbound_policy score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1906280000 definitions=main-1908090157 Archived-At: Subject: Re: [Add] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 09 Aug 2019 16:19:03 -0000 PiBUaGUgcG9pbnQgaXMsIHdpdGggRG9ILCBpZiB0aGF0IHJlYWxseSB0dXJucyBvdXQgdG8gYmUg dHJ1ZSwgdGhlIGVzY2FsYXRpb24gd2lsbA0KPiBjb250aW51ZS4gSWYgeW91IHdhbnQgdG8gbm90 IGhhdmUgRG9IIGdvIGNvbXBsZXRlbHkgc3RlYWx0aCwgdGhlbiBhcyBhbg0KPiBvcGVyYXRvciB0 aGUgbGFzdCB0aGluZyB5b3Ugd2FudCB0byBkbyBpcyBibG9jayB3ZWxsIGtub3duIERvSCBzZXJ2 ZXJzLg0KDQpJZiBEb0ggZ29lcyBzdGVhbHRoLCBpdCB3aWxsIGJlIGhhcmRlciBmb3IgImF2ZXJh Z2UiIHBlb3BsZSB0byB1c2UgaXQgKGtpbmQgb2YgbGlrZSBtb3N0IHBlb3BsZSB0aGluayBvZiB0 aGUgImRhcmsgd2ViIiBhcyBzb21lIHNvcnQgb2YgbXl0aGljYWwgZW50aXR5KSwgYW5kIGl0IHdp bGwgbm90IGJlIGFzIGRpc3J1cHRpdmUgdG8gbmV0d29ya3MuIA0KVGhlIG5ldHdvcmtzIGRvIG5v dCBoYXZlIGFic29sdXRlIHBvd2VyLCBidXQgbmVpdGhlciBkbyB0aGUgYXBwbGljYXRpb25zIGFu ZCBjbG91ZCBzZXJ2aWNlcy4gDQpVbmxlc3MgdGhlIDIgInNpZGVzIiB3b3JrIHRvZ2V0aGVyIGlu IGFuIGVudmlyb25tZW50IHdoZXJlIHRoZXJlIGlzIGEgYmFsYW5jZSBvZiBwb3dlciwgdGhlIGVz Y2FsYXRpb24gd2lsbCBjb250aW51ZS4gQW5kIGluZGl2aWR1YWxzIHdpbGwgYmUgdGhlIGxvc2Vy cy4NCk5laXRoZXIgInNpZGUiIGlzIGV2aWwuIFRoZXkgYXJlIG1lcmVseSBjb21pbmcgYXQgaXQg ZnJvbSBkaWZmZXJlbnQgcGVyc3BlY3RpdmVzIHRoYXQgYXJlbid0IGZ1bGx5IHNoYXJlZCBvciB1 bmRlcnN0b29kIChvciBhY2NlcHRlZCkgYnkgZWFjaCBvdGhlci4NCkFuZCBtb3N0IG9mIHRoZSBs YXJnZSBuZXR3b3JrIG9wZXJhdG9ycyByZXByZXNlbnRlZCBvbiB0aGlzIGxpc3QgYXJlbid0IGNv bWluZyBhdCB0aGlzIGZyb20gdGhlIHBlcnNwZWN0aXZlIG9mIGNyZWF0aW5nIHVzZXIgcHJvZmls ZXMgYW5kIGRvaW5nIGFkIGluc2VydGlvbiAtLSB0aGV5IHJlYWxseSBkbyBzZWUgdGhlIHBvdGVu dGlhbCBmb3IgbWFzc2l2ZSBuZXR3b3JrIGRpc3J1cHRpb24gYW5kIGhhcm0gdG8gcGVvcGxlLg0K SWYgd2UgaGF2ZSBjb21tb24gZ29hbHMgb2Ygc2VjdXJpbmcgdGhlIEludGVybmV0IChhZ2FpbnN0 IEREb1MgYXR0YWNrcywgdW5hdXRob3JpemVkIGludGVyY2VwdGlvbiBvZiBpbmZvcm1hdGlvbiwg ZXRjLiksIGluY3JlYXNpbmcgdGhlIGFiaWxpdHkgb2YgdXNlcnMgdG8gbWFuYWdlIHRoZWlyIHBy aXZhY3kgKGNvbnNpc3RlbnQgd2l0aCB3aGF0IHRoZXkgd2FudCBhbmQgbm90IHdoYXQgb3RoZXJz IHdhbnQgdG8gaW1wb3NlIG9uIHRoZW0pLCBhbmQgbWFpbnRhaW5pbmcgdGhlIHJpZ2h0cyBvZiBw cml2YXRlIG5ldHdvcmsgYWRtaW5pc3RyYXRvcnMgdG8gbWFuYWdlIHRoZWlyIG5ldHdvcmtzIGFz IHRoZXkgc2VlIGZpdCAoaW5jbHVkaW5nIGVudGVycHJpc2VzIGFuZCBwYXJlbnRzKSwgdGhlbiB3 ZSBzaG91bGQgYmUgYWJsZSB0byB3b3JrIHRvZ2V0aGVyIHRvIGlkZW50aWZ5IHdheXMgdG8gaW1w cm92ZSBhbGwgb2YgdGhlc2UgYW5kIG5vdCBpbXByb3ZlIGp1c3Qgb25lIGF0IHRoZSBleHBlbnNl IG9mIHRoZSBvdGhlcnMuIFRoaXMgaXMgbm90IGEgemVyby1zdW0gZ2FtZS4NCkJhcmJhcmENCg0K PiA+PiBGb3IgbXkgcGFydCwgSSB3b3VsZCByYXRoZXIgaGF2ZSB0aGUgb3B0aW9uIHRvIHVzZSBw dWJsaWMgRE5TLiBEb0gNCj4gPj4gbGV0cyBtZSBkbyB0aGF0IHdoZW4gd2l0aG91dCBpdCBJIHdv dWxkIGhhdmUgbm8gY29udHJvbCwgYmVjYXVzZSB0aGUNCj4gPj4gU1Agd291bGQgYmUgdGFraW5n IHRoYXQgY29udHJvbCBmcm9tIG1lLg0KPiA+Pg0KPiA+PiBUcnVlLCBvbiBteSBob21lIG5ldCwg SSBjYW4gc2V0IHVwIHRoZSByZXNvbHZlciBJIHdhbnQsIGFuZCBpbiB0aGF0DQo+ID4+IGNhc2Ug SSBhbSBiZXR0ZXIgb2ZmIGlmIGFwcHMgdXNlIG15IGNvbmZpZ3VyZWQgcmVzb2x2ZXIuIFRoYXTi gJlzIHRoZQ0KPiA+PiB1c2UgY2FzZSB5b3XigJlyZSB0YWxraW5nIGFib3V0LiBCdXQgd2hlbiBJ 4oCZbSBpbiBhIGNvZmZlZSBzaG9wLCBJIGhhdmUNCj4gPj4gbm8gcmVhc29uIHRvIHRydXN0IHRo ZSBsb2NhbCBuZXR3b3JrIGFkbWluaXN0cmF0b3IuIEluIHRoaXMgY2FzZSwgRG9IDQo+ID4+IGdp dmVzIG1lIHRoZSBhc3N1cmFuY2UgdGhhdCBJIGFtIHRhbGtpbmcgdG8gdGhlIHJlc29sdmVyIEkg aW50ZW5kZWQgdG8gdXNlLg0KPiA+DQo+ID4gT2gsIEkgZG9uJ3QgdHJ1c3QgcHVibGljIFdpLUZp IGF0IGFsbC4gSSBhdm9pZCB1c2luZyBpdCB1bmxlc3MgSSBmZWVsIGxpa2UgSSByZWFsbHkNCj4g bmVlZCBpdC4gSSBhdm9pZCBjaGVja2luZyBlbWFpbCBvciBGQiBvciBmaW5hbmNpYWwgYXBwcyAo bWFrZSBzdXJlIHRoZXkncmUgYWxsDQo+IGNsb3NlZCwgYW5kIG5vbmUgYWxsb3cgbm90aWZpY2F0 aW9ucykgaWYgSSBkbyBhdHRhY2ggdG8gb25lLiBCVFcsIEkgZG9uJ3QgdHJ1c3QNCj4gVlBOIHBy b3ZpZGVycyBlaXRoZXIgLS0gc28gSSBkb24ndCBwZXJzb25hbGx5IHNlZSB0aGF0IGFzIGEgZ29v ZCBhbHRlcm5hdGl2ZS4gSQ0KPiBhZ3JlZSB0aGF0IGlmIEkgd2VyZSB0byB1c2UgYSBwdWJsaWMg V2ktRmksIEkgd291bGQgcHJlZmVyIHRvIHVzZSBzb21ldGhpbmcgbGlrZQ0KPiBEb0guIEJ1dCB3 aGF0IEkgd2FzIHNheWluZywgaXMgSSBkb24ndCB0aGluayB0aGVyZSBpcyBhbnl0aGluZyBJIChv ciB5b3UpIGNhbiBkbw0KPiB0byBwcmV2ZW50IGEgY29mZmVlIHNob3AgZnJvbSBibG9ja2luZyB0 cmFmZmljIHRvIHB1YmxpYyBETlMgcHJvdmlkZXJzIC0tIGlmDQo+IHRoZXkgY2hvc2UgdG8gZG8g c28uIEFuZCBpdCB3b3VsZG4ndCBzdXJwcmlzZSBtZSBpZiB0aGV5IGRpZCBzbyBjaG9vc2UuDQo+ ID4NCj4gPiBJJ20gbm90IGFkdm9jYXRpbmcgZm9yIHRoaXMuIEknbSBqdXN0IGEgcmVhbGlzdCBh bmQgSSB0aGluayBpdCdzIGFuIHVuYXZvaWRhYmxlDQo+IHJlc3BvbnNlIHRvIHdoYXQncyBnb2lu ZyBvbi4NCj4gPg0KPiA+IFVsdGltYXRlbHksIG5ldHdvcmsgb3BlcmF0b3JzIChlc3BlY2lhbGx5 IG9wZXJhdG9ycyBvZiBwcml2YXRlIG5ldHdvcmtzIC0tDQo+IGFuZCBjb2ZmZWUgc2hvcCBob3Rz cG90cywgYSBsb3Qgb2YgInB1YmxpYyIgV2ktRmksIGFuZCBlbnRlcnByaXNlcyBhcmUgc3RpbGwN Cj4gcHJpdmF0ZSBuZXR3b3JrcykgKmRvKiBzdGlsbCBoYXZlIGNvbnRyb2wgb2YgdGhlaXIgbmV0 d29ya3MuDQo+ID4gQmFyYmFyYQ0KPiA+DQo+ID4+IElPVywgdGhlIGFkbWluaXN0cmF0b3Igcm9s ZSBpcyBhIGJpdCBtb3JlIG51YW5jZWQgdGhhbiB3aGF0IHlvdSBqdXN0DQo+ID4+IHNhaWQsIGV2 ZW4gdGhvdWdoIEkgYWdyZWUgd2l0aCB5b3VyIGNob2ljZSBpbiB0aGF0IHBhcnRpY3VsYXIgY2Fz ZS4NCj4gPj4NCj4gPj4gSSBndWVzcyB0aGUgZGlmZmVyZW5jZSBpcyB3aGVyZSB5b3UgdGhpbmsg dGhlIGVkZ2Ugb2YgdGhlDQo+ID4+IGFkbWluaXN0cmF0aXZlIGRvbWFpbiBpcy4uLiAgOikNCj4g Pj4NCj4gPj4gU2VudCBmcm9tIG15IGlQaG9uZQ0KPiA+Pg0KPiA+PiBPbiBBdWcgOSwgMjAxOSwg YXQgNToyNSBBTSwgU1RBUkssIEJBUkJBUkEgSCA8YnM3NjUyQGF0dC5jb20+IHdyb3RlOg0KPiA+ Pg0KPiA+Pj4+IEknbSBub3Qgc3VyZSBldmVyeW9uZSB2aWV3cyAibmV0d29yayBhZG1pbmlzdHJh dG9yIiBhcyBhIHZhbGlkDQo+ID4+Pj4gcm9sZSwgYXQNCj4gPj4gbGVhc3QgaW4gY29udGV4dHMg d2hlcmUgdGhlIGFkbWluaXN0cmF0b3IgZG9lcyBub3QgYWxzbyBjb250cm9sIHRoZQ0KPiBkZXZp Y2UuDQo+ID4+Pg0KPiA+Pj4gTWFueSBlbnRlcnByaXNlcyBhbmQgc21hbGwgYnVzaW5lc3NlcyBh bGxvdyBlbXBsb3llZXMgdG8gYXR0YWNoDQo+ID4+PiBwZXJzb25hbA0KPiA+PiBkZXZpY2VzIHRv IHRoZWlyIG5ldHdvcmtzLiBJIHRoaW5rIGl0J3MgY29tcGxldGVseSB2YWxpZCBmb3INCj4gPj4g YnVzaW5lc3NlcyB0byBhZG1pbmlzdGVyIHRoZWlyIG5ldHdvcmtzIGFzIHRoZXkgd2lzaCB3aXRo b3V0IGJhbm5pbmcNCj4gPj4gcGVyc29uYWwgZGV2aWNlcyBvciByZXF1aXJpbmcgZW1wbG95ZWVz IHRvIHR1cm4gb3ZlciBjb250cm9sIG9mIHBlcnNvbmFsDQo+IGRldmljZXMuDQo+ID4+Pg0KPiA+ Pj4gUGVyc29uYWxseSwgSSB2aWV3IG15IHJvbGUgYXMgbmV0d29yayBhZG1pbmlzdHJhdG9yIG9m IG15IGhvbWUNCj4gPj4+IG5ldHdvcmsgdG8NCj4gPj4gYmUgKmV4dHJlbWVseSogdmFsaWQgLS0g aW5jbHVkaW5nIHdoZW4gSSBhbGxvdyBndWVzdHMnIGRldmljZXMgKHdoaWNoDQo+ID4+IEkgZG9u J3QNCj4gPj4gY29udHJvbCkgdG8gYXR0YWNoIHRvIG15IG5ldHdvcmsuIEFuZCBJIG9mdGVuIGRv dWJ0IHRoYXQgSSByZWFsbHkNCj4gPj4gaGF2ZSAiY29udHJvbCIgb3ZlciBteSBTbWFydCBUVnMg YW5kIENocm9tZWNhc3QgKHdoaWNoIGlzIHdoeSB0aGV5DQo+ID4+IGdldCB0byBiZSB0b2dldGhl ciBvbiB0aGVpciBvd24gbGl0dGxlIHN1Ym5ldCBzbyB0aGV5IGNhbid0IHNlZSBvciBiZQ0KPiA+ PiBzZWVuIGJ5IHRoZSByZXN0IG9mIHRoZSBob21lIG5ldHdvcmsgLS0gSSBjb25uZWN0IHRvIHRo ZSBzdWJuZXQgV2ktRmkNCj4gPj4gQVAgdG8gdXNlIHRoZW0pLiBJIGRvbid0IGhhdmUgYW55IEFu ZHJvaWQgZGV2aWNlcywgYmVjYXVzZSBJIGRvbid0DQo+ID4+IGJlbGlldmUgdGhlcmUncyB0aGUg cmVtb3Rlc3QgcG9zc2liaWxpdHkgb2YgYmVpbmcgaW4gImNvbnRyb2wiIG9mDQo+ID4+IHRoZW0u IEkgZmxhc2hlZCBhIExpbnV4IE9TIG9uIG15IExlbm92byBsYXB0b3Agd2hlbiBJIHJlYWxpemVk IEkNCj4gPj4gZGlkbid0IGNvbnRyb2wgdGhlIG9yaWdpbmFsIE9TIHRoYXQgTGVub3ZvIGhhZCBo ZWF2aWx5ICJjdXN0b21pemVkIi4NCj4gPj4gSSBldmVuIGZpcmV3YWxsIG15IElTUCByb3V0ZXIg YnkgaGF2aW5nIG15IG93biByb3V0ZXIgYXQgdGhlIGVkZ2Ugb2YNCj4gKm15KiBob21lIG5ldHdv cmsuDQo+ID4+Pg0KPiA+Pj4gQXBwbGljYXRpb25zIGFuZCBjbG91ZCBzZXJ2aWNlcyB0aGF0IHRy eSB0byB0YWtlIGF3YXkgZnJvbSBtZSB0aGUNCj4gPj4+IGFiaWxpdHkgdG8NCj4gPj4gY29udHJv bCB3aGF0IGdvZXMgb24gaW5zaWRlIG15IHBlcnNvbmFsIGhvbWUgbmV0d29yayB3aWxsIGJlIGFk ZGVkIHRvDQo+ID4+IG15ICJkbyBub3QgdHJ1c3QiIGxpc3QuDQo+ID4+Pg0KPiA+Pj4gSSdtIHRo aW5raW5nIHdoYXQgSSdkIHJlYWxseSBsaWtlIGlzIGZvciBteSBob21lIHJvdXRlciB0byBoYXZl IGENCj4gPj4+IGZlYXR1cmUgSSBjYW4NCj4gPj4gZW5hYmxlIHRoYXQgbGV0cyBtZSBibG9jayBh bGwgdHJhZmZpYyB0byBrbm93biBwdWJsaWMgRE5TIHNlcnZpY2VzLg0KPiA+PiBJJ20gcHJldHR5 IHN1cmUgdGhhdCB3b3VsZCBnbyBhIGxvbmcgd2F5cyB0byByZXN0b3JpbmcgbXkgYWJpbGl0eSB0 bw0KPiA+PiB1c2UgRE5TIGFzIGEgcmVhc29uYWJseSBlZmZlY3RpdmUgY29udHJvbCBzdXJmYWNl LiBJJ20gbm90IGhhcHB5IHRoYXQNCj4gPj4gc29tZSBwZW9wbGUgYXJlIGNsYWltaW5nIEkgY2Fu J3QgY29udHJvbCBETlMgaW4gbXkgb3duIGhvbWUgYmVjYXVzZQ0KPiA+PiB0aGV5J3ZlIHN1Y2Nl ZWRlZCBpbiB0YWtpbmcgdGhpcyBjb250cm9sIGF3YXkgZnJvbSBtZS4gTXkgaG9tZQ0KPiA+PiBu ZXR3b3JrIGJlbG9uZ3MgdG8gbWUsIGFuZCBJJ20gZ29pbmcgdG8gZG8gd2hhdCBJIGNhbiB0byBr ZWVwIGl0IHRoYXQgd2F5Lg0KPiA+Pj4NCj4gPj4+IEp1c3QgbGlrZSBpdCB0dXJuZWQgb3V0IHRv IGJlIGdvb2QgZm9yIGV2ZXJ5b25lIHRvIGhhdmUgYSBnb29kDQo+ID4+PiBkZWZpbml0aW9uIG9m DQo+ID4+IE5BVCBhbmQgRE5TIHByb3h5LCBpdCB3b3VsZCBwcm9iYWJseSBiZSBnb29kIGlmIHRo aXMgInB1YmxpYyBETlMNCj4gYmxvY2tpbmciDQo+ID4+IGZ1bmN0aW9uYWxpdHkgd2VyZSB0aG91 Z2h0ZnVsbHkgZGVzaWduZWQgdG8gYXZvaWQgdW5uZWNlc3NhcnkgYnJlYWthZ2UuDQo+ID4+IElF VEYgbWF5IG9yIG1heSBub3QgYmUgdGhlIHJpZ2h0IHBsYWNlIHRvIGRlc2lnbiBpdC4gU3VnZ2Vz dGlvbnMgdGhhdA0KPiA+PiBwZW9wbGUgZ28gZWxzZXdoZXJlIHRvIGRlc2lnbiBzb21ldGhpbmcg bGlrZSB0aGlzIG1heSBiZSBjb3JyZWN0Lg0KPiA+PiBPVE9ILCBpZiBhcHBsaWNhdGlvbiBhbmQg Y2xvdWQgcHJvdmlkZXJzIHdhbnRlZCB0byBoYXZlIGlucHV0IHRvIHRoZQ0KPiA+PiBkZXNpZ24s IElFVEYgbWlnaHQgaW5kZWVkIGJlIHRoZSByaWdodCBwbGFjZS4NCj4gPj4+DQo+ID4+PiBJdCB3 b3VsZG4ndCBzdXJwcmlzZSBtZSBpZiBjb2ZmZWUgc2hvcHMsIGhvdGVscywgYW5kIGVudGVycHJp c2VzDQo+ID4+PiBkaWRuJ3QgYWxzbw0KPiA+PiBjaG9vc2UgdG8gZW5hYmxlIHN1Y2ggYSBmZWF0 dXJlLiBSZWd1bGF0b3JzIGluIHNvbWUgY291bnRyaWVzIG1pZ2h0DQo+ID4+IGV2ZW4gaW5zaXN0 IG9uIGl0Lg0KPiA+Pj4gQmFyYmFyYQ0KPiANCj4gLS0NCj4gQWRkIG1haWxpbmcgbGlzdA0KPiBB ZGRAaWV0Zi5vcmcNCj4gaHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91 PWh0dHBzLQ0KPiAzQV9fd3d3LmlldGYub3JnX21haWxtYW5fbGlzdGluZm9fYWRkJmQ9RHdJR2FR JmM9TEZZWi0NCj4gbzlfSFVNZU1UU1FpY3ZqSWcmcj1Mb0d6aEMtDQo+IDhzYzhTWThUcTR2cmZv ZyZtPTc1N2VvUlVtcktjNUpMNnBHWGpGVl9lRzU1ZmEycFVpbXlYUHBVZXBFNDAmDQo+IHM9YXF0 d013dVdjTERnM1Z4eFdBYUY4M095MlNHd1pqc2duNXJMcnRSZjEwZyZlPQ0K From nobody Fri Aug 9 09:29:12 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B4899120278 for ; Fri, 9 Aug 2019 09:28:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zvq8xyiEWqwK for ; Fri, 9 Aug 2019 09:28:56 -0700 (PDT) Received: from out.west.pexch112.icann.org (out.west.pexch112.icann.org [64.78.40.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4EF3E12023D for ; Fri, 9 Aug 2019 09:28:56 -0700 (PDT) Received: from PMBX112-W1-CA-1.pexch112.icann.org (64.78.40.21) by PMBX112-W1-CA-1.pexch112.icann.org (64.78.40.21) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Fri, 9 Aug 2019 09:28:54 -0700 Received: from PMBX112-W1-CA-1.pexch112.icann.org ([64.78.40.21]) by PMBX112-W1-CA-1.PEXCH112.ICANN.ORG ([64.78.40.21]) with mapi id 15.00.1473.005; Fri, 9 Aug 2019 09:28:54 -0700 From: Paul Hoffman To: Michael Richardson CC: ADD Mailing list Thread-Topic: [Ext] [Add] Chromecast using 8.8.8.8 Thread-Index: AQHVTs+IJX+MnBy+yU6i8kSZf08AeA== Date: Fri, 9 Aug 2019 16:28:53 +0000 Message-ID: References: <474778E2-BC34-4D87-951E-9CA2174F4F77@icann.org> <22628.1565364731@localhost> In-Reply-To: <22628.1565364731@localhost> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [192.0.32.234] Content-Type: text/plain; charset="us-ascii" Content-ID: Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: Re: [Add] [Ext] Chromecast using 8.8.8.8 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 09 Aug 2019 16:29:12 -0000 On Aug 9, 2019, at 8:32 AM, Michael Richardson wrot= e: > I wonder if there was something about your local DNS resolver that it did= n't > like, and if it "gave up" on it. That's not what the pcaps look like. It immediately started sending the dua= l queries, and kept up that action throughout, even after reboot.=20 > What happens if you block it's 8.8.8.8 > access? Dunno. My research questions was "does the Chromecast always send queries t= o 8.8.8.8", not "how can system admins mess with it". I'll maybe look later= into other related questions. --Paul Hoffman= From nobody Fri Aug 9 09:42:13 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B4C3412002E for ; Fri, 9 Aug 2019 09:42:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nohats.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gnTz-sWgo9Wo for ; Fri, 9 Aug 2019 09:42:09 -0700 (PDT) Received: from mx.nohats.ca (mx.nohats.ca [IPv6:2a03:6000:1004:1::68]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0F35A120020 for ; Fri, 9 Aug 2019 09:42:09 -0700 (PDT) Received: from localhost (localhost [IPv6:::1]) by mx.nohats.ca (Postfix) with ESMTP id 464rcb1dWpzDK5; Fri, 9 Aug 2019 18:42:07 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nohats.ca; s=default; t=1565368927; bh=vvJC2CXu8aRSxVit3+19YSdyXQ6ABkQ334tHBdEhBbk=; h=Date:From:To:cc:Subject:In-Reply-To:References; b=jukav+o/VDKQ2TJEiAfibeabffE/H2lUm3SnZjF0UAM9t3yS7xImUeLh3lf/R2Lvt PmBo51DsM8w8dwiSmfMZWjCGYuWDAM0N6ealYjFiH3xlcBq2A6XmLeRE4YCYXtwqEo IeuC5RDEh6nvXYxLxlxKXjxPBuAKM1EH3cCgYYYY= X-Virus-Scanned: amavisd-new at mx.nohats.ca Received: from mx.nohats.ca ([IPv6:::1]) by localhost (mx.nohats.ca [IPv6:::1]) (amavisd-new, port 10024) with ESMTP id Qw3ArCSuigyn; Fri, 9 Aug 2019 18:42:06 +0200 (CEST) Received: from bofh.nohats.ca (bofh.nohats.ca [76.10.157.69]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx.nohats.ca (Postfix) with ESMTPS; Fri, 9 Aug 2019 18:42:06 +0200 (CEST) Received: by bofh.nohats.ca (Postfix, from userid 1000) id 1F5E03540BB; Fri, 9 Aug 2019 12:42:05 -0400 (EDT) DKIM-Filter: OpenDKIM Filter v2.11.0 bofh.nohats.ca 1F5E03540BB Received: from localhost (localhost [127.0.0.1]) by bofh.nohats.ca (Postfix) with ESMTP id 1596640A7030; Fri, 9 Aug 2019 12:42:05 -0400 (EDT) Date: Fri, 9 Aug 2019 12:42:04 -0400 (EDT) From: Paul Wouters To: Michael Richardson cc: ADD Mailing list In-Reply-To: <22628.1565364731@localhost> Message-ID: References: <474778E2-BC34-4D87-951E-9CA2174F4F77@icann.org> <22628.1565364731@localhost> MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII; format=flowed Archived-At: Subject: Re: [Add] Chromecast using 8.8.8.8 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 09 Aug 2019 16:42:11 -0000 On Fri, 9 Aug 2019, Michael Richardson wrote: > I wonder if there was something about your local DNS resolver that it didn't > like, and if it "gave up" on it. Unless it remembers that over reboots, no. It simply does not send a single packet to my resolver. It does send pings to 8.8.8.8 and the network's default gateway, but nothing to my DNS servers. Paul From nobody Fri Aug 9 11:27:13 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 05D9212019D for ; Fri, 9 Aug 2019 11:27:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ctM2awH9JSgK for ; Fri, 9 Aug 2019 11:26:58 -0700 (PDT) Received: from mail-ot1-x332.google.com (mail-ot1-x332.google.com [IPv6:2607:f8b0:4864:20::332]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 676A8120188 for ; Fri, 9 Aug 2019 11:26:58 -0700 (PDT) Received: by mail-ot1-x332.google.com with SMTP id m97so2749986otm.12 for ; Fri, 09 Aug 2019 11:26:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=y+caEs/x3e3wuTHecTT80YeONJuyW5Wpr+Z/oGb7FnI=; b=buk870S0Pj3ElKS/eQGbq34t0tt/z2nKe0CX7DJOao1Wls8jDqTTRJKPHWkgQ1tWEN eOUVs2U0o7L3R7Q5PbFHUfWB/KzPwjKusfZd/Xh5Lyhw7d82ULORlZ9OC0YUUxMQjBeO bNY8pXeCqWHV84gKD66CAEfv8/tQx9aBp0UgADQ6OTG1twAFf+vjapRcfdooxkijFuWH 0Xu8oojcrJZJNIAChbaivPB/YtXtd5rVVoFt8gW2O/zARWOUjaRnLfaFxM4dVv1YInrb 1U/P/u+LvKxY79DLcPUkmPeucJDoYkyeBmJ+hyH4qS7QKMnLDF7aXjkHXrfrZVafon0y +9lw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=y+caEs/x3e3wuTHecTT80YeONJuyW5Wpr+Z/oGb7FnI=; b=BskezF04PIm2oZGICH6u46f+lsPUkA03BvroCcsGTbl3Kd8gzrIpIBcUUYktUXcIaX CywtHA/C2QcSQ4tiL0HnJJxD8GHvlTFVnK5sWehxt8RVQ2nY/EQDAnck9EsPQ5YKCEe7 YfCuIfzj/aRCjBi+TjOP5hSVU5IlSAov9080kxYHKLpuB5FJYS/KXwnrwMwXBm/sqVtq pefmRhBTW3RdN4xH9MAEag8/hF7Xbept2kyjFNa9ahF4IWuTanXVNlO6PrsmRQ3a0rj7 zqPqKNl/dXDqB3MsN82WMRC09JVrsn4hKoM1qR0Knph+/Ox8U0etIo0HHPWEcHOKZ7Ih 4Iwg== X-Gm-Message-State: APjAAAUW7ECepQ2J16Vpa85pT6m7Dn/DCcF8zl62/QwBEahY4WTMq77s tAxR6Hh3u2mQTQjNIcD4fhDpgVl8w7S7FiqZ85o= X-Google-Smtp-Source: APXvYqzIIDrG5+WETTFFcNa6lPuAkWG4CI74ue6UE4W9qR42aoZozA3S7XE0yfLi50etyRVWQznC+wb9gWvMcoKwbO0= X-Received: by 2002:a5e:d618:: with SMTP id w24mr22269657iom.73.1565375217535; Fri, 09 Aug 2019 11:26:57 -0700 (PDT) MIME-Version: 1.0 References: <474778E2-BC34-4D87-951E-9CA2174F4F77@icann.org> In-Reply-To: From: Rob Sayre Date: Fri, 9 Aug 2019 11:26:45 -0700 Message-ID: To: Paul Hoffman Cc: Paul Wouters , ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000c80f93058fb351ec" Archived-At: Subject: Re: [Add] [Ext] Chromecast using 8.8.8.8 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 09 Aug 2019 18:27:12 -0000 --000000000000c80f93058fb351ec Content-Type: text/plain; charset="UTF-8" On Fri, Aug 9, 2019 at 7:49 AM Paul Hoffman wrote: > I'm still quite interested in other reports of devices and applications > that by default don't use the configured resolver. Hopefully they are not > too expensive... > It looks like Roku set top boxes and some apps on them (e.g. Netflix) also do this. Searching for "Roku 8.8.8.8" should turn up reports. thanks, Rob --000000000000c80f93058fb351ec Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Fri, Aug 9, 2019 at 7:49 AM Paul Hoffm= an <paul.hoffman@icann.org= > wrote:
I'm still quite interested in other reports of devices and applications= that by default don't use the configured resolver. Hopefully they are = not too expensive...

It looks like Roku= set top boxes and some apps on them (e.g. Netflix) also do this. Searching= for "Roku 8.8.8.8" should turn up reports.

<= div>thanks,
Rob

--000000000000c80f93058fb351ec-- From nobody Fri Aug 9 11:27:41 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AB6061201CB for ; Fri, 9 Aug 2019 11:27:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AQDdgUhiVy7G for ; Fri, 9 Aug 2019 11:27:26 -0700 (PDT) Received: from mail-pg1-x534.google.com (mail-pg1-x534.google.com [IPv6:2607:f8b0:4864:20::534]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 551681201ED for ; Fri, 9 Aug 2019 11:27:18 -0700 (PDT) Received: by mail-pg1-x534.google.com with SMTP id d1so13434016pgp.4 for ; Fri, 09 Aug 2019 11:27:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=QdZUx/v+x1Vqtvw9BiuyLBvDl452Gj8hHy/4riEYwrs=; b=OLWFi1aOpKol1n5luPgeSMrIVzKi5WD7vAMTovBem1a5a5krjxOnqf5uzAZf+H/age W4rI1WJrL1MF/eDSBdhrgGusKdMEXidtVpY7/D7KmY3B8se0oy97Id7YBQfnHph3X3hm jZHt+Lmx8G5OFjy4GvxTm2WILHbPgvs3MCkQyT0r0NOj22HVMhzec5y77xcxMxfx6RIM COLXVY0J3qGkeVc0k7bZ53S0qzVrb1Dywc4j2QM7bMEOCOa2/1ejkjTvPhLKxmXhsSTg fCDV2W1YAwSXUphW1Sa/YQKBMtW/MOZvO/l7ASO32Oy68C3IRCOxbnwUb3IOivzkhZ6t bCpA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=QdZUx/v+x1Vqtvw9BiuyLBvDl452Gj8hHy/4riEYwrs=; b=uXkc2jHemLstSR589K29TPQeHHDuvtxFXLNTXuOWa0Fn8i/vnZlPx7ygxlhSDrvIOQ d9vNI1kQlHpd11dN4/oH8SOiMUjQH8jPPsjwzH1WNZdPIML7ECFNgMRHhOuatlHlgrEp t2X4q6V7oG0wH1NlRmPXlOZGpuUM++cf1grt9ff4230zlv/yFXK/jYa0xio1oA44m/ZI Gs/j+MBvXDHMmOSR7cjtXpryMxDB5gOs32ttpMJXgYR9BbB7hhLBs+LaFDeS0KUE1Kmw VQpY5GIiUYClKRvNXGG5zDCB/WzuADerlvY/gnHxrzhM2/LNH+Oskiv7OsPqFwkHjXxN msag== X-Gm-Message-State: APjAAAWBdKewemCdkS90dsOYgMxSRUgqU8j9tp5xgeYLBktvY1bJ8CpR D/j15ies8bDs48rE95WAsoaSpfXZ6dk= X-Google-Smtp-Source: APXvYqwDt0Ifn2tZYiNK/ZIzqTTC+g8DnGhR0MU6z1x4gtBMBFu7oVoINJVEcVI00uv7bGvnqoDKzg== X-Received: by 2002:a17:90a:3270:: with SMTP id k103mr10330579pjb.54.1565375237554; Fri, 09 Aug 2019 11:27:17 -0700 (PDT) Received: from ?IPv6:2607:fb90:365a:d765:2462:6f47:9c63:f66d? ([2607:fb90:365a:d765:2462:6f47:9c63:f66d]) by smtp.gmail.com with ESMTPSA id o11sm182960393pfh.114.2019.08.09.11.27.16 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 09 Aug 2019 11:27:17 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (1.0) From: Brian Dickson X-Mailer: iPhone Mail (16F203) In-Reply-To: Date: Fri, 9 Aug 2019 11:27:15 -0700 Cc: Paul Wouters , ADD Mailing list Content-Transfer-Encoding: quoted-printable Message-Id: <378BCA46-9E3F-481F-9FB7-D8A955E5EEFE@gmail.com> References: <474778E2-BC34-4D87-951E-9CA2174F4F77@icann.org> To: Paul Hoffman Archived-At: Subject: Re: [Add] [Ext] Chromecast using 8.8.8.8 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 09 Aug 2019 18:27:40 -0000 I don=E2=80=99t have one, but I am wondering about how it uses 8.8.8.8, ie i= f it somehow authenticates its identity, or if it trusts any answer from 8.8= .8.8. Maybe you could stand up a fake 8.8.8.8 including any necessary routes, and s= ee if it accepts it? Inquiring minds want to know... Brian=20 Sent from my iPhone > On Aug 9, 2019, at 7:48 AM, Paul Hoffman wrote: >=20 >> On Aug 9, 2019, at 7:44 AM, Paul Wouters wrote: >>=20 >>> On Fri, 9 Aug 2019, Paul Hoffman wrote: >>>=20 >>> For every DNS lookup, the Chromecast sends the the same query to 8.8.8.8= *and* the resolver that it was given by DHCP. A popular way to control a Ch= romecast is with the GoogleHome application on a phone. On my iPhone on the s= ame wireless access point, GoogleHome always used the resolver from DHCP. No= te that GoogleHome gave the Wifi password to the Chromecast during setup, so= it could have passed other settings like the resolver address, but appears n= ot to have. >>=20 >> This is not the behaviour I am seeing on my Chromecast Ultra. Local DNS >> is completely ignored and never queried, and the only DNS packets I see >> go to 8.8.8.8. >=20 > Thanks for the report! I'll order one now and make some pcaps. >=20 > I'm still quite interested in other reports of devices and applications th= at by default don't use the configured resolver. Hopefully they are not too e= xpensive...=20 >=20 > --Paul Hoffman > --=20 > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add From nobody Fri Aug 9 11:32:59 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CF74A1201DC for ; Fri, 9 Aug 2019 11:32:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id s6lWwkGuEyr4 for ; Fri, 9 Aug 2019 11:32:55 -0700 (PDT) Received: from mail-ot1-x331.google.com (mail-ot1-x331.google.com [IPv6:2607:f8b0:4864:20::331]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CD82D1201B7 for ; Fri, 9 Aug 2019 11:32:55 -0700 (PDT) Received: by mail-ot1-x331.google.com with SMTP id j11so35795442otp.10 for ; Fri, 09 Aug 2019 11:32:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to; bh=mj2V3KZxA80Xp80C1f6ag+x99KbxI4Lj+5t/e917fTs=; b=QXDUmV5DT3ZA0QbzTJSldzV6+AfiYZnp5lTQxT43b5w9ZqyYNxt+2bFd7bF9lHM1Bb xgvGdq1hmogvDJ+/UaM4QyokA7LknM/u+URhAzX4O3BNV/2daBzbN4qUPSsXK/cp2wb0 nBsGGRKgQkLg3SadhpolE4Tx2hf2WrnU3ciIkjvpb9r9UUE6K6HJowDxjNX13hwJJXh8 Kni0ei/tdoab1ymqNU6oIKcOlthf6l0o36fdNuvgnLwF6q1zrii2DXXCC9ANtxWs6mKt mpNpupLXmASuqPNez3UgILJe1sfHWNd7NXxuxTE1ZV66mR9iNto7BSGEivJnuvvJzeRe abkw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=mj2V3KZxA80Xp80C1f6ag+x99KbxI4Lj+5t/e917fTs=; b=MNoEldchI7o07T4Plbaur71c1jhu0qgnflah+BfOTbEzyD+93Tn5w9eBrvQEnOZose Es4RvOVvX+j5KwCRxGHhtpedUwf5ctXSnbRvcdkMTG3f+laVd/plvyNy6BlO7dALB/0d +iTW/7VrU1LAwqWRqFoiFFUrc4D3YW/fV8Ib4inM2UNOBVb8s3wGEK1xPX9ENf7MDqUE qTv0PRw2MqVyzku8HO8BnseS0sIlcnbAoT+uxNPUBr8tbc+klnTKAZZuhULlWQWHsHQS lMUAt39oeZ8LkB9b7af7EOzSewTSeJxBvD5znl+TONAkjZDgUeM1qhiI2r40FWgpNhdO /dfQ== X-Gm-Message-State: APjAAAVSPiT49VU3BhW/g8CCmAg+jqHgzNTE3IFYtCIBLe4to6T4bw01 9w322p8YTdRQtFii7wHZGdayWAbak6QzRMebFiNnZSXDFJ0= X-Google-Smtp-Source: APXvYqzwzPb+40ro9JrCIUGUoK+stKe4F4MXD+KuohydUyQ2wI6avD4+SL2/wwte+Ccxx6Vln8tc9ZuHDBJGiJcg2l8= X-Received: by 2002:a6b:bc42:: with SMTP id m63mr21394759iof.189.1565375574723; Fri, 09 Aug 2019 11:32:54 -0700 (PDT) MIME-Version: 1.0 From: Rob Sayre Date: Fri, 9 Aug 2019 11:32:43 -0700 Message-ID: To: ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000125025058fb367d2" Archived-At: Subject: [Add] DNS hijacking by exploiting home routers X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 09 Aug 2019 18:32:58 -0000 --000000000000125025058fb367d2 Content-Type: text/plain; charset="UTF-8" https://www.ixiacom.com/company/blog/paypal-netflix-gmail-and-uber-users-among-targets-new-wave-dns-hijacking-attacks I did a search and didn't find this attack mentioned here. It looks like they hack cheap and likely unmaintained home routers and change their DNS settings. thanks, Rob --000000000000125025058fb367d2 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
htt= ps://www.ixiacom.com/company/blog/paypal-netflix-gmail-and-uber-users-among= -targets-new-wave-dns-hijacking-attacks

I did a = search and didn't find this attack mentioned here. It looks like they h= ack cheap and likely unmaintained home routers and change their DNS setting= s.

thanks,
Rob
--000000000000125025058fb367d2-- From nobody Fri Aug 9 12:05:57 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B7AB0120077 for ; Fri, 9 Aug 2019 12:05:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GDPDg7Ny1-W0 for ; Fri, 9 Aug 2019 12:05:54 -0700 (PDT) Received: from out.west.pexch112.icann.org (out.west.pexch112.icann.org [64.78.40.7]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5C66B120019 for ; Fri, 9 Aug 2019 12:05:54 -0700 (PDT) Received: from PMBX112-W1-CA-1.pexch112.icann.org (64.78.40.21) by PMBX112-W1-CA-2.pexch112.icann.org (64.78.40.23) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Fri, 9 Aug 2019 12:05:52 -0700 Received: from PMBX112-W1-CA-1.pexch112.icann.org ([64.78.40.21]) by PMBX112-W1-CA-1.PEXCH112.ICANN.ORG ([64.78.40.21]) with mapi id 15.00.1473.005; Fri, 9 Aug 2019 12:05:52 -0700 From: Paul Hoffman To: Rob Sayre CC: ADD Mailing list Thread-Topic: [Add] [Ext] Chromecast using 8.8.8.8 Thread-Index: AQHVTuAJgBC5aWqD5UKDxKlTA1sz16bzooUA Date: Fri, 9 Aug 2019 19:05:52 +0000 Message-ID: <2A953C5F-0FBB-46F6-A3FE-51AC3E0DEDEB@icann.org> References: <474778E2-BC34-4D87-951E-9CA2174F4F77@icann.org> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [192.0.32.234] Content-Type: text/plain; charset="us-ascii" Content-ID: <81FD85F6051D1C41B9716468B08C8A6E@pexch112.icann.org> Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: Re: [Add] [Ext] Chromecast using 8.8.8.8 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 09 Aug 2019 19:05:56 -0000 On Aug 9, 2019, at 11:26 AM, Rob Sayre wrote: > It looks like Roku set top boxes and some apps on them (e.g. Netflix) als= o do this. Searching for "Roku 8.8.8.8" should turn up reports. Thanks! I now have one on order for testing as well. I hadn't thought of te= sting the individual apps, but I will do that also. (I am failing at keepin= g the "lab" aspect of my work in the office and out of the living room...) --Paul Hoffman= From nobody Fri Aug 9 13:04:52 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DBFED12015B for ; Fri, 9 Aug 2019 13:04:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id T96Uxj-2lEM7 for ; Fri, 9 Aug 2019 13:04:49 -0700 (PDT) Received: from mail-ot1-x335.google.com (mail-ot1-x335.google.com [IPv6:2607:f8b0:4864:20::335]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 80D3B120136 for ; Fri, 9 Aug 2019 13:04:49 -0700 (PDT) Received: by mail-ot1-x335.google.com with SMTP id n5so137272162otk.1 for ; Fri, 09 Aug 2019 13:04:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to; bh=+vp+x4U91kwoaPvMicdOBISWNtt8ZVQJz6FkL5Yki4M=; b=an4wf7f/QWUmW6cGC7fEpbDqrjabva719reagm9sazG36k0VB1SyQMJU5hJpXckMX9 6NOKTRI3xMt8VIRPatKqvF/PCV2dtTJab/Y4+JqAvy39jl2sSU5INcqYN8e0HZqj2iqY D8khGbcrrchgi/6DjPUTy9EqzsRGDOkJkWgZSda+FcNHsMkQEBOpfsvCrP1KgxAqA9uB 948/H/HUtjg2yO6ojmw538fD+BPqce4T1hrzvPFEbKh0Rh5P394/3P3HHFgG9U0R2n3x dRplmQ5nsAh4R7C8ooshfbIE2tHTfsBWwbhd0S4czUJDPc8F+1Mgn8zHYeKvZPDGn/11 knSg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=+vp+x4U91kwoaPvMicdOBISWNtt8ZVQJz6FkL5Yki4M=; b=GYWSwwxqwXXzrnZdzv8UfOQVDt1Yy/niWHC0XQAkj3P4YlGZbZIyb22L9YVIK2KZXX jATrCsx+ogjmH8d5RL6LwUTHaZxJC0wvOu2tetHjdLE5XAl/ilVfxXndGdBdX5ulcHeE HQniV8pB5EGit/jm+Fno3yMFUJf6AnDRzyzeVE67WTfW/07Xjyq2SHnsBZBhyJUz4MrX 3SI/bPbh1Z/ajW8Na6gqLfpPSwhfODPEXNQ21V4hbZ62eElDQcI6CMse2OmVUCm0cDN8 tb09nr49a61QGdisU4igQXsu2vBUpQHuugjoJCIOORiqAX4q9YFYcRauqUwb+G8j/PCC WvKg== X-Gm-Message-State: APjAAAXvamyVl2WjrvkiRDQ4A2v4a/GrxV98E0L11xy5dfcteVAPlzKp y4get8pGPRw+XviEGm+SDgWRj99w7YEcyjSbTscWjc/7IXs= X-Google-Smtp-Source: APXvYqyy3LQ0V2k6OivyGwzJmvIee3C3tEYqE4+tIdpLI/AB3wrIN1N+K5nLKXAvSqqsXKHzbWJqBUKk6LsewQG+WN0= X-Received: by 2002:a5e:d618:: with SMTP id w24mr393977iom.73.1565381088346; Fri, 09 Aug 2019 13:04:48 -0700 (PDT) MIME-Version: 1.0 From: Rob Sayre Date: Fri, 9 Aug 2019 13:04:37 -0700 Message-ID: To: ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000b58a2f058fb4afb5" Archived-At: Subject: [Add] Android: Automatic VPN via "Wifi-Assistant" X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 09 Aug 2019 20:04:51 -0000 --000000000000b58a2f058fb4afb5 Content-Type: text/plain; charset="UTF-8" Since 2015-2016, many Android phones have a feature called Wi-Fi Assistant that automatically activates a VPN if they've automatically switched from cellular to an open Wi-Fi hotspot that's in their quality-of-service database.[1] In late 2018, they made it an option for all connections, including cellular. I set up my Android phone a long time ago, so I can't remember if Wi-Fi Assistant was on by default or not. IIRC it was in the initial setup screens, and not something that required digging into the Settings app to find. thanks, Rob [1] https://support.google.com/nexus/answer/6327199?hl=en --000000000000b58a2f058fb4afb5 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Since 2015-2016, many Android phones have a feature called= Wi-Fi Assistant that automatically activates a VPN if they've automati= cally switched from cellular to an open Wi-Fi hotspot that's in their q= uality-of-service database.[1]

In late 2018, they made it an option = for all connections, including cellular. I set up my Android phone a long t= ime ago, so I can't remember if Wi-Fi Assistant was on by default or no= t. IIRC it was in the initial setup screens, and not something that require= d digging into the Settings app to find.

thanks,
--000000000000b58a2f058fb4afb5-- From nobody Fri Aug 9 13:25:54 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 64ED012015B for ; Fri, 9 Aug 2019 13:25:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NDxurtQocDFz for ; Fri, 9 Aug 2019 13:25:51 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [IPv6:2607:f0b0:f:3:216:3eff:fe7c:d1f3]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 73FAC1200B8 for ; Fri, 9 Aug 2019 13:25:51 -0700 (PDT) Received: from sandelman.ca (unknown [IPv6:2607:f0b0:f:2:56b2:3ff:fe0b:d84]) by tuna.sandelman.ca (Postfix) with ESMTP id C835F3818D for ; Fri, 9 Aug 2019 16:25:09 -0400 (EDT) Received: from localhost (localhost [IPv6:::1]) by sandelman.ca (Postfix) with ESMTP id DBBEA1002 for ; Fri, 9 Aug 2019 16:25:49 -0400 (EDT) From: Michael Richardson To: ADD Mailing list X-Mailer: MH-E 8.6; nmh 1.7+dev; GNU Emacs 24.5.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: [Add] split-DNS --- Re: Control X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 09 Aug 2019 20:25:53 -0000 --=-=-= Content-Type: text/plain Ted Lemon wrote: >> Split DNS is a critical use case. It is not just development systems >> that are not addressable on the outside, but nearly all HR and financial >> systems as well I sold firewalls for most of a decade (25 years ago) that did split-DNS. (I didn't invent it, but I feel that I invested a lot of time into it) > Yes, indeed, this has to work. Would be nice if it could be trusted > based on authenticity rather than a leap of faith. I think that Split-DNS is dumb, and it violates so many DNSSEC things, and it fails when you have multiple VPNs up because you are a consultant who works in many places. The right answer is to have internal names be an (sub-)zone that on a server that only answers when you are inside. Then chain via NS/DS to it. So example.com has it's internal servers at mail.internal.example.com, and unless you query from within (or via VPN), then you don't get an answer. I wrote a document on this for MIF which is expired, search for "walled gardens" But, this method depends upon IPv6 to be use correctly, and marketing people don't understand that, so we have brittle provisioning domains. Internal-only DNS as I described still breaks if you do DoT/DoH to the cloud rather than locally. It also works best if you do recursive DNS resolving locally... which also means you can DNSSEC and DNS64, so that all seems like a win to me. This is my biggest problem. -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAl1N1s0ACgkQgItw+93Q 3WXzNAf/dZE8j++sw6z+eBGki6Ezk7v9ejpBsTWrZD9g+Jv6SiEfmlzba+2TaCpd QtCR33MAej5znSdf+pTzgDcut3WKYDISrbp5gVxXg3VBRVW/FSTSdZVQ4WXTuV9J cA65G3yyzU4fAjeJiJMPfLf15MeU0xBl911Zv+CBU+ZNFVSz3z+H16RhlvStWa2J i3d7kyME5UMVANIC2a6OS6T5y4iycc8sP8AqgJvjOFvmx/BPvmgz1iRZ1eX/Pm+c o42GiZbD03H8BI80OERtgl5rByP+L0PrHty1HCBGGAwLkbFmr35RRXIAuArC/jlP ILfRUW14uOkQ8+oVbTx1t7Al2zxNVA== =HUsl -----END PGP SIGNATURE----- --=-=-=-- From nobody Fri Aug 9 13:30:43 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B41881200B4 for ; Fri, 9 Aug 2019 13:30:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zvtzlZ6z4KgG for ; Fri, 9 Aug 2019 13:30:40 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [IPv6:2607:f0b0:f:3:216:3eff:fe7c:d1f3]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 50DC3120077 for ; Fri, 9 Aug 2019 13:30:40 -0700 (PDT) Received: from sandelman.ca (unknown [IPv6:2607:f0b0:f:2:56b2:3ff:fe0b:d84]) by tuna.sandelman.ca (Postfix) with ESMTP id 2CD2D3818D; Fri, 9 Aug 2019 16:29:59 -0400 (EDT) Received: from localhost (localhost [IPv6:::1]) by sandelman.ca (Postfix) with ESMTP id 469431002; Fri, 9 Aug 2019 16:30:39 -0400 (EDT) From: Michael Richardson To: Paul Hoffman cc: ADD Mailing list In-Reply-To: References: <474778E2-BC34-4D87-951E-9CA2174F4F77@icann.org> <22628.1565364731@localhost> X-Mailer: MH-E 8.6; nmh 1.7+dev; GNU Emacs 24.5.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: Re: [Add] [Ext] Chromecast using 8.8.8.8 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 09 Aug 2019 20:30:42 -0000 --=-=-= Content-Type: text/plain Paul Hoffman wrote: > On Aug 9, 2019, at 8:32 AM, Michael Richardson > wrote: >> I wonder if there was something about your local DNS resolver that it >> didn't >> like, and if it "gave up" on it. > That's not what the pcaps look like. It immediately started sending the > dual queries, and kept up that action throughout, even after reboot. yes, I was actually asking Paul Wouters about his Ultra. -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAl1N1+8ACgkQgItw+93Q 3WUUVwf+PLTit2TAL80vI9ZtR5oF6gUxWj7iHSP3+S8SwyAsrR9LbfEJCElbddQU AD1cHEPfUkMEbF83aBBaJgQ54u8hysQ+jauDFPBXuZlGSgkw+wyuhAhX9+6UQEBI sdcOORgivdQey629oJlYJicDsYOnz7JXJliKFwhBLWN2EnyQuuvi60y3Gk7cBVyi b0PVmqz/CX9s3MU/f7OWUFkK1bEBMIsmjvOGLSw8F1NtECZZZrxLDsSdTtJPt4IJ 22PnEkr9uuiwribUgwLec1z2+R+RwTYfTNoXM1rciA0+0yf3xcy3g8cVk1HpPCoN jC5rFbL0CRQj0qSZtYHfHpT7CT32ag== =5NQ2 -----END PGP SIGNATURE----- --=-=-=-- From nobody Fri Aug 9 13:35:21 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9610D12006B for ; Fri, 9 Aug 2019 13:35:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iiDwRDSC5vtl for ; Fri, 9 Aug 2019 13:35:18 -0700 (PDT) Received: from mail-pf1-x429.google.com (mail-pf1-x429.google.com [IPv6:2607:f8b0:4864:20::429]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E7BD0120077 for ; Fri, 9 Aug 2019 13:35:17 -0700 (PDT) Received: by mail-pf1-x429.google.com with SMTP id q10so46612083pff.9 for ; Fri, 09 Aug 2019 13:35:17 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=X7zP2cy1o02A2VOpIvoxrMFXfeSHlGx/OxRD9FIdIkA=; b=btJ79sxtHJZTji3pDzGAjM2tCUDOBoD7p4rC38OwWkOju7lOL5RlqZM1dx72FDdQNo Lz9seGU32BqGjK0784ZLqF5pvA5a3raRshlTJ/WI3Rvd+7/NIwWRO5lkysUGyc0I3F6h 36+tlrg4Ecdxx4HQV5Ts3PxwVKhjXz9aJo0MGw6XMlKmge5j497r61nB/iMllcE0OX8a XiCKeA+TOWqQgRe1vX+Fviu70UC00X7rLfa+EtrDBdX6YJTeP6F234Mcun6F/ebyM5/C 5UuSXGlgiZELunmh7OETdiWZdRxPTnOabMuP1XXO6QwIr0LXDKUrS3q10fPX/9n74vuM L7Bw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=X7zP2cy1o02A2VOpIvoxrMFXfeSHlGx/OxRD9FIdIkA=; b=bbFHlD/jBmBpSbg16i72R61KhRyWWjTqF4jBCiTGqGEg9V9/clFDXzQGGYDXwvBzVw IKYRgJAhYOW4Azr+1F1PgvXtLe+bNQtyPGvDgtbn8CH3BLNIvbgGV7/QVKOy27MEhY8A emZ+DkhpdsIMxTzgyixgQgiTLyHjYfirOjJM0EKkTQLOOF/mPIoH8p+1qUC/4Jx9hqkr iZa3lSzAfuoIHHPx7fXMMPaqV2xgvUNGSwnlQyUmI3jWDb+cxUjcpNm4W3qVz+LQGG1z 28tGGbHmbZBUX+6h6+Yu5Qr8OhjNyipHhqyrcWk46GKCTUBxzs7YYgIek8tbJpp8ng5A yPUA== X-Gm-Message-State: APjAAAXixFEgq8Iale8jYBvzrkuXE5GZTuYn4gn7ilLQV18tnoSzZu78 ARXM0ekFwMebYHE18eirOi8kdA== X-Google-Smtp-Source: APXvYqzZ6evLqDzRsJICVvrzQsDz5O9DAj+DzlRWQUen7OOO0WIpRvmb8WbVCdQLyeba0SCo4Vkwbw== X-Received: by 2002:a65:6216:: with SMTP id d22mr17728381pgv.404.1565382917195; Fri, 09 Aug 2019 13:35:17 -0700 (PDT) Received: from [17.230.5.180] ([17.230.5.180]) by smtp.gmail.com with ESMTPSA id d144sm3671066pfd.69.2019.08.09.13.35.16 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 09 Aug 2019 13:35:16 -0700 (PDT) From: Ted Lemon Message-Id: Content-Type: multipart/alternative; boundary="Apple-Mail=_C5B1C42B-A3B5-4261-9754-20CD35C33E19" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Fri, 9 Aug 2019 13:35:15 -0700 In-Reply-To: <25417.1565382349@localhost> Cc: ADD Mailing list To: Michael Richardson References: <25417.1565382349@localhost> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] split-DNS --- Re: Control X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 09 Aug 2019 20:35:20 -0000 --Apple-Mail=_C5B1C42B-A3B5-4261-9754-20CD35C33E19 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 On Aug 9, 2019, at 1:25 PM, Michael Richardson = wrote: > The right answer is to have internal names be an (sub-)zone that on a = server > that only answers when you are inside. Then chain via NS/DS to it. > So example.com has it's internal servers at = mail.internal.example.com , > and unless you query from within (or via VPN), then you don't get an > answer. Not answering means that there is no source quench. What you want is = to give a different, validatable answer depending on whether you are = inside or outside. This is doable. But it is essentially split DNS. = This is why I=E2=80=99m pointing to =E2=80=9Cauthenticity=E2=80=9D = versus =E2=80=9Cleap of faith.=E2=80=9D It is possible to do split DNS = securely, and that=E2=80=99s the way we should do recommend that it be = done. --Apple-Mail=_C5B1C42B-A3B5-4261-9754-20CD35C33E19 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 On = Aug 9, 2019, at 1:25 PM, Michael Richardson <mcr+ietf@sandelman.ca> wrote:
The right = answer is to have internal names be an (sub-)zone that on a = server
that only = answers when you are inside. Then chain via NS/DS to it.
So example.com has it's internal servers = at mail.internal.example.com,
and unless = you query from within (or via VPN), then you don't get an
answer.

Not answering means that there is no source quench. =   What you want is to give a different, validatable answer = depending on whether you are inside or outside.   This is doable. =   But it is essentially split DNS.   This is why I=E2=80=99m = pointing to =E2=80=9Cauthenticity=E2=80=9D versus =E2=80=9Cleap of = faith.=E2=80=9D   It is possible to do split DNS securely, and = that=E2=80=99s the way we should do recommend that it be done.

= --Apple-Mail=_C5B1C42B-A3B5-4261-9754-20CD35C33E19-- From nobody Fri Aug 9 13:55:02 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7F2BA120118 for ; Fri, 9 Aug 2019 13:55:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.996 X-Spam-Level: X-Spam-Status: No, score=-1.996 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nohats.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KCKvE9aSx8XZ for ; Fri, 9 Aug 2019 13:54:58 -0700 (PDT) Received: from mx.nohats.ca (mx.nohats.ca [IPv6:2a03:6000:1004:1::68]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EE7D2120077 for ; Fri, 9 Aug 2019 13:54:57 -0700 (PDT) Received: from localhost (localhost [IPv6:::1]) by mx.nohats.ca (Postfix) with ESMTP id 464yDJ00QPzDZJ; Fri, 9 Aug 2019 22:54:55 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nohats.ca; s=default; t=1565384096; bh=tJdJUEoU0ZkVIjEnMAd+f74QM/A6QJrIsCUE50xJUTs=; h=Subject:From:In-Reply-To:Date:Cc:References:To; b=c5OKwf6XXPKDmKtdI8qoscRU5LWdAYlxNy1mc7GDu+qN35je4eNhNQMPWcj1tLYU4 WyaNEVj+FYavOTXWwh9BQwYM/Lpi8r8+YSXgeD93dxKD7BGM6IUujbBKX3Ase0Ufui ghNFQ6W6pbBNBidwRDzBTr+8hbmkhujlKtVUEwbY= X-Virus-Scanned: amavisd-new at mx.nohats.ca Received: from mx.nohats.ca ([IPv6:::1]) by localhost (mx.nohats.ca [IPv6:::1]) (amavisd-new, port 10024) with ESMTP id kn-GZUjc7dsP; Fri, 9 Aug 2019 22:54:53 +0200 (CEST) Received: from bofh.nohats.ca (bofh.nohats.ca [76.10.157.69]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx.nohats.ca (Postfix) with ESMTPS; Fri, 9 Aug 2019 22:54:52 +0200 (CEST) Received: from [10.164.90.188] (unknown [199.119.233.223]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by bofh.nohats.ca (Postfix) with ESMTPSA id 382F03540BB; Fri, 9 Aug 2019 16:54:51 -0400 (EDT) DKIM-Filter: OpenDKIM Filter v2.11.0 bofh.nohats.ca 382F03540BB Content-Type: multipart/alternative; boundary=Apple-Mail-BF6C2D31-2BDF-423F-A50B-F488B689FA9E Mime-Version: 1.0 (1.0) From: Paul Wouters X-Mailer: iPhone Mail (16F203) In-Reply-To: <25417.1565382349@localhost> Date: Fri, 9 Aug 2019 16:54:48 -0400 Cc: ADD Mailing list Content-Transfer-Encoding: 7bit Message-Id: <3E37CCF5-367A-480F-9E2D-B07C2FE1BFC1@nohats.ca> References: <25417.1565382349@localhost> To: Michael Richardson Archived-At: Subject: Re: [Add] split-DNS --- Re: Control X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 09 Aug 2019 20:55:01 -0000 --Apple-Mail-BF6C2D31-2BDF-423F-A50B-F488B689FA9E Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable > On Aug 9, 2019, at 16:25, Michael Richardson wrote= : >=20 >=20 >=20 > I think that Split-DNS is dumb, and it violates so many DNSSEC > things, and it fails when you have multiple VPNs up because you are a > consultant who works in many places. This is not true, unless the different VPNs use the same namespace. See https://tools.ietf.org/html/draft-ietf-ipsecme-split-dns-16 > The right answer is to have internal names be an (sub-)zone that on a serv= er > that only answers when you are inside. Then chain via NS/DS to it. Yes that is what the draft supports. >=20 > Internal-only DNS as I described still breaks if you do DoT/DoH to > the cloud rather than locally. Not if you properly reconfigure DNS when the VPN goes up or down. Paul= --Apple-Mail-BF6C2D31-2BDF-423F-A50B-F488B689FA9E Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable
On Aug 9, 2019, at 16:= 25, Michael Richardson <mcr+ietf= @sandelman.ca> wrote:



I think that Split-DNS is dumb, and it v= iolates so many DNSSEC
things, and it fails when you have mu= ltiple VPNs up because you are a
consultant who works in man= y places.

This is not true,= unless the different VPNs use the same namespace.


The right answ= er is to have internal names be an (sub-)zone that on a server
that only answers when you are inside. Then chain via NS/DS to it.=

Yes that is what the draft supports.


I= nternal-only DNS as I described still breaks if you do DoT/DoH to
= the cloud rather than locally.

Not if you properly reconfigure DNS when the VPN goes up or down.

Paul
= --Apple-Mail-BF6C2D31-2BDF-423F-A50B-F488B689FA9E-- From nobody Fri Aug 9 14:09:13 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1B6CA1200B8 for ; Fri, 9 Aug 2019 14:09:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jvRg7ZbxhJIl for ; Fri, 9 Aug 2019 14:09:08 -0700 (PDT) Received: from giant.haxx.se (www.haxx.se [IPv6:2a00:1a28:1200:9::2]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EAECD120077 for ; Fri, 9 Aug 2019 14:09:07 -0700 (PDT) Received: from giant.haxx.se (mail [127.0.0.1]) by giant.haxx.se (8.15.2/8.15.2/Debian-4) with ESMTPS id x79L8ck6002114 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 9 Aug 2019 23:08:38 +0200 Received: from localhost (dast@localhost) by giant.haxx.se (8.15.2/8.15.2/Submit) with ESMTP id x79L8aa0002106; Fri, 9 Aug 2019 23:08:37 +0200 X-Authentication-Warning: giant.haxx.se: dast owned process doing -bs Date: Fri, 9 Aug 2019 23:08:36 +0200 (CEST) From: Daniel Stenberg X-X-Sender: dast@giant.haxx.se To: Brian Dickson cc: Paul Hoffman , Paul Wouters , ADD Mailing list In-Reply-To: <378BCA46-9E3F-481F-9FB7-D8A955E5EEFE@gmail.com> Message-ID: References: <474778E2-BC34-4D87-951E-9CA2174F4F77@icann.org> <378BCA46-9E3F-481F-9FB7-D8A955E5EEFE@gmail.com> User-Agent: Alpine 2.20 (DEB 67 2015-01-07) X-fromdanielhimself: yes MIME-Version: 1.0 Content-Type: multipart/mixed; BOUNDARY="1129329158-191656876-1565384918=:26798" Archived-At: Subject: Re: [Add] [Ext] Chromecast using 8.8.8.8 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 09 Aug 2019 21:09:12 -0000 This message is in MIME format. The first part should be readable text, while the remaining parts are likely unreadable without MIME-aware tools. --1129329158-191656876-1565384918=:26798 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8BIT On Fri, 9 Aug 2019, Brian Dickson wrote: > I don’t have one, but I am wondering about how it uses 8.8.8.8, ie if it > somehow authenticates its identity, or if it trusts any answer from 8.8.8.8. > > Maybe you could stand up a fake 8.8.8.8 including any necessary routes, and > see if it accepts it? We're possibly not quite on topic here anymore, but... There are plenty of people online [1] at least saying they could just redirect the traffic to their own resolver [2]. [1] = https://news.ycombinator.com/item?id=19170671 [2] = https://ba.net/adblock/vpn/roku-chromecast-fix.html -- / daniel.haxx.se --1129329158-191656876-1565384918=:26798-- From nobody Fri Aug 9 14:30:58 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7C2A8120077 for ; Fri, 9 Aug 2019 14:30:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id n1Se9dAU4nlM for ; Fri, 9 Aug 2019 14:30:54 -0700 (PDT) Received: from mail-ot1-x334.google.com (mail-ot1-x334.google.com [IPv6:2607:f8b0:4864:20::334]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7AD3612006B for ; Fri, 9 Aug 2019 14:30:54 -0700 (PDT) Received: by mail-ot1-x334.google.com with SMTP id q20so137883032otl.0 for ; Fri, 09 Aug 2019 14:30:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=3qg7qLfAR5YzAWAolubXZBoDJtTmPLqKETx944Sm0Yo=; b=TbLAunOJUslbOJ7HY3TR/psA5RwePqsUUB6VvDGdHNiZA1c0a3NILPTWXOk/2Dclfy 5fR7N23u4E/DoelhYejVtTXb5s2q5YD6RXerWvPAhtVIcNur2L0PBGr7DJGgmwUloKjp urLMjoHsyD1YBzaS/lXSM1yY9EX+UBCh6qOtsgunJOFdDoU/+5qotIBzW3Yi5a+i6M3R gXdFI7xqOvKEEQ0HhCIcJC5hES3jxnDZtCeYEu2S6nyIWCxnztlZAEe3QqNHTp/gVkLY 279QdEHa10v5JJkwTCvb7X8uFF5PWQdTcsd+mr4TvfiDE2HBwGwEydz2qzMVgTSjTq1L eAaw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=3qg7qLfAR5YzAWAolubXZBoDJtTmPLqKETx944Sm0Yo=; b=Fbd/sEr08QCBL9Fp1bBDQ6PAHJ4tMKSwjTr4iaBO11o/VCXk/1/6DXMMwSRJk7AtIr E3EnlRnnaCNuspg/WsJErO0iwAf+xDH+thaBsgM1nSqODJ10Yh9uFDZcoa4Qknerbzwz z1UyV5kjpr2hftv6AZtQAMHmNYQ99A2Gw5FgHHNjc0RIscyr1kyNlgxO7LHeDREKNqST FIya85CZuCDM1MQTce2rBmu4gIG079u53FSWr2Fcajv3CC5XJTE4Tm3MfBhf9mrd5jVK PPxITJ8lt6vXE6beLzSMNXggZ4ZmBnBucaL7b38F5QAAE8FoaNAAo9wJkaghrxYVDDpq 5reg== X-Gm-Message-State: APjAAAW7nsWZ9xwkU2OvI+9/Jw5GEyoADb9JNybYtaytryrpvFFFAOHb yORfG0qlAbZh9o8SxMESk8xEBW7J/kOSDdrULfo= X-Google-Smtp-Source: APXvYqwXA7bQczeZmsoUzxRokQXfR0OfD3R3trCCVprh2GAlGMq0vozeDm/bXT0StaF4NcuILv3m3C8DSihi1cdmrxI= X-Received: by 2002:a02:1a86:: with SMTP id 128mr25075113jai.95.1565386253715; Fri, 09 Aug 2019 14:30:53 -0700 (PDT) MIME-Version: 1.0 References: <474778E2-BC34-4D87-951E-9CA2174F4F77@icann.org> <378BCA46-9E3F-481F-9FB7-D8A955E5EEFE@gmail.com> In-Reply-To: From: Rob Sayre Date: Fri, 9 Aug 2019 14:30:42 -0700 Message-ID: To: Daniel Stenberg Cc: Brian Dickson , Paul Hoffman , Paul Wouters , ADD Mailing list Content-Type: multipart/alternative; boundary="00000000000096d96f058fb5e3b8" Archived-At: Subject: Re: [Add] [Ext] Chromecast using 8.8.8.8 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 09 Aug 2019 21:30:57 -0000 --00000000000096d96f058fb5e3b8 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Fri, Aug 9, 2019 at 2:09 PM Daniel Stenberg wrote: > On Fri, 9 Aug 2019, Brian Dickson wrote: > > > I don=E2=80=99t have one, but I am wondering about how it uses 8.8.8.8,= ie if it > > somehow authenticates its identity, or if it trusts any answer from > 8.8.8.8. > > > > Maybe you could stand up a fake 8.8.8.8 including any necessary routes, > and > > see if it accepts it? > > We're possibly not quite on topic here anymore, but... > > There are plenty of people online [1] at least saying they could just > redirect > the traffic to their own resolver [2]. > If the devices used DoT/DoH, I don't think this technique would work, hence the investigation. The most common reason to make these changes seems to be to circumvent region-based content restrictions on streaming video. thanks, Rob --00000000000096d96f058fb5e3b8 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Fri, Aug 9, 2019 at 2:09 PM Daniel Ste= nberg <daniel@haxx.se> wrote:
On Fri, 9 Aug 2019, Brian Dickson wrote:

> I don=E2=80=99t have one, but I am wondering about how it uses 8.8.8.8= , ie if it
> somehow authenticates its identity, or if it trusts any answer from 8.= 8.8.8.
>
> Maybe you could stand up a fake 8.8.8.8 including any necessary routes= , and
> see if it accepts it?

We're possibly not quite on topic here anymore, but...

There are plenty of people online [1] at least saying they could just redir= ect
the traffic to their own resolver [2].

= If the devices used DoT/DoH, I don't think this technique would work, h= ence the investigation.

The most common reason to = make these changes seems to be to circumvent region-based content restricti= ons on streaming video.

thanks,
Rob
--00000000000096d96f058fb5e3b8-- From nobody Fri Aug 9 14:51:26 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A9EC1120077 for ; Fri, 9 Aug 2019 14:51:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nrycMDa2gOtg for ; Fri, 9 Aug 2019 14:51:23 -0700 (PDT) Received: from giant.haxx.se (www.haxx.se [IPv6:2a00:1a28:1200:9::2]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1CDD112006B for ; Fri, 9 Aug 2019 14:51:22 -0700 (PDT) Received: from giant.haxx.se (mail [127.0.0.1]) by giant.haxx.se (8.15.2/8.15.2/Debian-4) with ESMTPS id x79LouaM003074 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 9 Aug 2019 23:50:56 +0200 Received: from localhost (dast@localhost) by giant.haxx.se (8.15.2/8.15.2/Submit) with ESMTP id x79LosKT003068; Fri, 9 Aug 2019 23:50:54 +0200 X-Authentication-Warning: giant.haxx.se: dast owned process doing -bs Date: Fri, 9 Aug 2019 23:50:54 +0200 (CEST) From: Daniel Stenberg X-X-Sender: dast@giant.haxx.se To: Rob Sayre cc: Brian Dickson , Paul Hoffman , Paul Wouters , ADD Mailing list In-Reply-To: Message-ID: References: <474778E2-BC34-4D87-951E-9CA2174F4F77@icann.org> <378BCA46-9E3F-481F-9FB7-D8A955E5EEFE@gmail.com> User-Agent: Alpine 2.20 (DEB 67 2015-01-07) X-fromdanielhimself: yes MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII; format=flowed Archived-At: Subject: Re: [Add] [Ext] Chromecast using 8.8.8.8 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 09 Aug 2019 21:51:25 -0000 On Fri, 9 Aug 2019, Rob Sayre wrote: > If the devices used DoT/DoH, I don't think this technique would work, hence > the investigation. Yes, DoT and DoH authentication will of course fail after such tricks. But these boxes (obviously) don't use those protocols (yet)... -- / daniel.haxx.se From nobody Mon Aug 12 08:55:19 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6147B121BAF for ; Mon, 12 Aug 2019 08:55:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5AxpCsijvWUp for ; Mon, 12 Aug 2019 08:54:11 -0700 (PDT) Received: from mx0a-00191d01.pphosted.com (mx0b-00191d01.pphosted.com [67.231.157.136]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 93F70120A9E for ; Sun, 11 Aug 2019 15:10:41 -0700 (PDT) Received: from pps.filterd (m0049458.ppops.net [127.0.0.1]) by m0049458.ppops.net-00191d01. (8.16.0.27/8.16.0.27) with SMTP id x7BM56eN007414 for ; Sun, 11 Aug 2019 18:10:39 -0400 Received: from alpi154.enaf.aldc.att.com (sbcsmtp6.sbc.com [144.160.229.23]) by m0049458.ppops.net-00191d01. with ESMTP id 2uamkn63wb-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Sun, 11 Aug 2019 18:10:39 -0400 Received: from enaf.aldc.att.com (localhost [127.0.0.1]) by alpi154.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id x7BMAcd1012055 for ; Sun, 11 Aug 2019 18:10:38 -0400 Received: from zlp30486.vci.att.com (zlp30486.vci.att.com [135.47.91.177]) by alpi154.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id x7BMAXbf011997 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO) for ; Sun, 11 Aug 2019 18:10:34 -0400 Received: from zlp30486.vci.att.com (zlp30486.vci.att.com [127.0.0.1]) by zlp30486.vci.att.com (Service) with ESMTP id 88F2F4009E7A for ; Sun, 11 Aug 2019 22:10:33 +0000 (GMT) Received: from GAALPA1MSGHUBAD.ITServices.sbc.com (unknown [130.8.218.153]) by zlp30486.vci.att.com (Service) with ESMTPS id 75CF740002AD for ; Sun, 11 Aug 2019 22:10:33 +0000 (GMT) Received: from GAALPA1MSGUSRBF.ITServices.sbc.com ([169.254.5.84]) by GAALPA1MSGHUBAD.ITServices.sbc.com ([130.8.218.153]) with mapi id 14.03.0439.000; Sun, 11 Aug 2019 18:10:33 -0400 From: "STARK, BARBARA H" To: "'ADD Mailing list'" Thread-Topic: [Add] Chromecast using 8.8.8.8 Thread-Index: AQHVTlary1EUTWy3tkmOV4cCRz/KQqbzKC8AgAANaoCAAyRaoA== Date: Sun, 11 Aug 2019 22:10:32 +0000 Message-ID: <2D09D61DDFA73D4C884805CC7865E6114E263F72@GAALPA1MSGUSRBF.ITServices.sbc.com> References: <474778E2-BC34-4D87-951E-9CA2174F4F77@icann.org> <22628.1565364731@localhost> In-Reply-To: <22628.1565364731@localhost> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [135.70.204.105] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-08-11_10:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_policy_notspam policy=outbound_policy score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=581 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1906280000 definitions=main-1908110246 Archived-At: Subject: Re: [Add] Chromecast using 8.8.8.8 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 12 Aug 2019 15:55:17 -0000 > Paul Wouters wrote: > >> For every DNS lookup, the Chromecast sends the the same query to > >>8.8.8.8 *and* the resolver that it was given by DHCP. A popular way= to > >>control a Chromecast is with the GoogleHome application on a phone. > On > >>my iPhone on the same wireless access point, GoogleHome always used > the > >>resolver from DHCP. Note that GoogleHome gave the Wifi password to > the > >>Chromecast during setup, so it could have passed other settings lik= e the > >>resolver address, but appears not to have. >=20 > > This is not the behaviour I am seeing on my Chromecast Ultra. Local= DNS > > is completely ignored and never queried, and the only DNS packets I= see > > go to 8.8.8.8. >=20 > I wonder if there was something about your local DNS resolver that it did= n't > like, and if it "gave up" on it. What happens if you block it's 8.8.8.8 = access? I was curious, too, what would happen if the address was blocked. So I trie= d.=20 When I told the firewall to drop all packets to 8.8.8.8, my Chromecast just= kept trying to reach 8.8.8.8. I gave up after several minutes (it hadn't g= iven up). No attempt was made to use the resolver advertised by the router (and no at= tempt was made when 8.8.8.8 packets were accepted). When I told the firewall to reject packets (ICMP unreachable response) dest= ined for 8.8.8.8, it did try the locally advertised resolver (and seemed to= get good responses). It never gave up trying 8.8.8.8 every time it wanted = to resolve something. But the casting failed. Chromecast complained of a fa= ilure (displayed a message on the TV screen), but didn't explain what faile= d.=20 Just thought I'd share in the fun. Barbara > Oh, to have a MUD file for these devices. From nobody Mon Aug 12 15:17:59 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DC415120B25 for ; Mon, 12 Aug 2019 15:17:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=netorgft5189650.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lHfnP0Ozd5tV for ; Mon, 12 Aug 2019 15:17:45 -0700 (PDT) Received: from GBR01-LO2-obe.outbound.protection.outlook.com (mail-eopbgr100075.outbound.protection.outlook.com [40.107.10.75]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6EFB5120920 for ; Mon, 12 Aug 2019 14:16:35 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=ivrwsB7BKQnPxoA6SmvjxYvY6p594DBtyqcB+5LaCyIKTmVU34rKBKDtly10CylkHbX9wGePtTD5wkHKJvc9O27YoOpHi9h4t1ZFv+ZeK+33Z14y1LaQIOD5XeFeeNCAiTcOHMxQQ/FpuQoFFiDGbLWzKI+oFYEPBH3yg8g2Y20PRO3bkbT1c4emS5VNnPP355nT4ifmMV2zug0qpc+iy0e6U97mxddFAbW1dLw9gN4VAxuK+JWj/tLcynVL3nl7cC6vBiC/EqLOQOEfcXI0+txcfxwoMz7yFhf0Zy4XN/AwP9FLQU9TuaQePPc69Ofrkxmwts7Ht60ZzRyurPvfcQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=bP1C4A9zNRrJN8mU/OD08tgeRqy23ZI6oeQEFzSj814=; b=C8GjIxB5S8nFbvCVEeVy5oSjHtGgwK6lZRGJLNY4wON5SxMxayUvv0f4z6wY9/VBG8d5vJB5BQJBfgTasXQEvZXW9gq2tl74KS8AWLm8Q090dcE3THKLk3pM3WDp0aRtkObV2N8D82Snq4UVJMG1C6NEUBGwyLOGGaLzeL8hOy9aeYA0uFIFNZejXZw3D+Pq/YFIm8N5ojsnaw1mgolIB6U5poKguOVBxLtt+6FZdXaW3Y3AynZs6ZzdtrLcrrxGOnrijCONVxZL23H3X9xSIpcvEVKgO4N/Z0a2YQ/lOVZ7pD/zm8xo5tf3eCkVtErXzDhdrRtOxZhlx1VAySBdxQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=419.consulting; dmarc=pass action=none header.from=419.consulting; dkim=pass header.d=419.consulting; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=NETORGFT5189650.onmicrosoft.com; s=selector1-NETORGFT5189650-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=bP1C4A9zNRrJN8mU/OD08tgeRqy23ZI6oeQEFzSj814=; b=UaIB6DrG3oJWKxW0u9VRIeNQyXgwQYj4KiqWWyU8UmncXfEAcjP/ZeqwdDkfnnkXa6J9QmJ0U+91y5u+y7K1RAjDh0x9Gx/mVIbBSRbsusIvMVBpNbEreeC45aeMJF8h/AxAC7Yxe+V2OM6VpqnSOBC18SELYfR6osWvoLumXjk= Received: from LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM (20.176.138.146) by LO2P265MB1309.GBRP265.PROD.OUTLOOK.COM (20.176.138.142) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2157.15; Mon, 12 Aug 2019 21:16:33 +0000 Received: from LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM ([fe80::64e9:9b9e:59fc:26f]) by LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM ([fe80::64e9:9b9e:59fc:26f%5]) with mapi id 15.20.2157.022; Mon, 12 Aug 2019 21:16:33 +0000 From: Andrew Campling To: "STARK, BARBARA H" , 'ADD Mailing list' Thread-Topic: [Add] Chromecast using 8.8.8.8 Thread-Index: AQHVUUA1RUPFbvQUrEiVgQOG2cq+wab4Alvg Date: Mon, 12 Aug 2019 21:16:32 +0000 Message-ID: References: <474778E2-BC34-4D87-951E-9CA2174F4F77@icann.org> <22628.1565364731@localhost> <2D09D61DDFA73D4C884805CC7865E6114E263F72@GAALPA1MSGUSRBF.ITServices.sbc.com> In-Reply-To: <2D09D61DDFA73D4C884805CC7865E6114E263F72@GAALPA1MSGUSRBF.ITServices.sbc.com> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=andrew.campling@419.consulting; x-originating-ip: [81.141.76.158] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 7903a595-6bd3-4f09-1409-08d71f6a59d7 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(7021145)(8989299)(4534185)(7022145)(4603075)(4627221)(201702281549075)(8990200)(7048125)(7024125)(7027125)(7023125)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:LO2P265MB1309; x-ms-traffictypediagnostic: LO2P265MB1309: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:8882; x-forefront-prvs: 012792EC17 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(39830400003)(136003)(366004)(376002)(346002)(396003)(199004)(189003)(486006)(229853002)(476003)(256004)(66476007)(66556008)(6436002)(14444005)(66066001)(5660300002)(8936002)(14454004)(64756008)(110136005)(76116006)(44832011)(11346002)(66446008)(71190400001)(508600001)(446003)(71200400001)(316002)(99286004)(3846002)(2906002)(7696005)(6246003)(66946007)(53936002)(76176011)(55016002)(86362001)(6506007)(9686003)(81156014)(33656002)(8676002)(81166006)(7736002)(25786009)(102836004)(52536014)(6116002)(186003)(305945005)(66574012)(26005)(74316002)(46492003); DIR:OUT; SFP:1101; SCL:1; SRVR:LO2P265MB1309; H:LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: 419.consulting does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: Kd7tpVr9X2KO5+Lt166C6Pr4FgaNhrayP20parOYnzF1ek+ey3QlGEcTw7K0paZXlOwclJdRXUi2uGfeNOQDrageGCCfgasae49mEMiYAZ5KhWITT4q4MKF6PwXuWU3qMvawgpHNRTbociLIWjXtoiOL5awzlumy7bcFkarFYkL2NFQJGzpWDeWTiu+ThJNsyASxjCgDAiK/FZj1tsiygNLoSCfNLiJvd5bmYbp0zAnIPbalG/vVoL8RgSH4UbxbA8jvQVuE6FHgeId3sC+ixjTH3abk9hpa1oMkbtMzD3lZlsJZEDY4kPAz5amMxUrpk9qbgCGZQlK3wVryFN2qVu124HccKRFnkMH6pM5cKZWkTPFKlhv8Qv26zr/kX0IIxm0R7hnreUVvvZZGiy5f/i93+o4aqbQVPEZ0qdvMM0E= x-ms-exchange-transport-forked: True Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: 419.consulting X-MS-Exchange-CrossTenant-Network-Message-Id: 7903a595-6bd3-4f09-1409-08d71f6a59d7 X-MS-Exchange-CrossTenant-originalarrivaltime: 12 Aug 2019 21:16:32.9127 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 9c2ced3e-7522-4755-87dc-f983abc66ec3 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: TYKlQyoBU4RocNcIVYIj5NFqUV1lfKi9PjGrnna8RF7flINxavjcKQsXvEkj4ILCeAdjyE51T9QOjb4bMUGhycHSzyqd8S3yfWDdvfaMc7M= X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO2P265MB1309 Archived-At: Subject: Re: [Add] Chromecast using 8.8.8.8 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 12 Aug 2019 22:17:53 -0000 > STARK, BARBARA H wrote: > I was curious, too, what would happen if the address was blocked. So I tr= ied.=20 > When I told the firewall to drop all packets to 8.8.8.8, my Chromecast ju= st kept trying to reach 8.8.8.8. I gave up after several minutes (it hadn't= given up). > No attempt was made to use the resolver advertised by the router (and no = attempt was made when 8.8.8.8 packets were accepted). > When I told the firewall to reject packets (ICMP unreachable response) de= stined for 8.8.8.8, it did try the locally advertised resolver (and seemed = to get good responses). It never gave up trying 8.8.8.8 every=20 > time it wanted to resolve something. But the casting failed. Chromecast c= omplained of a failure (displayed a message on the TV screen), but didn't e= xplain what failed.=20 > Just thought I'd share in the fun. > Barbara I guess we'll be seeing more badly behaved devices and apps as DoH is imple= mented, except of course that it will be harder to detect and stop them. Th= is really underlines why DoH is a poor choice vs DoT or DNS53 in terms of u= ser choice and control. =20 Andrew =20 From nobody Tue Aug 13 10:38:56 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8D9DD1200B1 for ; Tue, 13 Aug 2019 10:38:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.965 X-Spam-Level: X-Spam-Status: No, score=-0.965 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_SBL_CSS=3.335, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UOVjhwMAy5vG for ; Tue, 13 Aug 2019 10:38:53 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9316D12011B for ; Tue, 13 Aug 2019 10:38:52 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 02919BE47; Tue, 13 Aug 2019 18:38:51 +0100 (IST) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OAtEqlv-lbXR; Tue, 13 Aug 2019 18:38:49 +0100 (IST) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 67982BE3E; Tue, 13 Aug 2019 18:38:49 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1565717929; bh=wKw4GyyOcJqtKoZt4ZVU9o7NgWJ3gYjoB8Ij4p8Pu68=; h=To:Cc:References:From:Subject:Date:In-Reply-To:From; b=Qylw/2V/CeWeUVsPGelte7m7CdClYeYSMgfC5hBUFngHACArYUCtoUTHPBpW7KJcM m1Qrd3j1b3i/oHjQVYqFYkSjEsDu7luoOUox/GQeVnrXhN1IlCTLUlCV8hWFVtAho+ w949kd1S3x9IpREIcBUuN0zezAWX9kYG5flOfJUU= To: "STARK, BARBARA H" , 'Rob Sayre' Cc: 'ADD Mailing list' References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: Date: Tue, 13 Aug 2019 18:38:44 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="MwpkXuSTIfjriKJUBo0CEGqqeoBKcv4nk" Archived-At: Subject: Re: [Add] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 13 Aug 2019 17:38:56 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --MwpkXuSTIfjriKJUBo0CEGqqeoBKcv4nk Content-Type: multipart/mixed; boundary="OfHE1vMtDl4D1f4zZQA9Nhr201i9McHcD"; protected-headers="v1" From: Stephen Farrell To: "STARK, BARBARA H" , 'Rob Sayre' Cc: 'ADD Mailing list' Message-ID: Subject: Re: [Add] Validity of network administrator role References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> In-Reply-To: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> --OfHE1vMtDl4D1f4zZQA9Nhr201i9McHcD Content-Type: multipart/mixed; boundary="------------4834EEE3F618F3E5ECDE0072" Content-Language: en-GB This is a multi-part message in MIME format. --------------4834EEE3F618F3E5ECDE0072 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hiya, On 09/08/2019 13:25, STARK, BARBARA H wrote: > Applications and cloud services that try to take away from me the > ability to control what goes on inside my personal home network will > be added to my "do not trust" list. I also like to manage my home n/w according to my own wishes. My wishes include not eavesdropping on guest or home user's traffic, except with their agreement, e.g. if someone's device isn't working. (Just in case someone goes there: when some of the home n/w users were too young to agree, we used manage their access to connected devices, not their n/w traffic, e.g. by insisting they be in the same room as an adult, and one of the people who most enforced that policy is decidedly non-technical.) For me, that means if a guest or other n/w user has chosen an application that wants to do DoH with some other recursive that's ok by me. I'd consider myself inhospitable were I to want to control the DNS choices of people in my home. In a similar vein, I do not insist that people using my home n/w use any particular OS, even though I have strong opinions on the relative goodness of those. So the important point here is "my network, my rules" does *not* imply "DoH is problematic." I think that also means that considering the n/w admin as a valid role similarly does not imply that one has a problem with DoH. And lastly, liking DoH does not imply disparaging n/w administration. There are of course a bunch of specific policies that some n/w admins do like for which DoH is problematic as has been described already on this list. But we ought not over-claim e.g. by asserting that liking DoH implies disliking n/w administration. Cheers, S. PS: Neither Barbara nor I are wearing our homenet WG chair hats in this discussion, but I think it's fun that we take different, reasonable, positions:-) --------------4834EEE3F618F3E5ECDE0072 Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------4834EEE3F618F3E5ECDE0072-- --OfHE1vMtDl4D1f4zZQA9Nhr201i9McHcD-- --MwpkXuSTIfjriKJUBo0CEGqqeoBKcv4nk Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAl1S9aQACgkQWrL68XsX K+rdMRAApbINNKHNxibUireotKX2RAtYRbXvAgBS5XZ/deCAFOX0JkaJMoDQ+YYE OdaqfoST/sjolIHfRVO1OwK6Ru2AZ7XnOToAoa1kft6r9z3WUVlzEQ0KZL9ccWSm mJBTOvIkGi4+dXqQYtkV7deAo4FbE0xa0s92BJ2sprHrUQr1uwb6L6NRERrBVg3W iDPl2w+eUOq5bOvJd703RPGhdaaXrONeMrLllJ92dUXeKECXqe+alvTmljl0ME5n 507r2vJ0YF84tboyfCpGFfh+pwVd1eZbMooC5zaejFvTpChrFS7v3zpu/EfNa5Nb 2P+uYPB4W6vvTzV/5acKIK36GefD81hpcLKOGxIqcCQqFNwbil/ZHfBBccXSN0WC Rziie22yatbZPY82kExafNCCwGUsX32lZr/cVaLbKxCRv72+IHV7zukkJ4ks4fRj RCmnUWwKMpCOw54MYPPiJ8z7rld2lYpXrBPAtJ2K/RehKbtVXAWBPytDnWfnXUHC ZD2kFc+NPQvplecz9bM5CP8PFmL+HySv9ERnfSVw7g/DTXFv2vtpwjCq3Kh7iox1 M52lnFMWKjl6zu8r14mWmKXk7MugE66Px2a5jCObPrsGTUpEKYFRSSYh00o6+E9U XxpupGa1Mk037Jds7wR9fclzg1870fe1Ynyp16eRttWS3aJAnn4= =/Diq -----END PGP SIGNATURE----- --MwpkXuSTIfjriKJUBo0CEGqqeoBKcv4nk-- From nobody Tue Aug 13 14:46:41 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 122821208E6 for ; Tue, 13 Aug 2019 14:46:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aenF9i9Cna9S for ; Tue, 13 Aug 2019 14:46:37 -0700 (PDT) Received: from mail-pg1-x534.google.com (mail-pg1-x534.google.com [IPv6:2607:f8b0:4864:20::534]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E64921208C2 for ; Tue, 13 Aug 2019 14:46:36 -0700 (PDT) Received: by mail-pg1-x534.google.com with SMTP id e11so1373579pga.5 for ; Tue, 13 Aug 2019 14:46:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=J2f79dBO33Vs6R/r5efg/RHnTP+Rv17NOUpZNeDAy9Y=; b=aQujupr13OXNeprQ7DdsD70awMZkpiOIoytx1TR3TdYZCrgYhNwwYefaf+sg7xysPX S2AqURdLsnPS0ByHNmJXpnPRsC1eOpWmq0B7Nz5DIMgKCFej2piFxdYMIvWwImU2clbI UvuSsUvq4hgJTJ3vnfoofqeL8IxQtCJcccKmdAjTGucoB2vPTXZtdQkiB1g2uMiRI8dA vb0qF9UhWCjaliSLZTiYP7w+7qlTVud9E5Q/AacSZP7XXoYYPRJ+r+QaE8mwwUydAxjS GY78DmWD3/jdzFZ8HsRk4q93OL/3s4boYMEfcQDPVg0kaWskh9gYbZCkTJG+fGQQT21k 3V4w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=J2f79dBO33Vs6R/r5efg/RHnTP+Rv17NOUpZNeDAy9Y=; b=HECyi+fkHP3bg3YJfjv/BylcIl++7hEQPU7eCgvHyof3MscBZkM5v92rW7E38JGetg XCU+ldXEVQeBNiyuwDd2Jgq3iXkOzUiAIY4N8q3Gn6zN8wfmqj/sItKdMYz1+hXkd2Sy /z7dxQDobn7hlScS05raCq2Kcd+YLu5qrkiAy7M0Sc38Pu5spPqi5pKeY57WHTq4T9kH R40Z7qwF0eIPeahgxLHiZoPALpmay0Jcrtt8S0Rsvjja6qTvl1H3B0MtMaatBugbhtft RXFmAQr8V+uqexFjsfAJwHmiEqeRnUn2j+2xzSf5XiJhNHGEtgHk+OZGZo2A9+PpdQly TJfw== X-Gm-Message-State: APjAAAU3bv4nOHa2WJu0YSQG2E59KXtHCSc1SCoClVcFfQKo39clinmE txkZ4uoLgBvXY/V8v/ZNMRk= X-Google-Smtp-Source: APXvYqxmoBJeoepCp/oIruDzolxAVVqq0vf8xJfmRu7fvq+VQFxu+PbqQZB9m2D+Er8+B/WKbl8ozA== X-Received: by 2002:a17:90a:fa8f:: with SMTP id cu15mr4133128pjb.119.1565732796442; Tue, 13 Aug 2019 14:46:36 -0700 (PDT) Received: from [10.128.64.149] ([136.60.227.81]) by smtp.gmail.com with ESMTPSA id u1sm105742699pgi.28.2019.08.13.14.46.35 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 13 Aug 2019 14:46:35 -0700 (PDT) From: Bret Jordan Message-Id: <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_C80B84E4-2375-4D1E-82DB-7D8FB8C778C7" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Tue, 13 Aug 2019 15:46:33 -0600 In-Reply-To: Cc: "STARK, BARBARA H" , Rob Sayre , ADD Mailing list To: Stephen Farrell References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 13 Aug 2019 21:46:39 -0000 --Apple-Mail=_C80B84E4-2375-4D1E-82DB-7D8FB8C778C7 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii My question is at what stage, level, organization type, or organization = size, does a network administrator care, or are forced to care by = regulators? Thanks, Bret PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 "Without cryptography vihv vivc ce xhrnrw, however, the only thing that = can not be unscrambled is an egg." > On Aug 13, 2019, at 11:38 AM, Stephen Farrell = wrote: >=20 >=20 > Hiya, >=20 > On 09/08/2019 13:25, STARK, BARBARA H wrote: >> Applications and cloud services that try to take away from me the >> ability to control what goes on inside my personal home network will >> be added to my "do not trust" list. > I also like to manage my home n/w according to my own > wishes. My wishes include not eavesdropping on guest > or home user's traffic, except with their agreement, > e.g. if someone's device isn't working. (Just in case > someone goes there: when some of the home n/w users > were too young to agree, we used manage their access > to connected devices, not their n/w traffic, e.g. by > insisting they be in the same room as an adult, and > one of the people who most enforced that policy is > decidedly non-technical.) >=20 > For me, that means if a guest or other n/w user has > chosen an application that wants to do DoH with some > other recursive that's ok by me. I'd consider myself > inhospitable were I to want to control the DNS choices > of people in my home. In a similar vein, I do not > insist that people using my home n/w use any particular > OS, even though I have strong opinions on the relative > goodness of those. >=20 > So the important point here is "my network, my rules" > does *not* imply "DoH is problematic." >=20 > I think that also means that considering the n/w admin > as a valid role similarly does not imply that one has > a problem with DoH. >=20 > And lastly, liking DoH does not imply disparaging n/w > administration. >=20 > There are of course a bunch of specific policies that > some n/w admins do like for which DoH is problematic as > has been described already on this list. But we ought > not over-claim e.g. by asserting that liking DoH implies > disliking n/w administration. >=20 > Cheers, > S. >=20 > PS: Neither Barbara nor I are wearing our homenet WG > chair hats in this discussion, but I think it's fun that > we take different, reasonable, positions:-) > <0x5AB2FAF17B172BEA.asc>--=20 > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add --Apple-Mail=_C80B84E4-2375-4D1E-82DB-7D8FB8C778C7 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii My = question is at what stage, level, organization type, or organization = size,  does a network administrator care, or are forced to care by = regulators?


Thanks,
Bret
PGP = Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 = 0050
"Without = cryptography vihv vivc ce xhrnrw, however, the only thing that can not = be unscrambled is an = egg."

On Aug 13, 2019, at 11:38 AM, Stephen Farrell <stephen.farrell@cs.tcd.ie> wrote:


Hiya,

On 09/08/2019 13:25, = STARK, BARBARA H wrote:
Applications and cloud services that try to take away from me = the
ability to control what goes on inside my personal = home network will
be added to my "do not trust" list.
I also like to manage my home n/w according to = my own
wishes. My wishes include not eavesdropping on = guest
or home user's traffic, except with their = agreement,
e.g. if someone's device isn't working. (Just = in case
someone goes there: when some of the home n/w = users
were too young to agree, we used manage their = access
to connected devices, not their n/w traffic, e.g. = by
insisting they be in the same room as an adult, and
one of the people who most enforced that policy is
decidedly non-technical.)

For = me, that means if a guest or other n/w user has
chosen an = application that wants to do DoH with some
other recursive = that's ok by me. I'd consider myself
inhospitable were I = to want to control the DNS choices
of people in my home. = In a similar vein, I do not
insist that people using my = home n/w use any particular
OS, even though I have strong = opinions on the relative
goodness of those.

So the important point here is "my network, my = rules"
does *not* imply "DoH is problematic."

I think that also means that considering the = n/w admin
as a valid role similarly does not imply that = one has
a problem with DoH.

And= lastly, liking DoH does not imply disparaging n/w
administration.

There are of = course a bunch of specific policies that
some n/w admins = do like for which DoH is problematic as
has been described = already on this list. But we ought
not over-claim e.g. by = asserting that liking DoH implies
disliking n/w = administration.

Cheers,
S.

PS: Neither Barbara nor I are wearing our = homenet WG
chair hats in this discussion, but I think it's = fun that
we take different, reasonable, positions:-)
<0x5AB2FAF17B172BEA.asc= >--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add

= --Apple-Mail=_C80B84E4-2375-4D1E-82DB-7D8FB8C778C7-- From nobody Tue Aug 13 14:48:41 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B0C1F1208E7 for ; Tue, 13 Aug 2019 14:48:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DwEFgdErI96b for ; Tue, 13 Aug 2019 14:48:36 -0700 (PDT) Received: from mail-pf1-x430.google.com (mail-pf1-x430.google.com [IPv6:2607:f8b0:4864:20::430]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2ADBE1208F3 for ; Tue, 13 Aug 2019 14:48:36 -0700 (PDT) Received: by mail-pf1-x430.google.com with SMTP id 129so5435884pfa.4 for ; Tue, 13 Aug 2019 14:48:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=xmBo1UCEQpmMHlUCEdw7s+ZHzfOwgV4ztYkqwz79GTM=; b=Zc1bsZ5J7vIXwYq13fFRt8xA8iFp2q5Kl8ENXEFjBe4Pnh3EeRs6rlN+CT1VzUUkhM 6+UUSLuRuy1SyliDbwBugpFL16A+vg2aJkZ5lt1WR+m7TCSfQnV6YO/gY4ZiBWiW+dFH RHvn9IKDqJbTBs11H3unHHArYcaQJQUNz1fC+M0zOikQI2jR+DIk+V/9tyBvyabsE5NI MPypkXmSENj8LVdaYB/b+lzFo/I50s6sxYlkLMZXufFo307yFaXugBdNNhW62JKXkTn0 8gIn3j7xh8jjg3Vjatz2/VIoorC5ajXaEw0E4SYCollOCa2uo70FO8pD9SSf+iRrQOD+ DVGA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=xmBo1UCEQpmMHlUCEdw7s+ZHzfOwgV4ztYkqwz79GTM=; b=BdjlvU7SP9Hk/gfD8zpxqCmX8wFoJyT57VunyVIEW63M5twEdlu1LrHNnz+ja/UHOb Rnenp12NC95iUjEjVAKnsJtjnEQtSWclicXYYm4NV99J3quE0nUwMezWoMU0XltwZB1g IWwQqaf7YLD+6kZnw1uWMufIgJNWAqMsUy6XZzN133VQ51FiQn7cbQnY2f0KjKkictpn zLV4sgUmh3Rryj3mBgHAPMGENq+PqXG0t2IC2c3Gf0rC2J3rBMNJcyZu4myR1GgT6zpG pIAPjgR/UV/wJyal+5ciabJ+lXv4l+PuFzOaSwdzwxI1hRMHIciTLCQcjgMNCjI1PSqZ cMkw== X-Gm-Message-State: APjAAAVqQ780BVBuWio6jASDA1T4uC2XXdMqXNiMbyOJ7ywgrR5UzDhM VYrRkqTbrxsqY+EyFN3iQApJ5A== X-Google-Smtp-Source: APXvYqzJ9YAP0eo23JtT2yyEpMaWlsYNR4PsRRYqRLv/VoI4N3IYoQqbC1vVlP8fdNabCaVPEuDGkg== X-Received: by 2002:a63:fc52:: with SMTP id r18mr36153118pgk.378.1565732915647; Tue, 13 Aug 2019 14:48:35 -0700 (PDT) Received: from [17.192.139.70] ([17.192.139.70]) by smtp.gmail.com with ESMTPSA id g2sm129808284pfi.26.2019.08.13.14.48.34 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 13 Aug 2019 14:48:35 -0700 (PDT) From: Ted Lemon Message-Id: <9E14586A-5F38-4B45-AC28-E4C231DA3941@fugue.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_57B02567-DFEF-445A-8CD6-F52268044F64" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Tue, 13 Aug 2019 14:48:33 -0700 In-Reply-To: <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> Cc: Stephen Farrell , ADD Mailing list , "STARK, BARBARA H" , Rob Sayre To: Bret Jordan References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 13 Aug 2019 21:48:39 -0000 --Apple-Mail=_57B02567-DFEF-445A-8CD6-F52268044F64 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii On Aug 13, 2019, at 2:46 PM, Bret Jordan wrote: > My question is at what stage, level, organization type, or = organization size, does a network administrator care, or are forced to = care by regulators? Is that a rhetorical question, or do you genuinely not know? --Apple-Mail=_57B02567-DFEF-445A-8CD6-F52268044F64 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii On = Aug 13, 2019, at 2:46 PM, Bret Jordan <jordan.ietf@gmail.com> wrote:
My question is at what stage, level, organization type, or = organization size,  does a network administrator care, or are = forced to care by regulators?

Is that a rhetorical question, or do you = genuinely not know?

= --Apple-Mail=_57B02567-DFEF-445A-8CD6-F52268044F64-- From nobody Tue Aug 13 15:31:47 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 692651208E6 for ; Tue, 13 Aug 2019 15:31:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0zoiwKDi5K6h for ; Tue, 13 Aug 2019 15:31:43 -0700 (PDT) Received: from mail-ot1-x331.google.com (mail-ot1-x331.google.com [IPv6:2607:f8b0:4864:20::331]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9541E120917 for ; Tue, 13 Aug 2019 15:31:43 -0700 (PDT) Received: by mail-ot1-x331.google.com with SMTP id z17so59407966otk.13 for ; Tue, 13 Aug 2019 15:31:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=FrGoxTMoSFxo2Wd+eXLXx77ME/1pfGd0Je3ByBOcpuA=; b=pN3AB8lwruijp1nIX/y1CB06ZGb8bZua5ou3lMv0g4oq/fuPQ+c0/hpyK68KR5GYna hadwfIPTKySiIeqdz2qDNBmGo45TKf8IkwKT/4Z9SsCcF+bYcM5MQnnAUvS5oR/XIJK8 H3epsDVIkyl/RzmasDcKwsCy3ydedyxPaYEop6ipanCGSSoI4FpHZmNGEiUgs6tutqyT bwjA1N0itcG+JqwvQvU99Z/qdEx6Vt9bMezVjgRlFs/b9b2uApnssSUx0HKi/IQhAvWf sas8SGYxZE/d+Lt+YO8PpLayM+PxKooR+5x0LnpQxtTaWkYshZ9xBX9XN/dwk0FuWclE iMVQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=FrGoxTMoSFxo2Wd+eXLXx77ME/1pfGd0Je3ByBOcpuA=; b=cBq8fD1ubrOQJLPfeO0uFG6VIJMSEyUduX2XJgOraFf/r5Nfi08udaL6ttczRh343J /NrLEWyN9efmtxqIsxGSZyWmk04u7nFPZFEynwL0JsRiBaSbBR50wNk7+ncRvraB9nI2 haBFniR7OtJY+IYOWqeSbh9gW71aaotB2L5HDsh02EjEDs3Nihrzhk8mxPCH8zDrdMzM 2WsGJdYN79Xb2wR0ztTvN/SeuctG94vz2ABgknSH3PvaS0QAcr/zYHt0YlWTWHug/q4k v0B06CvCK9GPrugIOknPDoUVeTDpJpcr76EwEuLvc+lp4fBvBLuy+emxPq2JdmTKeor1 grMA== X-Gm-Message-State: APjAAAXINY1WtiI0Jwwhg9xgNZqAOcjr2H9mlpUKh+Fi9acBed57kyda 8W3o9V1yKRdYKFHVTL0feM1p3XCRZCQymfRwV0Q= X-Google-Smtp-Source: APXvYqy798vEsKUPJvszmY6Ut77kkseRh/+ieHzx49MOzY3loNkEu7u40czOlYK5KQXzpqGOpttIdbSkU1SLCwaPzJg= X-Received: by 2002:a5e:d618:: with SMTP id w24mr20107686iom.73.1565735502777; Tue, 13 Aug 2019 15:31:42 -0700 (PDT) MIME-Version: 1.0 References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <9E14586A-5F38-4B45-AC28-E4C231DA3941@fugue.com> In-Reply-To: <9E14586A-5F38-4B45-AC28-E4C231DA3941@fugue.com> From: Rob Sayre Date: Tue, 13 Aug 2019 15:31:31 -0700 Message-ID: To: Ted Lemon Cc: Bret Jordan , Stephen Farrell , ADD Mailing list , "STARK, BARBARA H" Content-Type: multipart/alternative; boundary="0000000000007492f705900734de" Archived-At: Subject: Re: [Add] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 13 Aug 2019 22:31:46 -0000 --0000000000007492f705900734de Content-Type: text/plain; charset="UTF-8" On Tue, Aug 13, 2019 at 2:48 PM Ted Lemon wrote: > On Aug 13, 2019, at 2:46 PM, Bret Jordan wrote: > > My question is at what stage, level, organization type, or organization > size, does a network administrator care, or are forced to care by > regulators? > > > Is that a rhetorical question, or do you genuinely not know? > Rhetorical or not, regulators can just go to the endpoints if need be. For example: Last week, I sent an example of an attack that would not work over DoT/DoH: It looks to me like that attack would be hard to mitigate if there were a requirement that a certain resolver *must* be consulted, or if there were some in-the-clear mechanism to disable encrypted DNS. thanks, Rob --0000000000007492f705900734de Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Tue, Aug 13, 2019 at 2:48 PM Ted Lemon= <mellon@fugue.com> wrote:
On Aug 13, 2019, at 2:= 46 PM, Bret Jordan <jordan.ietf@gmail.com> wrote:
<= div>My question is at what = stage, level, organization type, or organization size, =C2=A0does a network= administrator care, or are forced to care by regulators?

Is that a rhetorical question, or do you genuinely not kn= ow?

Rhetorical or not, regulato= rs can just go to the endpoints if need be. For example:


Last week, I sent a= n example of an attack that would not work over DoT/DoH:


It looks to me like that atta= ck would be hard to mitigate if there were a requirement that a certain res= olver *must* be consulted, or if there were some in-the-clear mechanism to = disable encrypted DNS.

thanks,
Rob
=

--0000000000007492f705900734de-- From nobody Tue Aug 13 17:00:01 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 08FE81200B2 for ; Tue, 13 Aug 2019 16:59:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.965 X-Spam-Level: X-Spam-Status: No, score=-0.965 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_SBL_CSS=3.335, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 01HxtGnFXMr1 for ; Tue, 13 Aug 2019 16:59:57 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BE3E012001A for ; Tue, 13 Aug 2019 16:59:56 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 486E6BE5D; Wed, 14 Aug 2019 00:59:53 +0100 (IST) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id I1aQ3aub76qP; Wed, 14 Aug 2019 00:59:51 +0100 (IST) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 27F80BE5B; Wed, 14 Aug 2019 00:59:51 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1565740791; bh=Kc7I8gM6JiE0GhD9uQ7L/VaLRcu+CX3ktvUdQnWuYW4=; h=To:Cc:References:From:Subject:Date:In-Reply-To:From; b=d0CRoJRYyxXgPXjLGm1ffMvuiqmQSSF6wQ6FtKxUNxvDoCaYRESTvmMhdAdS+fTY7 iR7BtPTnMMdyOhUwteHiEkWSAmEMOkGNeOQ8BdG66Tt55kXwxHrXK+Ir2pBfnoaMaY 5BNKO54kjEoULmo0REDmRjym4ZT4Jefp1q9OwXVs= To: Bret Jordan Cc: ADD Mailing list References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> Date: Wed, 14 Aug 2019 00:59:49 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="g9y9rXoNPobXA6qiGGPm67n3bRBLuLIRq" Archived-At: Subject: Re: [Add] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 13 Aug 2019 23:59:59 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --g9y9rXoNPobXA6qiGGPm67n3bRBLuLIRq Content-Type: multipart/mixed; boundary="gnVUqapQHdikc4zv7cpVEgR8rB6wFkpZw"; protected-headers="v1" From: Stephen Farrell To: Bret Jordan Cc: ADD Mailing list Message-ID: <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> Subject: Re: [Add] Validity of network administrator role References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> In-Reply-To: <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> --gnVUqapQHdikc4zv7cpVEgR8rB6wFkpZw Content-Type: multipart/mixed; boundary="------------970CDD9914EE53681A8503A6" Content-Language: en-GB This is a multi-part message in MIME format. --------------970CDD9914EE53681A8503A6 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hi Bret, On 13/08/2019 22:46, Bret Jordan wrote: > My question is at what stage, level, organization type, > or organization size, does a network administrator care, > or are forced to care by regulators? It seems pretty clear to me that you have more than one question related to ADD. Claiming otherwise is odd, or perhaps just careless? ("My question" is a clear assertion that only one question exists, for you.) I also do not see the relevance of this particular question to the mail of mine to which you are responding. Again that could be down to carelessness, or perhaps is due to some other reason? I find it hard to envisage that you really think comreg (the relevant Irish regulator) ought tell me what I think about DoH use in my home network. Or perhaps you somehow consider that there may exist some metric of network complexity that could differentiate between networks where regulation is relevant and where not? As an argument, that'd seem fairly risible to me TBH. So I'm left to conclude that your mail is in the end an example of a pretty careless argument. I do not think such careless arguments are useful in what is a controversial and complex space such as this. In fact, I think such are counterproductive. And FWIW, I personally tend to more disregard the opinions of people the more they make such apparently careless arguments. I hope that others feel similarly, and that that imposes a pressure on people to be more careful in how and what they argue. But maybe I'm wrong in the above. I'd be happy if that were the case. Cheers, S. >=20 >=20 > Thanks, Bret PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 > ACAE 7415 0050 "Without cryptography vihv vivc ce xhrnrw, however, > the only thing that can not be unscrambled is an egg." >=20 >> On Aug 13, 2019, at 11:38 AM, Stephen Farrell >> wrote: >>=20 >>=20 >> Hiya, >>=20 >> On 09/08/2019 13:25, STARK, BARBARA H wrote: >>> Applications and cloud services that try to take away from me >>> the ability to control what goes on inside my personal home >>> network will be added to my "do not trust" list. >> I also like to manage my home n/w according to my own wishes. My >> wishes include not eavesdropping on guest or home user's traffic, >> except with their agreement, e.g. if someone's device isn't >> working. (Just in case someone goes there: when some of the home >> n/w users were too young to agree, we used manage their access to >> connected devices, not their n/w traffic, e.g. by insisting they be >> in the same room as an adult, and one of the people who most >> enforced that policy is decidedly non-technical.) >>=20 >> For me, that means if a guest or other n/w user has chosen an >> application that wants to do DoH with some other recursive that's >> ok by me. I'd consider myself inhospitable were I to want to >> control the DNS choices of people in my home. In a similar vein, I >> do not insist that people using my home n/w use any particular OS, >> even though I have strong opinions on the relative goodness of >> those. >>=20 >> So the important point here is "my network, my rules" does *not* >> imply "DoH is problematic." >>=20 >> I think that also means that considering the n/w admin as a valid >> role similarly does not imply that one has a problem with DoH. >>=20 >> And lastly, liking DoH does not imply disparaging n/w=20 >> administration. >>=20 >> There are of course a bunch of specific policies that some n/w >> admins do like for which DoH is problematic as has been described >> already on this list. But we ought not over-claim e.g. by asserting >> that liking DoH implies disliking n/w administration. >>=20 >> Cheers, S. >>=20 >> PS: Neither Barbara nor I are wearing our homenet WG chair hats in >> this discussion, but I think it's fun that we take different, >> reasonable, positions:-) <0x5AB2FAF17B172BEA.asc>-- Add mailing >> list Add@ietf.org https://www.ietf.org/mailman/listinfo/add >=20 >=20 --------------970CDD9914EE53681A8503A6 Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------970CDD9914EE53681A8503A6-- --gnVUqapQHdikc4zv7cpVEgR8rB6wFkpZw-- --g9y9rXoNPobXA6qiGGPm67n3bRBLuLIRq Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAl1TTvYACgkQWrL68XsX K+p6Rg//WhvuuYsAH+HJbqhxYpFKRPMkeFoXwmy41o23l19wfpEFFd96Ohsh9IoP LVtUjY82ib6+fQ8W4QyeNLjh0C0sRUZw701Ftz/UzqL5BGxfBwqC1/MwcCuzIHTX v4V8D6ElRecZ/YlhmN2864cAxRK6FwO9R8H/kKPqAbBKvhq0Z8UelnzzoAaTEY/T 4WDSBgrezy7ZYTxR/vMkd2FGlHZAk78nTSD0ce5CHzW8ERg1dTIqUaKMESqh7hrS d54uW0oVhM5xrPxoGiul1dnpzQmFCRVZQJJslQjlXxiDklZaGq+oYsroRBvtelpd lwn5HDewTy0JAtwPJ9d+V1OSIJndoaImWWJ02qec4cKPbBMWBI1ldJyxV4LQCh2+ kKLz98ZP3udiiRDKElfITBw7rWOukw9g3UnmEYszLdwgOl20wgEdJbGFDXPth4Ir d++Ph+oQF6FGxjATdvKferLR9087Eqgs6in1vpx3GW2maALiM0rT/WNpJnpmJpA6 PsG7C7MrWhlBHLSVfhZDaPQNKxtGmnH/zRVY+GHBKIaPnLE6GQPvaj+3NK4dAPgp NQfJbSSXNyUJZV1V4FK0H5gTETgdmJJBsnbUQRl+3pOlnaPfp7z23Dff36OQjdSs eTBqyDQJWRzy78AC38WeuTOdwkTRQ08scy/p0jqu6EyxXvqg91k= =ev2Z -----END PGP SIGNATURE----- --g9y9rXoNPobXA6qiGGPm67n3bRBLuLIRq-- From nobody Tue Aug 13 18:54:26 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BBB8B12001B for ; Tue, 13 Aug 2019 18:54:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dtGpFf7CqT1Q for ; Tue, 13 Aug 2019 18:54:22 -0700 (PDT) Received: from mail-qt1-x842.google.com (mail-qt1-x842.google.com [IPv6:2607:f8b0:4864:20::842]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6848C120018 for ; Tue, 13 Aug 2019 18:54:22 -0700 (PDT) Received: by mail-qt1-x842.google.com with SMTP id i4so68018qtj.8 for ; Tue, 13 Aug 2019 18:54:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=+D8moY3QVD14wgiX8FPNHjk7oE8g4wW5LZu74UKeAOI=; b=Tm6dO4GZvtmHtXgBLiSvc/K1KySA0FUwbZKD1VQ9eKDj6vtks6+BMd6bCYWvxDBPvU XCHgKpGs9YoF94IEzbuUftSlgAyk6TTqXSUu5iJuhyoSb+ZKkZ6M8obh0JmvwBDgdI6K QHqhnSrBbg97RGMRMzACJS8ea9B0FRuB8/7fm+iCM7FPtSd+mlOY1sg0+wzkofXgPzRj Fpso1wbXPpD6zumLdeciGaBcUw+Wn54LP46doiC10u8DF1KPdKwb+X0QtWHRospf8Vzd s05iZl2vZuhRBqzkwbmEYQaAAHOOQorgp5an990nLxPCrD7Zm/fS+h4ZpAaFeQNMilh8 gOEQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=+D8moY3QVD14wgiX8FPNHjk7oE8g4wW5LZu74UKeAOI=; b=leAQ7SEcZV3DY5xzCQP1nml964QWTcU0pb1j9b9YAZAm9rgF4KC0MG+YLIZSryaKcv M5XInTtH7GLLFKBWlzwy9pJ+yvqAHUSQ0uyAmfb6g0OTlgsMsI3S+TGoz4ThvVDvnfob NJptRDIeW0WB6NfoI/mpBhPXPqQLhr3ATNLbAjZ1mbpneEsE/Ohw8/dvjP+eXHsrIYqG ZGVVShmrwFtpCkpQhPXwfarnpEG8JfRNizTbBq7xOsSLYTa+bLiOiKWwkhDjpVFbPOFj b/zNTXtVsIGMbgm3HLXPc/9nXzExOJZWn6Pz/JxSswtJUzh900ylxBAp8Q1ZQ1QIFWy9 P0UA== X-Gm-Message-State: APjAAAWg+S7m+Y/LAkYKbjRKtbTW1OaodgJsK0HgLp2/MANC6GtxwOKS cMZL0BAXzkvywHun2it2i9rnvX7M X-Google-Smtp-Source: APXvYqwAkn+9himcyb10XAGF/pUzg1a1ABk4DrXrRe/yj/QfSnD1Kz9CnRPrF2DS2lx13dNY5+tikQ== X-Received: by 2002:ac8:41ce:: with SMTP id o14mr34483615qtm.92.1565747661076; Tue, 13 Aug 2019 18:54:21 -0700 (PDT) Received: from [192.168.2.18] (cpe-76-179-66-50.maine.res.rr.com. [76.179.66.50]) by smtp.gmail.com with ESMTPSA id m10sm46972157qka.43.2019.08.13.18.54.19 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 13 Aug 2019 18:54:20 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (1.0) From: Brian Dickson X-Mailer: iPhone Mail (16G77) In-Reply-To: <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> Date: Tue, 13 Aug 2019 21:54:18 -0400 Cc: Bret Jordan , ADD Mailing list Content-Transfer-Encoding: quoted-printable Message-Id: <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> To: Stephen Farrell Archived-At: Subject: Re: [Add] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 14 Aug 2019 01:54:25 -0000 Sent from my iPhone > On Aug 13, 2019, at 7:59 PM, Stephen Farrell w= rote: >=20 >=20 > Hi Bret, >=20 >> On 13/08/2019 22:46, Bret Jordan wrote: >> My question is at what stage, level, organization type, >> or organization size, does a network administrator care, >> or are forced to care by regulators? >=20 > It seems pretty clear to me that you have more than > one question related to ADD. Claiming otherwise is > odd, or perhaps just careless? ("My question" is a > clear assertion that only one question exists, for > you.) I disagree, as I read it as a single question where it is worded so as to en= sure the question is applicable regardless of size and scope of network, all= owing anyone to answer and provide any relevant provisos concerning their re= spective answer. I=E2=80=99ll try to reword it to make a bit more clear, and show that is in f= act directly related to your email. Reworded question (with preamble): The Internet is a network of networks, where a given host could be seen as =E2= =80=9Cinside=E2=80=9D of multiple networks depending only on scope. E.g. a host attached to a WiFi access point which is connected to your home n= etwork, is clearly on the WiFi network, but may or may not be considered =E2= =80=9Cpart of=E2=80=9D your home network. The same logic is applicable to de= vices directly connected to your home network, from the perspective of your i= mmediate upstream ISP. Your ISP could have an upstream ISP. And the original= host we were talking about could be doing =E2=80=9Cinternet sharing=E2=80=9D= using any arbitrary network protocol, anything from Bluetooth to serial to E= thernet to satellite. Each of the aforementioned networks has a nominal network administrator, whe= ther that person takes an active role or not. Each has different scope.=20 The question regarding regulators is, is whether the regulations on who is a= ccountable and responsible for adherence to regulations and possibly enforce= ment of regulations make it clear as to whether the operator of a home netwo= rk is obligated to enforce the DNS enforcement mechanism and use the mandate= d list of blocked names, and thusly required by law to prevent bypassing tho= se mechanisms, i.e. to block DoH? At least, that=E2=80=99s my interpretation of Brad=E2=80=99s question. Even if it isn=E2=80=99t an accurate interpretation, I think I=E2=80=99d be i= nterested in your opinion on the question, and if you are okay with the ques= tion, I=E2=80=99d be interested in your answer. Related hair-splitting questions: is it always the case (at least in Ireland= ) that SOMEONE is obligated by the regulators? Do the regulations spell out w= ho is, and whether it is the least specific scoped operator (highest level I= SP), or the most specific scoped operator (home network operator), or does e= veryone have to independently enforce the regulations? I.e. Does how the home network attach to the Internet fundamentally change t= he answer? Brian >=20 > I also do not see the relevance of this particular > question to the mail of mine to which you are > responding. Again that could be down to carelessness, > or perhaps is due to some other reason? I find it > hard to envisage that you really think comreg (the > relevant Irish regulator) ought tell me what I think > about DoH use in my home network. Or perhaps you > somehow consider that there may exist some metric > of network complexity that could differentiate > between networks where regulation is relevant and > where not? As an argument, that'd seem fairly > risible to me TBH. >=20 > So I'm left to conclude that your mail is in the > end an example of a pretty careless argument. >=20 > I do not think such careless arguments are useful in > what is a controversial and complex space such as this. > In fact, I think such are counterproductive. And FWIW, > I personally tend to more disregard the opinions of > people the more they make such apparently careless > arguments. I hope that others feel similarly, and that > that imposes a pressure on people to be more careful in > how and what they argue. >=20 > But maybe I'm wrong in the above. I'd be happy if that > were the case. >=20 > Cheers, > S. >=20 >=20 >>=20 >>=20 >> Thanks, Bret PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 >> ACAE 7415 0050 "Without cryptography vihv vivc ce xhrnrw, however, >> the only thing that can not be unscrambled is an egg." >>=20 >>> On Aug 13, 2019, at 11:38 AM, Stephen Farrell >>> wrote: >>>=20 >>>=20 >>> Hiya, >>>=20 >>>> On 09/08/2019 13:25, STARK, BARBARA H wrote: >>>> Applications and cloud services that try to take away from me >>>> the ability to control what goes on inside my personal home >>>> network will be added to my "do not trust" list. >>> I also like to manage my home n/w according to my own wishes. My >>> wishes include not eavesdropping on guest or home user's traffic, >>> except with their agreement, e.g. if someone's device isn't >>> working. (Just in case someone goes there: when some of the home >>> n/w users were too young to agree, we used manage their access to >>> connected devices, not their n/w traffic, e.g. by insisting they be >>> in the same room as an adult, and one of the people who most >>> enforced that policy is decidedly non-technical.) >>>=20 >>> For me, that means if a guest or other n/w user has chosen an >>> application that wants to do DoH with some other recursive that's >>> ok by me. I'd consider myself inhospitable were I to want to >>> control the DNS choices of people in my home. In a similar vein, I >>> do not insist that people using my home n/w use any particular OS, >>> even though I have strong opinions on the relative goodness of >>> those. >>>=20 >>> So the important point here is "my network, my rules" does *not* >>> imply "DoH is problematic." >>>=20 >>> I think that also means that considering the n/w admin as a valid >>> role similarly does not imply that one has a problem with DoH. >>>=20 >>> And lastly, liking DoH does not imply disparaging n/w=20 >>> administration. >>>=20 >>> There are of course a bunch of specific policies that some n/w >>> admins do like for which DoH is problematic as has been described >>> already on this list. But we ought not over-claim e.g. by asserting >>> that liking DoH implies disliking n/w administration. >>>=20 >>> Cheers, S. >>>=20 >>> PS: Neither Barbara nor I are wearing our homenet WG chair hats in >>> this discussion, but I think it's fun that we take different, >>> reasonable, positions:-) <0x5AB2FAF17B172BEA.asc>-- Add mailing >>> list Add@ietf.org https://www.ietf.org/mailman/listinfo/add >>=20 >>=20 > <0x5AB2FAF17B172BEA.asc> > --=20 > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add From nobody Tue Aug 13 19:36:33 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 692E9120025 for ; Tue, 13 Aug 2019 19:36:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5lSqTT4kbavf for ; Tue, 13 Aug 2019 19:36:29 -0700 (PDT) Received: from mail-ot1-x32f.google.com (mail-ot1-x32f.google.com [IPv6:2607:f8b0:4864:20::32f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B8C58120020 for ; Tue, 13 Aug 2019 19:36:29 -0700 (PDT) Received: by mail-ot1-x32f.google.com with SMTP id k18so46808622otr.3 for ; Tue, 13 Aug 2019 19:36:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=3yPrReCm903JywRlJrk56/db/VdD08ddaoC8klYhtRo=; b=mP5+uTO8/mrTVU1moOuwsLEHUbVTKen89Ix7iGpwvRSddJQ2CsQbpHiyZg84gy/GsL kotrLUlwITZ4KQVpU3VaPQ4SSi6yHRB4Lq/moV/7zSeRXzrBY8fSygZ1YOjSXekxoo6Z EPHulLgVGhwWWYDnA6a3kRuLP6eVIPGdmzylYEhM+UcKF6V6YxNCfU0NeY3PzviEFArx 97iXCID8zfASjYz9DbjfDYLoUT99/Mq38uSuG3Xnt3RRw08tT6SW7CRYsa4P8QLM8+tI cHpx9FZRMga/R/S6zKb/4Z0NsFeZBa3T8z+t2Ub+yW9X+qTu1uenOFBCU+m4orT8IIw6 awVA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=3yPrReCm903JywRlJrk56/db/VdD08ddaoC8klYhtRo=; b=EuJv8cZdgNJ54N3GM1rEG6U0uL+SXIkdzjS8jWC8q+IzOWlOJwqz6w2lTHHiUJ3bkX Vy/zPFD9v8tFOkk5NKAJpCxwnjOYbxquofMcS1OkOoa8uWNN4iWHJ65BXzMlpiBuOK4O Mw9Pk2qkGUbKn+TEqjtVf+Tw621x2rpxYX0WxoTZ6VLzHgSeuR+KCZjtKJSYnSIlTOSs ofGJrhH/EhI6ZQHVWQ4MQWXO/RofaAgcvBh6L2hNCxZnQfMBH8vL2+QSjChXNsG/J2zc L65rysvmziOb3nCMrnH0U1LtLWRlO+JjHHM1//AzxU9+tmKFzf3GaeaQCFTcjOMg591d gicA== X-Gm-Message-State: APjAAAXXQn3jZIgKv3GNOwk73pPsjDWQd+a+1cvqCd8DKzhbUhy9CUwn VuUtm82mlvV4fhQviOEpdpSzQmzElBA4OpDEcHY= X-Google-Smtp-Source: APXvYqybKVola5p4awaA4jmVB14EMuQn7MhJEvQBvdyCic7lUJObYr9p1VOmvTAJuF/6UnCBJj94tizeuZcWB1Cs8CY= X-Received: by 2002:a05:6602:98:: with SMTP id h24mr43568081iob.49.1565750188911; Tue, 13 Aug 2019 19:36:28 -0700 (PDT) MIME-Version: 1.0 References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> In-Reply-To: <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> From: Rob Sayre Date: Tue, 13 Aug 2019 19:36:17 -0700 Message-ID: To: Brian Dickson Cc: Stephen Farrell , ADD Mailing list , Bret Jordan Content-Type: multipart/alternative; boundary="000000000000d1323d05900a9fb8" Archived-At: Subject: Re: [Add] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 14 Aug 2019 02:36:31 -0000 --000000000000d1323d05900a9fb8 Content-Type: text/plain; charset="UTF-8" On Tue, Aug 13, 2019 at 6:54 PM Brian Dickson wrote: > > The question regarding regulators is, ... > It seems like it would be difficult to formulate this question if one were not a regulator. Even if one were a regulator, the IETF's protocols span several jurisdictions. What is the IETF supposed to do with this message? thanks, Rob --000000000000d1323d05900a9fb8 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Tue, Aug 13, 2019 at 6:54 PM Brian Dic= kson <brian.peter.dicks= on@gmail.com> wrote:

The question regarding regulators is, ...

It seems like it would be difficult to formulate this question if one we= re not a regulator. Even if one were a regulator, the IETF's protocols = span several jurisdictions.

What is the IETF suppo= sed to do with this message?

thanks,
Rob= =C2=A0=C2=A0
--000000000000d1323d05900a9fb8-- From nobody Wed Aug 14 02:36:49 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4DA311200C5 for ; Wed, 14 Aug 2019 02:36:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TRgIVTcTSAl9 for ; Wed, 14 Aug 2019 02:36:45 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F199C1200BA for ; Wed, 14 Aug 2019 02:36:44 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 66E71BE5D; Wed, 14 Aug 2019 10:36:42 +0100 (IST) Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TrHX71Jmjz1w; Wed, 14 Aug 2019 10:36:42 +0100 (IST) Received: from [134.226.36.93] (unknown [134.226.36.93]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 18687BE5B; Wed, 14 Aug 2019 10:36:42 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1565775402; bh=R5qY3tULAbT+e1LlbS8Eb1zJsYem4py5TEzYyJq4Nag=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From; b=vrbR8WzfOK554m/bSS9rM9/iiZzi77brDGKZaZuZsFepaVC0wEEC7EGnv6kyFUmJF EHFvnD62+CCMkYe1WAMsUj0nH8o2oh6llujGd5hOsUEefa8mhWvXSqez5iyM+eAcnt yk9vnj3jRQy3crYjHbO7cHpDL0opMnDY5SFSBzmw= To: Brian Dickson Cc: Bret Jordan , ADD Mailing list References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> Date: Wed, 14 Aug 2019 10:36:36 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="Zlv1JuuPQc2ZY8y97PmUKBvWSVPl1z5SP" Archived-At: Subject: Re: [Add] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 14 Aug 2019 09:36:47 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --Zlv1JuuPQc2ZY8y97PmUKBvWSVPl1z5SP Content-Type: multipart/mixed; boundary="7tUwsRKrLba4YbkNtTHnCpOkQR272DVob"; protected-headers="v1" From: Stephen Farrell To: Brian Dickson Cc: Bret Jordan , ADD Mailing list Message-ID: <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> Subject: Re: [Add] Validity of network administrator role References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> In-Reply-To: <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> --7tUwsRKrLba4YbkNtTHnCpOkQR272DVob Content-Type: multipart/mixed; boundary="------------C439B6DAB6F99248025E20B8" Content-Language: en-GB This is a multi-part message in MIME format. --------------C439B6DAB6F99248025E20B8 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable This seems to me off-topic for this thread but whatever... On 14/08/2019 02:54, Brian Dickson wrote: > The question regarding regulators is, is whether the regulations on > who is accountable and responsible for adherence to regulations and > possibly enforcement of regulations make it clear as to whether the > operator of a home network is obligated to enforce the DNS > enforcement mechanism and use the mandated list of blocked names, and > thusly required by law to prevent bypassing those mechanisms, i.e. to > block DoH? No. >=20 > At least, that=E2=80=99s my interpretation of Brad=E2=80=99s question. >=20 > Even if it isn=E2=80=99t an accurate interpretation, I think I=E2=80=99= d be > interested in your opinion on the question, and if you are okay with > the question, I=E2=80=99d be interested in your answer. >=20 > Related hair-splitting questions: is it always the case (at least in > Ireland) that SOMEONE is obligated by the regulators? Do the > regulations spell out who is, and whether it is the least specific > scoped operator (highest level ISP), or the most specific scoped > operator (home network operator), or does everyone have to > independently enforce the regulations? I have no idea as IANAL:-) If someone were to claim that my home n/w needs to adhere to the same regulations as a commercial ISP or mobile n/w operator, then I would be surprised and would disagree with them. I am nonetheless happy with my policies for my n/w. I would say Barbara is equally happy with her policies for her n/w and that we're both entitled to do as we do. The point of my mail was to provide a counterexample showing that one n/w admin's policy finding DoH problematic is not sufficient reason to claim that DoH is problematic for all n/w admins, nor that the existence of DoH somehow calls into question the role of a n/w admin. Neither claim stands up, and repeating such invalid claims does not make then valid. S. --------------C439B6DAB6F99248025E20B8 Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------C439B6DAB6F99248025E20B8-- --7tUwsRKrLba4YbkNtTHnCpOkQR272DVob-- --Zlv1JuuPQc2ZY8y97PmUKBvWSVPl1z5SP Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAl1T1iUACgkQWrL68XsX K+pQdRAAiOjj/LYahktG/2vDjeTy3BDrJsKrkZzfPRr9dLc/LH7JYlF0i5mi7BlW C0Uefj3ePwdZ0CnroGT3Nb7jWtHxVyJfov/0P92SKeMLdvunMPm8ZUXUGbwV9B7k ONGzvlFiZ4u67uvsX+ZlkoYITTh+aoRWErmZGQgdiS9SNbVjxYu7qqT6yBvouxpu Ho9EhJhin0ZVfm05J/EG7mjakjBfl+AOmiRLuvaOcYdFRJcJbDhRpJqEBh750pUu o0hBEBr7y4Ir3lHrOh1VlkxKUD5b7EdKwJUYzG6dgGl6NwdX4KeByWGdCqISCPNE NyMWwcm3TJn5K3beQUmOzZEy55KF9MnApS3PFTDfCSEvbJdmRME3OI474mtQ16lh sr0UtLtLJioBYR1MFjSzDkgRX5fL4HwKMNq2eaD0IysYZ9l5KIxB2/0tfzIN8InG Aqsl+C7oYQAlMT+cPJKN2RW373RjkPWg2x/hoBn5CJWlqctm0LHDHJe76/tHgcYh qshPyKmGlyX7ZtD98ijQ333ZEEwRkGgXH9NaLDsuMyw3xpuLjqXrfsjGo6OaT1ei OZmDOiFiwjJx8EK2+ja95jiB8hDogYHvUAdB7b7MilQVZZOkQngIQynTmtzVQIUi hJYDINVZCZoX7/MUC1px6Mx5beAcFDmiBkjQH0T+7Fjv88wA+5g= =CCsH -----END PGP SIGNATURE----- --Zlv1JuuPQc2ZY8y97PmUKBvWSVPl1z5SP-- From nobody Wed Aug 14 02:47:50 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7CC7A1200CC for ; Wed, 14 Aug 2019 02:47:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.298 X-Spam-Level: X-Spam-Status: No, score=-4.298 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=open-xchange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LwsIjdUBXorJ for ; Wed, 14 Aug 2019 02:47:45 -0700 (PDT) Received: from mx4.open-xchange.com (alcatraz.open-xchange.com [87.191.39.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 631791200BA for ; Wed, 14 Aug 2019 02:47:45 -0700 (PDT) Received: from open-xchange.com (imap.open-xchange.com [10.20.30.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx4.open-xchange.com (Postfix) with ESMTPS id C0A3D6A298; Wed, 14 Aug 2019 11:47:39 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=open-xchange.com; s=201705; t=1565776059; bh=d/5EIeYQdVuKiQMXQ2I9IxQlJjxLdnQ6cuiNM76LP4M=; h=From:Subject:Date:In-Reply-To:Cc:To:References:From; b=40MfZaHOSGKPG1WrmQ819G4DxrvRYzQ1EnItF97J4AX0tT/A4oZy2zA+Gpnr4n0pp y43/RsAek+eEB1B31ZVdoqy3uLMv9BRRP5rGti1Pksqk54dt522q7wkzYiI7RyDpyR L9V1WIQn5x0XCfXqUS0oX+/cHdP74CKZl0ibbKcjdVboczrS6ohWRv5jP/tj14jCAB vZ6KQnoEOD3CkhqeDCZkCFYJ0pm3Rc4iZCykTvXv4KAikCiLQDEOuCeneCSk9rkc+v JrzB5zSMyOTKK+QShNULgGYHvDkcrHlPXI/HM2O1pl3r7shFieH9PNKXK4EROEctJa 1rVQg673ko00A== Received: from [192.168.1.128] (host31-53-106-255.range31-53.btcentralplus.com [31.53.106.255]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by open-xchange.com (Postfix) with ESMTPSA id 86CB83C04A7; Wed, 14 Aug 2019 11:47:39 +0200 (CEST) From: Neil Cook Message-Id: <9CCE5D98-E595-472C-A73C-5BC0040C0EC6@open-xchange.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_F291FC8D-7017-4B61-9E56-B1B32A0F5D7F" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Wed, 14 Aug 2019 10:47:35 +0100 In-Reply-To: <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> Cc: Brian Dickson , ADD Mailing list , Bret Jordan To: Stephen Farrell References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 14 Aug 2019 09:47:48 -0000 --Apple-Mail=_F291FC8D-7017-4B61-9E56-B1B32A0F5D7F Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 > On 14 Aug 2019, at 10:36, Stephen Farrell = wrote: >=20 > The point of my mail was to provide a counterexample > showing that one n/w admin's policy finding DoH problematic > is not sufficient reason to claim that DoH is problematic > for all n/w admins, nor that the existence of DoH somehow > calls into question the role of a n/w admin. Neither claim > stands up, and repeating such invalid claims does not > make then valid. >=20 Did someone say either of those things on this thread? I couldn=E2=80=99t = find such assertions, but I agree that the existence DoH in itself = isn=E2=80=99t the problem. Personally my problem is with = applications/devices that choose to use a different DNS against my = wishes as a network administrator, but that=E2=80=99s not the fault of = DoH, even if that does seem to have been a catalyst for that behaviour = in e.g. browsers. The Chromecast discussion is a good example of that, = i.e. it is using regular DNS on port 53. Neil > S. >=20 > <0x5AB2FAF17B172BEA.asc>--=20 > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add Neil Cook neil.cook@open-xchange.com = --------------------------------------------------------------------------= ----------- Open-Xchange AG, Rollnerstr. 14, 90408 Nuremberg, District Court = Nuremberg HRB 24738 Managing Board: Rafael Laguna de la Vera, Carsten Dirks, Michael = Knapstein, Stephan Martin=20 Chairman of the Board: Richard Seibt European Office:=20 Open-Xchange GmbH, Olper Huette 5f, D-57462 Olpe, Germany, District = Court Siegen, HRB 8718=20 Managing Director: Frank Hoberg US Office:=20 Open-Xchange. Inc., 530 Lytton Avenue, Palo Alto, CA 94301, USA=20 = --------------------------------------------------------------------------= ----------- --Apple-Mail=_F291FC8D-7017-4B61-9E56-B1B32A0F5D7F Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8

On 14 Aug 2019, at 10:36, Stephen Farrell <stephen.farrell@cs.tcd.ie> wrote:

The point of my mail was to = provide a counterexample
showing that one n/w admin's = policy finding DoH problematic
is not sufficient reason to = claim that DoH is problematic
for all n/w admins, nor that = the existence of DoH somehow
calls into question the role = of a n/w admin. Neither claim
stands up, and repeating = such invalid claims does not
make then valid.


Did someone say either of those things on this = thread? I couldn=E2=80=99t find such assertions, but I agree that the = existence DoH in itself isn=E2=80=99t the problem. Personally my problem = is with applications/devices that choose to use a different DNS against = my wishes as a network administrator, but that=E2=80=99s not the fault = of DoH, even if that does seem to have been a catalyst for that = behaviour in e.g. browsers. The Chromecast discussion is a good example = of that, i.e. it is using regular DNS on port 53.

Neil

S.

<0x5AB2FAF17B172BE= A.asc>--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add


Neil Cook
neil.cook@open-xchange.com

---------------------------------------------------------------= ----------------------
Open-Xchange AG, Rollnerstr. 14, = 90408 Nuremberg, District Court Nuremberg HRB 24738
Managing Board: Rafael Laguna de la Vera, Carsten Dirks, = Michael Knapstein, Stephan Martin 
Chairman of = the Board: Richard Seibt

European = Office: 
Open-Xchange GmbH, Olper Huette = 5f, D-57462 Olpe, Germany, District Court Siegen, HRB = 8718 
Managing Director: Frank Hoberg
US Office: 
Open-Xchange. Inc., 530 = Lytton Avenue, Palo Alto, CA 94301, USA 
---------------------------------------------------------------= ----------------------

= --Apple-Mail=_F291FC8D-7017-4B61-9E56-B1B32A0F5D7F-- From nobody Wed Aug 14 02:53:15 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A47511200CD for ; Wed, 14 Aug 2019 02:53:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=netorgft5189650.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tD_QJx0g2AQG for ; Wed, 14 Aug 2019 02:53:12 -0700 (PDT) Received: from GBR01-LO2-obe.outbound.protection.outlook.com (mail-eopbgr100071.outbound.protection.outlook.com [40.107.10.71]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 967451200BA for ; Wed, 14 Aug 2019 02:53:12 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=Nqk0E+8vLAHxUVBTNMoKVP5A/m2aUTejV9w4uLv1562AWz9Tg/TgyfVtx2tVsFtHDjISr+VQNsefnerMpReIu/12mETjXfRIfh7C2kjoMcyi7TayKjTAH3agqOTWQ3ypUxeYUMYbTeuaEvRXJ3E7GuOqcEmUkzx0LcpSr+qxCUIwWYamP7e7pJ+tM4NHGiOlJyW5bU35k6gYKQX1se+a9VKl+/QFSQjD39eycglx0/gonSwdOZydc/jP4mWG29LRall5tOXRno+J5tjVgRn4jKbgVuCLwpzEuBZdFeu+Bc52L78xRVFRAACSejw+rRDa+dgefsInVDB4ynOUjOXO2A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=QcfsmYjf4X7mjQ9qQ4y8OwRKCZttn7mIJiHlF3kj4zo=; b=EPLpB+LkjP3OkeF4Q8leQlILsFx94aWcoIiS9Rr8zAgNqfCwpJYYKrcMVMfGKRFuJZMs3j4DZNqzrhRpTqeBaYo6gZJjuErXMSBAATu0K6J9OWu0wD/3552xHnXdCvEG9suS7sr0RpmMvICIk9PaUJ5hFEU0Nl98acm0mQhTPgEiATT0t9kfbKhQxYO8JBbcvJyUno2Snzk+zIC20yUFpP3co/f+BhR00R8c+iAipAPmH797DUtBxFmeSGbjVGaLIoKu2OLZM04TDwdp3a0Tl4IhQ6HUXDJATsgTer/VK3stNWaY0JgV9KUIBu1nvn8pxODQdOAy3Zt0pLxCn9AGKQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=419.consulting; dmarc=pass action=none header.from=419.consulting; dkim=pass header.d=419.consulting; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=NETORGFT5189650.onmicrosoft.com; s=selector1-NETORGFT5189650-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=QcfsmYjf4X7mjQ9qQ4y8OwRKCZttn7mIJiHlF3kj4zo=; b=gJLXAd54FxHQsqEloy8Sb3whlFN4NcfCjxJFdw9ppi6AkRrXnO57R53tn8UbZHxkF3SgEZED3+e5/aPjKgCuNdjZ2ofmr/U+DT+wig1fO1oDPML9yN5nS3uc5WRyJ+9mDBk1mqFbACnNfzUrvTro40ux4ZaBmHEFScIgC6DCWws= Received: from LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM (20.176.138.146) by LO2P265MB0799.GBRP265.PROD.OUTLOOK.COM (10.166.102.146) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2157.15; Wed, 14 Aug 2019 09:53:07 +0000 Received: from LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM ([fe80::64e9:9b9e:59fc:26f]) by LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM ([fe80::64e9:9b9e:59fc:26f%5]) with mapi id 15.20.2157.022; Wed, 14 Aug 2019 09:53:07 +0000 From: Andrew Campling To: Stephen Farrell , Brian Dickson CC: Bret Jordan , ADD Mailing list Thread-Topic: [Add] Validity of network administrator role Thread-Index: AQHVUoPRLz/iVZf6iUylWsH10fE/vab6ZRlQ Date: Wed, 14 Aug 2019 09:53:06 +0000 Message-ID: References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> In-Reply-To: <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=andrew.campling@419.consulting; x-originating-ip: [2a00:23c4:a499:2e00:546a:c528:ad9:4f7d] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: fe537edf-5647-4389-7306-08d7209d3533 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(7021145)(8989299)(4534185)(7022145)(4603075)(4627221)(201702281549075)(8990200)(7048125)(7024125)(7027125)(7023125)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:LO2P265MB0799; x-ms-traffictypediagnostic: LO2P265MB0799: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-forefront-prvs: 01294F875B x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(366004)(39830400003)(396003)(346002)(376002)(136003)(199004)(189003)(2906002)(81166006)(81156014)(64756008)(44832011)(66476007)(66556008)(5660300002)(66446008)(11346002)(446003)(46003)(33656002)(8936002)(66946007)(76116006)(486006)(55016002)(305945005)(7736002)(74316002)(6116002)(476003)(25786009)(256004)(71200400001)(316002)(110136005)(229853002)(7696005)(4326008)(54906003)(186003)(6436002)(71190400001)(508600001)(9686003)(53936002)(52536014)(99286004)(8676002)(6246003)(6506007)(102836004)(53546011)(86362001)(76176011)(14454004)(46492003); DIR:OUT; SFP:1101; SCL:1; SRVR:LO2P265MB0799; H:LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: 419.consulting does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: le8amYRJzhIn9+LvkgqrAcynbACWDKox8i0cKC4QZvPQaWXVGr1OwLmznHOC2U+nGrxrppvWGwwxLrY16J7AICKvUfH2fNZggZBoGA/2Vmrml6J65Uvg/3Bo1HdcvBZreMsUCpRU+aybNiOxvxK54UfM8B4V18G76shL6F4/zww0RGoiFCrAjKxNHJNE5dbVGu/IcXHjaVuxbthGGFxYqOLMA9jPnGQu4+GpBY4rDlqtXUAXcIN4F+S5fJuIhu/WlIhW4kDppm6jhrHZu1wDsvl93MonTe0tfHhH3mzj2/cOsyRY3P7l11KecJxvplwVrdmuvU4y/jOInOuXZBh17W9KE/OuNT0FuldOYPPFi0ZLzx8AhcGd1AShjA4ETTqN1CLjVX47Kix3ceiJbrFfJK5hvZYL0Xe6IG+7h63dxsM= x-ms-exchange-transport-forked: True Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: 419.consulting X-MS-Exchange-CrossTenant-Network-Message-Id: fe537edf-5647-4389-7306-08d7209d3533 X-MS-Exchange-CrossTenant-originalarrivaltime: 14 Aug 2019 09:53:06.8964 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 9c2ced3e-7522-4755-87dc-f983abc66ec3 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: /sDe6KHyQ6uHb6vfpexJfLK78Ii/+1ThDUw/i2BC4HZaRtXqC0zf9OfgoPpDZr0pXyNEkM39+xRRD9YbUKRQrRByFYh8RHNXpccq+gT/peM= X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO2P265MB0799 Archived-At: Subject: Re: [Add] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 14 Aug 2019 09:53:15 -0000 T24gMTQvMDgvMjAxOSAxMDozNywgU3RlcGhlbiBGYXJyZWxsIDxzdGVwaGVuLmZhcnJlbGxAY3Mu dGNkLmllPiB3cm90ZToNCj4gSSBhbSBub25ldGhlbGVzcyBoYXBweSB3aXRoIG15IHBvbGljaWVz IGZvciBteSBuL3cuIEkgd291bGQgc2F5IEJhcmJhcmEgaXMgZXF1YWxseSBoYXBweSANCj4gd2l0 aCBoZXIgcG9saWNpZXMgZm9yIGhlciBuL3cgYW5kIHRoYXQgd2UncmUgYm90aCBlbnRpdGxlZCB0 byBkbyBhcyB3ZSBkby4NCg0KPiBUaGUgcG9pbnQgb2YgbXkgbWFpbCB3YXMgdG8gcHJvdmlkZSBh IGNvdW50ZXJleGFtcGxlIHNob3dpbmcgdGhhdCBvbmUgbi93IGFkbWluJ3MgcG9saWN5IA0KPiBm aW5kaW5nIERvSCBwcm9ibGVtYXRpYyBpcyBub3Qgc3VmZmljaWVudCByZWFzb24gdG8gY2xhaW0g dGhhdCBEb0ggaXMgcHJvYmxlbWF0aWMgZm9yIGFsbCBuL3cgDQo+IGFkbWlucywgbm9yIHRoYXQg dGhlIGV4aXN0ZW5jZSBvZiBEb0ggc29tZWhvdyBjYWxscyBpbnRvIHF1ZXN0aW9uIHRoZSByb2xl IG9mIGEgbi93IGFkbWluLiANCj4gTmVpdGhlciBjbGFpbSBzdGFuZHMgdXAsIGFuZCByZXBlYXRp bmcgc3VjaCBpbnZhbGlkIGNsYWltcyBkb2VzIG5vdCBtYWtlIHRoZW4gdmFsaWQuDQoNClN1cmVs eSB0aGlzIGlzIGEgbW9vdCBwb2ludCBhcywgdW5mb3J0dW5hdGVseSwgdGhlIHdhcyB0aGUgRG9I IHN0YW5kYXJkIGhhcyBiZWVuIGRlZmluZWQsIHRoZSBuZXR3b3JrIGFkbWluIChhbmQgaW5kZWVk IHRoZSBkZXZpY2UgYWRtaW4gaWYgaGUvc2hlIGlzIGRpZmZlcmVudCkgaXMgbm90IGFibGUgdG8g ZGV0ZXJtaW5lIHdoZXRoZXIgdGhleSB3aXNoIHRvIHN1cHBvcnQgdGhlIHByb3RvY29sLiAgSXJy ZXNwZWN0aXZlIG9mIHlvdXIgbmV0d29yayBwb2xpY3ksIGFueSBhcHBsaWNhdGlvbiB0aGF0IGlt cGxlbWVudHMgRG9IIHdpbGwgcnVuIGl0IGFjcm9zcyB5b3VyIG5ldHdvcmsgdW5sZXNzIHRoYXQg YXBwbGljYXRpb24gZGV2ZWxvcGVyIGhhcyB2b2x1bnRhcmlseSBjaG9zZW4gdG8gY29uc3VsdCB5 b3UgLSBwb3NzaWJsZSBmb3IgZGV2aWNlIGFkbWlucywgaGFyZGVyIGZvciBuZXR3b3JrIGFkbWlu cyBleGNlcHQgcG9zc2libHkgaW4gdGhlIGhvbWUgYW5kIGVudGVycHJpc2UuICANCg0KQXMgYSBj b25zZXF1ZW5jZSBvZiB0aGUgYWJvdmUsIGl0J3MgcG9zc2libGUgdGhhdCBpbiBmdXR1cmUgc29t ZSByZWd1bGF0b3JzIG1heSBpbnN0cnVjdCBuZXR3b3JrIGFkbWlucyAoZW50ZXJwcmlzZSBhbmQg SVNQKSB0byBibG9jayBEb0ggcmVzb2x2ZXIgSVBzIGluIHNvbWUgY2lyY3Vtc3RhbmNlcy4NCg0K From nobody Wed Aug 14 03:12:28 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AD6FE1200C5 for ; Wed, 14 Aug 2019 03:12:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9ys4nc0gOdVO for ; Wed, 14 Aug 2019 03:12:22 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6F9021200DB for ; Wed, 14 Aug 2019 03:12:21 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id D9A5BBE5D; Wed, 14 Aug 2019 11:12:19 +0100 (IST) Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id srUXOGCFWuWE; Wed, 14 Aug 2019 11:12:19 +0100 (IST) Received: from [134.226.36.93] (unknown [134.226.36.93]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 8C1D2BE5B; Wed, 14 Aug 2019 11:12:19 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1565777539; bh=wM2HjzzV2OeN+DHxzdq8b5Ek/uARu5Ilr4GB0F0Hcvg=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From; b=CDFHtTyCqnk3fNMSRGydZhYe+ApDcNSv7gIfUOBsFTKgsPzMKFTRltnVj6G0Fc9wE T7ZdtQ08MeEkAFzkdB9OztA/uqtoruHr4mie6O1nY7FVKkOxvHnKGovOJ//2zb7tfx +6ZfGTd/Npgq14ZFRHkuSXlPN9eUZ7R/4wCe4NZc= To: Neil Cook Cc: ADD Mailing list , Brian Dickson , Bret Jordan References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <9CCE5D98-E595-472C-A73C-5BC0040C0EC6@open-xchange.com> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: Date: Wed, 14 Aug 2019 11:12:19 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: <9CCE5D98-E595-472C-A73C-5BC0040C0EC6@open-xchange.com> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="BH1PDbpEgnbLq14w8pprHtXOQ2eEN1WPW" Archived-At: Subject: Re: [Add] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 14 Aug 2019 10:12:26 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --BH1PDbpEgnbLq14w8pprHtXOQ2eEN1WPW Content-Type: multipart/mixed; boundary="FAw1SGTiDanKrufBuqCblxv8ZrQGhNEbT"; protected-headers="v1" From: Stephen Farrell To: Neil Cook Cc: ADD Mailing list , Brian Dickson , Bret Jordan Message-ID: Subject: Re: [Add] Validity of network administrator role References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <9CCE5D98-E595-472C-A73C-5BC0040C0EC6@open-xchange.com> In-Reply-To: <9CCE5D98-E595-472C-A73C-5BC0040C0EC6@open-xchange.com> --FAw1SGTiDanKrufBuqCblxv8ZrQGhNEbT Content-Type: multipart/mixed; boundary="------------072721A5DF8ECC21B1BE6195" Content-Language: en-GB This is a multi-part message in MIME format. --------------072721A5DF8ECC21B1BE6195 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hiya, On 14/08/2019 10:47, Neil Cook wrote: > Did someone say either of those things on this thread?=20 That's my interpretation yes. I think Andrew C's mail just now reinforces that by assuming that the only sane n/w admin policy is to be upset by DoH. > I couldn=E2=80=99t > find such assertions, but I agree that the existence DoH in itself > isn=E2=80=99t the problem. Personally my problem is with applications/d= evices > that choose to use a different DNS against my wishes as a network > administrator, but that=E2=80=99s not the fault of DoH, even if that do= es > seem to have been a catalyst for that behaviour in e.g. browsers. The > Chromecast discussion is a good example of that, i.e. it is using > regular DNS on port 53. Right, that's a more precise statement of a problem for your policy, but not really for mine. In my n/w I would also prefer that my son's chromecast used my DNS, but I'm not terribly upset that it does not, so I can live with it. (IIRC, it doesn't make DNS queries related to the content being "cast" but related to s/w update, though it's quite a while since I looked at that traffic and I did not spend much time looking at it so the device could be behaving "worse" than I thought.) In any case, I'd again compare ADD to choice of OS by people on my n/w. Despite my strong personal opinions about OSes, my policy is that the n/w is there for the users and if they've chosen a crazy OS or application then that's ok as long as it doesn't conflict with other policies. For example, I did intercept an attempt to add a "smart speaker" device that would send audio to a commercial provider and that doesn't IMO provide adequate controls over that for people who make noise:-) But a device or application using another DNS recursive basically doesn't conflict in such a way, so is ok by me. Cheers, S. --------------072721A5DF8ECC21B1BE6195 Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------072721A5DF8ECC21B1BE6195-- --FAw1SGTiDanKrufBuqCblxv8ZrQGhNEbT-- --BH1PDbpEgnbLq14w8pprHtXOQ2eEN1WPW Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAl1T3oMACgkQWrL68XsX K+qujBAAhNakZ1Z6+5ziOQtRjX7LDaLUpkgBaZ62EiGbbuTNkPQcs3/viztEVlhx 81vuODQJTTCSjk9+AZ6jTfC429G43MRyqICtAS1C4m8vdVlfZKbHWi+0hs7Dh6S3 JbLcgFgXyvCXdxyv/11Zpj5NzIuf+RGGjLd/SeFV9x2P7Qei59C9TOrau8xitEvy Smvi6SZ23DToWwEaS4EePhSQdV4cxHuUSrqJbON07ebCWwiTvNkOQdgpUQDX6GFG yPS/kf+ZzN1GzeoOgcSI+08hdammud+ddlcwpETSfqVfQGESNahUAbtpbMaorgnP UuyXkpHsQ65ZAXWOH2XllxRxg5hOLeI29TvnNebr8HBMgj2rQlVo5r7p+x0M/bXf K2WA9KCLOQobGFt1YsMF/cIxPh/cbEQaalF5Yl8LfkoIrE6XX/H95xyNB89XAWHN VGCm9f7qpsTJ+4wrlOFxHpQTG8Qzy97rI8r7QGwUsarynijRslPyiBBYh+zURjRF eghNxq6ESUgpxLYZQeqVPgp2PnLrJShPRkwbzC9TIEpqdYwkxrcU8z9bWmJRbUXL UQVTjK3Zfxul9wrVgLAJwSuTbRZp6rReLdxpXBn1uDRStirKFC8p9dGxOv3WQjbB AnNJR9Ss2HHhH3JZ+xq64HQ3GeX/c71YozTFrCrN118nwhGRKl0= =C520 -----END PGP SIGNATURE----- --BH1PDbpEgnbLq14w8pprHtXOQ2eEN1WPW-- From nobody Wed Aug 14 03:33:22 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 481D71200EC for ; Wed, 14 Aug 2019 03:33:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Tq3I6iHgnK0y for ; Wed, 14 Aug 2019 03:33:18 -0700 (PDT) Received: from mail-yb1-xb31.google.com (mail-yb1-xb31.google.com [IPv6:2607:f8b0:4864:20::b31]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5729A1200E9 for ; Wed, 14 Aug 2019 03:33:18 -0700 (PDT) Received: by mail-yb1-xb31.google.com with SMTP id x10so3160861ybs.13 for ; Wed, 14 Aug 2019 03:33:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=KJK/bE9SKf42VTmW9noQv15OZh3qoccZaxpRKn47C7Y=; b=VAt7tynoBStia4BCCapUdoXnhwbdavX5KjcGxrwQSD84U+oonxHY2TL6MYCpHU8TLF 3Sxd2QGpYV2ktei9VtoS6vgFBX4oIJ6tLM+peGGfGeH5NCedB5UjxHeZjfig/vVSVL1B 6+GozEyLrLpzD7SknbWDkEOhpsw60g4r8F9UHKEHrIxW+WWXmmmkhUAgThTlQ/nkA8gW B+XgpFC6SZA3zzoO2KaPzrpm9NxObW3rrlqaVEa5tJvlv2rI0huRMROcEN7rIuicF9BT UF2w8QHaXPrY7POcs2Lea4gMMM6nmwqsb6QPtfT2Qj3rV7bMazPHn4w3v9HEUar0aS34 JwfQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=KJK/bE9SKf42VTmW9noQv15OZh3qoccZaxpRKn47C7Y=; b=KY0v6TQQ8O3Xfw6FpDxKPFQ0QOsS2O9UshbJ/3zqnPDGhws6vfXkEytNQY2DjTOlBr aGMMZUjr6ex2Mdb521BS2betYd3+4TzidSO02joSt4FIIiTGgQuq/F+dwD9AdH4s3jdW 7CrfG/yTXXfqkdBz5sRRRDr+ALh7mpnCbvZgxrsWqwpTXdzvRw2eYZVgQlxo9F/EGgHK dANxW2lsq4mFlVf6TQW4jm7J/wkQvdN1PmafaRH4twRqklQIoU3fHI3j0RusM0Yl8qy+ t2PYA81Kyna3H4PzmfDDLqKnojy0eCMTvyRd2Q98RNB/t7S/P2wAaTt4hkKbOiZgimBG 40Bg== X-Gm-Message-State: APjAAAU1X/Ftikp5cjMK/5jlOI7siFRRZYH37NR2Hv6BDbf5NoR9YPXZ SzCL+pRzGj/8fBELjnwr5Hi3MTtgmbKmkgKo8D8= X-Google-Smtp-Source: APXvYqxMNaLAJXIw33RWWzZYUYus+i9sVAgglVH/DWyKJlNTK1HcskrLe331xdkFrB03nhtG/q9MMsiNeIHf5LYPNxw= X-Received: by 2002:a25:3f83:: with SMTP id m125mr13048801yba.501.1565778797299; Wed, 14 Aug 2019 03:33:17 -0700 (PDT) MIME-Version: 1.0 References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <9CCE5D98-E595-472C-A73C-5BC0040C0EC6@open-xchange.com> In-Reply-To: <9CCE5D98-E595-472C-A73C-5BC0040C0EC6@open-xchange.com> From: Alec Muffett Date: Wed, 14 Aug 2019 11:33:04 +0100 Message-ID: To: Neil Cook Cc: Stephen Farrell , ADD Mailing list , Brian Dickson , Bret Jordan Content-Type: multipart/alternative; boundary="00000000000002912c05901149f1" Archived-At: Subject: Re: [Add] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 14 Aug 2019 10:33:20 -0000 --00000000000002912c05901149f1 Content-Type: text/plain; charset="UTF-8" On Wed, 14 Aug 2019, 10:47 Neil Cook, wrote: > Personally my problem is with applications/devices that choose to use a > different DNS against my wishes as a network administrator > At risk of sounding flip or overly brief - but I hope this is a fairly succinct question: Does your problem extend to applications which use hardcoded IP addresses, and/or which (eg: Tor, VPN) do not use make visible or make use of DNS at all on your network? If so, how do you mitigate, and if not, why not? I am not asking this to seek illustration, but to query, in a very concrete sense, whether your "problem" is orthogonal with how you currently address extant tools which bypass the controls that you're concerned about lacking. I am aware of Network Intrusion Detection Solutions (NIDS) which flag the presence of any IP address on the wire, where that IP has not previously been returned in a DNS query response. I am not aware that level of control being commonly deployed, useful, or interesting. - alec --00000000000002912c05901149f1 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Wed, 14 Aug 2019, 10:47 Neil Cook, <neil.cook=3D40open-xchange.com@dmarc.ietf= .org> wrote:
Personally my p= roblem is with applications/devices that choose to use a different DNS agai= nst my wishes as a network administrator

At risk of sounding f= lip or overly brief - but I hope this is a fairly succinct question:
<= div dir=3D"auto">
Does your problem extend to ap= plications which use hardcoded IP addresses, and/or which (eg: Tor, VPN) do= not use make visible or make use of DNS at all on your network?

If so, how do you mitigate, and if= not, why not?=C2=A0 I am not asking this to seek illustration, but to quer= y, in a very concrete sense, whether your "problem" is orthogonal= with how you currently address extant tools which bypass the controls that= you're concerned about lacking.

I am aware of Network Intrusion Detection Solutions (NIDS) whi= ch flag the presence of any IP address on the wire, where that IP has not p= reviously been returned in a DNS query response.=C2=A0 I am not aware that = level of control being commonly deployed, useful, or interesting.

- alec


--00000000000002912c05901149f1-- From nobody Wed Aug 14 04:08:53 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3EA581200F8 for ; Wed, 14 Aug 2019 04:08:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.298 X-Spam-Level: X-Spam-Status: No, score=-4.298 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=open-xchange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sI2ihLA0uZ4U for ; Wed, 14 Aug 2019 04:08:49 -0700 (PDT) Received: from mx4.open-xchange.com (alcatraz.open-xchange.com [87.191.39.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6090E1200F7 for ; Wed, 14 Aug 2019 04:08:49 -0700 (PDT) Received: from open-xchange.com (imap.open-xchange.com [10.20.30.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx4.open-xchange.com (Postfix) with ESMTPS id 518AF6A299; Wed, 14 Aug 2019 13:08:47 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=open-xchange.com; s=201705; t=1565780927; bh=y8VM/w95fAijtf8PGdxVo/+RS6E9FOKZRh72tJVitA4=; h=From:Subject:Date:In-Reply-To:Cc:To:References:From; b=wIU9syboxW5GtASRxGQXk7Y2u5oiYgUQqvCqEUEwJ7Ebwz7GkDqgu/RXvr43GgE81 8z5r7yZxODPfBc9Sbd+FE7ex6jchoDjHv+4M/xaFvVIKyYEMPt6cYGdJ3zlEhx8rcr wz8ocTBiqbXML90CAXk7s+Vyfyo8sojOU7B3hyT1vAMfdoAdh9055WY6WeOoVKIBv2 QOhvvWj/YA5mIPN21ys9NYCP+QTDYNvn8GgSuvaZX6TO4mQI1q+Kx6XrJHYFOyjr4H 6U/kAsXszOtrl/5aUmyefpdpvv4pLlPuonQxo1kDped2Fj0YfON8EW2XZElIUsqokp cbkojPaJqefqg== Received: from [10.242.2.57] (unknown [10.242.2.57]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by open-xchange.com (Postfix) with ESMTPSA id 6BF0C3C05CE; Wed, 14 Aug 2019 13:08:45 +0200 (CEST) From: Neil Cook Message-Id: Content-Type: multipart/alternative; boundary="Apple-Mail=_34E460A5-8ACB-4BF2-9655-B1818CEB42DD" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Wed, 14 Aug 2019 12:08:40 +0100 In-Reply-To: Cc: ADD Mailing list To: Alec Muffett References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <9CCE5D98-E595-472C-A73C-5BC0040C0EC6@open-xchange.com> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 14 Aug 2019 11:08:51 -0000 --Apple-Mail=_34E460A5-8ACB-4BF2-9655-B1818CEB42DD Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 I was talking about my role as network admin in my home, which I have = discussed before on this list. I won=E2=80=99t bore everyone with the details, but I mainly do it to = stop my children (and indeed their friends and my extended family=E2=80=99= s children) from accidentally accessing content on the internet that is = not age appropriate. Hence my particular concern about browsers doing = this. My wife also appreciates it as she has clicked on links in = plausible-looking spam emails in the past and seen images she would = rather not have seen. If anyone on my network wants to bypass the controls, and they have the = wherewithal to change their DNS settings, or setup a VPN, then I don=E2=80= =99t attempt to stop them. Neil > On 14 Aug 2019, at 11:33, Alec Muffett wrote: >=20 > On Wed, 14 Aug 2019, 10:47 Neil Cook, = > wrote: > Personally my problem is with applications/devices that choose to use = a different DNS against my wishes as a network administrator >=20 > At risk of sounding flip or overly brief - but I hope this is a fairly = succinct question: >=20 > Does your problem extend to applications which use hardcoded IP = addresses, and/or which (eg: Tor, VPN) do not use make visible or make = use of DNS at all on your network? >=20 > If so, how do you mitigate, and if not, why not? I am not asking this = to seek illustration, but to query, in a very concrete sense, whether = your "problem" is orthogonal with how you currently address extant tools = which bypass the controls that you're concerned about lacking. >=20 > I am aware of Network Intrusion Detection Solutions (NIDS) which flag = the presence of any IP address on the wire, where that IP has not = previously been returned in a DNS query response. I am not aware that = level of control being commonly deployed, useful, or interesting. >=20 > - alec >=20 >=20 >=20 > --=20 > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add Neil Cook neil.cook@open-xchange.com = --------------------------------------------------------------------------= ----------- Open-Xchange AG, Rollnerstr. 14, 90408 Nuremberg, District Court = Nuremberg HRB 24738 Managing Board: Rafael Laguna de la Vera, Carsten Dirks, Michael = Knapstein, Stephan Martin=20 Chairman of the Board: Richard Seibt European Office:=20 Open-Xchange GmbH, Olper Huette 5f, D-57462 Olpe, Germany, District = Court Siegen, HRB 8718=20 Managing Director: Frank Hoberg US Office:=20 Open-Xchange. Inc., 530 Lytton Avenue, Palo Alto, CA 94301, USA=20 = --------------------------------------------------------------------------= ----------- --Apple-Mail=_34E460A5-8ACB-4BF2-9655-B1818CEB42DD Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 I = was talking about my role as network admin in my home, which I have = discussed before on this list.

I won=E2=80=99t bore everyone with the details, but I mainly = do it to stop my children (and indeed their friends and my extended = family=E2=80=99s children) from accidentally accessing content on the = internet that is not age appropriate. Hence my particular concern about = browsers doing this. My wife also appreciates it as she has clicked on = links in plausible-looking spam emails in the past and seen images she = would rather not have seen.

If anyone on my network wants to bypass the controls, and = they have the wherewithal to change their DNS settings, or setup a VPN, = then I don=E2=80=99t attempt to stop them.

Neil

On 14 = Aug 2019, at 11:33, Alec Muffett <alec.muffett@gmail.com> wrote:

On Wed, 14 Aug 2019, 10:47 Neil Cook, = <neil.cook=3D40open-xchange.com@dmarc.ietf..org> wrote:
Personally my problem is with = applications/devices that choose to use a different DNS against my = wishes as a network = administrator

At risk of = sounding flip or overly brief - but I hope this is a fairly succinct = question:

Does your problem extend to applications which = use hardcoded IP addresses, and/or which (eg: Tor, VPN) do not use make = visible or make use of DNS at all on your network?

If so, how = do you mitigate, and if not, why not?  I am not asking this to seek = illustration, but to query, in a very concrete sense, whether your = "problem" is orthogonal with how you currently address extant tools = which bypass the controls that you're concerned about lacking.

I am aware of Network Intrusion Detection Solutions (NIDS) = which flag the presence of any IP address on the wire, where that IP has = not previously been returned in a DNS query response.  I am not = aware that level of control being commonly deployed, useful, or = interesting.

- alec



--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add


Neil Cook
neil.cook@open-xchange.com

---------------------------------------------------------------= ----------------------
Open-Xchange AG, Rollnerstr. 14, = 90408 Nuremberg, District Court Nuremberg HRB 24738
Managing Board: Rafael Laguna de la Vera, Carsten Dirks, = Michael Knapstein, Stephan Martin 
Chairman of = the Board: Richard Seibt

European = Office: 
Open-Xchange GmbH, Olper Huette = 5f, D-57462 Olpe, Germany, District Court Siegen, HRB = 8718 
Managing Director: Frank Hoberg
US Office: 
Open-Xchange. Inc., 530 = Lytton Avenue, Palo Alto, CA 94301, USA 
---------------------------------------------------------------= ----------------------

= --Apple-Mail=_34E460A5-8ACB-4BF2-9655-B1818CEB42DD-- From nobody Wed Aug 14 05:58:45 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6742C120814 for ; Wed, 14 Aug 2019 05:58:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=hopcount.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IznY__kHevE4 for ; Wed, 14 Aug 2019 05:58:41 -0700 (PDT) Received: from mail-ot1-x32a.google.com (mail-ot1-x32a.google.com [IPv6:2607:f8b0:4864:20::32a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A807912081B for ; Wed, 14 Aug 2019 05:58:41 -0700 (PDT) Received: by mail-ot1-x32a.google.com with SMTP id w4so6988083ote.11 for ; Wed, 14 Aug 2019 05:58:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hopcount.ca; s=google; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=wSzHLoEJTN1Hr2ba0vmpGTkS9LpE4OkuqUOfoD1u7HE=; b=LY+pxWYzDBC031Mn2yXmeZBt+6WLyrBFYEWQolE4PhtvG5DeMkhr5zWNSv8FbnXnWU cQzPl9V0ZQQmvX/XxcWD/+Da7jF/jAJ+q+2BoD1PGqG4hlB/UFTjMu0Lc5h+pUObYFxN sBp0E7Do8+IDP50aoJk+lxvG5ApTVj/ZW5BWw= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=wSzHLoEJTN1Hr2ba0vmpGTkS9LpE4OkuqUOfoD1u7HE=; b=Ji2i0NwqWKP2WGtTyPG6PbJKwmazDJ9Fk4TBhkCLm5f6ywmtnTHCbU16v16aRe48IL O1t8+BYZLDoJ3SXFnMJD35kFXP4KsHc0VypofJRstk0H1FTbt+P92uFkzOucCpFneie9 JNRHQqGZ5C9z/obNSvYFUeBzwQYiPhBNuj3gjitjBkaPlAjmslRoc3MJO4EvaR8z2M3w D9M3Pdw2HcYfMB+ipzTORBZS139wZ3/uPlvurYGVSRR+1mbYMisVvpELi//KdvNv9iFe f57QB4BMyAGbf9ZrT/QZ3MUyhQaDMf1dMG4pGROb3cXvy2fcgBJNeE5ufzzf7U1cTyOF e/wA== X-Gm-Message-State: APjAAAVNv/U63jqCAE2pTTLTWeDeghStbgzI9dTAgjVgHhMl4hXs1a1G qSAaCnUiqH9NRYXQoS+zgvbixA== X-Google-Smtp-Source: APXvYqwmcM9Q6LxjjvzgOAT438F5oIohprKtYTqd05RaI04K3FXDP0LEGMLwOMjoV11iHO8Zz+4CsQ== X-Received: by 2002:a6b:dd18:: with SMTP id f24mr9251187ioc.97.1565787520580; Wed, 14 Aug 2019 05:58:40 -0700 (PDT) Received: from ?IPv6:2607:f2c0:e786:128f:f4dc:5e02:92fc:d9af? ([2607:f2c0:e786:128f:f4dc:5e02:92fc:d9af]) by smtp.gmail.com with ESMTPSA id n22sm158117540iob.37.2019.08.14.05.58.38 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 14 Aug 2019 05:58:39 -0700 (PDT) From: Joe Abley Message-Id: <9645B246-A171-4498-9A0D-4C149F30433F@hopcount.ca> Content-Type: multipart/signed; boundary="Apple-Mail=_F806782F-498F-4DB8-965C-A5369D42A49E"; protocol="application/pgp-signature"; micalg=pgp-sha1 Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Wed, 14 Aug 2019 08:58:37 -0400 In-Reply-To: Cc: Stephen Farrell , Brian Dickson , ADD Mailing list , Bret Jordan To: Andrew Campling References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 14 Aug 2019 12:58:44 -0000 --Apple-Mail=_F806782F-498F-4DB8-965C-A5369D42A49E Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii On 14 Aug 2019, at 05:53, Andrew Campling = wrote: > Surely this is a moot point as, unfortunately, the was the DoH = standard has been defined, the network admin (and indeed the device = admin if he/she is different) is not able to determine whether they wish = to support the protocol. "Wish to support the protocol" is a telling phrase. The Internet architecture in the opinions of some (I am one) succeeded = where other architectures had failed specifically because it did not = incorporate access control in the network; it was, in David Isenberg's = words, stupid. This was in stark contrast to the so-called intelligent = networks of phone companies that sought to control the applications and = services that could be provided over the pair of copper or synchronous = timeslot made available to a user. The Internet dispensed with centralised control over toplogy, routing, = and (I think importantly) introduced layers that separated not just = concepts but responsibility and freedom. The kind of innovation visible = to end-users on the Internet happens on the edge, high up in the stack, = not in the network. When I hear network administrators (I am one) talk about the ability to = constrain abuse in circumstances where they have responsibility for the = devices that they forward packets for, I do not (until now) hear a = general expectation of being able to support particular protocols. They = are conceptually different, even though many implementations of the = former today involve the latter. I think this is important. If we lose sight of this core principle of the architecture of the = network, history suggests it will be replaced by something else. What = happened a short number of decades ago was that the phone network became = a transport for a new network (leaving the voice network to be relegated = to one of many applications that run on top). Perhaps, in microcosm, the = idea that the network can contain and control one very specific service, = that of name resolution, has spawned a very similar outcome. Joe --Apple-Mail=_F806782F-498F-4DB8-965C-A5369D42A49E Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iF0EARECAB0WIQSAt40QkiztAcvphdg0jwy9hlI6LAUCXVQFfQAKCRA0jwy9hlI6 LFbFAKC1wgGbPY+ECQaaoySG4oLKX3jo4QCfZ3gLx3o/knp/PtRluFAFrXzQk/s= =Qb/2 -----END PGP SIGNATURE----- --Apple-Mail=_F806782F-498F-4DB8-965C-A5369D42A49E-- From nobody Wed Aug 14 11:18:45 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 19AF1120D03 for ; Wed, 14 Aug 2019 11:18:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JShe2E127H5m for ; Wed, 14 Aug 2019 11:18:41 -0700 (PDT) Received: from mail-qk1-x733.google.com (mail-qk1-x733.google.com [IPv6:2607:f8b0:4864:20::733]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id ACD17120CF5 for ; Wed, 14 Aug 2019 11:18:41 -0700 (PDT) Received: by mail-qk1-x733.google.com with SMTP id u190so19669794qkh.5 for ; Wed, 14 Aug 2019 11:18:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=xN5hp6v8zeg9xVSdMZUoy1ETUqSqNiybhXt9ClpkIjQ=; b=QkRG2l/AqJkaAf16IgRC98wuLr0dBgCcLSPYyL++Zj0wWAKQ3FhKjoiQX+adYFTU3v N1r1v4qU4oSUUa23mFRC3paT6A+KuUl37JTXUUf4I7YO/lLkSjGSfYEPkjfK7S1m2r54 KEzpgDSRRNVZCkKC/0ue08VWVYeF3xVcQ/z05nZa7WAMWwLbMUWoR48BiWPzWElvT9a6 ww76ZfXXtAwY9Sjzn2/qAubvzbh03X5FHSVplHLnsEfWdpTzksLg+jo7GrzjE69E+Z4p yiEHtpbVaVh+8cI0YgxAxv+n/cKeUd8t5gldv7Zay4asuDx2XztnW6eeEsqUfkjpkD++ eGEQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=xN5hp6v8zeg9xVSdMZUoy1ETUqSqNiybhXt9ClpkIjQ=; b=AjPvW7OFHair14/oJaodiZVffe/0CJ7IRmPeGdb3+FIZqPFX2fxJSJDDJgTUTeG4rl ErZM6QJNofrryA62DRN7Ib66jl/Ux36xM5QzlMKVBlt+cL+oT0AvITiNbaSRECeDVVKW v2lcFHMK02uM7wt3kVlkPhUBKybqN0LIHbRbo7v/I/+AVnVn5l595cVWMV521Ix4jW51 n1PiY/A4OLBnRySxWQcgRNacnNDNIYKzJF7IuK7j7smD5U1FGHTL/YYMaqb15JETo67W mj6O7z61VvCngGxEPjQDLmxXrJ5O6nyE3gdDWlYra4k/bNZROfKOcv1xIqEpwKIYnI0F 6pbg== X-Gm-Message-State: APjAAAVSj0M+Qn6ESMNPBBwE6JIotfCfeZHF6Q6L5K8wGejpXC8sN2AM EplneI6auKHnuH89/nh5Zi4= X-Google-Smtp-Source: APXvYqyHvt1VKsStVRoL/on2a0/snC/WsszghfW9agd2e4RMhvlQbYkv3XkRwNNUnIaD9kgHETQ96A== X-Received: by 2002:a05:620a:10b9:: with SMTP id h25mr736968qkk.33.1565806720832; Wed, 14 Aug 2019 11:18:40 -0700 (PDT) Received: from [192.168.2.18] (cpe-76-179-66-50.maine.res.rr.com. [76.179.66.50]) by smtp.gmail.com with ESMTPSA id 15sm219505qka.129.2019.08.14.11.18.39 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 14 Aug 2019 11:18:40 -0700 (PDT) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (1.0) From: Brian Dickson X-Mailer: iPhone Mail (16G77) In-Reply-To: <9645B246-A171-4498-9A0D-4C149F30433F@hopcount.ca> Date: Wed, 14 Aug 2019 14:18:38 -0400 Cc: Andrew Campling , Stephen Farrell , ADD Mailing list , Bret Jordan Content-Transfer-Encoding: quoted-printable Message-Id: <3830DDE7-5F96-4E0E-86B6-E9062D9FC8C5@gmail.com> References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <9645B246-A171-4498-9A0D-4C149F30433F@hopcount.ca> To: Joe Abley Archived-At: Subject: Re: [Add] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 14 Aug 2019 18:18:44 -0000 Sent from my iPhone > On Aug 14, 2019, at 8:58 AM, Joe Abley wrote: >=20 >> On 14 Aug 2019, at 05:53, Andrew Campling wrote: >>=20 >> Surely this is a moot point as, unfortunately, the was the DoH standard h= as been defined, the network admin (and indeed the device admin if he/she is= different) is not able to determine whether they wish to support the protoc= ol. >=20 > "Wish to support the protocol" is a telling phrase. >=20 > The Internet architecture in the opinions of some (I am one) succeeded whe= re other architectures had failed specifically because it did not incorporat= e access control in the network; it was, in David Isenberg's words, stupid. T= his was in stark contrast to the so-called intelligent networks of phone com= panies that sought to control the applications and services that could be pr= ovided over the pair of copper or synchronous timeslot made available to a u= ser. >=20 > The Internet dispensed with centralised control over toplogy, routing, and= (I think importantly) introduced layers that separated not just concepts bu= t responsibility and freedom. The kind of innovation visible to end-users on= the Internet happens on the edge, high up in the stack, not in the network.= >=20 > When I hear network administrators (I am one) talk about the ability to co= nstrain abuse in circumstances where they have responsibility for the device= s that they forward packets for, I do not (until now) hear a general expecta= tion of being able to support particular protocols. They are conceptually di= fferent, even though many implementations of the former today involve the la= tter. I think this is important. One interesting observation about layers and protocols, is the difference be= tween routing protocols that run on top of IP and those with their own proto= col number. One example of the latter is ISIS, an IGP very similar to OSPF. T= he operational experience with the former (eg BGP and OSPF) and ISIS shows t= he benefits of having distinct substrates for the control plane, where it is= possible. BGP and OSPF eventually had to add defense mechanisms against in-= band attacks (eg MD5 and TTL mechanisms), while ISIS was unaffected (AFAIK a= t least). It is interesting to consider what possible benefits there might have been o= r might be in separation of other control planes from the IP data plane, eg i= f DNS were properly considered a control plane rather than an application, e= ven if only on the client-to-resolver side. Brian >=20 > If we lose sight of this core principle of the architecture of the network= , history suggests it will be replaced by something else. What happened a sh= ort number of decades ago was that the phone network became a transport for a= new network (leaving the voice network to be relegated to one of many appli= cations that run on top). Perhaps, in microcosm, the idea that the network c= an contain and control one very specific service, that of name resolution, h= as spawned a very similar outcome. >=20 >=20 > Joe From nobody Wed Aug 14 11:26:43 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8AF19120824 for ; Wed, 14 Aug 2019 11:26:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id L5zuTrfJP7zV for ; Wed, 14 Aug 2019 11:26:39 -0700 (PDT) Received: from mail-ot1-x329.google.com (mail-ot1-x329.google.com [IPv6:2607:f8b0:4864:20::329]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2222F120127 for ; Wed, 14 Aug 2019 11:26:39 -0700 (PDT) Received: by mail-ot1-x329.google.com with SMTP id r20so217479ota.5 for ; Wed, 14 Aug 2019 11:26:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=content-transfer-encoding:from:mime-version:subject:date:message-id :references:cc:in-reply-to:to; bh=5Kpw51EwJI+ecZsuOnfxTshaOeyaPu3+rFWIr5bXgzc=; b=Q6tCekXL7t3MeUYpdLWqUw8guGUzehBpNCM+rRdNHSzIkZ5PlunKAZ3aeKYi47n1u8 Uv+0Y0sMiljlzjscGBa2epPofmSMa/0cahiORttc20u52uftBHPAUzMlddRkcx0tjT4+ dg7nJVlvSEA5D4/24Nd+8xWVhKldFaFwwllGcz8hnNUSxcrI3whR+iPrtTtdcLOX+1q7 wY/kOwF33FlZctc1m4TgOso2KEBotdjtJoXrah8krv+7+fvGRe/zPYAlnIfC9v2voJLM 33fT+yO3lT7vQCo4C1+lz8OLfrivtGh5Vj4ihpE/OQ0qNdQzHIWrIoffPw/13yfiW4nB iN2g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:content-transfer-encoding:from:mime-version :subject:date:message-id:references:cc:in-reply-to:to; bh=5Kpw51EwJI+ecZsuOnfxTshaOeyaPu3+rFWIr5bXgzc=; b=NeKAjqiYgEVw+eXFctcjnTa7gwd2jS1QcuF7Rs+JwotReVAZ4UnB45x78kgnAWwG5h 6lCnJ2bP5P7Py7Pgk747UvgAx6GCdR3ll/C/cSzv3t+jNgtj+IIClwhwUfMXIm17F3p0 E0QPtQYuBJBLaTlbkfUJsYQ5JcN7kiFdFqfeq2lPN+j4il0yU6njfQ8/mPWEZVsKlDUb RJHODh2b2mqwCeILqZJnANQPadR8CRjBDZGaQzNCOWeN0pahxY3jHyyCvJUsoB2qqu6U jSwj8EcrhjzqfqSsbQf6eFS701cqudKAOUb+8vVd2p1QzulxoqcNKtZDf5S5rIImT0wA RRDA== X-Gm-Message-State: APjAAAX3rFczKq1cnavtX3zTprm0ntBBUAD7//QfqOPSX4q8MNzHoSrw 0a8/AhCkr5c/dW3rQ5ARlAnF4A== X-Google-Smtp-Source: APXvYqxbBqs3Uns7Z5U0dUT8v45WoHcvHRP9S5qjCrtZAzdTobUX/u/WqMM9vcsNiII26mySwDl7kg== X-Received: by 2002:a5d:8c97:: with SMTP id g23mr1302487ion.250.1565807198310; Wed, 14 Aug 2019 11:26:38 -0700 (PDT) Received: from [172.19.0.18] ([75.104.91.58]) by smtp.gmail.com with ESMTPSA id b20sm337418ios.44.2019.08.14.11.26.36 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Wed, 14 Aug 2019 11:26:37 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable From: Ted Lemon Mime-Version: 1.0 (1.0) Date: Wed, 14 Aug 2019 11:26:32 -0700 Message-Id: <43F27F64-25DA-407B-8FF3-08B6C4A66FA3@fugue.com> References: <3830DDE7-5F96-4E0E-86B6-E9062D9FC8C5@gmail.com> Cc: Joe Abley , Andrew Campling , ADD Mailing list , Bret Jordan , Stephen Farrell In-Reply-To: <3830DDE7-5F96-4E0E-86B6-E9062D9FC8C5@gmail.com> To: Brian Dickson X-Mailer: iPhone Mail (17A815) Archived-At: Subject: Re: [Add] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 14 Aug 2019 18:26:42 -0000 Isn=E2=80=99t the big difference here that IS-IS is site-local and BGP is no= t? Why would it be interesting to consider? What does this actually have t= o do with DoH? Sent from my iPhone > On Aug 14, 2019, at 11:18 AM, Brian Dickson wrote: >=20 > =EF=BB=BF >=20 > Sent from my iPhone >=20 >>> On Aug 14, 2019, at 8:58 AM, Joe Abley wrote: >>>=20 >>>> On 14 Aug 2019, at 05:53, Andrew Campling wrote: >>>=20 >>> Surely this is a moot point as, unfortunately, the was the DoH standard h= as been defined, the network admin (and indeed the device admin if he/she is= different) is not able to determine whether they wish to support the protoc= ol. >>=20 >> "Wish to support the protocol" is a telling phrase. >>=20 >> The Internet architecture in the opinions of some (I am one) succeeded wh= ere other architectures had failed specifically because it did not incorpora= te access control in the network; it was, in David Isenberg's words, stupid.= This was in stark contrast to the so-called intelligent networks of phone c= ompanies that sought to control the applications and services that could be p= rovided over the pair of copper or synchronous timeslot made available to a u= ser. >>=20 >> The Internet dispensed with centralised control over toplogy, routing, an= d (I think importantly) introduced layers that separated not just concepts b= ut responsibility and freedom. The kind of innovation visible to end-users o= n the Internet happens on the edge, high up in the stack, not in the network= . >>=20 >> When I hear network administrators (I am one) talk about the ability to c= onstrain abuse in circumstances where they have responsibility for the devic= es that they forward packets for, I do not (until now) hear a general expect= ation of being able to support particular protocols. They are conceptually d= ifferent, even though many implementations of the former today involve the l= atter. I think this is important. >=20 > One interesting observation about layers and protocols, is the difference b= etween routing protocols that run on top of IP and those with their own prot= ocol number. One example of the latter is ISIS, an IGP very similar to OSPF.= The operational experience with the former (eg BGP and OSPF) and ISIS shows= the benefits of having distinct substrates for the control plane, where it i= s possible. BGP and OSPF eventually had to add defense mechanisms against in= -band attacks (eg MD5 and TTL mechanisms), while ISIS was unaffected (AFAIK a= t least). >=20 > It is interesting to consider what possible benefits there might have been= or might be in separation of other control planes from the IP data plane, e= g if DNS were properly considered a control plane rather than an application= , even if only on the client-to-resolver side. >=20 > Brian >=20 >>=20 >> If we lose sight of this core principle of the architecture of the networ= k, history suggests it will be replaced by something else. What happened a s= hort number of decades ago was that the phone network became a transport for= a new network (leaving the voice network to be relegated to one of many app= lications that run on top). Perhaps, in microcosm, the idea that the network= can contain and control one very specific service, that of name resolution,= has spawned a very similar outcome. >>=20 >>=20 >> Joe >=20 > --=20 > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add From nobody Wed Aug 14 12:03:27 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A8597120E31 for ; Wed, 14 Aug 2019 12:03:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id o1uKiKfMmsmY for ; Wed, 14 Aug 2019 12:03:15 -0700 (PDT) Received: from mail-vs1-xe30.google.com (mail-vs1-xe30.google.com [IPv6:2607:f8b0:4864:20::e30]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E9A0D120E2F for ; Wed, 14 Aug 2019 12:03:14 -0700 (PDT) Received: by mail-vs1-xe30.google.com with SMTP id q188so1283vsa.4 for ; Wed, 14 Aug 2019 12:03:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=e9Efx/8gQ/jUz2zCSNbEhFi2xtIeSVVIXuCf0ByCSWs=; b=tNFjR2d9wzv+7BSJ+XOVDtI/h37GkYjgnkDI78Sccm5fUfe4HoG52OTy/ci5ZZhqPw 6V2jwawy8YIdBrvlu0mRF2LeD6i7qPUer1WYlmMrKgConslhTV9vmOeAEul/qB5t+BJM pqVHt0PXcIdubwV2mm8O2zj2egpVEF7q96IKZRu2cxI+iRt6h74IfLW+iAt/Bj0B1dyc Bfy+64UYv1ywAeDbVU+YtxPBga/hlCHYy0Zck80L0pZNFbcpjcn8sxgKs1R97tlBkORE zjbrHnHV/SAxP1BPel0l5Ogm7mkxUOrFLEnt1N2Yc5YYzgdPXl8UQPETp8D3LHlpzpuM PvjA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=e9Efx/8gQ/jUz2zCSNbEhFi2xtIeSVVIXuCf0ByCSWs=; b=HLjz7fCVyFZmRQo5ioK4fGZzG+4f4pRPSjI1kYUe3pTGLKOm2N+jf4Uc1qw9pz6Z0Y yrrGR1Az7d3Eyq8wY2yq9Z64qW9uy8/bRRqwBbBRTTZkoibIMcpXmexW3Y/J0Lwthwps d7DCi5d6hK84xQzIQ52+IKrDDOyRMDkUh3gF1XvtubpDQH6mtzhHfgc1Qqy4qJM4TBHE LJvdrlHIhjPIYVtKqW8QwRqAhIR7HZWOkXHe3O0fQK6HJjUpVIS5ka1TCsuUfT7+qOdO OtFb9vnoTAozt4ix7V232sgqlRgkaQhN0m/K6Z3XCAcDgbxdCFSAZOQmIEeu4aZ3TgAw dQbw== X-Gm-Message-State: APjAAAVbYifkiUOvhRDTtCqYZr5+NQYVH1EiPdlAvNLGZe4+XSovKA8b Fu8w65y4UnT7nHIqjBi2BTq8h1KL2hW9CSsggUKIjAS0 X-Google-Smtp-Source: APXvYqxYGEHAsJC6amwTnyD0ulo9OOjlozcPLqoGTnsfzWaBmHtrN3U0FCKBh1p1tl1/iWBCCMoEkqzmg7Ny3oZjuuk= X-Received: by 2002:a67:edcf:: with SMTP id e15mr633220vsp.75.1565809393890; Wed, 14 Aug 2019 12:03:13 -0700 (PDT) MIME-Version: 1.0 References: <3830DDE7-5F96-4E0E-86B6-E9062D9FC8C5@gmail.com> <43F27F64-25DA-407B-8FF3-08B6C4A66FA3@fugue.com> In-Reply-To: <43F27F64-25DA-407B-8FF3-08B6C4A66FA3@fugue.com> From: Brian Dickson Date: Wed, 14 Aug 2019 15:02:52 -0400 Message-ID: To: Ted Lemon Cc: Joe Abley , Andrew Campling , ADD Mailing list , Bret Jordan , Stephen Farrell Content-Type: multipart/alternative; boundary="000000000000b579800590186875" Archived-At: Subject: Re: [Add] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 14 Aug 2019 19:03:25 -0000 --000000000000b579800590186875 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Wed, Aug 14, 2019 at 2:26 PM Ted Lemon wrote: > Isn=E2=80=99t the big difference here that IS-IS is site-local and BGP is= not? > Why would it be interesting to consider? What does this actually have t= o > do with DoH? > I'm not sure why you reference BGP, when I specifically said, "... eg if DNS were properly considered a control plane rather than an application, even if only on the client-to-resolver side." Also, IS-IS is more generalized as AS-local rather than site-local (especially in two-level ISIS, where level-1 is typically the site-local component.) This is the ADD mailing list, not the DoH mailing list, i.e. applicable to any applications doing DNS (not DoH exclusively). So, things about DNS that may not be directly applicable to DoH, or to all DoH cases, could still be relevant and interesting (e.g. DoH to local resolvers rather than to centralized quad-X resolvers). DNS client-to-resolver, when provided over DHCP, is frequently (but not always) site-local or AS-local, and may also involve forwarders and resolvers in RFC 1918 space. RFC 1918 is used specifically to avoid being globally routable, but leads to potential conflicting addressing schemes. This RFC 1918 usage might not be needed if another substrate is substituted, which could be site-local or AS-local, but still globally unique. I.e. fixes some of the issues on naming and discovery, which is an entire topic area for ADD. I.e. this might have the potential to actually solve some of the problems that are being discussed here in ADD currently. Brian > > Sent from my iPhone > > > On Aug 14, 2019, at 11:18 AM, Brian Dickson < > brian.peter.dickson@gmail.com> wrote: > > > > =EF=BB=BF > > > > Sent from my iPhone > > > >>> On Aug 14, 2019, at 8:58 AM, Joe Abley wrote: > >>> > >>>> On 14 Aug 2019, at 05:53, Andrew Campling > wrote: > >>> > >>> Surely this is a moot point as, unfortunately, the was the DoH > standard has been defined, the network admin (and indeed the device admin > if he/she is different) is not able to determine whether they wish to > support the protocol. > >> > >> "Wish to support the protocol" is a telling phrase. > >> > >> The Internet architecture in the opinions of some (I am one) succeeded > where other architectures had failed specifically because it did not > incorporate access control in the network; it was, in David Isenberg's > words, stupid. This was in stark contrast to the so-called intelligent > networks of phone companies that sought to control the applications and > services that could be provided over the pair of copper or synchronous > timeslot made available to a user. > >> > >> The Internet dispensed with centralised control over toplogy, routing, > and (I think importantly) introduced layers that separated not just > concepts but responsibility and freedom. The kind of innovation visible t= o > end-users on the Internet happens on the edge, high up in the stack, not = in > the network. > >> > >> When I hear network administrators (I am one) talk about the ability t= o > constrain abuse in circumstances where they have responsibility for the > devices that they forward packets for, I do not (until now) hear a genera= l > expectation of being able to support particular protocols. They are > conceptually different, even though many implementations of the former > today involve the latter. I think this is important. > > > > One interesting observation about layers and protocols, is the > difference between routing protocols that run on top of IP and those with > their own protocol number. One example of the latter is ISIS, an IGP very > similar to OSPF. The operational experience with the former (eg BGP and > OSPF) and ISIS shows the benefits of having distinct substrates for the > control plane, where it is possible. BGP and OSPF eventually had to add > defense mechanisms against in-band attacks (eg MD5 and TTL mechanisms), > while ISIS was unaffected (AFAIK at least). > > > > It is interesting to consider what possible benefits there might have > been or might be in separation of other control planes from the IP data > plane, eg if DNS were properly considered a control plane rather than an > application, even if only on the client-to-resolver side. > > > > Brian > > > >> > >> If we lose sight of this core principle of the architecture of the > network, history suggests it will be replaced by something else. What > happened a short number of decades ago was that the phone network became = a > transport for a new network (leaving the voice network to be relegated to > one of many applications that run on top). Perhaps, in microcosm, the ide= a > that the network can contain and control one very specific service, that = of > name resolution, has spawned a very similar outcome. > >> > >> > >> Joe > > > > -- > > Add mailing list > > Add@ietf.org > > https://www.ietf.org/mailman/listinfo/add > --000000000000b579800590186875 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Wed, Aug 14, 2019 at 2:26 PM Ted L= emon <mellon@fugue.com> wrote= :
Isn=E2=80=99t = the big difference here that IS-IS is site-local and BGP is not?=C2=A0 =C2= =A0Why would it be interesting to consider?=C2=A0 What does this actually h= ave to do with DoH?

I'm not sure wh= y you reference BGP, when I specifically said, "... eg if DNS were pro= perly considered a control plane rather than an application, even if only o= n the client-to-resolver side."

Also, IS-IS i= s more generalized as AS-local rather than site-local (especially in two-le= vel ISIS, where level-1 is typically the site-local component.)
<= br>
This is the ADD mailing list, not the DoH mailing list, i.e. = applicable to any applications doing DNS (not DoH exclusively). So, things = about DNS that may not be directly applicable to DoH, or to all DoH cases, = could still be relevant and interesting (e.g. DoH to local resolvers rather= than to centralized quad-X resolvers).

DNS client= -to-resolver, when provided over DHCP, is frequently (but not always) site-= local or AS-local, and may also involve forwarders and resolvers in RFC 191= 8 space. RFC 1918 is used specifically to avoid being globally routable, bu= t leads to potential conflicting addressing schemes. This RFC 1918 usage mi= ght not be needed if another substrate is substituted, which could be site-= local or AS-local, but still globally unique. I.e. fixes some of the issues= on naming and discovery, which is an entire topic area for ADD.
=
I.e. this might have the potential to actually solve some of= the problems that are being discussed here in ADD currently.
Brian
=C2=A0

Sent from my iPhone

> On Aug 14, 2019, at 11:18 AM, Brian Dickson <brian.peter.dickson@gmail.com<= /a>> wrote:
>
> =EF=BB=BF
>
> Sent from my iPhone
>
>>> On Aug 14, 2019, at 8:58 AM, Joe Abley <jabley@hopcount.ca> wrote:
>>>
>>>> On 14 Aug 2019, at 05:53, Andrew Campling <andrew.campl= ing@419.consulting> wrote:
>>>
>>> Surely this is a moot point as, unfortunately, the was the DoH= standard has been defined, the network admin (and indeed the device admin = if he/she is different) is not able to determine whether they wish to suppo= rt the protocol.
>>
>> "Wish to support the protocol" is a telling phrase.
>>
>> The Internet architecture in the opinions of some (I am one) succe= eded where other architectures had failed specifically because it did not i= ncorporate access control in the network; it was, in David Isenberg's w= ords, stupid. This was in stark contrast to the so-called intelligent netwo= rks of phone companies that sought to control the applications and services= that could be provided over the pair of copper or synchronous timeslot mad= e available to a user.
>>
>> The Internet dispensed with centralised control over toplogy, rout= ing, and (I think importantly) introduced layers that separated not just co= ncepts but responsibility and freedom. The kind of innovation visible to en= d-users on the Internet happens on the edge, high up in the stack, not in t= he network.
>>
>> When I hear network administrators (I am one) talk about the abili= ty to constrain abuse in circumstances where they have responsibility for t= he devices that they forward packets for, I do not (until now) hear a gener= al expectation of being able to support particular protocols. They are conc= eptually different, even though many implementations of the former today in= volve the latter. I think this is important.
>
> One interesting observation about layers and protocols, is the differe= nce between routing protocols that run on top of IP and those with their ow= n protocol number. One example of the latter is ISIS, an IGP very similar t= o OSPF. The operational experience with the former (eg BGP and OSPF) and IS= IS shows the benefits of having distinct substrates for the control plane, = where it is possible. BGP and OSPF eventually had to add defense mechanisms= against in-band attacks (eg MD5 and TTL mechanisms), while ISIS was unaffe= cted (AFAIK at least).
>
> It is interesting to consider what possible benefits there might have = been or might be in separation of other control planes from the IP data pla= ne, eg if DNS were properly considered a control plane rather than an appli= cation, even if only on the client-to-resolver side.
>
> Brian
>
>>
>> If we lose sight of this core principle of the architecture of the= network, history suggests it will be replaced by something else. What happ= ened a short number of decades ago was that the phone network became a tran= sport for a new network (leaving the voice network to be relegated to one o= f many applications that run on top). Perhaps, in microcosm, the idea that = the network can contain and control one very specific service, that of name= resolution, has spawned a very similar outcome.
>>
>>
>> Joe
>
> --
> Add mailing list
> Add@ietf.org
> https://www.ietf.org/mailman/listinfo/add
--000000000000b579800590186875-- From nobody Wed Aug 14 12:15:53 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4C54B120DFA for ; Wed, 14 Aug 2019 12:15:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sytFmshlawlt for ; Wed, 14 Aug 2019 12:15:50 -0700 (PDT) Received: from mail-ot1-x32a.google.com (mail-ot1-x32a.google.com [IPv6:2607:f8b0:4864:20::32a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 11700120DF2 for ; Wed, 14 Aug 2019 12:15:50 -0700 (PDT) Received: by mail-ot1-x32a.google.com with SMTP id g17so624653otl.2 for ; Wed, 14 Aug 2019 12:15:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=content-transfer-encoding:from:mime-version:subject:date:message-id :references:cc:in-reply-to:to; bh=D/Ulg3neZp5l/EPe/VWgwfZ8PPjDOrKJIO5rda+HZfY=; b=KmUS5zLjWiJEka0D++zDxxGVB6yErs3alhAvuEkZDWWdgR4xkW69j7XjwNGXn/+yfL mtMq2pVER2hztE7Vjh9IhoU09hqY9SkNUGOE0dTwsqILF0/DhS+QM6iMO5If46FasyDr 3sr/uTjFWUMYxfBdUm3RP5Eovpw7q34aO6oAUVwlQI2oWnyvOOTtT2yLbXVToMPb8mky dbEmFdrbpT8Ftz/bwc7UnFsa/vaO0nz7Huw07yksaWt4Xr8pVkQZckOlt7ZOR8E2Zmbz EI8gFjBiOJI6tw/o/7QGeJqYV0TN0v/50tgbH956yEuOXNRqEcLsuOU03lS7nW+7Cc6+ aiNg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:content-transfer-encoding:from:mime-version :subject:date:message-id:references:cc:in-reply-to:to; bh=D/Ulg3neZp5l/EPe/VWgwfZ8PPjDOrKJIO5rda+HZfY=; b=sir5/pBU6TAi5CVfxN9PGi9Flfl0yvc6kFAjV4RJ89PiaAZsaoinFtxyRas1vZiK/I rvjQd0WXWCn06mFWSQNIG/MSdOu8Kdf/QBX+Q4Pasdx5rDen8dVnFcmopwwcgcfp674P 4Jwn2dtkSFOMKScDFZ6MWrRbBrpSBYM0CnUCqCHaDO0l1lBtD7gtE9+piPmwcRP+DHdK ZKj19eSr18z3Nos3GxVkUU2ZvaZBh/0A3G6uYOeJbNuiCDLrg5fmT6pP2d7p8jvpnPWN z+Y+fh61+bb1fkTiIwGn8zo96EaGIvMW0mzSYES0EmyvDHhtLBCXAqFGBG7WlZi+vNtA FWgA== X-Gm-Message-State: APjAAAVooFiYzOkPZxH8fVVMK4dCtJfeg0ULypxLKSWS6S02F5nFTcIA PdeX1nCkrVtlrIeEwc3EVyOr7k9yTFs= X-Google-Smtp-Source: APXvYqx2uz3Q9gAq/2A95I64m36cdp3BVVQRCoaDf9jIeYSXOhEpdzQneJH/DjQzbj0DxegJ5LmC0g== X-Received: by 2002:a5d:8447:: with SMTP id w7mr1539264ior.197.1565810149238; Wed, 14 Aug 2019 12:15:49 -0700 (PDT) Received: from ?IPv6:2600:380:6856:535:489b:8f1b:6c23:e032? ([2600:380:6856:535:489b:8f1b:6c23:e032]) by smtp.gmail.com with ESMTPSA id l26sm1034592ioj.24.2019.08.14.12.15.48 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Wed, 14 Aug 2019 12:15:48 -0700 (PDT) Content-Type: multipart/alternative; boundary=Apple-Mail-5524A759-865C-4512-B43B-93B6277D9C7B Content-Transfer-Encoding: 7bit From: Ted Lemon Mime-Version: 1.0 (1.0) Date: Wed, 14 Aug 2019 14:15:47 -0500 Message-Id: <8F020632-E171-4C9B-9729-16A2D36834BD@fugue.com> References: Cc: Joe Abley , Andrew Campling , ADD Mailing list , Bret Jordan , Stephen Farrell In-Reply-To: To: Brian Dickson X-Mailer: iPhone Mail (17A815) Archived-At: Subject: Re: [Add] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 14 Aug 2019 19:15:52 -0000 --Apple-Mail-5524A759-865C-4512-B43B-93B6277D9C7B Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Okay, I think I see what you are saying. You are thinking of the DNS as bein= g something that is really specific to an administrative domain rather than a= global database? Sent from my iPhone > On Aug 14, 2019, at 2:03 PM, Brian Dickson = wrote: >=20 > =EF=BB=BF >=20 >=20 >> On Wed, Aug 14, 2019 at 2:26 PM Ted Lemon wrote: >> Isn=E2=80=99t the big difference here that IS-IS is site-local and BGP is= not? Why would it be interesting to consider? What does this actually ha= ve to do with DoH? >=20 > I'm not sure why you reference BGP, when I specifically said, "... eg if D= NS were properly considered a control plane rather than an application, even= if only on the client-to-resolver side." >=20 > Also, IS-IS is more generalized as AS-local rather than site-local (especi= ally in two-level ISIS, where level-1 is typically the site-local component.= ) >=20 > This is the ADD mailing list, not the DoH mailing list, i.e. applicable to= any applications doing DNS (not DoH exclusively). So, things about DNS that= may not be directly applicable to DoH, or to all DoH cases, could still be r= elevant and interesting (e.g. DoH to local resolvers rather than to centrali= zed quad-X resolvers). >=20 > DNS client-to-resolver, when provided over DHCP, is frequently (but not al= ways) site-local or AS-local, and may also involve forwarders and resolvers i= n RFC 1918 space. RFC 1918 is used specifically to avoid being globally rout= able, but leads to potential conflicting addressing schemes. This RFC 1918 u= sage might not be needed if another substrate is substituted, which could be= site-local or AS-local, but still globally unique. I.e. fixes some of the i= ssues on naming and discovery, which is an entire topic area for ADD. >=20 > I.e. this might have the potential to actually solve some of the problems t= hat are being discussed here in ADD currently. >=20 > Brian > =20 >>=20 >> Sent from my iPhone >>=20 >> > On Aug 14, 2019, at 11:18 AM, Brian Dickson wrote: >> >=20 >> > =EF=BB=BF >> >=20 >> > Sent from my iPhone >> >=20 >> >>> On Aug 14, 2019, at 8:58 AM, Joe Abley wrote: >> >>>=20 >> >>>> On 14 Aug 2019, at 05:53, Andrew Campling wrote: >> >>>=20 >> >>> Surely this is a moot point as, unfortunately, the was the DoH standa= rd has been defined, the network admin (and indeed the device admin if he/sh= e is different) is not able to determine whether they wish to support the pr= otocol. >> >>=20 >> >> "Wish to support the protocol" is a telling phrase. >> >>=20 >> >> The Internet architecture in the opinions of some (I am one) succeeded= where other architectures had failed specifically because it did not incorp= orate access control in the network; it was, in David Isenberg's words, stup= id. This was in stark contrast to the so-called intelligent networks of phon= e companies that sought to control the applications and services that could b= e provided over the pair of copper or synchronous timeslot made available to= a user. >> >>=20 >> >> The Internet dispensed with centralised control over toplogy, routing,= and (I think importantly) introduced layers that separated not just concept= s but responsibility and freedom. The kind of innovation visible to end-user= s on the Internet happens on the edge, high up in the stack, not in the netw= ork. >> >>=20 >> >> When I hear network administrators (I am one) talk about the ability t= o constrain abuse in circumstances where they have responsibility for the de= vices that they forward packets for, I do not (until now) hear a general exp= ectation of being able to support particular protocols. They are conceptuall= y different, even though many implementations of the former today involve th= e latter. I think this is important. >> >=20 >> > One interesting observation about layers and protocols, is the differen= ce between routing protocols that run on top of IP and those with their own p= rotocol number. One example of the latter is ISIS, an IGP very similar to OS= PF. The operational experience with the former (eg BGP and OSPF) and ISIS sh= ows the benefits of having distinct substrates for the control plane, where i= t is possible. BGP and OSPF eventually had to add defense mechanisms against= in-band attacks (eg MD5 and TTL mechanisms), while ISIS was unaffected (AFA= IK at least). >> >=20 >> > It is interesting to consider what possible benefits there might have b= een or might be in separation of other control planes from the IP data plane= , eg if DNS were properly considered a control plane rather than an applicat= ion, even if only on the client-to-resolver side. >> >=20 >> > Brian >> >=20 >> >>=20 >> >> If we lose sight of this core principle of the architecture of the net= work, history suggests it will be replaced by something else. What happened a= short number of decades ago was that the phone network became a transport f= or a new network (leaving the voice network to be relegated to one of many a= pplications that run on top). Perhaps, in microcosm, the idea that the netwo= rk can contain and control one very specific service, that of name resolutio= n, has spawned a very similar outcome. >> >>=20 >> >>=20 >> >> Joe >> >=20 >> > --=20 >> > Add mailing list >> > Add@ietf.org >> > https://www.ietf.org/mailman/listinfo/add --Apple-Mail-5524A759-865C-4512-B43B-93B6277D9C7B Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable Okay, I think I see what you are saying. Yo= u are thinking of the DNS as being something that is really specific to an a= dministrative domain rather than a global database?

Sent from my iPhone

On A= ug 14, 2019, at 2:03 PM, Brian Dickson <brian.peter.dickson@gmail.com>= wrote:

=EF=BB=BF


On Wed, Aug 14, 2019 at 2:26 P= M Ted Lemon <mellon@fugue.com>= wrote:
Isn=E2=80=99= t the big difference here that IS-IS is site-local and BGP is not?  &nb= sp;Why would it be interesting to consider?  What does this actually ha= ve to do with DoH?

I'm not sure why you r= eference BGP, when I specifically said, "... eg if DNS were properly conside= red a control plane rather than an application, even if only on the client-t= o-resolver side."

Also, IS-IS is more generalized a= s AS-local rather than site-local (especially in two-level ISIS, where level= -1 is typically the site-local component.)

This is t= he ADD mailing list, not the DoH mailing list, i.e. applicable to any applic= ations doing DNS (not DoH exclusively). So, things about DNS that may not be= directly applicable to DoH, or to all DoH cases, could still be relevant an= d interesting (e.g. DoH to local resolvers rather than to centralized quad-X= resolvers).

DNS client-to-resolver, when provided o= ver DHCP, is frequently (but not always) site-local or AS-local, and may als= o involve forwarders and resolvers in RFC 1918 space. RFC 1918 is used speci= fically to avoid being globally routable, but leads to potential conflicting= addressing schemes. This RFC 1918 usage might not be needed if another subs= trate is substituted, which could be site-local or AS-local, but still globa= lly unique. I.e. fixes some of the issues on naming and discovery, which is a= n entire topic area for ADD.

I.e. this might have t= he potential to actually solve some of the problems that are being discussed= here in ADD currently.

Brian
 

Sent from my iPhone

> On Aug 14, 2019, at 11:18 AM, Brian Dickson <brian.peter.dickson@gmail.com> wrote:
>
> =EF=BB=BF
>
> Sent from my iPhone
>
>>> On Aug 14, 2019, at 8:58 AM, Joe Abley <jabley@hopcount.ca> wrote:
>>>
>>>> On 14 Aug 2019, at 05:53, Andrew Campling <andrew.campli= ng@419.consulting> wrote:
>>>
>>> Surely this is a moot point as, unfortunately, the was the DoH s= tandard has been defined, the network admin (and indeed the device admin if h= e/she is different) is not able to determine whether they wish to support th= e protocol.
>>
>> "Wish to support the protocol" is a telling phrase.
>>
>> The Internet architecture in the opinions of some (I am one) succee= ded where other architectures had failed specifically because it did not inc= orporate access control in the network; it was, in David Isenberg's words, s= tupid. This was in stark contrast to the so-called intelligent networks of p= hone companies that sought to control the applications and services that cou= ld be provided over the pair of copper or synchronous timeslot made availabl= e to a user.
>>
>> The Internet dispensed with centralised control over toplogy, routi= ng, and (I think importantly) introduced layers that separated not just conc= epts but responsibility and freedom. The kind of innovation visible to end-u= sers on the Internet happens on the edge, high up in the stack, not in the n= etwork.
>>
>> When I hear network administrators (I am one) talk about the abilit= y to constrain abuse in circumstances where they have responsibility for the= devices that they forward packets for, I do not (until now) hear a general e= xpectation of being able to support particular protocols. They are conceptua= lly different, even though many implementations of the former today involve t= he latter. I think this is important.
>
> One interesting observation about layers and protocols, is the differen= ce between routing protocols that run on top of IP and those with their own p= rotocol number. One example of the latter is ISIS, an IGP very similar to OS= PF. The operational experience with the former (eg BGP and OSPF) and ISIS sh= ows the benefits of having distinct substrates for the control plane, where i= t is possible. BGP and OSPF eventually had to add defense mechanisms against= in-band attacks (eg MD5 and TTL mechanisms), while ISIS was unaffected (AFA= IK at least).
>
> It is interesting to consider what possible benefits there might have b= een or might be in separation of other control planes from the IP data plane= , eg if DNS were properly considered a control plane rather than an applicat= ion, even if only on the client-to-resolver side.
>
> Brian
>
>>
>> If we lose sight of this core principle of the architecture of the n= etwork, history suggests it will be replaced by something else. What happene= d a short number of decades ago was that the phone network became a transpor= t for a new network (leaving the voice network to be relegated to one of man= y applications that run on top). Perhaps, in microcosm, the idea that the ne= twork can contain and control one very specific service, that of name resolu= tion, has spawned a very similar outcome.
>>
>>
>> Joe
>
> --
> Add mailing list
> Add@ietf.org
> https://www.ietf.org/mailman/listinfo/add
= --Apple-Mail-5524A759-865C-4512-B43B-93B6277D9C7B-- From nobody Wed Aug 14 12:38:55 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6C168120886 for ; Wed, 14 Aug 2019 12:38:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8ULT5m1DrECo for ; Wed, 14 Aug 2019 12:38:50 -0700 (PDT) Received: from mail-ua1-x936.google.com (mail-ua1-x936.google.com [IPv6:2607:f8b0:4864:20::936]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2D7FA120863 for ; Wed, 14 Aug 2019 12:38:50 -0700 (PDT) Received: by mail-ua1-x936.google.com with SMTP id g13so2989uap.5 for ; Wed, 14 Aug 2019 12:38:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=j2CUFLWVvJYGesUGOQ6ZBl17UjriKJye3K21JqQontE=; b=L0R2DdHMSmyIMRGrY6qnxR0yGlj9eapuJptsgr9ZLp+JzIjf4HlohCXSi7RAsmR2XS waRRLDqHOigv2GYogqhE9ORCCmYaC6SFq8MYw2gn+NVRRy8iZTnxLYPM+hjkC3an1V6J 8lbgsQfq2vQENGwnaida0bTn15G4FpmdhU6mrXovQefadkRaKwfCRSmDmZ72dbcsu7Tv kQYYubefJto1EbYZ8X8KzqgF8wsY1OPaDrcAU/kPppEQnYkHQk103XnCnsCcjwCC7Tg3 u2WrNkeZcsFaKCwRMJ+tOqgIUWTFWWccDZvguG1MPAi3iLZbBZZJwZxOCCcJD9UlADD4 UbMg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=j2CUFLWVvJYGesUGOQ6ZBl17UjriKJye3K21JqQontE=; b=ftp5Ow6K0TLxWI2mOuWyygT9xdYREoQeGd/42MmfbVHZTcyIb1Fd0vhVJy9iX8E/Cl z4I/lCUsEnUGPRisz+dszYMT7CPZdq2NmWiqvuNmvLtWAiigIH/lebwMFfBewExodo9f CYGhS1CuV30SCeoIhWkNEtMS8IuXqw0gRqvXeB4JLMnU4J3LU+olvkcmypFR7BnLaszv Cwo4ZdNEC1MR7ALsfPVL7UFN6cwfQItQ7i9/w0uTALENOd5v6NBIH51xUiVrTCgV42wY 1JxE3Pmev9mwyBpmkHhjfo62MGKx0nnkdlryhaZ9w+o0ffkZbFhm00GNysNQhtdi0AOC K7Uw== X-Gm-Message-State: APjAAAVVnMlj/09vUwrebBckEXi6IcFr+zqKDEv3eo4FQxhoxNDzJM+e zmp5tswjaEvaG55idsFGRt44neL8um+E/GEF1Jg= X-Google-Smtp-Source: APXvYqzjIDSX8ZUTTsdsXChc45/pkKYQjnmTABcWmJCPAtwLttyTgV08Tjwcqprnh4OBBjEC456zwBoWLLK8vGrRjd4= X-Received: by 2002:ab0:7515:: with SMTP id m21mr1008756uap.114.1565811529148; Wed, 14 Aug 2019 12:38:49 -0700 (PDT) MIME-Version: 1.0 References: <8F020632-E171-4C9B-9729-16A2D36834BD@fugue.com> In-Reply-To: <8F020632-E171-4C9B-9729-16A2D36834BD@fugue.com> From: Brian Dickson Date: Wed, 14 Aug 2019 15:38:28 -0400 Message-ID: To: Ted Lemon Cc: Joe Abley , Andrew Campling , ADD Mailing list , Bret Jordan , Stephen Farrell Content-Type: multipart/alternative; boundary="000000000000faec79059018e731" Archived-At: Subject: Re: [Add] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 14 Aug 2019 19:38:54 -0000 --000000000000faec79059018e731 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Wed, Aug 14, 2019 at 3:15 PM Ted Lemon wrote: > Okay, I think I see what you are saying. You are thinking of the DNS as > being something that is really specific to an administrative domain rathe= r > than a global database? > The DNS is both a distributed database (I'm not suggesting thinking of that any differently), and a database look-up and caching system involving recursive resolvers (necessary to achieve performance at scale). I'm thinking specifically of the latter on the client-to-resolver piece as being specific to an administrative domain when configured via an appropriate mechanism (DHCP, or pushed via enterprise policy engines), and not necessarily exclusively so. In addition to the benefits previously mentioned, there are avenues of attack for poisoning resolvers which rely on the stateless nature of UDP for client-to-resolver. Those avenues would go away. DNSSEC is great, but until it is more widely deployed on the authority side, and validated on clients, there is a big gap, which will continue to exist for a long time IMHO. Brian > > Sent from my iPhone > > On Aug 14, 2019, at 2:03 PM, Brian Dickson > wrote: > > =EF=BB=BF > > > On Wed, Aug 14, 2019 at 2:26 PM Ted Lemon wrote: > >> Isn=E2=80=99t the big difference here that IS-IS is site-local and BGP i= s not? >> Why would it be interesting to consider? What does this actually have = to >> do with DoH? >> > > I'm not sure why you reference BGP, when I specifically said, "... eg if > DNS were properly considered a control plane rather than an application, > even if only on the client-to-resolver side." > > Also, IS-IS is more generalized as AS-local rather than site-local > (especially in two-level ISIS, where level-1 is typically the site-local > component.) > > This is the ADD mailing list, not the DoH mailing list, i.e. applicable t= o > any applications doing DNS (not DoH exclusively). So, things about DNS th= at > may not be directly applicable to DoH, or to all DoH cases, could still b= e > relevant and interesting (e.g. DoH to local resolvers rather than to > centralized quad-X resolvers). > > DNS client-to-resolver, when provided over DHCP, is frequently (but not > always) site-local or AS-local, and may also involve forwarders and > resolvers in RFC 1918 space. RFC 1918 is used specifically to avoid being > globally routable, but leads to potential conflicting addressing schemes. > This RFC 1918 usage might not be needed if another substrate is > substituted, which could be site-local or AS-local, but still globally > unique. I.e. fixes some of the issues on naming and discovery, which is a= n > entire topic area for ADD. > > I.e. this might have the potential to actually solve some of the problems > that are being discussed here in ADD currently. > > Brian > > >> >> Sent from my iPhone >> >> > On Aug 14, 2019, at 11:18 AM, Brian Dickson < >> brian.peter.dickson@gmail.com> wrote: >> > >> > =EF=BB=BF >> > >> > Sent from my iPhone >> > >> >>> On Aug 14, 2019, at 8:58 AM, Joe Abley wrote: >> >>> >> >>>> On 14 Aug 2019, at 05:53, Andrew Campling >> wrote: >> >>> >> >>> Surely this is a moot point as, unfortunately, the was the DoH >> standard has been defined, the network admin (and indeed the device admi= n >> if he/she is different) is not able to determine whether they wish to >> support the protocol. >> >> >> >> "Wish to support the protocol" is a telling phrase. >> >> >> >> The Internet architecture in the opinions of some (I am one) succeede= d >> where other architectures had failed specifically because it did not >> incorporate access control in the network; it was, in David Isenberg's >> words, stupid. This was in stark contrast to the so-called intelligent >> networks of phone companies that sought to control the applications and >> services that could be provided over the pair of copper or synchronous >> timeslot made available to a user. >> >> >> >> The Internet dispensed with centralised control over toplogy, routing= , >> and (I think importantly) introduced layers that separated not just >> concepts but responsibility and freedom. The kind of innovation visible = to >> end-users on the Internet happens on the edge, high up in the stack, not= in >> the network. >> >> >> >> When I hear network administrators (I am one) talk about the ability >> to constrain abuse in circumstances where they have responsibility for t= he >> devices that they forward packets for, I do not (until now) hear a gener= al >> expectation of being able to support particular protocols. They are >> conceptually different, even though many implementations of the former >> today involve the latter. I think this is important. >> > >> > One interesting observation about layers and protocols, is the >> difference between routing protocols that run on top of IP and those wit= h >> their own protocol number. One example of the latter is ISIS, an IGP ver= y >> similar to OSPF. The operational experience with the former (eg BGP and >> OSPF) and ISIS shows the benefits of having distinct substrates for the >> control plane, where it is possible. BGP and OSPF eventually had to add >> defense mechanisms against in-band attacks (eg MD5 and TTL mechanisms), >> while ISIS was unaffected (AFAIK at least). >> > >> > It is interesting to consider what possible benefits there might have >> been or might be in separation of other control planes from the IP data >> plane, eg if DNS were properly considered a control plane rather than an >> application, even if only on the client-to-resolver side. >> > >> > Brian >> > >> >> >> >> If we lose sight of this core principle of the architecture of the >> network, history suggests it will be replaced by something else. What >> happened a short number of decades ago was that the phone network became= a >> transport for a new network (leaving the voice network to be relegated t= o >> one of many applications that run on top). Perhaps, in microcosm, the id= ea >> that the network can contain and control one very specific service, that= of >> name resolution, has spawned a very similar outcome. >> >> >> >> >> >> Joe >> > >> > -- >> > Add mailing list >> > Add@ietf.org >> > https://www.ietf.org/mailman/listinfo/add >> > --000000000000faec79059018e731 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Wed, Aug 14, 2019 at 3:15 PM Ted L= emon <mellon@fugue.com> wrote= :
Okay, I think I see what you are saying. You are thinking of the DNS as= being something that is really specific to an administrative domain rather= than a global database?

The DNS is b= oth a distributed database (I'm not suggesting thinking of that any dif= ferently), and a database look-up and caching system involving recursive re= solvers (necessary to achieve performance at scale).
I'm thin= king specifically of the latter on the client-to-resolver piece as being sp= ecific to an administrative domain when configured via an appropriate mecha= nism (DHCP, or pushed via enterprise policy engines), and not necessarily e= xclusively so.

In addition to the benefits previou= sly mentioned, there are avenues of attack for poisoning resolvers which re= ly on the stateless nature of UDP for client-to-resolver. Those avenues wou= ld go away.

DNSSEC is great, but until it is more = widely deployed on the authority side, and validated on clients, there is a= big gap, which will continue to exist for a long time IMHO.

=
Brian
=C2=A0

Sent from my iPho= ne

On Aug 14, 2019, at = 2:03 PM, Brian Dickson <brian.peter.dickson@gmail.com> wrote:

=EF=BB=BF


On Wed, Aug 14, 2019 at 2:26 PM Ted Lemon <= ;mellon@fugue.com= > wrote:
Isn= =E2=80=99t the big difference here that IS-IS is site-local and BGP is not?= =C2=A0 =C2=A0Why would it be interesting to consider?=C2=A0 What does this = actually have to do with DoH?

I'm n= ot sure why you reference BGP, when I specifically said, "... eg if DN= S were properly considered a control plane rather than an application, even= if only on the client-to-resolver side."

Als= o, IS-IS is more generalized as AS-local rather than site-local (especially= in two-level ISIS, where level-1 is typically the site-local component.)

This is the ADD mailing list, not the DoH mailing l= ist, i.e. applicable to any applications doing DNS (not DoH exclusively). S= o, things about DNS that may not be directly applicable to DoH, or to all D= oH cases, could still be relevant and interesting (e.g. DoH to local resolv= ers rather than to centralized quad-X resolvers).

= DNS client-to-resolver, when provided over DHCP, is frequently (but not alw= ays) site-local or AS-local, and may also involve forwarders and resolvers = in RFC 1918 space. RFC 1918 is used specifically to avoid being globally ro= utable, but leads to potential conflicting addressing schemes. This RFC 191= 8 usage might not be needed if another substrate is substituted, which coul= d be site-local or AS-local, but still globally unique. I.e. fixes some of = the issues on naming and discovery, which is an entire topic area for ADD.<= /div>

I.e. this might have the potential to actually sol= ve some of the problems that are being discussed here in ADD currently.

Brian
=C2=A0

Sent from my iPhone

> On Aug 14, 2019, at 11:18 AM, Brian Dickson <brian.peter.dickson@gmail.com<= /a>> wrote:
>
> =EF=BB=BF
>
> Sent from my iPhone
>
>>> On Aug 14, 2019, at 8:58 AM, Joe Abley <jabley@hopcount.ca> wrote:
>>>
>>>> On 14 Aug 2019, at 05:53, Andrew Campling <andrew.campl= ing@419.consulting> wrote:
>>>
>>> Surely this is a moot point as, unfortunately, the was the DoH= standard has been defined, the network admin (and indeed the device admin = if he/she is different) is not able to determine whether they wish to suppo= rt the protocol.
>>
>> "Wish to support the protocol" is a telling phrase.
>>
>> The Internet architecture in the opinions of some (I am one) succe= eded where other architectures had failed specifically because it did not i= ncorporate access control in the network; it was, in David Isenberg's w= ords, stupid. This was in stark contrast to the so-called intelligent netwo= rks of phone companies that sought to control the applications and services= that could be provided over the pair of copper or synchronous timeslot mad= e available to a user.
>>
>> The Internet dispensed with centralised control over toplogy, rout= ing, and (I think importantly) introduced layers that separated not just co= ncepts but responsibility and freedom. The kind of innovation visible to en= d-users on the Internet happens on the edge, high up in the stack, not in t= he network.
>>
>> When I hear network administrators (I am one) talk about the abili= ty to constrain abuse in circumstances where they have responsibility for t= he devices that they forward packets for, I do not (until now) hear a gener= al expectation of being able to support particular protocols. They are conc= eptually different, even though many implementations of the former today in= volve the latter. I think this is important.
>
> One interesting observation about layers and protocols, is the differe= nce between routing protocols that run on top of IP and those with their ow= n protocol number. One example of the latter is ISIS, an IGP very similar t= o OSPF. The operational experience with the former (eg BGP and OSPF) and IS= IS shows the benefits of having distinct substrates for the control plane, = where it is possible. BGP and OSPF eventually had to add defense mechanisms= against in-band attacks (eg MD5 and TTL mechanisms), while ISIS was unaffe= cted (AFAIK at least).
>
> It is interesting to consider what possible benefits there might have = been or might be in separation of other control planes from the IP data pla= ne, eg if DNS were properly considered a control plane rather than an appli= cation, even if only on the client-to-resolver side.
>
> Brian
>
>>
>> If we lose sight of this core principle of the architecture of the= network, history suggests it will be replaced by something else. What happ= ened a short number of decades ago was that the phone network became a tran= sport for a new network (leaving the voice network to be relegated to one o= f many applications that run on top). Perhaps, in microcosm, the idea that = the network can contain and control one very specific service, that of name= resolution, has spawned a very similar outcome.
>>
>>
>> Joe
>
> --
> Add mailing list
> Add@ietf.org
> https://www.ietf.org/mailman/listinfo/add
--000000000000faec79059018e731-- From nobody Wed Aug 14 12:44:43 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 94306120E68 for ; Wed, 14 Aug 2019 12:44:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id g9oBN-f9O3V5 for ; Wed, 14 Aug 2019 12:44:38 -0700 (PDT) Received: from mail-ot1-x335.google.com (mail-ot1-x335.google.com [IPv6:2607:f8b0:4864:20::335]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1F56A120E71 for ; Wed, 14 Aug 2019 12:44:38 -0700 (PDT) Received: by mail-ot1-x335.google.com with SMTP id c7so847182otp.1 for ; Wed, 14 Aug 2019 12:44:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=content-transfer-encoding:from:mime-version:subject:date:message-id :references:cc:in-reply-to:to; bh=Wa2EXU322D7CoR77nQtvA6CMftuRFbttPy3oN+qdtlg=; b=YEt2CGMtRvsuFcaEPDIsWvIdi3JSOzm0+SOZZUH3CAc6uA7c4Faq1N3t7GOUtyIxNO +wwsYaMOpdubEvemRAOy91Yu2iNPYERUDScYqPU1PtFi0ht0RXEcKC74z8eqxy/Et3c0 LS5QRbh4jzLIWtNHD++DLuUEwL2YRHfSBH27ZQiNyDww/nJ6QEtytHk3i6MPZ/vHDubq DYOHCowumEvIwS/276HZjHDTXw8SblvCOL38PSfCVN1yiJGPHd7RCWgO5rSm3ULAhPq+ XW6yU1nrzFCRfoEfVtYZfk6cbsWaoQbNH8A/DR0GWpI0aDJV6DKHgmDOPKTVk+me0bdA isKg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:content-transfer-encoding:from:mime-version :subject:date:message-id:references:cc:in-reply-to:to; bh=Wa2EXU322D7CoR77nQtvA6CMftuRFbttPy3oN+qdtlg=; b=OJmgVY9YMkS7rNvnrSRIC30dxsn1QAt+GAsZogtOdYS6cD9yBT+SZuEtsTsAgyu55v 4JFN+FWvgNwsENaL4pMHnj5Hm7is7REOyuDsZAfeiH0dyhM3O1JrC7fbiO9bq5STIECO 6EW8Sb8DOtUNVb8gBqf572bN/7ZE2yHeEMY3qqlk15EE618I5z20G7qpGVHzBucWLYRY nkOHOebqTgqDjnmCVLflzOzkEBLoz+zjlQPv19U+xIZQs4uMeMcO34uJz5cr0IdgOcsI Rd0tlEhrd92oMh/WiuFr7ZkB55yhhxXXB0fSh0n95aQ367Sdfye52azqDzjgbAmQF4d3 KbOQ== X-Gm-Message-State: APjAAAVxkP1T0RVu3EOIzi81NKS5in44jq+Vj9muPVwxzNAn92tiP5IQ XCxvKaHwSBA4CQCnt3ibANDj1w== X-Google-Smtp-Source: APXvYqxDbTlxVB7cXJ2GMalMl071ZTp9k1TMvIeAVjajUd9QrbqF6kZU/YN4xS9FGD4hMrIwPIy29A== X-Received: by 2002:a5d:8c81:: with SMTP id g1mr1609562ion.239.1565811877308; Wed, 14 Aug 2019 12:44:37 -0700 (PDT) Received: from ?IPv6:2600:380:6856:535:489b:8f1b:6c23:e032? ([2600:380:6856:535:489b:8f1b:6c23:e032]) by smtp.gmail.com with ESMTPSA id p3sm499444iom.7.2019.08.14.12.44.36 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Wed, 14 Aug 2019 12:44:36 -0700 (PDT) Content-Type: multipart/alternative; boundary=Apple-Mail-44DA1A75-8D3D-413D-9FDF-1BE195F230D0 Content-Transfer-Encoding: 7bit From: Ted Lemon Mime-Version: 1.0 (1.0) Date: Wed, 14 Aug 2019 14:44:36 -0500 Message-Id: <8DCBAD7A-E9B7-4086-A5CE-C24C4E9ABFD5@fugue.com> References: Cc: Joe Abley , Andrew Campling , ADD Mailing list , Bret Jordan , Stephen Farrell In-Reply-To: To: Brian Dickson X-Mailer: iPhone Mail (17A815) Archived-At: Subject: Re: [Add] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 14 Aug 2019 19:44:41 -0000 --Apple-Mail-44DA1A75-8D3D-413D-9FDF-1BE195F230D0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Okay, I hear what you are saying, but you don=E2=80=99t seem to be adding an= ything new. We=E2=80=99ve already talked about this model. This is essentia= lly what Joe was talking about a few messages ago: do you want a POTS-like n= etwork or a permissionless (dumb) network? I get the sense that you kind of want both. That=E2=80=99s going to be hard.= I don=E2=80=99t think we know how to do it.=20 Sent from my iPhone > On Aug 14, 2019, at 2:38 PM, Brian Dickson = wrote: >=20 > =EF=BB=BF >=20 >=20 >> On Wed, Aug 14, 2019 at 3:15 PM Ted Lemon wrote: >> Okay, I think I see what you are saying. You are thinking of the DNS as b= eing something that is really specific to an administrative domain rather th= an a global database? >=20 > The DNS is both a distributed database (I'm not suggesting thinking of tha= t any differently), and a database look-up and caching system involving recu= rsive resolvers (necessary to achieve performance at scale). > I'm thinking specifically of the latter on the client-to-resolver piece as= being specific to an administrative domain when configured via an appropria= te mechanism (DHCP, or pushed via enterprise policy engines), and not necess= arily exclusively so. >=20 > In addition to the benefits previously mentioned, there are avenues of att= ack for poisoning resolvers which rely on the stateless nature of UDP for cl= ient-to-resolver. Those avenues would go away. >=20 > DNSSEC is great, but until it is more widely deployed on the authority sid= e, and validated on clients, there is a big gap, which will continue to exis= t for a long time IMHO. >=20 > Brian > =20 >>=20 >> Sent from my iPhone >>=20 >>>> On Aug 14, 2019, at 2:03 PM, Brian Dickson wrote: >>>>=20 >>> =EF=BB=BF >>>=20 >>>=20 >>>> On Wed, Aug 14, 2019 at 2:26 PM Ted Lemon wrote: >>>> Isn=E2=80=99t the big difference here that IS-IS is site-local and BGP i= s not? Why would it be interesting to consider? What does this actually h= ave to do with DoH? >>>=20 >>> I'm not sure why you reference BGP, when I specifically said, "... eg if= DNS were properly considered a control plane rather than an application, ev= en if only on the client-to-resolver side." >>>=20 >>> Also, IS-IS is more generalized as AS-local rather than site-local (espe= cially in two-level ISIS, where level-1 is typically the site-local componen= t.) >>>=20 >>> This is the ADD mailing list, not the DoH mailing list, i.e. applicable t= o any applications doing DNS (not DoH exclusively). So, things about DNS tha= t may not be directly applicable to DoH, or to all DoH cases, could still be= relevant and interesting (e.g. DoH to local resolvers rather than to centra= lized quad-X resolvers). >>>=20 >>> DNS client-to-resolver, when provided over DHCP, is frequently (but not a= lways) site-local or AS-local, and may also involve forwarders and resolvers= in RFC 1918 space. RFC 1918 is used specifically to avoid being globally ro= utable, but leads to potential conflicting addressing schemes. This RFC 1918= usage might not be needed if another substrate is substituted, which could b= e site-local or AS-local, but still globally unique. I.e. fixes some of the i= ssues on naming and discovery, which is an entire topic area for ADD. >>>=20 >>> I.e. this might have the potential to actually solve some of the problem= s that are being discussed here in ADD currently. >>>=20 >>> Brian >>> =20 >>>>=20 >>>> Sent from my iPhone >>>>=20 >>>> > On Aug 14, 2019, at 11:18 AM, Brian Dickson wrote: >>>> >=20 >>>> > =EF=BB=BF >>>> >=20 >>>> > Sent from my iPhone >>>> >=20 >>>> >>> On Aug 14, 2019, at 8:58 AM, Joe Abley wrote: >>>> >>>=20 >>>> >>>> On 14 Aug 2019, at 05:53, Andrew Campling wrote: >>>> >>>=20 >>>> >>> Surely this is a moot point as, unfortunately, the was the DoH stan= dard has been defined, the network admin (and indeed the device admin if he/= she is different) is not able to determine whether they wish to support the p= rotocol. >>>> >>=20 >>>> >> "Wish to support the protocol" is a telling phrase. >>>> >>=20 >>>> >> The Internet architecture in the opinions of some (I am one) succeed= ed where other architectures had failed specifically because it did not inco= rporate access control in the network; it was, in David Isenberg's words, st= upid. This was in stark contrast to the so-called intelligent networks of ph= one companies that sought to control the applications and services that coul= d be provided over the pair of copper or synchronous timeslot made available= to a user. >>>> >>=20 >>>> >> The Internet dispensed with centralised control over toplogy, routin= g, and (I think importantly) introduced layers that separated not just conce= pts but responsibility and freedom. The kind of innovation visible to end-us= ers on the Internet happens on the edge, high up in the stack, not in the ne= twork. >>>> >>=20 >>>> >> When I hear network administrators (I am one) talk about the ability= to constrain abuse in circumstances where they have responsibility for the d= evices that they forward packets for, I do not (until now) hear a general ex= pectation of being able to support particular protocols. They are conceptual= ly different, even though many implementations of the former today involve t= he latter. I think this is important. >>>> >=20 >>>> > One interesting observation about layers and protocols, is the differ= ence between routing protocols that run on top of IP and those with their ow= n protocol number. One example of the latter is ISIS, an IGP very similar to= OSPF. The operational experience with the former (eg BGP and OSPF) and ISIS= shows the benefits of having distinct substrates for the control plane, whe= re it is possible. BGP and OSPF eventually had to add defense mechanisms aga= inst in-band attacks (eg MD5 and TTL mechanisms), while ISIS was unaffected (= AFAIK at least). >>>> >=20 >>>> > It is interesting to consider what possible benefits there might have= been or might be in separation of other control planes from the IP data pla= ne, eg if DNS were properly considered a control plane rather than an applic= ation, even if only on the client-to-resolver side. >>>> >=20 >>>> > Brian >>>> >=20 >>>> >>=20 >>>> >> If we lose sight of this core principle of the architecture of the n= etwork, history suggests it will be replaced by something else. What happene= d a short number of decades ago was that the phone network became a transpor= t for a new network (leaving the voice network to be relegated to one of man= y applications that run on top). Perhaps, in microcosm, the idea that the ne= twork can contain and control one very specific service, that of name resolu= tion, has spawned a very similar outcome. >>>> >>=20 >>>> >>=20 >>>> >> Joe >>>> >=20 >>>> > --=20 >>>> > Add mailing list >>>> > Add@ietf.org >>>> > https://www.ietf.org/mailman/listinfo/add --Apple-Mail-44DA1A75-8D3D-413D-9FDF-1BE195F230D0 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable Okay, I hear what you are saying, but you d= on=E2=80=99t seem to be adding anything new. We=E2=80=99ve already talked ab= out this model.  This is essentially what Joe was talking about a few m= essages ago: do you want a POTS-like network or a permissionless (dumb) netw= ork?

I get the sense that you kind of want both. That=E2=80= =99s going to be hard. I don=E2=80=99t think we know how to do it. 
=
Sent from my iPhone

On Aug 14, 2019, at 2:38 PM, Brian Dickson <brian.peter.= dickson@gmail.com> wrote:

=EF=BB=BF

<= br>
On Wed, A= ug 14, 2019 at 3:15 PM Ted Lemon <mel= lon@fugue.com> wrote:
Okay, I think I see what you are saying. You ar= e thinking of the DNS as being something that is really specific to an admin= istrative domain rather than a global database?

<= /div>
The DNS is both a distributed database (I'm not suggesting thinkin= g of that any differently), and a database look-up and caching system involv= ing recursive resolvers (necessary to achieve performance at scale).
I'm thinking specifically of the latter on the client-to-resolver piece a= s being specific to an administrative domain when configured via an appropri= ate mechanism (DHCP, or pushed via enterprise policy engines), and not neces= sarily exclusively so.

In addition to the benefits p= reviously mentioned, there are avenues of attack for poisoning resolvers whi= ch rely on the stateless nature of UDP for client-to-resolver. Those avenues= would go away.

DNSSEC is great, but until it is mo= re widely deployed on the authority side, and validated on clients, there is= a big gap, which will continue to exist for a long time IMHO.
Brian
 

Sent from my iPhone=

On Aug 14, 2019, at 2:0= 3 PM, Brian Dickson <brian.peter.dickson@gmail.com> wrote:

=EF=BB=BF


On Wed, Aug 14, 2019 at 2:26 PM Ted Lemon <mellon@fugue.com> wrot= e:
Isn=E2=80=99t t= he big difference here that IS-IS is site-local and BGP is not?   = Why would it be interesting to consider?  What does this actually have t= o do with DoH?

I'm not sure why you refe= rence BGP, when I specifically said, "... eg if DNS were properly considered= a control plane rather than an application, even if only on the client-to-r= esolver side."

Also, IS-IS is more generalized as A= S-local rather than site-local (especially in two-level ISIS, where level-1 i= s typically the site-local component.)

This is the A= DD mailing list, not the DoH mailing list, i.e. applicable to any applicatio= ns doing DNS (not DoH exclusively). So, things about DNS that may not be dir= ectly applicable to DoH, or to all DoH cases, could still be relevant and in= teresting (e.g. DoH to local resolvers rather than to centralized quad-X res= olvers).

DNS client-to-resolver, when provided over= DHCP, is frequently (but not always) site-local or AS-local, and may also i= nvolve forwarders and resolvers in RFC 1918 space. RFC 1918 is used specific= ally to avoid being globally routable, but leads to potential conflicting ad= dressing schemes. This RFC 1918 usage might not be needed if another substra= te is substituted, which could be site-local or AS-local, but still globally= unique. I.e. fixes some of the issues on naming and discovery, which is an e= ntire topic area for ADD.

I.e. this might have the p= otential to actually solve some of the problems that are being discussed her= e in ADD currently.

Brian
 

Sent from my iPhone

> On Aug 14, 2019, at 11:18 AM, Brian Dickson <brian.peter.dickson@gmail.com> wrote:
>
> =EF=BB=BF
>
> Sent from my iPhone
>
>>> On Aug 14, 2019, at 8:58 AM, Joe Abley <jabley@hopcount.ca> wrote:
>>>
>>>> On 14 Aug 2019, at 05:53, Andrew Campling <andrew.campli= ng@419.consulting> wrote:
>>>
>>> Surely this is a moot point as, unfortunately, the was the DoH s= tandard has been defined, the network admin (and indeed the device admin if h= e/she is different) is not able to determine whether they wish to support th= e protocol.
>>
>> "Wish to support the protocol" is a telling phrase.
>>
>> The Internet architecture in the opinions of some (I am one) succee= ded where other architectures had failed specifically because it did not inc= orporate access control in the network; it was, in David Isenberg's words, s= tupid. This was in stark contrast to the so-called intelligent networks of p= hone companies that sought to control the applications and services that cou= ld be provided over the pair of copper or synchronous timeslot made availabl= e to a user.
>>
>> The Internet dispensed with centralised control over toplogy, routi= ng, and (I think importantly) introduced layers that separated not just conc= epts but responsibility and freedom. The kind of innovation visible to end-u= sers on the Internet happens on the edge, high up in the stack, not in the n= etwork.
>>
>> When I hear network administrators (I am one) talk about the abilit= y to constrain abuse in circumstances where they have responsibility for the= devices that they forward packets for, I do not (until now) hear a general e= xpectation of being able to support particular protocols. They are conceptua= lly different, even though many implementations of the former today involve t= he latter. I think this is important.
>
> One interesting observation about layers and protocols, is the differen= ce between routing protocols that run on top of IP and those with their own p= rotocol number. One example of the latter is ISIS, an IGP very similar to OS= PF. The operational experience with the former (eg BGP and OSPF) and ISIS sh= ows the benefits of having distinct substrates for the control plane, where i= t is possible. BGP and OSPF eventually had to add defense mechanisms against= in-band attacks (eg MD5 and TTL mechanisms), while ISIS was unaffected (AFA= IK at least).
>
> It is interesting to consider what possible benefits there might have b= een or might be in separation of other control planes from the IP data plane= , eg if DNS were properly considered a control plane rather than an applicat= ion, even if only on the client-to-resolver side.
>
> Brian
>
>>
>> If we lose sight of this core principle of the architecture of the n= etwork, history suggests it will be replaced by something else. What happene= d a short number of decades ago was that the phone network became a transpor= t for a new network (leaving the voice network to be relegated to one of man= y applications that run on top). Perhaps, in microcosm, the idea that the ne= twork can contain and control one very specific service, that of name resolu= tion, has spawned a very similar outcome.
>>
>>
>> Joe
>
> --
> Add mailing list
> Add@ietf.org
> https://www.ietf.org/mailman/listinfo/add
= --Apple-Mail-44DA1A75-8D3D-413D-9FDF-1BE195F230D0-- From nobody Wed Aug 14 13:01:20 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6D742120E83 for ; Wed, 14 Aug 2019 13:01:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.997 X-Spam-Level: X-Spam-Status: No, score=-0.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, FREEMAIL_REPLY=1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mTBN1X932ucD for ; Wed, 14 Aug 2019 13:01:15 -0700 (PDT) Received: from mail-pl1-x62d.google.com (mail-pl1-x62d.google.com [IPv6:2607:f8b0:4864:20::62d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B0A96120E88 for ; Wed, 14 Aug 2019 13:01:15 -0700 (PDT) Received: by mail-pl1-x62d.google.com with SMTP id y1so73700plp.9 for ; Wed, 14 Aug 2019 13:01:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:mime-version:subject:date:references:to:in-reply-to:message-id; bh=xxEenTbs3fvbLtbUxaZh4wJbgu/TqQtsc88W3GQoLJY=; b=kMjbFb/4McntjrWL6nxjIfxChr2VyNVQBY8ChjDGUNkXa0/5Vm5eBtwx/ZNDzyx3ON lonSR57xxL6juIIvqfwhJOmsG8pxDkIUCIBRBrXD6MITCMfrBgy7+qMvZ1Vpk7uftTQp JVyir2mwSxdGJsQwV0T0NveIBSG3VpmDhH7FIumOWtw7bntwBqZd1UBM7Q4dzClk0nUO gaP8K2pHAmN1mpmHUwYqSjfoG8QycXHpNp1umwnkk6JYDAy5cbA6gC9dCsFl4uMPFb+L DXWHzCcMkwpk9+n73/cIthgz5muAk6v1STp/o/LQPrPxqtzGImlGH3DT8Gye/GOaAlnT FvqQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:mime-version:subject:date:references:to :in-reply-to:message-id; bh=xxEenTbs3fvbLtbUxaZh4wJbgu/TqQtsc88W3GQoLJY=; b=pb3IVgiHSd4Dq6XDPPjqbdspRnQI3Knf/2E2PA4xDYiitOHE6tKmfHNQC1xqNmMWm8 QDLYYK8tlpr3A06O1SaDlRsWDGXtwvr5qqpST8M/AwfgmY1q6OATvVkIbEEMzaERdyp4 OYYVqFjGthqffuY6POENioWPUbqng4eAaavVF7pNPNAOVVIO1KZMZhX5jAL/lj9uH2xX p1pmqjVFL5SNDdYtjayJJ5DESrtgsbWdg02jF1oB7sw88y3VsLcPmVeqRU2Lw56YaYIN rCmbbtWORbwNeK1clhVVx/mF/2Z7dr/QPgciMvzfl6fhrlHM9pbEbQ6rSCL0wfQqOD9l UvXA== X-Gm-Message-State: APjAAAVw1L5/NkSThZwtBDXgAXXWVOLhcHGfZp1b0nZYkqHdRvRMd6Vf gOTeQ0PMxvuS1giZXete2Xveta5c X-Google-Smtp-Source: APXvYqwESC2LPScZBxosnKOlO1pHfw2vRNmRWseaUf2QpUpFThvgzpdeagJZEljJNAOZmU+Rojegsg== X-Received: by 2002:a17:902:bb8e:: with SMTP id m14mr1006244pls.107.1565812874717; Wed, 14 Aug 2019 13:01:14 -0700 (PDT) Received: from [10.128.64.149] ([136.60.227.81]) by smtp.gmail.com with ESMTPSA id j12sm628425pff.4.2019.08.14.13.01.13 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 14 Aug 2019 13:01:13 -0700 (PDT) From: Bret Jordan Content-Type: multipart/alternative; boundary="Apple-Mail=_2CB61548-ECD0-402A-B61C-0F0DD51B7D24" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Wed, 14 Aug 2019 14:01:11 -0600 References: <8DCBAD7A-E9B7-4086-A5CE-C24C4E9ABFD5@fugue.com> To: ADD Mailing list In-Reply-To: <8DCBAD7A-E9B7-4086-A5CE-C24C4E9ABFD5@fugue.com> Message-Id: <34CB2826-D309-4DBC-AE4D-1C0650A54221@gmail.com> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 14 Aug 2019 20:01:19 -0000 --Apple-Mail=_2CB61548-ECD0-402A-B61C-0F0DD51B7D24 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 It is not just about adding something new to the discussion, but getting = a feel for and understanding all of the use cases in and around this. I = feel like Brian is doing a great job talking through these points and = find his comments to be right on point.=20 Thanks, Bret PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 "Without cryptography vihv vivc ce xhrnrw, however, the only thing that = can not be unscrambled is an egg." > On Aug 14, 2019, at 1:44 PM, Ted Lemon wrote: >=20 > Okay, I hear what you are saying, but you don=E2=80=99t seem to be = adding anything new. We=E2=80=99ve already talked about this model. = This is essentially what Joe was talking about a few messages ago: do = you want a POTS-like network or a permissionless (dumb) network? >=20 > I get the sense that you kind of want both. That=E2=80=99s going to be = hard. I don=E2=80=99t think we know how to do it.=20 >=20 > Sent from my iPhone >=20 >> On Aug 14, 2019, at 2:38 PM, Brian Dickson = wrote: >>=20 >> =EF=BB=BF >>=20 >>=20 >> On Wed, Aug 14, 2019 at 3:15 PM Ted Lemon > wrote: >> Okay, I think I see what you are saying. You are thinking of the DNS = as being something that is really specific to an administrative domain = rather than a global database? >>=20 >> The DNS is both a distributed database (I'm not suggesting thinking = of that any differently), and a database look-up and caching system = involving recursive resolvers (necessary to achieve performance at = scale). >> I'm thinking specifically of the latter on the client-to-resolver = piece as being specific to an administrative domain when configured via = an appropriate mechanism (DHCP, or pushed via enterprise policy = engines), and not necessarily exclusively so. >>=20 >> In addition to the benefits previously mentioned, there are avenues = of attack for poisoning resolvers which rely on the stateless nature of = UDP for client-to-resolver. Those avenues would go away. >>=20 >> DNSSEC is great, but until it is more widely deployed on the = authority side, and validated on clients, there is a big gap, which will = continue to exist for a long time IMHO. >>=20 >> Brian >> =20 >>=20 >> Sent from my iPhone >>=20 >>> On Aug 14, 2019, at 2:03 PM, Brian Dickson = > = wrote: >>>=20 >>> =EF=BB=BF >>>=20 >>>=20 >>> On Wed, Aug 14, 2019 at 2:26 PM Ted Lemon > wrote: >>> Isn=E2=80=99t the big difference here that IS-IS is site-local and = BGP is not? Why would it be interesting to consider? What does this = actually have to do with DoH? >>>=20 >>> I'm not sure why you reference BGP, when I specifically said, "... = eg if DNS were properly considered a control plane rather than an = application, even if only on the client-to-resolver side." >>>=20 >>> Also, IS-IS is more generalized as AS-local rather than site-local = (especially in two-level ISIS, where level-1 is typically the site-local = component.) >>>=20 >>> This is the ADD mailing list, not the DoH mailing list, i.e. = applicable to any applications doing DNS (not DoH exclusively). So, = things about DNS that may not be directly applicable to DoH, or to all = DoH cases, could still be relevant and interesting (e.g. DoH to local = resolvers rather than to centralized quad-X resolvers). >>>=20 >>> DNS client-to-resolver, when provided over DHCP, is frequently (but = not always) site-local or AS-local, and may also involve forwarders and = resolvers in RFC 1918 space. RFC 1918 is used specifically to avoid = being globally routable, but leads to potential conflicting addressing = schemes. This RFC 1918 usage might not be needed if another substrate is = substituted, which could be site-local or AS-local, but still globally = unique. I.e. fixes some of the issues on naming and discovery, which is = an entire topic area for ADD. >>>=20 >>> I.e. this might have the potential to actually solve some of the = problems that are being discussed here in ADD currently. >>>=20 >>> Brian >>> =20 >>>=20 >>> Sent from my iPhone >>>=20 >>> > On Aug 14, 2019, at 11:18 AM, Brian Dickson = > = wrote: >>> >=20 >>> > =EF=BB=BF >>> >=20 >>> > Sent from my iPhone >>> >=20 >>> >>> On Aug 14, 2019, at 8:58 AM, Joe Abley > wrote: >>> >>>=20 >>> >>>> On 14 Aug 2019, at 05:53, Andrew Campling = wrote: >>> >>>=20 >>> >>> Surely this is a moot point as, unfortunately, the was the DoH = standard has been defined, the network admin (and indeed the device = admin if he/she is different) is not able to determine whether they wish = to support the protocol. >>> >>=20 >>> >> "Wish to support the protocol" is a telling phrase. >>> >>=20 >>> >> The Internet architecture in the opinions of some (I am one) = succeeded where other architectures had failed specifically because it = did not incorporate access control in the network; it was, in David = Isenberg's words, stupid. This was in stark contrast to the so-called = intelligent networks of phone companies that sought to control the = applications and services that could be provided over the pair of copper = or synchronous timeslot made available to a user. >>> >>=20 >>> >> The Internet dispensed with centralised control over toplogy, = routing, and (I think importantly) introduced layers that separated not = just concepts but responsibility and freedom. The kind of innovation = visible to end-users on the Internet happens on the edge, high up in the = stack, not in the network. >>> >>=20 >>> >> When I hear network administrators (I am one) talk about the = ability to constrain abuse in circumstances where they have = responsibility for the devices that they forward packets for, I do not = (until now) hear a general expectation of being able to support = particular protocols. They are conceptually different, even though many = implementations of the former today involve the latter. I think this is = important. >>> >=20 >>> > One interesting observation about layers and protocols, is the = difference between routing protocols that run on top of IP and those = with their own protocol number. One example of the latter is ISIS, an = IGP very similar to OSPF. The operational experience with the former (eg = BGP and OSPF) and ISIS shows the benefits of having distinct substrates = for the control plane, where it is possible. BGP and OSPF eventually had = to add defense mechanisms against in-band attacks (eg MD5 and TTL = mechanisms), while ISIS was unaffected (AFAIK at least). >>> >=20 >>> > It is interesting to consider what possible benefits there might = have been or might be in separation of other control planes from the IP = data plane, eg if DNS were properly considered a control plane rather = than an application, even if only on the client-to-resolver side. >>> >=20 >>> > Brian >>> >=20 >>> >>=20 >>> >> If we lose sight of this core principle of the architecture of = the network, history suggests it will be replaced by something else. = What happened a short number of decades ago was that the phone network = became a transport for a new network (leaving the voice network to be = relegated to one of many applications that run on top). Perhaps, in = microcosm, the idea that the network can contain and control one very = specific service, that of name resolution, has spawned a very similar = outcome. >>> >>=20 >>> >>=20 >>> >> Joe >>> >=20 >>> > --=20 >>> > Add mailing list >>> > Add@ietf.org >>> > https://www.ietf.org/mailman/listinfo/add = --Apple-Mail=_2CB61548-ECD0-402A-B61C-0F0DD51B7D24 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 It = is not just about adding something new to the discussion, but getting a = feel for and understanding all of the use cases in and around this. I = feel like Brian is doing a great job talking through these points and = find his comments to be right on point. 


Thanks,
Bret
PGP = Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 = 0050
"Without = cryptography vihv vivc ce xhrnrw, however, the only thing that can not = be unscrambled is an = egg."

On Aug 14, 2019, at 1:44 PM, Ted Lemon <mellon@fugue.com> = wrote:

Okay, I hear what you are = saying, but you don=E2=80=99t seem to be adding anything new. We=E2=80=99v= e already talked about this model.  This is essentially what Joe = was talking about a few messages ago: do you want a POTS-like network or = a permissionless (dumb) network?

I get the sense that you kind of want both. That=E2=80=99s = going to be hard. I don=E2=80=99t think we know how to do it. 

Sent from my = iPhone

On Aug 14, 2019, at 2:38 PM, Brian Dickson = <brian.peter.dickson@gmail.com> wrote:

=EF=BB=BF


On Wed, Aug = 14, 2019 at 3:15 PM Ted Lemon <mellon@fugue.com> wrote:
Okay, I think I see what you are saying. You are thinking of = the DNS as being something that is really specific to an administrative = domain rather than a global database?

The DNS is both a = distributed database (I'm not suggesting thinking of that any = differently), and a database look-up and caching system involving = recursive resolvers (necessary to achieve performance at = scale).
I'm thinking specifically of the latter on = the client-to-resolver piece as being specific to an administrative = domain when configured via an appropriate mechanism (DHCP, or pushed via = enterprise policy engines), and not necessarily exclusively = so.

In = addition to the benefits previously mentioned, there are avenues of = attack for poisoning resolvers which rely on the stateless nature of UDP = for client-to-resolver. Those avenues would go away.

DNSSEC is great, but = until it is more widely deployed on the authority side, and validated on = clients, there is a big gap, which will continue to exist for a long = time IMHO.

Brian
 

Sent from my = iPhone

On Aug 14, 2019, at 2:03 PM, Brian Dickson = <brian.peter.dickson@gmail.com> wrote:

=EF=BB=BF


On Wed, Aug = 14, 2019 at 2:26 PM Ted Lemon <mellon@fugue.com> wrote:
Isn=E2=80=99t the big difference here = that IS-IS is site-local and BGP is not?   Why would it be = interesting to consider?  What does this actually have to do with = DoH?

I'm not sure why you reference BGP, when I specifically said, = "... eg if DNS were properly considered a control plane rather than an = application, even if only on the client-to-resolver side."

Also, IS-IS is more = generalized as AS-local rather than site-local (especially in two-level = ISIS, where level-1 is typically the site-local component.)

This is the ADD mailing = list, not the DoH mailing list, i.e. applicable to any applications = doing DNS (not DoH exclusively). So, things about DNS that may not be = directly applicable to DoH, or to all DoH cases, could still be relevant = and interesting (e.g. DoH to local resolvers rather than to centralized = quad-X resolvers).

DNS client-to-resolver, when provided over DHCP, is = frequently (but not always) site-local or AS-local, and may also involve = forwarders and resolvers in RFC 1918 space. RFC 1918 is used = specifically to avoid being globally routable, but leads to potential = conflicting addressing schemes. This RFC 1918 usage might not be needed = if another substrate is substituted, which could be site-local or = AS-local, but still globally unique. I.e. fixes some of the issues on = naming and discovery, which is an entire topic area for ADD.

I.e. this might have the = potential to actually solve some of the problems that are being = discussed here in ADD currently.

Brian
 

Sent from my iPhone

> On Aug 14, 2019, at 11:18 AM, Brian Dickson <brian.peter.dickson@gmail.com> wrote:
>
> =EF=BB=BF
>
> Sent from my iPhone
>
>>> On Aug 14, 2019, at 8:58 AM, Joe Abley <jabley@hopcount.ca> wrote:
>>>
>>>> On 14 Aug 2019, at 05:53, Andrew Campling <andrew.campling@419.consulting> wrote:
>>>
>>> Surely this is a moot point as, unfortunately, the was the = DoH standard has been defined, the network admin (and indeed the device = admin if he/she is different) is not able to determine whether they wish = to support the protocol.
>>
>> "Wish to support the protocol" is a telling phrase.
>>
>> The Internet architecture in the opinions of some (I am one) = succeeded where other architectures had failed specifically because it = did not incorporate access control in the network; it was, in David = Isenberg's words, stupid. This was in stark contrast to the so-called = intelligent networks of phone companies that sought to control the = applications and services that could be provided over the pair of copper = or synchronous timeslot made available to a user.
>>
>> The Internet dispensed with centralised control over toplogy, = routing, and (I think importantly) introduced layers that separated not = just concepts but responsibility and freedom. The kind of innovation = visible to end-users on the Internet happens on the edge, high up in the = stack, not in the network.
>>
>> When I hear network administrators (I am one) talk about the = ability to constrain abuse in circumstances where they have = responsibility for the devices that they forward packets for, I do not = (until now) hear a general expectation of being able to support = particular protocols. They are conceptually different, even though many = implementations of the former today involve the latter. I think this is = important.
>
> One interesting observation about layers and protocols, is the = difference between routing protocols that run on top of IP and those = with their own protocol number. One example of the latter is ISIS, an = IGP very similar to OSPF. The operational experience with the former (eg = BGP and OSPF) and ISIS shows the benefits of having distinct substrates = for the control plane, where it is possible. BGP and OSPF eventually had = to add defense mechanisms against in-band attacks (eg MD5 and TTL = mechanisms), while ISIS was unaffected (AFAIK at least).
>
> It is interesting to consider what possible benefits there might = have been or might be in separation of other control planes from the IP = data plane, eg if DNS were properly considered a control plane rather = than an application, even if only on the client-to-resolver side.
>
> Brian
>
>>
>> If we lose sight of this core principle of the architecture of = the network, history suggests it will be replaced by something else. = What happened a short number of decades ago was that the phone network = became a transport for a new network (leaving the voice network to be = relegated to one of many applications that run on top). Perhaps, in = microcosm, the idea that the network can contain and control one very = specific service, that of name resolution, has spawned a very similar = outcome.
>>
>>
>> Joe
>
> --
> Add mailing list
> Add@ietf.org
> https://www.ietf.org/mailman/listinfo/add

= --Apple-Mail=_2CB61548-ECD0-402A-B61C-0F0DD51B7D24-- From nobody Wed Aug 14 13:32:10 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3BD2A120F26 for ; Wed, 14 Aug 2019 13:32:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id y54XG8_hzl91 for ; Wed, 14 Aug 2019 13:32:07 -0700 (PDT) Received: from mail-ot1-x332.google.com (mail-ot1-x332.google.com [IPv6:2607:f8b0:4864:20::332]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E5C25120EC6 for ; Wed, 14 Aug 2019 13:32:06 -0700 (PDT) Received: by mail-ot1-x332.google.com with SMTP id e12so1035344otp.10 for ; Wed, 14 Aug 2019 13:32:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=content-transfer-encoding:from:mime-version:subject:date:message-id :references:cc:in-reply-to:to; bh=nKbVCtSlDnex47pgtcg1lfsQM5c9/ZeP+h9lIai2lG4=; b=Oda53SioDoCcaVjD0vfgYuxzTXjuss3A+ERhDMbh1MDSwSSq1lpQH/xRwIxWHCxf/4 csROnoblFRpmjDqUX5SeadpmwRWP3/tRvn1p1V9dwz5vQTX2uJTlgSDkRW8U2uVHaq7q wQ4NOlLLfuP89VQHwkrUpQXcA7774J3+FQyPOjk5+aUPipMfYo/jQFkLho4uJY2mqt53 i+iObWITHNQYQx5EKfa5qBZBDl08PSKNRm9FN3rxcPQNK8LKcVm46rHI1hOHlIOci8wI tZA4qUZ8BNIwcFwwQ1qTt75xYhnmp4RxHpC15tUdhrOcFvdPUX3fr2HWIDw8r0atuC+1 1T1Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:content-transfer-encoding:from:mime-version :subject:date:message-id:references:cc:in-reply-to:to; bh=nKbVCtSlDnex47pgtcg1lfsQM5c9/ZeP+h9lIai2lG4=; b=BNSar9tl6Ks1DYkOQREBIwuNpRN52qJVXvyb3vpL1LIZflL8fNsa3z2eXme5dRaJUk aHFEufDV6KAmYHWj1ngC6CFJZ6EZ2G//rV0DJ1EoDsCNixDvo/VS+DEzcRzdRgVwvO+N D3QNn6NqqSJkcBMonxqJv2tGbH4p7PXjvxznXzT6X+Z6zvOIZ775NJNEwmN0rU3P1DWo p1TFdHROSBkI7WL82pSi1ZFtg0KMGSww+tl5hxFP0D+JakKOB8rN7I0Mc4mNBlxyLQYc jp6JA/f4XEchJv7Q+Uc/y7sGfLpnaXaj0Kk4NHVEpOVqN5kYNZl7ftzO0P10kfNbv+aR r/Dw== X-Gm-Message-State: APjAAAU1C+GwT1UvARN9DcQQ3JbpxwfkBFMYTUwcvFq5Px7JUXCKSBYO YbR0roE2yyVN3FFRt+y0ngLcNSawGps= X-Google-Smtp-Source: APXvYqwghXfqMNVX1o9A42of5Zk9YVB+WuwlTskA7iKfequYeCTSHnqPekQTQN66fgGHLO2hSwVJxA== X-Received: by 2002:a6b:6b02:: with SMTP id g2mr1913607ioc.13.1565814725845; Wed, 14 Aug 2019 13:32:05 -0700 (PDT) Received: from ?IPv6:2600:380:6856:535:489b:8f1b:6c23:e032? ([2600:380:6856:535:489b:8f1b:6c23:e032]) by smtp.gmail.com with ESMTPSA id e12sm1319404iob.66.2019.08.14.13.32.04 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Wed, 14 Aug 2019 13:32:05 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable From: Ted Lemon Mime-Version: 1.0 (1.0) Date: Wed, 14 Aug 2019 15:32:03 -0500 Message-Id: References: <34CB2826-D309-4DBC-AE4D-1C0650A54221@gmail.com> Cc: ADD Mailing list In-Reply-To: <34CB2826-D309-4DBC-AE4D-1C0650A54221@gmail.com> To: Bret Jordan X-Mailer: iPhone Mail (17A815) Archived-At: Subject: Re: [Add] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 14 Aug 2019 20:32:08 -0000 On Aug 14, 2019, at 3:01 PM, Bret Jordan wrote: >=20 > =EF=BB=BFIt is not just about adding something new to the discussion, but g= etting a feel for and understanding all of the use cases in and around this.= I feel like Brian is doing a great job talking through these points and fin= d his comments to be right on point.=20 Out would probably help to be explicit about what you mean by =E2=80=9Cthis=E2= =80=9D above. I could theorize, but I=E2=80=99m asking all these obnoxious q= uestions because I=E2=80=99m trying to get clarity.=20= From nobody Wed Aug 14 16:47:15 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E1739120901 for ; Wed, 14 Aug 2019 16:47:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.199 X-Spam-Level: X-Spam-Status: No, score=-4.199 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sPh2b6yXspvi for ; Wed, 14 Aug 2019 16:47:12 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [IPv6:2607:f0b0:f:3:216:3eff:fe7c:d1f3]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DBC811208E6 for ; Wed, 14 Aug 2019 16:47:11 -0700 (PDT) Received: from sandelman.ca (obiwan.sandelman.ca [IPv6:2607:f0b0:f:2::247]) by tuna.sandelman.ca (Postfix) with ESMTP id CB8823818C for ; Wed, 14 Aug 2019 19:46:22 -0400 (EDT) Received: from localhost (localhost [IPv6:::1]) by sandelman.ca (Postfix) with ESMTP id E233DA8A for ; Wed, 14 Aug 2019 19:47:10 -0400 (EDT) From: Michael Richardson To: 'ADD Mailing list' In-Reply-To: References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> X-Mailer: MH-E 8.6; nmh 1.7+dev; GNU Emacs 24.5.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Date: Wed, 14 Aug 2019 19:47:10 -0400 Message-ID: <30657.1565826430@localhost> Archived-At: Subject: Re: [Add] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 14 Aug 2019 23:47:14 -0000 Stephen Farrell wrote: > For me, that means if a guest or other n/w user has > chosen an application that wants to do DoH with some > other recursive that's ok by me. I'd consider myself > inhospitable were I to want to control the DNS choices > of people in my home. In a similar vein, I do not > So the important point here is "my network, my rules" > does *not* imply "DoH is problematic." Agreed. > There are of course a bunch of specific policies that > some n/w admins do like for which DoH is problematic as > has been described already on this list. But we ought > not over-claim e.g. by asserting that liking DoH implies > disliking n/w administration. "Daddy, why can't I print from my LeapFrog?" -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works | IoT architect [ ] mcr@sandelman.ca http://www.sandelman.ca/ | ruby on rails [ From nobody Wed Aug 14 18:25:47 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B043412001A for ; Wed, 14 Aug 2019 18:25:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id otbhgxUbl857 for ; Wed, 14 Aug 2019 18:25:42 -0700 (PDT) Received: from mail-qt1-x82f.google.com (mail-qt1-x82f.google.com [IPv6:2607:f8b0:4864:20::82f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D95D5120019 for ; Wed, 14 Aug 2019 18:25:41 -0700 (PDT) Received: by mail-qt1-x82f.google.com with SMTP id u34so841744qte.2 for ; Wed, 14 Aug 2019 18:25:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=6vBQ6Ao1gwI/XI4zu+bx5TNfc+Kp2aXk/J/J+w2v+C4=; b=Fjzz8rzSKNeGSlN3VQ0Jv5w9oANDfkLJ4Wfnv6dZsbJPY3IsXzqiGRkz/eFKObBfl9 YScs8o625y2GFdvfcIUEx/jJXWw5qMrLv/jq66efjzEYReIzi6g8FOqKfTMwG3EK0DYL nJGL4EKkvXdA8E+cAuloiJpMNRbipVwNoxKf1Tk/+xm76+GHLXhQdmqkDopGavvzLNG9 DgpLUQ93iuwd1/pToAJ2klxVsNaoRvt3S3GG/vPipz/u5ucrLALuz+PH4Y2Ohj86VpEP sP6zMDYxjfoue7/R0VoJrqy5zYaMamXruscVLmlGaxUDbKMXeMqSixYH8OSb1Jcwrob9 C5SA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=6vBQ6Ao1gwI/XI4zu+bx5TNfc+Kp2aXk/J/J+w2v+C4=; b=GiJ+Xog1lE6hkkSBSEdtK3uYGIurFNPlUjUkrRysTKR/sx62icSt0SN1t1dOpA/rC/ kdECV5xaj0McroWNXgX8azFtplSfe1DxVCzMw8j1b94uE6hkMUBFRwL/tKs3v/5fDHrY 2ug/zfDOKSLDxutlEvm+iUE+Of0zkQ31D6XbbU2B7MQ+ONK0CnRD0/1CTxwy2rDOalP2 XWQvvq9cwb7fTw8DssPlnSa9IuR2Hs2Tv7rgCyCbuPEBFkUzhUY0ja71565w4Na2CYJm C3UXGNdNChXM7XwsO2ZvFS+XWbYtKpllNFgTOWpidQZ5a55+Q88JZ13tNxDRvFFLIDhP PXdA== X-Gm-Message-State: APjAAAXqDyKbmyvSTaWD0f5bnRp4RPhIRZmgmj+8kbcX6+laJYY65Xj/ gsz1UWzaHqxf+0HfMHSuT2E= X-Google-Smtp-Source: APXvYqwMU/LNyv+t50UJMsA1bsw7YJi+CN6tSqmcMQkWhVxQ69Eq0d/ppIFqqwLjBqHZ3CeaunIq6A== X-Received: by 2002:ac8:4a0d:: with SMTP id x13mr1899653qtq.356.1565832340986; Wed, 14 Aug 2019 18:25:40 -0700 (PDT) Received: from [192.168.2.18] (cpe-76-179-66-50.maine.res.rr.com. [76.179.66.50]) by smtp.gmail.com with ESMTPSA id x2sm706556qkc.92.2019.08.14.18.25.39 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 14 Aug 2019 18:25:40 -0700 (PDT) Content-Type: multipart/alternative; boundary=Apple-Mail-096FA908-B6D5-4BEF-B54E-25F530629307 Mime-Version: 1.0 (1.0) From: Brian Dickson X-Mailer: iPhone Mail (16G77) In-Reply-To: <8DCBAD7A-E9B7-4086-A5CE-C24C4E9ABFD5@fugue.com> Date: Wed, 14 Aug 2019 21:25:39 -0400 Cc: Joe Abley , Andrew Campling , ADD Mailing list , Bret Jordan , Stephen Farrell Content-Transfer-Encoding: 7bit Message-Id: References: <8DCBAD7A-E9B7-4086-A5CE-C24C4E9ABFD5@fugue.com> To: Ted Lemon Archived-At: Subject: Re: [Add] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 01:25:46 -0000 --Apple-Mail-096FA908-B6D5-4BEF-B54E-25F530629307 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Sent from my iPhone > On Aug 14, 2019, at 3:44 PM, Ted Lemon wrote: >=20 > Okay, I hear what you are saying, but you don=E2=80=99t seem to be adding a= nything new. We=E2=80=99ve already talked about this model. This is essenti= ally what Joe was talking about a few messages ago: do you want a POTS-like n= etwork or a permissionless (dumb) network? Nothing I was saying changes the nature of the networks in question, actuall= y. It would still be UDP/$foo or TCP/$foo, for some value of $foo. The netwo= rk is still connectionless, dumb, packet forwarding, just distinct from the f= ull global Internet. It could be IPv6 ULA, or (I think?) ES-IS, or any other= similarly behaved network. At least some of the options for this are feasible for any network to deploy= . Each operator would be free to do so with no issues of interoperability as= long as client support is available. The ULA one might interesting to try. >=20 > I get the sense that you kind of want both. That=E2=80=99s going to be har= d. I don=E2=80=99t think we know how to do it.=20 No, definitely not. I=E2=80=99m suggesting there would be value to operators= , with no coordination required. The scope would necessarily be limited, and= that is a feature rather than a bug. Preventing spoofed packets via transpo= rt limits rather than ACLs scales better, requires nearly no configuration, a= nd if a distinct substrate is used across administrative boundaries, is fool= proof. Brian >=20 > Sent from my iPhone >=20 >> On Aug 14, 2019, at 2:38 PM, Brian Dickson wrote: >>=20 >> =EF=BB=BF >>=20 >>=20 >>> On Wed, Aug 14, 2019 at 3:15 PM Ted Lemon wrote: >>> Okay, I think I see what you are saying. You are thinking of the DNS as b= eing something that is really specific to an administrative domain rather th= an a global database? >>=20 >> The DNS is both a distributed database (I'm not suggesting thinking of th= at any differently), and a database look-up and caching system involving rec= ursive resolvers (necessary to achieve performance at scale). >> I'm thinking specifically of the latter on the client-to-resolver piece a= s being specific to an administrative domain when configured via an appropri= ate mechanism (DHCP, or pushed via enterprise policy engines), and not neces= sarily exclusively so. >>=20 >> In addition to the benefits previously mentioned, there are avenues of at= tack for poisoning resolvers which rely on the stateless nature of UDP for c= lient-to-resolver. Those avenues would go away. >>=20 >> DNSSEC is great, but until it is more widely deployed on the authority si= de, and validated on clients, there is a big gap, which will continue to exi= st for a long time IMHO. >>=20 >> Brian >> =20 >>>=20 >>> Sent from my iPhone >>>=20 >>>> On Aug 14, 2019, at 2:03 PM, Brian Dickson wrote: >>>>=20 >>>> =EF=BB=BF >>>>=20 >>>>=20 >>>>> On Wed, Aug 14, 2019 at 2:26 PM Ted Lemon wrote: >>>>> Isn=E2=80=99t the big difference here that IS-IS is site-local and BGP= is not? Why would it be interesting to consider? What does this actually= have to do with DoH? >>>>=20 >>>> I'm not sure why you reference BGP, when I specifically said, "... eg i= f DNS were properly considered a control plane rather than an application, e= ven if only on the client-to-resolver side." >>>>=20 >>>> Also, IS-IS is more generalized as AS-local rather than site-local (esp= ecially in two-level ISIS, where level-1 is typically the site-local compone= nt.) >>>>=20 >>>> This is the ADD mailing list, not the DoH mailing list, i.e. applicable= to any applications doing DNS (not DoH exclusively). So, things about DNS t= hat may not be directly applicable to DoH, or to all DoH cases, could still b= e relevant and interesting (e.g. DoH to local resolvers rather than to centr= alized quad-X resolvers). >>>>=20 >>>> DNS client-to-resolver, when provided over DHCP, is frequently (but not= always) site-local or AS-local, and may also involve forwarders and resolve= rs in RFC 1918 space. RFC 1918 is used specifically to avoid being globally r= outable, but leads to potential conflicting addressing schemes. This RFC 191= 8 usage might not be needed if another substrate is substituted, which could= be site-local or AS-local, but still globally unique. I.e. fixes some of th= e issues on naming and discovery, which is an entire topic area for ADD. >>>>=20 >>>> I.e. this might have the potential to actually solve some of the proble= ms that are being discussed here in ADD currently. >>>>=20 >>>> Brian >>>> =20 >>>>>=20 >>>>> Sent from my iPhone >>>>>=20 >>>>> > On Aug 14, 2019, at 11:18 AM, Brian Dickson wrote: >>>>> >=20 >>>>> > =EF=BB=BF >>>>> >=20 >>>>> > Sent from my iPhone >>>>> >=20 >>>>> >>> On Aug 14, 2019, at 8:58 AM, Joe Abley wrote:= >>>>> >>>=20 >>>>> >>>> On 14 Aug 2019, at 05:53, Andrew Campling wrote: >>>>> >>>=20 >>>>> >>> Surely this is a moot point as, unfortunately, the was the DoH sta= ndard has been defined, the network admin (and indeed the device admin if he= /she is different) is not able to determine whether they wish to support the= protocol. >>>>> >>=20 >>>>> >> "Wish to support the protocol" is a telling phrase. >>>>> >>=20 >>>>> >> The Internet architecture in the opinions of some (I am one) succee= ded where other architectures had failed specifically because it did not inc= orporate access control in the network; it was, in David Isenberg's words, s= tupid. This was in stark contrast to the so-called intelligent networks of p= hone companies that sought to control the applications and services that cou= ld be provided over the pair of copper or synchronous timeslot made availabl= e to a user. >>>>> >>=20 >>>>> >> The Internet dispensed with centralised control over toplogy, routi= ng, and (I think importantly) introduced layers that separated not just conc= epts but responsibility and freedom. The kind of innovation visible to end-u= sers on the Internet happens on the edge, high up in the stack, not in the n= etwork. >>>>> >>=20 >>>>> >> When I hear network administrators (I am one) talk about the abilit= y to constrain abuse in circumstances where they have responsibility for the= devices that they forward packets for, I do not (until now) hear a general e= xpectation of being able to support particular protocols. They are conceptua= lly different, even though many implementations of the former today involve t= he latter. I think this is important. >>>>> >=20 >>>>> > One interesting observation about layers and protocols, is the diffe= rence between routing protocols that run on top of IP and those with their o= wn protocol number. One example of the latter is ISIS, an IGP very similar t= o OSPF. The operational experience with the former (eg BGP and OSPF) and ISI= S shows the benefits of having distinct substrates for the control plane, wh= ere it is possible. BGP and OSPF eventually had to add defense mechanisms ag= ainst in-band attacks (eg MD5 and TTL mechanisms), while ISIS was unaffected= (AFAIK at least). >>>>> >=20 >>>>> > It is interesting to consider what possible benefits there might hav= e been or might be in separation of other control planes from the IP data pl= ane, eg if DNS were properly considered a control plane rather than an appli= cation, even if only on the client-to-resolver side. >>>>> >=20 >>>>> > Brian >>>>> >=20 >>>>> >>=20 >>>>> >> If we lose sight of this core principle of the architecture of the n= etwork, history suggests it will be replaced by something else. What happene= d a short number of decades ago was that the phone network became a transpor= t for a new network (leaving the voice network to be relegated to one of man= y applications that run on top). Perhaps, in microcosm, the idea that the ne= twork can contain and control one very specific service, that of name resolu= tion, has spawned a very similar outcome. >>>>> >>=20 >>>>> >>=20 >>>>> >> Joe >>>>> >=20 >>>>> > --=20 >>>>> > Add mailing list >>>>> > Add@ietf.org >>>>> > https://www.ietf.org/mailman/listinfo/add --Apple-Mail-096FA908-B6D5-4BEF-B54E-25F530629307 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable

Sent from my iPhone

On Aug 14, 2019, at 3:44= PM, Ted Lemon <mellon@fugue.com&= gt; wrote:

Okay, I hear= what you are saying, but you don=E2=80=99t seem to be adding anything new. W= e=E2=80=99ve already talked about this model.  This is essentially what= Joe was talking about a few messages ago: do you want a POTS-like network o= r a permissionless (dumb) network?

Not= hing I was saying changes the nature of the networks in question, actually. I= t would still be UDP/$foo or TCP/$foo, for some value of $foo. The network i= s still connectionless, dumb, packet forwarding, just distinct from the full= global Internet. It could be IPv6 ULA, or (I think?) ES-IS, or any other si= milarly behaved network.

At least some of the optio= ns for this are feasible for any network to deploy. Each operator would be f= ree to do so with no issues of interoperability as long as client support is= available. The ULA one might interesting to try.


I get the sense that you kind of= want both. That=E2=80=99s going to be hard. I don=E2=80=99t think we know h= ow to do it. 

No, defin= itely not. I=E2=80=99m suggesting there would be value to operators, with no= coordination required. The scope would necessarily be limited, and that is a= feature rather than a bug. Preventing spoofed packets via transport limits r= ather than ACLs scales better, requires nearly no configuration, and if a di= stinct substrate is used across administrative boundaries, is foolproof.

Brian


Sent from my iPhone

=
On Aug 14, 2019, at 2:38 PM, Brian Dickson <brian.peter.dickson@gmail.com> wrote:

=EF=BB=BF


On Wed, Aug 14, 2019 at 3= :15 PM Ted Lemon <mellon@fugue.com> wrote:


In addition to the benefits previously mentioned= , there are avenues of attack for poisoning resolvers which rely on the stat= eless nature of UDP for client-to-resolver. Those avenues would go away.

DNSSEC is great, but until it is more widely deployed o= n the authority side, and validated on clients, there is a big gap, which wi= ll continue to exist for a long time IMHO.

Brian
 

Sent from my iPhone
=EF=BB=BF
<= br>

On Wed, Aug 14, 2019 at 2:26 PM Ted Lemon <mellon@fugue.com> wrote:
Isn=E2=80=99t the big difference her= e that IS-IS is site-local and BGP is not?   Why would it be inter= esting to consider?  What does this actually have to do with DoH?

I'm not sure why you reference BGP, when I sp= ecifically said, "... eg if DNS were properly considered a control plane rat= her than an application, even if only on the client-to-resolver side."
=

Also, IS-IS is more generalized as AS-local rather than s= ite-local (especially in two-level ISIS, where level-1 is typically the site= -local component.)

This is the ADD mailing list, no= t the DoH mailing list, i.e. applicable to any applications doing DNS (not D= oH exclusively). So, things about DNS that may not be directly applicable to= DoH, or to all DoH cases, could still be relevant and interesting (e.g. DoH= to local resolvers rather than to centralized quad-X resolvers).
=
DNS client-to-resolver, when provided over DHCP, is frequentl= y (but not always) site-local or AS-local, and may also involve forwarders a= nd resolvers in RFC 1918 space. RFC 1918 is used specifically to avoid being= globally routable, but leads to potential conflicting addressing schemes. T= his RFC 1918 usage might not be needed if another substrate is substituted, w= hich could be site-local or AS-local, but still globally unique. I.e. fixes s= ome of the issues on naming and discovery, which is an entire topic area for= ADD.

I.e. this might have the potential to actuall= y solve some of the problems that are being discussed here in ADD currently.=

Brian
 

Sent from my iPhone

> On Aug 14, 2019, at 11:18 AM, Brian Dickson <brian.peter.dickson@gmail.com> wrote:
>
> =EF=BB=BF
>
> Sent from my iPhone
>
>>> On Aug 14, 2019, at 8:58 AM, Joe Abley <jabley@hopcount.ca> wrote:
>>>
>>>> On 14 Aug 2019, at 05:53, Andrew Campling <andrew.campling@419.consulting> w= rote:
>>>
>>> Surely this is a moot point as, unfortunately, the was the DoH s= tandard has been defined, the network admin (and indeed the device admin if h= e/she is different) is not able to determine whether they wish to support th= e protocol.
>>
>> "Wish to support the protocol" is a telling phrase.
>>
>> The Internet architecture in the opinions of some (I am one) succee= ded where other architectures had failed specifically because it did not inc= orporate access control in the network; it was, in David Isenberg's words, s= tupid. This was in stark contrast to the so-called intelligent networks of p= hone companies that sought to control the applications and services that cou= ld be provided over the pair of copper or synchronous timeslot made availabl= e to a user.
>>
>> The Internet dispensed with centralised control over toplogy, routi= ng, and (I think importantly) introduced layers that separated not just conc= epts but responsibility and freedom. The kind of innovation visible to end-u= sers on the Internet happens on the edge, high up in the stack, not in the n= etwork.
>>
>> When I hear network administrators (I am one) talk about the abilit= y to constrain abuse in circumstances where they have responsibility for the= devices that they forward packets for, I do not (until now) hear a general e= xpectation of being able to support particular protocols. They are conceptua= lly different, even though many implementations of the former today involve t= he latter. I think this is important.
>
> One interesting observation about layers and protocols, is the differen= ce between routing protocols that run on top of IP and those with their own p= rotocol number. One example of the latter is ISIS, an IGP very similar to OS= PF. The operational experience with the former (eg BGP and OSPF) and ISIS sh= ows the benefits of having distinct substrates for the control plane, where i= t is possible. BGP and OSPF eventually had to add defense mechanisms against= in-band attacks (eg MD5 and TTL mechanisms), while ISIS was unaffected (AFA= IK at least).
>
> It is interesting to consider what possible benefits there might have b= een or might be in separation of other control planes from the IP data plane= , eg if DNS were properly considered a control plane rather than an applicat= ion, even if only on the client-to-resolver side.
>
> Brian
>
>>
>> If we lose sight of this core principle of the architecture of the n= etwork, history suggests it will be replaced by something else. What happene= d a short number of decades ago was that the phone network became a transpor= t for a new network (leaving the voice network to be relegated to one of man= y applications that run on top). Perhaps, in microcosm, the idea that the ne= twork can contain and control one very specific service, that of name resolu= tion, has spawned a very similar outcome.
>>
>>
>> Joe
>
> --
> Add mailing list
> Add@ietf.org
> https://www.ietf.org/mailman/listinfo/add
= --Apple-Mail-096FA908-B6D5-4BEF-B54E-25F530629307-- From nobody Wed Aug 14 18:50:55 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D37BC120122 for ; Wed, 14 Aug 2019 18:50:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UvpQYJje_arr for ; Wed, 14 Aug 2019 18:50:51 -0700 (PDT) Received: from mail-qt1-x82c.google.com (mail-qt1-x82c.google.com [IPv6:2607:f8b0:4864:20::82c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C4E83120024 for ; Wed, 14 Aug 2019 18:50:51 -0700 (PDT) Received: by mail-qt1-x82c.google.com with SMTP id y26so880418qto.4 for ; Wed, 14 Aug 2019 18:50:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=X5VZGLcDZrgu0Z1Dnqn8a0FXak0NQZb2p7m8jqEpJVA=; b=QhmD/HDSmFO3uqPLhNkkx3tHETrR8qLIQwVQU4YCTORNdk+UCo1Ju+nQI3mpVo6BWA BC+KTYU6ZZlfAUcMw828ItVL00zPyXFiqspwBmfY8RonqRe34/I5tyK7ZfLM0AkU1HHp 093df4INdByQY4vbkwP8Y61Fmpg2sq6OCH3meQp5ibDPHSXJoTSi1TsPB3jfgsyoIwkr 3P0v32dSQezLfWD++ZzU3tp5psZgD3dUq6NWlNyFeUYN7Ju1LnAXoNvg7H6ISjKtXWqK ti9HqrdRSNNmBzb2Gaih4uHMxEm7W7z1sx6Tb+Crxx5BCGABKi7gekLUkRz7i3jRxUoU zZWg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=X5VZGLcDZrgu0Z1Dnqn8a0FXak0NQZb2p7m8jqEpJVA=; b=BSF+HuN1qLkRxNAUFGHxKbYJ8Wti+rUpjOsffpL/4gT89S0HTFj9A3+uFQ+OhNc2Wa 27w+CMLWYf6kCqphOt0PgbuHOMBSjq1jHAGnEtXxSkD6yCVV6hAV9CmR5w2zJgJODmnK y3/16MN4pYZ5BUfNu2EMGZ0dnTWVC83pAQo/VecFMJ1gmd7c6ybaDrgo4dJAnwEkSFa+ kc4G8lXy7vM2VYF270YFxBmM9OM1KGnL8u7p2ORvNQN/D8H8F7jr8v38a4boGILbAOC3 N7SOIvbwIHYjEmqjkNjFpKhmsuYnOqWF39pmgyvAtyi8WYDDOIn5VoNQOjETRh+yHmyI MsEQ== X-Gm-Message-State: APjAAAVnf2cYQDQM33Hp1E6dPdsHUdBxbYcjjQX26Ycgbwg28ua8p9aC /beVnW32UOOdtK5n02pStP1CMkxW X-Google-Smtp-Source: APXvYqw+dSsO7X1ZWoxyN7JH5i25X2VfHxofqylojeVDyLAFLKFZtMYlSeo6dZhBIxPh8A9sHBUKuQ== X-Received: by 2002:ac8:73d8:: with SMTP id v24mr2017591qtp.221.1565833850701; Wed, 14 Aug 2019 18:50:50 -0700 (PDT) Received: from [192.168.2.18] (cpe-76-179-66-50.maine.res.rr.com. [76.179.66.50]) by smtp.gmail.com with ESMTPSA id v84sm776137qkb.0.2019.08.14.18.50.49 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 14 Aug 2019 18:50:50 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (1.0) From: Brian Dickson X-Mailer: iPhone Mail (16G77) In-Reply-To: <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> Date: Wed, 14 Aug 2019 21:50:49 -0400 Cc: Bret Jordan , ADD Mailing list Content-Transfer-Encoding: quoted-printable Message-Id: References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> To: Stephen Farrell Archived-At: Subject: Re: [Add] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 01:50:54 -0000 Sent from my iPhone > On Aug 14, 2019, at 5:36 AM, Stephen Farrell w= rote: >=20 >=20 > This seems to me off-topic for this thread but whatever... >=20 >> On 14/08/2019 02:54, Brian Dickson wrote: >> The question regarding regulators is, is whether the regulations on >> who is accountable and responsible for adherence to regulations and >> possibly enforcement of regulations make it clear as to whether the >> operator of a home network is obligated to enforce the DNS >> enforcement mechanism and use the mandated list of blocked names, and >> thusly required by law to prevent bypassing those mechanisms, i.e. to >> block DoH? >=20 > No. >=20 >>=20 >> At least, that=E2=80=99s my interpretation of Brad=E2=80=99s question. >>=20 >> Even if it isn=E2=80=99t an accurate interpretation, I think I=E2=80=99d b= e >> interested in your opinion on the question, and if you are okay with >> the question, I=E2=80=99d be interested in your answer. >>=20 >> Related hair-splitting questions: is it always the case (at least in >> Ireland) that SOMEONE is obligated by the regulators? Do the >> regulations spell out who is, and whether it is the least specific >> scoped operator (highest level ISP), or the most specific scoped >> operator (home network operator), or does everyone have to >> independently enforce the regulations? >=20 > I have no idea as IANAL:-) If someone were to claim that > my home n/w needs to adhere to the same regulations as > a commercial ISP or mobile n/w operator, then I would > be surprised and would disagree with them. >=20 > I am nonetheless happy with my policies for my n/w. I > would say Barbara is equally happy with her policies > for her n/w and that we're both entitled to do as we > do. >=20 > The point of my mail was to provide a counterexample > showing that one n/w admin's policy finding DoH problematic > is not sufficient reason to claim that DoH is problematic > for all n/w admins, nor that the existence of DoH somehow > calls into question the role of a n/w admin. I think you are misunderstanding the specific argument. The argument is roughly as follows: 1. DoH is problematic for some network admins. 2. A protocol which was a priori known to be problematic for some network ad= mins ought to have been opposed to by all network admins.=20 3. In particular, a preexisting protocol that provides the same privacy qual= ities as DoH was available (DoT), which might have been a better option. As far as I can tell from previous comments, I believe you would not oppose u= se of DoT on your network any more than you would DoH (which you seem to be f= ine with). So, DoT would be fine for both Barbara and you, while DoH causes problems fo= r Barbara but not for you. I am saying collectively it makes sense to say DoH has problems for some net= work admins while DoT has none of those problems. This is strictly discussin= g network admins and not users. As a network admin exclusively, and/or as a user with no upstream network wh= ich blocks DoT, would you be okay if only DoT were available for use in impl= ementing DNS privacy? Eg if DoH were not available from your choice of brows= er or resolver? Brian > Neither claim > stands up, and repeating such invalid claims does not > make then valid. >=20 > S. >=20 > <0x5AB2FAF17B172BEA.asc> From nobody Wed Aug 14 18:55:03 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 41D6C120024 for ; Wed, 14 Aug 2019 18:55:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TpFYeyaD9X2q for ; Wed, 14 Aug 2019 18:54:59 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 08018120122 for ; Wed, 14 Aug 2019 18:54:59 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 30E5ABE4D; Thu, 15 Aug 2019 02:54:57 +0100 (IST) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id w-ry-vR7OYgq; Thu, 15 Aug 2019 02:54:55 +0100 (IST) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id CFDDDBE47; Thu, 15 Aug 2019 02:54:54 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1565834095; bh=kPzhbQ8IgRp/g81SfYXfxNJYGpSsy3NJsaq/PiaViCY=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From; b=nVN0S4P+BhjI3W/zSmol9nxFeNk8xwN6AZ8eMIWUBbH3aq9am7tsiaMvskXQS4/WQ 1OdBhF+TepxOo43/snO18z4NNNhSYLRlO/gQcCtbAvuS8NqVZzLV2KZY8YJF7zZnye nfHFoDU1X/6TaBWOQokMTOC9i5Ai2pjU3CoXbkQo= To: Brian Dickson Cc: Bret Jordan , ADD Mailing list References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: <95445c4b-fe74-d9b3-530e-9184b985a7c6@cs.tcd.ie> Date: Thu, 15 Aug 2019 02:54:53 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="q0WIncaPdpGHWTz4gVh4XRa7QmTsG54bg" Archived-At: Subject: Re: [Add] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 01:55:01 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --q0WIncaPdpGHWTz4gVh4XRa7QmTsG54bg Content-Type: multipart/mixed; boundary="CKQB0EINqDsYT3gOWsIfgv8R3NHDVkbFQ"; protected-headers="v1" From: Stephen Farrell To: Brian Dickson Cc: Bret Jordan , ADD Mailing list Message-ID: <95445c4b-fe74-d9b3-530e-9184b985a7c6@cs.tcd.ie> Subject: Re: [Add] Validity of network administrator role References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> In-Reply-To: --CKQB0EINqDsYT3gOWsIfgv8R3NHDVkbFQ Content-Type: multipart/mixed; boundary="------------3B06EEF1E48C770D64DD7017" Content-Language: en-GB This is a multi-part message in MIME format. --------------3B06EEF1E48C770D64DD7017 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On 15/08/2019 02:50, Brian Dickson wrote: > 2. A protocol which was a priori known to be problematic for some > network admins ought to have been opposed to by all network admins. Yeah, that's nonsense. Again. The pattern of nonsensical commentary sprinkled on this list is by now, and sadly, well established. S. --------------3B06EEF1E48C770D64DD7017 Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------3B06EEF1E48C770D64DD7017-- --CKQB0EINqDsYT3gOWsIfgv8R3NHDVkbFQ-- --q0WIncaPdpGHWTz4gVh4XRa7QmTsG54bg Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAl1Uu20ACgkQWrL68XsX K+r+fg//XusJb3Cmz+nxnUtkdC4v60tVzfqdnB2j65X7s8mTlMZYN1iqwKHxXXL0 rNBWA6czZ3N9SWDk/pajOZAH92otwrczBz6serC9gStT2H1yAsRXkDgvO9akyP6+ LEUgY7oirBcbYBicQX3PX8UoNCIO4GPx20kh0FLWumFqcHVdY0B9GPZWrmkamTXI FmmIWTvD+DuXsQ1QYQwlsRG86L9+B7SawkesA9QRlafHE7WAWwMBPoMxjHGw17Zz 951IRZinRgRImd9ozJCq7hrogPHtPATjvgCT3pOLdEHZjU7InLBGpABXPv+sV5cL EQv5y1aNWGODC1tnhfnEIsjrC+jZPDsorPNz26kj/Y3h0qpP0/hdSGeCEnCuTeZT nem5FS8kdNrMfHoDV0EX2k81aF8Y9AzruqJUghokCFe7BE1L6UJ/S/rUr86E0c9d 0kPxLgOop+zZiW2sBLfuVSdkceiu8myTNkAs6zZlNSwiIQZw98FBgJMtV8T6ZEfa 8LqcGxbRLYTp5Rhl251i4DpsXkzTkBsdy00Drg1pE3nH2psMwp+BdkjLxscfQmI/ MOtfBfJ8w+sdmo6wFhsjk3OopQKu4UOM9akxphlegZlFYMJ/DnYUnsb/VosBdWhQ SGGp9S27cj9djfrzoeS9qIvq4AO/2dhDV3XYXrpisf1trht4v0M= =emlB -----END PGP SIGNATURE----- --q0WIncaPdpGHWTz4gVh4XRa7QmTsG54bg-- From nobody Wed Aug 14 19:37:34 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 481E312091B for ; Wed, 14 Aug 2019 19:37:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id laAky3rK4oNk for ; Wed, 14 Aug 2019 19:37:30 -0700 (PDT) Received: from out.west.pexch112.icann.org (out.west.pexch112.icann.org [64.78.40.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CC302120816 for ; Wed, 14 Aug 2019 19:37:30 -0700 (PDT) Received: from PMBX112-W1-CA-1.pexch112.icann.org (64.78.40.21) by PMBX112-W1-CA-2.pexch112.icann.org (64.78.40.23) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Wed, 14 Aug 2019 19:37:28 -0700 Received: from PMBX112-W1-CA-1.pexch112.icann.org ([64.78.40.21]) by PMBX112-W1-CA-1.PEXCH112.ICANN.ORG ([64.78.40.21]) with mapi id 15.00.1473.005; Wed, 14 Aug 2019 19:37:28 -0700 From: Paul Hoffman To: Brian Dickson CC: ADD Mailing list Thread-Topic: [Ext] [Add] Validity of network administrator role Thread-Index: AQHVUxJhW/PZIsAIcka7b9q93g2ilA== Date: Thu, 15 Aug 2019 02:37:28 +0000 Message-ID: References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [192.0.32.234] Content-Type: text/plain; charset="us-ascii" Content-ID: Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 02:37:32 -0000 On Aug 14, 2019, at 6:50 PM, Brian Dickson = wrote: > 3. In particular, a preexisting protocol that provides the same privacy q= ualities as DoH was available (DoT), which might have been a better option. This misses a large point. Browser implementers didn't need a standard for = DoH: they could have done it without any standardization at all. In fact, G= oogle already had a (IMHO significantly worse) DNS-over-HTTPS proposal that= was already being implemented before the DoH WG even started up. The fact that network operators don't want DNS-over-HTTPS, standardized or = not, is relevant when they are speaking about the problems they face. Telli= ng browser and app vendors that DoT is "a better option" indicates that you= know their business better than they do, and that attitude sucks just as m= uch as them telling you that they know more about your business than you do= . --Paul Hoffman= From nobody Wed Aug 14 20:25:55 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DB2BA120020 for ; Wed, 14 Aug 2019 20:25:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=algebras-org.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id f-HtNThszHCu for ; Wed, 14 Aug 2019 20:25:51 -0700 (PDT) Received: from mail-ot1-x32e.google.com (mail-ot1-x32e.google.com [IPv6:2607:f8b0:4864:20::32e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DF93B12001A for ; Wed, 14 Aug 2019 20:25:50 -0700 (PDT) Received: by mail-ot1-x32e.google.com with SMTP id c34so3091489otb.7 for ; Wed, 14 Aug 2019 20:25:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=algebras-org.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc:content-transfer-encoding; bh=BbAIXRfKLCOu2Pn/crIAnnx8rrsY2AhggZWZq1rgA6g=; b=RS4z55lmzw3/MqNgmiszLMaGnWoHC2QUczbdAskJWWmWatCZNJyHOaRIivYU5XUTFY x/Z77PkuNFKosCbcLv9YV3otTA9b0D+ia90H4JMNEFLOqTwFuFAnm/b0JPPfF0ili7nh ERCBjNLtigM6b9zxK+IcigcGha7MwuYCN9exxOw5pK1cMY2bKxuBM88HHevzY5BHdgYL /bMpUHbM+93MgzPcTHYNgMNnsc9aOMzzmfwycGeoNva+ucWzFWnM0zROKsDBjmj7Hvud jCs2+NXv9HHKeHWSXxcccYtFarRSc8ZwJ/Qabdzp1/jALKC1odGJtv+EZR/Hj5aI4Kke WZjA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc:content-transfer-encoding; bh=BbAIXRfKLCOu2Pn/crIAnnx8rrsY2AhggZWZq1rgA6g=; b=reJkNgL7EFAjkc5Cbn7vUh7gIMNkl1vRGfze60DoJdIipYvFCyDmpoRJVU2yhQjGpV PXRSzgfwe7uLPDIqBekXM+Dw63Oy2J7+ht+HcSFKw/7EMYNbfxCPw8thj5SHORvJzSyL jGv4BGgiDpDB5XYtUa1DQZgf47z/uDDonxyMTsb7/H6egC0yfbFsxC3hfJFtG+7Emkis RpXXcae4/J1S0gddQ+WkihSg0ZywoGrwT1OPOc23ltXyWuOq7oQBXHZrh2ZjKXdisfXQ dbbOA6+BFQqqg5nYtQ5wasIvc8Q+menK6LaQF7sU2Mk23WXwGbyPesszsHwj/K89iXvy 9NHA== X-Gm-Message-State: APjAAAUS5VHI0k5caFJLMrlYbsg3fAgYHV2Z8n4hoMl92STSzOk9+U7x 9AuIdhHwFo8Ay6Y9ZZi2hCz8Dv9UOL2JKIspHDn9ZA== X-Google-Smtp-Source: APXvYqw/kBhpV1sqho3ThkunMcZZJYMRcvChq1j8khAr/4T3IhcRgwYdSqQzAka55TTFCHx+dkkX8G4DsHrXoiSfq6Q= X-Received: by 2002:a6b:3b57:: with SMTP id i84mr3592308ioa.145.1565839550020; Wed, 14 Aug 2019 20:25:50 -0700 (PDT) MIME-Version: 1.0 References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> In-Reply-To: From: George Michaelson Date: Thu, 15 Aug 2019 13:25:38 +1000 Message-ID: To: Paul Hoffman Cc: Brian Dickson , ADD Mailing list Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 03:25:54 -0000 Thanks for saying this Paul. This is substantively my point made (badly) at microphones: The DNS as the single inherent reference for name:address mapping is only "true" if you ignore the various approaches to HOSTS.TXT which a number of people already encode into their .js and can use freely. As far as "permissionless networks" go the cat is well and truly out of the bag here. URL encoding and re-writing inside the browser and the web page, is a "thing" Where I would change my position, is that I was in a more lax, permissive state of mind about DoH which I now realize was at fault: the fracture lines in the *semantic intent* of a name, domain or otherwise, and its binding to an IP address, this is a huge moment. We're throwing out the window something integral to what we've done, since we stopped cohering around HOSTS.TXT in the NIC model. What I think guardian.co.uk means, has to be semantically equivalent to what you think guardian.co.uk means, or we cannot have a "real" conversation about what lies there in the web, or any other service. If we don't cohere to a single namespace, how is that going to be possible? -g On Thu, Aug 15, 2019 at 12:37 PM Paul Hoffman wrot= e: > > On Aug 14, 2019, at 6:50 PM, Brian Dickson wrote: > > 3. In particular, a preexisting protocol that provides the same privacy= qualities as DoH was available (DoT), which might have been a better optio= n. > > This misses a large point. Browser implementers didn't need a standard fo= r DoH: they could have done it without any standardization at all. In fact,= Google already had a (IMHO significantly worse) DNS-over-HTTPS proposal th= at was already being implemented before the DoH WG even started up. > > The fact that network operators don't want DNS-over-HTTPS, standardized o= r not, is relevant when they are speaking about the problems they face. Tel= ling browser and app vendors that DoT is "a better option" indicates that y= ou know their business better than they do, and that attitude sucks just as= much as them telling you that they know more about your business than you = do. > > --Paul Hoffman > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add From nobody Wed Aug 14 20:55:07 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B23D412001A for ; Wed, 14 Aug 2019 20:55:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=lowentropy.net header.b=BBeWpPR7; dkim=pass (2048-bit key) header.d=messagingengine.com header.b=sFVnKFLJ Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PU52fInYbZzK for ; Wed, 14 Aug 2019 20:55:03 -0700 (PDT) Received: from out4-smtp.messagingengine.com (out4-smtp.messagingengine.com [66.111.4.28]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 17985120018 for ; Wed, 14 Aug 2019 20:55:03 -0700 (PDT) Received: from compute1.internal (compute1.nyi.internal [10.202.2.41]) by mailout.nyi.internal (Postfix) with ESMTP id 7A5752207F for ; Wed, 14 Aug 2019 23:55:02 -0400 (EDT) Received: from imap2 ([10.202.2.52]) by compute1.internal (MEProxy); Wed, 14 Aug 2019 23:55:02 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lowentropy.net; h=mime-version:message-id:in-reply-to:references:date:from:to :subject:content-type; s=fm3; bh=bmz+RiOb7KNc0CbJHYdCkj96b4YaJZW p8GqoS4J6OLE=; b=BBeWpPR7j+YJqyTNDewuvm1TVz9TzWZxmrfMu9FuVv7Izaf qRwmKyTnKZAUl30+vUaHWbX241UISK3LuzeUv9jC77tS3BDsxpzQTlqbhkPm6j2a KymEufRVxSJGQEqlZFDLfyEBz2Fj5C1glmGtVBx+g5VRCSI1bJibUI/708YCi+24 OXxokoyx4KNIfxcySVmX+9+0ToNIN4BDiTBX/+iL/cWCBaCLwdhjoshBagJNRo8t AkzdTD1tsJsaVGd0y2PyUx8HV0r9ZluakJ1bqbEHXIzBK+n0N7TtFcf1zv6jL/8m LwJczTjrngycrpdEmz5GZsQfMxGTU9PvKbyZ/BQ== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to:x-me-proxy :x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm3; bh=bmz+Ri Ob7KNc0CbJHYdCkj96b4YaJZWp8GqoS4J6OLE=; b=sFVnKFLJ75wtR/uW9f16vx 5lMIrKSUgtfw6vZ5pTc2CwZTfxnkPNz7kanLqbi3zxpeODod0IQ8EqbArsKPDhql tWJhmM1i9BkZWT/mCiSwV4+vtTrPQ0T3+3I5Fdz7wHxEra3Dtxk+aXQyx9dtxiff r6zNVPifiPDQfVb7xfg6EFAx1br/Kk/8Vi/f3qBUBni61JoqpcoiiVZBZK8ppa2e 1tbX+92fsxvauuxVxiI9NsxRZQD1Ma9AJRSZ/3LK/evJwUa/MGJ3VY4fcJGTAsJN KM5OvH0sR8ozXV4zjfkmO+18cztW7DV7M5T/0A8sO8qvU051P/UZ83sy7FdOhvkQ == X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeduvddrudeftddggeejucetufdoteggodetrfdotf fvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdfqfgfvpdfurfetoffkrfgpnffqhgen uceurghilhhouhhtmecufedttdenucenucfjughrpefofgggkfgjfhffhffvufgtsehttd ertderredtnecuhfhrohhmpedfofgrrhhtihhnucfvhhhomhhsohhnfdcuoehmtheslhho figvnhhtrhhophihrdhnvghtqeenucfrrghrrghmpehmrghilhhfrhhomhepmhhtsehloh ifvghnthhrohhphidrnhgvthenucevlhhushhtvghrufhiiigvpedt X-ME-Proxy: Received: by mailuser.nyi.internal (Postfix, from userid 501) id E91B3E00A4; Wed, 14 Aug 2019 23:55:01 -0400 (EDT) X-Mailer: MessagingEngine.com Webmail Interface User-Agent: Cyrus-JMAP/3.1.6-869-g2d94aad-fmstable-20190814v1 Mime-Version: 1.0 Message-Id: In-Reply-To: References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> Date: Thu, 15 Aug 2019 13:55:02 +1000 From: "Martin Thomson" To: add@ietf.org Content-Type: text/plain Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 03:55:05 -0000 I'm still struggling to find a way to make this discussion productive. There's an end state I want to avoid where this whole thing escalates with various attempts at blocking on one side and increasingly horrible tunneling on the other. The fact that people are willing to talk gives me a little hope here, but it's hard to get past the negativity. >From the application side of this, considering deployment of a system with pre-selected resolvers, I'm motivated by understanding the consequences of that choice. At this stage, it seems unlikely that some new understanding will cause me (or - to be correct - my organization) to completely reconsider plans, but that doesn't mean that those plans can't be changed. I am reminded of a similar change starting about 6 years ago, right after I joined Mozilla. At the time, the web had started to move more aggressively to HTTPS. And browsers were pushing hard. Some network operators were quite vocal in opposition to policy changes that would have accelerated the change. There was a complex set of use cases, as you might expect might arise from decades of development in an environment that had no effective security measures in place. For instance, caching of HTTP was seen at the time as critical for network performance; many networks deployed transparent proxies to provide that capability. There were also transcoding proxies and all sorts of amazing optimizations in place. The value of knowing that someone is about to watch a video - and how long that video is - has real benefits for network capacity planning. That sort of privacy violation was hardly the worst thing going around either. We started a process whereby we looked at the various use cases in some detail and worked through each in turn. In doing so, we got better understanding of the problem space and identified a number of key areas of genuine pain. It required having someone sit down and produce a dispassionate assessment of each use case in turn, reaching agreement that the analysis was at least accurate, then deciding what was important enough to do something about. I remember at least one face-to-face meeting and a good number of conference calls just to get to the point. But it was worth it. It resulted in new work being undertaken, some of which continues today in various places. For me though, the most valuable outcome was a better shared understanding. It doesn't take much squinting to see the similarities in the two situations. If others are willing to participate in such a process, I'd be happy to be a part of that. On Thu, Aug 15, 2019, at 12:37, Paul Hoffman wrote: > The fact that network operators don't want DNS-over-HTTPS, standardized > or not, is relevant when they are speaking about the problems they > face. Telling browser and app vendors that DoT is "a better option" > indicates that you know their business better than they do, and that > attitude sucks just as much as them telling you that they know more > about your business than you do. For my own part in that, I apologize. I'm trying to do better at formulating arguments that are less combative, and still learning. On Thu, Aug 15, 2019, at 11:55, Stephen Farrell wrote: > The pattern of nonsensical commentary sprinkled on this > list is by now, and sadly, well established. A reminder to keep things civil. We're all here to resolve our differences. I can see that this was intended to ridicule an idea and not an individual, but I am certain that less emotive language would be effective. From nobody Wed Aug 14 21:25:03 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 38A6C120026 for ; Wed, 14 Aug 2019 21:25:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id y_-d_K_izQ6W for ; Wed, 14 Aug 2019 21:24:59 -0700 (PDT) Received: from mail-ua1-x936.google.com (mail-ua1-x936.google.com [IPv6:2607:f8b0:4864:20::936]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4EDB9120018 for ; Wed, 14 Aug 2019 21:24:59 -0700 (PDT) Received: by mail-ua1-x936.google.com with SMTP id j21so410205uap.2 for ; Wed, 14 Aug 2019 21:24:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=mU57meP9VLfHkR3ig5hcXXiIBKE2JBj1SSbBzXamp6c=; b=KaJsXYyM877oJNYGc1h59Ibw4y5XfrIIRm5p8zE60Rv9Q6ezwwldLJidnHOzyu4QTX DMdxNeH53UtDRpF0GsjQ241PuLs8T3W2XLr2PwuBKSe8C1QtjoJXrFcBoNw7/zoAanti SKzmHk1MqYsZMMnhGI7iwDvrtMDTMqMUoVtcyOisNw+nUylvpDYYekocm6Xb/u/qTqEw 3vxT366zpbUdGjHdETjzhgA5M0wU5n8aTpfCqso7T3ySsaVY9FFy84MH2eLwQec46QCi +XHoi61nC1eep6FXtdT2oAB/x82+A7vbTtem5LiHoo0r9IR6nmcqjGrT6mVPFqkccqn9 EHhw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=mU57meP9VLfHkR3ig5hcXXiIBKE2JBj1SSbBzXamp6c=; b=pDCeFan1H9Y60ZVA1QiWC9mISuWnWBMW9iWLOgTNpmQKjozUM0/Szq1RuJrOSV5URl LOGE0Wg6jZV+dRu85zLLbSHVeuOQRTs8GBmNrvzYSFBUxixY5PRZCKU64kRxW446uunS 5KwKHuX5QpdawEye8OoBbP0WtH1a/rqo9gkF38rDFZ7slJfqzuzDn2xOjMOQ3tvfjfej 5DVFrVTLuVvg16il3aV5B8zODCQgCjEMc09DpUwuohrUG7osjT/4zlcZEIjpxYIENLkW I67cj6QmBCHb/QuK207BIZyWKNnMy/1c/Oc+D5W+NXduig9hVepqU4DgLOB2b/kvqRU+ xOBA== X-Gm-Message-State: APjAAAU2ykCc3VVM5dQnGVOIaovdGXBWY1rzk6Oe9HeWb532MbTEaeB9 uh/XiV+iaJXEu9+fJdRX9JxsWvPh2LYgUTiXAzw8Bg== X-Google-Smtp-Source: APXvYqzubYpSko7Ka4kV+JepW0Y5/Kj7ae7pcZ32S7sD2TwQVV9yecpGjFBzaUip8b23sG8j4V1fH8kPjFW6aH/JlJ4= X-Received: by 2002:ab0:6390:: with SMTP id y16mr2282920uao.62.1565843098445; Wed, 14 Aug 2019 21:24:58 -0700 (PDT) MIME-Version: 1.0 References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> In-Reply-To: From: Brian Dickson Date: Thu, 15 Aug 2019 00:24:37 -0400 Message-ID: To: Paul Hoffman Cc: ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000a82b8f059020413b" Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 04:25:01 -0000 --000000000000a82b8f059020413b Content-Type: text/plain; charset="UTF-8" On Wed, Aug 14, 2019 at 10:37 PM Paul Hoffman wrote: > On Aug 14, 2019, at 6:50 PM, Brian Dickson > wrote: > > 3. In particular, a preexisting protocol that provides the same privacy > qualities as DoH was available (DoT), which might have been a better option. > > This misses a large point. Browser implementers didn't need a standard for > DoH: they could have done it without any standardization at all. In fact, > Google already had a (IMHO significantly worse) DNS-over-HTTPS proposal > that was already being implemented before the DoH WG even started up. > > The fact that network operators don't want DNS-over-HTTPS, standardized or > not, is relevant when they are speaking about the problems they face. > Telling browser and app vendors that DoT is "a better option" With respect, Paul, I *specifically* said "might have been" not "is", in reference to a better option. It was not only intended to acknowledge that I might be wrong in this, but also that the correct tense is, I think, past imperfect or something to that effect. I.e. we are passed the point where the issue has become moot, with the caveat that being a protocol thing, it can always be un-mooted with varying amounts of difficulty. The big issue I have with 8484 was the specification of the port number. Everything else about DoH was fine, and would have been perfectly adequate. Only the obfuscation of DNS within the regular HTTPS channel, was contentious to me, and I believe to other network operators. The benefits otherwise of using the HTTP encoding and all the other channel sharing etc., got lost in the larger discussion, which I think is a big shame. If the browser implementers would ever have considered non-443 as the port for the DoH binding, I think all of this could have been easily avoided. While that is mostly 20/20 hindsight, it isn't entirely moot. My perspective is, that a non-443 port is not too late to converge upon, but would require engagement from the browser community, and I'm not sure I'm the right one to raise the issue. In fact, I'm pretty sure I'm not. So, I am leaving this as an opening for anyone else to step up, and see if there is any possible path to explaining and justifying the prospect of DoH!443 (DoH over not-443). > indicates that you know their business better than they do, and that > attitude sucks just as much as them telling you that they know more about > your business than you do. > I'm concerned about their implementation choices more than their protocol selection. But those aren't on topic for ADD, at least I don't think they are. However, it may be the case that those concerns rise to the level of being independent of which implementation, or which application, is doing DNS. As such, I will probably try to raise that in a separate discussion thread(s), with very specific Subject line(s). It is not easy to make major changes to how DNS client communications work, and the more experience from the DNS community (and to a lesser degree, security architecture and systems administration communities) the better the outcome for everyone. I'm also trying to figure out ways of addressing the split-dns and the RPZ issues, via technology, so that it might be possible to avoid the current requirement that only a single DNS resolver be used. More on that later (I'm on vacation and getting in trouble for spending time not on the beach.) Sincerely, Brian --000000000000a82b8f059020413b Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Wed, Aug 14, 2019 at 10:37 PM Paul= Hoffman <paul.hoffman@icann.o= rg> wrote:
brian.peter.dickson@gmail.com&= gt; wrote:
> 3. In particular, a preexisting protocol that provides the same privac= y qualities as DoH was available (DoT), which might have been a better opti= on.

This misses a large point. Browser implementers didn't need a standard = for DoH: they could have done it without any standardization at all. In fac= t, Google already had a (IMHO significantly worse) DNS-over-HTTPS proposal = that was already being implemented before the DoH WG even started up.

The fact that network operators don't want DNS-over-HTTPS, standardized= or not, is relevant when they are speaking about the problems they face. T= elling browser and app vendors that DoT is "a better option"

With respect, Paul, I specifically said= "might have been" not "is", in reference to a better o= ption. It was not only intended to acknowledge that I might be wrong in thi= s, but also that the correct tense is, I think, past imperfect or something= to that effect. I.e. we are passed the point where the issue has become mo= ot, with the caveat that being a protocol thing, it can always be un-mooted= with varying amounts of difficulty.

The big issue= I have with 8484 was the specification of the port number. Everything else= about DoH was fine, and would have been perfectly adequate. Only the obfus= cation of DNS within the regular HTTPS channel, was contentious to me, and = I believe to other network operators.

The benefits= otherwise of using the HTTP encoding and all the other channel sharing etc= ., got lost in the larger discussion, which I think is a big shame.

If the browser implementers would ever have considered no= n-443 as the port for the DoH binding, I think all of this could have been = easily avoided. While that is mostly 20/20 hindsight, it isn't entirely= moot.

My perspective is, that a non-443 port is n= ot too late to converge upon, but would require engagement from the browser= community, and I'm not sure I'm the right one to raise the issue. = In fact, I'm pretty sure I'm not.

So, I am= leaving this as an opening for anyone else to step up, and see if there is= any possible path to explaining and justifying the prospect of DoH!443 (Do= H over not-443).
=C2=A0
indicates that you know their business better than they do, a= nd that attitude sucks just as much as them telling you that they know more= about your business than you do.

I'= ;m concerned about their implementation choices more than their protocol se= lection.
But those aren't on topic for ADD, at least I don= 9;t think they are.

However, it may be the case th= at those concerns rise to the level of being independent of which implement= ation, or which application, is doing DNS.
As such, I will probab= ly try to raise that in a separate discussion thread(s), with very specific= Subject line(s).

It is not easy to make major cha= nges to how DNS client communications work, and the more experience from th= e DNS community (and to a lesser degree, security architecture and systems = administration communities) the better the outcome for everyone.
=
I'm also trying to figure out ways of addressing the spl= it-dns and the RPZ issues, via technology, so that it might be possible to = avoid the current requirement that only a single DNS resolver be used. More= on that later (I'm on vacation and getting in trouble for spending tim= e not on the beach.)

Sincerely,
Brian
--000000000000a82b8f059020413b-- From nobody Wed Aug 14 22:29:25 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 997E8120041 for ; Wed, 14 Aug 2019 22:29:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.68 X-Spam-Level: X-Spam-Status: No, score=-1.68 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_INVALID=0.1, DKIM_SIGNED=0.1, T_SPF_HELO_PERMERROR=0.01, T_SPF_PERMERROR=0.01] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=fail (1024-bit key) reason="fail (message has been altered)" header.d=nostrum.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Jkavu6gxfzS9 for ; Wed, 14 Aug 2019 22:29:22 -0700 (PDT) Received: from nostrum.com (raven-v6.nostrum.com [IPv6:2001:470:d:1130::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B94EB120019 for ; Wed, 14 Aug 2019 22:29:22 -0700 (PDT) Received: from MacBook-Pro.roach.at (99-152-146-228.lightspeed.dllstx.sbcglobal.net [99.152.146.228]) (authenticated bits=0) by nostrum.com (8.15.2/8.15.2) with ESMTPSA id x7F5SvKH026532 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NO); Thu, 15 Aug 2019 00:28:59 -0500 (CDT) (envelope-from adam@nostrum.com) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=nostrum.com; s=default; t=1565846939; bh=hYy4zeYGED/wQRbNN+p/6v7fUP6p+cLt3Yy1nDg0Hr8=; h=Subject:To:Cc:References:From:Date:In-Reply-To; b=epLB87qCjZYtVY8N4WFGl5KSicqvhKtIa9BwkaMtIJG/AoE4JhqP8H4lcfeAqRRN+ veNZ92dKpGbvF4NKMLpT6MXKBN09vvXdaopKANCxSpkJ86hYobbsSMg7TDgRzCtsE6 iUuDoV2s+gk317iNZjJbK+LaHj6WqMEbKbqe6cbU= X-Authentication-Warning: raven.nostrum.com: Host 99-152-146-228.lightspeed.dllstx.sbcglobal.net [99.152.146.228] claimed to be MacBook-Pro.roach.at To: Brian Dickson , Paul Hoffman Cc: ADD Mailing list References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> From: Adam Roach Message-ID: <8e00891f-2aa2-ee11-559a-b5a8967b22d9@nostrum.com> Date: Thu, 15 Aug 2019 00:28:52 -0500 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Content-Language: en-US Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 05:29:23 -0000 [as an individual] On 8/14/19 11:24 PM, Brian Dickson wrote: > My perspective is, that a non-443 port is not too late to converge > upon, but would require engagement from the browser community, and I'm > not sure I'm the right one to raise the issue. In fact, I'm pretty > sure I'm not. I think there is a key point that is being broadly missed here. I infer from your statements that you see the property that DoH cannot generally be distinguished from ordinary web traffic as a low-order protocol design decision that could be adjusted while still retaining the benefits that are driving DoH's adoption. Having been rather deeply involved in many conversations from a browser perspective, I can comfortably state that that this *is* the singularly most important property of the protocol that is driving DoH's adoption. You don't have to agree with the reasons for this, or even to understand them, but this is the ground truth that can't really be worked around. Martin's recent summary of the situation by way of analogy to HTTPS adoption is a good one, and I encourage you to re-read it with the foregoing assertion in mind. There are legitimate network operator interests here, and we are keenly interested in preserving them in the face of this change -- but the future will not look like the past, and we need to figure out new ways to solve old problems. It would be ideal if you and other operators were involved in coming up with these new solutions. /a From nobody Wed Aug 14 22:54:30 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 66A41120122 for ; Wed, 14 Aug 2019 22:54:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EPW2FHXZf0HT for ; Wed, 14 Aug 2019 22:54:21 -0700 (PDT) Received: from mail-pl1-x631.google.com (mail-pl1-x631.google.com [IPv6:2607:f8b0:4864:20::631]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 04FB6120044 for ; Wed, 14 Aug 2019 22:54:21 -0700 (PDT) Received: by mail-pl1-x631.google.com with SMTP id a93so710740pla.7 for ; Wed, 14 Aug 2019 22:54:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:mime-version:subject:date:references:to:in-reply-to:message-id; bh=v3ufrM/V9c+rzLCaSqPRqVGiaTRl/1m4lndKANNYWCI=; b=Z3oeX2P1IcWDrWrITz7bBnv1c9hCPw/pG8W67JOPFa2COWG7LngKpvluypil93ipKT b+u+3l47Yzx5JtaWYq9At19X/RZWkTc/B0JoUa30MOBWgCVz2/wex5oRDA+dQqFjMBOU bfXHF837RzHjmT3EX7gJrlvCFT1T6RqLJJrJSzzNLS+kzEL6xrZ9x+aHrnp/S9o9cbkj dLHd58/b6XfQyShvgOtcrmRjWcgnRd7uzya5ASv/JKPFg2UBBJHOQEvRiLcrwq0Fp7F6 1qiNKVqZmlNpSaRlW7gMVTh3qOtfg8+ase2i+zDKNBoAM68p5eDyZlZy0Pj0kUHgcPqG XtSw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:mime-version:subject:date:references:to :in-reply-to:message-id; bh=v3ufrM/V9c+rzLCaSqPRqVGiaTRl/1m4lndKANNYWCI=; b=nVxPuB0pDgJjx2wl8rNmfV0gjtf3Apn04BsK/BDpKJz2O74ya85u9hIgofzM1nW0L2 U8Gx64eMe8X6LQgI42+rtzx7UZvRI+5Pdq0l8FsS9g685yE9YmUJBUvoCGJ0EV/9bjl7 hhKYir15Ia5NAE6amrrpuP2RaQXjKBS+dqfBXDd7Eulemmwl5eq3He2fQKQ4NPyalyuF W4SiS6+PoJ7ezmcQfADpuB8/Q3ExozeU+ML3oR8dt6AYPwDd7a7H+uGvjW+mYU8S2/WO 3Yst4lQeA/sqJyoBlRWCNOICULBqSmItqewWYJy/C2Adl/vd6e0wtJDjeL4yIlyev8mf +f1w== X-Gm-Message-State: APjAAAWCRxK1gqWlKvRFvQwNHZtV8S4n0Wbi/zfRsv4ftXgf/xG8N87e Urrqsv+3tj3FqhC4CPOqOQy/iqKH X-Google-Smtp-Source: APXvYqxy9GHvxBE4COW15Kdpe1HLEUBLw6yLRzaLMQhJex7yJxQnatDPqTBzzKsLU2cmkJ52N/9FTA== X-Received: by 2002:a17:902:124:: with SMTP id 33mr2923214plb.145.1565848460463; Wed, 14 Aug 2019 22:54:20 -0700 (PDT) Received: from [10.128.64.149] ([136.60.227.81]) by smtp.gmail.com with ESMTPSA id z28sm1914308pfj.74.2019.08.14.22.54.19 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 14 Aug 2019 22:54:19 -0700 (PDT) From: Bret Jordan Content-Type: multipart/alternative; boundary="Apple-Mail=_BF7E9F22-163B-463B-9533-854DD8C38E22" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Wed, 14 Aug 2019 23:54:16 -0600 References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> To: Martin Thomson , ADD Mailing list In-Reply-To: Message-Id: <1610C8E4-1624-4A7E-A24B-C7D0CB06A1DE@gmail.com> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 05:54:26 -0000 --Apple-Mail=_BF7E9F22-163B-463B-9533-854DD8C38E22 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Martin, While I agree with Brian and I think he makes a lot of great points, = from my perspective the biggest problems are: 1) The potential for involuntary mass centralization of DNS data and the = consistent erosion of privacy that comes from it=20 2) Clients and apps not respecting the users=E2=80=99 or network = admins=E2=80=99 preferred DNS / DoH server 3) The fact that the WG seemed to completely ignore the split DNS use = case / requirement when they were designing this. IMO, this just shows = that the process of review and due diligence failed at some level. 4) The potential lack of DNS optimization based on geolocation and = optimized routes. =20 5) I am also worried about performance at scale and would love to see = some significantly relevant research and data that compares performance = of DoH and D53 not just from home users but also from geo-diverse = enterprises.=20 6) Potential of leakage of private corporate information out to some DoH = provider.=20 Thanks, Bret PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 "Without cryptography vihv vivc ce xhrnrw, however, the only thing that = can not be unscrambled is an egg." > On Aug 14, 2019, at 9:55 PM, Martin Thomson wrote: >=20 > I'm still struggling to find a way to make this discussion productive. = There's an end state I want to avoid where this whole thing escalates = with various attempts at blocking on one side and increasingly horrible = tunneling on the other. The fact that people are willing to talk gives = me a little hope here, but it's hard to get past the negativity. >=20 >> =46rom the application side of this, considering deployment of a = system with pre-selected resolvers, I'm motivated by understanding the = consequences of that choice. At this stage, it seems unlikely that some = new understanding will cause me (or - to be correct - my organization) = to completely reconsider plans, but that doesn't mean that those plans = can't be changed. >=20 > I am reminded of a similar change starting about 6 years ago, right = after I joined Mozilla. At the time, the web had started to move more = aggressively to HTTPS. And browsers were pushing hard. Some network = operators were quite vocal in opposition to policy changes that would = have accelerated the change. =20 >=20 > There was a complex set of use cases, as you might expect might arise = from decades of development in an environment that had no effective = security measures in place. For instance, caching of HTTP was seen at = the time as critical for network performance; many networks deployed = transparent proxies to provide that capability. There were also = transcoding proxies and all sorts of amazing optimizations in place. The = value of knowing that someone is about to watch a video - and how long = that video is - has real benefits for network capacity planning. That = sort of privacy violation was hardly the worst thing going around = either. >=20 > We started a process whereby we looked at the various use cases in = some detail and worked through each in turn. In doing so, we got better = understanding of the problem space and identified a number of key areas = of genuine pain. =20 >=20 > It required having someone sit down and produce a dispassionate = assessment of each use case in turn, reaching agreement that the = analysis was at least accurate, then deciding what was important enough = to do something about. I remember at least one face-to-face meeting and = a good number of conference calls just to get to the point. But it was = worth it. It resulted in new work being undertaken, some of which = continues today in various places. For me though, the most valuable = outcome was a better shared understanding. >=20 > It doesn't take much squinting to see the similarities in the two = situations. If others are willing to participate in such a process, I'd = be happy to be a part of that. >=20 > On Thu, Aug 15, 2019, at 12:37, Paul Hoffman wrote: >> The fact that network operators don't want DNS-over-HTTPS, = standardized=20 >> or not, is relevant when they are speaking about the problems they=20 >> face. Telling browser and app vendors that DoT is "a better option"=20= >> indicates that you know their business better than they do, and that=20= >> attitude sucks just as much as them telling you that they know more=20= >> about your business than you do. >=20 > For my own part in that, I apologize. I'm trying to do better at = formulating arguments that are less combative, and still learning. >=20 > On Thu, Aug 15, 2019, at 11:55, Stephen Farrell wrote: >> The pattern of nonsensical commentary sprinkled on this >> list is by now, and sadly, well established. >=20 > A reminder to keep things civil. We're all here to resolve our = differences. I can see that this was intended to ridicule an idea and = not an individual, but I am certain that less emotive language would be = effective. >=20 > --=20 > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add --Apple-Mail=_BF7E9F22-163B-463B-9533-854DD8C38E22 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Martin,

While I agree with Brian and I think he makes a lot of great = points, from my perspective the biggest problems are:

1) The potential for = involuntary mass centralization of DNS data and the consistent erosion = of privacy that comes from it 

2) Clients and apps not respecting the = users=E2=80=99 or network admins=E2=80=99 preferred DNS / DoH = server

3) The = fact that the WG seemed to completely ignore the split DNS use case / = requirement when they were designing this. IMO, this just shows that the = process of review and due diligence failed at some level.

4) The potential lack of = DNS optimization based on geolocation and optimized routes. =  

5) I am = also worried about performance at scale and would love to see some = significantly relevant research and data that compares performance of = DoH and D53 not just from home users but also from geo-diverse = enterprises. 

6) Potential of leakage of private corporate information out = to some DoH provider. 


Thanks,
Bret
PGP = Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 = 0050
"Without = cryptography vihv vivc ce xhrnrw, however, the only thing that can not = be unscrambled is an = egg."

On Aug 14, 2019, at 9:55 PM, Martin Thomson <mt@lowentropy.net> = wrote:

I'm still struggling to find a way to make this discussion = productive.  There's an end state I want to avoid where this whole = thing escalates with various attempts at blocking on one side and = increasingly horrible tunneling on the other.  The fact that people = are willing to talk gives me a little hope here, but it's hard to get = past the negativity.

=46rom the application side of this, = considering deployment of a system with pre-selected resolvers, I'm = motivated by understanding the consequences of that choice.  At = this stage, it seems unlikely that some new understanding will cause me = (or - to be correct - my organization) to completely reconsider plans, = but that doesn't mean that those plans can't be changed.

I am reminded of a similar change = starting about 6 years ago, right after I joined Mozilla.  At the = time, the web had started to move more aggressively to HTTPS.  And = browsers were pushing hard.  Some network operators were quite = vocal in opposition to policy changes that would have accelerated the = change.  

There was a complex set of = use cases, as you might expect might arise from decades of development = in an environment that had no effective security measures in place. =  For instance, caching of HTTP was seen at the time as critical for = network performance; many networks deployed transparent proxies to = provide that capability.  There were also transcoding proxies and = all sorts of amazing optimizations in place. The value of knowing that = someone is about to watch a video - and how long that video is - has = real benefits for network capacity planning.  That sort of privacy = violation was hardly the worst thing going around either.

We started a process whereby we looked at the = various use cases in some detail and worked through each in turn. =  In doing so, we got better understanding of the problem space and = identified a number of key areas of genuine pain.  
It required having someone sit down and produce a = dispassionate assessment of each use case in turn, reaching agreement = that the analysis was at least accurate, then deciding what was = important enough to do something about.  I remember at least one = face-to-face meeting and a good number of conference calls just to get = to the point.  But it was worth it.  It resulted in new work = being undertaken, some of which continues today in various places. =  For me though, the most valuable outcome was a better shared = understanding.

It doesn't take much = squinting to see the similarities in the two situations.  If others = are willing to participate in such a process, I'd be happy to be a part = of that.

On Thu, Aug 15, 2019, at 12:37, = Paul Hoffman wrote:
The= fact that network operators don't want DNS-over-HTTPS, standardized
or not, is relevant when they are speaking about the problems = they
face. Telling browser and app vendors that DoT is "a = better option"
indicates that you know their business = better than they do, and that
attitude sucks just as much = as them telling you that they know more
about your = business than you do.

For my = own part in that, I apologize.  I'm trying to do better at = formulating arguments that are less combative, and still learning.

On Thu, Aug 15, 2019, at 11:55, Stephen = Farrell wrote:
The = pattern of nonsensical commentary sprinkled on this
list = is by now, and sadly, well established.

A reminder to keep things civil.  We're all here to = resolve our differences.  I can see that this was intended to = ridicule an idea and not an individual, but I am certain that less = emotive language would be effective.

--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add

= --Apple-Mail=_BF7E9F22-163B-463B-9533-854DD8C38E22-- From nobody Thu Aug 15 00:21:17 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D7C9512004E for ; Thu, 15 Aug 2019 00:21:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id O26C9um0QzF3 for ; Thu, 15 Aug 2019 00:21:13 -0700 (PDT) Received: from mail-lf1-x133.google.com (mail-lf1-x133.google.com [IPv6:2a00:1450:4864:20::133]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6503712003E for ; Thu, 15 Aug 2019 00:21:12 -0700 (PDT) Received: by mail-lf1-x133.google.com with SMTP id c19so1019360lfm.10 for ; Thu, 15 Aug 2019 00:21:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=r0pp2Om9d8Eu1S1lonCSdCWZ6WIIhlgOShfkrkiSIKM=; b=mxuBjso18CjGT48eoW9bRa3FzpVjeB228hngt6FLLt1Eb+sBc/fb2/wYvHX/zeGHeE K/FhCtyS2M3lEyflylXNoJiA3nzII0VTSahsCk/C8RchsbpRHL7N2VxoHkb9kPzWRDUE uWA+PqMEmum4felTaioaijU7Gg13ZB1luFhYUb6/ZMo9K21W0lo6IW31F45l2Tnrz9FX cw6PnbmAM+S5JS8IuV/W3rm6W0XzrHMvYzkqjxsmXbBTUZY/aVK4jyMOClV/RX0jmvMF X7ZwgFksyHj1Jy7EfAjxaaV6QQAeZxmBwLholu7IAgopCs72PmCd4K/yDNRCIiXFblb+ sjig== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=r0pp2Om9d8Eu1S1lonCSdCWZ6WIIhlgOShfkrkiSIKM=; b=kS/P29jAWR6lv6g0595J6jYs6JeQqXGtqflkQUlJO8FNA/B5KaLBcMfJ2YkERt/Hxf nDZCtRMJRd1BC8l55VKzgIowWlqQfKRXV0yPBRgxNNpAbH0s7OsFVuX6GI8ZdfgpR0/T zsqaG7R2T5IV6HPVC7GVb2dNLJFFad3h6TNhfIpU48EZce4qRyRA5JAkqvP0hEUXBe2d Pv0uebSXHgTxC/0Lmhf8ZUwHQz5RAQzi7ZZ5LykGbo+8G/WPQ2DR8PC7bDccY2g0qM+K WNGaeDH5yIV3sxSlS4w5Ve0vr1Pr6Mtskfo4wQv9OPpC2o2KSXRvXwJeYE+hYcYZaSDD BaeA== X-Gm-Message-State: APjAAAXVs6UOsu8KDFdVjgbprmXpcECBaUxfjIGHBmN7Lc64uqng/S4N Yqpw+sGk0xya7kzevNnbKFvtgJV60ZWnoWY++uKdMQ== X-Google-Smtp-Source: APXvYqxm2M8VDOwvZbtQeNbx1+TssdvodSw1M3U58sXofOg8+dDemkJekHI/L8G44+p+25z1NbskkkRI9+VCDmdszBY= X-Received: by 2002:a05:6512:1da:: with SMTP id f26mr1660943lfp.129.1565853670575; Thu, 15 Aug 2019 00:21:10 -0700 (PDT) MIME-Version: 1.0 References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <1610C8E4-1624-4A7E-A24B-C7D0CB06A1DE@gmail.com> In-Reply-To: <1610C8E4-1624-4A7E-A24B-C7D0CB06A1DE@gmail.com> From: Eric Rescorla Date: Thu, 15 Aug 2019 09:20:34 +0200 Message-ID: To: Bret Jordan Cc: Martin Thomson , ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000ce2ee9059022b765" Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 07:21:16 -0000 --000000000000ce2ee9059022b765 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Thu, Aug 15, 2019 at 7:54 AM Bret Jordan wrote: > > 2) Clients and apps not respecting the users=E2=80=99 or network admins= =E2=80=99 preferred > DNS / DoH server > Well, the user and the network admin are two very different things. I agree that applications should respect the user's preferred server to the extent to which that is discernible, which is why Firefox will the user to disable DoH or select their own provider, even in cases where we have enabled DoH by default. However, in the vast majority of cases, the resolver that the machine is using does not reflect the user's conscious choice, but rather invisible network configuration, and I don't believe that it's necessarily desirable to respect that. As for respecting the network admin's preferred server, the basic assumption of DoH/TRR is that given the current information available to the client about the network's preferences, the user is better served by selecting a different resolver. If it becomes possible to determine that the network prefers a resolver with acceptable policies, that might change, but that's presently not the case. > > 3) The fact that the WG seemed to completely ignore the split DNS use cas= e > / requirement when they were designing this. IMO, this just shows that th= e > process of review and due diligence failed at some level. > Well, I can't speak for "seems", but DoH works just fine with split DNS use cases if the resolver that is selected is the split resolver. And since DoH takes no position on how the resolver is selected, I don't think that was ignored so much as out of scope. 4) The potential lack of DNS optimization based on geolocation and > optimized routes. > Our measurements indicate that to the effect there is a difference, the effect is relatively modest. See: https://blog.mozilla.org/futurereleases/2019/04/02/dns-over-https-doh-updat= e-recent-testing-results-and-next-steps/. I'm not aware of any other measurements, but I'd be interested to see them if they exist. > 5) I am also worried about performance at scale and would love to see som= e > significantly relevant research and data that compares performance of DoH > and D53 not just from home users but also from geo-diverse enterprises. > Our measurements were taken from Firefox users generally, not specifically from home users. With that said, enterprises often disable Firefox experiments, so those measurements probably overweight home users. I'd certainly be interested in hearing experimental proposals for how to target enterprises specifically. 6) Potential of leakage of private corporate information out to some DoH > provider. > I agree that this is a potential issue, which is why I think it's worthwhile to develop mechanisms for administrators to disable DoH. However, at the end of the day, those mechanisms will need to rely on control of the computer for the reasons mentioned above. -Ekr > > Thanks, > Bret > PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 > "Without cryptography vihv vivc ce xhrnrw, however, the only thing that > can not be unscrambled is an egg." > > On Aug 14, 2019, at 9:55 PM, Martin Thomson wrote: > > I'm still struggling to find a way to make this discussion productive. > There's an end state I want to avoid where this whole thing escalates wit= h > various attempts at blocking on one side and increasingly horrible > tunneling on the other. The fact that people are willing to talk gives m= e > a little hope here, but it's hard to get past the negativity. > > From the application side of this, considering deployment of a system wit= h > pre-selected resolvers, I'm motivated by understanding the consequences o= f > that choice. At this stage, it seems unlikely that some new understandin= g > will cause me (or - to be correct - my organization) to completely > reconsider plans, but that doesn't mean that those plans can't be changed= . > > > I am reminded of a similar change starting about 6 years ago, right after > I joined Mozilla. At the time, the web had started to move more > aggressively to HTTPS. And browsers were pushing hard. Some network > operators were quite vocal in opposition to policy changes that would hav= e > accelerated the change. > > There was a complex set of use cases, as you might expect might arise fro= m > decades of development in an environment that had no effective security > measures in place. For instance, caching of HTTP was seen at the time as > critical for network performance; many networks deployed transparent > proxies to provide that capability. There were also transcoding proxies > and all sorts of amazing optimizations in place. The value of knowing tha= t > someone is about to watch a video - and how long that video is - has real > benefits for network capacity planning. That sort of privacy violation w= as > hardly the worst thing going around either. > > We started a process whereby we looked at the various use cases in some > detail and worked through each in turn. In doing so, we got better > understanding of the problem space and identified a number of key areas o= f > genuine pain. > > It required having someone sit down and produce a dispassionate assessmen= t > of each use case in turn, reaching agreement that the analysis was at lea= st > accurate, then deciding what was important enough to do something about. = I > remember at least one face-to-face meeting and a good number of conferenc= e > calls just to get to the point. But it was worth it. It resulted in new > work being undertaken, some of which continues today in various places. > For me though, the most valuable outcome was a better shared understandin= g. > > It doesn't take much squinting to see the similarities in the two > situations. If others are willing to participate in such a process, I'd = be > happy to be a part of that. > > On Thu, Aug 15, 2019, at 12:37, Paul Hoffman wrote: > > The fact that network operators don't want DNS-over-HTTPS, standardized > or not, is relevant when they are speaking about the problems they > face. Telling browser and app vendors that DoT is "a better option" > indicates that you know their business better than they do, and that > attitude sucks just as much as them telling you that they know more > about your business than you do. > > > For my own part in that, I apologize. I'm trying to do better at > formulating arguments that are less combative, and still learning. > > On Thu, Aug 15, 2019, at 11:55, Stephen Farrell wrote: > > The pattern of nonsensical commentary sprinkled on this > list is by now, and sadly, well established. > > > A reminder to keep things civil. We're all here to resolve our > differences. I can see that this was intended to ridicule an idea and no= t > an individual, but I am certain that less emotive language would be > effective. > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --000000000000ce2ee9059022b765 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Thu, Aug 15, 2019 at 7:54 AM Bret = Jordan <jordan.ietf@gmail.com> wrote:

2) Clients and apps not re= specting the users=E2=80=99 or network admins=E2=80=99 preferred DNS / DoH = server











5) I am also worried about performance at scale and would love to see= some significantly relevant research and data that compares performance of= DoH and D53 not just from home users but also from geo-diverse enterprises= .=C2=A0

Our measurements were t= aken from Firefox users generally, not specifically from home users. With t= hat said, enterprises often disable Firefox experiments, so those measureme= nts probably overweight home users. I'd certainly be interested in hear= ing experimental proposals for how to target enterprises specifically.
<= /div>


6) Potential of l= eakage of private corporate information out to some DoH provider.=C2=A0

I agree that this is a potential i= ssue, which is why I think it's worthwhile to develop mechanisms for ad= ministrators to disable DoH. However, at the end of the day, those mechanis= ms will need to rely on control of the computer for the reasons mentioned a= bove.

-Ekr

Thanks,
Bret
<= span style=3D"font-size:11px">PGP Fingerprint:=C2=A063B= 4 FC53 680A 6B7D 1447 =C2=A0F2C0 74F8 ACAE 7415 0050
"Without cryptography vihv vivc ce xhrnrw, howe= ver, the only thing that can not be unscrambled is an egg."

On Aug 14, 2019, at 9:55 PM, Martin= Thomson <mt@lowe= ntropy.net> wrote:

I'm still struggling to find a way to = make this discussion productive.=C2=A0 There's an end state I want to a= void where this whole thing escalates with various attempts at blocking on = one side and increasingly horrible tunneling on the other.=C2=A0 The fact t= hat people are willing to talk gives me a little hope here, but it's ha= rd to get past the negativity.

From the ap= plication side of this, considering deployment of a system with pre-selecte= d resolvers, I'm motivated by understanding the consequences of that ch= oice.=C2=A0 At this stage, it seems unlikely that some new understanding wi= ll cause me (or - to be correct - my organization) to completely reconsider= plans, but that doesn't mean that those plans can't be changed.

I am reminded of a similar change starting about 6 years = ago, right after I joined Mozilla.=C2=A0 At the time, the web had started t= o move more aggressively to HTTPS.=C2=A0 And browsers were pushing hard.=C2= =A0 Some network operators were quite vocal in opposition to policy changes= that would have accelerated the change. =C2=A0

There was a complex = set of use cases, as you might expect might arise from decades of developme= nt in an environment that had no effective security measures in place.=C2= =A0 For instance, caching of HTTP was seen at the time as critical for netw= ork performance; many networks deployed transparent proxies to provide that= capability.=C2=A0 There were also transcoding proxies and all sorts of ama= zing optimizations in place. The value of knowing that someone is about to = watch a video - and how long that video is - has real benefits for network = capacity planning.=C2=A0 That sort of privacy violation was hardly the wors= t thing going around either.

We started a process whereby we looked = at the various use cases in some detail and worked through each in turn.=C2= =A0 In doing so, we got better understanding of the problem space and ident= ified a number of key areas of genuine pain. =C2=A0

It required havi= ng someone sit down and produce a dispassionate assessment of each use case= in turn, reaching agreement that the analysis was at least accurate, then = deciding what was important enough to do something about.=C2=A0 I remember = at least one face-to-face meeting and a good number of conference calls jus= t to get to the point.=C2=A0 But it was worth it.=C2=A0 It resulted in new = work being undertaken, some of which continues today in various places.=C2= =A0 For me though, the most valuable outcome was a better shared understand= ing.

It doesn't take much squinting to see the similarities in t= he two situations.=C2=A0 If others are willing to participate in such a pro= cess, I'd be happy to be a part of that.

On Thu, Aug 15, 2019, a= t 12:37, Paul Hoffman wrote:
The fact that net= work operators don't want DNS-over-HTTPS, standardized
or not, is r= elevant when they are speaking about the problems they
face. Telling br= owser and app vendors that DoT is "a better option"
indicates= that you know their business better than they do, and that
attitude su= cks just as much as them telling you that they know more
about your bus= iness than you do.

For my own part in that, I apologize= .=C2=A0 I'm trying to do better at formulating arguments that are less = combative, and still learning.

On Thu, Aug 15, 2019, at 11:55, Steph= en Farrell wrote:
The pattern of nonsensical c= ommentary sprinkled on this
list is by now, and sadly, well established.=

A reminder to keep things civil.=C2=A0 We're all h= ere to resolve our differences.=C2=A0 I can see that this was intended to r= idicule an idea and not an individual, but I am certain that less emotive l= anguage would be effective.

--
Add mailing list
Add@ietf.org
https://www.ietf.org/= mailman/listinfo/add

= --
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--000000000000ce2ee9059022b765-- From nobody Thu Aug 15 00:26:07 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id ED46E12004E for ; Thu, 15 Aug 2019 00:26:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=swm.pp.se Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BYElr9P6sP-T for ; Thu, 15 Aug 2019 00:26:01 -0700 (PDT) Received: from uplift.swm.pp.se (ipv6.swm.pp.se [IPv6:2a00:801::f]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1F59C12003E for ; Thu, 15 Aug 2019 00:26:00 -0700 (PDT) Received: by uplift.swm.pp.se (Postfix, from userid 501) id 858FDAF; Thu, 15 Aug 2019 09:25:58 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=swm.pp.se; s=mail; t=1565853958; bh=v7M0DXN0aNNP5vr+F862AFsZ0fDxYAo2ozzcvMpuLyc=; h=Date:From:To:cc:Subject:In-Reply-To:References:From; b=ne0jEd7SSQkZEM6o1FvPjmUl5JCo/EcXMFb+k7kK6kRbl5UheMkWtjeY8EWv33fC/ XOZHAvBzBlsWLZrjVmkfAKVvsm2dx5NAfUJvtV1hoIogbe+HIOJKojfbQWQaNK1KsE rd9pNzJYULjfAHhvdxJknHpHav2HGUZTbZ0w0zYg= Received: from localhost (localhost [127.0.0.1]) by uplift.swm.pp.se (Postfix) with ESMTP id 8241B9F; Thu, 15 Aug 2019 09:25:58 +0200 (CEST) Date: Thu, 15 Aug 2019 09:25:58 +0200 (CEST) From: Mikael Abrahamsson To: Eric Rescorla cc: Bret Jordan , ADD Mailing list , Martin Thomson In-Reply-To: Message-ID: References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <1610C8E4-1624-4A7E-A24B-C7D0CB06A1DE@gmail.com> User-Agent: Alpine 2.20 (DEB 67 2015-01-07) Organization: People's Front Against WWW MIME-Version: 1.0 Content-Type: multipart/mixed; BOUNDARY="-137064504-406447626-1565853958=:21828" Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 07:26:06 -0000 This message is in MIME format. The first part should be readable text, while the remaining parts are likely unreadable without MIME-aware tools. ---137064504-406447626-1565853958=:21828 Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8BIT On Thu, 15 Aug 2019, Eric Rescorla wrote: > On Thu, Aug 15, 2019 at 7:54 AM Bret Jordan wrote: > >> >> 2) Clients and apps not respecting the users’ or network admins’ preferred >> DNS / DoH server >> > > Well, the user and the network admin are two very different things. I agree > that applications should respect the user's preferred server to the extent > to which that is discernible, which is why Firefox will the user to disable > DoH or select their own provider, even in cases where we have enabled DoH > by default. However, in the vast majority of cases, the resolver that the > machine is using does not reflect the user's conscious choice, but rather > invisible network configuration, and I don't believe that it's necessarily > desirable to respect that. If a DoH-to-the-cloud-enabled browser stops working because of DoH related problems, who do you think the customer will call first? The browser support service, or the ISP/network customer support service? If you say they'll call the ISP/network admin, then your entire line of reasoning above falls flat. -- Mikael Abrahamsson email: swmike@swm.pp.se ---137064504-406447626-1565853958=:21828-- From nobody Thu Aug 15 00:46:19 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3C59512003E for ; Thu, 15 Aug 2019 00:46:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RPlPfK0Si7QB for ; Thu, 15 Aug 2019 00:46:15 -0700 (PDT) Received: from mail-lj1-x235.google.com (mail-lj1-x235.google.com [IPv6:2a00:1450:4864:20::235]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0F85612006D for ; Thu, 15 Aug 2019 00:46:15 -0700 (PDT) Received: by mail-lj1-x235.google.com with SMTP id t14so1475966lji.4 for ; Thu, 15 Aug 2019 00:46:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=hX87obo2kvteN05KSjb2t9R97saEfi3g1kAj9fPd3HQ=; b=yqWDq6lmvX5G5Q/OlEz+fRXyvFvxZuSZ9GSGnDEBN8Ycr5XJh8VnyxjHH5xI3L7koI DihsLs2l//9DLOevFIAgNRSDDrBezbhIycvQHaxuhooCjRxZdTDNKdJUqxstxGkVrlR5 noulItI96YnB3gI0yc4pn3y/n+6+sZ8N4hx2LmkvoFXBAbHY3CYbtYXX1wm6VjZoJKCo gKTtbbI1jXl2FkcromH3wIWL1S4s/AfBha3IFgWk3KDZFlVBkydGCne1Zb5O0eQmEgET h8x7SqqtAE+XeB2ZVEoRbDeNthIEiOX7d2eMbIKOu+R6ujF4V4nSNTvO8PDnoK+vNCOk xHYA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=hX87obo2kvteN05KSjb2t9R97saEfi3g1kAj9fPd3HQ=; b=LqyyG9eVzCq+cwNP9sEBv5eiBF9fF/YP0EWtV2xPZ8rKXCIv+gD7GZic1MYalNeOKV u+v8GA4n6RLtegwwtGT/obj0i+ReCjvPZFybbAFQpuBEn7NFavrVW8G7KE5O08qaUB+z rbTIbncZf0/qeRUuH3W1OamqDGlDerTw0JpQkc264EMPfO34TJ2fv+pr4vlAcMaprpp7 QIqtPZT9L6jKuZk5wIlHwxNXCH/9G/KwUqB8uj5PVBWbH/+pHYcs/CuKYbtAHwYgpgdb HKh4bYqCZtwUACvNCnbPljo4sUy7+nkZZEUyNEYBUNi8z6GX/PzxqP5Iny5t7jBTPt8/ 75Gw== X-Gm-Message-State: APjAAAVki4IxNRcJp11iQjsHXLY5yy8xeYASQI/cBDtlS1AE0JW9k8D6 Nwe5pMqCtB1KyKLPtuk82ZSvBov57MuaPSkdaXtGsQ== X-Google-Smtp-Source: APXvYqyy7hLinmgX+A/uU7UWA0XXROI+hMYgA77CwUTy/Cybr7FujnqFYmtfw23ecnaTQUgZSJEC9q0As3P0kyo0dis= X-Received: by 2002:a2e:5c43:: with SMTP id q64mr2002707ljb.14.1565855173290; Thu, 15 Aug 2019 00:46:13 -0700 (PDT) MIME-Version: 1.0 References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <1610C8E4-1624-4A7E-A24B-C7D0CB06A1DE@gmail.com> In-Reply-To: From: Eric Rescorla Date: Thu, 15 Aug 2019 09:45:36 +0200 Message-ID: To: Mikael Abrahamsson Cc: Bret Jordan , ADD Mailing list , Martin Thomson Content-Type: multipart/alternative; boundary="0000000000005fc263059023111e" Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 07:46:17 -0000 --0000000000005fc263059023111e Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Thu, Aug 15, 2019 at 9:25 AM Mikael Abrahamsson wrote= : > On Thu, 15 Aug 2019, Eric Rescorla wrote: > > > On Thu, Aug 15, 2019 at 7:54 AM Bret Jordan > wrote: > > > >> > >> 2) Clients and apps not respecting the users=E2=80=99 or network admin= s=E2=80=99 > preferred > >> DNS / DoH server > >> > > > > Well, the user and the network admin are two very different things. I > agree > > that applications should respect the user's preferred server to the > extent > > to which that is discernible, which is why Firefox will the user to > disable > > DoH or select their own provider, even in cases where we have enabled D= oH > > by default. However, in the vast majority of cases, the resolver that t= he > > machine is using does not reflect the user's conscious choice, but rath= er > > invisible network configuration, and I don't believe that it's > necessarily > > desirable to respect that. > > If a DoH-to-the-cloud-enabled browser stops working because of DoH relate= d > problems, who do you think the customer will call first? The browser > support service, or the ISP/network customer support service? > Misdirected customer service complaints are a fact of life. We not infrequently get bug reports on Firefox for defects in sites, servers, etc. I regularly hear complaints that if Facebook stops working for any reason, people call their ISP, so this case doesn't seem that different to me. -Ekr > -- > Mikael Abrahamsson email: swmike@swm.pp.se --0000000000005fc263059023111e Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Thu, Aug 15, 2019 at 9:25 AM Mikae= l Abrahamsson <swm= ike@swm.pp.se> wrote:
On Thu, 15 Aug 2019, Eric Rescorla wrote:

> On Thu, Aug 15, 2019 at 7:54 AM Bret Jordan <jordan.ietf@gmail.com> wrote: >
>>
>> 2) Clients and apps not respecting the users=E2=80=99 or network a= dmins=E2=80=99 preferred
>> DNS / DoH server
>>
>
> Well, the user and the network admin are two very different things. I = agree
> that applications should respect the user's preferred server to th= e extent
> to which that is discernible, which is why Firefox will the user to di= sable
> DoH or select their own provider, even in cases where we have enabled = DoH
> by default. However, in the vast majority of cases, the resolver that = the
> machine is using does not reflect the user's conscious choice, but= rather
> invisible network configuration, and I don't believe that it's= necessarily
> desirable to respect that.

If a DoH-to-the-cloud-enabled browser stops working because of DoH related =
problems, who do you think the customer will call first? The browser
support service, or the ISP/network customer support service?

Misdirected customer service complaints are a fact o= f life. We not infrequently get bug reports on Firefox for defects in sites= , servers, etc.

I regularly hear complaints t= hat if Facebook stops working for any reason, people call their ISP, so thi= s case doesn't seem that different to me.

-Ekr=



--
Mikael Abrahamsson=C2=A0 =C2=A0 email: swmike@swm.pp.se
--0000000000005fc263059023111e-- From nobody Thu Aug 15 00:51:34 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D782B12006D for ; Thu, 15 Aug 2019 00:51:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FROM_EXCESS_BASE64=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=frobbit.se Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id w2DBhTsLizRL for ; Thu, 15 Aug 2019 00:51:30 -0700 (PDT) Received: from mail.frobbit.se (mail.frobbit.se [85.30.129.176]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 62C4012003E for ; Thu, 15 Aug 2019 00:51:30 -0700 (PDT) Received: from [192.165.72.22] (unknown [IPv6:2a02:80:3ffc::22]) by mail.frobbit.se (Postfix) with ESMTPSA id 0386B21677; Thu, 15 Aug 2019 09:51:28 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=frobbit.se; s=mail; t=1565855488; bh=x6Q86iaSaMspIcIs9qGZyltnWjdPgmRbGeH8r5z8psg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=kEFWIPkJNxBLxmX2oHxB5ld9frMa1Nq610zW8SlPFCYUnaKaS3SXaYpkdlOTeO/zB B1sjGzCPGpBb7D/a0lAdBlktwYuJdWX2BaGPE8VCN+vic0BbaNRT5nj+XQjbSjjAL/ PFH9ZnUg4uM1bIxsG1KxwRCs9o5XsiKh3rGrgO2M= From: "Patrik =?utf-8?b?RsOkbHRzdHLDtm0=?=" To: "Eric Rescorla" Cc: "Bret Jordan" , "ADD Mailing list" , "Martin Thomson" Date: Thu, 15 Aug 2019 09:51:27 +0200 X-Mailer: MailMate (2.0BETAr6137) Message-ID: In-Reply-To: References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <1610C8E4-1624-4A7E-A24B-C7D0CB06A1DE@gmail.com> MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=_MailMate_68691049-7669-4DDB-99EF-AE2187EA8632_="; micalg=pgp-sha1; protocol="application/pgp-signature" Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 07:51:33 -0000 This is an OpenPGP/MIME signed message (RFC 3156 and 4880). --=_MailMate_68691049-7669-4DDB-99EF-AE2187EA8632_= Content-Type: text/plain Content-Transfer-Encoding: quoted-printable On 15 Aug 2019, at 9:20, Eric Rescorla wrote: > However, in the vast majority of cases, the resolver that the machine i= s using does not reflect the user's conscious choice, but rather invisibl= e network configuration, and I don't believe that it's necessarily desira= ble to respect that. If the user =3D=3D the network administrator, for example behind a CPE at= a persons home, then respecting the user is to respect the network admin= istrator definitions. Patrik --=_MailMate_68691049-7669-4DDB-99EF-AE2187EA8632_= Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iG0EARECAC0WIQRUH/cJI8i4DDUU3qWsxpsaC4jXzQUCXVUO/w8ccGFmQGZyb2Ji aXQuc2UACgkQrMabGguI180M0ACeII2WBzP/SgTChSf7HPrwulwEnykAn1HlPO+v 21GgyOylKWQjORPXDn9X =3cJ2 -----END PGP SIGNATURE----- --=_MailMate_68691049-7669-4DDB-99EF-AE2187EA8632_=-- From nobody Thu Aug 15 01:09:22 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EEE9812092B for ; Thu, 15 Aug 2019 01:09:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hlyud6JkM1BA for ; Thu, 15 Aug 2019 01:09:16 -0700 (PDT) Received: from giant.haxx.se (www.haxx.se [IPv6:2a00:1a28:1200:9::2]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6F2C6120071 for ; Thu, 15 Aug 2019 01:09:16 -0700 (PDT) Received: from giant.haxx.se (mail [127.0.0.1]) by giant.haxx.se (8.15.2/8.15.2/Debian-4) with ESMTPS id x7F88mFV004391 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 15 Aug 2019 10:08:48 +0200 Received: from localhost (dast@localhost) by giant.haxx.se (8.15.2/8.15.2/Submit) with ESMTP id x7F88lO8004384; Thu, 15 Aug 2019 10:08:47 +0200 X-Authentication-Warning: giant.haxx.se: dast owned process doing -bs Date: Thu, 15 Aug 2019 10:08:47 +0200 (CEST) From: Daniel Stenberg X-X-Sender: dast@giant.haxx.se To: Brian Dickson cc: Paul Hoffman , ADD Mailing list In-Reply-To: Message-ID: References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> User-Agent: Alpine 2.20 (DEB 67 2015-01-07) X-fromdanielhimself: yes MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII; format=flowed Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 08:09:20 -0000 On Thu, 15 Aug 2019, Brian Dickson wrote: > If the browser implementers would ever have considered non-443 as the port > for the DoH binding "browser implementers" allow the DoH server to be specified as a URL (template), which contains a port number. You're free to use a non-443 port there. HTTPS does however use 443 by default and it would be highly strange for DoH to try to change that... > I think all of this could have been easily avoided. I disagree. It would make DoH a whole lot less useful in my view as then coffere shop operators can easily take away my ability to chose to use DoH, for example. -- / daniel.haxx.se From nobody Thu Aug 15 01:34:51 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2378512007A for ; Thu, 15 Aug 2019 01:34:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MWkGh4RtEAPm for ; Thu, 15 Aug 2019 01:34:48 -0700 (PDT) Received: from mail-oi1-x22b.google.com (mail-oi1-x22b.google.com [IPv6:2607:f8b0:4864:20::22b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 776BE120071 for ; Thu, 15 Aug 2019 01:34:48 -0700 (PDT) Received: by mail-oi1-x22b.google.com with SMTP id a127so1027025oii.2 for ; Thu, 15 Aug 2019 01:34:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=XKlFqkLYQYD/FNIr25UedL5/yozqVen/KhitwinGCSE=; b=gQq1BAEDV2OaOwq70P4YTifKt4PB/uuGHdVUTnjc8ofj1TYfQwwj6PGSx6sr+fF5ik 4l8pGJT22xe+IXPdZGBwtkT87sdl2vXr1EY4zlZwWHQRGZM6XaneDrn3ix1/PwJwb+EH ZeHI2hafU2mSoyP4OclXkeExa/S2AKDu8TtHsdi+4ESRJXaM9StfNIA2QCj9rXPM4e+o B85H7K9jfsqnQ1gDG2ikHvBlK9e32APS4pRnqpeYUXT3R7NKdyMngLLkaOpqzsZEw5Mf stO+WEUifaD2UtY8ejgd1v9Futfu0qSpPqrm4IptktbJLyTj/96Poy7Hg7J/9JZlwh41 17vw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=XKlFqkLYQYD/FNIr25UedL5/yozqVen/KhitwinGCSE=; b=R/oqqvLFIAprX7phhpfiJt9WnOGzuEuaelhPsYH7r7aMF70fOYxgYAHoENkTMKQ91E EFJC47KY+qWD8q8Qvk1o2NG5K6GzlP3DYN35h1cDpLQyZl+1eGAlMDtUPtBnER9H7XvO ScbSpkXJ3Y3zyE19FmEWEacsjL3qmMRMdQT/kxCGkLGGDp9WSNWiygH9hu/6ov2MM0vs Sm3Ghz1UVg6y13Fo2j1oLRcS6WaRtLI0YOgx7pYGXgfbQRpjUb8YrFtfZwRC6QmkPGv4 eP1g2sMqytgwUUacfXpBV1RJnzUTzowBKmKd6E8BQeklEP0MAoivBIZF3ZOp3IywcFYc Drgg== X-Gm-Message-State: APjAAAXNwUSsSI8bbJsygy8srLtO07K2fc76LkqUm7sYmin1KfbHWo1T FYqxPtC10nVXc6Fgy3q6GXCG0rKHs/UnC6Cy3BF0YEgVo7U= X-Google-Smtp-Source: APXvYqzjpxUD5MQcMjsWrMLfpdFwhwH0ME2JtqV7ZjtQPWHahX+BhtbtaU+4tcG/tFBf3JysAXrV478+9DAZ33rW/YI= X-Received: by 2002:a02:1a86:: with SMTP id 128mr3815397jai.95.1565858087493; Thu, 15 Aug 2019 01:34:47 -0700 (PDT) MIME-Version: 1.0 References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> In-Reply-To: From: Rob Sayre Date: Thu, 15 Aug 2019 01:34:34 -0700 Message-ID: To: Martin Thomson Cc: ADD Mailing list Content-Type: multipart/alternative; boundary="00000000000012e674059023bf87" Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 08:34:50 -0000 --00000000000012e674059023bf87 Content-Type: text/plain; charset="UTF-8" On Wed, Aug 14, 2019 at 8:55 PM Martin Thomson wrote: > On Thu, Aug 15, 2019, at 11:55, Stephen Farrell wrote: > > The pattern of nonsensical commentary sprinkled on this > > list is by now, and sadly, well established. > > A reminder to keep things civil. We're all here to resolve our > differences. I can see that this was intended to ridicule an idea and not > an individual, but I am certain that less emotive language would be > effective. > It's not clear to me why you would be certain. thanks, Rob --00000000000012e674059023bf87 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Wed, Aug 14, 2019 at 8:55 PM Martin Th= omson <mt@lowentropy.net> wr= ote:
On Thu, Aug 15, 2019, at 11:55, Stephen Farrell wrote:
> The pattern of nonsensical commentary sprinkled on this
> list is by now, and sadly, well established.

A reminder to keep things civil.=C2=A0 We're all here to resolve our di= fferences.=C2=A0 I can see that this was intended to ridicule an idea and n= ot an individual, but I am certain that less emotive language would be effe= ctive.

It's not clear to me why you= would be=C2=A0certain.

thanks,
Rob
--00000000000012e674059023bf87-- From nobody Thu Aug 15 02:35:02 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D38BD120071 for ; Thu, 15 Aug 2019 02:34:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id k4q026STQHN0 for ; Thu, 15 Aug 2019 02:34:57 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DCAAE12006D for ; Thu, 15 Aug 2019 02:34:56 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 21245BE39; Thu, 15 Aug 2019 10:34:55 +0100 (IST) Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fOxAG7OHi4Qb; Thu, 15 Aug 2019 10:34:54 +0100 (IST) Received: from [134.226.36.93] (unknown [134.226.36.93]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id AE6D4BE2E; Thu, 15 Aug 2019 10:34:54 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1565861694; bh=5TOEKKd8eNNsyHy2+EVIhMR28KHVBMer8wjrzWeignU=; h=Subject:To:References:From:Date:In-Reply-To:From; b=0zf0gVAsGavwgNEuAEy6iI5fN3pkCwd5wflJmVIXbGullGPOHIeA5Yzgux0Pd15g9 3aO7B1s5wRW2wch99n5v3SiVmI2YuLDEYDAgYBoN1RQ2V6eS806pLUsJmCAoyJmgFt IpJYYPc18Jj0OGAETKtPHboMGSTyyTjK2Fp8G07U= To: Martin Thomson , add@ietf.org References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: Date: Thu, 15 Aug 2019 10:34:53 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="dz5c9kXExrqeDZc5C16nsl7q3e2tZf2wh" Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 09:35:00 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --dz5c9kXExrqeDZc5C16nsl7q3e2tZf2wh Content-Type: multipart/mixed; boundary="wIOB0hz6GyS44WrSi0dzhzyO9O7JihuKX"; protected-headers="v1" From: Stephen Farrell To: Martin Thomson , add@ietf.org Message-ID: Subject: Re: [Add] [Ext] Validity of network administrator role References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> In-Reply-To: --wIOB0hz6GyS44WrSi0dzhzyO9O7JihuKX Content-Type: multipart/mixed; boundary="------------BF8B2B8D2214FDCBD8F4B885" Content-Language: en-GB This is a multi-part message in MIME format. --------------BF8B2B8D2214FDCBD8F4B885 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hi Martin, On 15/08/2019 04:55, Martin Thomson wrote: > On Thu, Aug 15, 2019, at 11:55, Stephen Farrell wrote: >> The pattern of nonsensical commentary sprinkled on this list is by >> now, and sadly, well established. > A reminder to keep things civil. We're all here to resolve our > differences. I can see that this was intended to ridicule an idea > and not an individual, but I am certain that less emotive language > would be effective. Hmm. Well I don't think calling out a nonsensical argument is uncivil, nor was I ridiculing anything or anyone. In fact, treating such an argument as if it were not nonsensical would seem to me more likely ridiculous and likely to lead to emotive language and ridicule, especially if there's a pattern of such careless statements, which I think is the case. I do get that all may make it harder to establish the kind of conversation you're trying to have, but ISTM that the problem is not with calling out nonsense, but rather with emitting nonsense. The people who have problems with DoH do have good arguments to make but sprinkling bad arguments amongst those is a big part of what makes the discussion harder IMO. Cheers, S. --------------BF8B2B8D2214FDCBD8F4B885 Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------BF8B2B8D2214FDCBD8F4B885-- --wIOB0hz6GyS44WrSi0dzhzyO9O7JihuKX-- --dz5c9kXExrqeDZc5C16nsl7q3e2tZf2wh Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAl1VJz0ACgkQWrL68XsX K+oMaw/7B+oh6hnDdt6DDqLHlZux5F79w1EBOruOwSoWqY4OnfllJxrnCPECQLqd 5QRC/7qb2fAR0pxhD/XFy8vWpE1gy5FWvWSpbxUa0QKPB7D6AAz5MB1RN6EXAEv+ sMM4gPNSoMVHriJ4Ktpll31hncP9d0gZlWU4Vp8Xp2Qzy+epaui7LgHTi8vffxp9 vbk3nU039QgtxfkPgvQcttivLYk/s//9PzTzsbDTu7dg2r87JS5sV51er9cSm4Hn 7ZE2FOqvdtTZn62D/Bly4Nwg5qShmG2cp/6TX3icDFu5Ig7pSYsGsaBTmCgPp2VN fif8bVsEwFNOWjGrL+0hbMxlx5qgA9GHTlUHc1mEuRQ+AhuBtzTA+rJl/bGMmkdo tI+nJTIUXzUGyZL/uJF4lr8i+jWANTKkoLBzDtglrygWmQvMup/2/cEJx7c/DAp3 NlAPToZvnv2U+sdL+bYUDqYBU79pQ4IJqCuLoPApDahfzVK13fiNJF407ZfKNL0t exptFiEMK8//+or5OGOl4Zv4IvIC0kabswb8PQ97J3zhnXwoLWyPj/brCb26f4Du OvHAewsAdB/RI5ORy8PB8s7PnhbssbDUaNQHTDxEjwn1op5IhLfSUl6kq+ZyAzxg F5+gujVLnKL9Y1UOVwiY1nwCjZJrITnhXZKoydzlVyLYuwzi4yE= =anzL -----END PGP SIGNATURE----- --dz5c9kXExrqeDZc5C16nsl7q3e2tZf2wh-- From nobody Thu Aug 15 02:58:41 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C562C12008A for ; Thu, 15 Aug 2019 02:58:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dzNQGffmpALV for ; Thu, 15 Aug 2019 02:58:37 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2D56C120072 for ; Thu, 15 Aug 2019 02:58:37 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 82F09BE5D; Thu, 15 Aug 2019 10:58:35 +0100 (IST) Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id S98HV4LuHY3I; Thu, 15 Aug 2019 10:58:35 +0100 (IST) Received: from [134.226.36.93] (unknown [134.226.36.93]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 31641BE5B; Thu, 15 Aug 2019 10:58:35 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1565863115; bh=sh7huCT61Ibxb9x+Sc3I3CqDN8c0iPF1ZCpR0MddE9Y=; h=To:Cc:References:From:Subject:Date:In-Reply-To:From; b=yKcuysf+Nxd9Upji4HOsKhrwO7Mda5D2DZBK3i6NBifFPtG8dIhrgwgMFkoq+Tsbu n3M0VF6MiuUdmr5P+J40KPnvdgwdrhdqzzdr4MvdgQPU5e9H1Q/F1CVRb+vlkARJzG iPE/Ut349FiVn5MqXTRuk326x2i+hKe1r9qEuDMw= To: =?UTF-8?B?UGF0cmlrIEbDpGx0c3Ryw7Zt?= , Eric Rescorla Cc: ADD Mailing list , Martin Thomson , Bret Jordan References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <1610C8E4-1624-4A7E-A24B-C7D0CB06A1DE@gmail.com> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: <6bbc4857-449e-e587-1e16-c0ee7d1f2aa8@cs.tcd.ie> Date: Thu, 15 Aug 2019 10:58:34 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="l17LNISNLbzsfZkvYuWm1ZFhDrCl8Yban" Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 09:58:40 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --l17LNISNLbzsfZkvYuWm1ZFhDrCl8Yban Content-Type: multipart/mixed; boundary="1kV52FtGhm5ZtWYE2GHiJQudYa0J7DeTk"; protected-headers="v1" From: Stephen Farrell To: =?UTF-8?B?UGF0cmlrIEbDpGx0c3Ryw7Zt?= , Eric Rescorla Cc: ADD Mailing list , Martin Thomson , Bret Jordan Message-ID: <6bbc4857-449e-e587-1e16-c0ee7d1f2aa8@cs.tcd.ie> Subject: Re: [Add] [Ext] Validity of network administrator role References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <1610C8E4-1624-4A7E-A24B-C7D0CB06A1DE@gmail.com> In-Reply-To: --1kV52FtGhm5ZtWYE2GHiJQudYa0J7DeTk Content-Type: multipart/mixed; boundary="------------02F60CE605B0155D249960A5" Content-Language: en-GB This is a multi-part message in MIME format. --------------02F60CE605B0155D249960A5 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hi Patrik, On 15/08/2019 08:51, Patrik F=C3=A4ltstr=C3=B6m wrote: >=20 >=20 > On 15 Aug 2019, at 9:20, Eric Rescorla wrote: >=20 >> However, in the vast majority of cases, the resolver that the >> machine is using does not reflect the user's conscious choice, but >> rather invisible network configuration, and I don't believe that >> it's necessarily desirable to respect that. >=20 > If the user =3D=3D the network administrator, for example behind a CPE = at > a persons home, then respecting the user is to respect the network > administrator definitions. I'm not sure its that simple. In the case of Barbara's home n/w I think your point applies as she stated. In my home n/w it doesn't as I've no problem with a browser using DoH in the way Mozilla have planned. I could still have problems with other ADD setups, e.g. if some other application was (ab)using DNS traffic for profit or tracking or was using a DNS recursive that was flakey. But that's more a problem with that application than with DoH, for me. But I would guess for the vast majority of home networks, the user is not really the n/w administrator, but rather their current ISP is really performing that role, for DNS. And in those cases, I would say most people don't care as they don't even know DNS exists. Of those who do care, I have no idea how many might prefer to keep with their ISP's chosen DNS settings and how many might be ok with Mozilla's plans. I would guess many would be unhappy if their DNS server were flakey or abusive, and while that could happen in any scenario, presumably many home network users are ok with their ISP controlling DNS as they'd change ISP. There are of course some places where there's little choice of ISP, but I'm not sure if flakey DNS is or is not a real problem in those places. I guess (but don't know), that for a home network user, ADD being used by many applications is perhaps more risky than the status quo ante, where the ISP provides DNS for basically all applications, as the probability of a flakey or abusive DNS server being used by some application could be high. OTOH of course, if the same application install is used in the home but also in multiple other n/w contexts, (like a browser on a mobile device) then the risk/benefit balance can change, so that the benefit of DNS privacy via DoH is more substantial. All that said though, I'm not sure what the IETF could or should do about the risks and benefits here, other than perhaps analyse and document them in what may have to be a fairly abstract manner, in the hope that that helps n/w admins and application developers do better than would otherwise be the case. Cheers, S. >=20 > Patrik >=20 >=20 --------------02F60CE605B0155D249960A5 Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------02F60CE605B0155D249960A5-- --1kV52FtGhm5ZtWYE2GHiJQudYa0J7DeTk-- --l17LNISNLbzsfZkvYuWm1ZFhDrCl8Yban Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAl1VLMoACgkQWrL68XsX K+pDhA/+Ilz21TQzOrjMBAQv0po92BEyy6pqRkWk1BSc1VyNECH9zGpn2PPXJflU IWotcWG2Tiii2AbkjF68zLaHOnO44uNAKr6M7MrahfFg2iH1pdxiZgd43vDLc3r5 ZxJ+zcD8+XuYwZWD3lSMjvY/okb//0VPEWpDy7WtAODKigt1bV5sQNRmbC8WRSBn xw0t4dipftSXpLmeUH41kCTDrkDo9ZnX/+aWi4TNyWTQ0tPEWpTbWeBzo334hEJi gpL3BoHdIKYKTOFSq7ug95cYxjhzfYM7b7q7WQ4jCsQAKi7pK7D1asH6KQfLu8PH urbQVSF0LdoF5Buko2yGopD/MHXqh6dXKB73wHQulkcNJaboJyfhkQcuntUtnyB6 jiL1w0IJyZxnnjVBg6t1i86GAz03c4eMWNgAwHVNgH6epugym8IpBUEKoDQYffES F8nkYTb+uQDx77BhDlXxhoNr9H2TPizKI1phGOgjATkKb8MzYnKYrhmhNFIgef2H PnvMPK7+DEZqsDMWzIu8G/uautdwis3s2KNb3GxdkUIq0isZjsfvB3pAwys/CSch py2u+opbeBJBw3TPRryKQEkkHYYdbGuvZtXC/rQsNPljQAImxFX2FIIlmttdOXNi XnexoEZcDcIG//kkXbzECxzpWXgMvwxdPtvNpGELtuiL6Gmv308= =cqSB -----END PGP SIGNATURE----- --l17LNISNLbzsfZkvYuWm1ZFhDrCl8Yban-- From nobody Thu Aug 15 03:14:35 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CB69F120094 for ; Thu, 15 Aug 2019 03:14:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8ZdEjhV77i4R for ; Thu, 15 Aug 2019 03:14:32 -0700 (PDT) Received: from mail-lj1-x22b.google.com (mail-lj1-x22b.google.com [IPv6:2a00:1450:4864:20::22b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 57A7412008B for ; Thu, 15 Aug 2019 03:14:32 -0700 (PDT) Received: by mail-lj1-x22b.google.com with SMTP id t14so1787300lji.4 for ; Thu, 15 Aug 2019 03:14:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=Agm2YqGqbMH5mzKe1QemPdSiffH39U7giMyHPMq+MBQ=; b=XoVw7gBMg2NsxSSdOWyxVoJvK90goAkuZXgVPjGiSl41AiF3R1ewc7OqH5XL17ztkQ w/XWJZIHkZQfyY6B01PFGCXzJSIMp31It48NTU/CzujqapUA0a1mfb0kK9drwZTLNSVo /re4jarvAD2nhWn1hASjdFRKHaMBIpXQO2iKhcjcDBrXodlRAe2xNyMuOiCe/S/TEKuw ord8OInLUtdTXCYVBpoUj9BhQThXgd56wfeYHP3kdoMBsf3Wudvf+8rPeE6T84lFo1hH nqEu6ETW8o/KILdty4ZrD2H76motpmJCTIpAj63/qf+KlrSlMU8jo1Fh932k182+l0EO jKpQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=Agm2YqGqbMH5mzKe1QemPdSiffH39U7giMyHPMq+MBQ=; b=T185jyjEpU3QpqiC758As3tPFNkqsSGyFNMpIfgmhrrseqHfB77A6kVItWoXHnsElR IB4IdiJ3hNe8uLC9Cc5l85vjDklOzXhWKfq7OjF7fJqY35UnAdLIMwE/117KbVaqxaiR 0HhCUShW3u/QaLp+LPFMGaqHprHPMtPZ7Z72/L9o5NX5EHbuG5QLc+7D2Y69ulj9ti0l f1e9+idA2eNDiwNOWkRGSc/5LomCkOi/ePygkLtJYYnf57gnp4bTJQsAqUKD3Fxo6Iug D15RjCXP2jfANbRh7v7uj38ofpnVyyr+gM1m/ArKouyhZpHitbcdHoUZDQJo9aDFxHUr CeMA== X-Gm-Message-State: APjAAAVOlkJ/WTNhuqpnYRckSjz8UjGfMPqHdPr9mbtYDzSttNVn9oTe 48EHn0YMECFAttBnmcxnWPhMv+nVN97wWJm+fu8qCg== X-Google-Smtp-Source: APXvYqz6TvhCW3z2K8PVomfdugiExToCSehKxsnGAQ048YwLunu8iU59PRCVI9EdZWH902KiR0bClhrgR/9kpfTL5UY= X-Received: by 2002:a2e:9acf:: with SMTP id p15mr2289566ljj.13.1565864070374; Thu, 15 Aug 2019 03:14:30 -0700 (PDT) MIME-Version: 1.0 References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <1610C8E4-1624-4A7E-A24B-C7D0CB06A1DE@gmail.com> In-Reply-To: From: Eric Rescorla Date: Thu, 15 Aug 2019 12:13:53 +0200 Message-ID: To: =?UTF-8?B?UGF0cmlrIEbDpGx0c3Ryw7Zt?= Cc: Bret Jordan , ADD Mailing list , Martin Thomson Content-Type: multipart/alternative; boundary="000000000000ae752905902523eb" Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 10:14:34 -0000 --000000000000ae752905902523eb Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Thu, Aug 15, 2019 at 9:51 AM Patrik F=C3=A4ltstr=C3=B6m = wrote: > > > On 15 Aug 2019, at 9:20, Eric Rescorla wrote: > > > However, in the vast majority of cases, the resolver that the machine i= s > using does not reflect the user's conscious choice, but rather invisible > network configuration, and I don't believe that it's necessarily desirabl= e > to respect that. > > If the user =3D=3D the network administrator, for example behind a CPE at= a > persons home, then respecting the user is to respect the network > administrator definitions. > Well, maybe. For instance, if I am at friend's house, they're the network administrator and I am the user. However, in cases where they are one and the same, yes, it would be great to have a way to mechanically determine that that was the case. However, the current technical mechanisms we have do not in fact provide that. -Ekr > Patrik > --000000000000ae752905902523eb Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Thu, Aug 15, 2019 at 9:51 AM Patri= k F=C3=A4ltstr=C3=B6m <paf@frobbit.se> wrote:


On 15 Aug 2019, at 9:20, Eric Rescorla wrote:

> However, in the vast majority of cases, the resolver that the machine = is using does not reflect the user's conscious choice, but rather invis= ible network configuration, and I don't believe that it's necessari= ly desirable to respect that.

If the user =3D=3D the network administrator, for example behind a CPE at a= persons home, then respecting the user is to respect the network administr= ator definitions.

Well, maybe.=C2=A0 Fo= r instance, if I am at friend's house, they're the network administ= rator and I am the user. However, in cases where they are one and the same,= yes, it would be great to have a way to mechanically determine that that w= as the case. However, the current technical mechanisms we have do not in fa= ct provide that.

-Ekr


=C2=A0 =C2=A0Patrik
--000000000000ae752905902523eb-- From nobody Thu Aug 15 03:22:20 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EF5D7120072 for ; Thu, 15 Aug 2019 03:22:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.299 X-Spam-Level: X-Spam-Status: No, score=-4.299 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=open-xchange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KdNONwzPN70V for ; Thu, 15 Aug 2019 03:22:17 -0700 (PDT) Received: from mx4.open-xchange.com (alcatraz.open-xchange.com [87.191.39.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 40503120098 for ; Thu, 15 Aug 2019 03:22:17 -0700 (PDT) Received: from open-xchange.com (imap.open-xchange.com [10.20.30.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx4.open-xchange.com (Postfix) with ESMTPS id 74CC76A28F; Thu, 15 Aug 2019 12:22:15 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=open-xchange.com; s=201705; t=1565864535; bh=kZDZoNvejzJPdh+//zfquiQG8JonwGe5GOuYuhWiJrQ=; h=From:Subject:Date:In-Reply-To:Cc:To:References:From; b=QprqB1XnD07dK/ImXFUXnUL7xWwJ/LOEACtdgt9sI+a/UM2wgzuHWOh5RvI7YjcDi NuZJtSgHdoyyIYK+cOgEFLeNWZqeh9OLyTwUBbqZkfHb3Csnnp5vGSOLGAp35p8fhx QbgxRumwg8QQGBSpcslhD7lwJvxYlI3KEH3MwPqQrhy6cadxTZMPE2aVkKIIyxH1TB luoSdJ6PutAZybFEmpfU6FANYwrNERMj6QBka2+tUF444UfHU8z5zIWhlAoRgt9oBp EuTsA84fPnNf1cwbyZmQVfidNXdfG11vSIX3mUztx4Fe4r0D6O6pZyV4qEzAPGIS2S M6W7oS+QtfWIQ== Received: from [192.168.1.128] (host31-53-106-255.range31-53.btcentralplus.com [31.53.106.255]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by open-xchange.com (Postfix) with ESMTPSA id 279613C03A7; Thu, 15 Aug 2019 12:22:15 +0200 (CEST) From: Neil Cook Message-Id: <31226710-8C33-4696-90F3-4E05ED82FB05@open-xchange.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_8D7B0013-F1B6-47A7-9142-2C3DE38BF089" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Thu, 15 Aug 2019 11:22:13 +0100 In-Reply-To: <6bbc4857-449e-e587-1e16-c0ee7d1f2aa8@cs.tcd.ie> Cc: =?utf-8?B?UGF0cmlrIEbDpGx0c3Ryw7Zt?= , Eric Rescorla , ADD Mailing list , Bret Jordan , Martin Thomson To: Stephen Farrell References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <1610C8E4-1624-4A7E-A24B-C7D0CB06A1DE@gmail.com> <6bbc4857-449e-e587-1e16-c0ee7d1f2aa8@cs.tcd.ie> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 10:22:19 -0000 --Apple-Mail=_8D7B0013-F1B6-47A7-9142-2C3DE38BF089 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 > On 15 Aug 2019, at 10:58, Stephen Farrell = wrote: >=20 > But I would guess for the vast majority of home networks, the > user is not really the n/w administrator, but rather their > current ISP is really performing that role, for DNS. And in > those cases, I would say most people don't care as they don't > even know DNS exists. Of those who do care, I have no idea > how many might prefer to keep with their ISP's chosen DNS > settings and how many might be ok with Mozilla's plans. >=20 > I would guess many would be unhappy if their DNS server > were flakey or abusive, and while that could happen in any > scenario, presumably many home network users are ok with > their ISP controlling DNS as they'd change ISP. There > are of course some places where there's little choice of > ISP, but I'm not sure if flakey DNS is or is not a real > problem in those places. One very real use case, which we have discussed on this list multiple = times, is that of people using an ISP=E2=80=99s parental control (and = indeed malware detection) products which are based on DNS. In the UK = that is a lot of households (over a million if I=E2=80=99m not = mistaken).=20 So I do know that all those people, who almost certainly know nothing = about DNS, will be unhappy with Mozilla (or whomever) if it means that = their parental controls stop working. Neil Cook neil.cook@open-xchange.com = --------------------------------------------------------------------------= ----------- Open-Xchange AG, Rollnerstr. 14, 90408 Nuremberg, District Court = Nuremberg HRB 24738 Managing Board: Rafael Laguna de la Vera, Carsten Dirks, Michael = Knapstein, Stephan Martin=20 Chairman of the Board: Richard Seibt European Office:=20 Open-Xchange GmbH, Olper Huette 5f, D-57462 Olpe, Germany, District = Court Siegen, HRB 8718=20 Managing Director: Frank Hoberg US Office:=20 Open-Xchange. Inc., 530 Lytton Avenue, Palo Alto, CA 94301, USA=20 = --------------------------------------------------------------------------= ----------- --Apple-Mail=_8D7B0013-F1B6-47A7-9142-2C3DE38BF089 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8

On 15 Aug 2019, at 10:58, Stephen Farrell <stephen.farrell@cs.tcd.ie> wrote:

But I would guess for the vast = majority of home networks, the
user is not really the n/w = administrator, but rather their
current ISP is really = performing that role, for DNS. And in
those cases, I would = say most people don't care as they don't
even know DNS = exists. Of those who do care, I have no idea
how many = might prefer to keep with their ISP's chosen DNS
settings = and how many might be ok with Mozilla's plans.

I would guess many would be unhappy if their DNS server
were flakey or abusive, and while that could happen in any
scenario, presumably many home network users are ok with
their ISP controlling DNS as they'd change ISP. There
are of course some places where there's little choice of
ISP, but I'm not sure if flakey DNS is or is not a real
problem in those places.

One = very real use case, which we have discussed on this list multiple times, = is that of people using an ISP=E2=80=99s parental control (and indeed = malware detection) products which are based on DNS. In the UK that is a = lot of households (over a million if I=E2=80=99m not = mistaken). 

So I do know that = all those people, who almost certainly know nothing about DNS, will be = unhappy with Mozilla (or whomever) if it means that their parental = controls stop working.

Neil Cook
neil.cook@open-xchange.com

---------------------------------------------------------------= ----------------------
Open-Xchange AG, Rollnerstr. 14, = 90408 Nuremberg, District Court Nuremberg HRB 24738
Managing Board: Rafael Laguna de la Vera, Carsten Dirks, = Michael Knapstein, Stephan Martin 
Chairman of = the Board: Richard Seibt

European = Office: 
Open-Xchange GmbH, Olper Huette = 5f, D-57462 Olpe, Germany, District Court Siegen, HRB = 8718 
Managing Director: Frank Hoberg
US Office: 
Open-Xchange. Inc., 530 = Lytton Avenue, Palo Alto, CA 94301, USA 
---------------------------------------------------------------= ----------------------

= --Apple-Mail=_8D7B0013-F1B6-47A7-9142-2C3DE38BF089-- From nobody Thu Aug 15 03:28:20 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A12B1120094 for ; Thu, 15 Aug 2019 03:28:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=swm.pp.se Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Mvv6D9r22p0M for ; Thu, 15 Aug 2019 03:28:16 -0700 (PDT) Received: from uplift.swm.pp.se (ipv6.swm.pp.se [IPv6:2a00:801::f]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B28F0120072 for ; Thu, 15 Aug 2019 03:28:16 -0700 (PDT) Received: by uplift.swm.pp.se (Postfix, from userid 501) id E09C9AF; Thu, 15 Aug 2019 12:28:13 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=swm.pp.se; s=mail; t=1565864893; bh=PRgJphcqTwTUVTIuh3yb3Dwur9BP9UfcSsu5ev8ygvk=; h=Date:From:To:cc:Subject:In-Reply-To:References:From; b=hFu3hIBAI5FIJ4LB6en0+Z6Q3posc4wFcr5TBLcq1vOqn9D2ptOQqtwNpthW1JYXr fmLHyJdciBFiBgW7eqMm6/J+lXXj7JIjtPFkRbq/6z2qBiCf+716HaxCJQPZNduhPU f7HdjRJC3I8/cZ48i9hnKQ/LK+aSo0HyvNrOErcc= Received: from localhost (localhost [127.0.0.1]) by uplift.swm.pp.se (Postfix) with ESMTP id DE0079F; Thu, 15 Aug 2019 12:28:13 +0200 (CEST) Date: Thu, 15 Aug 2019 12:28:13 +0200 (CEST) From: Mikael Abrahamsson To: Eric Rescorla cc: =?ISO-8859-15?Q?Patrik_F=E4ltstr=F6m?= , ADD Mailing list , Martin Thomson , Bret Jordan In-Reply-To: Message-ID: References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <1610C8E4-1624-4A7E-A24B-C7D0CB06A1DE@gmail.com> User-Agent: Alpine 2.20 (DEB 67 2015-01-07) Organization: People's Front Against WWW MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII; format=flowed Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 10:28:19 -0000 On Thu, 15 Aug 2019, Eric Rescorla wrote: > Well, maybe. For instance, if I am at friend's house, they're the > network administrator and I am the user. However, in cases where they > are one and the same, yes, it would be great to have a way to > mechanically determine that that was the case. However, the current > technical mechanisms we have do not in fact provide that. There is no mechanical way to test this unless you ask the user. There is no way anyone can come up with a heuristic for "who does the user trust". If an application vendor wants this information from the OS/connection manager, then we should make sure this information is available via some mechanism/API. -- Mikael Abrahamsson email: swmike@swm.pp.se From nobody Thu Aug 15 03:28:53 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5C40F120072 for ; Thu, 15 Aug 2019 03:28:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id p50_nbEFRK3B for ; Thu, 15 Aug 2019 03:28:50 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7C1A412008C for ; Thu, 15 Aug 2019 03:28:50 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 9FFD7BE47; Thu, 15 Aug 2019 11:28:48 +0100 (IST) Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IakFgy9OrDbt; Thu, 15 Aug 2019 11:28:48 +0100 (IST) Received: from [134.226.36.93] (unknown [134.226.36.93]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 5F0D0BE39; Thu, 15 Aug 2019 11:28:48 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1565864928; bh=t8feouBs1JN1F5nEd4UJrhqQAWbvCwIluxLkbcoxgIs=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From; b=ng7ioeiMoNsBMTihsRuPxLELRz5hh3SpN3S+YUsqX4xB0a4j6Asiz0NmZgL/wBwd8 JnmxfBH5jFYPYvA5S/YZ97izFx7crF7x971ODOQ6Kec+eFGP4Ln4lTIaENX27rW3Zy RYwKkRDTjBuPMsueW8Ixs25nolxl8HW4wh5z8HG4= To: Neil Cook Cc: =?UTF-8?B?UGF0cmlrIEbDpGx0c3Ryw7Zt?= , Eric Rescorla , ADD Mailing list , Martin Thomson , Bret Jordan References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <1610C8E4-1624-4A7E-A24B-C7D0CB06A1DE@gmail.com> <6bbc4857-449e-e587-1e16-c0ee7d1f2aa8@cs.tcd.ie> <31226710-8C33-4696-90F3-4E05ED82FB05@open-xchange.com> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: <1d8539be-d4c3-4185-43b8-be506167d8fe@cs.tcd.ie> Date: Thu, 15 Aug 2019 11:28:47 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: <31226710-8C33-4696-90F3-4E05ED82FB05@open-xchange.com> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="72idxyY0mtRS1c4op7iSxikv1fIkOfAhi" Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 10:28:52 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --72idxyY0mtRS1c4op7iSxikv1fIkOfAhi Content-Type: multipart/mixed; boundary="xrpiCVcVcWQUcTBqUH3Z1TlrdKkjICv1a"; protected-headers="v1" From: Stephen Farrell To: Neil Cook Cc: =?UTF-8?B?UGF0cmlrIEbDpGx0c3Ryw7Zt?= , Eric Rescorla , ADD Mailing list , Martin Thomson , Bret Jordan Message-ID: <1d8539be-d4c3-4185-43b8-be506167d8fe@cs.tcd.ie> Subject: Re: [Add] [Ext] Validity of network administrator role References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <1610C8E4-1624-4A7E-A24B-C7D0CB06A1DE@gmail.com> <6bbc4857-449e-e587-1e16-c0ee7d1f2aa8@cs.tcd.ie> <31226710-8C33-4696-90F3-4E05ED82FB05@open-xchange.com> In-Reply-To: <31226710-8C33-4696-90F3-4E05ED82FB05@open-xchange.com> --xrpiCVcVcWQUcTBqUH3Z1TlrdKkjICv1a Content-Type: multipart/mixed; boundary="------------F882279B60B4B3D92507D1FD" Content-Language: en-GB This is a multi-part message in MIME format. --------------F882279B60B4B3D92507D1FD Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On 15/08/2019 11:22, Neil Cook wrote: > One very real use case, which we have discussed on this list multiple > times, is that of people using an ISP=E2=80=99s parental control (and i= ndeed > malware detection) products which are based on DNS. In the UK that is > a lot of households (over a million if I=E2=80=99m not mistaken). >=20 > So I do know that all those people, who almost certainly know nothing > about DNS, will be unhappy with Mozilla (or whomever) if it means > that their parental controls stop working. That's a fair point. Not that I believe in such controls nor their efficacy, but I do accept that surprising some of those people will not be universally welcomed. So if we did document the risks/benefits, that element of surprise ought be in the risk column I guess. S. --------------F882279B60B4B3D92507D1FD Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------F882279B60B4B3D92507D1FD-- --xrpiCVcVcWQUcTBqUH3Z1TlrdKkjICv1a-- --72idxyY0mtRS1c4op7iSxikv1fIkOfAhi Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAl1VM98ACgkQWrL68XsX K+prjRAAmd3R0h2dUsQqnlut7hS69e/avuiyLi9bsjdLE8hXpk2Cm+OdWgJstU+q kjFJDI9CPI2i3tihTJ9t+OYcgVeFIz0XvaKnykPF6SzAlBtE1f3bTZ/b5H/kh5tF 4/Ob67IWvSKpgsJpE30v224D4nE14Ok+5S7H5eB54dsiyvuaSDLKor71hHAKGqVl DpODd/sI5v/BVQQ22oZP/Wo/NLLfSuHGpAkWwBzcCNI7sLuIlal47DYDQ83P4T25 EMcd3phN1GkQRa4m/3McCeeuzaNfIEWz3Qa5NBLMoZQua01chd4+ZMVPdcC/8ddg oSeCNocox8a1q9wT0rO277M/zYZJ4w4b2TJ2sVOXvprahB7EamipXVdcahBGa2/I VDY69ESLdKmkRuHg+ovfVv6Ef58rjfWQwh3KhwhE7AUGG6aafLlBs4yGqjYcEsz4 qirSX4ihz8/T86XxSIGrsl/cyewmSbshtH4Q/rkvv6ixANVbXKt1hHC3BeNFxngV rtV3aU1Dthr8//plVD5BtqvtrLGF2/00yoRrXi68zBD2smL4lJuZyzOM46u9wJO/ HeYa3OCvDSzmR1/el3pfrvCzz0YBz9lHRU7b23RENU9whQ88DF1VtKMmeCryI4J9 4wagq2tpzMgQEla6O0+AzWUMPYYS1Ymd9u2Hy5MU6tCxdOp5gJs= =JFf7 -----END PGP SIGNATURE----- --72idxyY0mtRS1c4op7iSxikv1fIkOfAhi-- From nobody Thu Aug 15 03:30:28 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 43464120094 for ; Thu, 15 Aug 2019 03:30:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=swm.pp.se Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Spq9EyzPAFgt for ; Thu, 15 Aug 2019 03:30:25 -0700 (PDT) Received: from uplift.swm.pp.se (ipv6.swm.pp.se [IPv6:2a00:801::f]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D8943120072 for ; Thu, 15 Aug 2019 03:30:24 -0700 (PDT) Received: by uplift.swm.pp.se (Postfix, from userid 501) id 7645DB1; Thu, 15 Aug 2019 12:30:23 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=swm.pp.se; s=mail; t=1565865023; bh=mq/BRbuWRgrWyElZ2abdihZYOPT/tgsrPuu6QD4pnH4=; h=Date:From:To:cc:Subject:In-Reply-To:References:From; b=dpM4hAunhTzJ34tgGwdHZ3q221o0jFJY8hmHl4p1y3Im2apthGl4hjuaIvU7habE5 HkghnwsQLHMLdjVimXKaAJk5DJSOUOAgONQtr9MQiW698OCqmhuzJdFVIa/qNMW1qn IrQT5kVgwFIkyhWQEORwNYb6Acc2SDndYBF49aio= Received: from localhost (localhost [127.0.0.1]) by uplift.swm.pp.se (Postfix) with ESMTP id 721F7AF; Thu, 15 Aug 2019 12:30:23 +0200 (CEST) Date: Thu, 15 Aug 2019 12:30:23 +0200 (CEST) From: Mikael Abrahamsson To: Neil Cook cc: Stephen Farrell , =?ISO-8859-15?Q?Patrik_F=E4ltstr=F6m?= , Eric Rescorla , ADD Mailing list , Martin Thomson , Bret Jordan In-Reply-To: <31226710-8C33-4696-90F3-4E05ED82FB05@open-xchange.com> Message-ID: References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <1610C8E4-1624-4A7E-A24B-C7D0CB06A1DE@gmail.com> <6bbc4857-449e-e587-1e16-c0ee7d1f2aa8@cs.tcd.ie> <31226710-8C33-4696-90F3-4E05ED82FB05@open-xchange.com> User-Agent: Alpine 2.20 (DEB 67 2015-01-07) Organization: People's Front Against WWW MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII; format=flowed Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 10:30:26 -0000 On Thu, 15 Aug 2019, Neil Cook wrote: > So I do know that all those people, who almost certainly know nothing > about DNS, will be unhappy with Mozilla (or whomever) if it means that > their parental controls stop working. This is indeed true and relevant: https://www.zdnet.com/article/mozilla-no-plans-to-enable-dns-over-https-by-default-in-the-uk/ The weird thing is that we're still having the discussion like the above never happened. -- Mikael Abrahamsson email: swmike@swm.pp.se From nobody Thu Aug 15 03:33:51 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E9F8E12008B for ; Thu, 15 Aug 2019 03:33:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.299 X-Spam-Level: X-Spam-Status: No, score=-4.299 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=open-xchange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id a4StnuNzxczI for ; Thu, 15 Aug 2019 03:33:49 -0700 (PDT) Received: from mx4.open-xchange.com (alcatraz.open-xchange.com [87.191.39.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7E029120072 for ; Thu, 15 Aug 2019 03:33:49 -0700 (PDT) Received: from open-xchange.com (imap.open-xchange.com [10.20.30.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx4.open-xchange.com (Postfix) with ESMTPS id 882736A34A; Thu, 15 Aug 2019 12:33:47 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=open-xchange.com; s=201705; t=1565865227; bh=GF3bY8i/sMJpeDvZlDvZZ3PVwLlJWzvUB7GqFTRtdo0=; h=From:Subject:Date:In-Reply-To:Cc:To:References:From; b=Qc2p6whP4sJfoT5SfOU6ZJEcHCD7pBDSmbmB7xX1dQO/veQd275vjvFY7bmOK4m4D U75VpXrLJSVSRjActMvOWrMS4ilWlZYZ/Q44V/6KbDPsCqKcWPcLBL0Y2gHWb4vLNB AuqpfftOe8IibV9Pk0WqyBYPUs6ILbPYmaxNH5qblrQwNwBGPwo/bTrWjDimUfcYqN htK4s03rNMBPogHgWkWB983OH9r/SjjTlzElA35xMO9Fn8r8cg12+gqls5hD2ZqjoR vKUCAsp+MRhDroHdIbLuqkorsKsUHmsfbjKZNR5RsVa/Jyc3gQx4bh6zDSz9tZhSEI ryhh5d6nbgwhA== Received: from [192.168.1.128] (host31-53-106-255.range31-53.btcentralplus.com [31.53.106.255]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by open-xchange.com (Postfix) with ESMTPSA id 4262F3C03A7; Thu, 15 Aug 2019 12:33:47 +0200 (CEST) From: Neil Cook Message-Id: Content-Type: multipart/alternative; boundary="Apple-Mail=_1E589573-1F6D-47CC-A4BE-B65AC3FC3A8C" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Thu, 15 Aug 2019 11:33:46 +0100 In-Reply-To: <1d8539be-d4c3-4185-43b8-be506167d8fe@cs.tcd.ie> Cc: =?utf-8?B?UGF0cmlrIEbDpGx0c3Ryw7Zt?= , Eric Rescorla , ADD Mailing list , Martin Thomson , Bret Jordan To: Stephen Farrell References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <1610C8E4-1624-4A7E-A24B-C7D0CB06A1DE@gmail.com> <6bbc4857-449e-e587-1e16-c0ee7d1f2aa8@cs.tcd.ie> <31226710-8C33-4696-90F3-4E05ED82FB05@open-xchange.com> <1d8539be-d4c3-4185-43b8-be506167d8fe@cs.tcd.ie> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 10:33:51 -0000 --Apple-Mail=_1E589573-1F6D-47CC-A4BE-B65AC3FC3A8C Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 > So if we did document the risks/benefits, that element of surprise > ought be in the risk column I guess. Indeed, it is irrelevant what any of us think about the efficacy of such = solutions, they are very real, and many people use them. And it is = exactly the kind of thing that we should be documenting, along with the = other use-cases such as CDNs, split-horizon etc. Neil > On 15 Aug 2019, at 11:28, Stephen Farrell = wrote: >=20 >=20 >=20 > On 15/08/2019 11:22, Neil Cook wrote: >> One very real use case, which we have discussed on this list multiple >> times, is that of people using an ISP=E2=80=99s parental control (and = indeed >> malware detection) products which are based on DNS. In the UK that is >> a lot of households (over a million if I=E2=80=99m not mistaken). >>=20 >> So I do know that all those people, who almost certainly know nothing >> about DNS, will be unhappy with Mozilla (or whomever) if it means >> that their parental controls stop working. > That's a fair point. Not that I believe in such controls > nor their efficacy, but I do accept that surprising some > of those people will not be universally welcomed. So if we > did document the risks/benefits, that element of surprise > ought be in the risk column I guess. >=20 > S. > <0x5AB2FAF17B172BEA.asc> Neil Cook neil.cook@open-xchange.com = --------------------------------------------------------------------------= ----------- Open-Xchange AG, Rollnerstr. 14, 90408 Nuremberg, District Court = Nuremberg HRB 24738 Managing Board: Rafael Laguna de la Vera, Carsten Dirks, Michael = Knapstein, Stephan Martin=20 Chairman of the Board: Richard Seibt European Office:=20 Open-Xchange GmbH, Olper Huette 5f, D-57462 Olpe, Germany, District = Court Siegen, HRB 8718=20 Managing Director: Frank Hoberg US Office:=20 Open-Xchange. Inc., 530 Lytton Avenue, Palo Alto, CA 94301, USA=20 = --------------------------------------------------------------------------= ----------- --Apple-Mail=_1E589573-1F6D-47CC-A4BE-B65AC3FC3A8C Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8
 So if we did = document the risks/benefits, that element of surprise
ought = be in the risk column I guess.

Indeed, it is irrelevant what any of us think about the = efficacy of such solutions, they are very real, and many people use = them. And it is exactly the kind of thing that we should be documenting, = along with the other use-cases such as CDNs, split-horizon etc.

Neil

On 15 Aug 2019, at 11:28, Stephen Farrell <stephen.farrell@cs.tcd.ie> wrote:



On 15/08/2019 11:22, Neil Cook wrote:
One very real use case, = which we have discussed on this list multiple
times, is = that of people using an ISP=E2=80=99s parental control (and indeed
malware detection) products which are based on DNS. In the UK = that is
a lot of households (over a million if I=E2=80=99m = not mistaken).

So I do know that all those = people, who almost certainly know nothing
about DNS, will = be unhappy with Mozilla (or whomever) if it means
that = their parental controls stop working.
That's = a fair point. Not that I believe in such controls
nor = their efficacy, but I do accept that surprising some
of = those people will not be universally welcomed. So if we
did = document the risks/benefits, that element of surprise
ought = be in the risk column I guess.

S.
<0x5AB2FAF17B172BE= A.asc>


Neil Cook
neil.cook@open-xchange.com

---------------------------------------------------------------= ----------------------
Open-Xchange AG, Rollnerstr. 14, = 90408 Nuremberg, District Court Nuremberg HRB 24738
Managing Board: Rafael Laguna de la Vera, Carsten Dirks, = Michael Knapstein, Stephan Martin 
Chairman of = the Board: Richard Seibt

European = Office: 
Open-Xchange GmbH, Olper Huette = 5f, D-57462 Olpe, Germany, District Court Siegen, HRB = 8718 
Managing Director: Frank Hoberg
US Office: 
Open-Xchange. Inc., 530 = Lytton Avenue, Palo Alto, CA 94301, USA 
---------------------------------------------------------------= ----------------------

= --Apple-Mail=_1E589573-1F6D-47CC-A4BE-B65AC3FC3A8C-- From nobody Thu Aug 15 03:38:44 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9DED6120094 for ; Thu, 15 Aug 2019 03:38:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MR_jnMSDQGch for ; Thu, 15 Aug 2019 03:38:40 -0700 (PDT) Received: from mail-lj1-x229.google.com (mail-lj1-x229.google.com [IPv6:2a00:1450:4864:20::229]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9391D12008C for ; Thu, 15 Aug 2019 03:38:39 -0700 (PDT) Received: by mail-lj1-x229.google.com with SMTP id t14so1836678lji.4 for ; Thu, 15 Aug 2019 03:38:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=Wy6624NTtCLH8iZdwEjUNobTRReaCm18GCenneE1sII=; b=yZUXxFiQattqv1ZFdfSa/S7KbkGYJCV4PB0+4zrc/5rL8ORFeiBNyOwWcI8TNmS6N6 1+dUuPVcXo31wFt71ARJR6qRObYlIhUDuCCX7Rn68BGcxwh5Rnq1tHiBTiMc4RxcUlsg rEZJ3l/1ANCMZmEkBTlvvbMmp68xHf8MlWQfDaOAM0RQHMLCJvVZi7LKmKeEh8OKJKgI sjO34AkMu6/fZdjLVa1AMX9fjXELh7be+mlo2RZBM2Vve4VJy7invJje5IWTUvjK/QvX hGT8qGE3Dwd9IwAqEJ0UWmFu9QHcSyHLIXQErspq2gP/8wj7IAtu+lT1UCaAv0uKZwV0 4lRQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=Wy6624NTtCLH8iZdwEjUNobTRReaCm18GCenneE1sII=; b=QS7akWQEkFJaXSfmxehKEaLBDaQD3tHcsjFBc/CCBFT91vBWrfhUgljTxm2jn+yYQd na6jKhNlkLriuJG/ZbXsx6KJwP+fuiZHrbImqBd3xRI3X5tOpyO9Go1isCCGZYbDakcU CfURRuLp5aiugBYVrg3Qx1mtexMmhzT9dm42pe+qWqmFyiHrq9Bqu3zls8xV0vj+FwyK qnH5yyBxnhAOf+UyW27C1HR2f3fMtZfiwmqHmKsJZ4S5cT/gEvUxXyTNFI2wAhHFGu1M JpJh1KCJFl3DklUtDI/Yt8TOUeokS76xC0Gll3Oogw1zYRIj2RzFH1pPgbUEE/rp1FCY 0LSw== X-Gm-Message-State: APjAAAW/PsCxVkqmBbgLjUe6rWs56We2vrrWcRi8OU8N1DrkDvXfhoHL yOsM059lip3sZ13qRO41+L03mfK6Mm0rooFM8RBB0w== X-Google-Smtp-Source: APXvYqx1lewpL34HHcwfo1+EshESeJtdJBp0/CQby75s9J+5Rg5oJ2qCQtif6/2QpMhXoONmbO5FY8tyNG5HRfmUwUU= X-Received: by 2002:a2e:b0e6:: with SMTP id h6mr2162557ljl.18.1565865517679; Thu, 15 Aug 2019 03:38:37 -0700 (PDT) MIME-Version: 1.0 References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <1610C8E4-1624-4A7E-A24B-C7D0CB06A1DE@gmail.com> <6bbc4857-449e-e587-1e16-c0ee7d1f2aa8@cs.tcd.ie> <31226710-8C33-4696-90F3-4E05ED82FB05@open-xchange.com> In-Reply-To: <31226710-8C33-4696-90F3-4E05ED82FB05@open-xchange.com> From: Eric Rescorla Date: Thu, 15 Aug 2019 12:38:00 +0200 Message-ID: To: Neil Cook Cc: Stephen Farrell , =?UTF-8?B?UGF0cmlrIEbDpGx0c3Ryw7Zt?= , ADD Mailing list , Bret Jordan , Martin Thomson Content-Type: multipart/alternative; boundary="000000000000f3901e05902579c4" Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 10:38:43 -0000 --000000000000f3901e05902579c4 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Thu, Aug 15, 2019 at 12:22 PM Neil Cook wrote: > > > On 15 Aug 2019, at 10:58, Stephen Farrell > wrote: > > But I would guess for the vast majority of home networks, the > user is not really the n/w administrator, but rather their > current ISP is really performing that role, for DNS. And in > those cases, I would say most people don't care as they don't > even know DNS exists. Of those who do care, I have no idea > how many might prefer to keep with their ISP's chosen DNS > settings and how many might be ok with Mozilla's plans. > > I would guess many would be unhappy if their DNS server > were flakey or abusive, and while that could happen in any > scenario, presumably many home network users are ok with > their ISP controlling DNS as they'd change ISP. There > are of course some places where there's little choice of > ISP, but I'm not sure if flakey DNS is or is not a real > problem in those places. > > > One very real use case, which we have discussed on this list multiple > times, is that of people using an ISP=E2=80=99s parental control (and ind= eed > malware detection) products which are based on DNS. In the UK that is a l= ot > of households (over a million if I=E2=80=99m not mistaken). > > So I do know that all those people, who almost certainly know nothing > about DNS, will be unhappy with Mozilla (or whomever) if it means that > their parental controls stop working. > Agreed.This is why we are working to develop mechanisms to detect this case. See https://blog.mozilla.org/futurereleases/2019/07/31/dns-over-https-doh-updat= e-detecting-managed-networks-and-user-choice/ for more details. -Ekr > Neil Cook > neil.cook@open-xchange.com > > > -------------------------------------------------------------------------= ------------ > Open-Xchange AG, Rollnerstr. 14, 90408 Nuremberg, District Court > Nuremberg HRB 24738 > Managing Board: Rafael Laguna de la Vera, Carsten Dirks, Michael > Knapstein, Stephan Martin > Chairman of the Board: Richard Seibt > > European Office: > Open-Xchange GmbH, Olper Huette 5f, D-57462 Olpe, Germany, District > Court Siegen, HRB 8718 > Managing Director: Frank Hoberg > > US Office: > Open-Xchange. Inc., 530 Lytton Avenue, Palo Alto, CA 94301, USA > > -------------------------------------------------------------------------= ------------ > > --000000000000f3901e05902579c4 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Thu, Aug 15, 2019 at 12:22 PM Neil= Cook <neil.cook@open-xcha= nge.com> wrote:


On 15 Aug 2019, at 10:58, Stephen Farrell <stephen.farrell@cs.tcd.= ie> wrote:

But I would guess for the vast majorit= y of home networks, the
user is not really the n/w administrator, but ra= ther their
current ISP is really performing that role, for DNS. And inthose cases, I would say most people don't care as they don't
= even know DNS exists. Of those who do care, I have no idea
how many migh= t prefer to keep with their ISP's chosen DNS
settings and how many m= ight be ok with Mozilla's plans.

I would guess many would be unh= appy if their DNS server
were flakey or abusive, and while that could ha= ppen in any
scenario, presumably many home network users are ok with
= their ISP controlling DNS as they'd change ISP. There
are of course = some places where there's little choice of
ISP, but I'm not sure= if flakey DNS is or is not a real
problem in those places.

One very real use case, which we have d= iscussed on this list multiple times, is that of people using an ISP=E2=80= =99s parental control (and indeed malware detection) products which are bas= ed on DNS. In the UK that is a lot of households (over a million if I=E2=80= =99m not mistaken).=C2=A0

So I do know that all th= ose people, who almost certainly know nothing about DNS, will be unhappy wi= th Mozilla (or whomever) if it means that their parental controls stop work= ing.

Agreed.This is why w= e are working to develop mechanisms to detect this case. See https://blog.mozilla.org/future= releases/2019/07/31/dns-over-https-doh-update-detecting-managed-networks-an= d-user-choice/ for more details.

-Ekr


Neil Cook
neil.cook@open-xchange.com

------= ---------------------------------------------------------------------------= ----
Open-Xchange AG, Rollnerstr. 14, 90408=C2=A0Nuremberg, District Cou= rt Nuremberg=C2=A0HRB 24738
Managing Board: Rafael Laguna de la=C2=A0Ver= a, Carsten Dirks, Michael Knapstein,=C2=A0Stephan Martin=C2=A0
Chairman = of the Board: Richard Seibt

European Office:=C2=A0
Open-Xchange G= mbH, Olper Huette 5f,=C2=A0D-57462 Olpe, Germany, District Court=C2=A0Siege= n, HRB 8718=C2=A0
Managing Director: Frank Hoberg

US Office:=C2= =A0
Open-Xchange. Inc., 530 Lytton Avenue,=C2=A0Palo Alto, CA 94301, USA= =C2=A0
-----------------------------------------------------------------= --------------------

--000000000000f3901e05902579c4-- From nobody Thu Aug 15 04:42:59 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 988B312008F for ; Thu, 15 Aug 2019 04:42:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FROM_EXCESS_BASE64=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=frobbit.se Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JTJrQHZbjz1C for ; Thu, 15 Aug 2019 04:42:54 -0700 (PDT) Received: from mail.frobbit.se (mail.frobbit.se [85.30.129.176]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A4AA612004A for ; Thu, 15 Aug 2019 04:42:54 -0700 (PDT) Received: from [192.165.72.22] (unknown [IPv6:2a02:80:3ffc::22]) by mail.frobbit.se (Postfix) with ESMTPSA id 91A4020742; Thu, 15 Aug 2019 13:42:51 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=frobbit.se; s=mail; t=1565869371; bh=GwxMswmEgy6di45TbfK/aS1qPUUSpFTEPyV/m5jaT1c=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=etcH66+uuYtnIU2zntr7LFEec/P5WSsgBOaVZeRESQaQJvmE/iZX7WH2Q3QUBf3EU CwuvLs+tsRORNYLbnxV0r1DOlF6e9ZszrSyRpfMg+xHdk/BywmMRacIj324CNXxY0x H5LDWUnrNGuNt0knG8R9hZ34xipAcGTlaplS9wFs= From: "Patrik =?utf-8?b?RsOkbHRzdHLDtm0=?=" To: "Eric Rescorla" Cc: "ADD Mailing list" , "Martin Thomson" , "Bret Jordan" Date: Thu, 15 Aug 2019 13:42:49 +0200 X-Mailer: MailMate (2.0BETAr6137) Message-ID: <10DED437-69F4-401E-894E-DCC94464AA6D@frobbit.se> In-Reply-To: References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <1610C8E4-1624-4A7E-A24B-C7D0CB06A1DE@gmail.com> MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=_MailMate_44EEA101-39DF-4C9D-A5C2-56E27B3056FE_="; micalg=pgp-sha1; protocol="application/pgp-signature" Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 11:42:57 -0000 This is an OpenPGP/MIME signed message (RFC 3156 and 4880). --=_MailMate_44EEA101-39DF-4C9D-A5C2-56E27B3056FE_= Content-Type: text/plain Content-Transfer-Encoding: quoted-printable On 15 Aug 2019, at 12:13, Eric Rescorla wrote: > Well, maybe. For instance, if I am at friend's house, they're the netw= ork > administrator and I am the user. However, in cases where they are one a= nd > the same, yes, it would be great to have a way to mechanically determin= e > that that was the case. However, the current technical mechanisms we ha= ve > do not in fact provide that. I just wanted to bring up the fact things is not as white and black which= some arguments on this discussion is. This is hard. I use this as an argument to yes bring in DoT and standardise how DoH wor= ks but let the default setting continue to be set per operating system an= d by the network administrator (i.e. using the zeroconf mechanisms we hav= e developed at the IETF). I like for example the DNSSEC-Trigger program provided by NLNetLabs: It uses the default setting, tries and checks if a local resolver "works"= , and let me know if it doesn't (so I can choose what measures I want to = use, which normally is to faster start a VPN, and THEN a local resolver).= If it does, it changes the resolver to 127.0.0.1 in my laptop and do all= queries by itself. I.e. overrides what the network administrator gave me= as a default. But, I expect all my applications to use the setting I set= =2E So the real discussion I think include questions of: - Where do the default setting come from? - Is The DNS Setting same for a computer or per application? - Are the DNS queries identifiable by the network administrator or not? And not even those have black and white answers. For example, if I open a= VPN the DNS queries inside the tunnel will not be visible. And sure, my = favourite answers to those questions are most certainly different than yo= ur answers Eric. The IETF dilemma :-) Best, Patrik --=_MailMate_44EEA101-39DF-4C9D-A5C2-56E27B3056FE_= Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iG0EARECAC0WIQRUH/cJI8i4DDUU3qWsxpsaC4jXzQUCXVVFOQ8ccGFmQGZyb2Ji aXQuc2UACgkQrMabGguI183xggCeIspPAat5YHouZxSxjs8Whct1XaAAmgOAVu/s AUuGPRzLRrjXcm5lLNNB =p1Wg -----END PGP SIGNATURE----- --=_MailMate_44EEA101-39DF-4C9D-A5C2-56E27B3056FE_=-- From nobody Thu Aug 15 05:29:45 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7F35A120043 for ; Thu, 15 Aug 2019 05:29:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gY1A-1dYVAIy for ; Thu, 15 Aug 2019 05:29:42 -0700 (PDT) Received: from mx0a-00191d01.pphosted.com (mx0a-00191d01.pphosted.com [67.231.149.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B42BD120046 for ; Thu, 15 Aug 2019 05:29:42 -0700 (PDT) Received: from pps.filterd (m0049295.ppops.net [127.0.0.1]) by m0049295.ppops.net-00191d01. (8.16.0.27/8.16.0.27) with SMTP id x7FCPofa014093; Thu, 15 Aug 2019 08:29:36 -0400 Received: from alpi154.enaf.aldc.att.com (sbcsmtp6.sbc.com [144.160.229.23]) by m0049295.ppops.net-00191d01. with ESMTP id 2ud6ut0tpn-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 15 Aug 2019 08:29:36 -0400 Received: from enaf.aldc.att.com (localhost [127.0.0.1]) by alpi154.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id x7FCTY6a002730; Thu, 15 Aug 2019 08:29:35 -0400 Received: from zlp30487.vci.att.com (zlp30487.vci.att.com [135.47.91.176]) by alpi154.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id x7FCTQKK002617 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Thu, 15 Aug 2019 08:29:27 -0400 Received: from zlp30487.vci.att.com (zlp30487.vci.att.com [127.0.0.1]) by zlp30487.vci.att.com (Service) with ESMTP id B5A1C4009E67; Thu, 15 Aug 2019 12:29:26 +0000 (GMT) Received: from GAALPA1MSGHUBAD.ITServices.sbc.com (unknown [130.8.218.153]) by zlp30487.vci.att.com (Service) with ESMTPS id A12D04009E66; Thu, 15 Aug 2019 12:29:26 +0000 (GMT) Received: from GAALPA1MSGUSRBF.ITServices.sbc.com ([169.254.5.177]) by GAALPA1MSGHUBAD.ITServices.sbc.com ([130.8.218.153]) with mapi id 14.03.0439.000; Thu, 15 Aug 2019 08:29:26 -0400 From: "STARK, BARBARA H" To: "'Eric Rescorla'" , "'Neil Cook'" CC: =?utf-8?B?J1BhdHJpayBGw6RsdHN0csO2bSc=?= , "'ADD Mailing list'" , "'Martin Thomson'" , "'Bret Jordan'" , "'Stephen Farrell'" Thread-Topic: [Add] [Ext] Validity of network administrator role Thread-Index: AQHVUzoPOJgNGM3ylEyeeSjK6egTrqb8GRWAgAAjhQCAAAabgIAABGkA///YEqA= Date: Thu, 15 Aug 2019 12:29:25 +0000 Message-ID: <2D09D61DDFA73D4C884805CC7865E6114E272262@GAALPA1MSGUSRBF.ITServices.sbc.com> References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <1610C8E4-1624-4A7E-A24B-C7D0CB06A1DE@gmail.com> <6bbc4857-449e-e587-1e16-c0ee7d1f2aa8@cs.tcd.ie> <31226710-8C33-4696-90F3-4E05ED82FB05@open-xchange.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [135.70.196.183] Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-08-15_05:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_policy_notspam policy=outbound_policy score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1011 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=568 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1906280000 definitions=main-1908150131 Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 12:29:44 -0000 PiBBZ3JlZWQuIFRoaXMgaXMgd2h5IHdlIGFyZSB3b3JraW5nIHRvIGRldmVsb3AgbWVjaGFuaXNt cyB0byBkZXRlY3QgdGhpcyBjYXNlLiBTZWUgPHVybD4gZm9yIG1vcmUgZGV0YWlscy4NCg0KSXQg YXBwZWFycyBmcm9tIHRoaXMgdGhhdCB5b3UncmUgYWxzbyBkb2luZyBsb3RzIG9mIHRlc3RzIGFu ZCBleHBlcmltZW50cy4gVGhhdCdzIGdyZWF0LiBJJ2QgbGlrZSB0byBzdWdnZXN0IHRoZSBmb2xs b3dpbmcgZXhwZXJpbWVudDoNCkhvdyBvZnRlbiB3aWxsIGEgRE5TIHF1ZXJ5IGZvciBDRE4gY29u dGVudCB0byBDbG91ZGZsYXJlIChlLmcuLCB2aWEgRG9ILCBidXQgd2hhdCBETlMgZ29lcyBvdmVy IGlzbid0IGltcG9ydGFudCkgcHJvdmlkZSBhIGRpZmZlcmVudCBJUCBhZGRyZXNzIHRoYW4gdGhl IHNhbWUgcXVlcnkgdG8gdGhlIElTUCByZXNvbHZlcj8gT2YgcGFydGljdWxhciBpbnRlcmVzdCBh cmUgbW9iaWxlIG5ldHdvcmtzLiBPbmUgb2YgdGhlIGZlYXJzIGlzIGxvdHMgb2YgaGlnaC1iYW5k d2lkdGggY29udGVudCAodmlkZW8gc3RyZWFtcykgYmVpbmcgc2hpZnRlZCB0byB0YWtlIHBhdGhz IHRoYXQgaGFkbid0IGJlZW4gZW5naW5lZXJlZCB0byBoYW5kbGUgdGhlIHNoaWZ0ZWQgdHJhZmZp Yy4gVGhlIGV4cGVyaW1lbnQgcHJvYmFibHkgbmVlZHMgdG8gYmUgbW9yZSBudWFuY2VkIChtYXli ZSBkaWZmZXJlbnQgSVAgYWRkcmVzcyBpc27igJl0IHRoZSByaWdodCB0aGluZyB0byBsb29rIGZv ciksIGJ1dCB5b3UgZ2V0IHRoZSBpZGVhLg0KDQpJdCdzIG1vcmUgdGhhbiBqdXN0IHBlcmZvcm1h bmNlIG9mIHRoZSBxdWVyeSBvciByZWNlaXB0IG9mIHRoZSBmaXJzdCB3ZWJzaXRlIHBhY2tldC4g V2UgbmVlZCB0byB1bmRlcnN0YW5kIGlmIGxhcmdlIGFtb3VudHMgb2YgQ0ROIGNvbnRlbnQgd2ls bCBjb21lIGF0IGFjY2VzcyBuZXR3b3JrcyB1c2luZyBkaWZmZXJlbnQgcGF0aHMgYW5kIGxpbmtz Lg0KVGh4LA0KQmFyYmFyYQ0K From nobody Thu Aug 15 06:20:12 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1FAE012006D for ; Thu, 15 Aug 2019 06:20:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VV-yqTVwkTqY for ; Thu, 15 Aug 2019 06:20:09 -0700 (PDT) Received: from smtp.guxx.net (smtp.guxx.net [IPv6:2a01:4f8:a0:322c::25:42]) by ietfa.amsl.com (Postfix) with ESMTP id 3BE93120043 for ; Thu, 15 Aug 2019 06:20:09 -0700 (PDT) Received: by nyx.guxx.net (Postfix, from userid 107) id 2E7605F42D40; Thu, 15 Aug 2019 15:20:07 +0200 (CEST) Received: from [172.19.152.174] (p54B8ABDF.dip0.t-ipconnect.de [84.184.171.223]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by nyx.guxx.net (Postfix) with ESMTPSA id C07B55F42D1F; Thu, 15 Aug 2019 15:20:06 +0200 (CEST) From: "Ralf Weber" To: "STARK, BARBARA H" Cc: "Eric Rescorla" , "Neil Cook" , "Patrik =?utf-8?b?RsOkbHRzdHLDtm0=?=" , "ADD Mailing list" , "Bret Jordan" , "Martin Thomson" , "Stephen Farrell" Date: Thu, 15 Aug 2019 15:20:05 +0200 X-Mailer: MailMate (1.12.5r5635) Message-ID: <8F75AD20-706B-48F7-B6DD-4C15DAFFA429@fl1ger.de> In-Reply-To: <2D09D61DDFA73D4C884805CC7865E6114E272262@GAALPA1MSGUSRBF.ITServices.sbc.com> References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <1610C8E4-1624-4A7E-A24B-C7D0CB06A1DE@gmail.com> <6bbc4857-449e-e587-1e16-c0ee7d1f2aa8@cs.tcd.ie> <31226710-8C33-4696-90F3-4E05ED82FB05@open-xchange.com> <2D09D61DDFA73D4C884805CC7865E6114E272262@GAALPA1MSGUSRBF.ITServices.sbc.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 13:20:12 -0000 Moin! On 15 Aug 2019, at 14:29, STARK, BARBARA H wrote: >> Agreed. This is why we are working to develop mechanisms to detect >> this case. See for more details. > > It appears from this that you're also doing lots of tests and > experiments. That's great. I'd like to suggest the following > experiment: > How often will a DNS query for CDN content to Cloudflare (e.g., via > DoH, but what DNS goes over isn't important) provide a different IP > address than the same query to the ISP resolver? Of particular > interest are mobile networks. One of the fears is lots of > high-bandwidth content (video streams) being shifted to take paths > that hadn't been engineered to handle the shifted traffic. The > experiment probably needs to be more nuanced (maybe different IP > address isn’t the right thing to look for), but you get the idea. > > It's more than just performance of the query or receipt of the first > website packet. We need to understand if large amounts of CDN content > will come at access networks using different paths and links. While this study is not exactly what you envision, but comes close and is a clear indicator that there will be a shift if we don’t use on network resolvers or ECS: https://www.samknows.com/blog/dns-over-https-performance So long -Ralf —-- Ralf Weber From nobody Thu Aug 15 06:20:46 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4E28F120043 for ; Thu, 15 Aug 2019 06:20:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id H7NFhHM51W-Z for ; Thu, 15 Aug 2019 06:20:40 -0700 (PDT) Received: from mail-lj1-x22b.google.com (mail-lj1-x22b.google.com [IPv6:2a00:1450:4864:20::22b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0B22312006D for ; Thu, 15 Aug 2019 06:20:40 -0700 (PDT) Received: by mail-lj1-x22b.google.com with SMTP id h15so2191172ljg.10 for ; Thu, 15 Aug 2019 06:20:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=he8p3h9DM2s1GebCAd7P4jOH94X8cjOvd2I1rGwio94=; b=HuVEzCdDRJkWK9SQCyoT4MaGknVzpvp4xA3lnFS0xxu0bdtXs3184xQ2dcXWaZ9lfw cetlA9/wVqugagAZrYIx5SBRSgBlSMMd6dYASESEbQbKAXR+ZZ89kMOufM3a22FB0Qe1 p0/gfcxqDTOCfyOZv7krBjgQaRU92ZaqWzhZ5YvhzxlT5SeUhIwYD92ZiSNNVtuJiHqE XCuDrz1Az22Q4ct8eNudT3ePg8Ji794/ogdaesdcgFXyRlEjNL69bOjXupmlA1PgapRG cUdx244EMainHA2fVJn+4E7j2VvOMOiohxDSQDteJSehXKUjKbVWTdAQ2NCOMkz0tekc SsEA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=he8p3h9DM2s1GebCAd7P4jOH94X8cjOvd2I1rGwio94=; b=QoGHX3d4+yMB6GY9CHkxYFRapdTypWtKGw8tS3RejQBS7CmUzG3JUMhVgJDCpEpW0M n1Vlgda49+6zLnGVcnRM/YA4eyrkbXqpwnXQwSnA9MH+9VmGfmyjcfefeDPWjeci6Qj6 WCXtGK/jeb4O3A/2Hbc9xaycm6vHq53bILZ3L95eY8VmqDXS9HfImtS3U2+dZT+slkiM WCQvumHBKXkrpVQuNHrfUx/O86gpCjl88stxyzZnwLOFbA3Dj15/HUn0VI9GZzox8r/T iiV6vw8FHTc/iT7c4wKxMYfDzGNf7fuimPcalvpJVhZbKsdfnWdDWLF1fwsB3aRdrlZy 0pPA== X-Gm-Message-State: APjAAAUt7AgKs++TY5iFq1iNMRvUBJkvFq8JRp7QpOBkxIr/wc5plADx RlIpDNn0NJ+jR3u+b+7wzUCOSJmhTkJxjBBt4U1WRQ== X-Google-Smtp-Source: APXvYqy/SN1LtTtglNdYH+JT3kFDT43WyuTv7DWz0EuhdymhuNVtrIAQw1srPYIJDqNlMX+A3IH8EX6f41T0xSV3rKg= X-Received: by 2002:a2e:5c43:: with SMTP id q64mr2743325ljb.14.1565875238216; Thu, 15 Aug 2019 06:20:38 -0700 (PDT) MIME-Version: 1.0 References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <1610C8E4-1624-4A7E-A24B-C7D0CB06A1DE@gmail.com> <6bbc4857-449e-e587-1e16-c0ee7d1f2aa8@cs.tcd.ie> <31226710-8C33-4696-90F3-4E05ED82FB05@open-xchange.com> <2D09D61DDFA73D4C884805CC7865E6114E272262@GAALPA1MSGUSRBF.ITServices.sbc.com> In-Reply-To: <2D09D61DDFA73D4C884805CC7865E6114E272262@GAALPA1MSGUSRBF.ITServices.sbc.com> From: Eric Rescorla Date: Thu, 15 Aug 2019 15:20:00 +0200 Message-ID: To: "STARK, BARBARA H" Cc: Neil Cook , =?UTF-8?B?UGF0cmlrIEbDpGx0c3Ryw7Zt?= , ADD Mailing list , Martin Thomson , Bret Jordan , Stephen Farrell Content-Type: multipart/alternative; boundary="000000000000563ef0059027bde6" Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 13:20:45 -0000 --000000000000563ef0059027bde6 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Thu, Aug 15, 2019 at 2:29 PM STARK, BARBARA H wrote: > > Agreed. This is why we are working to develop mechanisms to detect this > case. See for more details. > > It appears from this that you're also doing lots of tests and experiments= . > That's great. I'd like to suggest the following experiment: > How often will a DNS query for CDN content to Cloudflare (e.g., via DoH, > but what DNS goes over isn't important) provide a different IP address th= an > the same query to the ISP resolver? Of particular interest are mobile > networks. One of the fears is lots of high-bandwidth content (video > streams) being shifted to take paths that hadn't been engineered to handl= e > the shifted traffic. The experiment probably needs to be more nuanced > (maybe different IP address isn=E2=80=99t the right thing to look for), b= ut you get > the idea. > We'd certainly be happy to talk to CDNs who have ideas for further research= . -Ekr > It's more than just performance of the query or receipt of the first > website packet. We need to understand if large amounts of CDN content wil= l > come at access networks using different paths and links. > Thx, > Barbara > --000000000000563ef0059027bde6 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Thu, Aug 15, 2019 at 2:29 PM STARK= , BARBARA H <bs7652@att.com> wr= ote:
> Agreed= . This is why we are working to develop mechanisms to detect this case. See= <url> for more details.

It appears from this that you're also doing lots of tests and experimen= ts. That's great. I'd like to suggest the following experiment:
How often will a DNS query for CDN content to Cloudflare (e.g., via DoH, bu= t what DNS goes over isn't important) provide a different IP address th= an the same query to the ISP resolver? Of particular interest are mobile ne= tworks. One of the fears is lots of high-bandwidth content (video streams) = being shifted to take paths that hadn't been engineered to handle the s= hifted traffic. The experiment probably needs to be more nuanced (maybe dif= ferent IP address isn=E2=80=99t the right thing to look for), but you get t= he idea.

We'd certainly be happy to= talk to CDNs who have ideas for further research.

-Ekr


It's more than just performance of the query or receipt of the first we= bsite packet. We need to understand if large amounts of CDN content will co= me at access networks using different paths and links.
Thx,
Barbara
--000000000000563ef0059027bde6-- From nobody Thu Aug 15 06:28:23 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 36ECE12011B for ; Thu, 15 Aug 2019 06:28:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jfyZvWHfzxdU for ; Thu, 15 Aug 2019 06:28:19 -0700 (PDT) Received: from mail-qk1-x72a.google.com (mail-qk1-x72a.google.com [IPv6:2607:f8b0:4864:20::72a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 020EE1200D8 for ; Thu, 15 Aug 2019 06:28:18 -0700 (PDT) Received: by mail-qk1-x72a.google.com with SMTP id p13so1741912qkg.13 for ; Thu, 15 Aug 2019 06:28:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=content-transfer-encoding:from:mime-version:subject:date:message-id :references:cc:in-reply-to:to; bh=3V8QwZNcR4CEa1VvdOnTjgq9HueiA1mKiGY6LbQaMS8=; b=iaPNAD9x9EamMpLufCh7JpvQoS0ZhT6+Lt+P7B8kmRybOMVEgueikp+FeHDh+ak8/T c98pnb6SI2B9L9wPd79qgehi+fvQNtan0zYUWGlEGbEm4UNteoBt9OpwhZceNdOhpWcB HapDGWZHqFoPCpODU4q8vxvclQkF29i7ikD+JFeARfA5fmFKs9I03Y0Hne2c6RTYSXeL Jn3AQwRMHycUv/YVAHatryUgr5jOQhbNRYDS87jRmHd9vp7hogWteSGrCSyHaYzVfR1C h+FEiLQO1wCgjpLT36M7NVIk43CHv6K2RQfh/Jf/LmbJSu3NlbsPaGeQ12uzXfZDc9d/ NlPg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:content-transfer-encoding:from:mime-version :subject:date:message-id:references:cc:in-reply-to:to; bh=3V8QwZNcR4CEa1VvdOnTjgq9HueiA1mKiGY6LbQaMS8=; b=hQuZaWXAMhrRosITRA00z/gTD0BuvujSwwu81pcecZYaTT8/UrmVTwdbznroopqKNP ojO846EExTdhD8DBJJ72MUWY0c5Gjzg8Vi5QLRbmfdY6U2zuax8zW97TlrzGoisAFfUg B+DB3AWPu8Ac9okswN5Zl1tEM5ZGsviZLy9P0Rn7Pdl+pEh/jhc/2PUDFP/5rMs/fxeT PIlE5tzI+s+FVpHfR2ezEGY+pwcnvS1aKxT1SAZJj6dsKp5wPpArjgBZJpq4THvySKD9 4pz/TA0JP6gaKEArot4GzwvhFjQvkKbR/T9AC54R/S/RYym4JzI05mV5/NvwW8m8P1kO rAHA== X-Gm-Message-State: APjAAAXEEifbW96GhoGGbr1v46+ANoZVdnogvBBByiCfVgMw8worSx0G rSmEWb/M0ywSSdqh1iXCVG/bRxkCG2GcGQ== X-Google-Smtp-Source: APXvYqwfFyTMW/MHDJZ3mSmEGqtgSPg1fE8oN/gxgQy1sYL4konWXxL4dEYWHo3B0j24qHD5BanHrA== X-Received: by 2002:a37:4c11:: with SMTP id z17mr4155868qka.107.1565875697966; Thu, 15 Aug 2019 06:28:17 -0700 (PDT) Received: from [10.0.100.56] (c-73-186-137-119.hsd1.ma.comcast.net. [73.186.137.119]) by smtp.gmail.com with ESMTPSA id z186sm1541754qkb.2.2019.08.15.06.28.17 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Thu, 15 Aug 2019 06:28:17 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable From: Ted Lemon Mime-Version: 1.0 (1.0) Date: Thu, 15 Aug 2019 09:28:16 -0400 Message-Id: <01BB207C-865B-4179-83E4-E75F9B0CB813@fugue.com> References: Cc: Paul Hoffman , ADD Mailing list In-Reply-To: To: Brian Dickson X-Mailer: iPhone Mail (17A815) Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 13:28:22 -0000 A non-443 port won=E2=80=99t work because it will enable filtering by malici= ous resolvers on path. The problem is we have no way to determine what is ma= licious intercept and what is authorized.=20 Sent from my iPhone > On Aug 15, 2019, at 00:25, Brian Dickson w= rote: >=20 > My perspective is, that a non-443 port is not too late to converge upon, b= ut would require engagement from the browser community, and I'm not sure I'm= the right one to raise the issue. In fact, I'm pretty sure I'm not. From nobody Thu Aug 15 06:50:17 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id ABB09120086 for ; Thu, 15 Aug 2019 06:50:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SgfLu8GmL6z6 for ; Thu, 15 Aug 2019 06:50:13 -0700 (PDT) Received: from mail-lj1-x234.google.com (mail-lj1-x234.google.com [IPv6:2a00:1450:4864:20::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4948F12006D for ; Thu, 15 Aug 2019 06:50:13 -0700 (PDT) Received: by mail-lj1-x234.google.com with SMTP id e24so2262102ljg.11 for ; Thu, 15 Aug 2019 06:50:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=csm9XMdoVPNwxexW3q1PXw7E5PIsR2oeXzUCwBYuV5s=; b=e0daUC5tQozPDbnZWVrTfmzFHXjxTvvzU1IR/iF91pxDj2+BFw70pAnBHp5cKCoo35 bFNGIXu+luhDmivwdgWpACAwFrswQkq8OemPym3/ZGh6Y0UsHx+104pyHe6m96zc0RXo 0nf7dCEsm+Y7DaoEdq+gI5t6qCkZ5cj23EYNJUCxhHU5mqdBkpMn3tQ8v0Cdpz1i1qrS axNOM+n1+aE8g7MYmnwSV6wBttxSxlg4NwCepo6nKl/fwbkeEyPM2ap7CVLpQdyYpl5I kH3dKWZ7eGJyixCc8a+8lsMXD2yVw+hQxqwmbJvYTDX1DXHag4J+o1yt3o3s5O7Gcdn7 HDww== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=csm9XMdoVPNwxexW3q1PXw7E5PIsR2oeXzUCwBYuV5s=; b=t+kt5zUQaiV30TpdnRHwvZVhEju60NgVDi9btZi/aqZh9NwNzt3ThhHXTEzHn3jNBK 7KTT80qsqtL+PpRouTRbyU48MKitRE7we/l0tbtzMU7/TYTn5NnXgwpMtk9gNbcmrvmj o/rZqzJkr18Av+mYlKeJzulExnp/mkoluWQodgV1h4MX+o/lmyrmzDN5shXzfaITm0vV g0eyE64ee6xosTOwR19oyCvsb5IXCiPkSk2bY/HPBtqmS2s9rzf9ZwyHXrbCZG+qQpyc bVc44C4K2Gbww6lkSX4hVJiwsdfQMpVyLCG19PDxkBncZxtyNTdK3G//wW0Y5o/xhCzX 7QEw== X-Gm-Message-State: APjAAAUpwi8Ad/2Taxa+U3nvMcNLN461ADQmwPMEp/N5GbjwqLh80nJp 5HpYiiv2OUpKjvDROWmVbMU0fHkglVw1TSRxh4sFEg== X-Google-Smtp-Source: APXvYqwBaMt+ZUcDpPter6+Eu45HB4hmJjyKcWB2PHxuf3utAtrBXTq0vVdY1CLWwUCJoMUt1LhFzXPTZ5f15TnxIwg= X-Received: by 2002:a2e:b0e6:: with SMTP id h6mr2568528ljl.18.1565877011485; Thu, 15 Aug 2019 06:50:11 -0700 (PDT) MIME-Version: 1.0 References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <1610C8E4-1624-4A7E-A24B-C7D0CB06A1DE@gmail.com> <6bbc4857-449e-e587-1e16-c0ee7d1f2aa8@cs.tcd.ie> <31226710-8C33-4696-90F3-4E05ED82FB05@open-xchange.com> <2D09D61DDFA73D4C884805CC7865E6114E272262@GAALPA1MSGUSRBF.ITServices.sbc.com> <8F75AD20-706B-48F7-B6DD-4C15DAFFA429@fl1ger.de> In-Reply-To: <8F75AD20-706B-48F7-B6DD-4C15DAFFA429@fl1ger.de> From: Eric Rescorla Date: Thu, 15 Aug 2019 15:49:33 +0200 Message-ID: To: Ralf Weber Cc: "STARK, BARBARA H" , Neil Cook , =?UTF-8?B?UGF0cmlrIEbDpGx0c3Ryw7Zt?= , ADD Mailing list , Bret Jordan , Martin Thomson , Stephen Farrell Content-Type: multipart/alternative; boundary="0000000000000835e30590282729" Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 13:50:16 -0000 --0000000000000835e30590282729 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Thu, Aug 15, 2019 at 3:20 PM Ralf Weber wrote: > Moin! > > On 15 Aug 2019, at 14:29, STARK, BARBARA H wrote: > > >> Agreed. This is why we are working to develop mechanisms to detect > >> this case. See for more details. > > > > It appears from this that you're also doing lots of tests and > > experiments. That's great. I'd like to suggest the following > > experiment: > > How often will a DNS query for CDN content to Cloudflare (e.g., via > > DoH, but what DNS goes over isn't important) provide a different IP > > address than the same query to the ISP resolver? Of particular > > interest are mobile networks. One of the fears is lots of > > high-bandwidth content (video streams) being shifted to take paths > > that hadn't been engineered to handle the shifted traffic. The > > experiment probably needs to be more nuanced (maybe different IP > > address isn=E2=80=99t the right thing to look for), but you get the ide= a. > > > > It's more than just performance of the query or receipt of the first > > website packet. We need to understand if large amounts of CDN content > > will come at access networks using different paths and links. > While this study is not exactly what you envision, but comes close and > is a clear indicator that there will be a shift if we don=E2=80=99t use o= n > network resolvers or ECS: > https://www.samknows.com/blog/dns-over-https-performance Bottom lining this, it seems like the results are broadly consistent with ours: when DoH/TRR through Cloudflare is used, different CDN nodes are used, but there's no significant performance difference. -Ekr > > So long > -Ralf > =E2=80=94-- > Ralf Weber > --0000000000000835e30590282729 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Thu, Aug 15, 2019 at 3:20 PM Ralf = Weber <dns@fl1ger.de> wrote:
=
Moin!

On 15 Aug 2019, at 14:29, STARK, BARBARA H wrote:

>> Agreed. This is why we are working to develop mechanisms to detect=
>> this case. See <url> for more details.
>
> It appears from this that you're also doing lots of tests and
> experiments. That's great. I'd like to suggest the following <= br> > experiment:
> How often will a DNS query for CDN content to Cloudflare (e.g., via > DoH, but what DNS goes over isn't important) provide a different I= P
> address than the same query to the ISP resolver? Of particular
> interest are mobile networks. One of the fears is lots of
> high-bandwidth content (video streams) being shifted to take paths > that hadn't been engineered to handle the shifted traffic. The > experiment probably needs to be more nuanced (maybe different IP
> address isn=E2=80=99t the right thing to look for), but you get the id= ea.
>
> It's more than just performance of the query or receipt of the fir= st
> website packet. We need to understand if large amounts of CDN content =
> will come at access networks using different paths and links.
While this study is not exactly what you envision, but comes close and
is a clear indicator that there will be a shift if we don=E2=80=99t use on =
network resolvers or ECS:
=C2=A0 =C2=A0 =C2=A0 =C2=A0 https://www.samk= nows.com/blog/dns-over-https-performance

Bottom lining this, it seems like the results are broadly consistent with= ours: when DoH/TRR through Cloudflare is used, different CDN nodes are use= d, but there's no significant performance difference.

-Ekr



So long
-Ralf
=E2=80=94--
Ralf Weber
--0000000000000835e30590282729-- From nobody Thu Aug 15 06:57:27 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F16F112008D for ; Thu, 15 Aug 2019 06:57:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gts6g8Ny7ak7 for ; Thu, 15 Aug 2019 06:57:24 -0700 (PDT) Received: from mail-qk1-x72a.google.com (mail-qk1-x72a.google.com [IPv6:2607:f8b0:4864:20::72a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 730CB120086 for ; Thu, 15 Aug 2019 06:57:24 -0700 (PDT) Received: by mail-qk1-x72a.google.com with SMTP id u190so1878498qkh.5 for ; Thu, 15 Aug 2019 06:57:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=content-transfer-encoding:from:mime-version:subject:date:message-id :references:cc:in-reply-to:to; bh=ogMjmU8TVVNg43Nr1CjCDeBBvgTwfndkWvfped9QcrM=; b=aEd+cwSu9A4LwgN/ix3KOeOFmQDCA2eP9xZg/6Y8pi9SE1rF3O326GWZ5rbAL4ipwU Qq91qGw656xKBl1Z1iATrTL1OpPkqnk/RXyBlnsN8rf2NGUne/QH6MAgKevMbbhjovqE V5Q/9XvycZrwXlqsg7dJMVlKMaoaQVtVptbiVHkliMCVm93auHxaNU4kCfddosy96UXM OKJ/FE7r1uaGu4phCgpuUihMsiWmylSay4+kIgIPmXCIAQasLO1+SksyA4GtAjJlYFtt yO/lLacbwfmoE1js4zuF704wMdf13oPWgLO9oJZhbn6jC8b/sF9I42Rw2jEOtqboQHjP I+TQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:content-transfer-encoding:from:mime-version :subject:date:message-id:references:cc:in-reply-to:to; bh=ogMjmU8TVVNg43Nr1CjCDeBBvgTwfndkWvfped9QcrM=; b=VmD7rGd1Y5omzC4VEBO0wlg6aa3Mo+h7uC7k/GFzui+9+h/NZ0WJtp2FFbOwTMdcMq 9iV9LZPJ67xGpGb8eTohnU1bUOINgsUPLOUS+E+JG9lavIiL15zDifMgqR5+qcUQMiHh X5YJxWchtjsCTPG/dnsQvh6qm2GkS6e9lFEvoEzz2iC6emz2ZasGOTOWSfc26eAOn2Xu XpXRIzFzQSYnAXnn/jFf6s5n7R5vy0/Pa9sXkhi5zIUlqiGyvoNAOU+tU2EwZpQUFczW EK/Tmf8ytPUHVmlMkCHv2JYJjrqi3hhA7TEDey1kiNwk/HbQKHNOw79KgN2rfskbzPAS NYfg== X-Gm-Message-State: APjAAAXdZbrlj7CMIA3d/k4snzqLQYGp8D+FVghAi4UQnxOmG7ZMuppT M+VTiWs7xO+F3V9wy6M4r5h6fg== X-Google-Smtp-Source: APXvYqxi7lMpvDjFdEAmDVHKn6pkax1dVZUmABILvpKh0qW1Nf3kYWcu1PpY4f6NIWqfLeDuXajpMw== X-Received: by 2002:a37:8a86:: with SMTP id m128mr4252309qkd.327.1565877443503; Thu, 15 Aug 2019 06:57:23 -0700 (PDT) Received: from [10.0.100.56] (c-73-186-137-119.hsd1.ma.comcast.net. [73.186.137.119]) by smtp.gmail.com with ESMTPSA id r15sm1405702qtp.94.2019.08.15.06.57.22 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Thu, 15 Aug 2019 06:57:22 -0700 (PDT) Content-Type: multipart/alternative; boundary=Apple-Mail-97F3552B-AE33-451D-8F32-B22EAACBBA2D Content-Transfer-Encoding: 7bit From: Ted Lemon Mime-Version: 1.0 (1.0) Date: Thu, 15 Aug 2019 09:57:22 -0400 Message-Id: References: Cc: Ralf Weber , Neil Cook , =?utf-8?Q?Patrik_F=C3=A4ltstr=C3=B6m?= , ADD Mailing list , Bret Jordan , "STARK, BARBARA H" , Martin Thomson , Stephen Farrell In-Reply-To: To: Eric Rescorla X-Mailer: iPhone Mail (17A815) Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 13:57:27 -0000 --Apple-Mail-97F3552B-AE33-451D-8F32-B22EAACBBA2D Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Silly question. We=E2=80=99re talking about how it would be nice to document= the issues that will come up as a result of DoH being in the wild, and perh= aps the solutions people propose, whether they are recommended by the IETF o= r not. Is anyone in fact writing that document? Sent from my iPhone > On Aug 15, 2019, at 09:50, Eric Rescorla wrote: >=20 > =EF=BB=BF >=20 >=20 >> On Thu, Aug 15, 2019 at 3:20 PM Ralf Weber wrote: >> Moin! >>=20 >> On 15 Aug 2019, at 14:29, STARK, BARBARA H wrote: >>=20 >> >> Agreed. This is why we are working to develop mechanisms to detect=20 >> >> this case. See for more details. >> > >> > It appears from this that you're also doing lots of tests and=20 >> > experiments. That's great. I'd like to suggest the following=20 >> > experiment: >> > How often will a DNS query for CDN content to Cloudflare (e.g., via=20 >> > DoH, but what DNS goes over isn't important) provide a different IP=20 >> > address than the same query to the ISP resolver? Of particular=20 >> > interest are mobile networks. One of the fears is lots of=20 >> > high-bandwidth content (video streams) being shifted to take paths=20 >> > that hadn't been engineered to handle the shifted traffic. The=20 >> > experiment probably needs to be more nuanced (maybe different IP=20 >> > address isn=E2=80=99t the right thing to look for), but you get the ide= a. >> > >> > It's more than just performance of the query or receipt of the first=20= >> > website packet. We need to understand if large amounts of CDN content=20= >> > will come at access networks using different paths and links. >> While this study is not exactly what you envision, but comes close and=20= >> is a clear indicator that there will be a shift if we don=E2=80=99t use o= n=20 >> network resolvers or ECS: >> https://www.samknows.com/blog/dns-over-https-performance >=20 > Bottom lining this, it seems like the results are broadly consistent with o= urs: when DoH/TRR through Cloudflare is used, different CDN nodes are used, b= ut there's no significant performance difference. >=20 > -Ekr >=20 >>=20 >>=20 >> So long >> -Ralf >> =E2=80=94-- >> Ralf Weber > --=20 > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add --Apple-Mail-97F3552B-AE33-451D-8F32-B22EAACBBA2D Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable Silly question. We=E2=80=99re talking about= how it would be nice to document the issues that will come up as a result o= f DoH being in the wild, and perhaps the solutions people propose, whether t= hey are recommended by the IETF or not.

Is anyone in fact= writing that document?

Sent from my iPhone

On Aug 15, 2019, at 09:50, E= ric Rescorla <ekr@rtfm.com> wrote:

=EF=BB=BF


On Thu, Aug 15, 2019 at 3:20 PM Ralf Weber <dns@fl1ger.de> wrote:
Moin!

On 15 Aug 2019, at 14:29, STARK, BARBARA H wrote:

>> Agreed. This is why we are working to develop mechanisms to detect <= br> >> this case. See <url> for more details.
>
> It appears from this that you're also doing lots of tests and
> experiments. That's great. I'd like to suggest the following
> experiment:
> How often will a DNS query for CDN content to Cloudflare (e.g., via > DoH, but what DNS goes over isn't important) provide a different IP > address than the same query to the ISP resolver? Of particular
> interest are mobile networks. One of the fears is lots of
> high-bandwidth content (video streams) being shifted to take paths
= > that hadn't been engineered to handle the shifted traffic. The
> experiment probably needs to be more nuanced (maybe different IP
> address isn=E2=80=99t the right thing to look for), but you get the ide= a.
>
> It's more than just performance of the query or receipt of the first > website packet. We need to understand if large amounts of CDN content <= br> > will come at access networks using different paths and links.
While this study is not exactly what you envision, but comes close and
is a clear indicator that there will be a shift if we don=E2=80=99t use on <= br> network resolvers or ECS:
        https://www.samkno= ws.com/blog/dns-over-https-performance

B= ottom lining this, it seems like the results are broadly consistent with our= s: when DoH/TRR through Cloudflare is used, different CDN nodes are used, bu= t there's no significant performance difference.

-E= kr


=
So long
-Ralf
=E2=80=94--
Ralf Weber
--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
= --Apple-Mail-97F3552B-AE33-451D-8F32-B22EAACBBA2D-- From nobody Thu Aug 15 07:08:45 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 88169120096 for ; Thu, 15 Aug 2019 07:08:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.299 X-Spam-Level: X-Spam-Status: No, score=-4.299 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=open-xchange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id C24fQqdO8yJq for ; Thu, 15 Aug 2019 07:08:42 -0700 (PDT) Received: from mx4.open-xchange.com (alcatraz.open-xchange.com [87.191.39.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B7FAA12008D for ; Thu, 15 Aug 2019 07:08:41 -0700 (PDT) Received: from open-xchange.com (imap.open-xchange.com [10.20.30.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx4.open-xchange.com (Postfix) with ESMTPS id B8E576A230; Thu, 15 Aug 2019 16:08:38 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=open-xchange.com; s=201705; t=1565878118; bh=bV9oMxa11AbH1XcU0K1hBOk2OC6EUPfgTlmSkMrJYqI=; h=From:Subject:Date:In-Reply-To:Cc:To:References:From; b=J5QOgFaRN68oxMGYfbzJ89oUsQOs3EbHZWoHlDd1KSafIg+cLoQwZuLVlyFX/0ZQn Q6yWeK27n14mpK2ZUG3Ceq35sZfLtWmCeDnT1AfU6YryzKwDDIrYjqdCRwQP9ApG6e TyoTg7PhXXSJ5ML/iywf23JO9L+8Roz3hBz6hRUeBCh9+ovnI2OjSV0FYKu2juEB54 lfVkeqFYUIYePb4kFCgovEL4UaIObjx9huNySFRutsr/J0htCvLB0B3asxxZTXXx0O KH5ycclkaFC6Pnz7BCht+PAMK+AvMDuaeBNdmEpvepd497RuMCUo+BAgOI4qvSdfm3 WU1uCYT5OtrnQ== Received: from [192.168.1.128] (host31-53-106-255.range31-53.btcentralplus.com [31.53.106.255]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by open-xchange.com (Postfix) with ESMTPSA id 656B33C03A7; Thu, 15 Aug 2019 16:08:38 +0200 (CEST) From: Neil Cook Message-Id: <404BD040-B3D2-4B60-A29E-CBA36559DAF6@open-xchange.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_8E70979F-053A-4E91-AEF4-5D38F9EF4209" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Thu, 15 Aug 2019 15:08:35 +0100 In-Reply-To: Cc: Ralf Weber , =?utf-8?B?UGF0cmlrIEbDpGx0c3Ryw7Zt?= , ADD Mailing list , Bret Jordan , "STARK, BARBARA H" , Martin Thomson , Stephen Farrell To: Eric Rescorla References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <1610C8E4-1624-4A7E-A24B-C7D0CB06A1DE@gmail.com> <6bbc4857-449e-e587-1e16-c0ee7d1f2aa8@cs.tcd.ie> <31226710-8C33-4696-90F3-4E05ED82FB05@open-xchange.com> <2D09D61DDFA73D4C884805CC7865E6114E272262@GAALPA1MSGUSRBF.ITServices.sbc.com> <8F75AD20-706B-48F7-B6DD-4C15DAFFA429@fl1ger.de> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 14:08:44 -0000 --Apple-Mail=_8E70979F-053A-4E91-AEF4-5D38F9EF4209 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 > On 15 Aug 2019, at 14:49, Eric Rescorla wrote: >=20 >=20 > Bottom lining this, it seems like the results are broadly consistent = with ours: when DoH/TRR through Cloudflare is used, different CDN nodes = are used, but there's no significant performance difference. >=20 =46rom the study: > Whilst the BBC uses Akamai extensively, none of the assets on the BBC = News homepage were served from=20 > on-prem Akamai caches within ISP networks at the time of testing (the = on-prem caches are certainly used for=20 > other BBC services though, such as videos on iPlayer). Which means that it=E2=80=99s not a true comparison of the performance = difference experienced for things like streaming video, which is one of = the primary motivations for on-premise caching for CDNs. So it would be = more accurate to say that the study shows that there=E2=80=99s no = significant performance difference for content served from off-net CDN = nodes. Neil Cook neil.cook@open-xchange.com = --------------------------------------------------------------------------= ----------- Open-Xchange AG, Rollnerstr. 14, 90408 Nuremberg, District Court = Nuremberg HRB 24738 Managing Board: Rafael Laguna de la Vera, Carsten Dirks, Michael = Knapstein, Stephan Martin=20 Chairman of the Board: Richard Seibt European Office:=20 Open-Xchange GmbH, Olper Huette 5f, D-57462 Olpe, Germany, District = Court Siegen, HRB 8718=20 Managing Director: Frank Hoberg US Office:=20 Open-Xchange. Inc., 530 Lytton Avenue, Palo Alto, CA 94301, USA=20 = --------------------------------------------------------------------------= ----------- --Apple-Mail=_8E70979F-053A-4E91-AEF4-5D38F9EF4209 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8

On 15 Aug 2019, at 14:49, Eric Rescorla <ekr@rtfm.com> = wrote:


Bottom lining this, it = seems like the results are broadly consistent with ours: when DoH/TRR = through Cloudflare is used, different CDN nodes are used, but there's no = significant performance difference.

=46rom the = study:

> Whilst the BBC uses = Akamai extensively, none of the assets on the BBC News homepage = were served from 
> on-prem Akamai caches within = ISP networks at the time of testing (the on-prem caches are = certainly used for 
> other BBC services though, = such as videos on iPlayer).

Which means that it=E2=80=99s not a true comparison of = the performance difference experienced for things like streaming video, = which is one of the primary motivations for on-premise caching for CDNs. = So it would be more accurate to say that the study shows that there=E2=80=99= s no significant performance difference for content served from off-net = CDN nodes.

Neil Cook
neil.cook@open-xchange.com

---------------------------------------------------------------= ----------------------
Open-Xchange AG, Rollnerstr. 14, = 90408 Nuremberg, District Court Nuremberg HRB 24738
Managing Board: Rafael Laguna de la Vera, Carsten Dirks, = Michael Knapstein, Stephan Martin 
Chairman of = the Board: Richard Seibt

European = Office: 
Open-Xchange GmbH, Olper Huette = 5f, D-57462 Olpe, Germany, District Court Siegen, HRB = 8718 
Managing Director: Frank Hoberg
US Office: 
Open-Xchange. Inc., 530 = Lytton Avenue, Palo Alto, CA 94301, USA 
---------------------------------------------------------------= ----------------------

= --Apple-Mail=_8E70979F-053A-4E91-AEF4-5D38F9EF4209-- From nobody Thu Aug 15 07:12:28 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BB73A120047 for ; Thu, 15 Aug 2019 07:12:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3L2BEIU2vbcW for ; Thu, 15 Aug 2019 07:12:24 -0700 (PDT) Received: from mail-lj1-x22a.google.com (mail-lj1-x22a.google.com [IPv6:2a00:1450:4864:20::22a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8BF1F120090 for ; Thu, 15 Aug 2019 07:12:23 -0700 (PDT) Received: by mail-lj1-x22a.google.com with SMTP id l14so2340882ljj.9 for ; Thu, 15 Aug 2019 07:12:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=nS7r9AEKvPTkfa8GtuiUJ9Xu3bPBO+QUtjwZ+7uydCE=; b=oR6N8sClOayZIBF9UH/D6WKuyglIDEA12VuPIYHlsVqPSlvWfuO+iNRK0CiYmXDM9Q SMvhpSbun7Tu5vpDEqf0aRqDWgjCqOjSYtPzzhcOL8OE4BQlu1GB92XzKJFfeNEaDCHk pkj+q2uJPIqkyeRXpcWLAgUOhXSvygDkfbIr+7zFSMLm0SwgoLkzXFpUZVUUYc1ES5Hr KJPfIwS4MatP0YpRD4nhaLDOPp3/f96uDZOFkAE0USWiuBMm1f6mLaHrsLMtk/COTCPh AE+qiKqTW5pji8wsA635sOAnQnco8QCvtCcItXf4Wr2LWwkNkUUreBi+joVvHDUBMnWV Lbog== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=nS7r9AEKvPTkfa8GtuiUJ9Xu3bPBO+QUtjwZ+7uydCE=; b=VbrM7ygj+bE0s8IbBhaQiurImo5h78kzz+3VSoRzUK3UX6r2xkMfUEWTEVnn8xF3gu Gkn47o9vzTJnRkIIkewgz7tHDmcB4w8GpEZnRNwpgF6N45NDNtfSgYb/89lPrmFlS8XB KM6NnT97vqYigi1dWvY3Oq7ITfiQIaPDko6GLmzaxtY5HG5jV4IhtaLBcCFqwdv420tb yevlqqnaNJmMbepLYw9mtLWUDmIeWG5wCRDQe7kqbuid09P/GEQIl9k1V8bD9hzbJP5J ecsZ/UNee3/06jnvGt23BLRxUhaL03ussw6hPdrkp0XMTdg1JxgRUP1tzbiY3ewA8fbl L4RA== X-Gm-Message-State: APjAAAUCwewYmHYdRo3SiYdgbvsC3a5xNDVl0GlG6JY3zxkR8uO8RPf+ 2MrTkaVDcJqqkIVrb4hGhJ+bHPgfww/xBNVUhKyGqg== X-Google-Smtp-Source: APXvYqwy/38hCRNbLvJJUS09ktw2BbSCrWgS6N+IFMeMQpN+Ptgy8iQA96VJdAgdtkjNkRcZ/jwQ5WBfFmqQNgRo4ew= X-Received: by 2002:a2e:5c43:: with SMTP id q64mr2863150ljb.14.1565878341711; Thu, 15 Aug 2019 07:12:21 -0700 (PDT) MIME-Version: 1.0 References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <1610C8E4-1624-4A7E-A24B-C7D0CB06A1DE@gmail.com> <6bbc4857-449e-e587-1e16-c0ee7d1f2aa8@cs.tcd.ie> <31226710-8C33-4696-90F3-4E05ED82FB05@open-xchange.com> <2D09D61DDFA73D4C884805CC7865E6114E272262@GAALPA1MSGUSRBF.ITServices.sbc.com> <8F75AD20-706B-48F7-B6DD-4C15DAFFA429@fl1ger.de> <404BD040-B3D2-4B60-A29E-CBA36559DAF6@open-xchange.com> In-Reply-To: <404BD040-B3D2-4B60-A29E-CBA36559DAF6@open-xchange.com> From: Eric Rescorla Date: Thu, 15 Aug 2019 16:11:44 +0200 Message-ID: To: Neil Cook Cc: Ralf Weber , =?UTF-8?B?UGF0cmlrIEbDpGx0c3Ryw7Zt?= , ADD Mailing list , Bret Jordan , "STARK, BARBARA H" , Martin Thomson , Stephen Farrell Content-Type: multipart/alternative; boundary="00000000000051e579059028765f" Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 14:12:27 -0000 --00000000000051e579059028765f Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Thu, Aug 15, 2019 at 4:08 PM Neil Cook wrote: > > > On 15 Aug 2019, at 14:49, Eric Rescorla wrote: > >> >> > Bottom lining this, it seems like the results are broadly consistent with > ours: when DoH/TRR through Cloudflare is used, different CDN nodes are > used, but there's no significant performance difference. > > From the study: > > > Whilst the BBC uses Akamai extensively, none of the assets on the > BBC News homepage were served from > > on-prem Akamai caches within ISP networks at the time of testing (the > on-prem caches are certainly used for > > other BBC services though, such as videos on iPlayer). > > Which means that it=E2=80=99s not a true comparison of the performance di= fference > experienced for things like streaming video, which is one of the primary > motivations for on-premise caching for CDNs. So it would be more accurate > to say that the study shows that there=E2=80=99s no significant performan= ce > difference for content served from off-net CDN nodes. > As I said, I'm certainly interested in any data that someone would like to share. -Ekr Neil Cook > neil.cook@open-xchange.com > > > -------------------------------------------------------------------------= ------------ > Open-Xchange AG, Rollnerstr. 14, 90408 Nuremberg, District Court > Nuremberg HRB 24738 > Managing Board: Rafael Laguna de la Vera, Carsten Dirks, Michael > Knapstein, Stephan Martin > Chairman of the Board: Richard Seibt > > European Office: > Open-Xchange GmbH, Olper Huette 5f, D-57462 Olpe, Germany, District > Court Siegen, HRB 8718 > Managing Director: Frank Hoberg > > US Office: > Open-Xchange. Inc., 530 Lytton Avenue, Palo Alto, CA 94301, USA > > -------------------------------------------------------------------------= ------------ > > --00000000000051e579059028765f Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Thu, Aug 15, 2019 at 4:08 PM Neil = Cook <neil.cook@open-xchan= ge.com> wrote:


On 15 Aug 2019, at 14:49, Eric Rescorla <ekr@rtfm.com> wrote:
<= div dir=3D"ltr" style=3D"font-family:Helvetica;font-size:13px;font-style:no= rmal;font-variant-caps:normal;font-weight:normal;letter-spacing:normal;text= -align:start;text-indent:0px;text-transform:none;white-space:normal;word-sp= acing:0px;text-decoration:none">


Bott= om lining this, it seems like the results are broadly consistent with ours:= when DoH/TRR through Cloudflare is used, different CDN nodes are used, but= there's no significant performance difference.

From the study:

> W= hilst the BBC uses Akamai extensively, none of the assets on the BBC=C2=A0N= ews homepage were served from=C2=A0
> on-prem Akamai caches wi= thin ISP=C2=A0networks at the time of testing (the on-prem caches are certa= inly used=C2=A0for=C2=A0
> other BBC services though, such as = videos on iPlayer).

Which means that it=E2=80=99s not a= true comparison of the performance difference experienced for things like = streaming video, which is one of the primary motivations for on-premise cac= hing for CDNs. So it would be more accurate to say that the study shows tha= t there=E2=80=99s no significant performance difference for content served = from off-net CDN nodes.

As I said= , I'm certainly interested in any data that someone would like to share= .

-Ekr



Neil Cook<= span style=3D"color:rgb(0,0,0);font-family:Helvetica;font-size:12px;font-st= yle:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-vari= ant-east-asian:normal;font-weight:normal;letter-spacing:normal;text-align:s= tart;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0p= x;float:none;display:inline">neil.cook@open-xchange.com

----= ---------------------------------------------------------------------------= ------
Open-Xchange AG, Rollnerstr. 14, 90408=C2=A0Nuremberg, District C= ourt Nuremberg=C2=A0HRB 24738
Managing Board: Rafael Laguna de la=C2=A0V= era, Carsten Dirks, Michael Knapstein,=C2=A0Stephan Martin=C2=A0
Chairma= n of the Board: Richard Seibt

European Office:=C2=A0
Open-Xchange= GmbH, Olper Huette 5f,=C2=A0D-57462 Olpe, Germany, District Court=C2=A0Sie= gen, HRB 8718=C2=A0
Managing Director: Frank Hoberg

US Office:=C2= =A0
Open-Xchange. Inc., 530 Lytton Avenue,=C2=A0Palo Alto, CA 94301, USA= =C2=A0
-----------------------------------------------------------------= --------------------

--00000000000051e579059028765f-- From nobody Thu Aug 15 07:25:40 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6A661120052 for ; Thu, 15 Aug 2019 07:25:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=netorgft5189650.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id C0BUNWfdTkc6 for ; Thu, 15 Aug 2019 07:25:37 -0700 (PDT) Received: from GBR01-CWL-obe.outbound.protection.outlook.com (mail-eopbgr110064.outbound.protection.outlook.com [40.107.11.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 22C49120047 for ; Thu, 15 Aug 2019 07:25:37 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=nI30WJ0E0wggn2Bf62CVhpzgX7A9DrOSA7wJKssVnP+8ELySzvb8fDJa7XV2+tHRAl72AB+OvUERXbdixtDaenvUNuOSy8w3U+OfpktP+6r1o6Pmxg8PkE7+K41kR2LZgttjo8FY1xMvyAl9vVUz12dyApA/xBmtG32bmdk2VO7X421lCJll7w0bMayOnNwyWfmhlLvZRiHv3pm0808iMUwYhF3MjQt7Lwjrzyx9MT2sJZOIC4ZtzGRWI2Ci5reJvRKd/QNsTfR1sxGYze0UMSv0OZg8xUuYUo+UXO2UUdknuLwS6/st5BCHVfRuovyV7gqyaywnkd39vRh04cEZ3g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=EBUGcRpPTZaP3e/wzHEU+ogvWlhEWl9V2fv0nbFjX7k=; b=UyLIwWKsKvDynb1f8JyozsWYpue5mr7XgiKmIfh/lApS/QxQyeYZat8/wCfWa8YiNsh4Kg4+FLjaIbkff0nI3fMFBsufIMgZtsWRSF7Q7ZYjcnf8EqstGEnK/viW1LNIBxsnSv/XpUwbmEnWveqXP3KqyZ4NhQ60hq9eqa6UfGw3WmXMsIcVtmU+ZOBrsWpgyDtOjeferczywtjzy1gs1x3mqVdP8LJCmE4E05BnCAAV65YJhX3OiYmOwTTiP4Vl7pkQeKFpZ4AgKJGI7ViTK0m9greSK3cvWBhaEuzZwDqxw11q5Sj/rYcIcKpsz6FSsHf64CtJDbtMM6xQ2gOhUQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=419.consulting; dmarc=pass action=none header.from=419.consulting; dkim=pass header.d=419.consulting; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=NETORGFT5189650.onmicrosoft.com; s=selector1-NETORGFT5189650-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=EBUGcRpPTZaP3e/wzHEU+ogvWlhEWl9V2fv0nbFjX7k=; b=blOF2X4aR+s6GCJfnzF1xVAXJ975bqkD6JFSaQv2beLBSVUI9AVkenEzuLchsyyhnjA3ktol519YVug4V5+2Maq5cqZBfgIyCCNyU4upZSCe1NtnRRqB5owMXUQvhAvdennc2GJsH9gKcUQ8hagQRjUMlIM8okyc5bqEv1acHJY= Received: from LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM (20.176.138.146) by LO2P265MB0174.GBRP265.PROD.OUTLOOK.COM (10.166.99.15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2157.14; Thu, 15 Aug 2019 14:25:34 +0000 Received: from LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM ([fe80::64e9:9b9e:59fc:26f]) by LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM ([fe80::64e9:9b9e:59fc:26f%5]) with mapi id 15.20.2157.022; Thu, 15 Aug 2019 14:25:34 +0000 From: Andrew Campling To: Daniel Stenberg , Brian Dickson CC: Paul Hoffman , ADD Mailing list Thread-Topic: Use Cases - the coffee shop Thread-Index: AdVTdTO8sMFf9NSjRg6hhfqT7Scbew== Date: Thu, 15 Aug 2019 14:25:34 +0000 Message-ID: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=andrew.campling@419.consulting; x-originating-ip: [2a00:23c4:a499:2e00:f42b:87f3:b90b:d830] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: f1a08478-30df-4657-29be-08d7218c6f8c x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(7021145)(8989299)(4534185)(7022145)(4603075)(4627221)(201702281549075)(8990200)(7048125)(7024125)(7027125)(7023125)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:LO2P265MB0174; x-ms-traffictypediagnostic: LO2P265MB0174: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:8882; x-forefront-prvs: 01304918F3 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(366004)(346002)(136003)(39830400003)(396003)(376002)(199004)(189003)(71200400001)(86362001)(2906002)(81156014)(6116002)(71190400001)(8936002)(81166006)(8676002)(508600001)(7736002)(33656002)(305945005)(53936002)(25786009)(74316002)(4326008)(14454004)(9686003)(44832011)(186003)(6436002)(46003)(5660300002)(486006)(110136005)(66574012)(55016002)(102836004)(6506007)(7696005)(476003)(99286004)(76116006)(66446008)(66476007)(66556008)(66946007)(64756008)(256004)(14444005)(52536014)(316002)(54906003)(46492003); DIR:OUT; SFP:1101; SCL:1; SRVR:LO2P265MB0174; H:LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: 419.consulting does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: qpF/vyAkcFCgZ/AIixSlgBVhZTlmexBqCVWobDPdZsnUzC0On9WFBYcl+SljgOisGlueHlOBACH2Vywu7VOCz0pUejwiZA8Uqdm7C+t2GCUEecyWVfyKcJ02vstP+I2DqKKwiGvlGUHtE26bQeiI4zYUD+najy+srxfs3K7Ogc517XrSvqVeyrOX8hzHXXI9MhcF7yX6LosZHt7stE3MfZumFYglu6+znYl1dRvMwr/hcaLWLFfpgxXPN6rJAODKC/2c7ComCrvqkIoTohgNErHllIXfJz/YXMzsfyhaqBulBxO8+a7RkmefXhQREZF2iah6GxntiZnGq4C7ZtFhrFIMvOB+c+kFlq5zC4ZJi6kk/ZlCyHtZnO0Sn4uhRapp+ASNJtnKeka/r+0TkufcVcxt0aNK6EaGImaT3Pw/5/g= x-ms-exchange-transport-forked: True Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: 419.consulting X-MS-Exchange-CrossTenant-Network-Message-Id: f1a08478-30df-4657-29be-08d7218c6f8c X-MS-Exchange-CrossTenant-originalarrivaltime: 15 Aug 2019 14:25:34.5550 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 9c2ced3e-7522-4755-87dc-f983abc66ec3 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: 71T7WK1CgbepjeCEQYS+mXMgz6nhdem/zY0Y4jdklwu/Qwmth1emWoZ92KizpANPsDduY8/Jm7Jj0u+3I6b/7O4BtWVpzoIc3+vwceWQpxc= X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO2P265MB0174 Archived-At: Subject: [Add] Use Cases - the coffee shop X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 14:25:39 -0000 On Thu, 15 Aug 2019, Daniel Stenberg wrote: > I disagree. It would make DoH a whole lot less useful in my view as then = coffere shop=20 > operators can easily take away my ability to chose to use DoH, for exampl= e. Since the coffee shop / hotel network use case arises so frequently, I thin= k it's worth exploring this a little further. =20 The coffee shop / hotel is providing the (presumably free) network in order= to attract your custom, you are freely choosing to use it rather than an a= lternate such as a mobile network. As the service provider, the coffee sho= p has the right to determine how its network is used, preferably clearly st= ating any such conditions at the outset. If it decides not to allow you to= access an alternate DNS for whatever reason, I'm not convinced that the mo= st appropriate next step is to change the way the whole internet ecosystem = works in order for you to circumvent its rules, with all the accompanying u= nintended consequences to the wider ecosystem. The more usual approach in = such circumstances, if such a prohibition matters to you, is to (i) raise y= our concerns and objections with the coffee shop owner and/or (ii) take you= r business elsewhere. =20 Andrew=20 From nobody Thu Aug 15 07:29:38 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5450E120096 for ; Thu, 15 Aug 2019 07:29:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xYM82jX6Zn0x for ; Thu, 15 Aug 2019 07:29:34 -0700 (PDT) Received: from mail-qt1-x82f.google.com (mail-qt1-x82f.google.com [IPv6:2607:f8b0:4864:20::82f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 90875120052 for ; Thu, 15 Aug 2019 07:29:34 -0700 (PDT) Received: by mail-qt1-x82f.google.com with SMTP id y26so2533171qto.4 for ; Thu, 15 Aug 2019 07:29:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=content-transfer-encoding:subject:mime-version:to:from:in-reply-to :cc:date:message-id:references; bh=Ypgf5SvaFWFv2NFGNAsD0coHxA5SpH3DFjs7juRIvRY=; b=0NZ11vJo9oyxo7Qka/VYQ8my10dFlLVwWpr611H0s/J/4VtjWaf1VNmvvCS7twoXqi 4jyQvgLHMytPga5E13UlsUT8jUvjj1TfxXYGaGYL+ZyPwpDZ6JHwYoGMEp8vNUwQXxgS HsrbqbR9EMSzobzHSri4QlOXJiSSWCIafVWY2oosCxNIEOScBp97N+RA441gcrMmGxVd iIGFmUamUSkMi/5uFbQezrBUjdtLPMWIfgt6JXur79k+T8RPgEdiQJrR2JGXNNQ+YUuN YELySUDg6EdrH2W02n3II5ZFzIexxL8Gbi/90BFRvk8EHRxNDrMrv4OXxly5xQiL4dMm DgVg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:content-transfer-encoding:subject:mime-version :to:from:in-reply-to:cc:date:message-id:references; bh=Ypgf5SvaFWFv2NFGNAsD0coHxA5SpH3DFjs7juRIvRY=; b=ChNVBv1NK5jqR6A3HGGlyHhPoj3TG8hnb0p4I82HGN0HP69BTym2a/GuYaOKZjGcI8 JeFjlC18azbmLCU2t/SkDyrg4ZEaJi4QEI3xD+A5hvZDNn+klGs6zRNnxMfDFyOk4vj4 vh8+/tIX7QejPtD+QPGm4m5GEPRetcpg7qO9Na9rZ8DUaRIjAO+ZNaJ8Aa8y5ichI/Xh qnXL7/nnW2yXm6Lvm4IddxUIDj7itxLD3pFwcAI+rbXoDTz6W9vY3TtXBH6H/WK9trY+ 0Pcfi2F7tXnMHbtJwOFV7kvB/CE7QXCZufY/WlZ3GnxO/Q9q/qfTuVgTQ2iJbdkmBxq5 z1gg== X-Gm-Message-State: APjAAAWPjotUk3nNrZA42KZcVICxQ040i/cRGRqIefT18jGR/kEGi20T MASjFcyavJtDSpWhgvPWt+B5uA== X-Google-Smtp-Source: APXvYqzIc+U1iF5UDxSiINtnsI7k/BQCuV8a+4U3K+9ycQR/10oWSeaJmnpUeL1+mk3+47/7DYAlLA== X-Received: by 2002:ac8:f3b:: with SMTP id e56mr4120754qtk.123.1565879373574; Thu, 15 Aug 2019 07:29:33 -0700 (PDT) Received: from [10.0.100.56] (c-73-186-137-119.hsd1.nh.comcast.net. [73.186.137.119]) by smtp.gmail.com with ESMTPSA id l5sm1426667qte.9.2019.08.15.07.29.32 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Thu, 15 Aug 2019 07:29:33 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 (1.0) To: Andrew Campling X-Universally-Unique-Identifier: 4688E712-FA70-4D0D-92BE-851C2D01E2AB From: Ted Lemon In-Reply-To: Cc: Daniel Stenberg , Brian Dickson , Paul Hoffman , ADD Mailing list Date: Thu, 15 Aug 2019 10:29:32 -0400 X-Apple-Message-Smime-Encrypt: NO Message-Id: References: X-Apple-Notify-Thread: NO X-Mailer: iPhone Mail (17A815) Archived-At: Subject: Re: [Add] Use Cases - the coffee shop X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 14:29:37 -0000 What if the coffee shop is just using a crappy dns proxy that mangles dnssec= messages? Sent from my iPhone > On Aug 15, 2019, at 10:25, Andrew Campling wrote: >=20 > =EF=BB=BFOn Thu, 15 Aug 2019, Daniel Stenberg wrote: >=20 >> I disagree. It would make DoH a whole lot less useful in my view as then c= offere shop=20 >> operators can easily take away my ability to chose to use DoH, for exampl= e. >=20 > Since the coffee shop / hotel network use case arises so frequently, I thi= nk it's worth exploring this a little further. =20 >=20 > The coffee shop / hotel is providing the (presumably free) network in orde= r to attract your custom, you are freely choosing to use it rather than an a= lternate such as a mobile network. As the service provider, the coffee shop= has the right to determine how its network is used, preferably clearly stat= ing any such conditions at the outset. If it decides not to allow you to ac= cess an alternate DNS for whatever reason, I'm not convinced that the most a= ppropriate next step is to change the way the whole internet ecosystem works= in order for you to circumvent its rules, with all the accompanying uninten= ded consequences to the wider ecosystem. The more usual approach in such ci= rcumstances, if such a prohibition matters to you, is to (i) raise your conc= erns and objections with the coffee shop owner and/or (ii) take your busines= s elsewhere. =20 >=20 >=20 > Andrew=20 >=20 > --=20 > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add From nobody Thu Aug 15 07:38:15 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CD6751200B6 for ; Thu, 15 Aug 2019 07:38:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=netorgft5189650.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SLM5I5xHEvpc for ; Thu, 15 Aug 2019 07:38:10 -0700 (PDT) Received: from GBR01-LO2-obe.outbound.protection.outlook.com (mail-eopbgr100083.outbound.protection.outlook.com [40.107.10.83]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9083E1200B3 for ; Thu, 15 Aug 2019 07:38:10 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=JjPB6Og2nBhAkZ3SYY+7MARrtz58rmxSFyB0pQDt+4G8TsjNuTuy1e5BQzP8gM48Cq6vYX55PISLuD6XIopn2b5xR7ZXs/gI1uuhJGKHGHQgYQyx+roL0GQcCur7YQQgfgSrVLH0HiDMVm6G/gC+GyEE1IZkf7+M5RMCtQdr9I/k5v8xlr3N3nygprlhEa6gDJ9wuqUY2JfDG6DXlUKyAwfSRgTbOC1/QQ3mqlF5WdA4lMgt7i4H5Rl+qR3IdKjBRJ7FvgRw9dri5fpMxWu7Clj/wZlRrgF743MUqConqsuyjJtXhVvRi2SgGL51KDDwMxS0KE3npadKaYFrXTwVXQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=ZRwnhLDpbGuT5K3dDp7nmHLCwcH+fOkKR5g6eIn4dE8=; b=UI3PCsbWtAwBXzhUwRoV5RPx3uPoa15ZTEWG0ypJi13AISLx82vy/CjC/OS1TqCjFH/fyI0sJLtChTbcbdizDwJ1xttY1ttN0AkCQG82w7a3vFhLmAkV0Igmycpvc8YqsV4zw7ExnvgddEdgnPGe4lJ5MnT9Bf4MwLAg1KVNXB8XfUHVO7aelstyl6THCB/Dlb1hk1flTKTKle7cQ/bOUiMkUwPA5yA2+Ls2BmBO6fBmvqF0pNkWdw8a5japNhpttGOacoaiS7q6CiAwFHKmTBimiQ/sgEySZxrIRY2kAYKsML6/TuuMmjcfdf/+vMFhJMW917r11sMpYM0lyjSApQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=419.consulting; dmarc=pass action=none header.from=419.consulting; dkim=pass header.d=419.consulting; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=NETORGFT5189650.onmicrosoft.com; s=selector1-NETORGFT5189650-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=ZRwnhLDpbGuT5K3dDp7nmHLCwcH+fOkKR5g6eIn4dE8=; b=O2FWeAGyXgk0Vr7lA3yBZtrBKlb9qj/vZElVgtPfIRVIth/9omMm1QXFGTHh9bNaj0X6nDysnYdQzsZBsRjY6HtRbN0vuZqzmnU0V6nl7MxDTbcUxtGm8vx0HrUWJG/b9o8IMXYJHze5RwuH15vYGu3Bv+i3k8jYfz57esPO1nw= Received: from LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM (20.176.138.146) by LO2SPR01MB01.GBRP265.PROD.OUTLOOK.COM (10.166.103.23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2157.13; Thu, 15 Aug 2019 14:38:08 +0000 Received: from LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM ([fe80::64e9:9b9e:59fc:26f]) by LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM ([fe80::64e9:9b9e:59fc:26f%5]) with mapi id 15.20.2157.022; Thu, 15 Aug 2019 14:38:08 +0000 From: Andrew Campling To: Ted Lemon CC: Daniel Stenberg , Brian Dickson , Paul Hoffman , ADD Mailing list Thread-Topic: [Add] Use Cases - the coffee shop Thread-Index: AdVTdTO8sMFf9NSjRg6hhfqT7ScbewAAKbMAAAAmFVA= Date: Thu, 15 Aug 2019 14:38:08 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=andrew.campling@419.consulting; x-originating-ip: [2a00:23c4:a499:2e00:f42b:87f3:b90b:d830] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 9fb2bea3-419a-4969-a388-08d7218e30c7 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(7021145)(8989299)(4534185)(7022145)(4603075)(4627221)(201702281549075)(8990200)(7048125)(7024125)(7027125)(7023125)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:LO2SPR01MB01; x-ms-traffictypediagnostic: LO2SPR01MB01: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:4303; x-forefront-prvs: 01304918F3 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(39830400003)(376002)(396003)(346002)(136003)(366004)(199004)(189003)(14444005)(8676002)(86362001)(256004)(316002)(74316002)(102836004)(6916009)(7696005)(54906003)(6436002)(229853002)(99286004)(64756008)(76116006)(44832011)(66446008)(66556008)(66476007)(66946007)(186003)(76176011)(14454004)(6506007)(53546011)(446003)(4326008)(33656002)(486006)(2906002)(81156014)(66574012)(71190400001)(71200400001)(476003)(305945005)(52536014)(7736002)(8936002)(4744005)(25786009)(9686003)(46003)(508600001)(5660300002)(53936002)(11346002)(55016002)(81166006)(6246003)(6116002)(46492003); DIR:OUT; SFP:1101; SCL:1; SRVR:LO2SPR01MB01; H:LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: 419.consulting does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: EV9SM3mzoNGKQtI+WzrZ+tv6aNd5XQXcdGcFt/I8tbgj+PMlylWF/rziF9R20HFXwf+YONbPqdHrUd4ckBaNbZJcXVXecgM55xlm6iW3U2SEgQEcuu66Bn8aqd48NvY6l0WIo5Eges5OlAe+TPXF9tk4u38UWhOwx/gkzlhAWziIpHSJT2Doh8LAvMfjl1eW/pdsArcW/3erHv5aMrT+ZpaLfPLlK5vjM4ftiMYN8z8zeKfdurjNIsV+RWm+acms/j8OWDxTnhDgiaZMPYGyM/VNmFix2Aj1wM9EerxqG4gerxhjmjXs4sIi2O0g468zisisHrQ5A9wgbkcixsWZfvUuoVS0DnnpS0/YcO3OV3bIzg1UQmVbir3ynkmzgX4YDadIg3+mUby8NWPl+VfV9uY1A+oUnKX9P1EfJzpDqKk= x-ms-exchange-transport-forked: True Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: 419.consulting X-MS-Exchange-CrossTenant-Network-Message-Id: 9fb2bea3-419a-4969-a388-08d7218e30c7 X-MS-Exchange-CrossTenant-originalarrivaltime: 15 Aug 2019 14:38:08.1648 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 9c2ced3e-7522-4755-87dc-f983abc66ec3 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: 7nTuBwQVq9sGNZhKWeKu86mxSIwJpFGeG19bQVYSqHQQKz+v60vbM6l9HdrsqYpO/FAYmpvfzdquANCXKDdTkDDpAq0LKORpWpxVlRT24z4= X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO2SPR01MB01 Archived-At: Subject: Re: [Add] Use Cases - the coffee shop X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 14:38:13 -0000 PiBPbiBBdWcgMTUsIDIwMTksIGF0IDE1OjMwLCBUZWQgTGVtb24gPG1lbGxvbkBmdWd1ZS5jb20+ IHdyb3RlOg0KPiANCj4gV2hhdCBpZiB0aGUgY29mZmVlIHNob3AgaXMganVzdCB1c2luZyBhIGNy YXBweSBkbnMgcHJveHkgdGhhdCBtYW5nbGVzIGRuc3NlYyBtZXNzYWdlcz8NCg0KSSBiZWxpZXZl IHRoZSBwb2ludCBzdGlsbCBzdGFuZHMuICBZb3UgaGF2ZSB0aGUgb3B0aW9uIG9mIHRha2luZyB5 b3VyIGJ1c2luZXNzIGVsc2V3aGVyZSBvciwgaWYgdGhlIGNvZmZlZSByZWFsbHkgaXMgdGhhdCBn b29kLCBhY2NlcHRpbmcgdGhlIG5ldHdvcmsgY29tcHJvbWlzZXMgaW4gb3JkZXIgdG8gY29uc3Vt ZSBpdC4gIENoYW5naW5nIHRoZSB3YXkgdGhlIHdob2xlIGludGVybmV0IGVjb3N5c3RlbSB3b3Jr cyBpbiBvcmRlciBmb3IgeW91IHRvIGNpcmN1bXZlbnQgdGhlIG5ldHdvcmsgcnVsZXMgb2Ygb3Vy IGh5cG90aGV0aWNhbCBjb2ZmZWUgc2hvcCBzbyB0aGF0IGl0IHdvcmtzIHRvIHlvdXIgbGlraW5n IGZlZWxzIGxpa2UgYSB3aG9sbHkgZGlzcHJvcG9ydGlvbmF0ZSByZXNwb25zZSB3aXRoIGxpa2Vs eSB1bmludGVuZGVkIGFuZCB1bmtub3duIGNvbnNlcXVlbmNlcy4gIA0KDQpUaGVyZSBtYXkgYmUg Y29tcGVsbGluZyB1c2UgY2FzZXMsIGluIG15IHZpZXcgdGhpcyBpcyBub3Qgb25lIG9mIHRoZW0u DQoNCg0KQW5kcmV3IA0K From nobody Thu Aug 15 07:42:53 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4F199120090 for ; Thu, 15 Aug 2019 07:42:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bJrkn2KYGEbi for ; Thu, 15 Aug 2019 07:42:49 -0700 (PDT) Received: from smtp.guxx.net (nyx.guxx.net [85.10.208.173]) by ietfa.amsl.com (Postfix) with ESMTP id 4E6881200B3 for ; Thu, 15 Aug 2019 07:42:49 -0700 (PDT) Received: by nyx.guxx.net (Postfix, from userid 107) id 3CE625F42D33; Thu, 15 Aug 2019 16:42:47 +0200 (CEST) Received: from [172.19.152.108] (p54B8ABDF.dip0.t-ipconnect.de [84.184.171.223]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by nyx.guxx.net (Postfix) with ESMTPSA id E08225F42C87; Thu, 15 Aug 2019 16:42:46 +0200 (CEST) From: "Ralf Weber" To: "Eric Rescorla" Cc: "Neil Cook" , "Patrik =?utf-8?b?RsOkbHRzdHLDtm0=?=" , "ADD Mailing list" , "Bret Jordan" , "STARK, BARBARA H" , "Martin Thomson" , "Stephen Farrell" Date: Thu, 15 Aug 2019 16:42:46 +0200 X-Mailer: MailMate (1.12.5r5635) Message-ID: <04E62C83-56A7-4668-BF95-FFD06C8C9E9F@fl1ger.de> In-Reply-To: References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <1610C8E4-1624-4A7E-A24B-C7D0CB06A1DE@gmail.com> <6bbc4857-449e-e587-1e16-c0ee7d1f2aa8@cs.tcd.ie> <31226710-8C33-4696-90F3-4E05ED82FB05@open-xchange.com> <2D09D61DDFA73D4C884805CC7865E6114E272262@GAALPA1MSGUSRBF.ITServices.sbc.com> <8F75AD20-706B-48F7-B6DD-4C15DAFFA429@fl1ger.de> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 14:42:51 -0000 Moin! On 15 Aug 2019, at 15:49, Eric Rescorla wrote: > Bottom lining this, it seems like the results are broadly consistent with > ours: when DoH/TRR through Cloudflare is used, different CDN nodes are > used, but there's no significant performance difference. There is no performance difference, because no one is using it. The fact that different nodes are used has a big impact both performance and commercial if there was a large population that had to get something from a location that was not designed to handle its load over links that were not sized to handle this load. And ISP and content/CDN providers would have to bear the cost of that traffic that otherwise would flow at much lower cost inside the provider network, often not leaving the POP where the user connects. So long -Ralf —-- Ralf Weber From nobody Thu Aug 15 07:43:05 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 95EBD120090 for ; Thu, 15 Aug 2019 07:43:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EFQX0FsulI1n for ; Thu, 15 Aug 2019 07:43:01 -0700 (PDT) Received: from mx0a-00191d01.pphosted.com (mx0a-00191d01.pphosted.com [67.231.149.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 387381200C3 for ; Thu, 15 Aug 2019 07:43:01 -0700 (PDT) Received: from pps.filterd (m0049295.ppops.net [127.0.0.1]) by m0049295.ppops.net-00191d01. (8.16.0.27/8.16.0.27) with SMTP id x7FEZkHW005596; Thu, 15 Aug 2019 10:42:32 -0400 Received: from alpi154.enaf.aldc.att.com (sbcsmtp6.sbc.com [144.160.229.23]) by m0049295.ppops.net-00191d01. with ESMTP id 2ud8v0s580-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 15 Aug 2019 10:42:32 -0400 Received: from enaf.aldc.att.com (localhost [127.0.0.1]) by alpi154.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id x7FEgUb4019937; Thu, 15 Aug 2019 10:42:31 -0400 Received: from zlp30488.vci.att.com (zlp30488.vci.att.com [135.47.91.93]) by alpi154.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id x7FEgEJd019457 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Thu, 15 Aug 2019 10:42:14 -0400 Received: from zlp30488.vci.att.com (zlp30488.vci.att.com [127.0.0.1]) by zlp30488.vci.att.com (Service) with ESMTP id 2196A4009E7B; Thu, 15 Aug 2019 14:42:14 +0000 (GMT) Received: from GAALPA1MSGHUBAB.ITServices.sbc.com (unknown [130.8.218.151]) by zlp30488.vci.att.com (Service) with ESMTPS id 0FEEE4009E65; Thu, 15 Aug 2019 14:42:14 +0000 (GMT) Received: from GAALPA1MSGUSRBF.ITServices.sbc.com ([169.254.5.177]) by GAALPA1MSGHUBAB.ITServices.sbc.com ([130.8.218.151]) with mapi id 14.03.0439.000; Thu, 15 Aug 2019 10:42:13 -0400 From: "STARK, BARBARA H" To: "'Ted Lemon'" , "'Andrew Campling'" CC: "'Paul Hoffman'" , "'ADD Mailing list'" , "'Brian Dickson'" , "'Daniel Stenberg'" Thread-Topic: [Add] Use Cases - the coffee shop Thread-Index: AdVTdTO8sMFf9NSjRg6hhfqT7ScbewAIi3cAAAgqRKA= Date: Thu, 15 Aug 2019 14:42:13 +0000 Message-ID: <2D09D61DDFA73D4C884805CC7865E6114E2757F0@GAALPA1MSGUSRBF.ITServices.sbc.com> References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [135.70.196.183] Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-08-15_05:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_policy_notspam policy=outbound_policy score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1011 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=476 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1906280000 definitions=main-1908150148 Archived-At: Subject: Re: [Add] Use Cases - the coffee shop X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 14:43:03 -0000 PiBXaGF0IGlmIHRoZSBjb2ZmZWUgc2hvcCBpcyBqdXN0IHVzaW5nIGEgY3JhcHB5IGRucyBwcm94 eSB0aGF0IG1hbmdsZXMgZG5zc2VjDQo+IG1lc3NhZ2VzPw0KDQpJJ20gcHJldHR5IHN1cmUgcGVv cGxlIGluIGNvZmZlZSBzaG9wcyBoYXZlIHRoZSBhYmlsaXR5IHRvIG5vdCB1c2UgdGhlIGNvZmZl ZSBzaG9wIG5ldHdvcmsgaWYgaXQgZG9lc24ndCBtZWV0IHRoZWlyIG5lZWRzLiBVc2luZyBwcml2 YXRlIGNvZmZlZSBzaG9wIG5ldHdvcmtzIGlzIG5vdCBhIGJhc2ljIGh1bWFuIHJpZ2h0LCBJTU8u IENvZmZlZSBzaG9wcyBkb24ndCBoYXZlIGFuIG9ibGlnYXRpb24gdG8gcHJvdmlkZSBmcmVlIElu dGVybmV0IGFjY2VzcyAob3IgZnJlZSBJbnRlcm5ldCBhY2Nlc3MgdGhhdCBhY3R1YWxseSB3b3Jr cykuIA0K From nobody Thu Aug 15 07:48:50 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1EBC81200DE for ; Thu, 15 Aug 2019 07:48:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5_-omsBvr5ZG for ; Thu, 15 Aug 2019 07:48:46 -0700 (PDT) Received: from mail-qt1-x832.google.com (mail-qt1-x832.google.com [IPv6:2607:f8b0:4864:20::832]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9B93B1200D7 for ; Thu, 15 Aug 2019 07:48:46 -0700 (PDT) Received: by mail-qt1-x832.google.com with SMTP id e8so2576728qtp.7 for ; Thu, 15 Aug 2019 07:48:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=content-transfer-encoding:from:mime-version:subject:date:message-id :references:cc:in-reply-to:to; bh=vtNlrDr2Mh8JlGLG0Qzq6sjooB1bx0uTUJop1KRIrcY=; b=hQ6+E+jAHo9Rs50QWPPgam0rYuhPJ2ntyD+rbnqiwkk5fklSBz8daZz/ZK1TVMhtJq GQjBJVaLsu5vsOVbSDv0uhYujq+A/PWt95tOmLiJsqJCPNRX9CB4bnZ2aXkBXToVI6zU +fq5oTVMMG5XqN6/l3evNLOIH/o0mnBg3W2tgOoSArBBAqYu/xg2QSHN6/UcHX1L8Hgx FjgtbAMK75p2TTrdSX2knVfd3jCvEYlBb6QsRNkj/0Lh8Q6hziU/spIhH5idkt3vsKZU W2Ra5k/xqWdNCZA0kvellF4k46kFtZiQBDHmpbfWuqrk4m/nhqQxMtHkWmiemMQwkE9s vt1A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:content-transfer-encoding:from:mime-version :subject:date:message-id:references:cc:in-reply-to:to; bh=vtNlrDr2Mh8JlGLG0Qzq6sjooB1bx0uTUJop1KRIrcY=; b=DQSHzuWPNoDHKRnMCIoXObOmD8AJxZbRNgrbLbIcBsJ56xIxd9fGYvH6kigg8F8nUE BTffrrvvc6RQCETw5/am02IqSGUzifuI9Z1I/nEMVds63pZqc/mvy2Lv+G3JfBUkC0WA LHRPZXx2IlP91HMlqfR2iI1O7mlU8V5xlFIZDLknB8nlYsNW9UttCcGkDJiB3jGSq8lJ iB/BbsArRjtYHXMLA3bHzKD43FPQpWMIjGOQlsNhfC6+3nOI0Sqm2/x+sZdGY6ah+mUh rjTaqyIh7h4s++mTQMx82lYrJ2eqzP9JxwlLDNZ9g5pe/MirrIFRyZbjHgvYG2GgkKWR X07w== X-Gm-Message-State: APjAAAUVAEvZT22x0VCBMYtCc5HqYEJZ3qpv/WHTkrYv3sSDMA85gZT5 J2dqQo8zoPkJeCvJgFE/C158dg== X-Google-Smtp-Source: APXvYqykndshc9Ach8aUaJNEv2d2TnDpCm7RR9sDCMpgDibo6qsDi4PUL8FMOvC7UM0xI7uNguZgYQ== X-Received: by 2002:ac8:6688:: with SMTP id d8mr4147921qtp.141.1565880525663; Thu, 15 Aug 2019 07:48:45 -0700 (PDT) Received: from [10.0.100.56] (c-73-186-137-119.hsd1.nh.comcast.net. [73.186.137.119]) by smtp.gmail.com with ESMTPSA id t29sm1600266qtt.42.2019.08.15.07.48.45 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Thu, 15 Aug 2019 07:48:45 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable From: Ted Lemon Mime-Version: 1.0 (1.0) Date: Thu, 15 Aug 2019 10:48:44 -0400 Message-Id: References: Cc: Daniel Stenberg , Brian Dickson , Paul Hoffman , ADD Mailing list In-Reply-To: To: Andrew Campling X-Mailer: iPhone Mail (17A815) Archived-At: Subject: Re: [Add] Use Cases - the coffee shop X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 14:48:49 -0000 I go to the coffee shop for coffee. If they have crappy IT, complaining to t= he barista isn=E2=80=99t going to help, and it=E2=80=99s almost certainly no= t intentional. I=E2=80=99m not going to go to a less good coffee shop to sa= tisfy some weird moral code of yours.=20 In any case, this is a straw man. I=E2=80=99ve never seen a ToS that forbade= me to use DoH, or to do my own thing generally as long as it isn=E2=80=99t c= riminal or abusing of the network. I have seen lots of broken DNS proxies. S= o that is the use case that I take seriously, not your hypothetical coffee s= hop panopticon.=20 Sent from my iPhone > On Aug 15, 2019, at 10:38, Andrew Campling wrote: >=20 > =EF=BB=BF >>=20 >> On Aug 15, 2019, at 15:30, Ted Lemon wrote: >>=20 >> What if the coffee shop is just using a crappy dns proxy that mangles dns= sec messages? >=20 > I believe the point still stands. You have the option of taking your busi= ness elsewhere or, if the coffee really is that good, accepting the network c= ompromises in order to consume it. Changing the way the whole internet ecos= ystem works in order for you to circumvent the network rules of our hypothet= ical coffee shop so that it works to your liking feels like a wholly disprop= ortionate response with likely unintended and unknown consequences. =20 >=20 > There may be compelling use cases, in my view this is not one of them. >=20 >=20 > Andrew=20 From nobody Thu Aug 15 07:52:34 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5F562120118 for ; Thu, 15 Aug 2019 07:52:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AedOOoqEVpBr for ; Thu, 15 Aug 2019 07:52:30 -0700 (PDT) Received: from smtp.guxx.net (smtp.guxx.net [IPv6:2a01:4f8:a0:322c::25:42]) by ietfa.amsl.com (Postfix) with ESMTP id 8FC28120105 for ; Thu, 15 Aug 2019 07:52:30 -0700 (PDT) Received: by nyx.guxx.net (Postfix, from userid 107) id 2A9595F42D3C; Thu, 15 Aug 2019 16:52:28 +0200 (CEST) Received: from [172.19.152.108] (p54B8ABDF.dip0.t-ipconnect.de [84.184.171.223]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by nyx.guxx.net (Postfix) with ESMTPSA id 140C45F42C87; Thu, 15 Aug 2019 16:52:28 +0200 (CEST) From: "Ralf Weber" To: "Ted Lemon" Cc: "Eric Rescorla" , "Neil Cook" , "Patrik =?utf-8?b?RsOkbHRzdHLDtm0=?=" , "ADD Mailing list" , "Bret Jordan" , "STARK, BARBARA H" , "Martin Thomson" , "Stephen Farrell" Date: Thu, 15 Aug 2019 16:52:27 +0200 X-Mailer: MailMate (1.12.5r5635) Message-ID: <0B87FCD7-79C5-4EFF-B2CD-46325FE745F1@fl1ger.de> In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 14:52:33 -0000 Moin! On 15 Aug 2019, at 15:57, Ted Lemon wrote: > Silly question. We’re talking about how it would be nice to document > the issues that will come up as a result of DoH being in the wild, and > perhaps the solutions people propose, whether they are recommended by > the IETF or not. > > Is anyone in fact writing that document? I seem to recall we had two drafts presented in the first add session ( draft-livingood-doh-implementation-risks-issues and draft-reid-operator-doh) which already captured a lot of the concern. I would hope that we continue to work on them within the framework that is yet to be setup by the IETF leadership. So long -Ralf —-- Ralf Weber From nobody Thu Aug 15 07:54:21 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 46649120090 for ; Thu, 15 Aug 2019 07:54:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id B0pxqMEGuaAI for ; Thu, 15 Aug 2019 07:54:18 -0700 (PDT) Received: from giant.haxx.se (www.haxx.se [IPv6:2a00:1a28:1200:9::2]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D0A2A120071 for ; Thu, 15 Aug 2019 07:54:17 -0700 (PDT) Received: from giant.haxx.se (mail [127.0.0.1]) by giant.haxx.se (8.15.2/8.15.2/Debian-4) with ESMTPS id x7FErS5G015247 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 15 Aug 2019 16:53:28 +0200 Received: from localhost (dast@localhost) by giant.haxx.se (8.15.2/8.15.2/Submit) with ESMTP id x7FErSoo015243; Thu, 15 Aug 2019 16:53:28 +0200 X-Authentication-Warning: giant.haxx.se: dast owned process doing -bs Date: Thu, 15 Aug 2019 16:53:28 +0200 (CEST) From: Daniel Stenberg X-X-Sender: dast@giant.haxx.se To: "STARK, BARBARA H" cc: "'Ted Lemon'" , "'Andrew Campling'" , "'Paul Hoffman'" , "'ADD Mailing list'" , "'Brian Dickson'" In-Reply-To: <2D09D61DDFA73D4C884805CC7865E6114E2757F0@GAALPA1MSGUSRBF.ITServices.sbc.com> Message-ID: References: <2D09D61DDFA73D4C884805CC7865E6114E2757F0@GAALPA1MSGUSRBF.ITServices.sbc.com> User-Agent: Alpine 2.20 (DEB 67 2015-01-07) X-fromdanielhimself: yes MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII; format=flowed Archived-At: Subject: Re: [Add] Use Cases - the coffee shop X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 14:54:20 -0000 On Thu, 15 Aug 2019, STARK, BARBARA H wrote: > I'm pretty sure people in coffee shops have the ability to not use the > coffee shop network if it doesn't meet their needs. Using private coffee > shop networks is not a basic human right, IMO. Coffee shops don't have an > obligation to provide free Internet access (or free Internet access that > actually works). I hate that I seem to have to explain this. "Coffee shop" is a handy shortcut to refer to a network where you might think twice before you send traffic in the clear, where you perhaps don't trust unauthorized clear text protocols or that just offer a crappy DNS. There are many such networks where the coffee shop is just one example. -- / daniel.haxx.se From nobody Thu Aug 15 07:55:44 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 688DC120071 for ; Thu, 15 Aug 2019 07:55:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=netorgft5189650.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2ykdd_ksKF96 for ; Thu, 15 Aug 2019 07:55:40 -0700 (PDT) Received: from GBR01-CWL-obe.outbound.protection.outlook.com (mail-eopbgr110084.outbound.protection.outlook.com [40.107.11.84]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A6EB1120052 for ; Thu, 15 Aug 2019 07:55:39 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=ViGHBAa64CLMC/LLRoBRp2x4O5axcU1TQgLZIiaaUb+/nklrIj0Psj8oWiUvzgzDCWyYvu9pA3wYU3IHjBPoTsbGy3FtgcDLJ0L8QCOtf/NO7wEe6J/f9CUbM2GcikaQNy2OhQUFbsPZlXk88ouU/0X1pUeRengHaqlAFgpFm+mixhCFOarn/fE0A36zflSpAxJrlZMqwSGfu9NROdNzWaSpCiaKa6CRjqLpFtWba6vP5h4+tImGArtcteaEyyJLAB+Oy3MHOzhmLezqTRSmu8Xj1AirxgXz3U2y/3j9lz3wDmn6Z13AJ3mBHDXKHT/Emlg+q9CWFIfFMudp9pnqKg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=4m9cvJQ+3ZwhR0mQJ4xgLKKHHIVuCB5kskcZxdK673Y=; b=jdkkKrV2MW23VWQf7ofLMouR5H7fCqxTH1WULLXgxlDBDVtcziqfmiij7uDTNQIF11Nry7cqvmOLr6W6q+z/336BYnJbf2IAA2LzgveKpmy5+l+6d1y2zBoq7LByMfTT2B4MezpI8dhOlxafo3zWovkrQ/Unnugl2X1Diqx7JiJQ98XJQq/SsReNgSh03OPwI/7dx8sJPUYC8BndSKq2tV/Ks6yeHb4+mQAXepI3xbPjje1LXGs8d2+F5KSDTEuSJGlwMmuylUH9d42m63mVrJS++p/QCjgzSjN8xD8yd/onJEQPZG0AyQHj4h704RY5eTllg+pvaMZLzxxd4ZTV6A== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=419.consulting; dmarc=pass action=none header.from=419.consulting; dkim=pass header.d=419.consulting; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=NETORGFT5189650.onmicrosoft.com; s=selector1-NETORGFT5189650-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=4m9cvJQ+3ZwhR0mQJ4xgLKKHHIVuCB5kskcZxdK673Y=; b=YWe7EOE/4z6a5eSzwThxkCARWnJKq/+k9L+4EX83pRmij/WTTEGGixixU+ab06b9bGjwemxYYoYgNh20sc0xHHyjwki/gW+Ic/ZYx5YyCRvLAGdPOKYS5lDdVWR6eKuc9tJOusoir+fUX+9ATDyqlRn7K9A7J70FIfOPUtGznOk= Received: from LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM (20.176.138.146) by LO2P265MB0094.GBRP265.PROD.OUTLOOK.COM (10.166.105.142) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2157.23; Thu, 15 Aug 2019 14:55:36 +0000 Received: from LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM ([fe80::64e9:9b9e:59fc:26f]) by LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM ([fe80::64e9:9b9e:59fc:26f%5]) with mapi id 15.20.2157.022; Thu, 15 Aug 2019 14:55:36 +0000 From: Andrew Campling To: ADD Mailing list Thread-Topic: When Two Worlds Collide Thread-Index: AdVTdyCapVPyep9JQGykvKh9TBzsEA== Date: Thu, 15 Aug 2019 14:55:36 +0000 Message-ID: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=andrew.campling@419.consulting; x-originating-ip: [2a00:23c4:a499:2e00:f42b:87f3:b90b:d830] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 448a121d-a489-478a-b2e0-08d72190a1c5 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(7021145)(8989299)(4534185)(7022145)(4603075)(4627221)(201702281549075)(8990200)(7048125)(7024125)(7027125)(7023125)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:LO2P265MB0094; x-ms-traffictypediagnostic: LO2P265MB0094: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-forefront-prvs: 01304918F3 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(366004)(346002)(39830400003)(376002)(136003)(396003)(189003)(199004)(33656002)(7696005)(966005)(3480700005)(102836004)(76116006)(46003)(508600001)(99286004)(6506007)(8936002)(53936002)(186003)(316002)(6916009)(486006)(476003)(44832011)(2906002)(14454004)(86362001)(81156014)(66476007)(52536014)(8676002)(66574012)(66556008)(6436002)(81166006)(30864003)(6306002)(66446008)(5660300002)(74316002)(64756008)(6116002)(9686003)(55016002)(256004)(25786009)(71200400001)(305945005)(7736002)(71190400001)(66946007)(46492003); DIR:OUT; SFP:1101; SCL:1; SRVR:LO2P265MB0094; H:LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: 419.consulting does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: lqfIcjDpH6C2UPQQVZPjrchE6qGd1Xzo4NbPQTFJoxn7ZBvBWuCYysAT7dy7/NvYEnTqd/ZPVS9/mY0dLhpPZ+4wvd/MKdQUnHJSTWW+EMcGF3YWmmh2FllqM14LkH8bugQmTxxPWpxTQXU/BuqHcrbkhWQM5o/vbxsg6e9KsvwnPRuLHPzUNic/MS8wQq0OkZVVT9Fbr9xlnbLmcq8J/GONVma98AmAfOsPjbOHhchlhRjEg0I7vnrn/VPa6X/nm/7OLvQiTug8CyGcpCUYxfue5xa5+flTJKRRjYW2PnqboRT4epDWCgEn3JJN6UytUVTobHtC6tz7RwhzS1wFO9RuDGfo/1rdRuaZMFtsrW90ZH4HWTAEjiuefcLvzjFqDcyUmDwzZS8AuizSlv3exPHcK64TA3fJR2Ob+kvCUn0= x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_LO2P265MB1327CC055667B8F972AEDC04C2AC0LO2P265MB1327GBRP_" MIME-Version: 1.0 X-OriginatorOrg: 419.consulting X-MS-Exchange-CrossTenant-Network-Message-Id: 448a121d-a489-478a-b2e0-08d72190a1c5 X-MS-Exchange-CrossTenant-originalarrivaltime: 15 Aug 2019 14:55:36.8890 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 9c2ced3e-7522-4755-87dc-f983abc66ec3 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: 53KR1F0uA7yXx8FZRAgpZ4hmQjwxAn/bAxzZtjicdMG88GuS9OcY3s4aZ4CqwQ7fTOZ5Af/rmVr0XRkTn/R/c3dQlzqORRnM6vErHKBHBKw= X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO2P265MB0094 Archived-At: Subject: [Add] When Two Worlds Collide X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 14:55:43 -0000 --_000_LO2P265MB1327CC055667B8F972AEDC04C2AC0LO2P265MB1327GBRP_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Some of the more recent discussions (eg on the validity of the network admi= nistrator role) have made it clear to me that there are fundamental differe= nces in world view between: (i) the one hand, network operators / ISPs and= others in that ecosystem; and (ii) browser companies / other applications = developers. These differences make it hard if not impossible to reach a mu= tual understanding of the potential problems and solutions. Trying to brid= ge such differences via email is difficult if not impossible, as are time c= onstraints at IETF events. (NB To be clear, I'm not suggesting that the above is either an original or= revolutionary observation!) With that in mind, would others from each of these two communities see valu= e in taking time for a more structured discussion in a workshop format, eit= her face-to-face or virtually, to set out the challenges and benefits posed= by DoH (and possibly also DoT etc if useful)? My hypothesis is that a bet= ter understanding of the perspective of both communities would simplify dis= cussions here, and at the very least help to focus minds on what the real i= ssues are from the other's perspective. This may in terms speed our path t= owards solutions. Do you agree with the above analysis and, if so, would you see value in tak= ing part in such a workshop? By all means email me directly on this if you= prefer not to clog up the mail reflector. Andrew --_000_LO2P265MB1327CC055667B8F972AEDC04C2AC0LO2P265MB1327GBRP_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable
Some of the more recent discussions (eg on the validity of the network= administrator role) have made it clear to me that there are fundamental di= fferences in world view between:  (i) the one hand, network operators = / ISPs and others in that ecosystem; and (ii) browser companies / other applications developers.  These dif= ferences make it hard if not impossible to reach a mutual understanding of = the potential problems and solutions.  Trying to bridge such differenc= es via email is difficult if not impossible, as are time constraints at IETF events.
 <= /div>
(NB To be clear, I’m not suggesting that the above is either an = original or revolutionary observation!)
 <= /div>
With that in mind, would others from each of these two communities see= value in taking time for a more structured discussion in a workshop format= , either face-to-face or virtually, to set out the challenges and benefits = posed by DoH (and possibly also DoT etc if useful)?  My hypothesis is that a better understanding of t= he perspective of both communities would simplify discussions here, and at = the very least help to focus minds on what the real issues are from the oth= er’s perspective.  This may in terms speed our path towards solutions. 
 <= /div>
Do you agree with the above analysis and, if so, would you see value i= n taking part in such a workshop?  By all means email me directly on t= his if you prefer not to clog up the mail reflector. 
 <= /div>
 <= /div>
Andrew
&nb= sp;
 <= /div>
 <= /div>
 <= /div>
 <= /div> --_000_LO2P265MB1327CC055667B8F972AEDC04C2AC0LO2P265MB1327GBRP_-- From nobody Thu Aug 15 07:57:51 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3CBFC120090 for ; Thu, 15 Aug 2019 07:57:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8vQWQWv0y321 for ; Thu, 15 Aug 2019 07:57:47 -0700 (PDT) Received: from mx0a-00191d01.pphosted.com (mx0b-00191d01.pphosted.com [67.231.157.136]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DFD40120052 for ; Thu, 15 Aug 2019 07:57:46 -0700 (PDT) Received: from pps.filterd (m0083689.ppops.net [127.0.0.1]) by m0083689.ppops.net-00191d01. (8.16.0.27/8.16.0.27) with SMTP id x7FEu4lI028417; Thu, 15 Aug 2019 10:57:34 -0400 Received: from alpi154.enaf.aldc.att.com (sbcsmtp6.sbc.com [144.160.229.23]) by m0083689.ppops.net-00191d01. with ESMTP id 2ud9dn8bha-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 15 Aug 2019 10:57:32 -0400 Received: from enaf.aldc.att.com (localhost [127.0.0.1]) by alpi154.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id x7FEvR7H015561; Thu, 15 Aug 2019 10:57:28 -0400 Received: from zlp30485.vci.att.com (zlp30485.vci.att.com [135.47.91.178]) by alpi154.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id x7FEvGVS015356 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Thu, 15 Aug 2019 10:57:17 -0400 Received: from zlp30485.vci.att.com (zlp30485.vci.att.com [127.0.0.1]) by zlp30485.vci.att.com (Service) with ESMTP id 8C5E64009E74; Thu, 15 Aug 2019 14:57:16 +0000 (GMT) Received: from GAALPA1MSGHUBAF.ITServices.sbc.com (unknown [130.8.218.155]) by zlp30485.vci.att.com (Service) with ESMTPS id 798A94009E63; Thu, 15 Aug 2019 14:57:16 +0000 (GMT) Received: from GAALPA1MSGUSRBF.ITServices.sbc.com ([169.254.5.177]) by GAALPA1MSGHUBAF.ITServices.sbc.com ([130.8.218.155]) with mapi id 14.03.0439.000; Thu, 15 Aug 2019 10:57:16 -0400 From: "STARK, BARBARA H" To: "'Ralf Weber'" , "'Eric Rescorla'" CC: "'ADD Mailing list'" Thread-Topic: [Add] [Ext] Validity of network administrator role Thread-Index: AQHVUzoPOJgNGM3ylEyeeSjK6egTrqb8GRWAgAAjhQCAAAabgIAABGkA///YEqCAAFU3gIAACDyAgAAO3gD//70gYA== Date: Thu, 15 Aug 2019 14:57:16 +0000 Message-ID: <2D09D61DDFA73D4C884805CC7865E6114E275923@GAALPA1MSGUSRBF.ITServices.sbc.com> References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <1610C8E4-1624-4A7E-A24B-C7D0CB06A1DE@gmail.com> <6bbc4857-449e-e587-1e16-c0ee7d1f2aa8@cs.tcd.ie> <31226710-8C33-4696-90F3-4E05ED82FB05@open-xchange.com> <2D09D61DDFA73D4C884805CC7865E6114E272262@GAALPA1MSGUSRBF.ITServices.sbc.com> <8F75AD20-706B-48F7-B6DD-4C15DAFFA429@fl1ger.de> <04E62C83-56A7-4668-BF95-FFD06C8C9E9F@fl1ger.de> In-Reply-To: <04E62C83-56A7-4668-BF95-FFD06C8C9E9F@fl1ger.de> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [135.70.196.183] Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-08-15_05:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_policy_notspam policy=outbound_policy score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1906280000 definitions=main-1908150149 Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 14:57:49 -0000 DQo+ID4gQm90dG9tIGxpbmluZyB0aGlzLCBpdCBzZWVtcyBsaWtlIHRoZSByZXN1bHRzIGFyZSBi cm9hZGx5IGNvbnNpc3RlbnQNCj4gPiB3aXRoDQo+ID4gb3Vyczogd2hlbiBEb0gvVFJSIHRocm91 Z2ggQ2xvdWRmbGFyZSBpcyB1c2VkLCBkaWZmZXJlbnQgQ0ROIG5vZGVzIGFyZQ0KPiA+IHVzZWQs IGJ1dCB0aGVyZSdzIG5vIHNpZ25pZmljYW50IHBlcmZvcm1hbmNlIGRpZmZlcmVuY2UuDQoNCj4g VGhlcmUgaXMgbm8gcGVyZm9ybWFuY2UgZGlmZmVyZW5jZSwgYmVjYXVzZSBubyBvbmUgaXMgdXNp bmcgaXQuIFRoZSBmYWN0IHRoYXQNCj4gZGlmZmVyZW50IG5vZGVzIGFyZSB1c2VkIGhhcyBhIGJp ZyBpbXBhY3QgYm90aCBwZXJmb3JtYW5jZSBhbmQgY29tbWVyY2lhbA0KPiBpZiB0aGVyZSB3YXMg YSBsYXJnZSBwb3B1bGF0aW9uIHRoYXQgaGFkIHRvIGdldCBzb21ldGhpbmcgZnJvbSBhIGxvY2F0 aW9uIHRoYXQNCj4gd2FzIG5vdCBkZXNpZ25lZCB0byBoYW5kbGUgaXRzIGxvYWQgb3ZlciBsaW5r cyB0aGF0IHdlcmUgbm90IHNpemVkIHRvIGhhbmRsZQ0KPiB0aGlzIGxvYWQuDQoNCj4gQW5kIElT UCBhbmQgY29udGVudC9DRE4gcHJvdmlkZXJzIHdvdWxkIGhhdmUgdG8gYmVhciB0aGUgY29zdCBv ZiB0aGF0DQo+IHRyYWZmaWMgdGhhdCBvdGhlcndpc2Ugd291bGQgZmxvdyBhdCBtdWNoIGxvd2Vy IGNvc3QgaW5zaWRlIHRoZSBwcm92aWRlcg0KPiBuZXR3b3JrLCBvZnRlbiBub3QgbGVhdmluZyB0 aGUgUE9QIHdoZXJlIHRoZSB1c2VyIGNvbm5lY3RzLg0KDQpJIHRoaW5rIE5ldGZsaXggcHJvdmVk IHF1aXRlIHdlbGwgd2hhdCBoYXBwZW5zIHdoZW4gYSBtYXNzaXZlIGFtb3VudCBvZiB0cmFmZmlj IGlzIHNoaWZ0ZWQgdG8gdGFrZSBhIGRpZmZlcmVudCBwYXRoIHRoYXQgZG9lc24ndCBoYXZlIHRo ZSBjYXBhY2l0eSB0byBoYW5kbGUgdGhhdCB0cmFmZmljLiBPZiBjb3Vyc2UsIE5ldGZsaXggKGFu ZCBwcmV0dHkgbXVjaCBldmVyeW9uZSBlbHNlKSBibGFtZWQgdGhlIElTUHMgZm9yIGFsbCB0aGUg ZHJvcHBlZCBwYWNrZXRzLg0KDQpUaGUgcXVlc3Rpb24gdGhhdCBjcm9zc2VkIG15IG1pbmQgaW4g cmVhZGluZyB0aGUgU2FtS25vd3MgcmVzdWx0cywgd2FzIGlmIHJlcXVlc3RpbmcgQ0ROIGNvbnRl bnQgZnJvbSB0aGUgR29vZ2xlIG9yIENsb3VkZmxhcmUgQ0ROIHdvdWxkIGhhdmUgaGFkIGRpZmZl cmVudCByZXN1bHRzLiANCkJhcmJhcmENCg== From nobody Thu Aug 15 08:00:14 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B999D1200D5 for ; Thu, 15 Aug 2019 08:00:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VTDoE0PNNDuS for ; Thu, 15 Aug 2019 08:00:10 -0700 (PDT) Received: from mail-qk1-x72e.google.com (mail-qk1-x72e.google.com [IPv6:2607:f8b0:4864:20::72e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6AE0B1200E5 for ; Thu, 15 Aug 2019 08:00:10 -0700 (PDT) Received: by mail-qk1-x72e.google.com with SMTP id m2so2023814qkd.10 for ; Thu, 15 Aug 2019 08:00:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=JbAgLgYfwvVPfzRRgaKOTr296e69UcCv0J+qDTpAPmg=; b=iXzy9NKTdG8Kbh1b4spehqAJfhAMz60fsYClTWDcSWfj7mMFeoZj/NHdDBARVQWLP0 yMjNBxJOWr+nWWvKbRYd10VHvSUy04ModFFOi/pyW8g8oW3cxxe+LiVFDH09lSapG1Dx JVCJVcAmHXz/DAM2wrJNosCi0oyxsVYZhOzryKGCdBcG5A8IP3EmyZUXUAT++BhF9NPg XxG4wpCMfloQ6dA6WNINnhWN4X57HzmlrcppXaMaSpDUD0+z1+/9ohsGgSeyTakLZi0R 75abCvoIWp27ce+flYlVCgNGbB3WgrkOQRwcZQDmmhcwQNV/4NrfmtbBL+DZ4HYu8yz6 D76A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=JbAgLgYfwvVPfzRRgaKOTr296e69UcCv0J+qDTpAPmg=; b=NUvsCyizgxL+zEiyy2PBqdH+4DJwqvDOwbiNAJeJW9PMxbDXkvJ4T2/P645WWRgGOB Us9k26Zmye0PXNPdr75elmCKWsMy02voqkAsz1vWfE6rOFrSqbM7H6Zre23Aa/1Nau65 9mamS85UnFFuCzuypbH5+OFjWNFazt2aFCPmyLP+ueNz83Lf5sGsmUYDFSF1k1R6V5zR B6iz8wlzaSgwYAUj1miI1KOqD+IaKWsL+nH+nbNTL9hal3ARwScVKcvEJ+tCJtCnxn6b d0W/FCbRc4EOsPQCMGWfTsWYfyIrQe4O3Y7IEQtW3J7oNkjAJN53VPYMN+DO39kKXUEg otOA== X-Gm-Message-State: APjAAAUU4jgKxus7FTPd/KdAnJ9Q247OcZ/mBaVNsA8RRHcuzCQK9t5z K2nhwQXS0Lw9U764R+bamP+JfA== X-Google-Smtp-Source: APXvYqzFqYRaAfqaPSOyh4jYOwxjvc8RiIuBODut7OeS1pWYW7sAVE/eZTMXO2HvFZyaIm9FZhASUw== X-Received: by 2002:a37:4747:: with SMTP id u68mr4481162qka.42.1565881207046; Thu, 15 Aug 2019 08:00:07 -0700 (PDT) Received: from ?IPv6:2001:470:c1a2:1:9128:e34:f62c:61a4? ([2001:470:c1a2:1:9128:e34:f62c:61a4]) by smtp.gmail.com with ESMTPSA id f9sm1580653qkm.51.2019.08.15.08.00.05 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 15 Aug 2019 08:00:06 -0700 (PDT) From: Ted Lemon Message-Id: Content-Type: multipart/alternative; boundary="Apple-Mail=_EBFB954F-3BAC-4387-8D55-44E2FDBB4DA0" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Thu, 15 Aug 2019 08:00:04 -0700 In-Reply-To: <0B87FCD7-79C5-4EFF-B2CD-46325FE745F1@fl1ger.de> Cc: Eric Rescorla , Neil Cook , =?utf-8?B?UGF0cmlrIEbDpGx0c3Ryw7Zt?= , ADD Mailing list , Bret Jordan , "STARK, BARBARA H" , Martin Thomson , Stephen Farrell To: Ralf Weber References: <0B87FCD7-79C5-4EFF-B2CD-46325FE745F1@fl1ger.de> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 15:00:13 -0000 --Apple-Mail=_EBFB954F-3BAC-4387-8D55-44E2FDBB4DA0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 On Aug 15, 2019, at 7:52 AM, Ralf Weber wrote: > I seem to recall we had two drafts presented in the first add session = ( draft-livingood-doh-implementation-risks-issues and = draft-reid-operator-doh) which already captured a lot of the concern. I = would hope that we continue to work on them within the framework that is = yet to be setup by the IETF leadership. I think these documents were views from the authors=E2=80=99 = perspectives on the topic. What I=E2=80=99m talking about is more a = collection of the discussion of the whole group, rather than a single = coherent view, no matter how interesting that might be. I mention this because we keep going back over territory we=E2=80=99d = already covered. --Apple-Mail=_EBFB954F-3BAC-4387-8D55-44E2FDBB4DA0 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 On = Aug 15, 2019, at 7:52 AM, Ralf Weber <dns@fl1ger.de> wrote:
I seem to recall we had two drafts presented in the first add = session ( draft-livingood-doh-implementation-risks-issues and = draft-reid-operator-doh) which already captured a lot of the concern. I = would hope that we continue to work on them within the framework that is = yet to be setup by the IETF leadership.

I think these documents were views from the = authors=E2=80=99 perspectives on the topic.  What I=E2=80=99m = talking about is more a collection of the discussion of the whole group, = rather than a single coherent view, no matter how interesting that might = be.

I mention = this because we keep going back over territory we=E2=80=99d already = covered.

= --Apple-Mail=_EBFB954F-3BAC-4387-8D55-44E2FDBB4DA0-- From nobody Thu Aug 15 08:02:09 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6A271120090 for ; Thu, 15 Aug 2019 08:02:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=swm.pp.se Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 42LHXsft6mi6 for ; Thu, 15 Aug 2019 08:02:04 -0700 (PDT) Received: from uplift.swm.pp.se (ipv6.swm.pp.se [IPv6:2a00:801::f]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B618D12008B for ; Thu, 15 Aug 2019 08:02:04 -0700 (PDT) Received: by uplift.swm.pp.se (Postfix, from userid 501) id BB20CB5; Thu, 15 Aug 2019 17:02:02 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=swm.pp.se; s=mail; t=1565881322; bh=nTLsWv5jAwivy86DmgyKp1/KID6xBw0eLKMufcQe5IU=; h=Date:From:To:cc:Subject:In-Reply-To:References:From; b=eETOSFx9r/Xo4EuQtpFBIHRAIJdNp2ZNFvF3TULq3m4tldrdco5Vt8RX20/AhHOR6 XFbhBIzjeUIiMCH4U0de8OMm6z9pXwokGydQjfvmmjJ+UlHLqHbbzzTdhubPqXRqxr 5v2Zmxt17WJAwELfRTXXAHvObjv/DCGF2xcJIoBQ= Received: from localhost (localhost [127.0.0.1]) by uplift.swm.pp.se (Postfix) with ESMTP id B90B9B1; Thu, 15 Aug 2019 17:02:02 +0200 (CEST) Date: Thu, 15 Aug 2019 17:02:02 +0200 (CEST) From: Mikael Abrahamsson To: Daniel Stenberg cc: "STARK, BARBARA H" , 'Andrew Campling' , 'ADD Mailing list' , 'Ted Lemon' , 'Paul Hoffman' , 'Brian Dickson' In-Reply-To: Message-ID: References: <2D09D61DDFA73D4C884805CC7865E6114E2757F0@GAALPA1MSGUSRBF.ITServices.sbc.com> User-Agent: Alpine 2.20 (DEB 67 2015-01-07) Organization: People's Front Against WWW MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII; format=flowed Archived-At: Subject: Re: [Add] Use Cases - the coffee shop X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 15:02:08 -0000 On Thu, 15 Aug 2019, Daniel Stenberg wrote: > "Coffee shop" is a handy shortcut to refer to a network where you might > think twice before you send traffic in the clear, where you perhaps > don't trust unauthorized clear text protocols or that just offer a > crappy DNS. There are many such networks where the coffee shop is just > one example. Yes, that's fine. So how are you going to detect that the network is one of these and run DoH as main resolver path, but not change the default of all other networks I attach to where I actually trust the resolver an desire to use it? 1. I am at home. I trust my home ISP more than I trust CF/GOOG, so I want to use my ISP resolver. 2. I go to a coffee shop and I trust CF/GOOG more than I trust the Coffee shop, so I want to use them there. How are you going to solve this? Until I see a concrete proposal, my statement is that there is absolutely no technical way to do this without asking me, and changing the default to GOOG/CF for * to fix 2 is ... just horrible. Most ISPs I've seen hover around 5% of the customers that make an active choice not to use their ISP provided resolver. So the proposal to change the defaults for everything means 95% will have their default changed. Some users on this list seems to think this is acceptable fallout to fix 2. I do not agree. -- Mikael Abrahamsson email: swmike@swm.pp.se From nobody Thu Aug 15 08:04:23 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CE3F1120090 for ; Thu, 15 Aug 2019 08:04:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=netorgft5189650.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xpScta9MO8nP for ; Thu, 15 Aug 2019 08:04:19 -0700 (PDT) Received: from GBR01-CWL-obe.outbound.protection.outlook.com (mail-eopbgr110056.outbound.protection.outlook.com [40.107.11.56]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CB4FB12008B for ; Thu, 15 Aug 2019 08:04:18 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=PWkln/Ounq5+deUWlgqhXX8XBjcIFXqXIO8HXE6mjkLhtgFnYvKDmAVd3I0zJDSRsOdn70Edj+cOixZlb8VkV0/8tf5m79YhLTEKJlPAGXZlL1hHhQCkLEBvBWbC/6QFh/MzaycIqbujQ2BvbpXqgB6wcSHVaxa1FXmGrEN9BYDk05SODz5CTT11GEOKOjiXg1oiQAEy6ImC6qnBXB2bYOSNXMFEz3LFhmBFr6r9cf4wKGkSeEi16quzFIxVu/Yb0B6tOV29IOGUrBq1GEtRdeNiV+0m9rA/OlQ2lXxSgMBwA1DdED66lZdUY/sSSWZsJp8RiuzUNYBUAMHu5asvpQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=pDHnW4NEwMpMm6EumpuPqn3JoPUT4eeqABVOSHRb7D4=; b=mFpruXTv8T0uFNJt78TIuVKBrwMHz3CQnkVv6pDTT41gkqqYZM7umIDlq0NlQ9r2EpI5H2t4n6n086Pr3sPkvcHG3+sNiNrgVquncAjZmy2+sCzSilcwkBJEt9d8/TgK1if5f1bzvCu66voKZg5anlNafVA0OuGZLBwrRd27ufoPM1LhWNpW/6hIMZmJJb+kaKFUTyz2GxaJB51NIqVct0mrNuwIsMNhFxMj4wskk3Nk03Ivw09NAIQThcXmnW2RIGmwfz2VA/km0Q3fE5N4kH6fXY4fEk5U5nIPJqTBMh3QnSkMikmPZQ0TWQ2wWgQ45Ar4geKQME8Dj/HNPQNTjQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=419.consulting; dmarc=pass action=none header.from=419.consulting; dkim=pass header.d=419.consulting; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=NETORGFT5189650.onmicrosoft.com; s=selector1-NETORGFT5189650-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=pDHnW4NEwMpMm6EumpuPqn3JoPUT4eeqABVOSHRb7D4=; b=oc/Jor9FNLNC7nf8TZfw7XsWQPBYVNjNOgg3pCudY7a8XOfFE/gyyYaPKgilGhRj+Hw7arABJ/gegHyF+R6lhRpf9+QaQiAkifotuPOWkmshEUv0q1NdJn9+O1YIB873e6ltpKsAmB6Khc4gAB2kh6qHH2OifOSnZKzNg9fQvhI= Received: from LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM (20.176.138.146) by LO2P265MB0672.GBRP265.PROD.OUTLOOK.COM (10.166.105.151) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2157.21; Thu, 15 Aug 2019 15:04:16 +0000 Received: from LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM ([fe80::64e9:9b9e:59fc:26f]) by LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM ([fe80::64e9:9b9e:59fc:26f%5]) with mapi id 15.20.2157.022; Thu, 15 Aug 2019 15:04:16 +0000 From: Andrew Campling To: Daniel Stenberg , "STARK, BARBARA H" CC: 'Ted Lemon' , 'Paul Hoffman' , 'ADD Mailing list' , 'Brian Dickson' Thread-Topic: [Add] Use Cases - the coffee shop Thread-Index: AdVTdTO8sMFf9NSjRg6hhfqT7ScbewAAKbMAAABxZoAAAGSVAAAAG4zg Date: Thu, 15 Aug 2019 15:04:16 +0000 Message-ID: References: <2D09D61DDFA73D4C884805CC7865E6114E2757F0@GAALPA1MSGUSRBF.ITServices.sbc.com> In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=andrew.campling@419.consulting; x-originating-ip: [2a00:23c4:a499:2e00:f42b:87f3:b90b:d830] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 6b9ee4af-6bfc-4e25-d660-08d72191d785 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(7021145)(8989299)(5600148)(711020)(4605104)(1401327)(4534185)(7022145)(4603075)(4627221)(201702281549075)(8990200)(7048125)(7024125)(7027125)(7023125)(2017052603328)(7193020); SRVR:LO2P265MB0672; x-ms-traffictypediagnostic: LO2P265MB0672: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:1360; x-forefront-prvs: 01304918F3 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(346002)(376002)(39830400003)(396003)(136003)(366004)(51444003)(199004)(189003)(4326008)(186003)(76116006)(71190400001)(53936002)(316002)(71200400001)(14444005)(229853002)(46003)(44832011)(55016002)(8936002)(11346002)(256004)(25786009)(486006)(102836004)(508600001)(6506007)(6246003)(476003)(66574012)(6116002)(5660300002)(33656002)(8676002)(81156014)(7696005)(81166006)(14454004)(305945005)(76176011)(52536014)(2906002)(6436002)(110136005)(99286004)(86362001)(66446008)(64756008)(446003)(66556008)(66946007)(7736002)(54906003)(66476007)(74316002)(9686003)(46492003); DIR:OUT; SFP:1101; SCL:1; SRVR:LO2P265MB0672; H:LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: 419.consulting does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: r+6XEJRkV6hccOjn0ta9xPBDV0ELKHB7BgT2XEBbaMKbvuz1TMHOELhWK8Dc9lAr/iI2cYsYgjqLyOEzoZmk1THeBoxlPS2zXWmJ63hS6UbsXHDMxh728pbNOmAGx7+aMM7YeuCm1uJ9Vc/mAXim6tSVqC8aoN9cxIfknQvp8Wr5cGqRkXSDIX0J1UfO43/ZfLRVzxklnGsNpDUweCSUUgDqiLOE+E5nhwtybM6MuVNJyT7tu/yPbp4nOse6DglYkuqGsnxLxcjxcbqd9gLh5f7DcnPdRF+XJQtCEcP1BS8LzUPq8BxMN6P5DVj5W52vMvyBsEYZmZM0rvK/ysJyP52owLM20Kjy1gcJPBwoni0c0IdCdwz0NxWlnpZYXRouzaumOJjwDUmNls1ep7qUZTq6pj5tzzd5EfX07LTtzJc= x-ms-exchange-transport-forked: True Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: 419.consulting X-MS-Exchange-CrossTenant-Network-Message-Id: 6b9ee4af-6bfc-4e25-d660-08d72191d785 X-MS-Exchange-CrossTenant-originalarrivaltime: 15 Aug 2019 15:04:16.4862 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 9c2ced3e-7522-4755-87dc-f983abc66ec3 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: 6J1Mw3ZkSiAGsGoGTyc+Hdvy9Do2Rvrr0UKFlVh4AwoUZ/MG5VszZhS7P/z9hOlQeqExNQHUS4GR0N8mQlbYT16jYqc6JJWCuMtFpX6NcFg= X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO2P265MB0672 Archived-At: Subject: Re: [Add] Use Cases - the coffee shop X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 15:04:22 -0000 On Thu, 15 Aug 2019, Daniel Stenberg wrote: > I hate that I seem to have to explain this. >=20 > "Coffee shop" is a handy shortcut to refer to a network where you might t= hink twice before=20 > you send traffic in the clear, where you perhaps don't trust unauthorized= clear text protocols=20 > or that just offer a crappy DNS. There are many such networks where the c= offee shop is just=20 > one example. I think it was understood that "coffee shop" was a metaphor, indeed was "co= ffee" in my original email on this subject. If you, for example, replace c= offee shop with ISP, I think that the point still stands - in most (every?)= case, you have the ability to take your business elsewhere either until th= e "coffee shop" adapts its offering to your liking or you decide that its o= verall offering is such that you can live with the trade-offs. =20 As per my earlier comments, I'm not clear why changing the way the internet= ecosystem works with likely unintended and unknown consequences is the mos= t appropriate and proportionate response. =20 Andrew From nobody Thu Aug 15 08:05:41 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 02224120090 for ; Thu, 15 Aug 2019 08:05:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nohats.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id caDJqa3arh8Y for ; Thu, 15 Aug 2019 08:05:36 -0700 (PDT) Received: from mx.nohats.ca (mx.nohats.ca [193.110.157.68]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 52AAA12008B for ; Thu, 15 Aug 2019 08:05:36 -0700 (PDT) Received: from localhost (localhost [IPv6:::1]) by mx.nohats.ca (Postfix) with ESMTP id 468VBQ2QyFzCN7; Thu, 15 Aug 2019 17:05:34 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nohats.ca; s=default; t=1565881534; bh=OWOBYFuQkO73Cgi3k3ot9cUzqqZN29bJenzKPWlSfTk=; h=Date:From:To:cc:Subject:In-Reply-To:References; b=XwM32J3uqteum5egr1Kw39dUYpDgJ0EUoONuMmVdl85AOWiN91ZskJmzedRSbcW0e B9cRr/anEt+CEWD1zVr2qcWlgKLZC8FaUAwB99vYT5qzwWMkmatYZl81ld7HVaTjHt ShRZejx2Q7i+sg4VmZa9Xyp0UKbJG6fMt24QwKSQ= X-Virus-Scanned: amavisd-new at mx.nohats.ca Received: from mx.nohats.ca ([IPv6:::1]) by localhost (mx.nohats.ca [IPv6:::1]) (amavisd-new, port 10024) with ESMTP id 8tesvPNgvq-K; Thu, 15 Aug 2019 17:05:28 +0200 (CEST) Received: from bofh.nohats.ca (bofh.nohats.ca [76.10.157.69]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx.nohats.ca (Postfix) with ESMTPS; Thu, 15 Aug 2019 17:05:28 +0200 (CEST) Received: by bofh.nohats.ca (Postfix, from userid 1000) id C7C28373B; Thu, 15 Aug 2019 11:05:26 -0400 (EDT) DKIM-Filter: OpenDKIM Filter v2.11.0 bofh.nohats.ca C7C28373B Received: from localhost (localhost [127.0.0.1]) by bofh.nohats.ca (Postfix) with ESMTP id C230F406CB11; Thu, 15 Aug 2019 11:05:26 -0400 (EDT) Date: Thu, 15 Aug 2019 11:05:26 -0400 (EDT) From: Paul Wouters To: Andrew Campling cc: ADD Mailing list In-Reply-To: Message-ID: References: MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII; format=flowed Archived-At: Subject: Re: [Add] Use Cases - the coffee shop X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 15:05:39 -0000 On Thu, 15 Aug 2019, Andrew Campling wrote: >> What if the coffee shop is just using a crappy dns proxy that mangles dnssec messages? > > I believe the point still stands. You have the option of taking your business elsewhere or, if the coffee really is that good, accepting the network compromises in order to consume it. Changing the way the whole internet ecosystem works in order for you to circumvent the network rules of our hypothetical coffee shop so that it works to your liking feels like a wholly disproportionate response with likely unintended and unknown consequences. I strongly disgree with the "agreement" between user and coffeeshop. There is an expectation by the user that once authenticated to the hotspot, that the user can then more or less send/receive whatever they want. Sure there are some limitations based on sharing the bandwidth, and prevention of certain websites (eg porn) that would negatively affect other customers. But the user may totally corrupt their own device by downloading malicious content. And there is still an expectation of privacy (eg when reading email, when browsing sites) that a coffeeshop owner cannot just claim that they do not apply because you are a guest and you can choose not to connect. Furthermore, the main "issue" with DoH is that it bypasses protection offered by the network to the enduser. Well, in this case, the user clearly opts out of that "protection", and since coffeeshop users these days are always containerized, so their traffic cannot reach any other users of the coffeeshop/hotel, there is zero risk to the other users. So there are zero resaons not to give the coffeeshop / hotel enduser that freedom (or rather, give the user an "uncensored internet") If you say the coffeeshop / hotel as an ISP has the right to filter any of your traffic, I don't see why that would not apply to DSL or LTE based ISPs. That would be the end of net neutrality and the start of commercial (not government) censorship. I have already experienced that a large hotel chain would prevent access to booking.com or kayak.com and those practicises should be illegal and it is fine to work around that with DoH. Paul From nobody Thu Aug 15 08:08:50 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9B7561200C3 for ; Thu, 15 Aug 2019 08:08:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Kwg3I-FVxV7q for ; Thu, 15 Aug 2019 08:08:46 -0700 (PDT) Received: from giant.haxx.se (www.haxx.se [IPv6:2a00:1a28:1200:9::2]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7C33D1200B7 for ; Thu, 15 Aug 2019 08:08:46 -0700 (PDT) Received: from giant.haxx.se (mail [127.0.0.1]) by giant.haxx.se (8.15.2/8.15.2/Debian-4) with ESMTPS id x7FF89Lg028843 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 15 Aug 2019 17:08:09 +0200 Received: from localhost (dast@localhost) by giant.haxx.se (8.15.2/8.15.2/Submit) with ESMTP id x7FF89uP028838; Thu, 15 Aug 2019 17:08:09 +0200 X-Authentication-Warning: giant.haxx.se: dast owned process doing -bs Date: Thu, 15 Aug 2019 17:08:09 +0200 (CEST) From: Daniel Stenberg X-X-Sender: dast@giant.haxx.se To: Mikael Abrahamsson cc: "STARK, BARBARA H" , "'Andrew Campling'" , "'ADD Mailing list'" , "'Ted Lemon'" , "'Paul Hoffman'" , "'Brian Dickson'" In-Reply-To: Message-ID: References: <2D09D61DDFA73D4C884805CC7865E6114E2757F0@GAALPA1MSGUSRBF.ITServices.sbc.com> User-Agent: Alpine 2.20 (DEB 67 2015-01-07) X-fromdanielhimself: yes MIME-Version: 1.0 Content-Type: text/plain; format=flowed; charset=US-ASCII Archived-At: Subject: Re: [Add] Use Cases - the coffee shop X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 15:08:49 -0000 On Thu, 15 Aug 2019, Mikael Abrahamsson wrote: > On Thu, 15 Aug 2019, Daniel Stenberg wrote: > >> "Coffee shop" is a handy shortcut to refer to a network where you might >> think twice before you send traffic in the clear, where you perhaps don't >> trust unauthorized clear text protocols or that just offer a crappy DNS. >> There are many such networks where the coffee shop is just one example. > So how are you going to detect that the network is one of these and run DoH > as main resolver path, but not change the default of all other networks I > attach to where I actually trust the resolver an desire to use it? I have never claimed to be able to detect this situation and I won't do it now either - I'm just stressing that I think there are good uses for DoH already as it works today. I haven't seen anyone at all present ideas on how to detect the different situations, and even "the situations" themselves are hard to define and agree upon. -- / daniel.haxx.se From nobody Thu Aug 15 08:11:31 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0F1FD1200B7 for ; Thu, 15 Aug 2019 08:11:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PBII9FiobIKv for ; Thu, 15 Aug 2019 08:11:29 -0700 (PDT) Received: from smtp.guxx.net (nyx.guxx.net [85.10.208.173]) by ietfa.amsl.com (Postfix) with ESMTP id D0CDD1200C3 for ; Thu, 15 Aug 2019 08:11:28 -0700 (PDT) Received: by nyx.guxx.net (Postfix, from userid 107) id B55755F42D46; Thu, 15 Aug 2019 17:11:27 +0200 (CEST) Received: from [172.19.152.108] (p54B8ABDF.dip0.t-ipconnect.de [84.184.171.223]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by nyx.guxx.net (Postfix) with ESMTPSA id AE6F45F42C87; Thu, 15 Aug 2019 17:11:26 +0200 (CEST) From: "Ralf Weber" To: "STARK, BARBARA H" Cc: "Eric Rescorla" , "ADD Mailing list" Date: Thu, 15 Aug 2019 17:11:26 +0200 X-Mailer: MailMate (1.12.5r5635) Message-ID: <9A3959B6-2DD0-47ED-B5A8-E3E477DD4434@fl1ger.de> In-Reply-To: <2D09D61DDFA73D4C884805CC7865E6114E275923@GAALPA1MSGUSRBF.ITServices.sbc.com> References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <1610C8E4-1624-4A7E-A24B-C7D0CB06A1DE@gmail.com> <6bbc4857-449e-e587-1e16-c0ee7d1f2aa8@cs.tcd.ie> <31226710-8C33-4696-90F3-4E05ED82FB05@open-xchange.com> <2D09D61DDFA73D4C884805CC7865E6114E272262@GAALPA1MSGUSRBF.ITServices.sbc.com> <8F75AD20-706B-48F7-B6DD-4C15DAFFA429@fl1ger.de> <04E62C83-56A7-4668-BF95-FFD06C8C9E9F@fl1ger.de> <2D09D61DDFA73D4C884805CC7865E6114E275923@GAALPA1MSGUSRBF.ITServices.sbc.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 15:11:31 -0000 Moin! On 15 Aug 2019, at 16:57, STARK, BARBARA H wrote: > I think Netflix proved quite well what happens when a massive amount > of traffic is shifted to take a different path that doesn't have the > capacity to handle that traffic. Of course, Netflix (and pretty much > everyone else) blamed the ISPs for all the dropped packets. Yeah the messenger of bad news is usually shot ;-). > The question that crossed my mind in reading the SamKnows results, was > if requesting CDN content from the Google or Cloudflare CDN would have > had different results. Of course it would as having the client IP allows you to make much better mapping decision. The Google resolver shows this already for the SamKnows case as it is forwarding the client network using EDNS0 Client Subnet (ECS - RFC7871). So long -Ralf —-- Ralf Weber From nobody Thu Aug 15 08:13:05 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D26E81200D5 for ; Thu, 15 Aug 2019 08:12:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nohats.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tGATgbMpp8DF for ; Thu, 15 Aug 2019 08:12:55 -0700 (PDT) Received: from mx.nohats.ca (mx.nohats.ca [193.110.157.68]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 664BF1200C3 for ; Thu, 15 Aug 2019 08:12:53 -0700 (PDT) Received: from localhost (localhost [IPv6:::1]) by mx.nohats.ca (Postfix) with ESMTP id 468VLr1bd3z1jN; Thu, 15 Aug 2019 17:12:52 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nohats.ca; s=default; t=1565881972; bh=+/q+V/c9rjECwuXmTZZEwTQoHATny40dSiw5nIo5a44=; h=Date:From:To:cc:Subject:In-Reply-To:References; b=dDPQbfh2bVQmy6DUR9kpyi0lBJXFLQde8gv1SH9bXukoS8pI2kZ7XLJBkwGRvm+mc QEcMaWHmaVTtyhZMMmj7H+LD1meL4g2LSwF6zuCsGtjLin9F2Es36QuszEqVZzyn0l rlcza2r5osuZ6+EUD3b0JN+/Ts84TZclN2gRPj14= X-Virus-Scanned: amavisd-new at mx.nohats.ca Received: from mx.nohats.ca ([IPv6:::1]) by localhost (mx.nohats.ca [IPv6:::1]) (amavisd-new, port 10024) with ESMTP id s73XJCjsIvB9; Thu, 15 Aug 2019 17:12:49 +0200 (CEST) Received: from bofh.nohats.ca (bofh.nohats.ca [76.10.157.69]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx.nohats.ca (Postfix) with ESMTPS; Thu, 15 Aug 2019 17:12:49 +0200 (CEST) Received: by bofh.nohats.ca (Postfix, from userid 1000) id 4145C373B; Thu, 15 Aug 2019 11:12:48 -0400 (EDT) DKIM-Filter: OpenDKIM Filter v2.11.0 bofh.nohats.ca 4145C373B Received: from localhost (localhost [127.0.0.1]) by bofh.nohats.ca (Postfix) with ESMTP id 37548406CB11; Thu, 15 Aug 2019 11:12:48 -0400 (EDT) Date: Thu, 15 Aug 2019 11:12:48 -0400 (EDT) From: Paul Wouters To: Mikael Abrahamsson cc: 'ADD Mailing list' In-Reply-To: Message-ID: References: <2D09D61DDFA73D4C884805CC7865E6114E2757F0@GAALPA1MSGUSRBF.ITServices.sbc.com> MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII; format=flowed Archived-At: Subject: Re: [Add] Use Cases - the coffee shop X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 15:12:58 -0000 On Thu, 15 Aug 2019, Mikael Abrahamsson wrote: > 1. I am at home. I trust my home ISP more than I trust CF/GOOG, so I want to > use my ISP resolver. > > 2. I go to a coffee shop and I trust CF/GOOG more than I trust the Coffee > shop, so I want to use them there. > > How are you going to solve this? Until I see a concrete proposal, my > statement is that there is absolutely no technical way to do this without > asking me, and changing the default to GOOG/CF for * to fix 2 is ... just > horrible. Browsers could become aware of which wifi network they are on and configure DNS appropriately. Of course, this would have to be strictly controlled so that webpages do not gain access to any of this information. It is the same idea as Microsoft's "home", "office" and "public" network association when connecting to a new network. > Most ISPs I've seen hover around 5% of the customers that make an active > choice not to use their ISP provided resolver. So the proposal to change the > defaults for everything means 95% will have their default changed. Some users > on this list seems to think this is acceptable fallout to fix 2. How many million routers need to be hacked and have their DHCP DNS configuration modified before you deem it "acceptable" ? https://www.google.com/search?q=modem+router+dns+modified+attack Paul From nobody Thu Aug 15 08:28:28 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0260E1200DE for ; Thu, 15 Aug 2019 08:28:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id B1FP2aUS83yJ for ; Thu, 15 Aug 2019 08:28:24 -0700 (PDT) Received: from mail-qk1-x732.google.com (mail-qk1-x732.google.com [IPv6:2607:f8b0:4864:20::732]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7D62D120152 for ; Thu, 15 Aug 2019 08:28:21 -0700 (PDT) Received: by mail-qk1-x732.google.com with SMTP id d79so2095094qke.11 for ; Thu, 15 Aug 2019 08:28:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=NADAl+vvKkfMdVuIsHrpc1nMvBCXqLThPl02n97vLfY=; b=jq7ixM5ZNAn3WWi6mUp5fxa4TEAYwwlIx0PdgeVczXls6TCMXkovSMdUvJDWOrH0oA nDYjtLf4fk/Mmx6xwyo8Rneb4w+9YRF4Y4VgLUr2cDOE2IzxqBQO4mHVkePvTiPAF3Kt +Ol1PI7IltGUgOy2Sx6w2Kb55TUNo0ayktWl3CNN3GfK9Y8xpIFSGA9FE9odtWEOpp0C Wcp//3JkPykZmQvXE7yQDWbYjJHNbBq6tKPpLqod0AFU9S5VsMRRkJIGy5mLRmsspVEc cotDkY92ZosvtqXrUdY6ZlGbVdZXoMLo79WPuXEQa6+Cd8jxZGlLhd+4ipCisL2j8Onc ALqg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=NADAl+vvKkfMdVuIsHrpc1nMvBCXqLThPl02n97vLfY=; b=iUnpQS3wgtDkxpLOo/tAJrCvCJ6wV32+FKh5y7Yxl/j+mSpUUxCxb1jZramKBh47Oq 3PUYs4VvqEXAws3SIOmuNDDhtjnxcZ1g7sFO6fLk9YOgF2EYNhZdDZ9mKIObEsY81Ab2 eg3IvQoJAJsAf7qKfG18W7J3tzSyPMs+nsrOAeFiyFo5ZZiiy7GGCfPumdZHWGG/2DZL ZQZ7I4te9PomsCG8E7vJtnrygCFbZmbyGd7nSmmDssgwoZ2u+uGDQGGc8P4OZ4WSTA6a XiEqsAOAMYEWX8maIHV2Xo183md9ao1FGGHW9sWX7zCz+6ZgPv8KWxh+c2gPtqIQSfpU E8yw== X-Gm-Message-State: APjAAAW2YV8hovrBONaVGswq8ngivVnQkCmTKxvhRNdpa2BuB6+GIf3j Y6/ScPS80DVERJWaH8WjBNzNdc0huP8sOQ== X-Google-Smtp-Source: APXvYqzce8D153lj1LDOs45gx+eAHkhjO+ItnQnyYJWQHhz1lrl0YhxmymGYU3hwA6zDswSShBwfmg== X-Received: by 2002:a05:620a:4d4:: with SMTP id 20mr4268467qks.95.1565882900517; Thu, 15 Aug 2019 08:28:20 -0700 (PDT) Received: from ?IPv6:2001:470:c1a2:1:9128:e34:f62c:61a4? ([2001:470:c1a2:1:9128:e34:f62c:61a4]) by smtp.gmail.com with ESMTPSA id v81sm1655481qkb.21.2019.08.15.08.28.19 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 15 Aug 2019 08:28:19 -0700 (PDT) From: Ted Lemon Message-Id: Content-Type: multipart/alternative; boundary="Apple-Mail=_C224DAD2-2E05-4C07-A46D-52542D0B6B17" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Thu, 15 Aug 2019 08:28:18 -0700 In-Reply-To: Cc: ADD Mailing list To: Andrew Campling References: X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] When Two Worlds Collide X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 15:28:27 -0000 --Apple-Mail=_C224DAD2-2E05-4C07-A46D-52542D0B6B17 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 On Aug 15, 2019, at 7:55 AM, Andrew Campling = wrote: > Do you agree with the above analysis and, if so, would you see value = in taking part in such a workshop? By all means email me directly on = this if you prefer not to clog up the mail reflector. =20 I don=E2=80=99t think there=E2=80=99s any point in this (and I will = point out that you did not mention users, just ISPs and browser = vendors). I think what Martin said here explains why this isn=E2=80=99t = going to work: = https://mailarchive.ietf.org/arch/msg/add/You2UXZbjDogcASupgZTzjdYVMs If there is useful work to be done here, it is not in figuring out what = rules should be followed. What people will do will be based on their = best interests, not on what the IETF tells them to do, because there = isn=E2=80=99t an interop problem here. What we can and perhaps should = do is, as Martin said, do some dispassionate assessment of the use cases = and how the prevalence of DoH changes things. But we can=E2=80=99t do that as long as this feels to some participants = like the problem is that there are differences in worldview between = operators, users and browser vendors, and that what we need to do is to = come into alignment about worldviews. --Apple-Mail=_C224DAD2-2E05-4C07-A46D-52542D0B6B17 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 On = Aug 15, 2019, at 7:55 AM, Andrew Campling <andrew.campling@419.consulting> wrote:
Do = you agree with the above analysis and, if so, would you see value in = taking part in such a workshop?  By all means email me directly on = this if you prefer not to clog up the mail = reflector.  

I don=E2=80=99t think there=E2=80=99s any point in = this (and I will point out that you did not mention users, just ISPs and = browser vendors).   I think what Martin said here explains why this = isn=E2=80=99t going to work: https://mailarchive.ietf.org/arch/msg/add/You2UXZbjDogcASupgZTz= jdYVMs

If there is useful work = to be done here, it is not in figuring out what rules should be = followed.  What people will do will be based on their best = interests, not on what the IETF tells them to do, because there isn=E2=80=99= t an interop problem here.   What we can and perhaps should do is, as Martin said, do some dispassionate assessment = of the use cases and how the prevalence of DoH changes = things.

But we can=E2=80=99t do that = as long as this feels to some participants like the problem is that = there are differences in worldview between operators, users and browser = vendors, and that what we need to do is to come into alignment about = worldviews.

= --Apple-Mail=_C224DAD2-2E05-4C07-A46D-52542D0B6B17-- From nobody Thu Aug 15 08:29:10 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4C64B12012A for ; Thu, 15 Aug 2019 08:29:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=swm.pp.se Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NF8A9zqodc1Q for ; Thu, 15 Aug 2019 08:29:07 -0700 (PDT) Received: from uplift.swm.pp.se (ipv6.swm.pp.se [IPv6:2a00:801::f]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A06721200DE for ; Thu, 15 Aug 2019 08:28:59 -0700 (PDT) Received: by uplift.swm.pp.se (Postfix, from userid 501) id 92C05AF; Thu, 15 Aug 2019 17:28:57 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=swm.pp.se; s=mail; t=1565882937; bh=yqURC6JEXhhinu2gVxirmkkwvzYwbRurnd7pTjLwxDk=; h=Date:From:To:cc:Subject:In-Reply-To:References:From; b=P6zySH+Mpz/lJ1ZRGW73wtjj0kc2m/BmQJaxpvF6YkTrZYXZDr7+sFTDoPQ5Pqaan 8yxB9lIXjupGzn5QHTrN5b+L0PkEknMfiD+RkjkBh+bzG4GBN6/J00iMTULTfB91N4 8Elfq9mkvUAmnLsFrBuwgl6CquVWZ9/cQ2eKMszE= Received: from localhost (localhost [127.0.0.1]) by uplift.swm.pp.se (Postfix) with ESMTP id 906A59F; Thu, 15 Aug 2019 17:28:57 +0200 (CEST) Date: Thu, 15 Aug 2019 17:28:57 +0200 (CEST) From: Mikael Abrahamsson To: Paul Wouters cc: 'ADD Mailing list' In-Reply-To: Message-ID: References: <2D09D61DDFA73D4C884805CC7865E6114E2757F0@GAALPA1MSGUSRBF.ITServices.sbc.com> User-Agent: Alpine 2.20 (DEB 67 2015-01-07) Organization: People's Front Against WWW MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII; format=flowed Archived-At: Subject: Re: [Add] Use Cases - the coffee shop X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 15:29:09 -0000 On Thu, 15 Aug 2019, Paul Wouters wrote: > Browsers could become aware of which wifi network they are on and > configure DNS appropriately. Of course, this would have to be strictly > controlled so that webpages do not gain access to any of this > information. It is the same idea as Microsoft's "home", "office" and > "public" network association when connecting to a new network. Indeed, and I have made this argument 3-4 times already in the past 1-2 weeks on this list. ASK THE USER! However, the people advocating to change the default seem to not agree. > How many million routers need to be hacked and have their DHCP DNS > configuration modified before you deem it "acceptable" ? A lot more than has happened to date. Since the malicious ones are barely a blip on the radar (the number for "other" I have seen in peoples presentations are barely noticable). Most of the ones not using their ISP resolvers are instead using Google, Cloudflare, opendns or something that is not changed to this for malicious reasons. -- Mikael Abrahamsson email: swmike@swm.pp.se From nobody Thu Aug 15 08:29:37 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9E64612082E for ; Thu, 15 Aug 2019 08:29:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.299 X-Spam-Level: X-Spam-Status: No, score=-4.299 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=open-xchange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JhbukHzZ9gdK for ; Thu, 15 Aug 2019 08:29:26 -0700 (PDT) Received: from mx4.open-xchange.com (alcatraz.open-xchange.com [87.191.39.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5C147120813 for ; Thu, 15 Aug 2019 08:29:26 -0700 (PDT) Received: from open-xchange.com (imap.open-xchange.com [10.20.30.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx4.open-xchange.com (Postfix) with ESMTPS id 8A0586A298; Thu, 15 Aug 2019 17:29:23 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=open-xchange.com; s=201705; t=1565882963; bh=B8mcCzD1kENdcZQv4A1TbphQnywbudPOYS8iZoETRTI=; h=From:Subject:Date:In-Reply-To:Cc:To:References:From; b=QXrzRtAFOV4Kxm8jWOZSNO63p/wLRdeytTJpzMwMGMdGjpn7N0LdNKHcxkNPDXXyn q5Tr3FNEe31hN0ulloNg5I2mtuu4qWJeSOKgAaCPY0gfRKfrudAgKPfzvbZ9TxefFX bK6vV48mq/4jov8sReRgZhEuLSbKw3VjTlKxsuRh2Ern/tyLGCWmsuuZlduXtEBUK1 sfcWuzbIUIId4UP2kBfZPYqfyw7hBByuN1ByF/OuB8xHjZwpB3kW78faUmYLakX4Pg Vful5CwpjX44qYLSdRVAKduWctgeO1D3jqdZfHXo98LwYDK+nT4vPeADDP97ypw3Yb v+qVI5tjbDXgw== Received: from [10.242.2.29] (unknown [10.242.2.29]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by open-xchange.com (Postfix) with ESMTPSA id 137E53C03A7; Thu, 15 Aug 2019 17:29:22 +0200 (CEST) From: Neil Cook Message-Id: <55C6DE51-6E9B-4BFD-A08F-1B8323268A02@open-xchange.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_4A1323DA-9C26-421B-A2D5-829AB3E513A1" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Thu, 15 Aug 2019 16:29:21 +0100 In-Reply-To: Cc: Andrew Campling , ADD Mailing list To: Paul Wouters References: X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] Use Cases - the coffee shop X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 15:29:32 -0000 --Apple-Mail=_4A1323DA-9C26-421B-A2D5-829AB3E513A1 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii > On 15 Aug 2019, at 16:05, Paul Wouters wrote: > they want. Sure there are some limitations based on sharing the > bandwidth, and prevention of certain websites (eg porn) that would > negatively affect other customers. > . So > there are zero resaons not to give the coffeeshop / hotel enduser that > freedom (or rather, give the user an "uncensored internet") I think you just gave a reason yourself in the above paragraph why the = coffee shop would not want to give the user an uncensored internet. Neil Cook neil.cook@open-xchange.com = --------------------------------------------------------------------------= ----------- Open-Xchange AG, Rollnerstr. 14, 90408 Nuremberg, District Court = Nuremberg HRB 24738 Managing Board: Rafael Laguna de la Vera, Carsten Dirks, Michael = Knapstein, Stephan Martin=20 Chairman of the Board: Richard Seibt European Office:=20 Open-Xchange GmbH, Olper Huette 5f, D-57462 Olpe, Germany, District = Court Siegen, HRB 8718=20 Managing Director: Frank Hoberg US Office:=20 Open-Xchange. Inc., 530 Lytton Avenue, Palo Alto, CA 94301, USA=20 = --------------------------------------------------------------------------= ----------- --Apple-Mail=_4A1323DA-9C26-421B-A2D5-829AB3E513A1 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii

On 15 Aug 2019, at 16:05, Paul Wouters <paul@nohats.ca> = wrote:

they want. Sure = there are some limitations based on sharing the
bandwidth, = and prevention of certain websites (eg porn) that would
negatively affect other customers. =


. So
there are zero resaons not to give the = coffeeshop / hotel enduser that
freedom (or rather, give = the user an "uncensored internet")

I think you = just gave a reason yourself in the above paragraph why the coffee shop = would not want to give the user an uncensored internet.

Neil Cook
neil.cook@open-xchange.com

---------------------------------------------------------------= ----------------------
Open-Xchange AG, Rollnerstr. 14, = 90408 Nuremberg, District Court Nuremberg HRB 24738
Managing Board: Rafael Laguna de la Vera, Carsten Dirks, = Michael Knapstein, Stephan Martin 
Chairman of = the Board: Richard Seibt

European = Office: 
Open-Xchange GmbH, Olper Huette = 5f, D-57462 Olpe, Germany, District Court Siegen, HRB = 8718 
Managing Director: Frank Hoberg
US Office: 
Open-Xchange. Inc., 530 = Lytton Avenue, Palo Alto, CA 94301, USA 
---------------------------------------------------------------= ----------------------

= --Apple-Mail=_4A1323DA-9C26-421B-A2D5-829AB3E513A1-- From nobody Thu Aug 15 08:33:07 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AE21B1207FC for ; Thu, 15 Aug 2019 08:33:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9BBNDQYvmm7o for ; Thu, 15 Aug 2019 08:33:04 -0700 (PDT) Received: from mail-qt1-x834.google.com (mail-qt1-x834.google.com [IPv6:2607:f8b0:4864:20::834]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5D7BD1200DE for ; Thu, 15 Aug 2019 08:33:02 -0700 (PDT) Received: by mail-qt1-x834.google.com with SMTP id t12so2735299qtp.9 for ; Thu, 15 Aug 2019 08:33:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=nQvZNf9kOx7dsKkW/SzqI524bkC09cxBMFyk3U6zDrc=; b=LOuxHpw3QoRC3A1JLMEKcAD9dOcafdzfVwgPEj0pXD7tyPDCeOumrTanP8cEmeZyYh YYmRGI0WgIbOiG/Z+6Nticu7BNRKzQ5r6VmMeC9s3QG7P0ymy1hRIFPDoaeY9hODhLul vn/5vuqadggTAYH9uiXikdk8x/lCAvFQ0eRc9a1RvZqYmq12JvkMtaOW2wIXYPvAXkqT HBMaKIDMcWfhkI1l4pfQfjzOLvtTBbsvBqI88Dy5UXykKgFw4nYDt5IIjn9FD0OYoX2Z VxJePjWTvDSGZbWElPMN/4fUgeNlvUR/NgLGbhvVVzf5MvOVk+YmF7lJE/doUOuqDcD5 QI9A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=nQvZNf9kOx7dsKkW/SzqI524bkC09cxBMFyk3U6zDrc=; b=iZbJspM8VTpaiSE+W16ursazv/k82KSWt7t2Z1w5VweH2IhzcH5NhdEEPUwVQ86wwC i6EEeBtzu2xkX7I4bPJoUaYJiCzUG7pDQBJ0TDIR7zw4hWfy6LQe3lLwJvztcyfMwxfh U2JlUXVp8oPrnycjqxtSeVzjjKWna8I3fq0XE44U12a8Qegsk4w/Fg/gD8v5hS/gEQrZ 1XmfHUFbqASvZXv6eAcGGV5ad0D4MHZGkw5BqGqp3kKLtCap6rdkPDk2xCVvSYOKiyDZ xQgO5CBA8cAltT8Wz1GtoxNlWQ9ODwQ+GxpeS34pTRvCUgtitHIyPwKmrZlVTtPsqmpk JRAg== X-Gm-Message-State: APjAAAVmy+IiMcig69yJ1l9N+O06BdDcg6ZBBiU5It059Duo1NOIoem3 7PGM3837vE2Xy+wyIVW3en79ip5q6qntJw== X-Google-Smtp-Source: APXvYqwdNg1el3YUnqwZH84ZdQk8APSkXIrMf8dWubIF28+qePLrJ4GC246QtpDbA3ndLlVC4MRW2A== X-Received: by 2002:ad4:41c6:: with SMTP id a6mr3701291qvq.49.1565883181449; Thu, 15 Aug 2019 08:33:01 -0700 (PDT) Received: from ?IPv6:2001:470:c1a2:1:9128:e34:f62c:61a4? ([2001:470:c1a2:1:9128:e34:f62c:61a4]) by smtp.gmail.com with ESMTPSA id p126sm1855732qkc.84.2019.08.15.08.33.00 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 15 Aug 2019 08:33:01 -0700 (PDT) From: Ted Lemon Message-Id: Content-Type: multipart/alternative; boundary="Apple-Mail=_AEC9B623-8FBD-4651-8BE6-95EDB74E5417" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Thu, 15 Aug 2019 08:32:59 -0700 In-Reply-To: Cc: Paul Wouters , ADD Mailing list To: Mikael Abrahamsson References: <2D09D61DDFA73D4C884805CC7865E6114E2757F0@GAALPA1MSGUSRBF.ITServices.sbc.com> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] Use Cases - the coffee shop X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 15:33:07 -0000 --Apple-Mail=_AEC9B623-8FBD-4651-8BE6-95EDB74E5417 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 On Aug 15, 2019, at 8:28 AM, Mikael Abrahamsson = wrote: > Indeed, and I have made this argument 3-4 times already in the past = 1-2 weeks on this list. ASK THE USER! However, the people advocating to = change the default seem to not agree. Any security UI that the user sees more than once at setup time is going = to turn into a =E2=80=9Cwhat do I have to click to get work done=E2=80=9D = decision. The reason we say =E2=80=9Cdon=E2=80=99t ask the user=E2=80=9D= is not because we don=E2=80=99t think what the user wants matters. = It=E2=80=99s because asking the user what they want when they are trying = to get work done will not result in us getting an answer that actually = represents what the user wants. Look at the failure of Windows Vista. I thought that the notification = system for security issues was fantastic, because I understand the = problem and its solutions. And even I got tired of the security alert = popups after a while. Most users hated this UI with a passion and = stuck to Windows XP. It was a disaster for user security, despite = being a better UI in the sense that you are imagining. It was a better = UI in theory, but not in practice. --Apple-Mail=_AEC9B623-8FBD-4651-8BE6-95EDB74E5417 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 On = Aug 15, 2019, at 8:28 AM, Mikael Abrahamsson <swmike@swm.pp.se> = wrote:
Indeed, and I = have made this argument 3-4 times already in the past 1-2 weeks on this = list. ASK THE USER! However, the people advocating to change the default = seem to not agree.

Any security UI that the user sees more than = once at setup time is going to turn into a =E2=80=9Cwhat do I have to = click to get work done=E2=80=9D decision.   The reason we say = =E2=80=9Cdon=E2=80=99t ask the user=E2=80=9D is not because we don=E2=80=99= t think what the user wants matters.   It=E2=80=99s because asking = the user what they want when they are trying to get work done will not = result in us getting an answer that actually represents what the user = wants.

Look at = the failure of Windows Vista.   I thought that the notification = system for security issues was fantastic, because I = understand the problem and its solutions.  And even I got tired of the security alert = popups after a while.   Most users hated this UI with a passion and = stuck to Windows XP.   It was a disaster for user security, despite = being a better UI in the sense that you are imagining.   It was a = better UI in theory, but not in practice.

= --Apple-Mail=_AEC9B623-8FBD-4651-8BE6-95EDB74E5417-- From nobody Thu Aug 15 08:39:39 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 815E21200DB for ; Thu, 15 Aug 2019 08:39:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=swm.pp.se Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id A1GcE_PGb3wB for ; Thu, 15 Aug 2019 08:39:36 -0700 (PDT) Received: from uplift.swm.pp.se (ipv6.swm.pp.se [IPv6:2a00:801::f]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BD67212009C for ; Thu, 15 Aug 2019 08:39:36 -0700 (PDT) Received: by uplift.swm.pp.se (Postfix, from userid 501) id CE817AF; Thu, 15 Aug 2019 17:39:34 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=swm.pp.se; s=mail; t=1565883574; bh=bGSiy9Lq2jBxb5l51+SH3c5mRMZX7nEqKmHd95E8LxE=; h=Date:From:To:cc:Subject:In-Reply-To:References:From; b=VEn08Hb9D9UlsLrBbCaW0u5UIl4XM0pFoQM7Q+ENjxGJoT6kMieAHFFDFoWKJSx2Z RgLEvz5QK3TCt2EvAw7ZwOP6m3Klmrlsgf/0lIXPBYwfF6yoNRABaI3qw2bZjKYvSz VQmbnP8SrhX/EwZLtIchKeEZz8u1R7/MBTjh4gtk= Received: from localhost (localhost [127.0.0.1]) by uplift.swm.pp.se (Postfix) with ESMTP id CC4069F; Thu, 15 Aug 2019 17:39:34 +0200 (CEST) Date: Thu, 15 Aug 2019 17:39:34 +0200 (CEST) From: Mikael Abrahamsson To: Ted Lemon cc: Paul Wouters , ADD Mailing list In-Reply-To: Message-ID: References: <2D09D61DDFA73D4C884805CC7865E6114E2757F0@GAALPA1MSGUSRBF.ITServices.sbc.com> User-Agent: Alpine 2.20 (DEB 67 2015-01-07) Organization: People's Front Against WWW MIME-Version: 1.0 Content-Type: multipart/mixed; BOUNDARY="-137064504-1168532076-1565883574=:21548" Archived-At: Subject: Re: [Add] Use Cases - the coffee shop X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 15:39:38 -0000 This message is in MIME format. The first part should be readable text, while the remaining parts are likely unreadable without MIME-aware tools. ---137064504-1168532076-1565883574=:21548 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8BIT On Thu, 15 Aug 2019, Ted Lemon wrote: > Any security UI that the user sees more than once at setup time is going > to turn into a “what do I have to click to get work done” decision. > The reason we say “don’t ask the user” is not because we don’t think > what the user wants matters. It’s because asking the user what they > want when they are trying to get work done will not result in us getting > an answer that actually represents what the user wants. Does this mean you think what MS is doing in Windows at network connect (first time, regarding the public/private wifi) is the wrong thing to do? Because that's exactly what I am talking about. Sensible defaults depending on that kind of question. Ask once per SSID. -- Mikael Abrahamsson email: swmike@swm.pp.se ---137064504-1168532076-1565883574=:21548-- From nobody Thu Aug 15 08:46:25 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4A9271200C1 for ; Thu, 15 Aug 2019 08:46:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qT0kenPtM6Yd for ; Thu, 15 Aug 2019 08:46:14 -0700 (PDT) Received: from smtp.guxx.net (nyx.guxx.net [85.10.208.173]) by ietfa.amsl.com (Postfix) with ESMTP id 5EF9C120273 for ; Thu, 15 Aug 2019 08:46:14 -0700 (PDT) Received: by nyx.guxx.net (Postfix, from userid 107) id 2BADA5F42C87; Thu, 15 Aug 2019 17:46:13 +0200 (CEST) Received: from [172.19.152.108] (p54B8ABDF.dip0.t-ipconnect.de [84.184.171.223]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by nyx.guxx.net (Postfix) with ESMTPSA id C000E5F42B98; Thu, 15 Aug 2019 17:46:11 +0200 (CEST) From: "Ralf Weber" To: "Paul Wouters" Cc: "Andrew Campling" , "ADD Mailing list" Date: Thu, 15 Aug 2019 17:46:11 +0200 X-Mailer: MailMate (1.12.5r5635) Message-ID: In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [Add] Use Cases - the coffee shop X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 15:46:24 -0000 Moin! On 15 Aug 2019, at 17:05, Paul Wouters wrote: > There is an expectation by the user that once authenticated to the > hotspot, that the user can then more or less send/receive whatever > they want. Is there really? In all parts of the world? > Sure there are some limitations based on sharing the > bandwidth, and prevention of certain websites (eg porn) that would > negatively affect other customers. So given that you are ok with the provision of not accessing certain sites would you be ok with them to enforce this? > But the user may totally corrupt > their own device by downloading malicious content. TBH I’d rather connect to a network that protects me from malware/ trojans then one that protects me from porn (Though there is some relationship there ;-) > And there is still an expectation of privacy (eg when reading email, > when browsing sites) that a coffeeshop owner cannot just claim that they > do not apply because you are a guest and you can choose not to connect. I agree here, but isn’t that what TLS is for. Sure it would be good if the DNS connection also would be encrypted, but if the coffee shop owner offered it he would still be able to see the traffic. On most coffee shops/hotels I would have less problem with that then if Cloudflare or Google get all my browsing traffic. Anyway I think the fundamental problem is that there are a lot of different use cases and environments out there and there will not be a one size fits all solution. Even the coffee shop could be in a jurisdiction where the user expects the network to protect them or where networks are required to do that (and get fined/license revoked when they don’t). So long -Ralf —-- Ralf Weber From nobody Thu Aug 15 08:46:43 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 36C0B1200B7 for ; Thu, 15 Aug 2019 08:46:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AYKGFva9DLMo for ; Thu, 15 Aug 2019 08:46:39 -0700 (PDT) Received: from mail-qt1-x82d.google.com (mail-qt1-x82d.google.com [IPv6:2607:f8b0:4864:20::82d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C61CC120090 for ; Thu, 15 Aug 2019 08:46:38 -0700 (PDT) Received: by mail-qt1-x82d.google.com with SMTP id l9so2798316qtu.6 for ; Thu, 15 Aug 2019 08:46:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=93NNADE3W+pVBKHHr5y28O5XA7+0RmrPAjVbDcwNYlY=; b=y1kzZa6BUEGx05TSAXSbOhuEzUMZN/+L1ikMYklzGGzAIuTnc71lIcZ2fHZYfeQkX9 DUw3xGgtYBgpnzwgp5G/CSUFFKhbeq1jJLbQWnKY1LJNE6A/zs6RVr6HTlN8OHc7ADix 623pLyZ9F7R7d6JmWYsla72lUrzpX3r/9P+f5utGIRahbNz9SOY2Ig9/0Ate6YDWVmfx vsD1SBGoPdFw/KLSNsUJ8/wGoQCumEavsyCevi8Etv83N75/T95KGXoFeYqIHEvMXOKs tVB7FSZtGirPxFKPRKLUtjsl9eA/tBfBea1yk/57ErBwu5q+xxI5Vd9e21swlheSn3UZ 3S2g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=93NNADE3W+pVBKHHr5y28O5XA7+0RmrPAjVbDcwNYlY=; b=uiSbB+BhIEGHAVmzaAlX1/hvCG49trOemX85yYpVoQOYngSCWIWzaF0LWuaUtY7DIn KhD+BGzgTVGz0VQ31o6v+CI30Yow/+T7gkKArLJR+t+KjIG4NOnd2GoKNGIqu6yYhMul Ku0qZpK/weR80OToSTvxJbF+l6KFYC+n5o837MXEfzBuCepE/5qNtjROoziRtiyCvQ8+ sKdqeykOZjVHvy21ibsYyLASnyhJXNPoWegUOlsx8zcemgZsLmBwN7OtmubT1SwD3/1g vj1znw4itToocrcsmBiM+Yh+j6mwZbk/E8meoTMRaAfkVlbTzDuJr0qeLY6fythCSWZD wOXQ== X-Gm-Message-State: APjAAAXeSNCFZSdSZN5R+gZe6KB66UW7q/8tPnZ+wEdyDXS9e4XPa0qE txl3g1bvepe/9EIRqvnjGrb9Bg== X-Google-Smtp-Source: APXvYqztcB7bFKH+B4oSr4YEsYsz6MKJE1v7r6vslTxidck6Z6zYNeSR0vRZo4z5E0j7RCigMjNl0A== X-Received: by 2002:a0c:e1cd:: with SMTP id v13mr3735464qvl.245.1565883997864; Thu, 15 Aug 2019 08:46:37 -0700 (PDT) Received: from ?IPv6:2001:470:c1a2:1:9128:e34:f62c:61a4? ([2001:470:c1a2:1:9128:e34:f62c:61a4]) by smtp.gmail.com with ESMTPSA id p126sm1875526qkc.84.2019.08.15.08.46.37 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 15 Aug 2019 08:46:37 -0700 (PDT) From: Ted Lemon Message-Id: Content-Type: multipart/alternative; boundary="Apple-Mail=_79601A54-7ECD-4CF3-B184-DF80FEED5EFB" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Thu, 15 Aug 2019 08:46:35 -0700 In-Reply-To: Cc: Paul Wouters , ADD Mailing list To: Mikael Abrahamsson References: <2D09D61DDFA73D4C884805CC7865E6114E2757F0@GAALPA1MSGUSRBF.ITServices.sbc.com> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] Use Cases - the coffee shop X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 15:46:41 -0000 --Apple-Mail=_79601A54-7ECD-4CF3-B184-DF80FEED5EFB Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 On Aug 15, 2019, at 8:39 AM, Mikael Abrahamsson = wrote: > Does this mean you think what MS is doing in Windows at network = connect (first time, regarding the public/private wifi) is the wrong = thing to do? That was bad too, yes. How does the user know? What will happen if = they say =E2=80=9Cpublic=E2=80=9D? What will happen if they say = =E2=80=9Cprivate?=E2=80=9D What will happen in practice is that the = user will notice when clicking =E2=80=9Cpublic=E2=80=9D causes problems, = and when clicking =E2=80=9Cprivate=E2=80=9D causes problems, and over = time will be conditioned to, without thinking, click the one that causes = the least problems. But I was actually referring to the notification that an app has done a = privilege escalation, which happened all the time. I found it helpful = because when an app unexpectedly escalated privileges, I could kill it = and stop using it. Others found it annoying because it happened a lot. > Because that's exactly what I am talking about. Sensible defaults = depending on that kind of question. Ask once per SSID. Absent authentication and unambiguous identification, neither of which = are present in SSIDs, there is no way to make this work. Every SSID, = even if it=E2=80=99s got the same name and the same BSSID, has to be = treated as a new SSID, because there is no way to prove that it is not = without 802.1x. So you could use 802.1x authentication to trigger = different behavior, but that=E2=80=99s the only case where this would = make sense. Even there, you have to make sure that two SSIDs marked = DeutscheTelekom with different certs are treated as different SSIDs, and = that there=E2=80=99s a way for the user to understand what is going on. = This is a really hard problem, because there=E2=80=99s no definitive = registry for SSIDs. I honestly can=E2=80=99t think of a secure way to = do this that doesn=E2=80=99t involve the IT department installing certs = on the host, at which point there=E2=80=99s no need for a UI. --Apple-Mail=_79601A54-7ECD-4CF3-B184-DF80FEED5EFB Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 On = Aug 15, 2019, at 8:39 AM, Mikael Abrahamsson <swmike@swm.pp.se> = wrote:
Does this = mean you think what MS is doing in Windows at network connect (first = time, regarding the public/private wifi) is the wrong thing to = do?

That was bad too, yes.   How does the user know?   = What will happen if they say =E2=80=9Cpublic=E2=80=9D?   What will = happen if they say =E2=80=9Cprivate?=E2=80=9D   What will happen in = practice is that the user will notice when clicking =E2=80=9Cpublic=E2=80=9D= causes problems, and when clicking =E2=80=9Cprivate=E2=80=9D causes = problems, and over time will be conditioned to, without thinking, click = the one that causes the least problems.

But I was actually referring to the = notification that an app has done a privilege escalation, which happened = all the time.  I found it helpful because when an app unexpectedly = escalated privileges, I could kill it and stop using it.  Others = found it annoying because it happened a lot.

Because = that's exactly what I am talking about. Sensible defaults depending on = that kind of question. Ask once per SSID.

Absent authentication and unambiguous identification, neither = of which are present in SSIDs, there is no way to make this work.   = Every SSID, even if it=E2=80=99s got the same name and the same BSSID, = has to be treated as a new SSID, because there is no way to prove that = it is not without 802.1x.   So you could use 802.1x authentication = to trigger different behavior, but that=E2=80=99s the only case where = this would make sense.   Even there, you have to make sure that two = SSIDs marked DeutscheTelekom with different certs are treated as = different SSIDs, and that there=E2=80=99s a way for the user to = understand what is going on.   This is a really hard problem, because there=E2=80=99s no = definitive registry for SSIDs.   I honestly can=E2=80=99t think of = a secure way to do this that doesn=E2=80=99t involve the IT department = installing certs on the host, at which point there=E2=80=99s no need for = a UI.

= --Apple-Mail=_79601A54-7ECD-4CF3-B184-DF80FEED5EFB-- From nobody Thu Aug 15 08:46:56 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 81B3D1200C1 for ; Thu, 15 Aug 2019 08:46:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=netorgft5189650.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zzs_bx2SaeGE for ; Thu, 15 Aug 2019 08:46:50 -0700 (PDT) Received: from GBR01-CWL-obe.outbound.protection.outlook.com (mail-eopbgr110054.outbound.protection.outlook.com [40.107.11.54]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D6D0A120826 for ; Thu, 15 Aug 2019 08:46:49 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=ZjHpx06XaS40VtQ2LdWWu2UrxqbF33F9hKd//Gtoqt3Qu0EBz4C4t6oge/DMOSr/KAw3s92k6/4+BmqPPo9tNmN4TJUGLRQ2T+rxp5GZAgvhnpdF3cD9QqEFodKFUaQSkDZic/osV6NJSlO/jUMP7e1npX5MS/IAl6kUe+H77Y9YerSOEFDxsEOjeEoq+LYeHdbUno/yjsLYHhGXq7IC8hEHVAQsIF4yNACQ8GhNIe8KHmBV0rbQZSGMx1RBgB8A0XpDEc1LDlPpBYF1Q+vFdgi+nQWFJ2up5iQPQOYYezdepsRuTISHpa1WZ7v+tvahwIHKKvccb0x4hsNFQag7cw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=AjJ2jce61VTrpPnqOwR7jn5DBO6V9TYvEDyc94m/XYw=; b=iXigTPtnSQOZhM/mNoXhJZvHK2dpY99H5SaG0NJd4LPOi157mVGFiBisfvs2TYDJCCF9TdxYt9lWEOadZO8kGunWSWgZ0bYGKACRE2R1006hXBCHIxmIyRpKzEyPoeSdLRGQpwJCH9OQzRae4FV9c3/xb+DBIq8c81hzKtRcHk91dJhlFod+ygeM9MCOFF+aR+f/hSUoQtQSsOXU/FuoX9l6mTfFXx9sVyMxQO4AFSSJlRvtML3YU2kpRfo9r1snNmUvN7ezfr/Y45OuKwNbNmaCJoG/TaIHkYaNvr7zzbVEOcYCwB680ImSywrve5c9Orn7k45ii+suIN4EM9386A== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=419.consulting; dmarc=pass action=none header.from=419.consulting; dkim=pass header.d=419.consulting; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=NETORGFT5189650.onmicrosoft.com; s=selector1-NETORGFT5189650-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=AjJ2jce61VTrpPnqOwR7jn5DBO6V9TYvEDyc94m/XYw=; b=VI4OiG+I/CmVQUXDg+qT4dy0yIpcUQST87QsXWR22tfs5owJHLoAMf2pyertZ0kCvOyJa5qdFysuv1tws7M902QanYiN6xKnpMUOg5lAnstVDo6pqh3xAHy+yXeJU5Gg9BzZPjL5zujnVc9bxJrbYuJXUHZ9H8B123UHqmMe25c= Received: from LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM (20.176.138.146) by LO2P265MB0861.GBRP265.PROD.OUTLOOK.COM (20.176.139.17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2157.15; Thu, 15 Aug 2019 15:46:47 +0000 Received: from LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM ([fe80::64e9:9b9e:59fc:26f]) by LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM ([fe80::64e9:9b9e:59fc:26f%5]) with mapi id 15.20.2157.022; Thu, 15 Aug 2019 15:46:46 +0000 From: Andrew Campling To: Ted Lemon CC: ADD Mailing list Thread-Topic: [Add] When Two Worlds Collide Thread-Index: AdVTdyCapVPyep9JQGykvKh9TBzsEAABu+YAAAAP56A= Date: Thu, 15 Aug 2019 15:46:46 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=andrew.campling@419.consulting; x-originating-ip: [2a00:23c4:a499:2e00:f42b:87f3:b90b:d830] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 6b141cd4-3f30-4f07-b184-08d72197c7aa x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(7021145)(8989299)(4534185)(7022145)(4603075)(4627221)(201702281549075)(8990200)(7048125)(7024125)(7027125)(7023125)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:LO2P265MB0861; x-ms-traffictypediagnostic: LO2P265MB0861: x-ms-exchange-purlcount: 1 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-forefront-prvs: 01304918F3 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(366004)(376002)(136003)(396003)(39830400003)(346002)(199004)(53234004)(189003)(7696005)(102836004)(76176011)(4326008)(53936002)(6506007)(25786009)(6306002)(186003)(9686003)(46003)(6246003)(55016002)(53546011)(66574012)(508600001)(966005)(71200400001)(71190400001)(99286004)(14454004)(2906002)(66446008)(64756008)(66556008)(6436002)(486006)(52536014)(316002)(66946007)(76116006)(81166006)(5660300002)(66476007)(33656002)(81156014)(8936002)(256004)(86362001)(44832011)(8676002)(6116002)(446003)(305945005)(74316002)(476003)(229853002)(6916009)(11346002)(7736002)(46492003); DIR:OUT; SFP:1101; SCL:1; SRVR:LO2P265MB0861; H:LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: 419.consulting does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: BGaXpfwU0oqSCLVC8yTzFjqkdHbyfcRgY+g/gKVnowEwdaschumMtzm1WyQhpc5smnvqY2r5GOqsazgTbjVR097ALYdmvXorS/Kwb6RsTxFJS+iyzCbKcqug7pYYQT7vdcp0gsx+LrHhb5PeLsVrhwMwm1IwThnC3XfO2VZRJJBN/vYy1MVgVgdT5TPwBWd0ouz+QL7k0jzxAZTW7dIyWqo19MVfgY1q6Iy3QlqMLbUGedaLjyQIuPWv5pVxJ67MYPG+4jK7h9DmDvCnGFBdUs1b0iMPvrj13NbUIuPtjfWqByLlsze/p9lyOnW6aOf53IM7oEQctXo08GfYyEagOSrtqL3k/fHGz1v9BcGHnan0TpbVvlMvnezXNAWqetuRsK0NkuNqkoxLjDDwBK6zfVmJVdn/SMQAxBD4nCnZBRY= x-ms-exchange-transport-forked: True Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: 419.consulting X-MS-Exchange-CrossTenant-Network-Message-Id: 6b141cd4-3f30-4f07-b184-08d72197c7aa X-MS-Exchange-CrossTenant-originalarrivaltime: 15 Aug 2019 15:46:46.9255 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 9c2ced3e-7522-4755-87dc-f983abc66ec3 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: VhwAS3tUCZxSIYsq4CpgLFLmOpRSEFXIdPE/6bN7bB/IcZdcVLZaQZaj1DFyBD5qM7SHJVe9FQj0PeIc69yyw0Q8H9V9mRkyzVpTOxfk46c= X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO2P265MB0861 Archived-At: Subject: Re: [Add] When Two Worlds Collide X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 15:46:54 -0000 T24gQXVnIDE1LCAyMDE5LCBhdCAxNjoyOCwgVGVkIExlbW9uIDxtZWxsb25AZnVndWUuY29tPiB3 cm90ZToNCg0KPiBJIGRvbuKAmXQgdGhpbmsgdGhlcmXigJlzIGFueSBwb2ludCBpbiB0aGlzIChh bmQgSSB3aWxsIHBvaW50IG91dCB0aGF0IHlvdSBkaWQgbm90IG1lbnRpb24gdXNlcnMsIGp1c3Qg SVNQcyANCj4gYW5kIGJyb3dzZXIgdmVuZG9ycykuIMKgIEkgdGhpbmsgd2hhdCBNYXJ0aW4gc2Fp ZCBoZXJlIGV4cGxhaW5zIHdoeSB0aGlzIGlzbuKAmXQgZ29pbmcgdG8gd29yazrCoA0KPiBodHRw czovL21haWxhcmNoaXZlLmlldGYub3JnL2FyY2gvbXNnL2FkZC9Zb3UyVVhaYmpEb2djQVN1cGda VHpqZFlWTXMNCg0KWW91J3JlIHJpZ2h0IHRoYXQgSSBkaWRuJ3QgZXhwbGljaXRseSBtZW50aW9u IHVzZXJzLCBob3dldmVyIEkgd291bGQgaG9wZSB0aGF0IGJvdGggY29tbXVuaXRpZXMgd291bGQg YnJpbmcgdXNlciBwZXJzcGVjdGl2ZXMgaW50byB0aGUgZGlzY3Vzc2lvbiwgYWNjZXB0aW5nIHRo YXQgdGhlaXIgdGFrZXMgYXJlIGxpa2VseSB0byBiZSBxdWl0ZSBkaWZmZXJlbnQgZ2l2ZW4gdGhl IHZlcnkgZGlmZmVyZW50IG5hdHVyZSBvZiB0aGVpciBpbnRlcmFjdGlvbnMgd2l0aCB0aG9zZSB1 c2Vycy4gIE90aGVyIHN0YWtlaG9sZGVyIHZpZXdzIGNvdWxkIGFsc28gYmUgdmVyeSBpbmZvcm1h dGl2ZSBpbiB0aGlzIGRpc2N1c3Npb24gYXMgd2VsbC4gIEZvciBleGFtcGxlLCB0aGUgdmlld3Mg b2YgcmVndWxhdG9ycyB3aWxsIGJlIHJlbGV2YW50IGluIG1hbnkgZ2VvZ3JhcGhpZXMgZ2l2ZW4g dGhhdCBtYW55IElTUHMgYXJvdW5kIHRoZSB3b3JsZCBhcmUgcmVndWxhdGVkIHdoZXJlYXMgbWFu eSB0ZWNoIGNvbXBhbmllcyBhcmUgbm90LCBhdCBsZWFzdCBmb3Igbm93LiAgDQoNCj4gSWYgdGhl cmUgaXMgdXNlZnVsIHdvcmsgdG8gYmUgZG9uZSBoZXJlLCBpdCBpcyBub3QgaW4gZmlndXJpbmcg b3V0IHdoYXQgcnVsZXMgc2hvdWxkIGJlIGZvbGxvd2VkLiDCoA0KPiBXaGF0IHBlb3BsZSB3aWxs IGRvIHdpbGwgYmUgYmFzZWQgb24gdGhlaXIgYmVzdCBpbnRlcmVzdHMsIG5vdCBvbiB3aGF0IHRo ZSBJRVRGIHRlbGxzIHRoZW0gdG8gZG8sIA0KPiBiZWNhdXNlIHRoZXJlIGlzbuKAmXQgYW4gaW50 ZXJvcCBwcm9ibGVtIGhlcmUuIMKgIFdoYXQgd2UgY2FuwqBhbmQgcGVyaGFwcyBzaG91bGTCoGRv IGlzLCBhcyANCj4gTWFydGluIHNhaWQsIGRvIHNvbWUgZGlzcGFzc2lvbmF0ZSBhc3Nlc3NtZW50 IG9mIHRoZSB1c2UgY2FzZXMgYW5kIGhvdyB0aGUgcHJldmFsZW5jZSBvZiA/DQo+IERvSCBjaGFu Z2VzIHRoaW5ncy4NCj4gDQo+IEJ1dCB3ZSBjYW7igJl0IGRvIHRoYXQgYXMgbG9uZyBhcyB0aGlz IGZlZWxzIHRvIHNvbWUgcGFydGljaXBhbnRzIGxpa2UgdGhlIHByb2JsZW0gaXMgdGhhdCB0aGVy ZSANCj4gYXJlIGRpZmZlcmVuY2VzIGluIHdvcmxkdmlldyBiZXR3ZWVuIG9wZXJhdG9ycywgdXNl cnMgYW5kIGJyb3dzZXIgdmVuZG9ycywgYW5kIHRoYXQgd2hhdCANCj4gd2UgbmVlZCB0byBkbyBp cyB0byBjb21lIGludG8gYWxpZ25tZW50IGFib3V0IHdvcmxkdmlld3MuDQoNCkkgZXZpZGVudGx5 IGRpZG4ndCBleHByZXNzIGNsZWFybHkgZW5vdWdoIHdoYXQgSSBtZWFudC4gIEkgYWdyZWUgdGhh dCB0aGVyZSBpcyBubyB2YWx1ZSBpbiB0cnlpbmcgdG8gZmlndXJlIG91dCB3aGF0IHJ1bGVzIHNo b3VsZCBiZSBmb2xsb3dlZCwgSSBkbyBob3dldmVyIHRoaW5rIHRoYXQgdGhlcmUgaXMgdmFsdWUg aW4gc3BlbmRpbmcgdGltZSB0cnlpbmcgdG8gdW5kZXJzdGFuZCBpbiBtb3JlIGRldGFpbCB3aHks IGZvciBleGFtcGxlLCBEb0ggYW5kIHBvc3NpYmx5IG90aGVyIHByb3RvY29scyBhcmUgY2F1c2Ug Zm9yIGNvbmNlcm4gdG8gSVNQcyBhbmQgb3RoZXJzIGZyb20gYW4gb3BlcmF0aW9uYWwgcGVyc3Bl Y3RpdmUgYW5kIGNvbnZlcnNlbHkgd2h5IGJyb3dzZXIgY29tcGFuaWVzIGFuZCBvdGhlcnMgZXZp ZGVudGx5IGZlZWwgc3Ryb25nbHkgdGhhdCBEb0ggcHJvdmlkZXMgY29tcGVsbGluZyBiZW5lZml0 cyBub3QgYXZhaWxhYmxlIHRvIHRoZW0gdmlhIG90aGVyIHByb3RvY29scy4gIA0KDQpJbiBteSBl eHBlcmllbmNlLCBnYWluaW5nIGEgYmV0dGVyIHVuZGVyc3RhbmRpbmcgb2YgYW4gYWx0ZXJuYXRl IHBlcnNwZWN0aXZlLCBhcyBvcHBvc2VkIHRvIGFuIGFsaWdubWVudCwgaXMgb2Z0ZW4gdGhlIHBy ZWN1cnNvciB0byBpZGVudGlmeWluZyBhIHByb2R1Y3RpdmUgd2F5IGZvcndhcmQuICBXaXRob3V0 IHRoYXQgdW5kZXJzdGFuZGluZyB3ZSBjb3VsZCBleHBlbmQgYSBncmVhdCBkZWFsIG9mIHRpbWUg YW5kIGVuZXJneSB3aXRob3V0IG1ha2luZyBhbnkgdXNlZnVsIHByb2dyZXNzLg0KDQogIA0K From nobody Thu Aug 15 08:51:26 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8C5AC1200EB for ; Thu, 15 Aug 2019 08:51:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id f00r0oqRkcTt for ; Thu, 15 Aug 2019 08:51:23 -0700 (PDT) Received: from mail-qk1-x732.google.com (mail-qk1-x732.google.com [IPv6:2607:f8b0:4864:20::732]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 89F7512009C for ; Thu, 15 Aug 2019 08:51:23 -0700 (PDT) Received: by mail-qk1-x732.google.com with SMTP id s145so2186174qke.7 for ; Thu, 15 Aug 2019 08:51:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=5yG75YlATHxfStm1F3LdypJt153Wg1TWNvNP/cMjE1E=; b=xCjrlv1YaA2WP/B2VLSY18325bOVJis99rWcG3myzSjFFXmKD020GVfJwvCR1+UrfA pwBGC0H8I1Ho40SH061hDnZIfT+oYRj8mycfNt/0hXakvRW4ozD7A2IEvhB65eDZM3qR WQeNuVH1gQqXRivEyqO7GZLKA1tungSViFXzdJmR/IjRkiQpQfkfeyEmYsB0v8ZiKeme 1GmHFMR5AzGHveAT62gzt2V3LKshJqUOSlVgMSHTsApx4EHMzhB1n0/Hv1jrJeLj6DhP iL7CIVUZ0QbsTZwJUaLogdoBE3xsT7YWxCtyvucV/9kJYGznpiJjjsgoSg2ZtsKw4E/p 2juQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=5yG75YlATHxfStm1F3LdypJt153Wg1TWNvNP/cMjE1E=; b=iM3vN7gDB1d2lh9wFV4zVtntlVJ5Sa1jKI4ANsjfUU3VIwYOCnmSuyIogIOQumpBxC NwHvXdM5Ux90SoB8VNLUrfwtMxDDWT4nceq/uenZkLKtH6aI2lB/27+mzrc8+esoLVkW Q9/6t1JUGjITggUmH73No6FKGKN9YuvRhLDQ4+L21SY7PmAQIx5MpaKGbXvEy4Vw+BHj zzAdg7AMuEiTyWLDND1K8ZRUYCs/EDDrY/USozE7r0Huxwoa+odld4ZhOGuEgU/2UQZ9 fDnuNQSLhQ74PAN1LQqUosz6HI7OcFQblNbTeF36cM7hByQAqJ66zit2AkTUgjqk1YqF P4tA== X-Gm-Message-State: APjAAAUEEGp6wTMETsrFObg77g2icwzjetal2TzS6H40GQzas7a72IE9 aWhTHsiTpx665S6wmbNE3bwQig== X-Google-Smtp-Source: APXvYqxJNK1pdivkaghCBzmoRMYnSynJvBZzIQZtXYmbA3OGvgQ7PIau9iqMmwtCQtxqD7ogE5Obzg== X-Received: by 2002:a05:620a:130d:: with SMTP id o13mr4835390qkj.285.1565884282729; Thu, 15 Aug 2019 08:51:22 -0700 (PDT) Received: from ?IPv6:2001:470:c1a2:1:9128:e34:f62c:61a4? ([2001:470:c1a2:1:9128:e34:f62c:61a4]) by smtp.gmail.com with ESMTPSA id i5sm1815709qti.0.2019.08.15.08.51.21 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 15 Aug 2019 08:51:21 -0700 (PDT) From: Ted Lemon Message-Id: Content-Type: multipart/alternative; boundary="Apple-Mail=_21F79046-D708-414D-9E0C-03DFF948D049" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Thu, 15 Aug 2019 08:51:19 -0700 In-Reply-To: Cc: Paul Wouters , Andrew Campling , ADD Mailing list To: Ralf Weber References: X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] Use Cases - the coffee shop X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 15:51:26 -0000 --Apple-Mail=_21F79046-D708-414D-9E0C-03DFF948D049 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 On Aug 15, 2019, at 8:46 AM, Ralf Weber wrote: > TBH I=E2=80=99d rather connect to a network that protects me from = malware/ > trojans then one that protects me from porn (Though there is some > relationship there ;-) If you want that, and you want DNS filtering of malware, then the best = way to get that is to know what resolver you are talking to. IOW, = that=E2=80=99s a really clear use case for DoH. If you trust a resolver offered to you over DHCP or RA, you do not get = any assurance that your resolver has this property. --Apple-Mail=_21F79046-D708-414D-9E0C-03DFF948D049 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 On = Aug 15, 2019, at 8:46 AM, Ralf Weber <dns@fl1ger.de> wrote:
TBH I=E2=80=99d rather connect to a network that protects me = from malware/
trojans then = one that protects me from porn (Though there is some
relationship = there ;-)

If= you want that, and you want DNS filtering of malware, then the best way = to get that is to know what resolver you are talking = to.   IOW, that=E2=80=99s a really clear use = case for DoH.

If you trust a resolver offered to you over DHCP or RA, you = do not get any assurance that your resolver has this property.

= --Apple-Mail=_21F79046-D708-414D-9E0C-03DFF948D049-- From nobody Thu Aug 15 08:55:10 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BE2F31200B8 for ; Thu, 15 Aug 2019 08:55:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Bp9ArJPXz6N6 for ; Thu, 15 Aug 2019 08:55:06 -0700 (PDT) Received: from mail-qk1-x736.google.com (mail-qk1-x736.google.com [IPv6:2607:f8b0:4864:20::736]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DCF8F1200B7 for ; Thu, 15 Aug 2019 08:55:05 -0700 (PDT) Received: by mail-qk1-x736.google.com with SMTP id m2so2176409qkd.10 for ; Thu, 15 Aug 2019 08:55:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=6GmyM0z3hU4YC69pBaksLZizPh7s8oepE4d8/WVyzbc=; b=Nelt1M+UGUeLrkJ+bjkbzvBAn2aRH8Ppk73T4ywgKNFB3AoqFL+RtmYROwov5yVHbu Iv9T/bATJMgirTlSxQLMuqjgvOQ0xgYWBkeUB2v8ztx4tJeRU2sCWY9Icgs8cHqm4RQJ WF9MggPt0XawjBomsVHqNlpLU8K1+Bip3y4KBFM5bexN4FL1YJ1yHSjNUzs5u1+ttjpw GR4RRbA8KtMaJnv/RvcOhbEwFF9ia9k4yox/2liqqccIbVYoQeAq48msANzFsmsW58Lo KAHIdv8UGmPVW/GPaEcuXtVefcGmn4csFrMXyG7d6vwRqrODNJ3tttJDaOot2RGSeWuB 40uA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=6GmyM0z3hU4YC69pBaksLZizPh7s8oepE4d8/WVyzbc=; b=DAKUaWAyA7429WQAgzeP/qLYFa5Tm+hDFn87SW3iw2T4wnlrPCW/ZfXBApZmgFo1ol MBI0di7Z1RlJ9i1pIdQkBKLZZnEJsVXmuTowShuFmlUk806G+OOpd6p0a4MBDmPCFW08 cUJwLpDnI82CuDEs1hALBYyo4QeemTQCKy1ffpv8lxpzebE7dXerQqECQPSPcL0+FpsS 9wSo1Kx2OZGp4RWh7mW3/ETkRSjyRQ4IV5EI667oAC4dG7vrJq/dUK4Xh4on7Sq2c/gh PEVlfjRYA+P6aCimFkt5Y6WLvjYmcMDui4U3sQ+NYlj+lRnOheAP7owq4cEUX+BXRxPp Qs+w== X-Gm-Message-State: APjAAAU8BiMlUtP0ZcJjANGfyFiNT+2AeQsMD7YmvosZZ2HhsWBZLuLV mn2ynJJSPRK5XGpm7r9HhBnlKw== X-Google-Smtp-Source: APXvYqx5wYuIM8zff24jqUV4D/skWHihLlUv5Anwsk/s3ikI/k8i8LhKxPGksNatxf5OEfz8dyKK2A== X-Received: by 2002:a37:270a:: with SMTP id n10mr4672848qkn.434.1565884504874; Thu, 15 Aug 2019 08:55:04 -0700 (PDT) Received: from ?IPv6:2001:470:c1a2:1:9128:e34:f62c:61a4? ([2001:470:c1a2:1:9128:e34:f62c:61a4]) by smtp.gmail.com with ESMTPSA id 131sm1675316qkn.7.2019.08.15.08.55.04 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 15 Aug 2019 08:55:04 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) From: Ted Lemon In-Reply-To: Date: Thu, 15 Aug 2019 08:55:02 -0700 Cc: ADD Mailing list Content-Transfer-Encoding: quoted-printable Message-Id: <039B96FE-8A88-4FD7-B3E9-CBBE3F590CDC@fugue.com> References: To: Andrew Campling X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] When Two Worlds Collide X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 15:55:09 -0000 On Aug 15, 2019, at 8:46 AM, Andrew Campling = wrote: > I evidently didn't express clearly enough what I meant. I agree that = there is no value in trying to figure out what rules should be followed, = I do however think that there is value in spending time trying to = understand in more detail why, for example, DoH and possibly other = protocols are cause for concern to ISPs and others from an operational = perspective and conversely why browser companies and others evidently = feel strongly that DoH provides compelling benefits not available to = them via other protocols. =20 Right, this is what I mean. There is no lack of clarity in any of the = people here who are proponents of DoH in terms of what its impact is on = service providers. We do not think =E2=80=9Cla li lu, DoH causes no = problems.=E2=80=9D We all understand that DoH causes problems. I = doubt there is any disagreement at all on what problems DoH causes for = SPs. So it would be pointless to have a conversation about that. E.g., if you look at this message from Bret: = https://mailarchive.ietf.org/arch/msg/add/wRRmJKwg1Nie_NfBlPLt_c31y8k There is nothing in here that I disagree with. All of these are real = concerns. If you look at Martin=E2=80=99s message that I quoted, he = reflects back other concerns that have been raised here by operators and = agrees that they are valid concerns. So the problem is not that we = need to understand in more detail why Doh is causing concern for ISPs = and others. From nobody Thu Aug 15 08:55:56 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8EDBE1200B8 for ; Thu, 15 Aug 2019 08:55:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=swm.pp.se Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6I8AC-CEHGP0 for ; Thu, 15 Aug 2019 08:55:52 -0700 (PDT) Received: from uplift.swm.pp.se (ipv6.swm.pp.se [IPv6:2a00:801::f]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8E9E51200B7 for ; Thu, 15 Aug 2019 08:55:52 -0700 (PDT) Received: by uplift.swm.pp.se (Postfix, from userid 501) id A8895AF; Thu, 15 Aug 2019 17:55:50 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=swm.pp.se; s=mail; t=1565884550; bh=gITZGpxzurjRtD8Wf60wc7Fw+oAoLuEeYYTsdYd/z4g=; h=Date:From:To:cc:Subject:In-Reply-To:References:From; b=fAlxiIKJMHqYYmmuWsRSC4KMuUjE4ppRKYQHUJPeQG3MTqn33YqCRpOJzeVD8v3gA 3/1/yEkCi2Bvct9AJr91rJRXiI7dHaWieTh18eLzTF6m1NleqViajv+TM+NQUa9k+d 1+aJTgn+XRTUufvIXfpTHvBZ/gNvyjqPRsLy9v4s= Received: from localhost (localhost [127.0.0.1]) by uplift.swm.pp.se (Postfix) with ESMTP id A61E39F; Thu, 15 Aug 2019 17:55:50 +0200 (CEST) Date: Thu, 15 Aug 2019 17:55:50 +0200 (CEST) From: Mikael Abrahamsson To: Ted Lemon cc: Paul Wouters , ADD Mailing list In-Reply-To: Message-ID: References: <2D09D61DDFA73D4C884805CC7865E6114E2757F0@GAALPA1MSGUSRBF.ITServices.sbc.com> User-Agent: Alpine 2.20 (DEB 67 2015-01-07) Organization: People's Front Against WWW MIME-Version: 1.0 Content-Type: multipart/mixed; BOUNDARY="-137064504-1843722886-1565884550=:21548" Archived-At: Subject: Re: [Add] Use Cases - the coffee shop X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 15:55:55 -0000 This message is in MIME format. The first part should be readable text, while the remaining parts are likely unreadable without MIME-aware tools. ---137064504-1843722886-1565884550=:21548 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8BIT On Thu, 15 Aug 2019, Ted Lemon wrote: > problem, because there’s no definitive registry for SSIDs. I honestly > can’t think of a secure way to do this that doesn’t involve the IT > department installing certs on the host, at which point there’s no need > for a UI. So just because it can't be made 100% sure and fool-proof, let's just change the default in browsers to use CF/GOOG for all browser users? This is the tradeoff I am opposed to. This is the crux of the problem. There is no way to technically decide if the network can be trusted or not (we agree on that), now what? We can also agree that asking the user is a bad thing. But is the solution really to change the default resolver path? Is this the least harmful way? That is the important question to ask ourselves. This is where we have disagreement. What is the sensible default? Follow the operating system (as has been the case for 20+ years), or change it. Changing it has consequences, keeping it the way it has always been has consequences. Which one is the least bad? How do we come up with a compromise that everybody can live with? -- Mikael Abrahamsson email: swmike@swm.pp.se ---137064504-1843722886-1565884550=:21548-- From nobody Thu Aug 15 09:02:44 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7512A1200F9 for ; Thu, 15 Aug 2019 09:02:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 870hmqUGT6DU for ; Thu, 15 Aug 2019 09:02:36 -0700 (PDT) Received: from mail-qt1-x829.google.com (mail-qt1-x829.google.com [IPv6:2607:f8b0:4864:20::829]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 44A151200F4 for ; Thu, 15 Aug 2019 09:02:23 -0700 (PDT) Received: by mail-qt1-x829.google.com with SMTP id u34so2882275qte.2 for ; Thu, 15 Aug 2019 09:02:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=itHSykGRP5rOulUd7OjrjKRzVv2fXo40Brj6BRxgKgI=; b=KASlhOdj47ZKWEdcg/EUvoZM7mDg075W1JrasAYx2h6U2hIRt+QDL/ut3e79b5XQjq JkUkC+lyrx9znSlC2MPenXQizCXuk4aAVYTrpSi4tl98ABbuhGbVWX0W8P+9pqSMyNgs iy+zUyWV+wUYpf6fbJpMDnpO2wsQiCCijCTP2Giu4qv4f3AnZvLqAWrY0ls2Usxk1oYS SzPliJ9uGmZ170+fTLOEwFuOoE5+5EYzKbEGw5QhvDEXE6BlyBSGl/SP0sGbPk6PiwNw uaxKcp6Pr8Pcss+1dIF8JJXs3v98+7atzagn73w4tRD04BOaGGgFpD1xcA3h3r68+zT+ 77HQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=itHSykGRP5rOulUd7OjrjKRzVv2fXo40Brj6BRxgKgI=; b=XNWx6rZR0ydp8ZKz46rbqTUpnpH9/rwYU65M2JjDBR/+koegzanXKj4aMI1D7MfmL3 +ZFgbprKN40DgIr5tM3kQG2Ax0/Uogsalzpkn18OTYi0nnea4hG3QYksMghdUwHa7Uh3 lQDMepJklA2EhdPaLE6GsI+mgzwIa6KvSBnMFUsW8iquQbQfZNgUO7HI7tSOmvK4E/mS Zd/O4CvDbNKHmcKpZaNHgSz9i4o2o4XSylRa0mBKXLrymvJZfH63stwWuvols7gyUNkZ OzySb+j2y2VJ9xva2Kpwmd3eiVE0dpJD22936ehbO4H3mD3Zp1CixBMbA55UJ63QFgeS 1ioA== X-Gm-Message-State: APjAAAWUDf4YyLGrievtmMzH2oVSi8NAZLw1bhl++8wJIMjDsJY0SGaJ 8UKOZtBx7pUEiNPcGhdJR3zXpjwA2iw= X-Google-Smtp-Source: APXvYqzFfrpEMA8xL/9iMtN823yygb1aIZcTTyE1RrgcMOrgBSeROMSJ1suqlSWrFlty8BgbdZCmlQ== X-Received: by 2002:ac8:7499:: with SMTP id v25mr4180582qtq.212.1565884941941; Thu, 15 Aug 2019 09:02:21 -0700 (PDT) Received: from [192.168.2.18] (cpe-76-179-66-50.maine.res.rr.com. [76.179.66.50]) by smtp.gmail.com with ESMTPSA id h2sm1564143qto.81.2019.08.15.09.02.21 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 15 Aug 2019 09:02:21 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (1.0) From: Brian Dickson X-Mailer: iPhone Mail (16G77) In-Reply-To: Date: Thu, 15 Aug 2019 12:02:20 -0400 Cc: Andrew Campling , ADD Mailing list Content-Transfer-Encoding: quoted-printable Message-Id: <04866029-F45D-48CA-9484-BD0A08C0AC8B@gmail.com> References: To: Paul Wouters Archived-At: Subject: Re: [Add] Use Cases - the coffee shop X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 16:02:43 -0000 Top-reply addressing some of Paul W=E2=80=99s arguments: - My recent experience with public Wi-Fi has been mixed. Many offer =E2=80=9C= open=E2=80=9D SSIDs (no lock symbol, no password required) with captive port= als of some flavor. I would not agree with the expectation of privacy for th= ose. Nor would I expect any containerization. - Given the previous bullet point, I believe it is reasonable for operators o= f those networks to limit their liability on customer vs customer traffic (e= g malware) by use of DNS-based filters or other filter mechanisms. The same a= pplies to community standards on content (porn etc). IMHO, liability trumps u= ser choice, which is why there are Ts and Ca, whether or not the users pay a= ttention to them. The definition I=E2=80=99d use for =E2=80=9Ccoffee shop=E2=80=9D is =E2=80=9C= not the user=E2=80=99s primary ISP=E2=80=9D. Where there may be some kind of= purchased service for access (eg GoGo or similar), I would expect some expl= icit TOS covering relevant expectations. Network neutrality is, unfortunately, a localized (possibly geo-political in= nature or subject to corruption) thing. Violating TOS and or jurisdiction-specific laws should not be done on a user= =E2=80=99s behalf, IMHO. Paul may choose to do so, but if he does, any risk a= ssociated with that is his responsibility, as it should be. The sentiment that something =E2=80=9Cshould be illegal=E2=80=9D, does not c= hange the legality of that thing. Whether =E2=80=9Cit is fine=E2=80=9D to wo= rk around that is both questionable logic and very likely something that dif= fers significantly by jurisdiction. My point is basically, unless the network is owned by you or is a permanent p= rovider to you (with well defined contract etc), the network owner is entire= ly justified in operating the network however they wish, and using a network= , whether =E2=80=9Coffered to the public=E2=80=9D or to a more restricted se= t of users (eg hotel guests), is basically a proposition of accept the terms= as-is, or don=E2=80=99t use it. That can range from allowing anything at al= l, to requiring use of their broken DNS proxy, to blocking all HTTPS and doi= ng horrible things to the remaining traffic. Unfettered Internet access is n= ot yet a universal right. It doesn=E2=80=99t mean I like some of these things, or agree with these pra= ctices in general. I=E2=80=99m pointing out that legal stuff at a per-jurisd= iction level, may not be compatible with DoH, regardless of who controls the= enabling or disabling, which makes compliance and informed user consent a h= uge issue. IMHO that should be a barrier to deployment of DoH in browsers, b= ut that is likely a choice that browser vendors and customers both need to c= onsider. Brian Sent from my iPhone > On Aug 15, 2019, at 11:05 AM, Paul Wouters wrote: >=20 > On Thu, 15 Aug 2019, Andrew Campling wrote: >=20 >>> What if the coffee shop is just using a crappy dns proxy that mangles dn= ssec messages? >>=20 >> I believe the point still stands. You have the option of taking your bus= iness elsewhere or, if the coffee really is that good, accepting the network= compromises in order to consume it. Changing the way the whole internet ec= osystem works in order for you to circumvent the network rules of our hypoth= etical coffee shop so that it works to your liking feels like a wholly dispr= oportionate response with likely unintended and unknown consequences. >=20 > I strongly disgree with the "agreement" between user and coffeeshop. >=20 > There is an expectation by the user that once authenticated to the > hotspot, that the user can then more or less send/receive whatever > they want. Sure there are some limitations based on sharing the > bandwidth, and prevention of certain websites (eg porn) that would > negatively affect other customers. But the user may totally corrupt > their own device by downloading malicious content. >=20 > And there is still an expectation of privacy (eg when reading email, > when browsing sites) that a coffeeshop owner cannot just claim that they > do not apply because you are a guest and you can choose not to connect. >=20 > Furthermore, the main "issue" with DoH is that it bypasses protection > offered by the network to the enduser. Well, in this case, the user > clearly opts out of that "protection", and since coffeeshop users these > days are always containerized, so their traffic cannot reach any other > users of the coffeeshop/hotel, there is zero risk to the other users. So > there are zero resaons not to give the coffeeshop / hotel enduser that > freedom (or rather, give the user an "uncensored internet") >=20 > If you say the coffeeshop / hotel as an ISP has the right to filter any > of your traffic, I don't see why that would not apply to DSL or LTE > based ISPs. That would be the end of net neutrality and the start of > commercial (not government) censorship. I have already experienced that a > large hotel chain would prevent access to booking.com or kayak.com and > those practicises should be illegal and it is fine to work around that > with DoH. >=20 > Paul >=20 > --=20 > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add From nobody Thu Aug 15 09:03:32 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1357312011F for ; Thu, 15 Aug 2019 09:03:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ACbvO6Gy9T-7 for ; Thu, 15 Aug 2019 09:03:28 -0700 (PDT) Received: from smtp.guxx.net (nyx.guxx.net [85.10.208.173]) by ietfa.amsl.com (Postfix) with ESMTP id D979B1200EB for ; Thu, 15 Aug 2019 09:03:20 -0700 (PDT) Received: by nyx.guxx.net (Postfix, from userid 107) id 973F45F42D50; Thu, 15 Aug 2019 18:03:19 +0200 (CEST) Received: from [172.19.152.108] (p54B8ABDF.dip0.t-ipconnect.de [84.184.171.223]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by nyx.guxx.net (Postfix) with ESMTPSA id 78F2E5F42335; Thu, 15 Aug 2019 18:03:18 +0200 (CEST) From: "Ralf Weber" To: "Ted Lemon" Cc: "Paul Wouters" , "Andrew Campling" , "ADD Mailing list" Date: Thu, 15 Aug 2019 18:03:17 +0200 X-Mailer: MailMate (1.12.5r5635) Message-ID: <1311E18B-0B6F-482A-9C51-B2741D6666CA@fl1ger.de> In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [Add] Use Cases - the coffee shop X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 16:03:30 -0000 Moin! On 15 Aug 2019, at 17:51, Ted Lemon wrote: > On Aug 15, 2019, at 8:46 AM, Ralf Weber wrote: >> TBH I’d rather connect to a network that protects me from malware/ >> trojans then one that protects me from porn (Though there is some >> relationship there ;-) > > If you want that, and you want DNS filtering of malware, then the best > way to get that is to know what resolver you are talking to. IOW, > that’s a really clear use case for DoH. I was making the point on what people are ok with when it comes to DNS servers, but I can agree that we should work on making DNS server setup more secure and capabilities more known. I believe there is work in dnsop on that at the moment (draft-sah-resolver-information). > If you trust a resolver offered to you over DHCP or RA, you do not get > any assurance that your resolver has this property. There are ways to protect against rouge RA/DHCP on network devices, but I agree it is an attack vector. So long -Ralf —-- Ralf Weber From nobody Thu Aug 15 09:09:17 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 91F6D1200C1 for ; Thu, 15 Aug 2019 09:09:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2zlQKj2RgLaw for ; Thu, 15 Aug 2019 09:09:09 -0700 (PDT) Received: from mail-qt1-x82c.google.com (mail-qt1-x82c.google.com [IPv6:2607:f8b0:4864:20::82c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 091C61200B7 for ; Thu, 15 Aug 2019 09:09:09 -0700 (PDT) Received: by mail-qt1-x82c.google.com with SMTP id 44so2847365qtg.11 for ; Thu, 15 Aug 2019 09:09:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=BMlZPXaAbGaxCuXUxxWRKQPAl+miiprqKmhSTyFWhgg=; b=y3QtE0RrIuEmYaHBYmbjV82SKCPo3zcuh8dvU0bO+/BCgC2wKjUAGPLQ68sOh2/Uj9 y+KjblAmW6nzctZU1a9OIKbXp6xV/Zw4brixSQ3E9+Tr8RJ+fP6yrxz3SUGJ2Fl+4la7 YNQLLLczUyRTv378zPasteTuu5APpVVQqNjsnC/bfiFYRMjmMrFPE9EdhOw4mAs7KRhB 7iU16zBQwIyJREr3t1DgAue+/K8A0F/U/bVgQgay7e2VZIsfcaMwI/rV6L3qzEryDUcS Cr868j6vSkB43jLwtxLdY1/s/ihWbjLVEUYm9rckWUv4GXi8v26ldtpG1eYhRQoPpnWf 7ahg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=BMlZPXaAbGaxCuXUxxWRKQPAl+miiprqKmhSTyFWhgg=; b=E2dL2jS8vq3faCgQq3QiHQkEhO6BCNOkQmKk1Gwl97+PkLgWWtWwGRo15VyRV4Ikze dtXQ2De3JJbDKMoJDPGfSGgE2n1x8gCOH7hBldBIT0goVmSZLJkz6HS1y13ysTpvCUdh +I6q3cIz9q2ViV2J5PeldPy6iSjFCd5HAAQWzAFKq4qUMQMszfo7t7AcpQ+SCsP8Y6f1 uhfnV1yD6hYfsn6f3iihp8VWurpDUWIwwgq1eZ7QXWWYFyZ6bt1BcJiPh8vhOKE4DCzH VDa53ntk8ii2iAXHK29sA/j6bs17EvLElhGcu/FroExFyx+uhBKHKvvPpCt/ypFsAS5W jkPg== X-Gm-Message-State: APjAAAXnClLHGRKKHhx99yR+sii/o2ymHRL7/Uou+oVabmx1GpCtyBtO srgnX0KVWdb/rH4RFWzhZnovCg== X-Google-Smtp-Source: APXvYqzWXaKUlhNFNSo5H9ukfSLAgxhcEyX9MVME233R3RaG+2jmyoDNTSC4Cm24sZBhQamojJtAmw== X-Received: by 2002:ac8:45d0:: with SMTP id e16mr4480180qto.337.1565885348095; Thu, 15 Aug 2019 09:09:08 -0700 (PDT) Received: from ?IPv6:2001:470:c1a2:1:9128:e34:f62c:61a4? ([2001:470:c1a2:1:9128:e34:f62c:61a4]) by smtp.gmail.com with ESMTPSA id b13sm1680134qtk.55.2019.08.15.09.09.07 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 15 Aug 2019 09:09:07 -0700 (PDT) From: Ted Lemon Message-Id: <88896553-D642-43ED-873D-5E963B875B06@fugue.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_67036C8B-FBAB-4B02-A986-20F7A85A6A22" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Thu, 15 Aug 2019 09:09:05 -0700 In-Reply-To: <1311E18B-0B6F-482A-9C51-B2741D6666CA@fl1ger.de> Cc: Paul Wouters , Andrew Campling , ADD Mailing list To: Ralf Weber References: <1311E18B-0B6F-482A-9C51-B2741D6666CA@fl1ger.de> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] Use Cases - the coffee shop X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 16:09:16 -0000 --Apple-Mail=_67036C8B-FBAB-4B02-A986-20F7A85A6A22 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 On Aug 15, 2019, at 9:03 AM, Ralf Weber wrote: > There are ways to protect against rouge RA/DHCP on network devices, = but I agree it is an attack vector. The point is, whatever network you are on, unless you know who operates = it and have some reasonable basis for trusting their puissance at = defending you, you must assume that the resolver will attack you, and = the DHCP server will attack you, and the RAs will attack you, because = none of them are authenticated. If your strategy for configuring your = box places trust in any of these services, you are at risk. As the end = user, or as the browser vendor, I have no knowledge of who is running = the network to which I am connected at this moment, so I can=E2=80=99t = make assumptions about how trustworthy it is. --Apple-Mail=_67036C8B-FBAB-4B02-A986-20F7A85A6A22 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 On = Aug 15, 2019, at 9:03 AM, Ralf Weber <dns@fl1ger.de> wrote:
There are ways to protect against rouge RA/DHCP on network = devices, but I agree it is an attack vector.

The point is, whatever network you are on, unless you know = who operates it and have some reasonable basis for trusting their = puissance at defending you, you must assume that the resolver will = attack you, and the DHCP server will attack you, and the RAs will attack = you, because none of them are authenticated.   If your strategy for = configuring your box places trust in any of these services, you are at = risk.   As the end user, or as the browser vendor, I have no = knowledge of who is running the network to which I am connected at this = moment, so I can=E2=80=99t make assumptions about how trustworthy it = is.

= --Apple-Mail=_67036C8B-FBAB-4B02-A986-20F7A85A6A22-- From nobody Thu Aug 15 09:11:23 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D31AE1200CD for ; Thu, 15 Aug 2019 09:11:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jW4cTfcovjmJ for ; Thu, 15 Aug 2019 09:11:17 -0700 (PDT) Received: from mail-qk1-x729.google.com (mail-qk1-x729.google.com [IPv6:2607:f8b0:4864:20::729]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9FABE1200DE for ; Thu, 15 Aug 2019 09:11:17 -0700 (PDT) Received: by mail-qk1-x729.google.com with SMTP id p13so2203850qkg.13 for ; Thu, 15 Aug 2019 09:11:17 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=q6H2/XPWB/pUaEjFS254f52gcxFqP09e141vlayCcCI=; b=hlTtQETqwHZI5UPB1kZDlhlB7k/uu+rT7vlQ1KLDT69Kj+ZQuvkXnaUJJOcYubyZu4 76rjLsuAtYJxzfjhRGQ84lzy5J5rPGVIbGIdy5UgpGsRwNrpDrtz27fzvk+QIH3Ciuix /u9BvP6jShEn0IXBvm3606+d17q7n4MpNDwlTuOYNeCt06Bb2q8Amv2eYH49sOgYU6HX OzP/eI7XRVgbRuabqBD1jQ8rL0izHVdDQj+azyHDaJ83g6qhtu4Zw5a5STyHznNcoA7f N8I0oCmt6Ajv7p6XzaNJLLBQ2U1uZPu03H0EzVvgGze4c792T6TyPp8KOpyn8VdpagZ+ TNaw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=q6H2/XPWB/pUaEjFS254f52gcxFqP09e141vlayCcCI=; b=VHGy8s+riXhBghx/jyk9YboHyIe7j5Gzg0WDWSSdbPD6mvtDJhWb7rpN2cz7OrYRvm BdNRtn1s9gSuML/NasR9CoFRUrfP7DG2qcEDG17azRQkTHGQXh17FZw9VHjb0SbNUAVQ VodG1E+TvU3srTtUjiMufsZZWIAiVvl/owvn7G0M5SOx1c6yT2Ag092q9J0Jb90KKX8y SqvrCaC1NCHe4UOS3qbfdXhG72DZom1mWlnilzlhwiWyB5i+PvkdtgO8iXm8677DVCHB cHqGBBtcbF2iNcl05fY1KFcgvv4RhShIuwz5By0ruv9ZlO5aYIwGg1ICzjPSW8uyj2DL 7zZA== X-Gm-Message-State: APjAAAVEuh1RIvbbw16V4IefCLcuVpipThiINo94uxf71P7gytihf3bz uuALwbQHphT5TdE+FvcNgQUOiQ== X-Google-Smtp-Source: APXvYqwHhjoah2qSdnxKpeGGtwAy9PlAfNUnUZNtasktgT5M1U9uafjKb//K0BmhwiZ7lyhrjr0WdA== X-Received: by 2002:a37:4cd3:: with SMTP id z202mr4772716qka.203.1565885476713; Thu, 15 Aug 2019 09:11:16 -0700 (PDT) Received: from ?IPv6:2001:470:c1a2:1:9128:e34:f62c:61a4? ([2001:470:c1a2:1:9128:e34:f62c:61a4]) by smtp.gmail.com with ESMTPSA id 143sm1645055qkl.114.2019.08.15.09.11.15 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 15 Aug 2019 09:11:16 -0700 (PDT) From: Ted Lemon Message-Id: <16CB08F9-97A0-479E-A176-0F50A7CD22F7@fugue.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_3C9AA897-4E28-4CA1-A7A7-0203099B6873" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Thu, 15 Aug 2019 09:11:13 -0700 In-Reply-To: <04866029-F45D-48CA-9484-BD0A08C0AC8B@gmail.com> Cc: Paul Wouters , Andrew Campling , ADD Mailing list To: Brian Dickson References: <04866029-F45D-48CA-9484-BD0A08C0AC8B@gmail.com> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] Use Cases - the coffee shop X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 16:11:21 -0000 --Apple-Mail=_3C9AA897-4E28-4CA1-A7A7-0203099B6873 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 On Aug 15, 2019, at 9:02 AM, Brian Dickson = wrote: > - Given the previous bullet point, I believe it is reasonable for = operators of those networks to limit their liability on customer vs = customer traffic (eg malware) by use of DNS-based filters or other = filter mechanisms. This isn=E2=80=99t a valid assumption. Depending on jurisdiction, this = action may protect you from liability, but it may also expose you to = liability. Similarly, depending on the jurisdiction, the user may be more = accountable, or less accountable, if they are using software that has = default behavior that happens to be in violation of the ToS. We really aren=E2=80=99t in a position to give advice about this. --Apple-Mail=_3C9AA897-4E28-4CA1-A7A7-0203099B6873 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 On = Aug 15, 2019, at 9:02 AM, Brian Dickson <brian.peter.dickson@gmail.com> wrote:
- Given the previous bullet point, I believe it is reasonable = for operators of those networks to limit their liability on customer vs = customer traffic (eg malware) by use of DNS-based filters or other = filter mechanisms.

This isn=E2=80=99t a valid assumption.  Depending on = jurisdiction, this action may protect you from liability, but it may = also expose you to liability.

Similarly, depending on the jurisdiction, the user may be = more accountable, or less accountable, if they are using software that = has default behavior that happens to be in violation of the = ToS.

We really = aren=E2=80=99t in a position to give advice about this.

= --Apple-Mail=_3C9AA897-4E28-4CA1-A7A7-0203099B6873-- From nobody Thu Aug 15 09:19:09 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 82BA31200BA for ; Thu, 15 Aug 2019 09:19:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=hopcount.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qI3OBFejeZI9 for ; Thu, 15 Aug 2019 09:19:05 -0700 (PDT) Received: from mail-io1-xd35.google.com (mail-io1-xd35.google.com [IPv6:2607:f8b0:4864:20::d35]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B04641200B8 for ; Thu, 15 Aug 2019 09:19:05 -0700 (PDT) Received: by mail-io1-xd35.google.com with SMTP id e20so249408iob.9 for ; Thu, 15 Aug 2019 09:19:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hopcount.ca; s=google; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=t9RuYSkcg0WPr8xTvmPiNnQNmHfIZPwkOoNau6FTxZw=; b=CGkNNJOHT2YGYhYfm1n/hdPZKouivVbtDZWSTL9u6Z2m4M6SKGximm54frT5xKN5pG L9Lxf18q2lnFL5oh8tXHS1IlU9YvPFySA0Ux0nszbr2777qFUTPWPTjAnQvPP0U4M7mP 5vHn+jiTQggOiWKOYlk495M5YywKJk2UDRskg= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=t9RuYSkcg0WPr8xTvmPiNnQNmHfIZPwkOoNau6FTxZw=; b=g7IhGV1BKXlh+xAIKgbNhLlNIbOo8oEGyQT9mAE3sPL74GAHLAu5ZKCJsRtuliFmf8 SEw1uyJjRoZYpNpsPLrqIr98IkztatkT8H6k2mi6ba2ojGPdFc2EQQZgsOcyObXFG5A7 VPLu4lkQofS56MtRkB7sweml8+zeJkXh2c7GwusXhlvT05LJnJN40H5TG7Yo8twLXOep h/EQ1aROmKfUvOmE2WBBF+w+k7+SbIbcuj9tdJDz1YGmGkmJ3mJZ7ZirT9rUR6CvAMrM AkWlw/J8z0SA23fT06s+VnTQOcBWbjP1TXUvgCewM5jpVkQAOs0/YZo17qRw1XNBRNsh P28g== X-Gm-Message-State: APjAAAXQeUiplv9daFfJb/m07X6eA2q/jzKa0P5jODYQNB8bGeJVcp1H 8dzLz01AIWayxaRIcQDZW7+2Sg== X-Google-Smtp-Source: APXvYqyqfLo8R4OOMJV2Pyc881EQJpesPTj1Pq+kJ83TYAR7h0PePgxItf9QvdxrS1UyZRhlvBTTig== X-Received: by 2002:a5e:9818:: with SMTP id s24mr4237594ioj.0.1565885944732; Thu, 15 Aug 2019 09:19:04 -0700 (PDT) Received: from [192.168.1.50] (24-246-23-138.cable.teksavvy.com. [24.246.23.138]) by smtp.gmail.com with ESMTPSA id x11sm5261973ioh.87.2019.08.15.09.19.02 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 15 Aug 2019 09:19:03 -0700 (PDT) From: Joe Abley Message-Id: <3DEACC72-50D9-410F-B4D1-4316784A5B72@hopcount.ca> Content-Type: multipart/signed; boundary="Apple-Mail=_2F7403CC-00ED-426B-8C16-A5198A140124"; protocol="application/pgp-signature"; micalg=pgp-sha1 Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Thu, 15 Aug 2019 12:19:01 -0400 In-Reply-To: Cc: Mikael Abrahamsson , Paul Wouters , ADD Mailing list To: Ted Lemon References: <2D09D61DDFA73D4C884805CC7865E6114E2757F0@GAALPA1MSGUSRBF.ITServices.sbc.com> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] Use Cases - the coffee shop X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 16:19:07 -0000 --Apple-Mail=_2F7403CC-00ED-426B-8C16-A5198A140124 Content-Type: multipart/alternative; boundary="Apple-Mail=_CD222A2E-DFDC-4142-A1A4-FA40492A2CE1" --Apple-Mail=_CD222A2E-DFDC-4142-A1A4-FA40492A2CE1 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 > On 15 Aug 2019, at 11:46, Ted Lemon wrote: >=20 > On Aug 15, 2019, at 8:39 AM, Mikael Abrahamsson > wrote: >> Does this mean you think what MS is doing in Windows at network = connect (first time, regarding the public/private wifi) is the wrong = thing to do? >=20 > That was bad too, yes. How does the user know? What will happen if = they say =E2=80=9Cpublic=E2=80=9D? What will happen if they say = =E2=80=9Cprivate?=E2=80=9D For what it's worth (not very much!) the small number of times I have = seen this kind of question it has just made me mildly uncomfortable and = I have not known how to answer. I think the only reasonable security posture in general is to assume = that all networks are hostile. I don't know how "public" and "private" = maps to that, and I can't look up what implications the decision has = without making a guess to get connected to search. Joe --Apple-Mail=_CD222A2E-DFDC-4142-A1A4-FA40492A2CE1 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8

On 15 Aug 2019, at 11:46, Ted Lemon <mellon@fugue.com> = wrote:

On Aug 15, 2019, at = 8:39 AM, Mikael Abrahamsson <swmike@swm.pp.se> wrote:
Does this mean you think what MS is doing in Windows at = network connect (first time, regarding the public/private wifi) is the = wrong thing to do?

That was bad too, yes.   How does the = user know?   What will happen if they say =E2=80=9Cpublic=E2=80=9D? =   What will happen if they say = =E2=80=9Cprivate?=E2=80=9D

For what it's worth (not very much!) the small = number of times I have seen this kind of question it has just made me = mildly uncomfortable and I have not known how to answer.

I think the only reasonable security posture in = general is to assume that all networks are hostile. I don't know how = "public" and "private" maps to that, and I can't look up what = implications the decision has without making a guess to get connected to = search.


Joe

= --Apple-Mail=_CD222A2E-DFDC-4142-A1A4-FA40492A2CE1-- --Apple-Mail=_2F7403CC-00ED-426B-8C16-A5198A140124 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iF0EARECAB0WIQSAt40QkiztAcvphdg0jwy9hlI6LAUCXVWF9QAKCRA0jwy9hlI6 LIZnAKCio9sdhx5xnLwP2RyLKPJDxgo46QCeO/VsG99T9aTft+bOl67vFp1Iu9c= =0S3U -----END PGP SIGNATURE----- --Apple-Mail=_2F7403CC-00ED-426B-8C16-A5198A140124-- From nobody Thu Aug 15 09:26:02 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6000C120106 for ; Thu, 15 Aug 2019 09:26:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=swm.pp.se Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id J8AGx8aMAXSD for ; Thu, 15 Aug 2019 09:25:58 -0700 (PDT) Received: from uplift.swm.pp.se (swm.pp.se [212.247.200.143]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1AB4E120105 for ; Thu, 15 Aug 2019 09:25:58 -0700 (PDT) Received: by uplift.swm.pp.se (Postfix, from userid 501) id D2F76BB; Thu, 15 Aug 2019 18:25:54 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=swm.pp.se; s=mail; t=1565886354; bh=aZwXD7dBQBBQElJ0ha33qqKyPbtJr9VNdRMJlYArgjo=; h=Date:From:To:cc:Subject:In-Reply-To:References:From; b=zW0lktwzRkQJjYLlVnCO7dhFSCPrlnX4zGg46yLXXxCbg7mSNxzy6922Evw4dftjw d0lfnvsM3x7EL/vaRSxsiP3GOcUFJbZhyMovwVwXlWTCc7G4EBlVBd+nT1MDXA4n9d 3up0HE4s/w7S5xf+2sxyTtNjY3JACRrm3GdLPci4= Received: from localhost (localhost [127.0.0.1]) by uplift.swm.pp.se (Postfix) with ESMTP id D13819F; Thu, 15 Aug 2019 18:25:54 +0200 (CEST) Date: Thu, 15 Aug 2019 18:25:54 +0200 (CEST) From: Mikael Abrahamsson To: Joe Abley cc: Ted Lemon , Paul Wouters , ADD Mailing list In-Reply-To: <3DEACC72-50D9-410F-B4D1-4316784A5B72@hopcount.ca> Message-ID: References: <2D09D61DDFA73D4C884805CC7865E6114E2757F0@GAALPA1MSGUSRBF.ITServices.sbc.com> <3DEACC72-50D9-410F-B4D1-4316784A5B72@hopcount.ca> User-Agent: Alpine 2.20 (DEB 67 2015-01-07) Organization: People's Front Against WWW MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII; format=flowed Archived-At: Subject: Re: [Add] Use Cases - the coffee shop X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 16:26:01 -0000 On Thu, 15 Aug 2019, Joe Abley wrote: > For what it's worth (not very much!) the small number of times I have > seen this kind of question it has just made me mildly uncomfortable and > I have not known how to answer. https://www.howtogeek.com/245982/whats-the-difference-between-private-and-public-networks-in-windows/ To me it seems MS has done a good job in trying to explain this to the user. I'd imagine they didn't do this lightly and had considerable research to base their user prompt on and what it contained. -- Mikael Abrahamsson email: swmike@swm.pp.se From nobody Thu Aug 15 09:33:27 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0563F1200B8 for ; Thu, 15 Aug 2019 09:33:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=hopcount.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Dqy4H4fSju2P for ; Thu, 15 Aug 2019 09:33:21 -0700 (PDT) Received: from mail-io1-xd2a.google.com (mail-io1-xd2a.google.com [IPv6:2607:f8b0:4864:20::d2a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 101E01200CD for ; Thu, 15 Aug 2019 09:33:21 -0700 (PDT) Received: by mail-io1-xd2a.google.com with SMTP id j4so342677iop.11 for ; Thu, 15 Aug 2019 09:33:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hopcount.ca; s=google; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=C9nkB/q5bKGHDJC+stMLB6zVG21K9aEbCbmIgj1ixmI=; b=Zy0hNuFgdIDRGP75orShoJqSmhVUjkFHqE3VAACLbc4A6ChmDHVXoHOxpd+5sV/VBi XOmImMe/QzGAUY/braU9iuV/VdM6nCUpMvzwEKtpCtN7ce0+/ThOtBjjV2LBE1VyjxHo WsozswdjfHWbp3DM7BOVN+kMhIgg0BO0I1KXw= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=C9nkB/q5bKGHDJC+stMLB6zVG21K9aEbCbmIgj1ixmI=; b=F9LzH4EoNgmcSwHPAJALdC+oA1dOsioVqhTRNVvnlbNvyXJf9EtsDFMzv19IvOe6Pb RiUPv7wDjrB5W/KDAwfChp8Tehm8O7CRH49m/EX7Cfnmg1+qQ4Cq1XMLrI58xe6gYUi3 DtygQ7vbygFNjFcFq3GdwTnA1G4NoyDybcQKS4GEtF6e/VCZXDF0KpilFLywTlgYeT8+ AGwSOpT2ajnhIzp4AEbYubJVVAoMTYITfeOuqvlCA5jQK8li2J0oi9qmPYRMVx3lRF8x fSszvNrrXkNuNdztY7xFpJRf7ESKHcogRkb6hw8iK4EBuot4uSYo0kO8wul8LHurXWzq WNwg== X-Gm-Message-State: APjAAAVUL9dpx0Iy8bQMxQsmMPRhvC2Oxqevv9wa89rHwHuOAFC8Dx7H Jy6vzu5nPS2PZEkKeOKLMbSpng== X-Google-Smtp-Source: APXvYqycrFlEZmRltgsh4+Y3k+u4Wxl6fxZ9s5l2K6zxTiTNs8TMADwb6012LT4OJvz5WtaYjsJ8gg== X-Received: by 2002:a5e:d611:: with SMTP id w17mr6079976iom.34.1565886800136; Thu, 15 Aug 2019 09:33:20 -0700 (PDT) Received: from [192.168.1.50] (24-246-23-138.cable.teksavvy.com. [24.246.23.138]) by smtp.gmail.com with ESMTPSA id t2sm8124521iod.81.2019.08.15.09.33.18 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 15 Aug 2019 09:33:19 -0700 (PDT) From: Joe Abley Message-Id: Content-Type: multipart/signed; boundary="Apple-Mail=_6E97D836-56EC-4B53-A543-2ED91B628F53"; protocol="application/pgp-signature"; micalg=pgp-sha1 Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Thu, 15 Aug 2019 12:33:17 -0400 In-Reply-To: Cc: Ted Lemon , Paul Wouters , ADD Mailing list To: Mikael Abrahamsson References: <2D09D61DDFA73D4C884805CC7865E6114E2757F0@GAALPA1MSGUSRBF.ITServices.sbc.com> <3DEACC72-50D9-410F-B4D1-4316784A5B72@hopcount.ca> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] Use Cases - the coffee shop X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 16:33:24 -0000 --Apple-Mail=_6E97D836-56EC-4B53-A543-2ED91B628F53 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii > On 15 Aug 2019, at 12:25, Mikael Abrahamsson wrote: >=20 > On Thu, 15 Aug 2019, Joe Abley wrote: >=20 >> For what it's worth (not very much!) the small number of times I have = seen this kind of question it has just made me mildly uncomfortable and = I have not known how to answer. >=20 > = https://www.howtogeek.com/245982/whats-the-difference-between-private-and-= public-networks-in-windows/ >=20 > To me it seems MS has done a good job in trying to explain this to the = user. I don't use windows very often (I haven't used it regularly since 1995). = I don't remember the dialogue box on whatever I was using more recently = looking like that, but I have to say that I am just differently confused = by the pop-up shown at that link than I was for the one I saw. If I don't want my PC to be discoverable by other devices on the = network, isn't that the same as not connecting to the network? What is = the point of a network if I can't exchange information with other = devices? I appreciate that this dialogue box is not intended for me (I interpret = it at first glance as a weird request relating to ARP and ND filtering, = and I'm pretty sure that's not what is intended) but I'll take the = opportunity to express doubt that in general it's possible to achieve = clarity for all audiences. Really if your discovery protocol (whatever that is) is not secure, I = recommend not implementing it. All networks are hostile. If your printer = isn't fit to be connected to the Internet, don't connect it to any = network more complicated than a crossover cable. Joe --Apple-Mail=_6E97D836-56EC-4B53-A543-2ED91B628F53 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iF0EARECAB0WIQSAt40QkiztAcvphdg0jwy9hlI6LAUCXVWJTQAKCRA0jwy9hlI6 LBn1AJ0bkMlQE2diCk4mpFiLf5PFvOEpLQCeLlKv2HVzwSjJZTebKsunOGPzxl0= =v9Eb -----END PGP SIGNATURE----- --Apple-Mail=_6E97D836-56EC-4B53-A543-2ED91B628F53-- From nobody Thu Aug 15 09:52:50 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CB98A1200CD for ; Thu, 15 Aug 2019 09:52:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pT5XJS2rtQFF for ; Thu, 15 Aug 2019 09:52:46 -0700 (PDT) Received: from mail-qk1-x72a.google.com (mail-qk1-x72a.google.com [IPv6:2607:f8b0:4864:20::72a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 76E8D120074 for ; Thu, 15 Aug 2019 09:52:46 -0700 (PDT) Received: by mail-qk1-x72a.google.com with SMTP id w18so1657527qki.0 for ; Thu, 15 Aug 2019 09:52:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=0+QiEJ9XwUNoXDj27fN5pD3DWLSdGk6dIVUBLULuo4E=; b=r2u75YHHQ8ja/Kn8AUWfeEXVCi02YEysnPBbaFwiub99M6YBZ2cE7plg8jLZ1jEdjk rgLLW32/0JXYpfKEzmxSql56AxrUF7LrldfzxTPAhKRqtY2P7/IRv2N+DZ9Olt0IcWEk 4A4mWWaOplBokdXGciIGFY2/s2qg2joAMbS3EhUtOwRGGl3cJ89+xl+NWSF4slFmK6/P 1V1lCSWqXxYlsL1xcMeun587yDdj0HJwOEJtp23kCJ+3shh1VMi81PeBCzcK3R3FHxPS x3PFZ9Nfokil7mYYcw+aLZvBwDdmyuxfWkb4wlZjlEyhrrW5VUs6BvD/pe9rEaS3jpIW jM+Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=0+QiEJ9XwUNoXDj27fN5pD3DWLSdGk6dIVUBLULuo4E=; b=SBLLJhCP4Gjkm6MP0+33o6Y9miuJFsElOrdaPYqEuNWGsO8AI03NKs8hTjbhulGoxe ns8Gf1paqVqT4b9fPPz72qxUky/Ksbyfpqfn6v1OPCLw+fi1WR8OjlUF0COCqkfcOh8m /YtyhmLUStMmPO7wGmkYeXs6Frk7alg4aBoOpG7pO5Wb4rT1Ymz5NrlmXYY2HJtgRHKg vQ9FU4v4LdxBhZdYlUCnumYo1R0HH93gSoBJ7yuQXatTZvqDIV4xTMe0YLPYbU9pjSuY d7hQ772QjPSwlOQpjQD8K1e+aWNSS5Fopy4AHEaYK0Dgbx6rxglb2b21KeA9JYEzZxEU xwnA== X-Gm-Message-State: APjAAAXz1OMa2P8fhWD59iqGEmqcGOOi/yErOuKYzDhZMWPITa39Gg8T c/ANREDbMoL1T3frzQ7HUZat+4OZXow= X-Google-Smtp-Source: APXvYqzfwF3N7uCLxr3JW/M0HwgzV9Eov1hNKiBW7KuwaFJlEA9S11bSS+axD+Tro/VPfKODT9kCDA== X-Received: by 2002:ae9:e897:: with SMTP id a145mr4856096qkg.403.1565887965373; Thu, 15 Aug 2019 09:52:45 -0700 (PDT) Received: from [192.168.2.18] (cpe-76-179-66-50.maine.res.rr.com. [76.179.66.50]) by smtp.gmail.com with ESMTPSA id u57sm1979909qtk.29.2019.08.15.09.52.44 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 15 Aug 2019 09:52:44 -0700 (PDT) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (1.0) From: Brian Dickson X-Mailer: iPhone Mail (16G77) In-Reply-To: <8e00891f-2aa2-ee11-559a-b5a8967b22d9@nostrum.com> Date: Thu, 15 Aug 2019 12:52:43 -0400 Cc: Paul Hoffman , ADD Mailing list Content-Transfer-Encoding: quoted-printable Message-Id: <2C23D415-84F9-4B6C-B67B-0CC3EB600520@gmail.com> References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <8e00891f-2aa2-ee11-559a-b5a8967b22d9@nostrum.com> To: Adam Roach Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 16:52:49 -0000 Sent from my iPhone > On Aug 15, 2019, at 1:28 AM, Adam Roach wrote: >=20 > [as an individual] >=20 >> On 8/14/19 11:24 PM, Brian Dickson wrote: >> My perspective is, that a non-443 port is not too late to converge upon, b= ut would require engagement from the browser community, and I'm not sure I'm= the right one to raise the issue. In fact, I'm pretty sure I'm not. >=20 >=20 > I think there is a key point that is being broadly missed here. >=20 > I infer from your statements that you see the property that DoH cannot gen= erally be distinguished from ordinary web traffic as a low-order protocol de= sign decision that could be adjusted while still retaining the benefits that= are driving DoH's adoption. >=20 > Having been rather deeply involved in many conversations from a browser pe= rspective, I can comfortably state that that this *is* the singularly most i= mportant property of the protocol that is driving DoH's adoption. You don't h= ave to agree with the reasons for this, or even to understand them, but this= is the ground truth that can't really be worked around. This is what I find extremely annoying. We are (all of us) asking someone to explain. You claim to actually know but effectively refuse to even attempt to explain= . I will try to elicit a meaningful response: Is the primary purpose of intermingling DoH with 443 traffic to prevent bloc= king DNS resolution? Hypothetical (but very important question): If ALL browser DNS traffic was sent over BOTH DoH and DoT in parallel (both e= ncrypted, sent to the same resolver), do you agree that the privacy would be= the same (same encryption) and the unblockability would be unchanged?=20 The reason for doing this would be to allow the choice of resolver (per clie= nt/app) to be discoverable. This is one significant gap in the DoH-only mode= l. It would not require that the browser (or any other app) wait for both an= swers, so would at worst have no affect on performance, and at best would im= prove performance. One variant to consider would be sending a DoT-like DNS query with only the q= uery NAME encrypted or hashes (ie completely different from DoT or DoH where= the entire DNS message is encrypted) and to return A and AAAA RDATA and QID= and port number unencrypted (but encrypt all other fields and all other RDA= TA responses). This would allow IDS/firewall systems to control access on th= e basis of DNS answers, without needing to know the question. If there is anything else you can share to enlighten everyone on the reasons= , reasoning, and/or requirements from the browser side, it would be greatly a= ppreciated by everyone. (We are, IMHO, interested in the necessary attributes, vs beneficial attribu= tes, specifically on privacy exclusively; there may be other requirements fo= r providing security which might be achievable with a different set of mecha= nisms.) Brian >=20 > Martin's recent summary of the situation by way of analogy to HTTPS adopti= on is a good one, and I encourage you to re-read it with the foregoing asser= tion in mind. There are legitimate network operator interests here, and we a= re keenly interested in preserving them in the face of this change -- but th= e future will not look like the past, and we need to figure out new ways to s= olve old problems. It would be ideal if you and other operators were involve= d in coming up with these new solutions. >=20 > /a >=20 From nobody Thu Aug 15 10:06:43 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CA913120115 for ; Thu, 15 Aug 2019 10:06:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=hopcount.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GHsZ450SQYJ7 for ; Thu, 15 Aug 2019 10:06:40 -0700 (PDT) Received: from mail-io1-xd29.google.com (mail-io1-xd29.google.com [IPv6:2607:f8b0:4864:20::d29]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EAEA51200F8 for ; Thu, 15 Aug 2019 10:06:39 -0700 (PDT) Received: by mail-io1-xd29.google.com with SMTP id t6so557480ios.7 for ; Thu, 15 Aug 2019 10:06:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hopcount.ca; s=google; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=NRNg+pWZNJSNVbelv2Y8Xsa3AdzGP6u6XVrpLHm7o98=; b=Qe/7aN+/Fr+3qbGPtgDDD+l+FFoc/fHhPYUM5lgYT9t0oJe4CrUDt3cvJPiLQjPAed aCDa53W+lusF67QAcOjuun9DIBUBj0i5v+PkGwPMS6ZU6YRPagI2pSk/mZ51/QHPUnQX Fc5hBb9VfHrY7SfKbuPzVXm6Bc3MwkONKta3I= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=NRNg+pWZNJSNVbelv2Y8Xsa3AdzGP6u6XVrpLHm7o98=; b=BlSJDNx59OIJecCz97qx/dGcXOyLOaB7MBFBMu3kAmmBaaI0IELgniGuyZ4o8H3d9o +R5LqRiRWa9sXfGJCBh03N+8nVyrSV5qJR2cmV6C2qFt4vGahzq7u00VZjTGb3EDBSRM yfRivgNAveg3i/jxJCrb3xKsXShBhQXiTNH4cjyzeSN/ZBGoNT/mfAUdeCNs5srxskP6 528FGhwjaLpnqp9FeGcpvPNFG8oQ/h/iayuzZy5+xO1BfZkyW+6F4ygO8ZWZ1cKIpajT z8PUoZ8K1AnJLICN3hRFa0PyzLqBGYzw3pFpJMq/n2GcSBMhMmaPsx5sqz5sIizyjf+1 WXdQ== X-Gm-Message-State: APjAAAUxf+1TDJCgRWjcqZDQeqJ8Q3VBgYfJnNtmtk/5HD00g5/u2SHj ollo8CsE5doRn8uzAeKfi7t8vA== X-Google-Smtp-Source: APXvYqxWJZO14noeZf3dEM0r11SgASTqU7CBnLb/i6Fd/9S+bQLlKbgqdNfETZ2vCzE5mYS5CFIPUw== X-Received: by 2002:a5d:8550:: with SMTP id b16mr6044401ios.11.1565888799006; Thu, 15 Aug 2019 10:06:39 -0700 (PDT) Received: from ?IPv6:2607:f2c0:e786:128f:e4d3:9643:614c:849e? ([2607:f2c0:e786:128f:e4d3:9643:614c:849e]) by smtp.gmail.com with ESMTPSA id n203sm2986979iod.28.2019.08.15.10.06.37 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 15 Aug 2019 10:06:37 -0700 (PDT) From: Joe Abley Message-Id: Content-Type: multipart/signed; boundary="Apple-Mail=_0EC118DF-A9A5-4974-8030-5548F55C154E"; protocol="application/pgp-signature"; micalg=pgp-sha1 Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Thu, 15 Aug 2019 13:06:36 -0400 In-Reply-To: <2C23D415-84F9-4B6C-B67B-0CC3EB600520@gmail.com> Cc: Adam Roach , Paul Hoffman , ADD Mailing list To: Brian Dickson References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <8e00891f-2aa2-ee11-559a-b5a8967b22d9@nostrum.com> <2C23D415-84F9-4B6C-B67B-0CC3EB600520@gmail.com> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 17:06:42 -0000 --Apple-Mail=_0EC118DF-A9A5-4974-8030-5548F55C154E Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii On 15 Aug 2019, at 12:52, Brian Dickson = wrote: > I will try to elicit a meaningful response: >=20 > Is the primary purpose of intermingling DoH with 443 traffic to = prevent blocking DNS resolution? I don't know what Adam's response to that is, but I don't think it's = reasonable to get frustrated when asking questions that have many = possible answers. (One person's "primary purpose" is another person's = "ancillary benefit" is another person's "mild annoyance" is another = person's "nightmare scenario".) For what it's worth, I think that hiding DNS resolution is a perfectly = reasonable primary purpose for end-users who find themselves in = situations where they desire privacy from a third party. I think it's simultaneously a terrible idea for third parties who want = to block things they can't observe, measure or modify. I'm not sure why the question is important, since I think it has been = answered eleventy billion times already on this list. Incidentally, I don't think "on the browser side" is a useful phrase, = since it suggests that there are entrenched armies here all battling = over the same strip of land. Different people here have different = answers to the same questions. The answers are not compatible. It's ok = for everybody to be right. Joe --Apple-Mail=_0EC118DF-A9A5-4974-8030-5548F55C154E Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iF0EARECAB0WIQSAt40QkiztAcvphdg0jwy9hlI6LAUCXVWRHAAKCRA0jwy9hlI6 LEEhAJ4y9qzlIP1oepOzhKi2eEW6li1SKACePdSwhCK6ncXGvTHBzwwZ2hWiW1U= =siZw -----END PGP SIGNATURE----- --Apple-Mail=_0EC118DF-A9A5-4974-8030-5548F55C154E-- From nobody Thu Aug 15 10:38:48 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 484681200C3 for ; Thu, 15 Aug 2019 10:38:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nohats.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Nhu5XIsO6kXU for ; Thu, 15 Aug 2019 10:38:45 -0700 (PDT) Received: from mx.nohats.ca (mx.nohats.ca [193.110.157.68]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 895421200BA for ; Thu, 15 Aug 2019 10:38:45 -0700 (PDT) Received: from localhost (localhost [IPv6:::1]) by mx.nohats.ca (Postfix) with ESMTP id 468Yb54Xk2zCP3; Thu, 15 Aug 2019 19:38:41 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nohats.ca; s=default; t=1565890721; bh=CBqCiZbnGw2rxa0jcTAbVSShQCf2pU7lbpS74YIJTkw=; h=Date:From:To:cc:Subject:In-Reply-To:References; b=kKXrkyo3J5ZoLoLr5amFhTeezhVyNm10R9WUHkqABc4CFebZQ8X5h6UhjIZtX406H Ww/Qraw3H2M9hytRwqPX6xtbOQkmGDqBy4wgSsZWU2Yv7UtAAztSUsNCSWVg2RVn1t p+heDAkNwMLTJIrym+/UgoZnx5UOAV4QjHzPSYrk= X-Virus-Scanned: amavisd-new at mx.nohats.ca Received: from mx.nohats.ca ([IPv6:::1]) by localhost (mx.nohats.ca [IPv6:::1]) (amavisd-new, port 10024) with ESMTP id SkzIrrtYrKVL; Thu, 15 Aug 2019 19:38:35 +0200 (CEST) Received: from bofh.nohats.ca (bofh.nohats.ca [76.10.157.69]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx.nohats.ca (Postfix) with ESMTPS; Thu, 15 Aug 2019 19:38:34 +0200 (CEST) Received: by bofh.nohats.ca (Postfix, from userid 1000) id 3C2CF373B; Thu, 15 Aug 2019 13:38:33 -0400 (EDT) DKIM-Filter: OpenDKIM Filter v2.11.0 bofh.nohats.ca 3C2CF373B Received: from localhost (localhost [127.0.0.1]) by bofh.nohats.ca (Postfix) with ESMTP id 2FCBB406CB1A; Thu, 15 Aug 2019 13:38:33 -0400 (EDT) Date: Thu, 15 Aug 2019 13:38:32 -0400 (EDT) From: Paul Wouters To: Brian Dickson cc: ADD Mailing list In-Reply-To: <2C23D415-84F9-4B6C-B67B-0CC3EB600520@gmail.com> Message-ID: References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <8e00891f-2aa2-ee11-559a-b5a8967b22d9@nostrum.com> <2C23D415-84F9-4B6C-B67B-0CC3EB600520@gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII; format=flowed Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 17:38:47 -0000 On Thu, 15 Aug 2019, Brian Dickson wrote: > One variant to consider would be sending a DoT-like DNS query with only the query NAME encrypted or hashes (ie completely different from DoT or DoH where the entire DNS message is encrypted) and to return A and AAAA RDATA and QID and port number unencrypted (but encrypt all other fields and all other RDATA responses). This would allow IDS/firewall systems to control access on the basis of DNS answers, without needing to know the question. Seeing answers leads to deducation the question. It is not privacy preserving at all. So then you are basically just faciliating censorship against the user's wishes. Paul From nobody Thu Aug 15 10:39:20 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 180751200CC for ; Thu, 15 Aug 2019 10:39:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=netorgft5189650.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AOqtXERSQz8X for ; Thu, 15 Aug 2019 10:39:17 -0700 (PDT) Received: from GBR01-LO2-obe.outbound.protection.outlook.com (mail-eopbgr100080.outbound.protection.outlook.com [40.107.10.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A9A2D1200BA for ; Thu, 15 Aug 2019 10:39:16 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=m8X3f1W/ZgoQTBAvDhkOG2REoheh9yOMCbCDG8hxzX5EAxyVdRHSH4HQE1G1DnSDzXjwh8EUBGzAtUcJeB55J8kFZRslBsy7By2EpYJFpJHGQeQLv6BWgDdijW/aPv6spxQs2rYNP2f68aPSEufW28Vh14wdYJVPoAfKSactB5MTy2AVjg7OWt0a17ScV+XlyCkxpkA3Z1sWwyx6xrJEbRX5JooAel8L4SJzGZKOLYpBDPrFRiYsv0e9DFgjQmaRTvs9FCi55Kpav6ADTgiUr3bMiWSB5mgPzQrXHOx2ng9mtWYA5PE/g8OSpTHyoNqdgWXQLj8KC5xT8MoRpmIyvA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=OYZByFQB/69jAs3HbE2zHVfcXY/GmH1ZdApp7v7LdqU=; b=DocjJJHGN1KpkaSyN25cyx/YtSdprv6z9qWMKoT2cqJPjep5koWK9COXIFZoav4Mhx5+kXDk3I7HDC2spjJ6+VTAQneKU3b51dfwZfm7Cd1ZNBZ4kE9OGY+2fR6w9PPirM7pGU+npH99GyM58YXnpcy3WVANmkW6rAVUY6ehLKID0ProkktH2MM6Nl4ffkh3F7c8GDEfuhyHegqQ3L9161F6se684GTbehXPwKsmLqof9CoUVHErjAn0S6ejZtCiKpegv9+NoJWM9o6uhI2ix/bS1OgZpxnLHryjkrVu20FRC26PrQ0iRCtC4bm/kHUky+KNWxw/jOW4FFppxaneCg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=419.consulting; dmarc=pass action=none header.from=419.consulting; dkim=pass header.d=419.consulting; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=NETORGFT5189650.onmicrosoft.com; s=selector1-NETORGFT5189650-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=OYZByFQB/69jAs3HbE2zHVfcXY/GmH1ZdApp7v7LdqU=; b=WwBWRk7Du71PHuPcmsXQjX/bBGcTec4ABor6jbBRffArYcPoIchpJbdMeridW1B1qmxclL6bI3L4OwpXxxvfNoEVGUClPyML60fnrNPa7WG47Aa3OUTHhzabWTmi7DzyRV8kBV4mmU2dZukOr80ED4S5SfMk5OxXs/rj6JFgoLY= Received: from LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM (20.176.138.146) by LO2P265MB0240.GBRP265.PROD.OUTLOOK.COM (10.166.101.149) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2157.21; Thu, 15 Aug 2019 17:39:14 +0000 Received: from LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM ([fe80::64e9:9b9e:59fc:26f]) by LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM ([fe80::64e9:9b9e:59fc:26f%5]) with mapi id 15.20.2157.022; Thu, 15 Aug 2019 17:39:14 +0000 From: Andrew Campling To: Ted Lemon CC: ADD Mailing list Thread-Topic: [Add] Use Cases - the coffee shop Thread-Index: AdVTdTO8sMFf9NSjRg6hhfqT7ScbewAAKbMAAAAmFVAAARrjAAABbFaAAAAt5YAAA6aTQA== Date: Thu, 15 Aug 2019 17:39:14 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=andrew.campling@419.consulting; x-originating-ip: [2a00:23c4:a499:2e00:f42b:87f3:b90b:d830] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: c194ca76-1a05-4e68-d805-08d721a77d64 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(7021145)(8989299)(4534185)(7022145)(4603075)(4627221)(201702281549075)(8990200)(7048125)(7024125)(7027125)(7023125)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:LO2P265MB0240; x-ms-traffictypediagnostic: LO2P265MB0240: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:4125; x-forefront-prvs: 01304918F3 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(136003)(346002)(366004)(376002)(39830400003)(396003)(189003)(199004)(81166006)(81156014)(8676002)(66574012)(6916009)(316002)(6246003)(256004)(4326008)(71200400001)(71190400001)(99286004)(33656002)(2906002)(52536014)(6306002)(66476007)(5660300002)(66946007)(14454004)(86362001)(54896002)(186003)(7736002)(9686003)(74316002)(76116006)(11346002)(6506007)(486006)(508600001)(102836004)(229853002)(446003)(476003)(46003)(25786009)(53936002)(64756008)(66556008)(4744005)(790700001)(7696005)(44832011)(6116002)(8936002)(6436002)(66446008)(76176011)(55016002)(46492003); DIR:OUT; SFP:1101; SCL:1; SRVR:LO2P265MB0240; H:LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: 419.consulting does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: s+jpZVSISCP/vYdtqe6AaRH9zL7aJGXZEllOs7xGWJ1H++FXZzk6Yq7DbiQXdTTaeiXc+N6FnbakD0FlfdmgTifpTRIkj63EMamP2m0yeyAXOviGjuedenofnUDKLS83ZUF4chedqGH5FjCfdIBz3xY3TOuRbJiVlU6Od0KIGgCoQsPsJp+meHBPuek/AFwsEJdS7UJDAGfUA1l//HguzrhWt2+b0YumLt5qqsLokytpmwqNnkdPf89kJGr4qhhBiKKVZYNh8HQua0fwU00m4FTHWR4/3VdkYxm0CCL0+uyL/T/gk+22tXqmRLDcBGHWsDlcasSEW1TTqJrnHvHKqsp+uCXT0QZgmxZ6E6wXPCbcmqKCFXphjN1XFF2x0UIYl4NeQWMJsFkYvTDGJjlKs8/a/SjVRVDK+iCaezcS+GY= x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_LO2P265MB132775E91ACF65896C52AC90C2AC0LO2P265MB1327GBRP_" MIME-Version: 1.0 X-OriginatorOrg: 419.consulting X-MS-Exchange-CrossTenant-Network-Message-Id: c194ca76-1a05-4e68-d805-08d721a77d64 X-MS-Exchange-CrossTenant-originalarrivaltime: 15 Aug 2019 17:39:14.2790 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 9c2ced3e-7522-4755-87dc-f983abc66ec3 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: h5TwyDlkOBQoZrdPZ8wFGfILCPbplzy73ajTaatQnWzH5GwFhTouT2oLGYn0CfrMaFZpTsS775rRX/XJ5QGVP959mcRqxs9WeuBOMMDxixw= X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO2P265MB0240 Archived-At: Subject: Re: [Add] Use Cases - the coffee shop X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 17:39:19 -0000 --_000_LO2P265MB132775E91ACF65896C52AC90C2AC0LO2P265MB1327GBRP_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 PiBJZiB5b3Ugd2FudCB0aGF0LCBhbmQgeW91IHdhbnQgRE5TIGZpbHRlcmluZyBvZiBtYWx3YXJl LCB0aGVuIHRoZSBiZXN0IHdheSB0byBnZXQgdGhhdCBpcw0KPiB0byBrbm93IHdoYXQgcmVzb2x2 ZXIgeW91IGFyZSB0YWxraW5nIHRvLiAgIElPVywgdGhhdOKAmXMgYSByZWFsbHkgY2xlYXIgdXNl IGNhc2UgZm9yIERvSC4NCg0KV2l0aG91dCBhdXRoZW50aWNhdGlvbiwgYSBrZXkgbWlzc2luZyBm ZWF0dXJlIG9mIERvSCBhbG9uZ3NpZGUgZGlzY292ZXJ5LCBJIGRvbuKAmXQgYmVsaWV2ZSB0aGF0 IHRoaXMgc3RhdGVtZW50IGlzIGNvcnJlY3QuDQoNCg== --_000_LO2P265MB132775E91ACF65896C52AC90C2AC0LO2P265MB1327GBRP_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBjbTsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQph OmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xv cjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFuLk1z b0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpwdXJw bGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwLk1zb0xpc3RQYXJhZ3JhcGgsIGxp Lk1zb0xpc3RQYXJhZ3JhcGgsIGRpdi5Nc29MaXN0UGFyYWdyYXBoDQoJe21zby1zdHlsZS1wcmlv cml0eTozNDsNCgltYXJnaW4tdG9wOjBjbTsNCgltYXJnaW4tcmlnaHQ6MGNtOw0KCW1hcmdpbi1i b3R0b206MGNtOw0KCW1hcmdpbi1sZWZ0OjM2LjBwdDsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7 DQoJZm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9 DQpwLm1zb25vcm1hbDAsIGxpLm1zb25vcm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHls ZS1uYW1lOm1zb25vcm1hbDsNCgltc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmln aHQ6MGNtOw0KCW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBjbTsN Cglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30N CnNwYW4uRW1haWxTdHlsZTE4DQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZv bnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOndpbmRvd3RleHQ7fQ0KLk1z b0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1zaXplOjEw LjBwdDt9DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7c2l6ZTo2MTIuMHB0IDc5Mi4wcHQ7DQoJbWFy Z2luOjcyLjBwdCA3Mi4wcHQgNzIuMHB0IDcyLjBwdDt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3Bh Z2U6V29yZFNlY3Rpb24xO30NCi0tPjwvc3R5bGU+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8 bzpzaGFwZWRlZmF1bHRzIHY6ZXh0PSJlZGl0IiBzcGlkbWF4PSIxMDI2IiAvPg0KPC94bWw+PCFb ZW5kaWZdLS0+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWxheW91dCB2OmV4dD0i ZWRpdCI+DQo8bzppZG1hcCB2OmV4dD0iZWRpdCIgZGF0YT0iMSIgLz4NCjwvbzpzaGFwZWxheW91 dD48L3htbD48IVtlbmRpZl0tLT4NCjwvaGVhZD4NCjxib2R5IGxhbmc9IkVOLUdCIiBsaW5rPSJi bHVlIiB2bGluaz0icHVycGxlIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+Jmd0OyA8L3NwYW4+ SWYgeW91IHdhbnQgdGhhdCwgYW5kIHlvdSB3YW50IEROUyBmaWx0ZXJpbmcgb2YgbWFsd2FyZSwg dGhlbiB0aGUgYmVzdCB3YXkgdG8gZ2V0IHRoYXQgaXMNCjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPiZndDsgPC9zcGFu PnRvIDxpPmtub3cgd2hhdCByZXNvbHZlciB5b3UgYXJlIHRhbGtpbmcgdG88L2k+LiAmbmJzcDsg SU9XLCB0aGF04oCZcyBhDQo8aT5yZWFsbHkgY2xlYXIgdXNlIGNhc2U8L2k+IGZvciBEb0guPG86 cD48L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286 cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBw dCI+V2l0aG91dCBhdXRoZW50aWNhdGlvbiwgYSBrZXkgbWlzc2luZyBmZWF0dXJlIG9mIERvSCBh bG9uZ3NpZGUgZGlzY292ZXJ5LCBJIGRvbuKAmXQgYmVsaWV2ZSB0aGF0IHRoaXMgc3RhdGVtZW50 IGlzIGNvcnJlY3QuJm5ic3A7ICZuYnNwOyZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0K PC9kaXY+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_LO2P265MB132775E91ACF65896C52AC90C2AC0LO2P265MB1327GBRP_-- From nobody Thu Aug 15 10:44:03 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 44C0E1200C3 for ; Thu, 15 Aug 2019 10:44:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 115dcT1-p4JV for ; Thu, 15 Aug 2019 10:43:59 -0700 (PDT) Received: from mail-pf1-x434.google.com (mail-pf1-x434.google.com [IPv6:2607:f8b0:4864:20::434]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 77D961200EB for ; Thu, 15 Aug 2019 10:43:59 -0700 (PDT) Received: by mail-pf1-x434.google.com with SMTP id w26so1653885pfq.12 for ; Thu, 15 Aug 2019 10:43:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:mime-version:subject:date:references:to:in-reply-to:message-id; bh=xBRbD6yx9i991l78X7KdxLgHgUtSqqeXN/bcOsQKyjk=; b=udOx+QZ4eB8BdY5iCXcecdrzf4I3p/OKKJuQoxOu4xKgNgiIlNaHclzp4WrarpfvkC W/3aETohrdjo7YAZ6rujxV8pkZ/RrE2F9SR+isBtNYrfpuss/psvxNvPdtXtTloCxevl Qs2r1OncJkq2T2CAWxFmvPHnFV1oENL4i6KOSBzHbG6weWfIb+B9ezJBaqV/w1K6bXL4 5XAhJeha7jbSMSMEALfH/xHDXpZ9m9HKQna93suv90r77Pw3frqkYB2oA5RdaT+e43Zn K+IOm9XzbBzepz4QMkKyblaZt9i4K94MJ2emyqkjt/EbYfp9QAycTEeGnvACaxEHvhF+ Oagw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:mime-version:subject:date:references:to :in-reply-to:message-id; bh=xBRbD6yx9i991l78X7KdxLgHgUtSqqeXN/bcOsQKyjk=; b=LRkXezCr6/85i5kCJnbrYLs6JICUYwmOXdJatQZXemNgxN/twJhOTZnj4rEVxejJ/1 S3Bx8xNeJGUErsCetTTjA9WMXRzN2n6jd5awArsLVXMtfr6Q2KZyowbtep1wZHBQn7nv R5G29g2Zmpz2AQAuH353cPg5LxEhmuhjw/Wg7oNVdp1a9YsNaUc7CB/QUgMc0hqipxNV AA8lfSb8FTvMdG/S1EAj2i1tqQeaTnuDhgG+/ORVppKdP9aukoFJOF2LRiFEexzEpIY2 fzswk+SZ0MB2CqxB2WCSmgffw5qATqiJfgNQ89I7kFNoIhQsDTMBY38i1ozu1CQAwSw1 GuNw== X-Gm-Message-State: APjAAAV1FRJuSeIwU+5K9DX1NlP4IMY1EyCYNhAcXf2RxNAbzXT+EeMd aqISoLyq+vJPDy1+yJJQAz/Nzs7G X-Google-Smtp-Source: APXvYqy/qeIVtvSNVg0m9td+C3EljIJebLnQPcQw4BtCtchXaXsNvQvAiT1XC11uqeJ9D72Ll+Gm/w== X-Received: by 2002:a63:d301:: with SMTP id b1mr4307315pgg.379.1565891038533; Thu, 15 Aug 2019 10:43:58 -0700 (PDT) Received: from [10.128.64.149] ([136.60.227.81]) by smtp.gmail.com with ESMTPSA id v189sm3073797pfv.176.2019.08.15.10.43.57 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 15 Aug 2019 10:43:57 -0700 (PDT) From: Bret Jordan Content-Type: multipart/alternative; boundary="Apple-Mail=_84D19466-431C-47CA-B4AF-D036211AFF88" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Thu, 15 Aug 2019 11:43:55 -0600 References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <1610C8E4-1624-4A7E-A24B-C7D0CB06A1DE@gmail.com> <6bbc4857-449e-e587-1e16-c0ee7d1f2aa8@cs.tcd.ie> <31226710-8C33-4696-90F3-4E05ED82FB05@open-xchange.com> <2D09D61DDFA73D4C884805CC7865E6114E272262@GAALPA1MSGUSRBF.ITServices.sbc.com> <8F75AD20-706B-48F7-B6DD-4C15DAFFA429@fl1ger.de> <404BD040-B3D2-4B60-A29E-CBA36559DAF6@open-xchange.com> To: ADD Mailing list In-Reply-To: Message-Id: X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 17:44:02 -0000 --Apple-Mail=_84D19466-431C-47CA-B4AF-D036211AFF88 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Personally I think a lot more research needs to be done so that we can = make statements using data. Further, we need to identify all of the use = cases we know that need to be represented in the research to make sure = it is not one-sided.=20 Thanks, Bret PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 "Without cryptography vihv vivc ce xhrnrw, however, the only thing that = can not be unscrambled is an egg." > On Aug 15, 2019, at 8:11 AM, Eric Rescorla wrote: >=20 >=20 >=20 > On Thu, Aug 15, 2019 at 4:08 PM Neil Cook > wrote: >=20 >=20 >> On 15 Aug 2019, at 14:49, Eric Rescorla > wrote: >>=20 >>=20 >> Bottom lining this, it seems like the results are broadly consistent = with ours: when DoH/TRR through Cloudflare is used, different CDN nodes = are used, but there's no significant performance difference. >>=20 > =46rom the study: >=20 > > Whilst the BBC uses Akamai extensively, none of the assets on the = BBC News homepage were served from=20 > > on-prem Akamai caches within ISP networks at the time of testing = (the on-prem caches are certainly used for=20 > > other BBC services though, such as videos on iPlayer). >=20 > Which means that it=E2=80=99s not a true comparison of the performance = difference experienced for things like streaming video, which is one of = the primary motivations for on-premise caching for CDNs. So it would be = more accurate to say that the study shows that there=E2=80=99s no = significant performance difference for content served from off-net CDN = nodes. >=20 > As I said, I'm certainly interested in any data that someone would = like to share. >=20 > -Ekr >=20 >=20 >=20 > Neil Cook > neil.cook@open-xchange.com >=20 > = --------------------------------------------------------------------------= ----------- > Open-Xchange AG, Rollnerstr. 14, 90408 Nuremberg, District Court = Nuremberg HRB 24738 > Managing Board: Rafael Laguna de la Vera, Carsten Dirks, Michael = Knapstein, Stephan Martin=20 > Chairman of the Board: Richard Seibt >=20 > European Office:=20 > Open-Xchange GmbH, Olper Huette 5f, D-57462 Olpe, Germany, District = Court Siegen, HRB 8718=20 > Managing Director: Frank Hoberg >=20 > US Office:=20 > Open-Xchange. Inc., 530 Lytton Avenue, Palo Alto, CA 94301, USA=20 > = --------------------------------------------------------------------------= ----------- >=20 --Apple-Mail=_84D19466-431C-47CA-B4AF-D036211AFF88 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8
Personally I think a lot more research needs to be done so = that we can make statements using data.  Further, we need to = identify all of the use cases we know that need to be represented in the = research to make sure it is not one-sided. 


Thanks,
Bret
PGP = Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 = 0050
"Without = cryptography vihv vivc ce xhrnrw, however, the only thing that can not = be unscrambled is an = egg."

On Aug 15, 2019, at 8:11 AM, Eric Rescorla <ekr@rtfm.com> = wrote:



On Thu, Aug 15, 2019 at 4:08 PM Neil = Cook <neil.cook@open-xchange.com> wrote:


On 15 = Aug 2019, at 14:49, Eric Rescorla <ekr@rtfm.com> wrote:


Bottom lining this, it = seems like the results are broadly consistent with ours: when DoH/TRR = through Cloudflare is used, different CDN nodes are used, but there's no = significant performance difference.

=46rom the = study:

> = Whilst the BBC uses Akamai extensively, none of the assets on the = BBC News homepage were served from 
> = on-prem Akamai caches within ISP networks at the time of testing = (the on-prem caches are certainly used for 
> other BBC services though, such as videos on = iPlayer).

Which means that = it=E2=80=99s not a true comparison of the performance difference = experienced for things like streaming video, which is one of the primary = motivations for on-premise caching for CDNs. So it would be more = accurate to say that the study shows that there=E2=80=99s no significant = performance difference for content served from off-net CDN nodes.

As I said, I'm certainly interested in any data that someone = would like to share.

-Ekr



Neil Cook
neil.cook@open-xchange.com

---------------------------------------------------------------= ----------------------
Open-Xchange AG, Rollnerstr. 14, = 90408 Nuremberg, District Court Nuremberg HRB 24738
Managing Board: Rafael Laguna de la Vera, Carsten Dirks, = Michael Knapstein, Stephan Martin 
Chairman of = the Board: Richard Seibt

European = Office: 
Open-Xchange GmbH, Olper Huette = 5f, D-57462 Olpe, Germany, District Court Siegen, HRB = 8718 
Managing Director: Frank Hoberg
US Office: 
Open-Xchange. Inc., 530 = Lytton Avenue, Palo Alto, CA 94301, USA 
---------------------------------------------------------------= ----------------------


= --Apple-Mail=_84D19466-431C-47CA-B4AF-D036211AFF88-- From nobody Thu Aug 15 10:45:10 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 281FF120108 for ; Thu, 15 Aug 2019 10:45:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=netorgft5189650.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jZTZ8fNKNwON for ; Thu, 15 Aug 2019 10:45:05 -0700 (PDT) Received: from GBR01-LO2-obe.outbound.protection.outlook.com (mail-eopbgr100052.outbound.protection.outlook.com [40.107.10.52]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 44E0B1200EB for ; Thu, 15 Aug 2019 10:45:05 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=eyuXT5cZLMcuNXa4bA7yhv/4j4JmxNs2FwOAuAj3mmpDSxBhfdiywlWqiDAHzguxzq8738pdvo1lcM4zmJkBwUE3I/b7opMMmrBAgCHb1LEcPKzTEL4JEotICoeD7Rvm9rlsYEtZpa+rPXlnA9FgCfgs1B0S/CuYjfUSUhm/iuReUTZ2KTKvAC2++AgXKFyZJwlBv7nmU4YnCVYQunMlsZKDFjk0jFhgMvchVHLB8uC5kRrSr6rz2FxTVojRCZYIZRElOYxbpdBE6p5Zj44GzxZkpHvutWXKEKJPVPT95EIDP4tOgXvyPsu1m5W48Q8YHI9TezN1TjnghSH//GpLAA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=pKGWomfyGnVu88ZExbuXSfjoBvN/648hDrnDhA3Tc5g=; b=ebx+63iCjcS93ux2rFFtvdnSa2va8GaF/kEeYy76sfipyi/Pr68Ftv0VOfwekFAh7R5rWmnSmEu//nMqh1u3eUkCYg5mILtDfDAcmrUf3F2dBbsDVvVi+R0EeTeSWTnvcNdgwthkwWI7LfZa9m5rrDHdx1JcmOh0Ws2yz9t9zXMPIhiTuLo9GvlTnW78b48PPGOqVpRADh1J6OG32dALL9YS46c4eCoeZIawIHJrJvwdBny3rSUqIIUzP+anAk5hR724UZPwdCeUaaZfeQYu3cv38PmRNe04hCrt/sJ17YyucCJKtioWOH6dcL2fmcusXkpuNsy+dRcIyEwrLt6NpQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=419.consulting; dmarc=pass action=none header.from=419.consulting; dkim=pass header.d=419.consulting; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=NETORGFT5189650.onmicrosoft.com; s=selector1-NETORGFT5189650-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=pKGWomfyGnVu88ZExbuXSfjoBvN/648hDrnDhA3Tc5g=; b=kx43jhfyBhnyEqek2zyZxF2/nK+QK93Rfk3a/rm23hwuGyGsDStSKjHD+L1aGx+MrSiMBi2pyF1Dl/eGAfsQ8eqfHc72Umm4VmlmFg2NqiQw2P0/QEhok10ZlGXCA+Bi6Tdm4bzW8HzGyJnIX2faUGkRNipOU/uuPdPCBRIe5IY= Received: from LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM (20.176.138.146) by LO2P265MB0015.GBRP265.PROD.OUTLOOK.COM (10.166.100.11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2157.14; Thu, 15 Aug 2019 17:45:03 +0000 Received: from LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM ([fe80::64e9:9b9e:59fc:26f]) by LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM ([fe80::64e9:9b9e:59fc:26f%5]) with mapi id 15.20.2157.022; Thu, 15 Aug 2019 17:45:03 +0000 From: Andrew Campling To: Ted Lemon CC: ADD Mailing list Thread-Topic: [Add] When Two Worlds Collide Thread-Index: AdVTdyCapVPyep9JQGykvKh9TBzsEAABu+YAAAAP56AAAN8cAAADp1mA Date: Thu, 15 Aug 2019 17:45:03 +0000 Message-ID: References: <039B96FE-8A88-4FD7-B3E9-CBBE3F590CDC@fugue.com> In-Reply-To: <039B96FE-8A88-4FD7-B3E9-CBBE3F590CDC@fugue.com> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=andrew.campling@419.consulting; x-originating-ip: [2a00:23c4:a499:2e00:f42b:87f3:b90b:d830] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 054de3b5-cc05-44ac-3f17-08d721a84d65 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(7021145)(8989299)(4534185)(7022145)(4603075)(4627221)(201702281549075)(8990200)(7048125)(7024125)(7027125)(7023125)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:LO2P265MB0015; x-ms-traffictypediagnostic: LO2P265MB0015: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-forefront-prvs: 01304918F3 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(346002)(366004)(376002)(136003)(396003)(39830400003)(189003)(199004)(14454004)(6506007)(7696005)(2906002)(6916009)(102836004)(76176011)(66574012)(53546011)(99286004)(4326008)(508600001)(25786009)(55016002)(6436002)(229853002)(33656002)(9686003)(6246003)(71200400001)(71190400001)(6116002)(81166006)(46003)(81156014)(8676002)(8936002)(53936002)(316002)(7736002)(52536014)(86362001)(74316002)(5660300002)(446003)(11346002)(476003)(66476007)(66446008)(486006)(64756008)(44832011)(66556008)(66946007)(186003)(305945005)(76116006)(256004)(46492003); DIR:OUT; SFP:1101; SCL:1; SRVR:LO2P265MB0015; H:LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: 419.consulting does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: TpTojyGIfcQVP+C3YcC/3REdBnSkRKNXqf6z4TswWuBmH8pG3rouRs7MJNhjZFcHkFUvqiX9bUoLby5J7nGry0ZoKHKZkTJsYYAq/jZ1ctIFKTf2BlmYR01swLu2lvp2Vk+jENPRYzL0R6vPNCYxLWUG1uPQlkjifSe/SeZMCmtmmmfRDz9eANrMKUOl1uRhV25q3Ndm9kPNa7TEFfPfpkLaW658NVn/N6mj4Zj7CFR76I4WWPx/l0fLumQb35bkFSYeWKMhJHu5GCMuRugn4gBckM1yeP5g06pKknR4vo12sB/VUtfUs3SyjFXR6/bPzhfSWal+QTK4hmavTDu6U1xaPP8gS9nt9Q0Khqe/y1sEf2FiyZWumQW0yeWczxN3Y5YXm1DWFme87D03jfBujpNNN91u7jotz9nNnEtwO5M= x-ms-exchange-transport-forked: True Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: 419.consulting X-MS-Exchange-CrossTenant-Network-Message-Id: 054de3b5-cc05-44ac-3f17-08d721a84d65 X-MS-Exchange-CrossTenant-originalarrivaltime: 15 Aug 2019 17:45:03.1728 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 9c2ced3e-7522-4755-87dc-f983abc66ec3 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: WqrTrpnKWS82vv/QI6cD509eyEz4TfubbTRy3qkyQaS7v39s3AsFnthysKuBsxF0ySgtKTQihc/KB2NxCbdPnPEomHTH2CkgG8Z6pTVdU/Q= X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO2P265MB0015 Archived-At: Subject: Re: [Add] When Two Worlds Collide X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 17:45:08 -0000 T24gQXVnIDE1LCAyMDE5LCBhdCAxNjo1NSwgVGVkIExlbW9uIDxtZWxsb25AZnVndWUuY29tPiB3 cm90ZToNCj4gUmlnaHQsIHRoaXMgaXMgd2hhdCBJIG1lYW4uICAgVGhlcmUgaXMgbm8gbGFjayBv ZiBjbGFyaXR5IGluIGFueSBvZiB0aGUgcGVvcGxlIGhlcmUgd2hvIGFyZSANCj4gcHJvcG9uZW50 cyBvZiBEb0ggaW4gdGVybXMgb2Ygd2hhdCBpdHMgaW1wYWN0IGlzIG9uIHNlcnZpY2UgcHJvdmlk ZXJzLiAgIFdlIGRvIG5vdCB0aGluayANCj4g4oCcbGEgbGkgbHUsIERvSCBjYXVzZXMgbm8gcHJv YmxlbXMu4oCdICAgV2UgYWxsIHVuZGVyc3RhbmQgdGhhdCBEb0ggY2F1c2VzIHByb2JsZW1zLiAg IEkgDQo+IGRvdWJ0IHRoZXJlIGlzIGFueSBkaXNhZ3JlZW1lbnQgYXQgYWxsIG9uIHdoYXQgcHJv YmxlbXMgRG9IIGNhdXNlcyBmb3IgU1BzLiAgIFNvIGl0IA0KPiB3b3VsZCBiZSBwb2ludGxlc3Mg dG8gaGF2ZSBhIGNvbnZlcnNhdGlvbiBhYm91dCB0aGF0Lg0KDQpJIGRvbid0IHRoaW5rIHRoYXQg ZWl0aGVyIG9mIHVzIGNhbiBjbGFpbSB0byBzcGVhayBmb3Igb3RoZXJzLCBob3dldmVyIEkgbm90 ZSB0aGF0IHRoZSBhYm92ZSBpcyBhIGNsZWFyIHN0YXRlbWVudCBvZiB5b3VyIHBlcnNvbmFsIHBv c2l0aW9uLiAgDQoNCj4gSWYgeW91IGxvb2sgYXQgTWFydGlu4oCZcyBtZXNzYWdlIHRoYXQgSSBx dW90ZWQsIGhlIHJlZmxlY3RzIGJhY2sgb3RoZXIgY29uY2VybnMgdGhhdCBoYXZlIA0KPiBiZWVu IHJhaXNlZCBoZXJlIGJ5IG9wZXJhdG9ycyBhbmQgYWdyZWVzIHRoYXQgdGhleSBhcmUgdmFsaWQg Y29uY2VybnMuICAgU28gdGhlIHByb2JsZW0gDQo+IGlzIG5vdCB0aGF0IHdlIG5lZWQgdG8gdW5k ZXJzdGFuZCBpbiBtb3JlIGRldGFpbCB3aHkgRG9oIGlzIGNhdXNpbmcgY29uY2VybiBmb3IgSVNQ cyANCj4gYW5kIG90aGVycy4NCg0KSW50ZXJlc3RpbmdseSBJIGtub3cgYSBudW1iZXIgb2YgSVNQ cyB0aGF0IHRob3VnaHQgc29tZSBjb21tZW50cywgZWcgaW4gdGhlIG1hdGVyaWFsIHByZXNlbnRl ZCBhdCBJRVRGIDEwNSwgdW5kZXJsaW5lZCB0aGUgZ3VsZiBpbiB1bmRlcnN0YW5kaW5nIG9mIGlz c3VlcyBiZXR3ZWVuIGJyb3dzZXIgY29tcGFuaWVzIGFuZCBJU1BzLCBjbGVhcmx5IHNob3dlZCB0 aGF0IHRoZXkgd2VyZSB0YWxraW5nIHBhc3NlZCBlYWNoIG90aGVyLiAgDQoNCg0KQW5kcmV3IA0K DQo= From nobody Thu Aug 15 10:50:30 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A4C021200C4 for ; Thu, 15 Aug 2019 10:50:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.996 X-Spam-Level: X-Spam-Status: No, score=-1.996 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=hopcount.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 34KHMc5Rq5-F for ; Thu, 15 Aug 2019 10:50:26 -0700 (PDT) Received: from mail-io1-xd32.google.com (mail-io1-xd32.google.com [IPv6:2607:f8b0:4864:20::d32]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8543C120113 for ; Thu, 15 Aug 2019 10:50:26 -0700 (PDT) Received: by mail-io1-xd32.google.com with SMTP id o9so828222iom.3 for ; Thu, 15 Aug 2019 10:50:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hopcount.ca; s=google; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=WjquUQQcUbxER6L7XFKxeUXahAf12LiH4TChZy3ssRk=; b=PtrClWjfMXogjpqfGl0pWqI6lqsey/RbZQqf8Q0CZcQ3akT78ZzmDXdCZJg8m0OVe2 tn0ezZ7qDD8ax1m8nuUqkFszvb0Y1q+bloJ9J9WB1ONiB9GzNq43QTPJcgJYb6v3tpLM 6SecngHeCz60O2X6DjsMV3XAfCsoSrIFk4oVQ= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=WjquUQQcUbxER6L7XFKxeUXahAf12LiH4TChZy3ssRk=; b=Ve4EJ2N/jkZ5ePf1K3zyxg1XKQ1LJHjHx6ciaJze38Xsb9hPuhR4LjXpDTV4NdJhzG t8r1/ooyOpCQkgZsYqRL2oxaxWgz4bXYx4PWcTPvKz9PoGNHB8bqJ9jUoHldHx441L2B fr4QVVK7FUcyuQg1A6O190/JP0FUZ8qh+WovkwtKzOEkcC8eslQReu5ducqLMUtmOEa4 x+rcvOQNDkSDac2/gnz+1nlQwTmXzyP/O0WpEmaldfKM/Ix7Xmkr/4fxU1R55R6TY6jm caXxWR+owHIkC2RMLfDLpBbbQ6/+7mdBVrGj46tmw6Yj0Q0MIBLkE4cRE7r7Bm/8x3AA pxeQ== X-Gm-Message-State: APjAAAVR2vLoRH8pv2J9Qp9VhDV7/jkmt3EExMCl+Y3GYX2uuadMxlvI YtxEwPYei8mL1pJvLRSyPTRfHQMg2FXilbu4 X-Google-Smtp-Source: APXvYqzzBh3pAlUD0uaDqzqYg7ZSNGdZY1TxwvSQ6mqv8w04ZdqQevbQkvVD+pCQUXwEqobu0ElCbQ== X-Received: by 2002:a5e:9404:: with SMTP id q4mr2012649ioj.46.1565891425029; Thu, 15 Aug 2019 10:50:25 -0700 (PDT) Received: from ?IPv6:2607:f2c0:e786:128f:2c61:3c82:3faa:7d03? ([2607:f2c0:e786:128f:2c61:3c82:3faa:7d03]) by smtp.gmail.com with ESMTPSA id e17sm4142669ioh.0.2019.08.15.10.50.24 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 15 Aug 2019 10:50:24 -0700 (PDT) Content-Type: multipart/alternative; boundary=Apple-Mail-9929E8AF-E704-4A21-8ED8-F58347328BC7 Mime-Version: 1.0 (1.0) From: Joe Abley X-Mailer: iPad Mail (16G77) In-Reply-To: Date: Thu, 15 Aug 2019 13:50:23 -0400 Cc: Ted Lemon , ADD Mailing list Content-Transfer-Encoding: 7bit Message-Id: <6DA33ED2-AD37-4C5C-ADE7-D326D9C89A9A@hopcount.ca> References: To: Andrew Campling Archived-At: Subject: Re: [Add] Use Cases - the coffee shop X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 17:50:29 -0000 --Apple-Mail-9929E8AF-E704-4A21-8ED8-F58347328BC7 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hi Andrew, On Aug 15, 2019, at 13:39, Andrew Campling w= rote: > > If you want that, and you want DNS filtering of malware, then the best w= ay to get that is > > to know what resolver you are talking to. IOW, that=E2=80=99s a really= clear use case for DoH. > =20 > Without authentication, a key missing feature of DoH alongside discovery, I= don=E2=80=99t believe that this statement is correct. =20 In your view, what is missing in HTTPS authentication that is needed for DoH= ? I agree that there is a lack of automatic mechanisms to configure DoH. Joe= --Apple-Mail-9929E8AF-E704-4A21-8ED8-F58347328BC7 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable
Hi A= ndrew,

On Aug 15, 2019, at 13:39, Andrew Camp= ling <andrew.campling@4= 19.consulting> wrote:

> If you w= ant that, and you want DNS filtering of malware, then the best way to get th= at is

> to kn= ow what resolver you are talking to.   IOW, that=E2=80=99s a really clear use case for DoH.

 

Without authenticati= on, a key missing feature of DoH alongside discovery, I don=E2=80=99t believ= e that this statement is correct.    

<= /div>

In your view, what is missing in HTTPS= authentication that is needed for DoH?

I agree tha= t there is a lack of automatic mechanisms to configure DoH.


Joe
= --Apple-Mail-9929E8AF-E704-4A21-8ED8-F58347328BC7-- From nobody Thu Aug 15 10:52:30 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 380191200C4 for ; Thu, 15 Aug 2019 10:52:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id X0iyMkLds-xe for ; Thu, 15 Aug 2019 10:52:27 -0700 (PDT) Received: from mail-qk1-x729.google.com (mail-qk1-x729.google.com [IPv6:2607:f8b0:4864:20::729]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1602B12011B for ; Thu, 15 Aug 2019 10:52:27 -0700 (PDT) Received: by mail-qk1-x729.google.com with SMTP id g17so2490775qkk.8 for ; Thu, 15 Aug 2019 10:52:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=466GWu4HwYKsMzeQpW9D/2b/XqrShf67VcuMqnQMJ8k=; b=HKbODNcRStCGwux6goa21pXot/bVNUjeDBkPEcUIK8PhFIFfzT5FwBxTTlQfwBgLlz CVVOKEsaTQJGKjB4QVQpgqmyqcQYeRzW/zNQDlyaUdHV1q1uKkOGFjZp44eyRlNbHDTd Up1BcKTe9jFh6eTQPdMahwsTgGLCZC5lfEG3s0uEMi9r1iLWGEusK67TBUMQgulgwZLn gEqQ2dC7D7YmXfwOiYvmPb8CukLjKLn58f6JN/z6kU7UxOfQUzLVJdwD7BTu1yjNCvWX XeHR+QkaVwNL06NJd7TqDYwtmwxzgYDiUe5vBewi0pir5iuv0n3jpk9ZLjuYLqws43XD 8ZVw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=466GWu4HwYKsMzeQpW9D/2b/XqrShf67VcuMqnQMJ8k=; b=XLYEE0RMy3dLePHyC+Fux+6gtSRu55zWql5zGV9H8+J3qiSeKqbC/CRD1jW/gznYb0 Aj/hetURCVp3b32WEw4cECZBXVo+2yayn4Qw+Q3Mj0n/fq8zg1Q/rPGFe+EzUOOsyUWH 30Xfu5PeRC8orLVVnUNyGJ6cfGuRDSUSmPshD9rHQhKqigZHdZrTah3+kVRMfCy8a8MI wJFggcRgk5gGsKdPz32cTWNM8Je6mymQ0LKgQL5LdPEAFIHsWpKDFIl+kmgFpQJBR+7a YuSktj7lRkj8rzWxc2QQlERo0/bt592EH8Au8YCi/bkr1Yfwwcr0h2IL6WaScCSp6vdy vwfQ== X-Gm-Message-State: APjAAAVJnETssKfUyvGLWQ5JMD+OIxwUrmfU6mtaniKjdKaelhlPROhI K/sOTpzJlXoKtYDcUqwGJqNjf+VACXk= X-Google-Smtp-Source: APXvYqz60KhFp+7HJk0SLHMAUUhJYoyl56BvVbFZinIJttiD8Lyz1cb8yjeVbyIvQCSvF1JcxvsBBw== X-Received: by 2002:a37:a358:: with SMTP id m85mr5347173qke.190.1565891545977; Thu, 15 Aug 2019 10:52:25 -0700 (PDT) Received: from [192.168.2.18] (cpe-76-179-66-50.maine.res.rr.com. [76.179.66.50]) by smtp.gmail.com with ESMTPSA id a67sm1790706qkg.131.2019.08.15.10.52.25 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 15 Aug 2019 10:52:25 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (1.0) From: Brian Dickson X-Mailer: iPhone Mail (16G77) In-Reply-To: Date: Thu, 15 Aug 2019 13:52:24 -0400 Cc: ADD Mailing list Content-Transfer-Encoding: quoted-printable Message-Id: References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <8e00891f-2aa2-ee11-559a-b5a8967b22d9@nostrum.com> <2C23D415-84F9-4B6C-B67B-0CC3EB600520@gmail.com> To: Paul Wouters Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 17:52:29 -0000 Sent from my iPhone > On Aug 15, 2019, at 1:38 PM, Paul Wouters wrote: >=20 >> On Thu, 15 Aug 2019, Brian Dickson wrote: >>=20 >> One variant to consider would be sending a DoT-like DNS query with only t= he query NAME encrypted or hashes (ie completely different from DoT or DoH w= here the entire DNS message is encrypted) and to return A and AAAA RDATA and= QID and port number unencrypted (but encrypt all other fields and all other= RDATA responses). This would allow IDS/firewall systems to control access o= n the basis of DNS answers, without needing to know the question. >=20 > Seeing answers leads to deducation the question. It is not privacy > preserving at all. So then you are basically just faciliating censorship > against the user's wishes. >=20 Okay, so what if the only =E2=80=9Csignal=E2=80=9D was client IP and destina= tion IP on DoT packets? You might not think there is value in that, but would that be a privacy issu= e per se? The intent would be to identifying hosts that are possibly compromised, and u= sing a known-bad resolver (for whatever is locally defined as =E2=80=9Cbad=E2= =80=9D). Brian= From nobody Thu Aug 15 10:54:22 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B64481200E0 for ; Thu, 15 Aug 2019 10:54:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qDgx9Y4INx9v for ; Thu, 15 Aug 2019 10:54:19 -0700 (PDT) Received: from mail-qk1-x731.google.com (mail-qk1-x731.google.com [IPv6:2607:f8b0:4864:20::731]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6D91D1200C4 for ; Thu, 15 Aug 2019 10:54:19 -0700 (PDT) Received: by mail-qk1-x731.google.com with SMTP id g17so2495608qkk.8 for ; Thu, 15 Aug 2019 10:54:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=content-transfer-encoding:from:mime-version:subject:date:message-id :references:cc:in-reply-to:to; bh=F9JZsqg3SpN9SjmrjxFIdm8q4eHKTQ1WRLo+ot/C8+8=; b=Bm1QTsDAx+kYnByWYFRCMxl9RbFw2kabFD2T7DzvAJAhwuCIlIWLVRgt+SUiKa1ncX ZFNaIkFzZnahiFXc37uj7+8mKfvWj/+t8xzMoQMWsDi6yoiCezZ6WfnJVFzxnKPFafu2 IEhj34E34MMfzOdinRwkadqKZ5RCuI/yZ5k69L18tdB5S7L9Ad/p3aly3DOrwCKpr3R1 WT/nPtKXm8M79OFx0BqYqkXeon7x/BMpxz+L1Qgf15DJYV19Lwa/+DZ2wR2drz6JD0oj kkuW1f+MRK2sIMEWxFtv0pnsR/4/ZyP3GrlyIZQqEzdDwaPx73N59xYDPT5AG+6S/Vr/ TTbg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:content-transfer-encoding:from:mime-version :subject:date:message-id:references:cc:in-reply-to:to; bh=F9JZsqg3SpN9SjmrjxFIdm8q4eHKTQ1WRLo+ot/C8+8=; b=cfdHD0LZA0kpWL06+RRGRyHF7jhcuSKQ46csa9/pwkPw5Kd5RuSCd7scSJPdxwXVv5 LVYQogZ2KWRC9HMAM/oqlEzPXvvPuJciaEM1OMMOGslyiuCSLLU20RUjH7o/pix4Wpr/ t0ywyYOi+M8ybUIoUegnL7rZgDOAb3oImuXxPY/FcoOb1zvgHRH1scTum4gKMj6FZMYN 2h6LoOgCn+sSnx/AJCfnPszzrwU8QHmUUXscX9/vh41Ng9JxbpitE78EKAruSwLvb2Vj wAEl4ncg2bAwEMKMmg+td2gXZ+rkTuj5ERmiaPVfhOdqHuOIAMJCz3QYYEndkMJS6gjz RzYQ== X-Gm-Message-State: APjAAAVrm0fPXUBvQ+YUOwMGCxQu07hoIHN3u6NkhoNRFSYbTKQwNkrB pdkQ9RC67KwqDW1+WYluVlgEtQ== X-Google-Smtp-Source: APXvYqyKoyZkndIJbuOjPrAMJgWQSbdTSzhxywPc4B/vSBg9EqcNUDejDXKZioT2GWQIggSC+kvIqw== X-Received: by 2002:ae9:e00c:: with SMTP id m12mr5276752qkk.268.1565891658472; Thu, 15 Aug 2019 10:54:18 -0700 (PDT) Received: from [10.0.100.56] (c-73-186-137-119.hsd1.nh.comcast.net. [73.186.137.119]) by smtp.gmail.com with ESMTPSA id z7sm1810414qki.88.2019.08.15.10.54.17 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Thu, 15 Aug 2019 10:54:17 -0700 (PDT) Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable From: Ted Lemon Mime-Version: 1.0 (1.0) Date: Thu, 15 Aug 2019 13:54:16 -0400 Message-Id: <65A11E95-ABF6-4B70-AB63-62517A202419@fugue.com> References: <2C23D415-84F9-4B6C-B67B-0CC3EB600520@gmail.com> Cc: Adam Roach , Paul Hoffman , ADD Mailing list In-Reply-To: <2C23D415-84F9-4B6C-B67B-0CC3EB600520@gmail.com> To: Brian Dickson X-Mailer: iPhone Mail (17A815) Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 17:54:22 -0000 On Aug 15, 2019, at 12:52, Brian Dickson wro= te: >=20 > Hypothetical (but very important question): > If ALL browser DNS traffic was sent over BOTH DoH and DoT in parallel (bot= h encrypted, sent to the same resolver), do you agree that the privacy would= be the same (same encryption) and the unblockability would be unchanged? Why is this an important question?= From nobody Thu Aug 15 10:55:44 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D458B1200E0 for ; Thu, 15 Aug 2019 10:55:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id N0TKgNi8BnHh for ; Thu, 15 Aug 2019 10:55:41 -0700 (PDT) Received: from mail-qk1-x72c.google.com (mail-qk1-x72c.google.com [IPv6:2607:f8b0:4864:20::72c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 240491200C4 for ; Thu, 15 Aug 2019 10:55:41 -0700 (PDT) Received: by mail-qk1-x72c.google.com with SMTP id p13so2472707qkg.13 for ; Thu, 15 Aug 2019 10:55:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=content-transfer-encoding:from:mime-version:subject:date:message-id :references:cc:in-reply-to:to; bh=tYyXYsv5RgNDhcqN5TEkN7R+RlQSIs2VAJEq6THwUuY=; b=QHCyeOwGQgOwj9EK6buWHBvUFpKkY15Kb7wOrQquC3dAUO8Ar+gpDpzUzhXoL5i1VK IB3bb6zPT8TBgxNExf10Rl6OZ8gLqkImPaAY7PxlzI/PmRa6W86i3VgdbwLqV1A86I7G vLz1drZN/LRkk1A9CaJaMXEtLt619cOYeBeQZPn4rVhKAkjPrgyrpHmafdahXQFYLpcf DfeKTtmffuoit06pau0GjWxEuM7GQn759xuUXGLThHffi6epL/4EFXKsLlGqaFdYnlZM AxKVzD1KkQ9hP3XC9OUfUZQI/L2kIqKpzi97RWsrh+u9VZSFnYKys1vMGAzpNp0yEU+7 AXrw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:content-transfer-encoding:from:mime-version :subject:date:message-id:references:cc:in-reply-to:to; bh=tYyXYsv5RgNDhcqN5TEkN7R+RlQSIs2VAJEq6THwUuY=; b=eCKyJvETlZInkt3xKmW+huqcgOafiyfLZ9g0P5NDoFjf8Zc2bnuWxyOqCKTdlL12VX 1rzBhvVaKe3io3Csq2ua076tXjNqJ6d4JF/opoAIGOp+gPHiZo+22l1jjkG1IenJWxGT +Sv2X429srpkXDVxBBq0Itjt3vBykVeCrih+gTS3fcI309qrhbiyQKsjzwbEuxcOYvSf Qg3XyR3Spi0fkk9TrZNhmg3VVBRiBi7JqtkFmfyqRUyRtz4JWiva1Z+eCzOXTNt3xvyh +ays0Ur0lwimezlJYN0rhm50w6vahMcJxSH+gkTTMMIgsabcm59XCKnbRj1a2r1vq867 dzqw== X-Gm-Message-State: APjAAAVLDpc+uFV3qdkoCzaloFOEFLZCcsY/JjrfvdKHfYwbVor9eIbp zYrFxRK64d0SbO0c7ykRfs46JMh4xthujw== X-Google-Smtp-Source: APXvYqzjd0AB7Ta5e0Gc3C60SU/9OzhnI8qOW7OsTl6OJSSWIavhjk8OUXGe7u8TwC7l0ySk1KyofQ== X-Received: by 2002:ae9:de81:: with SMTP id s123mr5108610qkf.339.1565891740101; Thu, 15 Aug 2019 10:55:40 -0700 (PDT) Received: from [10.0.100.56] (c-73-186-137-119.hsd1.nh.comcast.net. [73.186.137.119]) by smtp.gmail.com with ESMTPSA id v81sm1852212qkb.21.2019.08.15.10.55.39 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Thu, 15 Aug 2019 10:55:39 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable From: Ted Lemon Mime-Version: 1.0 (1.0) Date: Thu, 15 Aug 2019 13:55:39 -0400 Message-Id: <839B8C13-5DE9-4479-B639-92F22F11BEE6@fugue.com> References: Cc: ADD Mailing list In-Reply-To: To: Andrew Campling X-Mailer: iPhone Mail (17A815) Archived-At: Subject: Re: [Add] Use Cases - the coffee shop X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 17:55:43 -0000 On Aug 15, 2019, at 13:39, Andrew Campling w= rote: >=20 > Without authentication, a key missing feature of DoH alongside discovery, I= don=E2=80=99t believe that this statement is correct. =20 Fortunately DoH provides authentication.=20= From nobody Thu Aug 15 10:58:00 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9A46B1200EB for ; Thu, 15 Aug 2019 10:57:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9yR4IRo-RACD for ; Thu, 15 Aug 2019 10:57:56 -0700 (PDT) Received: from mail-qt1-x835.google.com (mail-qt1-x835.google.com [IPv6:2607:f8b0:4864:20::835]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A63D51200C4 for ; Thu, 15 Aug 2019 10:57:56 -0700 (PDT) Received: by mail-qt1-x835.google.com with SMTP id z4so3255144qtc.3 for ; Thu, 15 Aug 2019 10:57:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=content-transfer-encoding:from:mime-version:subject:date:message-id :references:cc:in-reply-to:to; bh=hO5CO6cR96+5PsatHrdVwg2SeQYdVZ4qTClKB0HohLE=; b=M+qfQosM+T8wcpCjAaM7QxKvEnVkFvW7JDH+LYJkkn1oUZDVj+2ntg8O2ZqZaE4FxH 3KmCd6Gz5kIwdbb3FqJ3dCZLPOB6WlJLXkOeZ+mL4gy2NCUoFFygKvAnUeSRuYOF/IqL FlXobv8/bSrMUqAnESa5qUTIJfMQPvplQ7hyZSD72W8h5ZBSiQFghNMrW/LG+pKGh+mA CZ47V8WE4LmkWEzuwe63Pk8Lp3bt8/iAGbLPLbvFjf9mSOeiS4ezu0cZPmw6e/OKcD6k i9uRn0hLiU0qABDr6bjxLur3NVcsCVY9R/muzP062daAC82V4E46LgC/NcshzT2/tawP ng8A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:content-transfer-encoding:from:mime-version :subject:date:message-id:references:cc:in-reply-to:to; bh=hO5CO6cR96+5PsatHrdVwg2SeQYdVZ4qTClKB0HohLE=; b=YeoQH77M4qC/oCwSZyeJ46aeIRowq2Ac1uzAm3AMA+DXJnlOwMERdF9msJtBuLgc6d a1/avgFDCB8z+ytPa5lgyx4j1Hv1fFdyGNW2h4n6nbR7U7HeBQfX9jbX7w7An/AERSDw LdErwXE0v2lJQ7KRT8ReR0bv/L+ESKKZBqnlOqgFOnBxuAmaRBmkZzaz34KQwU6x3XjK OQLxNepZVMXh5FOf0/zSLC26G/0sbE6DZF2sgP4cyeZ+LlR4zQkFoyHx9Y1vE7D3B/fD V3hkzsQ/Rdx8LxcW/Hida0rsCf4SeA+R1OKUaoieojoziHROyNDliU1keTxwhUwB1zu8 6wFg== X-Gm-Message-State: APjAAAWI4bWeBqAbgAzuxpcgf/NedzGX1NoHVocGdaefuvgKcw1bHl9T a0BPcZK9OaWuDo6GFgiAGjn/GbpZkZUrKw== X-Google-Smtp-Source: APXvYqxXq4EQW3KGD5Bf9qiXduvEQjO9VlCTYjGDJfa9SZEqGVwdBv9gSydUCwx3at4sHeadigBFDQ== X-Received: by 2002:ac8:7094:: with SMTP id y20mr5161071qto.140.1565891875588; Thu, 15 Aug 2019 10:57:55 -0700 (PDT) Received: from [10.0.100.56] (c-73-186-137-119.hsd1.nh.comcast.net. [73.186.137.119]) by smtp.gmail.com with ESMTPSA id m5sm2322436qtc.89.2019.08.15.10.57.55 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Thu, 15 Aug 2019 10:57:55 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable From: Ted Lemon Mime-Version: 1.0 (1.0) Date: Thu, 15 Aug 2019 13:57:54 -0400 Message-Id: References: Cc: ADD Mailing list In-Reply-To: To: Andrew Campling X-Mailer: iPhone Mail (17A815) Archived-At: Subject: Re: [Add] When Two Worlds Collide X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 17:57:59 -0000 On Aug 15, 2019, at 13:45, Andrew Campling w= rote: >=20 > Interestingly I know a number of ISPs that thought some comments, eg in th= e material presented at IETF 105, underlined the gulf in understanding of is= sues between browser companies and ISPs, clearly showed that they were talki= ng passed each other. =20 I agree that we are taking past each other. But it=E2=80=99s not because D= oH proponents aren=E2=80=99t aware of the problems DoH creates for network o= perators.=20= From nobody Thu Aug 15 10:58:30 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 535861200C1 for ; Thu, 15 Aug 2019 10:58:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=netorgft5189650.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zECTcQHnDS2q for ; Thu, 15 Aug 2019 10:58:26 -0700 (PDT) Received: from GBR01-CWL-obe.outbound.protection.outlook.com (mail-eopbgr110051.outbound.protection.outlook.com [40.107.11.51]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0A824120074 for ; Thu, 15 Aug 2019 10:58:26 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=PnVHrz+mL4Suo08Ep342MzwOAVkNXNm8EltpF9ba4HJFCzj1buGsPnjKqKU2/1luFiyatGwcXpufn3pQcNCfGC/NCrOa5DnNi/lTaR4T4+5Vui5eXqoFDDBKozdbQHn4+7IBMB19l6dwUub5qxqlZlCmpAKUzDA94QusxiDiPXM2orYk25VE6U+hXZNif7ZNIRGPD8XkxLyPB3b4kJMe+8pqc1QcoSHryWb1FxMkhHgtju8+qIVeOkddIoaU48epXPpA9KyG09RJ8TVOQmw319frdVAgrfXPN5lNwSXDl6auS2xgGxznTFdIzrLC18F2cGsoLY+IS5bj9Z7OuWfIaA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=3fPZ+TJYsk7GeRARG4lEVharuJyTFjSQ/j8qhQzYWxU=; b=ZgQa+A+ht2W1mw2mVB5tmwFuStblf+MPS01E86NDHJEF1EYgJ4WcacSnSIEPfx1dSFBmBrbfn6+oH45GCYzIcbigYkRFlLcScBqB9butoZmM8Vk/hcvg51qBT+qXvNdCHy7nRrXRKJwQX4TXOZXsFl8XMbAsDRzz7VhdT6+/SRcn7274HAfqC6mknHZ2PXl6rpbOPQO70Pv3SMd1fPP9Lip7KqW17kfLthP01tvHxxPIPPk0ij5WyDsKAunF+o/MnnyeMtDjYVQUw5evtJpnYpmn/L3hDxkM137gz2zhGdTFZ4RQURptWbxKNfOY/P9Fzc5KVpH70ZJU1GgKiZry+g== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=419.consulting; dmarc=pass action=none header.from=419.consulting; dkim=pass header.d=419.consulting; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=NETORGFT5189650.onmicrosoft.com; s=selector1-NETORGFT5189650-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=3fPZ+TJYsk7GeRARG4lEVharuJyTFjSQ/j8qhQzYWxU=; b=EAohS6vgUvaH/wqRxp0/LN2C11BQmijISTqB1LHMcKXxiAO9kicMSWA02M26JfndQFSsS+ebP3T/9tzMhnITU3hqOziFuvKVhvgJYMWALy63VxGhRJuTuheJoqMgyYpreFstNr6TMt58xytdjPiuRG089RW1vydy0GCMF9GPKcc= Received: from LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM (20.176.138.146) by LO2P265MB0191.GBRP265.PROD.OUTLOOK.COM (10.166.98.146) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2157.15; Thu, 15 Aug 2019 17:58:23 +0000 Received: from LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM ([fe80::64e9:9b9e:59fc:26f]) by LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM ([fe80::64e9:9b9e:59fc:26f%5]) with mapi id 15.20.2157.022; Thu, 15 Aug 2019 17:58:23 +0000 From: Andrew Campling To: Paul Wouters CC: ADD Mailing list Thread-Topic: [Add] Use Cases - the coffee shop Thread-Index: AdVTdTO8sMFf9NSjRg6hhfqT7ScbewAAKbMAAAAmFVAAARrjAAAFuPNQ Date: Thu, 15 Aug 2019 17:58:23 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=andrew.campling@419.consulting; x-originating-ip: [2a00:23c4:a499:2e00:f42b:87f3:b90b:d830] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 5fb28788-c166-4cff-79b1-08d721aa2a62 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(7021145)(8989299)(4534185)(7022145)(4603075)(4627221)(201702281549075)(8990200)(7048125)(7024125)(7027125)(7023125)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:LO2P265MB0191; x-ms-traffictypediagnostic: LO2P265MB0191: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:8882; x-forefront-prvs: 01304918F3 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(39830400003)(366004)(376002)(136003)(346002)(396003)(189003)(199004)(81166006)(66556008)(14454004)(256004)(66446008)(8936002)(81156014)(6246003)(55016002)(2906002)(316002)(7736002)(74316002)(4326008)(305945005)(64756008)(66476007)(99286004)(71190400001)(71200400001)(5660300002)(52536014)(14444005)(6436002)(86362001)(508600001)(186003)(102836004)(446003)(6116002)(7696005)(46003)(25786009)(44832011)(33656002)(76116006)(229853002)(11346002)(53936002)(6506007)(476003)(4744005)(8676002)(76176011)(6916009)(66946007)(9686003)(486006)(46492003); DIR:OUT; SFP:1101; SCL:1; SRVR:LO2P265MB0191; H:LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: 419.consulting does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: 3/dUrmCNiB1NpeWpN+9tbz04tA13thL3WILJDsIUMm/BZfuY/5fhutGBAuFgwrMaq9/HdMg0KN3yZ9HHLFsw9F7d/ifXK700w1iX9TzIDyrW8IUmdqx89MbgDFDrCmmfY3ioe4SMB2e9n5wK9p4A4vcAmFMbmu+oGd8wz0OZ0tBmHSjYHFzuhiACIiRKQNOtsy8gtT7DGMMOpN0Gq5/eRNfl6TyviF4N3c9z7nTU+eAMO/F2JaV5Fd2eNgcFFNK46NekDKl9vdre3aTcUy56b+eu7jzksZgIxEkqQ3mv8HjDIuwkkoMz1Ehk/fO6r6neWDzIbsBwESV9GfkOkw/NXqFL9msITfrFzQ5XA5QOuK5gqICLIYzEHpuScpPWNA/u3u29k4XySPEcGitInWh40ocqm7epRWi+WMYOfPGuAGo= x-ms-exchange-transport-forked: True Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: 419.consulting X-MS-Exchange-CrossTenant-Network-Message-Id: 5fb28788-c166-4cff-79b1-08d721aa2a62 X-MS-Exchange-CrossTenant-originalarrivaltime: 15 Aug 2019 17:58:23.5118 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 9c2ced3e-7522-4755-87dc-f983abc66ec3 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: 53bSUiZGYrivg3MPnKgtK4GG1hAOAns4nZNkfYtiw8iPhnjnfrutVQ3ZodtQH9jnL1F8yl+5TfHtGrC6ggn3ehpiPrVhjhvveJvzWknJgkg= X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO2P265MB0191 Archived-At: Subject: Re: [Add] Use Cases - the coffee shop X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 17:58:28 -0000 On Thu, 15 Aug 2019, Paul Wouters wrote: > If you say the coffeeshop / hotel as an ISP has the right to filter any o= f your traffic, I don't see why that would not apply to DSL or LTE based IS= Ps. That would be the end of net neutrality and the start of commercial (no= t government) censorship.=20 It's important to remember that definitions of net neutrality vary around t= he world, may not be viewed to be important or even relevant in some jurisd= ictions. For example, some of the content available on 8chan in the US is = unlikely to be legally acceptable in at least some European markets despite= provisions for net neutrality applying in both geographies, albeit with di= ffering views on meaning / application. =20 Andrew From nobody Thu Aug 15 11:08:26 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9A4D51200B2 for ; Thu, 15 Aug 2019 11:08:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XnnShvpapZu9 for ; Thu, 15 Aug 2019 11:08:22 -0700 (PDT) Received: from mail-qk1-x734.google.com (mail-qk1-x734.google.com [IPv6:2607:f8b0:4864:20::734]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B5F9B120074 for ; Thu, 15 Aug 2019 11:08:22 -0700 (PDT) Received: by mail-qk1-x734.google.com with SMTP id m2so2523291qkd.10 for ; Thu, 15 Aug 2019 11:08:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=lGyQmvMy+uguvm4pFBAjUd0Nf/qOLU0eMyEd6BfyUHI=; b=tHPYKYH3WS09Nd1MGYlf4a5R4HbmX9rrqaB/I0PcyLNwL/SubRiq0rwEMd9ljC5eHo fpVNNc3mJm/+d3Jc2EeE0JxOgKx0448JS47eBXbDkuqVxOysjqN0MhR/nDZFJTXETShg y1FDLiA1I/nEkYLHR1DjKhJTBIULhoxF/eoEcVpk7Ft8T31ZOXt757+z6ptnZJlhhCvc 2MvMqJU+cnWJKcUNe0t+ZZAFY5fL0NgF+q3lEf0iO9BJdKjohvNJRIeEsrUujz8s81LK KByWjVU1nUFxv31FTk54Rh7sD/MZc/C9Dr5fen6kErsn34tH5/4D0b2sJ94hzjLnI7Bj XzTg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=lGyQmvMy+uguvm4pFBAjUd0Nf/qOLU0eMyEd6BfyUHI=; b=ITn76T1XYLQytCAupTR8hTyyr7Svf7C7ZVWPS3SFG4015fbv7yAHkLYptit8OFKTrA QjvO104W4AHh8yLIxLL9JMRGUyfUOq3MQtEXsqIH8cAAnJ9btoeLqTsbW14A4v9zzVdh elJBYbFNEx50/f+9HqI1hVEGOGpuHPlgsx5sJPEoUgeZWX7AsMoqIsNhU7LWp6Tf/VFl /49kiFvsDaETfvIEH7vbUlNAr/QbHnc3BsaLB2rpkI71ToSSx2f0LxzR1t46Qb981Uoo Sp8QCb393Uzn+0UKVLDM7ICQXBgGS99RTD6jKYcaf2B1PBbi+QPaAYtjEY+ExYP8ENma vg0A== X-Gm-Message-State: APjAAAUbHzsfeJYtv9B0/48uxq1om0SjL2D2skvFbBX3a+X6wpaE6aKQ mAjWI2QwMge+nk0eYZopg04= X-Google-Smtp-Source: APXvYqxxDUWG3Q3v/E9tQOGi4CNI808oQTI+kSA4HmjnXzifqEic0DW4xY2csxuSa8PXQfK4y2TD3Q== X-Received: by 2002:a37:640e:: with SMTP id y14mr5184288qkb.333.1565892501841; Thu, 15 Aug 2019 11:08:21 -0700 (PDT) Received: from [192.168.2.18] (cpe-76-179-66-50.maine.res.rr.com. [76.179.66.50]) by smtp.gmail.com with ESMTPSA id x69sm1874109qkb.4.2019.08.15.11.08.21 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 15 Aug 2019 11:08:21 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (1.0) From: Brian Dickson X-Mailer: iPhone Mail (16G77) In-Reply-To: <65A11E95-ABF6-4B70-AB63-62517A202419@fugue.com> Date: Thu, 15 Aug 2019 14:08:20 -0400 Cc: Adam Roach , Paul Hoffman , ADD Mailing list Content-Transfer-Encoding: quoted-printable Message-Id: References: <2C23D415-84F9-4B6C-B67B-0CC3EB600520@gmail.com> <65A11E95-ABF6-4B70-AB63-62517A202419@fugue.com> To: Ted Lemon Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 18:08:25 -0000 Sent from my iPhone > On Aug 15, 2019, at 1:54 PM, Ted Lemon wrote: >=20 >> On Aug 15, 2019, at 12:52, Brian Dickson w= rote: >>=20 >> Hypothetical (but very important question): >> If ALL browser DNS traffic was sent over BOTH DoH and DoT in parallel (bo= th encrypted, sent to the same resolver), do you agree that the privacy woul= d be the same (same encryption) and the unblockability would be unchanged? >=20 > Why is this an important question? If implemented universally by browsers (and other ADD apps), it would provid= e a missing signal about those apps. Specifically, it would be a somewhat we= ak signal that an app is legitimate (not rogue) and that it has not had its c= hoice of resolver changed to something unusual or noteworthy. The example use case for DoT is the same, except that DoT would also enable b= locking specific DNS resolver choices. The options available (to a network o= r security admin) would be greatly reduced, since it would not be possible t= o block DNS exclusively. It would enable detection of suspicious activity, i= ncluding identification of the host, which presumably could be quarantined. IMHO it doesn=E2=80=99t directly impact privacy, but would enable a limited d= egree of network admin control. Eg as long as a single public DoH resolver w= as not blocked, the client could have privacy for DNS. It=E2=80=99s s not pe= rfect by any means, but might be a reasonable starting point for exploring c= ompromises between network security and user privacy. Brian=20= From nobody Thu Aug 15 11:11:21 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0C2E61200B2 for ; Thu, 15 Aug 2019 11:11:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nohats.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sPUi-Kqol00t for ; Thu, 15 Aug 2019 11:11:18 -0700 (PDT) Received: from mx.nohats.ca (mx.nohats.ca [IPv6:2a03:6000:1004:1::68]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 163E5120074 for ; Thu, 15 Aug 2019 11:11:18 -0700 (PDT) Received: from localhost (localhost [IPv6:::1]) by mx.nohats.ca (Postfix) with ESMTP id 468ZJg5zFNzCP5 for ; Thu, 15 Aug 2019 20:11:15 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nohats.ca; s=default; t=1565892675; bh=Fra8SLY9TaRE6SlfqAmWO6ma0a5J6Wba1EGge0596Zo=; h=Date:From:To:Subject:In-Reply-To:References; b=eym6vvfMk/A8cVpTgU20NA+70NBcQ28svWyMgAs7kdOFPp6siR18lcYoc+aoaqJBv +Hc5S3ICYBaERwmaED6S8EfGJbRxeXiSQXuxcS+cl6l7xWKCmrdZm8ZUBpYWodOrGJ hLKDfUk+PgIa6JuzRKE72S5vqG+Dc1Xo5t7JCXXQ= X-Virus-Scanned: amavisd-new at mx.nohats.ca Received: from mx.nohats.ca ([IPv6:::1]) by localhost (mx.nohats.ca [IPv6:::1]) (amavisd-new, port 10024) with ESMTP id awRZvVa4jFya for ; Thu, 15 Aug 2019 20:11:14 +0200 (CEST) Received: from bofh.nohats.ca (bofh.nohats.ca [76.10.157.69]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx.nohats.ca (Postfix) with ESMTPS for ; Thu, 15 Aug 2019 20:11:13 +0200 (CEST) Received: by bofh.nohats.ca (Postfix, from userid 1000) id 5AAC6373B; Thu, 15 Aug 2019 14:11:12 -0400 (EDT) DKIM-Filter: OpenDKIM Filter v2.11.0 bofh.nohats.ca 5AAC6373B Received: from localhost (localhost [127.0.0.1]) by bofh.nohats.ca (Postfix) with ESMTP id 50805406CB1A for ; Thu, 15 Aug 2019 14:11:12 -0400 (EDT) Date: Thu, 15 Aug 2019 14:11:12 -0400 (EDT) From: Paul Wouters To: add@ietf.org In-Reply-To: <04866029-F45D-48CA-9484-BD0A08C0AC8B@gmail.com> Message-ID: References: <04866029-F45D-48CA-9484-BD0A08C0AC8B@gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8BIT Archived-At: Subject: Re: [Add] Use Cases - the coffee shop X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 18:11:20 -0000 On Thu, 15 Aug 2019, Brian Dickson wrote: > Top-reply addressing some of Paul W’s arguments: > - My recent experience with public Wi-Fi has been mixed. Many offer “open” SSIDs (no lock symbol, no password required) with captive portals of some flavor. I would not agree with the expectation of privacy for those. Nor would I expect any containerization. > - Given the previous bullet point, I believe it is reasonable for operators of those networks to limit their liability on customer vs customer traffic (eg malware) by use of DNS-based filters or other filter mechanisms. The only thing you need to do is block wifi-client --- AP ---wifi client traffic. Why on earth would you try to block client to client traffic using DNS? Especially because when clients can see each other's traffic, they can also start spoofing DNS answers that will be quicker than the real further away DNS server? > The same applies to community standards on content (porn etc). IMHO, liability trumps user choice, which is why there are Ts and Ca, whether or not the users pay attention to them. customers at any establishment can misbehave. You already should have a system in place for removing such customers, whether it is "bad" internet use, or spouting racists rants. Besides, you will never be able to block all porn using a DNS filter anyway. Any user can bring up a VPN and play all the porn they want. So since it is fairly trivial to circument, and not using DoH actually harms legitimate users that are being censored (new recent examples: Kashmir, possibly soon Hong Kong), I am in favour of DoH being possible, and maybe even should be the default. Although if it is the default, I do believe the browsers should be helt to _very_ high privacy standards for their DNS data. > Network neutrality is, unfortunately, a localized (possibly geo-political in nature or subject to corruption) thing. Still, the IETF designs for this principle. > Violating TOS and or jurisdiction-specific laws should not be done on a user’s behalf Neither should overreaching censorship be done on a user's behalf. But these arguments are rather open doors into the legal system, and not so much IETF themed discussions. > My point is basically, unless the network is owned by you or is a permanent provider to you (with well defined contract etc), the network owner is entirely justified in operating the network however they wish Sure, and the user is welcome to try and encrypt and route packets of their own choosing and assume that if the packets routes and get answers, that it falls within the network's valid use case. So DoH to my own private server will be fine on those networks. Your argument also throws dissidents and journalists under the bus. For the "safety" of trusting random unknown local ISPs over established (sadly mostly US based) DoH providers. Paul From nobody Thu Aug 15 11:20:47 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 12743120105 for ; Thu, 15 Aug 2019 11:20:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TUzHw9qRaeOz for ; Thu, 15 Aug 2019 11:20:39 -0700 (PDT) Received: from mail-lf1-x12d.google.com (mail-lf1-x12d.google.com [IPv6:2a00:1450:4864:20::12d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E72C8120074 for ; Thu, 15 Aug 2019 11:20:38 -0700 (PDT) Received: by mail-lf1-x12d.google.com with SMTP id c19so2254326lfm.10 for ; Thu, 15 Aug 2019 11:20:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=gPOtIVQ+jldAgIo4AjPkur5qqoeuObc2JWDHpXbABt8=; b=TqMmEPu2XJnkoeOAb/xiZJD7UAXLVE8daW8nOMsS6haORrnkAEsYmjQvuTaprzOlf9 180y6A9wCXNCAtgqhqgDabCKZk97VRjPY4QOspLB9630rTQMGEtTdT8lNQFVWwnrB44b e2p1Co+JDckpWkEvbm0/g3FHMWW1FM2GGrmUVl9wjUBE6AEg4ru9QTbhLTvVitnRtGY/ MGQev3TvvdFhRRZ9aSEnZOSCpW8cg0xvvxbppkNH7cuMoqTnEtukPXODlMf8IkfKue2/ Zndu30MYDiADwP+m5u2+EODnzvW5MYXcsR4idJP7ttdnewteognKyudg7W/ZeUj1OLgK bSyQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=gPOtIVQ+jldAgIo4AjPkur5qqoeuObc2JWDHpXbABt8=; b=AcZxONQDnMhVzfJhnQXBZNaoAGSFR2mXXuLglv/YWZpVexVZComY68jY3AFaDLNsSb JBq7hb2RL92NmhXygGQt/2ZZDKv6VZwkJKrDAWXhNGJ5uO9/rRkU0hPOCmhT5C5lAXPr DG2dtNh//s56TxGNXWPUze2eR5UMq0GUFLIj54QoIdDIlPzJhWYpROqFM2fH7CheGQlN t3m3/9PTR331aLWohDfEWWd7dmcG9vLj3B3Oz5KXicpFrIwzAMKhqgQH+ZfeuzBr3IG+ X7GWieTRSKKuDtlDi+g6Sum1dr1ScO8EEtMmCrLIIpz0p2H8bp+OEY4YOXxztIuLyTNm kZUw== X-Gm-Message-State: APjAAAVwGm4sVwr6R7MLuG6W4d3nEqsHwHobU5rf6RmGN7kBITEsKdKU pS+346e1wPkArRQEjxHPKVc2aO2JEJwRUtAibxmezA== X-Google-Smtp-Source: APXvYqySpInaouPeCvv9JX3zXw8tx3nss724nHhbNBxba4pW4P7IZhoLMzZkGj1CP0ylE0HmFvL/zXlJnAvUHBQbB4w= X-Received: by 2002:ac2:51a3:: with SMTP id f3mr2944750lfk.94.1565893237053; Thu, 15 Aug 2019 11:20:37 -0700 (PDT) MIME-Version: 1.0 References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <8e00891f-2aa2-ee11-559a-b5a8967b22d9@nostrum.com> <2C23D415-84F9-4B6C-B67B-0CC3EB600520@gmail.com> In-Reply-To: <2C23D415-84F9-4B6C-B67B-0CC3EB600520@gmail.com> From: Eric Rescorla Date: Thu, 15 Aug 2019 20:19:56 +0200 Message-ID: To: Brian Dickson Cc: Adam Roach , Paul Hoffman , ADD Mailing list Content-Type: multipart/alternative; boundary="00000000000026ba3905902bee12" Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 18:20:42 -0000 --00000000000026ba3905902bee12 Content-Type: text/plain; charset="UTF-8" On Thu, Aug 15, 2019 at 6:52 PM Brian Dickson wrote: > > > Sent from my iPhone > > On Aug 15, 2019, at 1:28 AM, Adam Roach wrote: > Hypothetical (but very important question): > If ALL browser DNS traffic was sent over BOTH DoH and DoT in parallel > (both encrypted, sent to the same resolver), do you agree that the privacy > would be the same (same encryption) and the unblockability would be > unchanged? > > The reason for doing this would be to allow the choice of resolver (per > client/app) to be discoverable. This is one significant gap in the DoH-only > model. It would not require that the browser (or any other app) wait for > both answers, so would at worst have no affect on performance, and at best > would improve performance. > I don't understand what this is intended to accomplish. In a later message, you argue that this would allow a network monitor to determine that this is a legitimate app that isn't using an undesirable DoH resolver, but I don't understand why you think that's true. It's true that the monitor can see that there are two connections to resolver X (DoH and DoT) but that doesn't mean that the app is using those for its resolution; it may be making a third connection to bad resolver Y and using the results from that. > One variant to consider would be sending a DoT-like DNS query with only > the query NAME encrypted or hashes (ie completely different from DoT or DoH > where the entire DNS message is encrypted) and to return A and AAAA RDATA > and QID and port number unencrypted (but encrypt all other fields and all > other RDATA responses). This would allow IDS/firewall systems to control > access on the basis of DNS answers, without needing to know the question. > If all the IDS gets to see is the IP, why don't they just block on the IP directly. -Ekr --00000000000026ba3905902bee12 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Thu, Aug 15, 2019 at 6:52 PM Brian= Dickson <brian.peter.d= ickson@gmail.com> wrote:


Sent from my iPhone
> On Aug 15, 2019, at 1:28 AM, Adam Roach <adam@nostrum.com> wrote:
Hypothetical= (but very important question):
If ALL browser DNS traffic was sent over BOTH DoH and DoT in parallel (both= encrypted, sent to the same resolver), do you agree that the privacy would= be the same (same encryption) and the unblockability would be unchanged? <= br>
The reason for doing this would be to allow the choice of resolver (per cli= ent/app) to be discoverable. This is one significant gap in the DoH-only mo= del. It would not require that the browser (or any other app) wait for both= answers, so would at worst have no affect on performance, and at best woul= d improve performance.

I don't unde= rstand what this is intended to accomplish.=C2=A0 In a later message, you a= rgue that this would allow a network monitor to determine that this is a le= gitimate app that isn't using an undesirable DoH resolver, but I don= 9;t understand why you think that's true. It's true that the monito= r can see that there are two connections to resolver X (DoH and DoT) but th= at doesn't mean that the app is using those for its resolution; it may = be making a third connection to bad resolver Y and using the results from t= hat.

=C2=A0
One variant to consider would be sending a DoT-like DNS query with only the= query NAME encrypted or hashes (ie completely different from DoT or DoH wh= ere the entire DNS message is encrypted) and to return A and AAAA RDATA and= QID and port number unencrypted (but encrypt all other fields and all othe= r RDATA responses). This would allow IDS/firewall systems to control access= on the basis of DNS answers, without needing to know the question.

If all the IDS gets to see is the IP, why don&= #39;t they just block on the IP directly.

-Ekr

--00000000000026ba3905902bee12-- From nobody Thu Aug 15 11:29:28 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 39ECD1200F1 for ; Thu, 15 Aug 2019 11:29:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fLEst7kpRi6h for ; Thu, 15 Aug 2019 11:29:24 -0700 (PDT) Received: from mail-qk1-x742.google.com (mail-qk1-x742.google.com [IPv6:2607:f8b0:4864:20::742]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 376A8120090 for ; Thu, 15 Aug 2019 11:29:17 -0700 (PDT) Received: by mail-qk1-x742.google.com with SMTP id r21so2666681qke.2 for ; Thu, 15 Aug 2019 11:29:17 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=ZEICSN7M3JGSGL+N6tZQJL0EVO2Yk4wWG+lYBzQD8nE=; b=Xx/Rj1xQxGGGsiphyS8vzozEb0gXscwJKKuiULaTYwBPNRuJxfVxVcwlzxePq+5m2t lWnYLibdNfB03mE9maGlOc8qqT6x9vhQZPXcfnhRHT8v2aEsGc29PWogwG5K8ynWB6o8 I0CLJMiCHaqKvXnBGtLpHzJWUrQL5rRaxabm4/sEp756x6fCRn7eAdZcjBwWZOwv7l0D OePTDYy2BIw9e6XRDNb9EYI+0i9MuhGM9ksHp2SY9ffLKjW/mxpfKa1Zceiv239ZOTym d6pe+WIF7jLLGo0HZEqHX+RyFumjC0Qjvz6PwIEsJpXwUZq78aOyi1zjLKIvHKbk4VcO gFKw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=ZEICSN7M3JGSGL+N6tZQJL0EVO2Yk4wWG+lYBzQD8nE=; b=T0U4bszZ73CT6RcecpRKRbPOKKerMvLFfJxUQLfCKxP4FoY7KWtTZ544yK+I6ehJAC ywhX3KC9oXdX0yhznM0jWR78Vy0LcYKzEQWIoQqrnN0bIVDP3N2xgfBYcN0wqv8uXSHQ LHGk6zluGTaJ5VGpR9d3BBLQkyeuqqyAk/I2tHJi0AShzu3PhXTEzN7P91ZjrgyvkHYC 6tylzGLyFSFrBQpApDGTIc8PvP6x1amEa/NdsXqQDNduDzYGyGAhSZuKiKuvBJo++4iQ 7PLzrNOu4ok+p2zEdF9K1gGSxy0WoskIYnEluTlapxuoIdga8EodsqSfSthoh/w3Umju EC1g== X-Gm-Message-State: APjAAAXDgHdLn7iMoOqTBm2YsZe33pL4J9J4usTxRDnaGyXtcRnIdHJF z39TxMS1tQlr11GHrXHf8W33WQ== X-Google-Smtp-Source: APXvYqz5RwtL1xPo2GZt+Kh1eHrfgg8Uz4+2fD0ONyKOD1sWzjtnTWEZY9H2zy/s5dCLM/5q5rAqbQ== X-Received: by 2002:a37:63d1:: with SMTP id x200mr5079699qkb.131.1565893756420; Thu, 15 Aug 2019 11:29:16 -0700 (PDT) Received: from ?IPv6:2001:470:c1a2:1:9128:e34:f62c:61a4? ([2001:470:c1a2:1:9128:e34:f62c:61a4]) by smtp.gmail.com with ESMTPSA id w10sm1729023qts.37.2019.08.15.11.29.15 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 15 Aug 2019 11:29:15 -0700 (PDT) From: Ted Lemon Message-Id: <0F932296-C744-4DB4-B2A1-C63A36BD4984@fugue.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_3489F974-3A2D-48B4-B577-D0E59A9A1780" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Thu, 15 Aug 2019 11:29:14 -0700 In-Reply-To: Cc: Adam Roach , Paul Hoffman , ADD Mailing list To: Brian Dickson References: <2C23D415-84F9-4B6C-B67B-0CC3EB600520@gmail.com> <65A11E95-ABF6-4B70-AB63-62517A202419@fugue.com> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 18:29:26 -0000 --Apple-Mail=_3489F974-3A2D-48B4-B577-D0E59A9A1780 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii On Aug 15, 2019, at 11:08 AM, Brian Dickson = wrote: > If implemented universally by browsers (and other ADD apps), it would = provide a missing signal about those apps. Specifically, it would be a = somewhat weak signal that an app is legitimate (not rogue) and that it = has not had its choice of resolver changed to something unusual or = noteworthy. Why not just have the app send an EDNS0 message to the resolver = announcing that it is doing DoH, if your goal is simply for it to reveal = that it is doing DoH? --Apple-Mail=_3489F974-3A2D-48B4-B577-D0E59A9A1780 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii On = Aug 15, 2019, at 11:08 AM, Brian Dickson <brian.peter.dickson@gmail.com> wrote:
If implemented universally by browsers (and other ADD apps), = it would provide a missing signal about those apps. Specifically, it = would be a somewhat weak signal that an app is legitimate (not rogue) = and that it has not had its choice of resolver changed to something = unusual or noteworthy.

Why not just have the app send an EDNS0 message to the = resolver announcing that it is doing DoH, if your goal is simply for it = to reveal that it is doing DoH?

= --Apple-Mail=_3489F974-3A2D-48B4-B577-D0E59A9A1780-- From nobody Thu Aug 15 11:30:02 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D41EE1200B2 for ; Thu, 15 Aug 2019 11:30:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZSrRNWYcCmUq for ; Thu, 15 Aug 2019 11:29:58 -0700 (PDT) Received: from mail-qt1-x82f.google.com (mail-qt1-x82f.google.com [IPv6:2607:f8b0:4864:20::82f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DD91B120074 for ; Thu, 15 Aug 2019 11:29:57 -0700 (PDT) Received: by mail-qt1-x82f.google.com with SMTP id x4so3352522qts.5 for ; Thu, 15 Aug 2019 11:29:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=1xHMQTvjd/MT4gL7gyrrMkvtxvJjUnGA5WRicaBhjKg=; b=Y02lM7/4Tu15zSly21besjnzxOAAw8km3BA6gDnbPLeu0i/A0RiFevau7GL1c1d3g4 I4gDco5pt+5zQNanZ7huJE7r53Nzc0+v4gF1EDeB9U4EavUEXumGoaKXVB08FcoFz8FN juURso4jh9ISLf4KJ2LcTRaS+3pol3LLbvm8OjXxxsY8lTkSlvOrXF8iJkacx3yMJvnf T1Vy3b+BNRzGJoEHhkIiKUCsP7m9jvSCXD6mMEoMLDru56uf3wSJWl9gstX16s8k4U39 0a3n1JYLmLfuG1qKWNETepu14Z9l2Cg8R5f9wHXKfpJa1z51CIx0vGZF4rzrTcj36wxO 7RwQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=1xHMQTvjd/MT4gL7gyrrMkvtxvJjUnGA5WRicaBhjKg=; b=Zc/L0WHX/gZtiHfwxnzWXbOpa04HKO7WA6vO2978VpgORYsKo0AZi/xBfsJMyX/Dgr ZG9zmA9Uzm71WSfRm+bjfzoGg/ZkX0G4huyPNbtZ9IBmufMH4yLvcDioaP1rP7DJCvcH D6kj5UWNaZe2smQTp9xx/lWSCNuyvNWycjJ4I3I3V/QL4kHRY7+aFk/VTVzE0HNhfBhD ye6JLPRTpNFr05M2sUz0D7DZFIqh8NW9uFXk25dKFvM7S4rvpznsZA645gJ2BRj1iZX/ cWeNxR/il7PzGGhM+ogkKdgaP0GpOrwl4yKiA+yncsgbFUsz85F5GtLUQSOnxqYHxdpQ Opdw== X-Gm-Message-State: APjAAAWjH1/bys7yXvlFI8dVTrnZ1YmTmvXFc+BgcsylQyCaPDBkIgcs xmhOS47ATrhRyD26++d1JCUfltZZ1ok= X-Google-Smtp-Source: APXvYqxfAomH6IYArjz/O96C/tmmIQS/umkJI26DcBWA/9nllV8dOGQSnpT8PF8gKRKNNYtIFCTAOA== X-Received: by 2002:ac8:1a37:: with SMTP id v52mr5241781qtj.129.1565893796821; Thu, 15 Aug 2019 11:29:56 -0700 (PDT) Received: from [192.168.2.18] (cpe-76-179-66-50.maine.res.rr.com. [76.179.66.50]) by smtp.gmail.com with ESMTPSA id f9sm1839606qkm.51.2019.08.15.11.29.56 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 15 Aug 2019 11:29:56 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (1.0) From: Brian Dickson X-Mailer: iPhone Mail (16G77) In-Reply-To: Date: Thu, 15 Aug 2019 14:29:55 -0400 Cc: add@ietf.org Content-Transfer-Encoding: quoted-printable Message-Id: References: <04866029-F45D-48CA-9484-BD0A08C0AC8B@gmail.com> To: Paul Wouters Archived-At: Subject: Re: [Add] Use Cases - the coffee shop X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 18:30:01 -0000 Sent from my iPhone >> On Aug 15, 2019, at 2:11 PM, Paul Wouters wrote: >>=20 >> On Thu, 15 Aug 2019, Brian Dickson wrote: >>=20 >> Top-reply addressing some of Paul W=E2=80=99s arguments: >> - My recent experience with public Wi-Fi has been mixed. Many offer =E2=80= =9Copen=E2=80=9D SSIDs (no lock symbol, no password required) with captive p= ortals of some flavor. I would not agree with the expectation of privacy for= those. Nor would I expect any containerization. >> - Given the previous bullet point, I believe it is reasonable for operato= rs of those networks to limit their liability on customer vs customer traffi= c (eg malware) by use of DNS-based filters or other filter mechanisms. >=20 > The only thing you need to do is block wifi-client --- AP ---wifi client > traffic. Why on earth would you try to block client to client traffic > using DNS? Especially because when clients can see each other's traffic, > they can also start spoofing DNS answers that will be quicker than the > real further away DNS server? >=20 >> The same applies to community standards on content (porn etc). IMHO, liab= ility trumps user choice, which is why there are Ts and Ca, whether or not t= he users pay attention to them. >=20 > customers at any establishment can misbehave. You already should have > a system in place for removing such customers, whether it is "bad" > internet use, or spouting racists rants. Besides, you will never be > able to block all porn using a DNS filter anyway. Any user can bring > up a VPN and play all the porn they want. >=20 > So since it is fairly trivial to circument, and not using DoH actually > harms legitimate users that are being censored (new recent examples: > Kashmir, possibly soon Hong Kong), I am in favour of DoH being possible, > and maybe even should be the default. Although if it is the default, I > do believe the browsers should be helt to _very_ high privacy standards > for their DNS data. >=20 >> Network neutrality is, unfortunately, a localized (possibly geo-political= in nature or subject to corruption) thing. >=20 > Still, the IETF designs for this principle. >=20 >> Violating TOS and or jurisdiction-specific laws should not be done on a u= ser=E2=80=99s behalf >=20 > Neither should overreaching censorship be done on a user's behalf. But > these arguments are rather open doors into the legal system, and not so > much IETF themed discussions. >=20 >> My point is basically, unless the network is owned by you or is a permane= nt provider to you (with well defined contract etc), the network owner is en= tirely justified in operating the network however they wish >=20 > Sure, and the user is welcome to try and encrypt and route packets of > their own choosing and assume that if the packets routes and get answers, > that it falls within the network's valid use case. So DoH to my own > private server will be fine on those networks. Your argument also throws > dissidents and journalists under the bus. You appear to have inadvertently excluded the one piece of my message that c= hanges the intent of my message, with respect to this =E2=80=9Cunder the bus= =E2=80=9D issue. I said =E2=80=9CPaul may choose to do so, but if he does, any risk associate= d with that is his responsibility, as it should be.=E2=80=9D That would (and should) apply to dissidents and journalists. I.e. parties wh= o understand those risks and without a doubt are in a position to enable DoH= with unambiguous informed consent. My argument precisely does not throw those folks under the bus. This is also the context within which to point out that since DoH hides all i= ts DNS traffic in the volume of general HTTPS traffic, the percentage of use= rs using DoH in theory should not matter, ie pushing all users onto DoH isn=E2= =80=99t strictly necessary to protect the dissidents and journalists IMHO. Brian > For the "safety" of trusting > random unknown local ISPs over established (sadly mostly US based) DoH > providers. >=20 > Paul >=20 > --=20 > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add From nobody Thu Aug 15 11:39:43 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C0F40120074 for ; Thu, 15 Aug 2019 11:39:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id faGEzIsCXYck for ; Thu, 15 Aug 2019 11:39:39 -0700 (PDT) Received: from NAM03-DM3-obe.outbound.protection.outlook.com (mail-eopbgr800135.outbound.protection.outlook.com [40.107.80.135]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A0285120071 for ; Thu, 15 Aug 2019 11:39:39 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=lsnwtzfFSKTCcLiAwur5FEnhRw33dgAltGRZWs5RZIFCRgRO/6mnMl7duiAn63Oa00nJAGQUzXhv0WMYzsQ4Cs7sdo2N7Pejut9ZHdVpBYQpxVRjAOMGvd4HRDPtwV1MVLMnH+9SU0Y0+z2yj1b7BpuGXW+OwxcgC/FJ69TP8s7nvSCPnkKXnj760pWZUh1v4tetBdZRYGq9vtUCJ4/8+1w6ewbMI342qvfrYqjHVc1890gSaE34OcIy/+uJ0Q5xya7y6HmaM2IX3ddxEuF+Blm8thgyZ+lJ2YLZWFv0z0M7JiVA0sZHy5WOGCf81+EIrVsNv0tV1M4kJxztuMqJbg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=6bHB1ZoiboG0Sxlkyy5pA5eHDME/5pRUh0Vzdhz96bE=; b=BJgBxK2UbtAJYSjsKXGyuBo45b3BKO7OaBGhn7rnntGHAUFLWu94/OzT1iMaZEbk96AFlKR9e1dXdE0hH65TjOmwWR+u/IVpwJ6QA1Tm3MrfH5Vy10hn7OxP5ddRy68Tjs6hB1hy2K7hvoyJX5lX13KzZoq7NhFgThz1PF83+TUZW3kElt7cnu+WauipMjIwf9igj57lD+rL1XPUKsjYSW28Cb6tnUDHeUgisXhv+N+oquRxKvtRcPXIP3rk0yxDBSmDIvV3QJ5hnJL44e+W0n7lNm786J3RGzHI7ifMxyq7O2lAz1jmXB5Fj5lDr3zTfDd35WM25Sf3ijcfydUueg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=microsoft.com; dmarc=pass action=none header.from=microsoft.com; dkim=pass header.d=microsoft.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=6bHB1ZoiboG0Sxlkyy5pA5eHDME/5pRUh0Vzdhz96bE=; b=deTp6YAr9aelNrqgIXQ2uM64rW++/nZosVDMaRrQkTEBu5fvmQ8NrRQDSzL0z3sGWrvyYk4WzaN9G7JoroiJyWeliTzdjEh+2Y8s4bo4xMdAL8LVQ/72UiYpYirLlu3YPRCePScxvhHifnuaakHPE+SZVqeLxtmyx+wUzTgzUJQ= Received: from MWHPR21MB0192.namprd21.prod.outlook.com (10.173.52.138) by MWHPR21MB0781.namprd21.prod.outlook.com (10.173.51.147) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2178.6; Thu, 15 Aug 2019 18:39:37 +0000 Received: from MWHPR21MB0192.namprd21.prod.outlook.com ([fe80::3040:4d29:2935:9a7f]) by MWHPR21MB0192.namprd21.prod.outlook.com ([fe80::3040:4d29:2935:9a7f%3]) with mapi id 15.20.2178.010; Thu, 15 Aug 2019 18:39:37 +0000 From: Tommy Jensen To: Eric Rescorla , Brian Dickson CC: Paul Hoffman , ADD Mailing list , Adam Roach Thread-Topic: [Add] [Ext] Validity of network administrator role Thread-Index: AQHVUyp4iPKBDVjDIkCVQCaF07YMYKb8bWGAgAAYXgCAAALNxw== Date: Thu, 15 Aug 2019 18:39:37 +0000 Message-ID: References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <8e00891f-2aa2-ee11-559a-b5a8967b22d9@nostrum.com> <2C23D415-84F9-4B6C-B67B-0CC3EB600520@gmail.com>, In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Jensen.Thomas@microsoft.com; x-originating-ip: [2001:4898:80e8:f:49d4:26fe:1372:35bd] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 98058260-7443-45ab-caa5-08d721afed40 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600158)(711020)(4605104)(1401327)(4618075)(2017052603328)(7193020); SRVR:MWHPR21MB0781; x-ms-traffictypediagnostic: MWHPR21MB0781: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-forefront-prvs: 01304918F3 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(4636009)(396003)(376002)(39860400002)(136003)(346002)(366004)(189003)(199004)(10290500003)(81166006)(66556008)(66946007)(81156014)(8990500004)(86362001)(74316002)(9686003)(53546011)(11346002)(52536014)(6246003)(2906002)(33656002)(54896002)(76116006)(8676002)(53936002)(7736002)(478600001)(6506007)(66476007)(229853002)(55016002)(8936002)(66446008)(64756008)(236005)(25786009)(10090500001)(19627405001)(14444005)(476003)(256004)(46003)(99286004)(105004)(446003)(110136005)(102836004)(5660300002)(6116002)(6436002)(71200400001)(66574012)(316002)(71190400001)(54906003)(14454004)(76176011)(7696005)(4326008)(186003)(22452003)(486006); DIR:OUT; SFP:1102; SCL:1; SRVR:MWHPR21MB0781; H:MWHPR21MB0192.namprd21.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: iqmQCSEDJQVb+6mdCx5wEqKKcyiGoj2VATYNXwJ2RnL+KkD/qDaQBF2b79Ffaak7xC9NDNKMLkfsKk77OIuA0Ohvq2JSrFpYswPmTwjcQOcW10ivgWmkyhmeodBMBh+Y9rm1pAKRa7Gx9XSrhNIf+MATadpxQCzEgPNUPftTrJdfSS1J1GkyiDscKYQE15u8gNCJdc44deufrrWBnw/9aZ+TEp7ueZ1/T3pXZXAY3JwHx2D6hA4xxRYMXPz+lEpG9Rkz/D48kUCtABusdh6S3hQa6l1LTz0ThwGVyZOZyIdWTJJQ4WUSt9Gg8F2m6/EToOEd3LLMNZtuyhJ6mQqCXECd5s4Szp2tFnWSQcBRzJv9qoQLV0szTH/mEwdB6kUSilhkVmwCnJeAuopDYdvSTsoVex4bk6XMpAEojissjNs= x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_MWHPR21MB01929E3203DC2F0C21C49014FAAC0MWHPR21MB0192namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: 98058260-7443-45ab-caa5-08d721afed40 X-MS-Exchange-CrossTenant-originalarrivaltime: 15 Aug 2019 18:39:37.8513 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: G7cC2/yC3T65AMZwclVoHWDMBZyyTeWNOfAHzd/SB6AfdCGbcyLJIsX0zQ9zL9ivB+MlE9D4fRD/WgabJUHWAQ== X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR21MB0781 Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 18:39:43 -0000 --_000_MWHPR21MB01929E3203DC2F0C21C49014FAAC0MWHPR21MB0192namp_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable ekr> If all the IDS gets to see is the IP, why don't they just block on the= IP directly. Agreed. It doesn't matter how the client acquired an IP address (DNS, user = typing, etc.) if the network knows the IP is bad already. In general, I think any approach to appeasing user privacy and network secu= rity that begins with deciding which parts of traffic to leave unencrypted = is heading in the wrong direction. The major point of encrypting traffic is= to prevent third party boxes from seeing/tampering with the data, and ther= e's no way to differentiate third parties with good and ill intent. Focusin= g on how the decision in resolvers gets made in the first place seems to pr= ovide more value, as the traffic can be manipulated in the Good Ways(tm) by= the resolver trusted to do so, and not by anyone else along the path. Enab= ling Good Ways(tm) tampering by anyone other than the RR the stub is trying= to reach just puts us back in square one (classic DNS). Thanks, Tommy ________________________________ From: Add on behalf of Eric Rescorla Sent: Thursday, August 15, 2019 11:19 AM To: Brian Dickson Cc: Paul Hoffman ; ADD Mailing list ;= Adam Roach Subject: Re: [Add] [Ext] Validity of network administrator role On Thu, Aug 15, 2019 at 6:52 PM Brian Dickson > wrote: Sent from my iPhone > On Aug 15, 2019, at 1:28 AM, Adam Roach > wrote: Hypothetical (but very important question): If ALL browser DNS traffic was sent over BOTH DoH and DoT in parallel (both= encrypted, sent to the same resolver), do you agree that the privacy would= be the same (same encryption) and the unblockability would be unchanged? The reason for doing this would be to allow the choice of resolver (per cli= ent/app) to be discoverable. This is one significant gap in the DoH-only mo= del. It would not require that the browser (or any other app) wait for both= answers, so would at worst have no affect on performance, and at best woul= d improve performance. I don't understand what this is intended to accomplish. In a later message= , you argue that this would allow a network monitor to determine that this = is a legitimate app that isn't using an undesirable DoH resolver, but I don= 't understand why you think that's true. It's true that the monitor can see= that there are two connections to resolver X (DoH and DoT) but that doesn'= t mean that the app is using those for its resolution; it may be making a t= hird connection to bad resolver Y and using the results from that. One variant to consider would be sending a DoT-like DNS query with only the= query NAME encrypted or hashes (ie completely different from DoT or DoH wh= ere the entire DNS message is encrypted) and to return A and AAAA RDATA and= QID and port number unencrypted (but encrypt all other fields and all othe= r RDATA responses). This would allow IDS/firewall systems to control access= on the basis of DNS answers, without needing to know the question. If all the IDS gets to see is the IP, why don't they just block on the IP d= irectly. -Ekr --_000_MWHPR21MB01929E3203DC2F0C21C49014FAAC0MWHPR21MB0192namp_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable
ekr> If all the IDS gets to see is the IP, why don't they just block on the IP dir= ectly.
From: Add <add-bounces@i= etf.org> on behalf of Eric Rescorla <ekr@rtfm.com>
Sent: Thursday, August 15, 2019 11:19 AM
To: Brian Dickson <brian.peter.dickson@gmail.com>
Cc: Paul Hoffman <paul.hoffman@icann.org>; ADD Mailing list &l= t;add@ietf.org>; Adam Roach <adam@nostrum.com>
Subject: Re: [Add] [Ext] Validity of network administrator role
 


On Thu, Aug 15, 2019 at 6:52 PM Bri= an Dickson <brian.peter= .dickson@gmail.com> wrote:


Sent from my iPhone
> On Aug 15, 2019, at 1:28 AM, Adam Roach <adam@nostrum.com> wrote:
Hypothetical (but very important question):
If ALL browser DNS traffic was sent over BOTH DoH and DoT in parallel (both= encrypted, sent to the same resolver), do you agree that the privacy would= be the same (same encryption) and the unblockability would be unchanged?

The reason for doing this would be to allow the choice of resolver (per cli= ent/app) to be discoverable. This is one significant gap in the DoH-only mo= del. It would not require that the browser (or any other app) wait for both= answers, so would at worst have no affect on performance, and at best would improve performance.

I don't understand what this is intended to accomplish.  In a lat= er message, you argue that this would allow a network monitor to determine = that this is a legitimate app that isn't using an undesirable DoH resolver,= but I don't understand why you think that's true. It's true that the monitor can see that there are two connect= ions to resolver X (DoH and DoT) but that doesn't mean that the app is usin= g those for its resolution; it may be making a third connection to bad reso= lver Y and using the results from that.

 
One variant to consider would be sending a DoT-like DNS query with only the= query NAME encrypted or hashes (ie completely different from DoT or DoH wh= ere the entire DNS message is encrypted) and to return A and AAAA RDATA and= QID and port number unencrypted (but encrypt all other fields and all other RDATA responses). This would a= llow IDS/firewall systems to control access on the basis of DNS answers, wi= thout needing to know the question.

If all the IDS gets to see is the IP, why don't they just block on the= IP directly.

-Ekr

--_000_MWHPR21MB01929E3203DC2F0C21C49014FAAC0MWHPR21MB0192namp_-- From nobody Thu Aug 15 11:41:13 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BB3C1120105 for ; Thu, 15 Aug 2019 11:41:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0WwNITzXklIC for ; Thu, 15 Aug 2019 11:41:05 -0700 (PDT) Received: from mail-qt1-x833.google.com (mail-qt1-x833.google.com [IPv6:2607:f8b0:4864:20::833]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D7BCB120071 for ; Thu, 15 Aug 2019 11:41:04 -0700 (PDT) Received: by mail-qt1-x833.google.com with SMTP id u34so3411154qte.2 for ; Thu, 15 Aug 2019 11:41:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=piL+D1BdnQwmkKot8QQpAXu6sysgMQtt5fRKF9znbhE=; b=omf7VtGlhBww5/2/k8xV7wVL+eYOqkkvxngxJHB4VtQbYYvEe+f6Jxnu5omQ+CaMJV FFLrgWCUyBaYB8U30aHWPlIcXz4WuX/uTd38gmtg5O9/VEfVXHVB4/Eezz5TAVEQJl5I /teBVh2WK8vasI4PL2sNd2xano7PWuCPUunzDaHZCzWIRkAjpgzXQIuN67/q6AgsYJeQ QAs/bTn7oZ446QHbmC7hEaBUKLaH6VYvCT+BqikzGakQngpRTcwLJtxzyQaxUHSVw8nB p9u3CkJcXgFPjcjA4Fq/h8xQXCbjD11cvuBqrzkXkX+Eebia5hZlkqL8mix7oP6fE40m /ClA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=piL+D1BdnQwmkKot8QQpAXu6sysgMQtt5fRKF9znbhE=; b=AIywHfK3+Wia0hQoWrmPyIHkY/lM0lzm3S3LXEW81nbzo4C/YchJsUofLmWMGTEKFx O2yNGpT+SGOQzbpew0ab2/wys6EYAi9MxnNCWeC1D24HUAm+c/bBBtIiFoSzcC5H6oAy kLawpcmqJDmgwkTzL+e+WifgW4wDxR46QiwTnriX/x5CcLHvpOvJwVA4iERtcPWeeb2Z 9uohrAHCjNtKMI8pYvWyCKOLfqs9ENsXJVL8zxv3rqUzd+Uc6EXl6Ws6mpzfF2xKjyoa V0k8HuBIudDak/MdpPXO/+WwmzdVIsz68mC9TKa3BEBSFtkM1VHO937QI/Bz2el0x0Ha 6LdQ== X-Gm-Message-State: APjAAAX6tavlbzBAgMpruD0bFf4pvnO48jzkPsW3CMyVKVkAIyT9JU6q LL9P+aTTBtmL4Evr4Ov7uVBzQH7Ew+c= X-Google-Smtp-Source: APXvYqy30D4c96ESzDxKewNqSslRMAJWm2eY++VB/VijbbunvKU/WiMLkP7cqSvft4edmF3nm6uW7Q== X-Received: by 2002:aed:3a03:: with SMTP id n3mr5011683qte.85.1565894464003; Thu, 15 Aug 2019 11:41:04 -0700 (PDT) Received: from [192.168.2.18] (cpe-76-179-66-50.maine.res.rr.com. [76.179.66.50]) by smtp.gmail.com with ESMTPSA id r14sm1872204qke.47.2019.08.15.11.41.03 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 15 Aug 2019 11:41:03 -0700 (PDT) Content-Type: multipart/alternative; boundary=Apple-Mail-0ACAA085-8E14-439E-862A-E573D8D8C79F Mime-Version: 1.0 (1.0) From: Brian Dickson X-Mailer: iPhone Mail (16G77) In-Reply-To: Date: Thu, 15 Aug 2019 14:41:02 -0400 Cc: Adam Roach , Paul Hoffman , ADD Mailing list Content-Transfer-Encoding: 7bit Message-Id: <3BAF0D47-67BD-4BA2-96D3-A9AB3095F04A@gmail.com> References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <8e00891f-2aa2-ee11-559a-b5a8967b22d9@nostrum.com> <2C23D415-84F9-4B6C-B67B-0CC3EB600520@gmail.com> To: Eric Rescorla Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 18:41:12 -0000 --Apple-Mail-0ACAA085-8E14-439E-862A-E573D8D8C79F Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Sent from my iPhone > On Aug 15, 2019, at 2:19 PM, Eric Rescorla wrote: >=20 >=20 >=20 >> On Thu, Aug 15, 2019 at 6:52 PM Brian Dickson wrote: >>=20 >>=20 >> Sent from my iPhone >> > On Aug 15, 2019, at 1:28 AM, Adam Roach wrote: >> Hypothetical (but very important question): >> If ALL browser DNS traffic was sent over BOTH DoH and DoT in parallel (bo= th encrypted, sent to the same resolver), do you agree that the privacy woul= d be the same (same encryption) and the unblockability would be unchanged?=20= >>=20 >> The reason for doing this would be to allow the choice of resolver (per c= lient/app) to be discoverable. This is one significant gap in the DoH-only m= odel. It would not require that the browser (or any other app) wait for both= answers, so would at worst have no affect on performance, and at best would= improve performance. >=20 > I don't understand what this is intended to accomplish. In a later messag= e, you argue that this would allow a network monitor to determine that this i= s a legitimate app that isn't using an undesirable DoH resolver, but I don't= understand why you think that's true. It's true that the monitor can see th= at there are two connections to resolver X (DoH and DoT) but that doesn't me= an that the app is using those for its resolution; it may be making a third c= onnection to bad resolver Y and using the results from that. >=20 > =20 >> One variant to consider would be sending a DoT-like DNS query with only t= he query NAME encrypted or hashes (ie completely different from DoT or DoH w= here the entire DNS message is encrypted) and to return A and AAAA RDATA and= QID and port number unencrypted (but encrypt all other fields and all other= RDATA responses). This would allow IDS/firewall systems to control access o= n the basis of DNS answers, without needing to know the question. >=20 > If all the IDS gets to see is the IP, why don't they just block on the IP d= irectly. >=20 The IDS and/or threat service needs to detect such an IP before it can be bl= ocked. The first clue new malware may provide is changing DNS so as to avoid IDS de= tection via DNS. The same approach could also be used by a malicious human, eg doing data exf= iltration. My understanding is that detection is significantly hampered without any DNS= information. This is better than nothing even if it is far from ideal.=20 And in the case of a configured enterprise DoH server on a company owned dev= ice, where DNS resolution is monitored, changing resolver would be necessary= to evade detection. Again, not entirely foolproof, but certainly raises the bar, IMHO. Brian=20= --Apple-Mail-0ACAA085-8E14-439E-862A-E573D8D8C79F Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable

Sent from my iPhone

On Aug 15, 2019, at 2:19= PM, Eric Rescorla <ekr@rtfm.com> w= rote:



On Thu, Aug 15, 2019 at 6:52 PM Brian Dickson <brian.peter.dickson@gmail.com> wrote:

=
Sent from my iPhone
> On Aug 15, 2019, at 1:28 AM, Adam Roach <adam@nostrum.com> wrote:
Hypothetical (= but very important question):
If ALL browser DNS traffic was sent over BOTH DoH and DoT in parallel (both e= ncrypted, sent to the same resolver), do you agree that the privacy would be= the same (same encryption) and the unblockability would be unchanged?

The reason for doing this would be to allow the choice of resolver (per clie= nt/app) to be discoverable. This is one significant gap in the DoH-only mode= l. It would not require that the browser (or any other app) wait for both an= swers, so would at worst have no affect on performance, and at best would im= prove performance.

I don't understand wh= at this is intended to accomplish.  In a later message, you argue that t= his would allow a network monitor to determine that this is a legitimate app= that isn't using an undesirable DoH resolver, but I don't understand why yo= u think that's true. It's true that the monitor can see that there are two c= onnections to resolver X (DoH and DoT) but that doesn't mean that the app is= using those for its resolution; it may be making a third connection to bad r= esolver Y and using the results from that.

&nbs= p;
One variant to consider would be sending a DoT-like DNS query with only the q= uery NAME encrypted or hashes (ie completely different from DoT or DoH where= the entire DNS message is encrypted) and to return A and AAAA RDATA and QID= and port number unencrypted (but encrypt all other fields and all other RDA= TA responses). This would allow IDS/firewall systems to control access on th= e basis of DNS answers, without needing to know the question.

If all the IDS gets to see is the IP, why don't they j= ust block on the IP directly.


The IDS and/or threat service needs to detect su= ch an IP before it can be blocked.

The first clue n= ew malware may provide is changing DNS so as to avoid IDS detection via DNS.=

The same approach could also be used by a maliciou= s human, eg doing data exfiltration.

My understandi= ng is that detection is significantly hampered without any DNS information. T= his is better than nothing even if it is far from ideal. 
And in the case of a configured enterprise DoH server on a compa= ny owned device, where DNS resolution is monitored, changing resolver would b= e necessary to evade detection.

Again, not entirely= foolproof, but certainly raises the bar, IMHO.

Bri= an 
= --Apple-Mail-0ACAA085-8E14-439E-862A-E573D8D8C79F-- From nobody Thu Aug 15 11:44:39 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F36CA120074 for ; Thu, 15 Aug 2019 11:44:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MrumFmSJznhV for ; Thu, 15 Aug 2019 11:44:35 -0700 (PDT) Received: from mail-qk1-x72f.google.com (mail-qk1-x72f.google.com [IPv6:2607:f8b0:4864:20::72f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A2F9A120071 for ; Thu, 15 Aug 2019 11:44:35 -0700 (PDT) Received: by mail-qk1-x72f.google.com with SMTP id s14so2713363qkm.4 for ; Thu, 15 Aug 2019 11:44:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=9ASdT/c3Ub2tj054Al015u96uvIy/1bBklnpz+rfavY=; b=Bzniz5nGg565Xq8Ju2qw8WrjWonZRNmZCVUmHkBCSZKKhD94W6eB9rn+15O2hyaeF4 CC+Z0ywdXval3Xb8soo/KvwmCnACXXj7iWGhVS70uvNrdVZooqf1zuWL5Z9aU3XdDSEl LLLQxyn8nlnnSIST3WMnCUY99xdeXpSzLlpI0GDbWwo2cGxMRJ7J65CXB6UYWSFbd9LK HYlDVZvcXeqTvRx3ebLRCNeuLEZ5U+tpcnVHph92h+7iqZZQCq5AvJ3BmxqqO2hQU/2C adw1hA3i2pbpkQyG9XXcEY4QU61dHfJb6ze6YU+8g4A8qdw9kachrapoqTEi5S5sC6He savg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=9ASdT/c3Ub2tj054Al015u96uvIy/1bBklnpz+rfavY=; b=ICLYsz1gLVeeRuKJ+qCDqZRBICbfBOYGv2N5+f7jy+QcAPcCUJZTmZ2uXA0TYdg7ix bwbcCXF14aVexn9T1tMoJOdcaW/HCAU8XS2jTNUCtCh5SaNdnzpYjYzqcog7V683ZhRL ACt+cuy9Wm5g3JZN5frAAB+aOxIoE0vqUFv93odxagYBRLwB+lbYLptdIxUK7nAWx9WO zZx5CHx39FI2svUUS5zEgjAQZrGwjl2brF4vdIjOTWoIKCce5P+jIajPDyVrOx02jRv1 tkBFZ496TdLr4FcOol9OcUsiZS1obAqipdwmiQ5DzaR3bP2Ug+yeEzZT35dNfneOS9NT g7Cw== X-Gm-Message-State: APjAAAXpEh1kqW8n61OqerT8piToVmp6Xj9rzLgJtHcmjDQac4Zv2jfr CH5t+XLzbnZ8RWCsmf7grGdz1k0vJ14= X-Google-Smtp-Source: APXvYqx3gminrHz+lsAxZLQxWpu+Vuy1KVCdPaFpZSee2ucA6JmHe7wsU5yz1nMgPGscX1DWZHBNmQ== X-Received: by 2002:ae9:ee07:: with SMTP id i7mr5582099qkg.410.1565894674766; Thu, 15 Aug 2019 11:44:34 -0700 (PDT) Received: from [192.168.2.18] (cpe-76-179-66-50.maine.res.rr.com. [76.179.66.50]) by smtp.gmail.com with ESMTPSA id 143sm1844839qkl.114.2019.08.15.11.44.34 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 15 Aug 2019 11:44:34 -0700 (PDT) Content-Type: multipart/alternative; boundary=Apple-Mail-EF68DEE4-20FC-4373-8E7F-04F8484BC27A Mime-Version: 1.0 (1.0) From: Brian Dickson X-Mailer: iPhone Mail (16G77) In-Reply-To: Date: Thu, 15 Aug 2019 14:44:33 -0400 Cc: Adam Roach , Paul Hoffman , ADD Mailing list Content-Transfer-Encoding: 7bit Message-Id: <81463267-1436-4155-BBB9-488ED659C8D8@gmail.com> References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <8e00891f-2aa2-ee11-559a-b5a8967b22d9@nostrum.com> <2C23D415-84F9-4B6C-B67B-0CC3EB600520@gmail.com> To: Eric Rescorla Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 18:44:38 -0000 --Apple-Mail-EF68DEE4-20FC-4373-8E7F-04F8484BC27A Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Sent from my iPhone > On Aug 15, 2019, at 2:19 PM, Eric Rescorla wrote: >=20 >=20 >=20 >> On Thu, Aug 15, 2019 at 6:52 PM Brian Dickson wrote: >>=20 >>=20 >> Sent from my iPhone >> > On Aug 15, 2019, at 1:28 AM, Adam Roach wrote: >> Hypothetical (but very important question): >> If ALL browser DNS traffic was sent over BOTH DoH and DoT in parallel (bo= th encrypted, sent to the same resolver), do you agree that the privacy woul= d be the same (same encryption) and the unblockability would be unchanged?=20= >>=20 >> The reason for doing this would be to allow the choice of resolver (per c= lient/app) to be discoverable. This is one significant gap in the DoH-only m= odel. It would not require that the browser (or any other app) wait for both= answers, so would at worst have no affect on performance, and at best would= improve performance. >=20 > I don't understand what this is intended to accomplish. In a later messag= e, you argue that this would allow a network monitor to determine that this i= s a legitimate app that isn't using an undesirable DoH resolver, but I don't= understand why you think that's true. It's true that the monitor can see th= at there are two connections to resolver X (DoH and DoT) but that doesn't me= an that the app is using those for its resolution; it may be making a third c= onnection to bad resolver Y and using the results from that. That=E2=80=99s why I suggested a variation where answer A or AAAA data would= be exposed. Any new connection not correlated to a recent A/AAAA response could be flagg= ed or blocked. Not perfect, but another tool for the defense against apps be= having badly. Brian=20 >=20 > =20 >> One variant to consider would be sending a DoT-like DNS query with only t= he query NAME encrypted or hashes (ie completely different from DoT or DoH w= here the entire DNS message is encrypted) and to return A and AAAA RDATA and= QID and port number unencrypted (but encrypt all other fields and all other= RDATA responses). This would allow IDS/firewall systems to control access o= n the basis of DNS answers, without needing to know the question. >=20 > If all the IDS gets to see is the IP, why don't they just block on the IP d= irectly. >=20 > -Ekr >=20 --Apple-Mail-EF68DEE4-20FC-4373-8E7F-04F8484BC27A Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable

Sent from my iPhone

On Aug 15, 2019, at 2:19= PM, Eric Rescorla <ekr@rtfm.com> w= rote:



On Thu, Aug 15, 2019 at 6:52 PM Brian Dickson <brian.peter.dickson@gmail.com> wrote:

=
Sent from my iPhone
> On Aug 15, 2019, at 1:28 AM, Adam Roach <adam@nostrum.com> wrote:
Hypothetical (= but very important question):
If ALL browser DNS traffic was sent over BOTH DoH and DoT in parallel (both e= ncrypted, sent to the same resolver), do you agree that the privacy would be= the same (same encryption) and the unblockability would be unchanged?

The reason for doing this would be to allow the choice of resolver (per clie= nt/app) to be discoverable. This is one significant gap in the DoH-only mode= l. It would not require that the browser (or any other app) wait for both an= swers, so would at worst have no affect on performance, and at best would im= prove performance.

I don't understand wh= at this is intended to accomplish.  In a later message, you argue that t= his would allow a network monitor to determine that this is a legitimate app= that isn't using an undesirable DoH resolver, but I don't understand why yo= u think that's true. It's true that the monitor can see that there are two c= onnections to resolver X (DoH and DoT) but that doesn't mean that the app is= using those for its resolution; it may be making a third connection to bad r= esolver Y and using the results from that.

That=E2=80=99s why I suggested a variation where a= nswer A or AAAA data would be exposed.
Any new connection not corr= elated to a recent A/AAAA response could be flagged or blocked. Not perfect,= but another tool for the defense against apps behaving badly.
Brian 

=

 
=
One variant to consider would be sending a DoT-like DNS query with only the q= uery NAME encrypted or hashes (ie completely different from DoT or DoH where= the entire DNS message is encrypted) and to return A and AAAA RDATA and QID= and port number unencrypted (but encrypt all other fields and all other RDA= TA responses). This would allow IDS/firewall systems to control access on th= e basis of DNS answers, without needing to know the question.

If all the IDS gets to see is the IP, why don't they j= ust block on the IP directly.

-Ekr

= --Apple-Mail-EF68DEE4-20FC-4373-8E7F-04F8484BC27A-- From nobody Thu Aug 15 11:48:06 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 96EDA1200F8 for ; Thu, 15 Aug 2019 11:48:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zsfUv4R7mTym for ; Thu, 15 Aug 2019 11:48:02 -0700 (PDT) Received: from mail-lf1-x12b.google.com (mail-lf1-x12b.google.com [IPv6:2a00:1450:4864:20::12b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 667171200F3 for ; Thu, 15 Aug 2019 11:48:01 -0700 (PDT) Received: by mail-lf1-x12b.google.com with SMTP id n19so2291860lfe.13 for ; Thu, 15 Aug 2019 11:48:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=k+I18IpaHeX4tbFQk6Qh5HKcZlFaG+b2FiWMiOzt31Q=; b=z6W8fpcZ+8AIsS7krM+0kP/kjg9Uxj6/1KgfJoVl1EALJ5OB1f89omzHBRgRR3+0QN PX6TVjnpJFg4jeIJDOwFqAtYyZUrJ2liFLWAAGaOsTNx5was7AVP5lXpp4CbDB1Ifn1X NfZkY5Rjn9Gw+Eb6RjMC6lt4Ji1p4IGtFEDyqfM4gB1xI9+Ker5j3MsoKrOVFOCVkZbS FKfcSVmCOG2uS4YJ7OD1xg81bIoHVtO4P2XlUldyLP2OwSy22lg4cO66Ialsiw6+Zm8E M+STU/zsxu5AcLYwOwhCWKaWq07X9lIC/QJDkwS3SUuSGPqm+aNTnQcMIFR4NwPPiPdY GFcg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=k+I18IpaHeX4tbFQk6Qh5HKcZlFaG+b2FiWMiOzt31Q=; b=FIxPuS/EMyGfCC/boRQD6yTJFWYMEoWHGY3dv8ueYWcTw33rsnEz73BuxWor2M0Doz kkA73Lu8Z2GpqlFjyEUIqVfyFThcll/9ARgCZoMHU2Dz4osWBvayot/yphMboS0oYLVI 4cvOUJOj6/JMusIgcNFXG/Rw6w8iBei/gLZiCfXIP7PUUjRhAClTtp8rf89DLyESHkEM PPNbjWYA0nWeKTmbyw/lnjPd3C5BLisVyWjB18ffBB1yDMHDR1avofJWN0UyyVKL+hIO ZB/oPxURRxGfiFVj3Mmm4A+SIEIMfbOsZ6rDM334akg7Fcb12WAQXNRnhcVPSkTEoB0S sImQ== X-Gm-Message-State: APjAAAWK7+xJ3Aq9cdoDAR6yHtY68Kj+Cv2CIKnoW/xVQ1JCSRPwTnzZ fiLW/98M4lMxdny5RRgcr0/vtbFOMa6dYhDVSDGkkA== X-Google-Smtp-Source: APXvYqyOsIoOcEarMmAc3z/9U+ivMn5d8OH55o7Z6mhy1mZfqvIeicGQELF25x+rq819KmkNkah87HGuc1No6ERw8lw= X-Received: by 2002:a19:7908:: with SMTP id u8mr3140299lfc.178.1565894879617; Thu, 15 Aug 2019 11:47:59 -0700 (PDT) MIME-Version: 1.0 References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <8e00891f-2aa2-ee11-559a-b5a8967b22d9@nostrum.com> <2C23D415-84F9-4B6C-B67B-0CC3EB600520@gmail.com> <3BAF0D47-67BD-4BA2-96D3-A9AB3095F04A@gmail.com> In-Reply-To: <3BAF0D47-67BD-4BA2-96D3-A9AB3095F04A@gmail.com> From: Eric Rescorla Date: Thu, 15 Aug 2019 20:47:20 +0200 Message-ID: To: Brian Dickson Cc: Adam Roach , Paul Hoffman , ADD Mailing list Content-Type: multipart/alternative; boundary="0000000000000e3eb605902c5090" Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 18:48:05 -0000 --0000000000000e3eb605902c5090 Content-Type: text/plain; charset="UTF-8" On Thu, Aug 15, 2019 at 8:41 PM Brian Dickson wrote: > > > Sent from my iPhone > > On Aug 15, 2019, at 2:19 PM, Eric Rescorla wrote: > > > > On Thu, Aug 15, 2019 at 6:52 PM Brian Dickson < > brian.peter.dickson@gmail.com> wrote: > >> >> >> Sent from my iPhone >> > On Aug 15, 2019, at 1:28 AM, Adam Roach wrote: >> Hypothetical (but very important question): >> If ALL browser DNS traffic was sent over BOTH DoH and DoT in parallel >> (both encrypted, sent to the same resolver), do you agree that the privacy >> would be the same (same encryption) and the unblockability would be >> unchanged? >> >> The reason for doing this would be to allow the choice of resolver (per >> client/app) to be discoverable. This is one significant gap in the DoH-only >> model. It would not require that the browser (or any other app) wait for >> both answers, so would at worst have no affect on performance, and at best >> would improve performance. >> > > I don't understand what this is intended to accomplish. In a later > message, you argue that this would allow a network monitor to determine > that this is a legitimate app that isn't using an undesirable DoH resolver, > but I don't understand why you think that's true. It's true that the > monitor can see that there are two connections to resolver X (DoH and DoT) > but that doesn't mean that the app is using those for its resolution; it > may be making a third connection to bad resolver Y and using the results > from that. > > > >> One variant to consider would be sending a DoT-like DNS query with only >> the query NAME encrypted or hashes (ie completely different from DoT or DoH >> where the entire DNS message is encrypted) and to return A and AAAA RDATA >> and QID and port number unencrypted (but encrypt all other fields and all >> other RDATA responses). This would allow IDS/firewall systems to control >> access on the basis of DNS answers, without needing to know the question. >> > > If all the IDS gets to see is the IP, why don't they just block on the IP > directly. > > > The IDS and/or threat service needs to detect such an IP before it can be > blocked. > > The first clue new malware may provide is changing DNS so as to avoid IDS > detection via DNS. > > The same approach could also be used by a malicious human, eg doing data > exfiltration. > > My understanding is that detection is significantly hampered without any > DNS information. This is better than nothing even if it is far from ideal. > > And in the case of a configured enterprise DoH server on a company owned > device, where DNS resolution is monitored, changing resolver would be > necessary to evade detection. > > Again, not entirely foolproof, but certainly raises the bar, IMHO. > I'm really not following your reasoning here. As I said, the application is perfectly free to just use a totally separate channel and get IP addresses that don't get advertised this way. What would be helpful here would be if you described what it is that (a) you cannot do with DoH and (b) you can do if applications do as you suggest. -Ekr > Brian > --0000000000000e3eb605902c5090 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Thu, Aug 15, 2019 at 8:41 PM Brian= Dickson <brian.peter.d= ickson@gmail.com> wrote:


Sent from my iPhone

On Aug 15, 2019, at 2:19 PM, Eric Rescorla <ekr@rtfm.com> wrote:


On Thu, Aug 15, 2019 at 6:52 PM Brian Dickson <brian.peter.dickson@gmail.com> wrote:

Sent from my iPhone
> On Aug 15, 2019, at 1:28 AM, Adam Roach <adam@nostrum.com> wrote:
Hypothetical= (but very important question):
If ALL browser DNS traffic was sent over BOTH DoH and DoT in parallel (both= encrypted, sent to the same resolver), do you agree that the privacy would= be the same (same encryption) and the unblockability would be unchanged? <= br>
The reason for doing this would be to allow the choice of resolver (per cli= ent/app) to be discoverable. This is one significant gap in the DoH-only mo= del. It would not require that the browser (or any other app) wait for both= answers, so would at worst have no affect on performance, and at best woul= d improve performance.

I don't unde= rstand what this is intended to accomplish.=C2=A0 In a later message, you a= rgue that this would allow a network monitor to determine that this is a le= gitimate app that isn't using an undesirable DoH resolver, but I don= 9;t understand why you think that's true. It's true that the monito= r can see that there are two connections to resolver X (DoH and DoT) but th= at doesn't mean that the app is using those for its resolution; it may = be making a third connection to bad resolver Y and using the results from t= hat.

=C2=A0
One variant to consider would be sending a DoT-like DNS query with only the= query NAME encrypted or hashes (ie completely different from DoT or DoH wh= ere the entire DNS message is encrypted) and to return A and AAAA RDATA and= QID and port number unencrypted (but encrypt all other fields and all othe= r RDATA responses). This would allow IDS/firewall systems to control access= on the basis of DNS answers, without needing to know the question.

If all the IDS gets to see is the IP, why don&= #39;t they just block on the IP directly.


The IDS and/or threat service needs to detect s= uch an IP before it can be blocked.

The first clue= new malware may provide is changing DNS so as to avoid IDS detection via D= NS.

The same approach could also be used by a mali= cious human, eg doing data exfiltration.

My unders= tanding is that detection is significantly hampered without any DNS informa= tion. This is better than nothing even if it is far from ideal.=C2=A0
=

And in the case of a configured enterprise DoH server o= n a company owned device, where DNS resolution is monitored, changing resol= ver would be necessary to evade detection.

Again, = not entirely foolproof, but certainly raises the bar, IMHO.

I'm really not following your reasoning he= re. As I said, the application is perfectly free to just use a totally sepa= rate channel and get IP addresses that don't get advertised this way.

What would be helpful here would be if you describe= d what it is that (a) you cannot do with DoH and (b) you can do if applicat= ions do as you suggest.

-Ekr


Brian=C2=A0
--0000000000000e3eb605902c5090-- From nobody Thu Aug 15 11:54:52 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D5FCB1200C4 for ; Thu, 15 Aug 2019 11:54:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id w4l9bjd1gHde for ; Thu, 15 Aug 2019 11:54:46 -0700 (PDT) Received: from mail-lj1-x233.google.com (mail-lj1-x233.google.com [IPv6:2a00:1450:4864:20::233]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6E84D1200E5 for ; Thu, 15 Aug 2019 11:54:46 -0700 (PDT) Received: by mail-lj1-x233.google.com with SMTP id h15so3104217ljg.10 for ; Thu, 15 Aug 2019 11:54:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=tZrQJSgNAA2MjmXg9EX/uONbGpDbJXnikCbXzGmQzXQ=; b=0VG6ATNDmksWXALgx/yez5SpLF5jhTiExCHj+slPvfzgkjDRJ6ZFWcdtGZy1rzaPNM 1N9F9wfvzSgXr7DuUGLdn21YOQucaeKkajQ5DF4FgbTDshw4rHXaFtIvKDYe4mDWiE4y gTjdjLm6WX1kMcyC7ksmwUbcmcGx/Men9eymekeytapEl1xgA4cTroSXC7ypVobx5Qss ZOS/Kf310Onojf7cjDP9zTUo/MbKuebeFVHYWb5R8F3THTfC3n6L80PuvZUmIG2iQbrU iGlY7Q6njcI3+e5opnjPejpEb6bL3vv5KUvPzjFCpYQbcML1KEsNOGAuDUR1P0nlrVdo ASxw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=tZrQJSgNAA2MjmXg9EX/uONbGpDbJXnikCbXzGmQzXQ=; b=lxnq5hJmjcfsbdjw+1ki2+T6CQ61J/K9Hw0kWKLoE85LJwNLeVx77HHGXmXiamAw3H awocYx02+jQrC735jsvhJ+PGM1zuQjPWNWMpEZbAKbSQKMvKrsc6ECdotj6EV4zWb+T5 a3GNxgfHhIL0JCYHVoyf8nFOkZb92cBLlty0rIVKgHz3vtfvdeR+iAd2Ssh4BAYZbbE/ iD36s6WOVILyPwPq9bvzDfyz1wC/JXgpPcFWkQoxim1W2sJxc186ze0CK/0H7a58QTob R9vNij5A2nJta1vj0Sgi2xZTWlp65baEG6MDZyIzhamO9BeBRQcYoe4QjTciC07avNNW CZYw== X-Gm-Message-State: APjAAAXCV8Uc+6toghAhh2vJya+vwVN0lnN2fUiTFvD0331PbGK1UgNd RkZBLjYlS1hwnIs9R3blpfU6PzzaNOzUhrJn7+KvMA== X-Google-Smtp-Source: APXvYqyIiw2u+U6N3ZeeHT/o8pPtlMhR8IOijhcEUWT7ZeCIsGIaGS4gfnuuwDDvOEF/Cs8epTpN5t8sOKclJ4z5DPI= X-Received: by 2002:a2e:b0e6:: with SMTP id h6mr3215386ljl.18.1565895284656; Thu, 15 Aug 2019 11:54:44 -0700 (PDT) MIME-Version: 1.0 References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <8e00891f-2aa2-ee11-559a-b5a8967b22d9@nostrum.com> <2C23D415-84F9-4B6C-B67B-0CC3EB600520@gmail.com> <81463267-1436-4155-BBB9-488ED659C8D8@gmail.com> In-Reply-To: <81463267-1436-4155-BBB9-488ED659C8D8@gmail.com> From: Eric Rescorla Date: Thu, 15 Aug 2019 20:54:06 +0200 Message-ID: To: Brian Dickson Cc: Adam Roach , Paul Hoffman , ADD Mailing list Content-Type: multipart/alternative; boundary="00000000000032a25005902c687c" Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 18:54:49 -0000 --00000000000032a25005902c687c Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Thu, Aug 15, 2019 at 8:44 PM Brian Dickson wrote: > > > Sent from my iPhone > > On Aug 15, 2019, at 2:19 PM, Eric Rescorla wrote: > > > > On Thu, Aug 15, 2019 at 6:52 PM Brian Dickson < > brian.peter.dickson@gmail.com> wrote: > >> >> >> Sent from my iPhone >> > On Aug 15, 2019, at 1:28 AM, Adam Roach wrote: >> Hypothetical (but very important question): >> If ALL browser DNS traffic was sent over BOTH DoH and DoT in parallel >> (both encrypted, sent to the same resolver), do you agree that the priva= cy >> would be the same (same encryption) and the unblockability would be >> unchanged? >> >> The reason for doing this would be to allow the choice of resolver (per >> client/app) to be discoverable. This is one significant gap in the DoH-o= nly >> model. It would not require that the browser (or any other app) wait for >> both answers, so would at worst have no affect on performance, and at be= st >> would improve performance. >> > > I don't understand what this is intended to accomplish. In a later > message, you argue that this would allow a network monitor to determine > that this is a legitimate app that isn't using an undesirable DoH resolve= r, > but I don't understand why you think that's true. It's true that the > monitor can see that there are two connections to resolver X (DoH and DoT= ) > but that doesn't mean that the app is using those for its resolution; it > may be making a third connection to bad resolver Y and using the results > from that. > > > That=E2=80=99s why I suggested a variation where answer A or AAAA data wo= uld be > exposed. > Any new connection not correlated to a recent A/AAAA response could be > flagged or blocked. Not perfect, but another tool for the defense against > apps behaving badly. > This doesn't seem like an awesome practice because it breaks any app which gets IP addresses via non-DNS mechanisms (e.g., WebRTC). -Ekr > Brian > > > > >> One variant to consider would be sending a DoT-like DNS query with only >> the query NAME encrypted or hashes (ie completely different from DoT or = DoH >> where the entire DNS message is encrypted) and to return A and AAAA RDAT= A >> and QID and port number unencrypted (but encrypt all other fields and al= l >> other RDATA responses). This would allow IDS/firewall systems to control >> access on the basis of DNS answers, without needing to know the question= . >> > > If all the IDS gets to see is the IP, why don't they just block on the IP > directly. > > -Ekr > > --00000000000032a25005902c687c Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Thu, Aug 15, 2019 at 8:44 PM Brian= Dickson <brian.peter.d= ickson@gmail.com> wrote:


Sent from my iPhone

On Aug 15, 2019, at 2:19 PM, Eric Rescorla <ekr@rtfm.com> wrote:


On Thu, Aug 15, 2019 at 6:52 PM Brian Dickson <brian.peter.dickson@gmail.com> wrote:

Sent from my iPhone
> On Aug 15, 2019, at 1:28 AM, Adam Roach <adam@nostrum.com> wrote:
Hypothetical= (but very important question):
If ALL browser DNS traffic was sent over BOTH DoH and DoT in parallel (both= encrypted, sent to the same resolver), do you agree that the privacy would= be the same (same encryption) and the unblockability would be unchanged? <= br>
The reason for doing this would be to allow the choice of resolver (per cli= ent/app) to be discoverable. This is one significant gap in the DoH-only mo= del. It would not require that the browser (or any other app) wait for both= answers, so would at worst have no affect on performance, and at best woul= d improve performance.

I don't unde= rstand what this is intended to accomplish.=C2=A0 In a later message, you a= rgue that this would allow a network monitor to determine that this is a le= gitimate app that isn't using an undesirable DoH resolver, but I don= 9;t understand why you think that's true. It's true that the monito= r can see that there are two connections to resolver X (DoH and DoT) but th= at doesn't mean that the app is using those for its resolution; it may = be making a third connection to bad resolver Y and using the results from t= hat.

That=E2=80= =99s why I suggested a variation where answer A or AAAA data would be expos= ed.
Any new connection not correlated to a recent A/AAAA response= could be flagged or blocked. Not perfect, but another tool for the defense= against apps behaving badly.

T= his doesn't seem like an awesome practice because it breaks any app whi= ch gets IP addresses via non-DNS mechanisms (e.g., WebRTC).

<= /div>
-Ekr



Brian=C2=A0<= /div>

=C2=A0
One variant to consider would be sending a DoT-like DNS query with only the= query NAME encrypted or hashes (ie completely different from DoT or DoH wh= ere the entire DNS message is encrypted) and to return A and AAAA RDATA and= QID and port number unencrypted (but encrypt all other fields and all othe= r RDATA responses). This would allow IDS/firewall systems to control access= on the basis of DNS answers, without needing to know the question.

If all the IDS gets to see is the IP, why don&= #39;t they just block on the IP directly.

-Ekr

--00000000000032a25005902c687c-- From nobody Thu Aug 15 11:57:05 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1B60D120808 for ; Thu, 15 Aug 2019 11:57:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DULZ3aWNYoO9 for ; Thu, 15 Aug 2019 11:57:00 -0700 (PDT) Received: from mail-qt1-x833.google.com (mail-qt1-x833.google.com [IPv6:2607:f8b0:4864:20::833]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B0C99120115 for ; Thu, 15 Aug 2019 11:57:00 -0700 (PDT) Received: by mail-qt1-x833.google.com with SMTP id j15so3382622qtl.13 for ; Thu, 15 Aug 2019 11:57:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=NMzUKYFJjNHwRD1ckH7JPIHeE0n73FWBSq0prlugLyM=; b=sDOxB40ZeImoRbRCHk7S9eEpUBPaoIxDeCmlhG9968ZmA2VNIXVgFc0sXlY6oCQcwJ tacdSPokNWP12DzmxmPXmC7+4vUMjeg+aODy8Cu/2IhmDD1pnK0BZboT+YDjmWdqa/Jw PKxK49a5kGwhnUYNZopru7p/dPCObHzkAHbHWBgMtSf13F7ajkY71zKAFBAu6+RDtZEQ GAuDb0IrcmfeucjUcsiZPflax7qXV5jBv+8MVVgBt2nPyJuNxyFyl1BTYyjTbWw8kp3X Zto8yfawS/XSsblz/ex94YRi5nZ1JjDvNLBnt1scFqiXy4sjjTQpLazx6+qQWiRad0Jz oUIA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=NMzUKYFJjNHwRD1ckH7JPIHeE0n73FWBSq0prlugLyM=; b=mXFC/bLWQgq+ktwaQkB2ertenjm0/9eJ7ITncK9qX7gy6WZjK9RjJYfLUu1z/DNpU0 0MJQF/xj/5QC4th9vqQFNjoUa9rmd2L0g+Io5Sy3mlPCafOmouCOuumNzEAuwAn3CjMY oAbpxpc6YVlNOPAV1cOLTZ7D4Jl0mOuzh46AxY6250XoG25AsOXRlZkzT1zU9oNOrXCq AqDAhX96Cbmx6209BCnkiayhTlfAhBw0deo/XmdF2ChPnpaItZ8uAE6RvUBC4dhNGIV8 SRsiGCv69UnVNm2+odlyJZcfzBPrv/UZY+wGcmbqZ+bDJtNcafW3AB4IJflMDhKTaR6l 3wVQ== X-Gm-Message-State: APjAAAWcSel1sjoBfdffukC3DNwmjZgAA8v73ZIz0xwxBWyPNN1a8SyD Aggn5Eqvst4BlZvioqQZq04= X-Google-Smtp-Source: APXvYqxuT4VhgaFOSOk2KoWT0OeSS47I/OeSHpn9EyKMNSRB7F7D7oOB1ojelwoeCLGexemAyMVNAg== X-Received: by 2002:ac8:5185:: with SMTP id c5mr5158069qtn.254.1565895419896; Thu, 15 Aug 2019 11:56:59 -0700 (PDT) Received: from [192.168.2.18] (cpe-76-179-66-50.maine.res.rr.com. [76.179.66.50]) by smtp.gmail.com with ESMTPSA id m5sm2437117qtc.89.2019.08.15.11.56.59 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 15 Aug 2019 11:56:59 -0700 (PDT) Content-Type: multipart/alternative; boundary=Apple-Mail-D93E94BD-FB38-481D-8E51-88164DC7C966 Mime-Version: 1.0 (1.0) From: Brian Dickson X-Mailer: iPhone Mail (16G77) In-Reply-To: Date: Thu, 15 Aug 2019 14:56:58 -0400 Cc: Eric Rescorla , Paul Hoffman , ADD Mailing list , Adam Roach Content-Transfer-Encoding: 7bit Message-Id: References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <8e00891f-2aa2-ee11-559a-b5a8967b22d9@nostrum.com> <2C23D415-84F9-4B6C-B67B-0CC3EB600520@gmail.com> To: Tommy Jensen Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 18:57:04 -0000 --Apple-Mail-D93E94BD-FB38-481D-8E51-88164DC7C966 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Sent from my iPhone > On Aug 15, 2019, at 2:39 PM, Tommy Jensen wr= ote: >=20 > ekr> If all the IDS gets to see is the IP, why don't they just block on th= e IP directly. >=20 > Agreed. It doesn't matter how the client acquired an IP address (DNS, user= typing, etc.) if the network knows the IP is bad already. >=20 > In general, I think any approach to appeasing user privacy and network sec= urity that begins with deciding which parts of traffic to leave unencrypted i= s heading in the wrong direction. The major point of encrypting traffic is t= o prevent third party boxes from seeing/tampering with the data, Here=E2=80=99s what I=E2=80=99d like to emphasize: Encrypted data is protected from on-path viewing, and I believe is the only m= echanism available for that purpose. However, there are two mechanisms available for prevention of tampering. One= is encryption, the other is use of cryptographic signatures (eg DNSSEC, but= possibly also via signing by the resolver, ie DoH server). Exposing some portion of the responses while protecting them via signatures,= is one way of preventing tampering (or at least providing tamper evidence.)= Brian > and there's no way to differentiate third parties with good and ill intent= . Focusing on how the decision in resolvers gets made in the first place see= ms to provide more value, as the traffic can be manipulated in the Good Ways= (tm) by the resolver trusted to do so, and not by anyone else along the path= . This, I agree with. The main challenge is in the ways of ensuring the correc= t resolver is being used. That is the rationale for the DoT+DoH idea. I=E2=80= =99d certainly welcome any other ideas for how that could be done. Brian > Enabling Good Ways(tm) tampering by anyone other than the RR the stub is t= rying to reach just puts us back in square one (classic DNS). >=20 > Thanks, > Tommy > From: Add on behalf of Eric Rescorla = > Sent: Thursday, August 15, 2019 11:19 AM > To: Brian Dickson > Cc: Paul Hoffman ; ADD Mailing list = ; Adam Roach > Subject: Re: [Add] [Ext] Validity of network administrator role > =20 >=20 >=20 > On Thu, Aug 15, 2019 at 6:52 PM Brian Dickson wrote: >=20 >=20 > Sent from my iPhone > > On Aug 15, 2019, at 1:28 AM, Adam Roach wrote: > Hypothetical (but very important question): > If ALL browser DNS traffic was sent over BOTH DoH and DoT in parallel (bot= h encrypted, sent to the same resolver), do you agree that the privacy would= be the same (same encryption) and the unblockability would be unchanged?=20= >=20 > The reason for doing this would be to allow the choice of resolver (per cl= ient/app) to be discoverable. This is one significant gap in the DoH-only mo= del. It would not require that the browser (or any other app) wait for both a= nswers, so would at worst have no affect on performance, and at best would i= mprove performance. >=20 > I don't understand what this is intended to accomplish. In a later messag= e, you argue that this would allow a network monitor to determine that this i= s a legitimate app that isn't using an undesirable DoH resolver, but I don't= understand why you think that's true. It's true that the monitor can see th= at there are two connections to resolver X (DoH and DoT) but that doesn't me= an that the app is using those for its resolution; it may be making a third c= onnection to bad resolver Y and using the results from that. >=20 > =20 > One variant to consider would be sending a DoT-like DNS query with only th= e query NAME encrypted or hashes (ie completely different from DoT or DoH wh= ere the entire DNS message is encrypted) and to return A and AAAA RDATA and Q= ID and port number unencrypted (but encrypt all other fields and all other R= DATA responses). This would allow IDS/firewall systems to control access on t= he basis of DNS answers, without needing to know the question. >=20 > If all the IDS gets to see is the IP, why don't they just block on the IP d= irectly. >=20 > -Ekr >=20 --Apple-Mail-D93E94BD-FB38-481D-8E51-88164DC7C966 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable

Sent from my iPhone

On Aug 15, 2019, at 2:39= PM, Tommy Jensen <Jensen.= Thomas@microsoft.com> wrote:

<= div dir=3D"ltr"> =
ekr> If all the IDS gets to see is the IP, why don't they just block on the IP dire= ctly.
Agr= eed. It doesn't matter how the client acquired an IP address (DNS, user typing, e= tc.) if the network knows the IP is bad already.
In general, I think any approach to appeasing user privacy and network securit= y that begins with deciding which parts of traffic to leave unencrypted is h= eading in the wrong direction. The major point of encrypting traffic is to p= revent third party boxes from seeing/tampering with the data,

Here=E2=80=99s what I=E2=80=99d like to emphasize:

Encrypted data is protected from on-path viewing, and I believe is t= he only mechanism available for that purpose.

Howev= er, there are two mechanisms available for prevention of tampering. One is e= ncryption, the other is use of cryptographic signatures (eg DNSSEC, but poss= ibly also via signing by the resolver, ie DoH server).

<= div>Exposing some portion of the responses while protecting them via signatu= res, is one way of preventing tampering (or at least providing tamper eviden= ce.)

Brian

= and there's no way to differentiate third parties with good and ill intent. = Focusing on how the decision in resolvers gets made in the first place seems= to provide more value, as the traffic can be manipulated in the Good Ways(t= m) by the resolver trusted to do so, and not by anyone else along the path.

This, I agree with. The mai= n challenge is in the ways of ensuring the correct resolver is being used. T= hat is the rationale for the DoT+DoH idea. I=E2=80=99d certainly welcome any= other ideas for how that could be done.

Brian


Enabling Good Ways(tm) t= ampering by anyone other than the RR the stub is trying to reach just puts u= s back in square one (classic DNS).
Tha= nks,
Tom= my
From: Add <add-bounces@ietf.org> on behalf of Eric Resc= orla <ekr@rtfm.com>
Sent: Thursday, August 15, 2019 11:19 AM
To: Brian Dickson <brian.peter.dickson@gmail.com>
Cc: Paul Hoffman <paul.h= offman@icann.org>; ADD Mailing list <add@ietf.org>; Adam Roach <= adam@nostrum.com>
Subject: Re: [Add] [Ext] Validity of network administrator role
 


On Thu, Aug 15, 2019 at 6:52 PM Bria= n Dickson <brian.peter.d= ickson@gmail.com> wrote:


Sent from my iPhone
> On Aug 15, 2019, at 1:28 AM, Adam Roach <adam@nostrum.com> wrote:
Hypothetical (but very important question):
If ALL browser DNS traffic was sent over BOTH DoH and DoT in parallel (both e= ncrypted, sent to the same resolver), do you agree that the privacy would be= the same (same encryption) and the unblockability would be unchanged?

The reason for doing this would be to allow the choice of resolver (per clie= nt/app) to be discoverable. This is one significant gap in the DoH-only mode= l. It would not require that the browser (or any other app) wait for both an= swers, so would at worst have no affect on performance, and at best would improve performance.

I don't understand what this is intended to accomplish.  In a late= r message, you argue that this would allow a network monitor to determine th= at this is a legitimate app that isn't using an undesirable DoH resolver, bu= t I don't understand why you think that's true. It's true that the monitor can see that there are two connecti= ons to resolver X (DoH and DoT) but that doesn't mean that the app is using t= hose for its resolution; it may be making a third connection to bad resolver= Y and using the results from that.

 
One variant to consider would be sending a DoT-like DNS query with only the q= uery NAME encrypted or hashes (ie completely different from DoT or DoH where= the entire DNS message is encrypted) and to return A and AAAA RDATA and QID= and port number unencrypted (but encrypt all other fields and all other RDATA responses). This would al= low IDS/firewall systems to control access on the basis of DNS answers, with= out needing to know the question.

If all the IDS gets to see is the IP, why don't they just block on the I= P directly.

-Ekr

= --Apple-Mail-D93E94BD-FB38-481D-8E51-88164DC7C966-- From nobody Thu Aug 15 12:03:23 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0E4871200C4 for ; Thu, 15 Aug 2019 12:03:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3gsRo09jSxCP for ; Thu, 15 Aug 2019 12:03:19 -0700 (PDT) Received: from mail-qt1-x832.google.com (mail-qt1-x832.google.com [IPv6:2607:f8b0:4864:20::832]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7ECB91200D6 for ; Thu, 15 Aug 2019 12:03:19 -0700 (PDT) Received: by mail-qt1-x832.google.com with SMTP id x4so3463449qts.5 for ; Thu, 15 Aug 2019 12:03:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=E5hkxI0fAJMx2kqY10ZqQ0yiurNdqCxjW2zpd7Iv14Y=; b=Blfug6K+kdyZHTuow94r6fX5b0iTgYzP+XThAGn81HvQn8ejEXC8w68LdnVNoc0y6N NoHX+EoFfOj9WdEj1uoYIyq3ZAcj51mKSquoNV/jHyPCf5FX0qbdaTi1EJqoFY+VQJwm s2aKzgYCjY7qDdZTr1ZAH+psD0OTAHtENrZ440GhfZqCiWaza/s2/IAr2saAajAApHVP gXLe3vcPpgbuUk5I7dMJ1CflFus8mHUVHG3XUXSCVfv1ERhJMKa/rShvuDKvOkVfNzGX M8+8lQ3iZGHaLB6sYSNObHyZbYa4y/+UC1dEKzp1X/UA4shEZanuHjqcf8C96cazoASH mMeA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=E5hkxI0fAJMx2kqY10ZqQ0yiurNdqCxjW2zpd7Iv14Y=; b=KdtREf0rGhsJjTiYA9kuKSiGjKPm3CpoyDDHXQxnEb2EJnR2cIT8eSmNzRGeb0ibP8 SSITSIWUXWANaIjpQezul+i/A2E+EIvjQ5TxgwzgxgO4PoAIUiyNmITiMs/2FCVh0r27 dT8uPiGqznSOUywP27jRawY6Fge4zv9luD8jHguBsl5r2wMh7jYup8Y/jGyUjD6YpIIP ZTDeB2Q1yTjZ8ijPmjxLAOhT9f+PVhpn+hFPjGyeeiqzbzUlR5pub+OAZpRilxYu2fFz fXJumr9Fr+kiJV8+70wOVMAyqcgABruQSwZfb7V5qJCXM1faIMpSLWFJ+GrMSYdgHeY1 8s9A== X-Gm-Message-State: APjAAAXn6N62zm1KIQhSkrVlgZ3/P/sSbecNiliDwKVxwv/7nOuRaBzB bDNLzGqL9dOiR2iDz3mQEnPUSA== X-Google-Smtp-Source: APXvYqymNNNYhRzgrM5ZpnKN27UC+14Eth0Nz1SAHFUgndkzGFtfV32nSSHTGBQCSX0XP9lJ2NAtaA== X-Received: by 2002:ac8:2498:: with SMTP id s24mr5415445qts.375.1565895798470; Thu, 15 Aug 2019 12:03:18 -0700 (PDT) Received: from ?IPv6:2001:470:c1a2:1:9128:e34:f62c:61a4? ([2001:470:c1a2:1:9128:e34:f62c:61a4]) by smtp.gmail.com with ESMTPSA id f2sm1923626qkj.58.2019.08.15.12.03.17 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 15 Aug 2019 12:03:17 -0700 (PDT) From: Ted Lemon Message-Id: <2704899B-E43D-4978-A3C9-30E9E7CEBEBD@fugue.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_E67C8D87-5DB1-44EA-B934-D0871AE7E952" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Thu, 15 Aug 2019 12:03:16 -0700 In-Reply-To: Cc: Tommy Jensen , Eric Rescorla , ADD Mailing list , Adam Roach , Paul Hoffman To: Brian Dickson References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <8e00891f-2aa2-ee11-559a-b5a8967b22d9@nostrum.com> <2C23D415-84F9-4B6C-B67B-0CC3EB600520@gmail.com> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 19:03:22 -0000 --Apple-Mail=_E67C8D87-5DB1-44EA-B934-D0871AE7E952 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 On Aug 15, 2019, at 11:56 AM, Brian Dickson = wrote: > However, there are two mechanisms available for prevention of = tampering. One is encryption, the other is use of cryptographic = signatures (eg DNSSEC, but possibly also via signing by the resolver, ie = DoH server). Blocking is a form of tampering. One purpose of DoH is to make = blocking impractical, so that the end user isn=E2=80=99t forced to = choose a path that=E2=80=99s subject to tampering and intercept. The resolver can=E2=80=99t attest to the validity of records for domains = for which it is not authoritative, and there is no mechanism for = associating a DoH resolver with an authoritative domain other than = DNSSEC (nor would it be useful to define one, since DNSSEC does this = quite handily). So in practice DNSSEC is the only mechanism that = prevents tampering of the sort you are describing. --Apple-Mail=_E67C8D87-5DB1-44EA-B934-D0871AE7E952 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 On = Aug 15, 2019, at 11:56 AM, Brian Dickson <brian.peter.dickson@gmail.com> wrote:
However, there are two mechanisms = available for prevention of tampering. One is encryption, the other is = use of cryptographic signatures (eg DNSSEC, but possibly also via = signing by the resolver, ie DoH server).

Blocking is a form of tampering.   One = purpose of DoH is to make blocking impractical, so that the end user = isn=E2=80=99t forced to choose a path that=E2=80=99s subject to = tampering and intercept.

The = resolver can=E2=80=99t attest to the validity of records for domains for = which it is not authoritative, and there is no mechanism for associating = a DoH resolver with an authoritative domain other than DNSSEC (nor would = it be useful to define one, since DNSSEC does this quite handily). =  So in practice DNSSEC is the only mechanism that prevents = tampering of the sort you are describing.

= --Apple-Mail=_E67C8D87-5DB1-44EA-B934-D0871AE7E952-- From nobody Thu Aug 15 12:10:45 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 00DBD12013D for ; Thu, 15 Aug 2019 12:10:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KYWLlxw0XUaK for ; Thu, 15 Aug 2019 12:10:40 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 01562120127 for ; Thu, 15 Aug 2019 12:10:40 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 2AA69BE2C for ; Thu, 15 Aug 2019 20:10:38 +0100 (IST) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aM1h9G8xOuRr for ; Thu, 15 Aug 2019 20:10:36 +0100 (IST) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id ED71BBE20 for ; Thu, 15 Aug 2019 20:10:35 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1565896236; bh=89KD6C7dTDT1JWbMT7kFJwrC5L7Lb3J8szRxJTc9OG8=; h=To:References:From:Subject:Date:In-Reply-To:From; b=pcLKXWJRGpJ6sLZmP6YYctigad9Nq8590WFmtG09xOvmRAIOZdcQIeBB5ySpC2o3b 94LJynWlSlviYHwhK01YdxrY3750PO21g2I5ChP8rdEooVen8SRp7kTeG3S84odT+s QgwRTJsNF4VW6+h9RdS4QnZ+G5kLOmYNW/4xHm+I= To: ADD Mailing list References: From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: <400b774a-5bd0-d6f4-5640-e561f067a9b5@cs.tcd.ie> Date: Thu, 15 Aug 2019 20:10:34 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="Qzx5PZ1pH9L6Dz5ZNEPSZ3D0GX7OnwLlF" Archived-At: Subject: Re: [Add] Use Cases - the coffee shop X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 19:10:44 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --Qzx5PZ1pH9L6Dz5ZNEPSZ3D0GX7OnwLlF Content-Type: multipart/mixed; boundary="jCyxsEeg3C7u2HQNg4cuppJ6Ve7o7NpeJ"; protected-headers="v1" From: Stephen Farrell To: ADD Mailing list Message-ID: <400b774a-5bd0-d6f4-5640-e561f067a9b5@cs.tcd.ie> Subject: Re: [Add] Use Cases - the coffee shop References: In-Reply-To: --jCyxsEeg3C7u2HQNg4cuppJ6Ve7o7NpeJ Content-Type: multipart/mixed; boundary="------------893DA43B762885F2572BCF43" Content-Language: en-GB This is a multi-part message in MIME format. --------------893DA43B762885F2572BCF43 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Users' wanting DoH in this kind of n/w scenario seems to me a no-brainer. I think points not already mentioned include: - People who use such networks in one place likely use many such networks over time so the probability of being attacked by one such n/w accumulates. - Consistent use of DoH with an authenticated recursive reduces those users' attack surface usefully as well as being more privacy friendly. - I would not be surprised if consistent use of DoH also made the user experience more consistent and maybe better overall. - I would be surprised if use of DoT was feasible, but it'd be nice if it were. (I have seen problems using stubby in some such networks that require a bit of "pretend" DNS resolution in the captive portal signon bit, and while I can see how stubby could do a bit better there I suspect that leaving the system resolver on Do53 and having applications do DoH may be a sweetspot setup for getting connection and DNS privacy for DoH-enabled applications in such networks.) On the n/w admin side, ISTM most such networks have two different kinds of "operator" - the first being the coffee-shop or hotel business and the 2nd being whomever the coffee-shop or hotel have contracted with to provide hotspots. IIUC, that's the common kind of setup these days but I don't claim that much familiarity with who does exactly what. I frankly don't believe that the hotel or similar really care about choices of DNS recursive. I've not heard anything convincing as to why the hotspot-provider company would really either, though the caport problem space has it's own complexities I guess. (I did hear the points about T&C's, legalities and whatnot, but those mostly seems like normally necessary business-oriented arse-covering to me.) I wonder if many of the DNS queries in such cases don't already end up with a quadN resolver - does anyone know? Anyway, bottom line for me is absent something convincing, these scenarios strongly argue in favour of wanting to see as much use of DoH as is practical. (At the same time we do have the problem that e.g. a browser can't really know when we're in that kind of n/w scenario so this is not the same as saying that browsers ought make DoH their default, just so as to cover these scenarios well.) Cheers, S. --------------893DA43B762885F2572BCF43 Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------893DA43B762885F2572BCF43-- --jCyxsEeg3C7u2HQNg4cuppJ6Ve7o7NpeJ-- --Qzx5PZ1pH9L6Dz5ZNEPSZ3D0GX7OnwLlF Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAl1VrisACgkQWrL68XsX K+rI5BAAlpZpMkBuxU2mtYOCxY7R8I27oAGJ9BoEomPdac9qdGGBUtbnOMKk+CQi sGsTQjvY4Rly7cNPumBDaacs5MGMbaf7nwHB6A1un3tTaFNTDy5hUDw+XXQiEawj W2kgJz8+3jlrqkyYXT4TuQSmiKShnodfec34k3gxDSbGDCGyjdgJaUrEHQBxLd6X XYVCjsUiXeoP+IonuVs7l6bLr3yLLSQpMJng/EPpeZmfJ2bPNZjpUhCG+s3835H2 EbgO2UGHpidHq6rZM1zQehAJKsndwxenEekBJvj7PtN+eG87at9Cv5yq6fOWJ+E0 Ww6NikKCrjDKEfDI2gmoRhO8XjPpREoTbCLsAQPd3P/PBc8xQSD6CoBHctE0/ST5 5xDbVGiRO4iiYLsRmL7UIlFTlYvrmWe5C1S3jo+y3AMSv7MSYK84tdkUuLCkxfm/ 5nXksjtOt80PO3I8OO8FCMoOMAErUzzEeR+YECWBR+CoTFCpxFTFbi6xrMXznRy2 G3QB9bfpxwarx9ehKhAFRPnoH8Oy9cqIvsYWD3IDCFqacaoMyqSdvHftrJwI2sS9 FbRjCFwjXhFvyrRD231CtnTcNLZAwLm1MLrwzmd3y+vpZ7v1VC3XQnfygfm734C1 kuRsSP3C27IRVbXsBFP8LjkXOj2TpivRuKygfyXtgXrCX2YBD/s= =aAlU -----END PGP SIGNATURE----- --Qzx5PZ1pH9L6Dz5ZNEPSZ3D0GX7OnwLlF-- From nobody Thu Aug 15 12:14:05 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B34AE1200B2 for ; Thu, 15 Aug 2019 12:14:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DKEE6mixtZ4c for ; Thu, 15 Aug 2019 12:14:01 -0700 (PDT) Received: from mail-qk1-x744.google.com (mail-qk1-x744.google.com [IPv6:2607:f8b0:4864:20::744]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D41081200B7 for ; Thu, 15 Aug 2019 12:14:00 -0700 (PDT) Received: by mail-qk1-x744.google.com with SMTP id s145so2712826qke.7 for ; Thu, 15 Aug 2019 12:14:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=EuPPWkmNeXUEmPkQ1P9sk6D/tpHx2MB2ErUOqptBas4=; b=DHElgSzOQ8RrqqaolN8P2bSiOMr1YpHvipn0cukbFJWJzGemTwnIU9kS5tQsFbTFRk 3e2Prm9PFXdPs1YhAXJ/jFwj0/LCbsFUCCg8b//ua1uQTCWxlEYUD97IzN6tQ1t0pi0c 1RC9xhvQtD6Lt2ruamiA+tI+BgviWEO9nwe8nusRdRo6R5ubbJirc1MUiCpGECAUV1d2 IpPf3KtUAPeOwG9z9JcrDumZcyqN8dTaEMcKf0UgBidsHRF4t7FezfsUR4aHxiRH5Nw2 8JyghHA9M9/qgDpr3nRZYK64WOIfYzczNRlrNj7Ra1Ocd0jVQ/GEffdGHcs0hdgmUtSD gePA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=EuPPWkmNeXUEmPkQ1P9sk6D/tpHx2MB2ErUOqptBas4=; b=HsqNh5u8obMtSUwjcbcuwKYRo8Vv6UxZQa8lVWBaaCSRHj9hZsT7QCSgdaAsyKp+Zu +5NMsSK7BeYVmfo+RwEDs7LQubNvunBOZoqqw8KIw1GsWRUTTg9oo0ZbPAIOSQdaxSj9 uYLC3Rum9DQGqBAzbTkMuF6tw5d2L+iUko6dmSSOG3K6L94Kn1WS0+vSNCvexi4OsuCe P69HOJFq7p4oFtMedkueBtL5ZMiBqn26JM5+G0yJNHmt53MDhodqSVp10DcfP7m2Lvw8 lFqzJgrXwQWeIO9oR7ubvHN+nKhcfbSPgXBhVQnu/k/0ywyVj1JkVJo9mazxJMvkxhdq MxqQ== X-Gm-Message-State: APjAAAVdpXQE7T95RJNLTLa1Ae1iCGJ7mq9nBgamyZj08JF+mBpYggSo CjCacQo+E1BizEgZvb9Dxao= X-Google-Smtp-Source: APXvYqzo0Aj0DnIfrwnVNZjpwSGglxo8ueXT3Eaq9Sc9NfSwtJB9c7G7UcRNOdXXeYmrlJUFxXDnNQ== X-Received: by 2002:a37:b381:: with SMTP id c123mr5580115qkf.349.1565896440025; Thu, 15 Aug 2019 12:14:00 -0700 (PDT) Received: from [192.168.2.18] (cpe-76-179-66-50.maine.res.rr.com. [76.179.66.50]) by smtp.gmail.com with ESMTPSA id l206sm1890596qke.33.2019.08.15.12.13.59 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 15 Aug 2019 12:13:59 -0700 (PDT) Content-Type: multipart/alternative; boundary=Apple-Mail-18A7EE77-F263-461B-AAA3-4498E46EF490 Mime-Version: 1.0 (1.0) From: Brian Dickson X-Mailer: iPhone Mail (16G77) In-Reply-To: Date: Thu, 15 Aug 2019 15:13:57 -0400 Cc: Adam Roach , Paul Hoffman , ADD Mailing list Content-Transfer-Encoding: 7bit Message-Id: <6AA22A84-F94A-4631-A161-211F3CFF54F7@gmail.com> References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <8e00891f-2aa2-ee11-559a-b5a8967b22d9@nostrum.com> <2C23D415-84F9-4B6C-B67B-0CC3EB600520@gmail.com> <3BAF0D47-67BD-4BA2-96D3-A9AB3095F04A@gmail.com> To: Eric Rescorla Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 19:14:04 -0000 --Apple-Mail-18A7EE77-F263-461B-AAA3-4498E46EF490 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Sent from my iPhone > On Aug 15, 2019, at 2:47 PM, Eric Rescorla wrote: >=20 >=20 >=20 >> On Thu, Aug 15, 2019 at 8:41 PM Brian Dickson wrote: >>=20 >>=20 >> Sent from my iPhone >>=20 >>> On Aug 15, 2019, at 2:19 PM, Eric Rescorla wrote: >>>=20 >>>=20 >>>=20 >>>> On Thu, Aug 15, 2019 at 6:52 PM Brian Dickson wrote: >>>>=20 >>>>=20 >>>> Sent from my iPhone >>>> > On Aug 15, 2019, at 1:28 AM, Adam Roach wrote: >>>> Hypothetical (but very important question): >>>> If ALL browser DNS traffic was sent over BOTH DoH and DoT in parallel (= both encrypted, sent to the same resolver), do you agree that the privacy wo= uld be the same (same encryption) and the unblockability would be unchanged?= =20 >>>>=20 >>>> The reason for doing this would be to allow the choice of resolver (per= client/app) to be discoverable. This is one significant gap in the DoH-only= model. It would not require that the browser (or any other app) wait for bo= th answers, so would at worst have no affect on performance, and at best wou= ld improve performance. >>>=20 >>> I don't understand what this is intended to accomplish. In a later mess= age, you argue that this would allow a network monitor to determine that thi= s is a legitimate app that isn't using an undesirable DoH resolver, but I do= n't understand why you think that's true. It's true that the monitor can see= that there are two connections to resolver X (DoH and DoT) but that doesn't= mean that the app is using those for its resolution; it may be making a thi= rd connection to bad resolver Y and using the results from that. >>>=20 >>> =20 >>>> One variant to consider would be sending a DoT-like DNS query with only= the query NAME encrypted or hashes (ie completely different from DoT or DoH= where the entire DNS message is encrypted) and to return A and AAAA RDATA a= nd QID and port number unencrypted (but encrypt all other fields and all oth= er RDATA responses). This would allow IDS/firewall systems to control access= on the basis of DNS answers, without needing to know the question. >>>=20 >>> If all the IDS gets to see is the IP, why don't they just block on the I= P directly. >>>=20 >>=20 >> The IDS and/or threat service needs to detect such an IP before it can be= blocked. >>=20 >> The first clue new malware may provide is changing DNS so as to avoid IDS= detection via DNS. >>=20 >> The same approach could also be used by a malicious human, eg doing data e= xfiltration. >>=20 >> My understanding is that detection is significantly hampered without any D= NS information. This is better than nothing even if it is far from ideal.=20= >>=20 >> And in the case of a configured enterprise DoH server on a company owned d= evice, where DNS resolution is monitored, changing resolver would be necessa= ry to evade detection. >>=20 >> Again, not entirely foolproof, but certainly raises the bar, IMHO. >=20 > I'm really not following your reasoning here. As I said, the application i= s perfectly free to just use a totally separate channel and get IP addresses= that don't get advertised this way. >=20 > What would be helpful here would be if you described what it is that (a) y= ou cannot do with DoH and (b) you can do if applications do as you suggest. >=20 > -Ekr The obvious use case is the second one: a malicious user, using an unmodifie= d app (eg browser) configured to use a monitored DoH resolver (eg enterprise= resolver). If the user changes the resolver, in the DoH-only case, the monitored resolv= er stops seeing queries. The malicious user accesses some site somewhere (wh= ich involves first doing the DNS query via the newly configured resolver) an= d exfiltrates data, then changes the configuration back. A brief period of n= o queries would not likely be suspicious. Queries to new resolvers would be c= ompletely unambiguous in that regard. If the application (browser) does what I suggest, the IDS at a minimum would= be able to detect the use of the rogue resolver, and potentially could disc= onnect the malicious user=E2=80=99s device from the network (preventing the e= xfiltration). If the enterprise resolver also was blocking the site the user intended to u= se (via DNS), the only other way the user could access it would be via some k= ind of hard-coding. A robust anti-exfiltration solution could further restri= ct site access by requiring DNS-before-access. Security is an arms race; this isn=E2=80=99t necessarily foolproof or compre= hensive, but it doesn=E2=80=99t need to be, to be useful. Brian= --Apple-Mail-18A7EE77-F263-461B-AAA3-4498E46EF490 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable

Sent from my iPhone

On Aug 15, 2019, at 2:47= PM, Eric Rescorla <ekr@rtfm.com> w= rote:



On Thu, Aug 15, 2019 at 8:41 PM Brian Dickson <brian.peter.dickson@gmail.com> wrote:


Sent from my iPhone


On Thu, Aug 15, 2019 at 6= :52 PM Brian Dickson <brian.peter.dickson@gmail.com> wrote:


Sent from my iPhone
> On Aug 15, 2019, at 1:28 AM, Adam Roach <adam@nostrum.com> wrote:
Hypothetical (= but very important question):
If ALL browser DNS traffic was sent over BOTH DoH and DoT in parallel (both e= ncrypted, sent to the same resolver), do you agree that the privacy would be= the same (same encryption) and the unblockability would be unchanged?

The reason for doing this would be to allow the choice of resolver (per clie= nt/app) to be discoverable. This is one significant gap in the DoH-only mode= l. It would not require that the browser (or any other app) wait for both an= swers, so would at worst have no affect on performance, and at best would im= prove performance.

I don't understand wh= at this is intended to accomplish.  In a later message, you argue that t= his would allow a network monitor to determine that this is a legitimate app= that isn't using an undesirable DoH resolver, but I don't understand why yo= u think that's true. It's true that the monitor can see that there are two c= onnections to resolver X (DoH and DoT) but that doesn't mean that the app is= using those for its resolution; it may be making a third connection to bad r= esolver Y and using the results from that.

&nbs= p;
One variant to consider would be sending a DoT-like DNS query with only the q= uery NAME encrypted or hashes (ie completely different from DoT or DoH where= the entire DNS message is encrypted) and to return A and AAAA RDATA and QID= and port number unencrypted (but encrypt all other fields and all other RDA= TA responses). This would allow IDS/firewall systems to control access on th= e basis of DNS answers, without needing to know the question.

If all the IDS gets to see is the IP, why don't they j= ust block on the IP directly.


The IDS and/or threat service needs to detect su= ch an IP before it can be blocked.

The first clue n= ew malware may provide is changing DNS so as to avoid IDS detection via DNS.=

The same approach could also be used by a maliciou= s human, eg doing data exfiltration.

My understandi= ng is that detection is significantly hampered without any DNS information. T= his is better than nothing even if it is far from ideal. 
And in the case of a configured enterprise DoH server on a compa= ny owned device, where DNS resolution is monitored, changing resolver would b= e necessary to evade detection.

Again, not entirely= foolproof, but certainly raises the bar, IMHO.

I'm really not following your reasoning here. As I said, the= application is perfectly free to just use a totally separate channel and ge= t IP addresses that don't get advertised this way.

= What would be helpful here would be if you described what it is that (a) you= cannot do with DoH and (b) you can do if applications do as you suggest.

-Ekr

The obvious use case is the second one: a malici= ous user, using an unmodified app (eg browser) configured to use a monitored= DoH resolver (eg enterprise resolver).

If the user= changes the resolver, in the DoH-only case, the monitored resolver stops se= eing queries. The malicious user accesses some site somewhere (which involve= s first doing the DNS query via the newly configured resolver) and exfiltrat= es data, then changes the configuration back. A brief period of no queries w= ould not likely be suspicious. Queries to new resolvers would be completely u= nambiguous in that regard.

If the application (brow= ser) does what I suggest, the IDS at a minimum would be able to detect the u= se of the rogue resolver, and potentially could disconnect the malicious use= r=E2=80=99s device from the network (preventing the exfiltration).

If the enterprise resolver also was blocking the site the us= er intended to use (via DNS), the only other way the user could access it wo= uld be via some kind of hard-coding. A robust anti-exfiltration solution cou= ld further restrict site access by requiring DNS-before-access.
Security is an arms race; this isn=E2=80=99t necessarily foolpr= oof or comprehensive, but it doesn=E2=80=99t need to be, to be useful.
=

Brian
= --Apple-Mail-18A7EE77-F263-461B-AAA3-4498E46EF490-- From nobody Thu Aug 15 12:14:44 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 29C171200B7 for ; Thu, 15 Aug 2019 12:14:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=swm.pp.se Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id A9AbNnmxnrIl for ; Thu, 15 Aug 2019 12:14:41 -0700 (PDT) Received: from uplift.swm.pp.se (ipv6.swm.pp.se [IPv6:2a00:801::f]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D64F81200B2 for ; Thu, 15 Aug 2019 12:14:40 -0700 (PDT) Received: by uplift.swm.pp.se (Postfix, from userid 501) id C2891AF; Thu, 15 Aug 2019 21:14:38 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=swm.pp.se; s=mail; t=1565896478; bh=rKYoTL9rPGhFWt1WuNTCa0tvDGppAEie4wEj2wAb1VM=; h=Date:From:To:cc:Subject:In-Reply-To:References:From; b=4mnU0Iiz1FQITiE3YjBZtBYUcxqwkGW0Wf3DLJ7mDQD+YYv69KbjZQFibVzizhFua A1bi6GJhPVIXksZx4i67Ds8wFm++mYq64VFNsCN9a7dIK+w/qrvwbPTpVUSbWC2dq9 wSCcszyvKqoXPmf3bwiKoTOi9vzNoDe2gUSWG71k= Received: from localhost (localhost [127.0.0.1]) by uplift.swm.pp.se (Postfix) with ESMTP id C0C809F; Thu, 15 Aug 2019 21:14:38 +0200 (CEST) Date: Thu, 15 Aug 2019 21:14:38 +0200 (CEST) From: Mikael Abrahamsson To: Ted Lemon cc: ADD Mailing list In-Reply-To: <2704899B-E43D-4978-A3C9-30E9E7CEBEBD@fugue.com> Message-ID: References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <8e00891f-2aa2-ee11-559a-b5a8967b22d9@nostrum.com> <2C23D415-84F9-4B6C-B67B-0CC3EB600520@gmail.com> <2704899B-E43D-4978-A3C9-30E9E7CEBEBD@fugue.com> User-Agent: Alpine 2.20 (DEB 67 2015-01-07) Organization: People's Front Against WWW MIME-Version: 1.0 Content-Type: multipart/mixed; BOUNDARY="-137064504-1292726738-1565896478=:21548" Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 19:14:43 -0000 This message is in MIME format. The first part should be readable text, while the remaining parts are likely unreadable without MIME-aware tools. ---137064504-1292726738-1565896478=:21548 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8BIT On Thu, 15 Aug 2019, Ted Lemon wrote: > Blocking is a form of tampering. One purpose of DoH is to make blocking > impractical, so that the end user isn’t forced to choose a path that’s > subject to tampering and intercept. As with any technology this is dual use. If the customer has purchased a solution that's built around certain mechanisms, bypassing these mechanisms might be against the users' wishes. There is no correct answer here, and anyone pretending to know the correct answer for all situations is wrong. So let's fall back on the "principle of least astonishment". If you tell the users "your browser is now doing DNS lookups using a cloud provider and your ISP is no longer in that loop", what do you think their response will be? (might need explanation to the user, but still) -- Mikael Abrahamsson email: swmike@swm.pp.se ---137064504-1292726738-1565896478=:21548-- From nobody Thu Aug 15 12:26:26 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E53061200E7 for ; Thu, 15 Aug 2019 12:26:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kk5jhA9aom5G for ; Thu, 15 Aug 2019 12:26:22 -0700 (PDT) Received: from mail-lj1-x22d.google.com (mail-lj1-x22d.google.com [IPv6:2a00:1450:4864:20::22d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BFFA91200F1 for ; Thu, 15 Aug 2019 12:26:20 -0700 (PDT) Received: by mail-lj1-x22d.google.com with SMTP id z17so3230309ljz.0 for ; Thu, 15 Aug 2019 12:26:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=hEHdn+soNA9MXzv/OVS4Z5qdqa5tXDnVyzr7iwc62XY=; b=yZoGvrMU8nBoCZCMko4l6As5rrFe5ZJK1N5shHns5uwE96UKI/eIGjucjIjoas+vfm T5HtHtcSsetCylA59bRbyIIizAAAEsd2RZKx35NyUSyU3tEgNufokbUIFHMDVEsiGbGz 4pob0WX+7cM+kdC22EA8GtJ2Y1uSL/uErlqQ80IUnfwx1LBRFcxHr8ed34vPzqKLUkoQ Z/CdXXG39I6YXtTbCBciSSq5UNnxjrJqPhfLBL4Uz7WyRniYzt4A6ehWEb6bwyKPd1CZ nRApradL14QA3aO+OcovB/UZNL0cWH9aw2XOFKfut/l74JY+cqIXjNMnmtJDKXkLoeuy 2BLg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=hEHdn+soNA9MXzv/OVS4Z5qdqa5tXDnVyzr7iwc62XY=; b=sPPYQAOe+LuS5KkFfzbnV7ToGjfm9mPK1SjBvmG2YPRr/YPLyG7PfAhK1VEClAPa6u tiBhxOmXlWMI0wZdXDvgemFCIf1j95ii835uYIkUyo7pfSAUSdBnJhkWe8vTkiiJHjG/ 7dRq7FlUqousaV8Eoa4y/MAFwvY0xE0dR7heP/BlqjK29rV4HadGxM6eRZS/v+qyHrgm C4ye/j6Mvms47IN46lIc692uZSH/ZUPwsRu3v1jemW+2hnsaoXYCW5bEHqjPUOtaBBAl aXd030208wULzk4khjvli4vna+1l675p2iKWbTUll0aUle8jPFnbpAnltq3jcP1kf5fX Ym/w== X-Gm-Message-State: APjAAAVvZfGI2JKu2VRU3OB9dR/ub6atK1WWXQb0B1TdoDXCi7ihZYGe hfCctG1XuHO4SuJZfIqHk7bNTR5QugItC69tbs6b3w== X-Google-Smtp-Source: APXvYqzTjgw8HWgALehs6KHz4yI2ccBSNu7bJRbSkHL85fn7RM1tWAGSdXiR+CucLEnSKJO0fBYvH1F70eeCxBKKzc8= X-Received: by 2002:a2e:b0e6:: with SMTP id h6mr3273334ljl.18.1565897178897; Thu, 15 Aug 2019 12:26:18 -0700 (PDT) MIME-Version: 1.0 References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <8e00891f-2aa2-ee11-559a-b5a8967b22d9@nostrum.com> <2C23D415-84F9-4B6C-B67B-0CC3EB600520@gmail.com> <2704899B-E43D-4978-A3C9-30E9E7CEBEBD@fugue.com> In-Reply-To: From: Eric Rescorla Date: Thu, 15 Aug 2019 21:25:40 +0200 Message-ID: To: Mikael Abrahamsson Cc: Ted Lemon , ADD Mailing list Content-Type: multipart/alternative; boundary="0000000000001a6dae05902cd9db" Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 19:26:25 -0000 --0000000000001a6dae05902cd9db Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Thu, Aug 15, 2019 at 9:14 PM Mikael Abrahamsson wrote= : > On Thu, 15 Aug 2019, Ted Lemon wrote: > > > Blocking is a form of tampering. One purpose of DoH is to make blockin= g > > impractical, so that the end user isn=E2=80=99t forced to choose a path= that=E2=80=99s > > subject to tampering and intercept. > > As with any technology this is dual use. If the customer has purchased a > solution that's built around certain mechanisms, bypassing these > mechanisms might be against the users' wishes. > > There is no correct answer here, and anyone pretending to know the correc= t > answer for all situations is wrong. > > So let's fall back on the "principle of least astonishment". If you tell > the users "your browser is now doing DNS lookups using a cloud provider > and your ISP is no longer in that loop", what do you think their response > will be? I think their response will be "What's DNS"? (might need explanation to the user, but still) > I suppose it depends on whether that explanation includes describing the various forms of misbehavior that network operators have been known to engage in? -Ekr > -- > Mikael Abrahamsson email: swmike@swm.pp.se-- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --0000000000001a6dae05902cd9db Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Thu, Aug 15, 2019 at 9:14 PM Mikae= l Abrahamsson <swmike@swm.pp.se&= gt; wrote:
On Th= u, 15 Aug 2019, Ted Lemon wrote:

> Blocking is a form of tampering.=C2=A0 One purpose of DoH is to make b= locking
> impractical, so that the end user isn=E2=80=99t forced to choose a pat= h that=E2=80=99s
> subject to tampering and intercept.

As with any technology this is dual use. If the customer has purchased a solution that's built around certain mechanisms, bypassing these
mechanisms might be against the users' wishes.

There is no correct answer here, and anyone pretending to know the correct =
answer for all situations is wrong.

So let's fall back on the "principle of least astonishment". = If you tell
the users "your browser is now doing DNS lookups using a cloud provide= r
and your ISP is no longer in that loop", what do you think their respo= nse
will be?

I think their response will be &qu= ot;What's DNS"?


(might need explanation to the user, bu= t still)

I suppose it depends on whethe= r that explanation includes describing the various forms of misbehavior tha= t network operators have been known to engage in?

<= div>-Ekr


--
Mikael Abrahamsson=C2=A0 =C2=A0 email: swmike@swm.pp.se--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--0000000000001a6dae05902cd9db-- From nobody Thu Aug 15 12:27:06 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DF5DC1200BA for ; Thu, 15 Aug 2019 12:27:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id N_kI5lbge90q for ; Thu, 15 Aug 2019 12:27:01 -0700 (PDT) Received: from mail-lf1-x12b.google.com (mail-lf1-x12b.google.com [IPv6:2a00:1450:4864:20::12b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A7BDC120074 for ; Thu, 15 Aug 2019 12:27:00 -0700 (PDT) Received: by mail-lf1-x12b.google.com with SMTP id v16so451944lfg.11 for ; Thu, 15 Aug 2019 12:27:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=SSVOWTs/YzIyKMY5A8ouzDWccMKeTeX1xsU8iNPDEiE=; b=r0wY0jgjBZrVsHqt1vyN1fiEEH719gm4zKzQJQ8k4SQ6g/x/6n4vIprJRNT/Zq9bGl JUOxLHUFhCVRBob+eMnRr3Yy3EEvjwaDPSG3hhzN+kahOQlawYEycxkThFoObQwdaqpb 7nL7l0e6NM8xYC1rzWlgdsAD4HWAHmRIEJNYCNr4mKKdnoNHsLZ5llcePeiTf63vL7NI WGlfHl6aLllPqLvOCiw3gosRXWJcfgQGngBN7BOIDtrjf516etLe6HAaos/phzooUXkb vDWLmj8P0AUmXEBX/r83ryWnexorfU/1wXYzRskX3eVmYFcKoD+rd0NBqJvCnQfwWCpp IOLg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=SSVOWTs/YzIyKMY5A8ouzDWccMKeTeX1xsU8iNPDEiE=; b=WYOXUev1jKUslFns6jxQH48dllv/nsojAcWToRfI7BwqZBK8thA2bZc2GHluWOtv0i x1ujpSgDBxs/svw8guX8gwvm6+GqkUKHTToI0iBjS2yIfUJ5eMYVgVkGLtYN1WqgG0Lp e1RJJtds2UYVpcqqAACUsjwZC2tNo0ybAFme1JDmDm4HRZ3sbK36cmJMd1erBHmBt53n 9UExgzke5Xt0vSlu9RKaqEeJKoafwQV1X8T67362cXuurf1ZsGE0/XKSyQ72KWNytLET ZGkMxhtadfZ+bBcnnUwquuuoumFlzPzaRZXkkJP4KbAvOA/gSoz9nbjDmuLsCWMTp6Jw UxzA== X-Gm-Message-State: APjAAAVvlJ0tVQUZ7c89WyjsEnln0KNZkY6aPxqC60heL6MLKOja4T6w 8BmmqsOtBq1VeNx8Rb+HZbr5QiUsED2CVSJpjOPU0g== X-Google-Smtp-Source: APXvYqyT80uSX30YkpEP8sg8+PMCIXN05A9r2Ho2yyZgKF3iIED5WumczMj1D6bj1XRfX2YDwUSiH8lQTTeTLueshls= X-Received: by 2002:a19:4a50:: with SMTP id x77mr3084686lfa.91.1565897218874; Thu, 15 Aug 2019 12:26:58 -0700 (PDT) MIME-Version: 1.0 References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <8e00891f-2aa2-ee11-559a-b5a8967b22d9@nostrum.com> <2C23D415-84F9-4B6C-B67B-0CC3EB600520@gmail.com> <3BAF0D47-67BD-4BA2-96D3-A9AB3095F04A@gmail.com> <6AA22A84-F94A-4631-A161-211F3CFF54F7@gmail.com> In-Reply-To: <6AA22A84-F94A-4631-A161-211F3CFF54F7@gmail.com> From: Eric Rescorla Date: Thu, 15 Aug 2019 21:26:21 +0200 Message-ID: To: Brian Dickson Cc: Adam Roach , Paul Hoffman , ADD Mailing list Content-Type: multipart/alternative; boundary="0000000000007c73ef05902cdbd7" Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 19:27:04 -0000 --0000000000007c73ef05902cdbd7 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Thu, Aug 15, 2019 at 9:14 PM Brian Dickson wrote: > > > Sent from my iPhone > > On Aug 15, 2019, at 2:47 PM, Eric Rescorla wrote: > > > > On Thu, Aug 15, 2019 at 8:41 PM Brian Dickson < > brian.peter.dickson@gmail.com> wrote: > >> >> >> Sent from my iPhone >> >> On Aug 15, 2019, at 2:19 PM, Eric Rescorla wrote: >> >> >> >> On Thu, Aug 15, 2019 at 6:52 PM Brian Dickson < >> brian.peter.dickson@gmail.com> wrote: >> >>> >>> >>> Sent from my iPhone >>> > On Aug 15, 2019, at 1:28 AM, Adam Roach wrote: >>> Hypothetical (but very important question): >>> If ALL browser DNS traffic was sent over BOTH DoH and DoT in parallel >>> (both encrypted, sent to the same resolver), do you agree that the priv= acy >>> would be the same (same encryption) and the unblockability would be >>> unchanged? >>> >>> The reason for doing this would be to allow the choice of resolver (per >>> client/app) to be discoverable. This is one significant gap in the DoH-= only >>> model. It would not require that the browser (or any other app) wait fo= r >>> both answers, so would at worst have no affect on performance, and at b= est >>> would improve performance. >>> >> >> I don't understand what this is intended to accomplish. In a later >> message, you argue that this would allow a network monitor to determine >> that this is a legitimate app that isn't using an undesirable DoH resolv= er, >> but I don't understand why you think that's true. It's true that the >> monitor can see that there are two connections to resolver X (DoH and Do= T) >> but that doesn't mean that the app is using those for its resolution; it >> may be making a third connection to bad resolver Y and using the results >> from that. >> >> >> >>> One variant to consider would be sending a DoT-like DNS query with only >>> the query NAME encrypted or hashes (ie completely different from DoT or= DoH >>> where the entire DNS message is encrypted) and to return A and AAAA RDA= TA >>> and QID and port number unencrypted (but encrypt all other fields and a= ll >>> other RDATA responses). This would allow IDS/firewall systems to contro= l >>> access on the basis of DNS answers, without needing to know the questio= n. >>> >> >> If all the IDS gets to see is the IP, why don't they just block on the I= P >> directly. >> >> >> The IDS and/or threat service needs to detect such an IP before it can b= e >> blocked. >> >> The first clue new malware may provide is changing DNS so as to avoid ID= S >> detection via DNS. >> >> The same approach could also be used by a malicious human, eg doing data >> exfiltration. >> >> My understanding is that detection is significantly hampered without any >> DNS information. This is better than nothing even if it is far from idea= l. >> >> And in the case of a configured enterprise DoH server on a company owned >> device, where DNS resolution is monitored, changing resolver would be >> necessary to evade detection. >> >> Again, not entirely foolproof, but certainly raises the bar, IMHO. >> > > I'm really not following your reasoning here. As I said, the application > is perfectly free to just use a totally separate channel and get IP > addresses that don't get advertised this way. > > What would be helpful here would be if you described what it is that (a) > you cannot do with DoH and (b) you can do if applications do as you sugge= st. > > -Ekr > > > The obvious use case is the second one: a malicious user, using an > unmodified app (eg browser) configured to use a monitored DoH resolver (e= g > enterprise resolver). > > If the user changes the resolver, in the DoH-only case, the monitored > resolver stops seeing queries. The malicious user accesses some site > somewhere (which involves first doing the DNS query via the newly > configured resolver) and exfiltrates data, then changes the configuration > back. A brief period of no queries would not likely be suspicious. Querie= s > to new resolvers would be completely unambiguous in that regard. > > If the application (browser) does what I suggest, the IDS at a minimum > would be able to detect the use of the rogue resolver, and potentially > could disconnect the malicious user=E2=80=99s device from the network (pr= eventing > the exfiltration). > > If the enterprise resolver also was blocking the site the user intended t= o > use (via DNS), the only other way the user could access it would be via > some kind of hard-coding. A robust anti-exfiltration solution could furth= er > restrict site access by requiring DNS-before-access. > This all seems pretty trivial to bypass. Even if we assume that resolution is completely under control of an enterprise resolver, it's trivial for the attacker to set up a server co-located with some set of innocuous domains (e.g., on GCP/AWS, etc.). The application then does resolution for one of those innocuous domains, gets back the IP address, then connects to it and instead requests its own domain (this is effectively domain fronting). Security is an arms race; this isn=E2=80=99t necessarily foolproof or > comprehensive, but it doesn=E2=80=99t need to be, to be useful. > It's true that things need not be foolproof to be useful, but declining to deploy a mechanism (DoH) that has substantial security value in order to preserve a mechanism that is easily bypassed doesn't seem like a good tradeoff. -Ekr > Brian > --0000000000007c73ef05902cdbd7 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Thu, Aug 15, 2019 at 9:14 PM Brian= Dickson <brian.peter.d= ickson@gmail.com> wrote:


Sent from my iPhone

On Aug 15, 2019, at 2:47 PM, Eric Rescorla <ekr@rtfm.com> wrote:


On Thu, Aug 15, 2019 at 8:41 PM Brian Dickson <brian.peter.dickson@gmail.com> wrote:


Sent from my iPhone

On Aug 15, 2019, at 2:19 PM, Eric Rescorla <ekr@rtfm.com> wrote:

<= /div>


On Thu, Aug 15, 2019 at 6:52 PM Brian Dickson <brian.peter.dickson@= gmail.com> wrote:


Sent from my iPhone
> On Aug 15, 2019, at 1:28 AM, Adam Roach <adam@nostrum.com> wrote:
Hypothetical= (but very important question):
If ALL browser DNS traffic was sent over BOTH DoH and DoT in parallel (both= encrypted, sent to the same resolver), do you agree that the privacy would= be the same (same encryption) and the unblockability would be unchanged? <= br>
The reason for doing this would be to allow the choice of resolver (per cli= ent/app) to be discoverable. This is one significant gap in the DoH-only mo= del. It would not require that the browser (or any other app) wait for both= answers, so would at worst have no affect on performance, and at best woul= d improve performance.

I don't unde= rstand what this is intended to accomplish.=C2=A0 In a later message, you a= rgue that this would allow a network monitor to determine that this is a le= gitimate app that isn't using an undesirable DoH resolver, but I don= 9;t understand why you think that's true. It's true that the monito= r can see that there are two connections to resolver X (DoH and DoT) but th= at doesn't mean that the app is using those for its resolution; it may = be making a third connection to bad resolver Y and using the results from t= hat.

=C2=A0
One variant to consider would be sending a DoT-like DNS query with only the= query NAME encrypted or hashes (ie completely different from DoT or DoH wh= ere the entire DNS message is encrypted) and to return A and AAAA RDATA and= QID and port number unencrypted (but encrypt all other fields and all othe= r RDATA responses). This would allow IDS/firewall systems to control access= on the basis of DNS answers, without needing to know the question.

If all the IDS gets to see is the IP, why don&= #39;t they just block on the IP directly.


The IDS and/or threat service needs to detect s= uch an IP before it can be blocked.

The first clue= new malware may provide is changing DNS so as to avoid IDS detection via D= NS.

The same approach could also be used by a mali= cious human, eg doing data exfiltration.

My unders= tanding is that detection is significantly hampered without any DNS informa= tion. This is better than nothing even if it is far from ideal.=C2=A0
=

And in the case of a configured enterprise DoH server o= n a company owned device, where DNS resolution is monitored, changing resol= ver would be necessary to evade detection.

Again, = not entirely foolproof, but certainly raises the bar, IMHO.

I'm really not following your reasoning he= re. As I said, the application is perfectly free to just use a totally sepa= rate channel and get IP addresses that don't get advertised this way.

What would be helpful here would be if you describe= d what it is that (a) you cannot do with DoH and (b) you can do if applicat= ions do as you suggest.

-Ekr

The obvious use case is the second one: a malic= ious user, using an unmodified app (eg browser) configured to use a monitor= ed DoH resolver (eg enterprise resolver).

If the u= ser changes the resolver, in the DoH-only case, the monitored resolver stop= s seeing queries. The malicious user accesses some site somewhere (which in= volves first doing the DNS query via the newly configured resolver) and exf= iltrates data, then changes the configuration back. A brief period of no qu= eries would not likely be suspicious. Queries to new resolvers would be com= pletely unambiguous in that regard.

If the applica= tion (browser) does what I suggest, the IDS at a minimum would be able to d= etect the use of the rogue resolver, and potentially could disconnect the m= alicious user=E2=80=99s device from the network (preventing the exfiltratio= n).

If the enterprise resolver also was blocking t= he site the user intended to use (via DNS), the only other way the user cou= ld access it would be via some kind of hard-coding. A robust anti-exfiltrat= ion solution could further restrict site access by requiring DNS-before-acc= ess.

This all seems pretty triv= ial to bypass. Even if we assume that=20 resolution is completely under control of an enterprise resolver, it's= =20 trivial for the attacker to set up a server co-located with some set of=20 innocuous domains (e.g., on GCP/AWS, etc.). The application then does=20 resolution for one of those innocuous domains, gets back the IP address, then connects to it and instead requests its own domain (this is=20 effectively domain fronting).


Security is= an arms race; this isn=E2=80=99t necessarily foolproof or comprehensive, b= ut it doesn=E2=80=99t need to be, to be useful.

It's true that things need not be foolproof to be usef= ul, but declining to deploy a mechanism (DoH) that has substantial security= value in order to preserve a mechanism that is easily bypassed doesn't= seem like a good tradeoff.

-Ekr
=

Brian
--0000000000007c73ef05902cdbd7-- From nobody Thu Aug 15 12:29:02 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 857991200C4 for ; Thu, 15 Aug 2019 12:29:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=swm.pp.se Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3zQG9f4ELG61 for ; Thu, 15 Aug 2019 12:28:59 -0700 (PDT) Received: from uplift.swm.pp.se (ipv6.swm.pp.se [IPv6:2a00:801::f]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E70091200BA for ; Thu, 15 Aug 2019 12:28:58 -0700 (PDT) Received: by uplift.swm.pp.se (Postfix, from userid 501) id 04706AF; Thu, 15 Aug 2019 21:28:56 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=swm.pp.se; s=mail; t=1565897336; bh=p9Ya5jHyoV2VkOO89EpyQzaS3jkI3za4/vLrVfAZ42U=; h=Date:From:To:cc:Subject:In-Reply-To:References:From; b=S0/+Q/YAKiLOKXXtjZBWwqN8wXx7EeQvb9PHMROLmcK7dgFHXy111eS7/fc8BOW/V cgma5dzog8Ds8f2Xx4qgqRubzuoSYFfn8EZCGnwLcKzfFQ/fQYFUQoEdESfiAqSFYe rxDYgdEzde0oilY1WeZaZA0VbtWbLFDbCLKZOKFY= Received: from localhost (localhost [127.0.0.1]) by uplift.swm.pp.se (Postfix) with ESMTP id 026F09F; Thu, 15 Aug 2019 21:28:56 +0200 (CEST) Date: Thu, 15 Aug 2019 21:28:55 +0200 (CEST) From: Mikael Abrahamsson To: Eric Rescorla cc: Ted Lemon , ADD Mailing list In-Reply-To: Message-ID: References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <8e00891f-2aa2-ee11-559a-b5a8967b22d9@nostrum.com> <2C23D415-84F9-4B6C-B67B-0CC3EB600520@gmail.com> <2704899B-E43D-4978-A3C9-30E9E7CEBEBD@fugue.com> User-Agent: Alpine 2.20 (DEB 67 2015-01-07) Organization: People's Front Against WWW MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII; format=flowed Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 19:29:01 -0000 On Thu, 15 Aug 2019, Eric Rescorla wrote: > I suppose it depends on whether that explanation includes describing the > various forms of misbehavior that network operators have been known to > engage in? I guess we can agree that the answer is "it depends". There is no "one correct answer". Therefore the whole discussion on "one default that fits all" is just the wrong answer. There is no default that suits all. Can we at least agree on this? -- Mikael Abrahamsson email: swmike@swm.pp.se From nobody Thu Aug 15 12:29:20 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AF6A41200C4 for ; Thu, 15 Aug 2019 12:29:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KhDSlh-Y44gJ for ; Thu, 15 Aug 2019 12:29:16 -0700 (PDT) Received: from mail-qt1-x82b.google.com (mail-qt1-x82b.google.com [IPv6:2607:f8b0:4864:20::82b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C2C301200BA for ; Thu, 15 Aug 2019 12:29:16 -0700 (PDT) Received: by mail-qt1-x82b.google.com with SMTP id j15so3490800qtl.13 for ; Thu, 15 Aug 2019 12:29:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=B6hCfEWxm8n/QAwLEosUDBhZBhyqcDu8tXBXx2m/N1k=; b=YqyAO6QIRNbtT3KBdAB3OxYCpoUzo9GMfc2O+hEuEYrgdu1v0+ipTOdm5o/1PadB8g 8fTSWPfeZwiQBqOWeg+rx46g1vUHma6MiXepAFl5aMIEWxktPNCGLbyn4faKYY49E9Ka uypmFlKDSdsS8M7498oCUQ9wLZKFD+MLHPQ1gGaT/ZnsYAjIHhwGNov9jzG9Wac2Gzco RFNsdst7eGar/IqAIxeUBGx/YJEfdwSrsFi4o/bkp+8RETRYU37GT3M+GiwH4rCPwaHD NjYAG7qM0dpOseBU+NQ7rSB69SfAM+6oLuyiq/4t0RiTwKUjL3pNKi02eEtfISSrNI9U LgcA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=B6hCfEWxm8n/QAwLEosUDBhZBhyqcDu8tXBXx2m/N1k=; b=jDvvJevWzspS2hATTaaANQiyal0X2+N3tuJ17H9quaCllqYXyoGJlXCB8ufguiZ9jn mfA22ifJ5vwOQ+EfZ2ZmlhT9XpTP9tW45skHMLH3d9VqZc6KURN8rlB6/hqaDbSE3q0s R2UeTdlE0CKGz1QQ2C8FNScxpIJ7Dou1jvp5AMCtkeLYiavsTByMwedRl7VCxYHpjUJ7 14yspCpPHbE5V7Kb5QjmNGT0f2LFTlEMH2tJ1De0Pd/E2qygDrc4otlwsYJM+5QUeLHB X8mkVAC0EPMi0mNpkLdNSHRn4w7+pRjFsZm07VIlaC1hhXh1B30UmeHnY2HnifReAxAO WUMQ== X-Gm-Message-State: APjAAAWGhRDkBldTn0vV7AsIT8/2SOcG6o2v8S8yJgujUF18o2+y6xNM /hsEwVo9dOo9FZ1owTeuo1o= X-Google-Smtp-Source: APXvYqyW8OEOP31Llsq5X/0pTAhRlQQBqJXZWCWTo78sOedAnRFfR70ZMOl82RfcQYpB1R82mGadGQ== X-Received: by 2002:ac8:31ba:: with SMTP id h55mr5487338qte.363.1565897355886; Thu, 15 Aug 2019 12:29:15 -0700 (PDT) Received: from [192.168.2.18] (cpe-76-179-66-50.maine.res.rr.com. [76.179.66.50]) by smtp.gmail.com with ESMTPSA id y188sm2128664qkc.29.2019.08.15.12.29.15 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 15 Aug 2019 12:29:15 -0700 (PDT) Content-Type: multipart/alternative; boundary=Apple-Mail-F51E61A9-FFA6-44A3-B928-D3BA5268F6A8 Mime-Version: 1.0 (1.0) From: Brian Dickson X-Mailer: iPhone Mail (16G77) In-Reply-To: <2704899B-E43D-4978-A3C9-30E9E7CEBEBD@fugue.com> Date: Thu, 15 Aug 2019 15:29:14 -0400 Cc: Tommy Jensen , Eric Rescorla , ADD Mailing list , Adam Roach , Paul Hoffman Content-Transfer-Encoding: 7bit Message-Id: <178D14DE-26A8-4097-9854-5CDE96D1C76C@gmail.com> References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <8e00891f-2aa2-ee11-559a-b5a8967b22d9@nostrum.com> <2C23D415-84F9-4B6C-B67B-0CC3EB600520@gmail.com> <2704899B-E43D-4978-A3C9-30E9E7CEBEBD@fugue.com> To: Ted Lemon Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 19:29:19 -0000 --Apple-Mail-F51E61A9-FFA6-44A3-B928-D3BA5268F6A8 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Sent from my iPhone > On Aug 15, 2019, at 3:03 PM, Ted Lemon wrote: >=20 >> On Aug 15, 2019, at 11:56 AM, Brian Dickson wrote: >> However, there are two mechanisms available for prevention of tampering. O= ne is encryption, the other is use of cryptographic signatures (eg DNSSEC, b= ut possibly also via signing by the resolver, ie DoH server). >=20 > Blocking is a form of tampering. One purpose of DoH is to make blocking i= mpractical, so that the end user isn=E2=80=99t forced to choose a path that=E2= =80=99s subject to tampering and intercept. >=20 > The resolver can=E2=80=99t attest to the validity of records for domains f= or which it is not authoritative, and there is no mechanism for associating a= DoH resolver with an authoritative domain other than DNSSEC (nor would it b= e useful to define one, since DNSSEC does this quite handily). So in practi= ce DNSSEC is the only mechanism that prevents tampering of the sort you are d= escribing. >=20 Or, it can wait for the DoH response and use that. The incremental change is= adding the DoT query, and the app can ignore that response. It still provid= es signal to the network (eg IDS). Blocking is still impossible since DoH is still used. Brian PS I=E2=80=99m still advocating for client DNSSEC validation, of course, reg= ardless of DoH/DoT.= --Apple-Mail-F51E61A9-FFA6-44A3-B928-D3BA5268F6A8 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable

Sent from my iPhone

On Aug 15, 2019, at 3:03= PM, Ted Lemon <mellon@fugue.com&= gt; wrote:

On Aug 15, 2= 019, at 11:56 AM, Brian Dickson <brian.peter.dickson@gmail.com> wrote:
However, there are two mechanisms available for prevention of tamperin= g. One is encryption, the other is use of cryptographic signatures (eg DNSSE= C, but possibly also via signing by the resolver, ie DoH server).

Blocking is a form of tampering. &nb= sp; One purpose of DoH is to make blocking impractical, so that the end user= isn=E2=80=99t forced to choose a path that=E2=80=99s subject to tampering a= nd intercept.

The resolver can=E2=80=99t= attest to the validity of records for domains for which it is not authorita= tive, and there is no mechanism for associating a DoH resolver with an autho= ritative domain other than DNSSEC (nor would it be useful to define one, sin= ce DNSSEC does this quite handily).  So in practice DNSSEC is the only m= echanism that prevents tampering of the sort you are describing.
<= br class=3D"">

Or, it can wait for the DoH r= esponse and use that. The incremental change is adding the DoT query, and th= e app can ignore that response. It still provides signal to the network (eg I= DS).

Blocking is still impossible since DoH is stil= l used.

Brian

PS I=E2=80=99= m still advocating for client DNSSEC validation, of course, regardless of Do= H/DoT.
= --Apple-Mail-F51E61A9-FFA6-44A3-B928-D3BA5268F6A8-- From nobody Thu Aug 15 12:33:21 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 51DD6120071 for ; Thu, 15 Aug 2019 12:33:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LqUux8mnIYvf for ; Thu, 15 Aug 2019 12:33:18 -0700 (PDT) Received: from mail-lj1-x232.google.com (mail-lj1-x232.google.com [IPv6:2a00:1450:4864:20::232]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 51CE31200BA for ; Thu, 15 Aug 2019 12:33:18 -0700 (PDT) Received: by mail-lj1-x232.google.com with SMTP id z17so3247082ljz.0 for ; Thu, 15 Aug 2019 12:33:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=p2Ho4rDBS9J3acZjBgqQy/QXw9/DpsCIuP6y+YqEq5E=; b=EW+POouBfVLhqCeso7Bs8NBnSpyMm4vq7yHYCSZ0P8cTFjgiBRUKBg7GNf4NnXO9HM XUiyWKjewU7tiDJ3lafuOyK7/jb9Ldo1Dpmvs8wp7tVGz0gvFXBfgZnNx+xIv2lWYCwN +YMqd0TPo1sP6bP4m9iUP/Z5eThSN8RxDhrKnO2NAOsHHACxXl3//nZ7CLC3gCvFTths 1ASIQywoKKugo2tNvlD6aBVAICIeWK3piltyt6CexGqYskDc/vndTKD8ssG7Sktrav8G 2xmYvyowm6nF4BDcra8ILGnk4pnoff8l8iN296AG8QgrG+9mle5pKzNqEflIrz4tgSER R/RA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=p2Ho4rDBS9J3acZjBgqQy/QXw9/DpsCIuP6y+YqEq5E=; b=VUFpWFhwfhDkPwz7iX/ZylA54cuswxqJuwrO8f8MqLt+oHdkMP5JCWBq2VBmIz8jPi qz9zHlMKMljDsh+P/bdNp+8N/mz/5NOZQEdoJIU7v1C1u4j0ibyECupGYPCti0KYB2M7 C5FUUqexwf0UOkhgTzoUTc8TeUGGKKZ1M6ljrw82TMqwWaxnyQ3ymy7HIbVmcjm2xI4w hXXKJWuEhVYM9bKEEyq08mgdqd1dG1GZLzFNlB8Yl5tj9//IzERjs1+OlSzEADcpcZex 1AxT1UIZnvhuFucr1CrEDiFkIsqWj9Lr0uPhLRtdvgqMf8ISRXmnWcYIlE52UA25Ujh1 /SIQ== X-Gm-Message-State: APjAAAUadljqqvYu2D0QrXCCA6CpuCLj37H8mNhzozfBlSdqJ2duEk/H EFYYSqvVXSeHrL9sA3dlkAk8xWEuAv9deoOf+nXnYw== X-Google-Smtp-Source: APXvYqyhyXSsTY+MntfWPQr4EfBNqCuVKSSg1ob2y3e/K/t0ibCFZkdbaHgxj2l30fhv/nBcbLbvylJ1cfuBsPisGZ4= X-Received: by 2002:a2e:9b0c:: with SMTP id u12mr3512946lji.239.1565897596358; Thu, 15 Aug 2019 12:33:16 -0700 (PDT) MIME-Version: 1.0 References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <8e00891f-2aa2-ee11-559a-b5a8967b22d9@nostrum.com> <2C23D415-84F9-4B6C-B67B-0CC3EB600520@gmail.com> <2704899B-E43D-4978-A3C9-30E9E7CEBEBD@fugue.com> In-Reply-To: From: Eric Rescorla Date: Thu, 15 Aug 2019 21:32:39 +0200 Message-ID: To: Mikael Abrahamsson Cc: Ted Lemon , ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000fc7c0e05902cf1f7" Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 19:33:20 -0000 --000000000000fc7c0e05902cf1f7 Content-Type: text/plain; charset="UTF-8" On Thu, Aug 15, 2019 at 9:28 PM Mikael Abrahamsson wrote: > On Thu, 15 Aug 2019, Eric Rescorla wrote: > > > I suppose it depends on whether that explanation includes describing the > > various forms of misbehavior that network operators have been known to > > engage in? > > I guess we can agree that the answer is "it depends". There is no "one > correct answer". > > Therefore the whole discussion on "one default that fits all" is just the > wrong answer. There is no default that suits all. > > Can we at least agree on this? > Yes, but that also applies to the current default. The question is what would be a better default for more people. -Ekr > -- > Mikael Abrahamsson email: swmike@swm.pp.se > --000000000000fc7c0e05902cf1f7 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Thu, Aug 15, 2019 at 9:28 PM Mikae= l Abrahamsson <swmike@swm.pp.se&= gt; wrote:
On Th= u, 15 Aug 2019, Eric Rescorla wrote:

> I suppose it depends on whether that explanation includes describing t= he
> various forms of misbehavior that network operators have been known to=
> engage in?

I guess we can agree that the answer is "it depends". There is no= "one
correct answer".

Therefore the whole discussion on "one default that fits all" is = just the
wrong answer. There is no default that suits all.

Can we at least agree on this?

Yes, but= that also applies to the current default. The question is what would be a = better default for more people.

-Ekr

--
Mikael Abrahamsson=C2=A0 =C2=A0 email: swmike@swm.pp.se
--000000000000fc7c0e05902cf1f7-- From nobody Thu Aug 15 12:43:43 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EFFF012008B for ; Thu, 15 Aug 2019 12:43:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uLHOq7yr19Qs for ; Thu, 15 Aug 2019 12:43:40 -0700 (PDT) Received: from mail-qk1-x72f.google.com (mail-qk1-x72f.google.com [IPv6:2607:f8b0:4864:20::72f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C49C112007C for ; Thu, 15 Aug 2019 12:43:39 -0700 (PDT) Received: by mail-qk1-x72f.google.com with SMTP id u190so2807202qkh.5 for ; Thu, 15 Aug 2019 12:43:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=DhfQsqKnLwCaozVmvadrsBJFo8n2AbpK7rt0KooPI0Q=; b=V+xzImjtICgJ9zDV6wvcFt/IidKW8kMsbKE5tWzEHLDOxBtPTtjfuTkAzmejGGqp0P WoQgdlf+HDzets3UbYQQhbwZ6L5I6yuor7XMvpJHjRd1lOXAxpVi04PhYNsGW6Cja5yD 7uH6crwrrY/nU6VimpguEb+1GlBPYez0FF0xCRBhXEewWKcTebFtAYn9pXjRx+xaWyhd wrFkvnWqQuRZM5ZuF3q7s5755inPjuMw0IqXUHtASsuKm2c+oxddkAeMzRZaSeTgyvhZ EcRh6IkliE4VsoZghFlsGbHbqslwgJx9WJzFmAl39z+Zxb40q0ItcCBCDXW2l0UDH9Q+ V22A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=DhfQsqKnLwCaozVmvadrsBJFo8n2AbpK7rt0KooPI0Q=; b=MkmZRKJP5a8OFgoKzwO/MzJ3bhVdS8b8Z29WRm5AnD8RbVU4F2Fvq3e0iKGh/rT3+j Kn6mcxXPpiBUbfUlctJitB2+T7ReFvSQEgMDt7tHFupxKCiDgJNR3SwvpS6Fr/otpLXM aLPXG4QuhHIKqiYu0I5Injm5utyM2qDAVYnDH8mps6CQonPlfPQ2gG1/cfp3Tr/8TBO+ Qwl1VYwV/zOxntUB0hYsHJyFW4rpR2QjvL9j8dFKAuBaeIAFn5snHuQCB21vWvKwj+r9 gzUWu0uzoMuNBcIc0oGUa2dYiwOkgOKtlrXe7fuA42kG+H/CkhaNKIIgZyNO2CtcLVBC I/Gw== X-Gm-Message-State: APjAAAV8ogu+CH9K8YO1yc/PTw2TstcKeg8j+n3vJEk74M2r1hE3lnkb 5R1jLiWtEss//uasMYbAYwsuVA== X-Google-Smtp-Source: APXvYqzQPXpAFQiJ0WxOro2tSjP1aiiaPVV09W4Z/+kXuavR0BlBgIRLPqkvrIRaytmkmrH94n+SGQ== X-Received: by 2002:ae9:df84:: with SMTP id t126mr5598566qkf.328.1565898218673; Thu, 15 Aug 2019 12:43:38 -0700 (PDT) Received: from ?IPv6:2001:470:c1a2:1:9128:e34:f62c:61a4? ([2001:470:c1a2:1:9128:e34:f62c:61a4]) by smtp.gmail.com with ESMTPSA id q29sm2152743qtf.74.2019.08.15.12.43.36 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 15 Aug 2019 12:43:37 -0700 (PDT) From: Ted Lemon Message-Id: <2BF9864A-67F5-4A86-99B8-2E2F75B466FB@fugue.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_4416790C-F8CC-4067-826B-D3AA1679C99B" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Thu, 15 Aug 2019 12:43:34 -0700 In-Reply-To: <178D14DE-26A8-4097-9854-5CDE96D1C76C@gmail.com> Cc: ADD Mailing list To: Brian Dickson References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <8e00891f-2aa2-ee11-559a-b5a8967b22d9@nostrum.com> <2C23D415-84F9-4B6C-B67B-0CC3EB600520@gmail.com> <2704899B-E43D-4978-A3C9-30E9E7CEBEBD@fugue.com> <178D14DE-26A8-4097-9854-5CDE96D1C76C@gmail.com> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 19:43:42 -0000 --Apple-Mail=_4416790C-F8CC-4067-826B-D3AA1679C99B Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 On Aug 15, 2019, at 12:29 PM, Brian Dickson = wrote: > Blocking is still impossible since DoH is still used. Sure, except that if this were the default behavior of devices that use = DoH, it would be trivial to block outgoing HTTPS connections for devices = that do this. And then the user would disable it, the device would go = back to using the local resolver, and all would be well (for the network = operator, not necessarily the user). Or the user would disable DoT = replication, and continue doing DoH. Also, you=E2=80=99ve added complexity, and probably latency. And = honestly, why the heck would I implement that? If you tell me I have = to do X to make things work, and I should do Y, but it will make no = difference to my user if I do Y or not, then why would I spend = additional geek-hours building and testing Y? There is no scenario I = can imagine, that did not involve jack-booted thugs standing over me, = where I would implement this, even if I agreed in principle that it was = a good idea. It=E2=80=99s a really basic principle of getting stuff = done: you write the code you need to write, and no other code. --Apple-Mail=_4416790C-F8CC-4067-826B-D3AA1679C99B Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 On = Aug 15, 2019, at 12:29 PM, Brian Dickson <brian.peter.dickson@gmail.com> wrote:
Blocking is still impossible since = DoH is still used.

Sure,= except that if this were the default behavior of devices that use DoH, = it would be trivial to block outgoing HTTPS connections for devices that = do this.   And then the user would disable it, the device would go = back to using the local resolver, and all would be well (for the network = operator, not necessarily the user).  Or the user would disable DoT = replication, and continue doing DoH.

Also, you=E2=80=99ve added complexity, and = probably latency.   And honestly, why the heck would I implement = that?   If you tell me I have to do X to make things work, and I = should do Y, but it will make no difference to my user if I do Y or not, = then why would I spend additional geek-hours building and testing Y? =   There is no scenario I can imagine, that did not involve = jack-booted thugs standing over me, where I would implement this, even = if I agreed in principle that it was a good idea.  It=E2=80=99s a = really basic principle of getting stuff done: you write the code you = need to write, and no other code.


= --Apple-Mail=_4416790C-F8CC-4067-826B-D3AA1679C99B-- From nobody Thu Aug 15 14:08:53 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3C2431200CC for ; Thu, 15 Aug 2019 14:08:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MALa3lLzKq9X for ; Thu, 15 Aug 2019 14:08:46 -0700 (PDT) Received: from NAM02-BL2-obe.outbound.protection.outlook.com (mail-bl2nam02on0707.outbound.protection.outlook.com [IPv6:2a01:111:f400:fe46::707]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F3AA61200C7 for ; Thu, 15 Aug 2019 14:08:36 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=k8nZRyG+OdHjkvqrnOLZUhixBF4HQmHpyU/apNdcGVmpsFmPrZFjOr469jsjW6KCriAbSsk0tnQ51vIj1LyPz4MBbrg5pj4MXJIBBZX9rGN0VSVOJctTXZG0CovJTYlNFLQJ4EjgCxEW8YQM4vOy5FEDNZdY/GzRsaohzfXzCxWvu8ytCyfp5X0ExgFq6SN2xjypmYx2zEJxHCxfTvQIR+MYNW2fq+oK62LcOiYdvf/0dUYuVKAr5muOrq+fxfKKfISr00YjkzUZxuaDSq3JYXM3NXggQ2C0fZUOYDelc2X/S8H0izx0oKo8ibwZW32XTmyMU6Ox+SaA/8fQvNLLFw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=5UV4u6mdvsZvmft/4A8AvMWZHy37EirdK0YDHufMKo4=; b=EqHyAKy/Q/4GNdfeGWUe+2wbrVLDlAiX8Q9mt3+vwzRcMSoxQM41buDLctkWksDWwwlJ4cTKOrzQ/p5MAnDHgc3lQgNyQe8WomJi8JXcVvVbqWJFsc3n94SwCzNmGV7rDxLwk7LfkqZ3wRsjRRAcAaT7xbv+xPE/CP0BZyB9lMNtu75q2JSrnFGi5Ahl2k6G30dqHut2WksU447TqpnwoN6Lfoh+n92d+sAtkHnhhH2ymnIZGZGxWQDG/jkq8sxNGsAhMnD/EpqK488T7VWmm3PTwUl+Vt8qiTJCRtJ1qhpiPtkzPBNDLoj8KmZKrhVyTFiXMrPiRh9b3DGB9fwx1w== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=microsoft.com; dmarc=pass action=none header.from=microsoft.com; dkim=pass header.d=microsoft.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=5UV4u6mdvsZvmft/4A8AvMWZHy37EirdK0YDHufMKo4=; b=Lvkk0bJ/8JD830OFZZqplo5eRvMwM167spYW7RwP3rE916cW/3N4UqHdUruJzZFY+zctF4HstecRKVT772/k47DreW1uMXECDWCEoT0RYWzsHdGkOl8khoFZnlOnmaLezwIIqQxuMAq5fgBCA4FeD45bAMRJb/h3BSGgxVrKgfU= Received: from MWHPR21MB0192.namprd21.prod.outlook.com (10.173.52.138) by MWHPR21MB0142.namprd21.prod.outlook.com (10.173.52.12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2199.6; Thu, 15 Aug 2019 21:08:34 +0000 Received: from MWHPR21MB0192.namprd21.prod.outlook.com ([fe80::3040:4d29:2935:9a7f]) by MWHPR21MB0192.namprd21.prod.outlook.com ([fe80::3040:4d29:2935:9a7f%3]) with mapi id 15.20.2178.010; Thu, 15 Aug 2019 21:08:34 +0000 From: Tommy Jensen To: Brian Dickson CC: Eric Rescorla , Paul Hoffman , ADD Mailing list , Adam Roach Thread-Topic: [Add] [Ext] Validity of network administrator role Thread-Index: AQHVUyp4iPKBDVjDIkCVQCaF07YMYKb8bWGAgAAYXgCAAALNx4AAB4wAgAAg8ZA= Date: Thu, 15 Aug 2019 21:08:34 +0000 Message-ID: References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <8e00891f-2aa2-ee11-559a-b5a8967b22d9@nostrum.com> <2C23D415-84F9-4B6C-B67B-0CC3EB600520@gmail.com> , In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Jensen.Thomas@microsoft.com; x-originating-ip: [2001:4898:80e8:f:49d4:26fe:1372:35bd] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: f6efda8d-0df6-4381-6d00-08d721c4bbbe x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600158)(711020)(4605104)(1401327)(4618075)(2017052603328)(7193020); SRVR:MWHPR21MB0142; x-ms-traffictypediagnostic: MWHPR21MB0142: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-forefront-prvs: 01304918F3 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(4636009)(346002)(136003)(396003)(376002)(366004)(39860400002)(199004)(189003)(51444003)(6246003)(76176011)(7736002)(74316002)(6506007)(7696005)(54906003)(53546011)(25786009)(71190400001)(71200400001)(33656002)(8936002)(81166006)(81156014)(19627405001)(561944003)(53936002)(4326008)(22452003)(316002)(478600001)(10290500003)(8990500004)(6436002)(55016002)(5660300002)(229853002)(66574012)(14454004)(10090500001)(2906002)(476003)(186003)(446003)(11346002)(6916009)(52536014)(486006)(99286004)(256004)(86362001)(14444005)(105004)(46003)(102836004)(54896002)(9686003)(8676002)(236005)(66556008)(64756008)(66446008)(66476007)(6116002)(66946007)(76116006); DIR:OUT; SFP:1102; SCL:1; SRVR:MWHPR21MB0142; H:MWHPR21MB0192.namprd21.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: yCjslhYSDCzBzv2ji0fDI9rybM6BxrwLgQ10wwK3aIel16L0tWTqmqhffBVQ1bbmo0GHp0NU6Ol879HsYtU5Dap7c9LReQQDUtDBJ5+ynNl3v5mpX96pUpfOqoeNglgCcB/2nQ0ccfF+P2Sh0QjpI9HcCrvTu5MmgtJSh6Y3uaa2aJZo6w1VhR+O/a0HjbEjIt5JfZCECWfZYssujM7d5He4jMRTiP98E+GIIn5oRfvxwdUTj2qe0OxpsuYVZpJae4QbiyMY0jxMj+YDDKrL6cB3+zhI6/VB6u1AmxWG+WYCxBBTpd6DVAY9PZaRyup3MTl2lMMc0ALTRDbjbrVbKIpkmRutwmVLSgGVuyMMEIBppeRTbTHrJRt4vnNtyDrCmXWQwISt5WzAi+Cagj2dYtWeyF6DvCDlIZoL9pSUcwg= x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_MWHPR21MB01924197E936B19A89DF3D75FAAC0MWHPR21MB0192namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: f6efda8d-0df6-4381-6d00-08d721c4bbbe X-MS-Exchange-CrossTenant-originalarrivaltime: 15 Aug 2019 21:08:34.1088 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: nzxnuKkOiblXklB3sYaC4IbRnobCYa9y/TQHNTKy1G3Tbkj3bFCcmzBVhMwAme/Vrj9yBPdPJH4EbsoI4swsJg== X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR21MB0142 Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 21:08:51 -0000 --_000_MWHPR21MB01924197E936B19A89DF3D75FAAC0MWHPR21MB0192namp_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable brian> However, there are two mechanisms available for prevention of tamper= ing. One is encryption, the other is use of cryptographic signatures (eg DN= SSEC, but possibly also via signing by the resolver, ie DoH server). brian> brian> Exposing some portion of the responses while protecting them via sig= natures, is one way of preventing tampering (or at least providing tamper e= vidence.) I agree that DNSSEC provides evidence of tampering, but I think that is les= s valuable than what encryption brings (lack of visibility as well as tampe= r protection). brian> This, I agree with. The main challenge is in the ways of ensuring th= e correct resolver is being used. That is the rationale for the DoT+DoH ide= a. I=92d certainly welcome any other ideas for how that could be done. After seeing the discussions on this mailing list, I think our best collect= ive chance at determing the "correct" resolver is to work in the platform c= ontext where the correctness of a DNS server has previously been expressed.= For example, the platform has configuration for deciding whether to trust = the network recommendation or to use a manually provided server set, what s= uffixes to use with single label names, what exceptions to use for specific= domain spaces as dictated by VPN or proxy configurations, and so forth. As= has been pointed out, platform configurations have different sources and h= aving a conversation about how to compare those sources would be my next st= ep forward. To that end, I am working with some folks offline to see if we can build a = proposal for platform exposure of DNS intent to apps that could provide the= correctness guide we're all looking for. That way, apps would have a cross= -platform way of communicating with the platform about what the user author= ities over the device have previously configured, and networks would know w= hat contract they need to meet to prove correctness to the platform. Let me= know if you're interested in such a conversation. It's far from perfect, b= ut it would be a distinct improvement over any of these imo: * "always trust network recommendation no matter what network" * "always trust the app, no matter what platform configuration exists" * "always ask the user, no matter how much or little they know" (or how= much or little administrative control they have over the device or network= , since user at keyboard !=3D user with administrative privilege in many ca= ses) Thanks, Tommy ________________________________ From: Brian Dickson Sent: Thursday, August 15, 2019 11:56 AM To: Tommy Jensen Cc: Eric Rescorla ; Paul Hoffman ; AD= D Mailing list ; Adam Roach Subject: Re: [Add] [Ext] Validity of network administrator role Sent from my iPhone On Aug 15, 2019, at 2:39 PM, Tommy Jensen > wrote: ekr> If all the IDS gets to see is the IP, why don't they just block on the= IP directly. Agreed. It doesn't matter how the client acquired an IP address (DNS, user = typing, etc.) if the network knows the IP is bad already. In general, I think any approach to appeasing user privacy and network secu= rity that begins with deciding which parts of traffic to leave unencrypted = is heading in the wrong direction. The major point of encrypting traffic is= to prevent third party boxes from seeing/tampering with the data, Here=92s what I=92d like to emphasize: Encrypted data is protected from on-path viewing, and I believe is the only= mechanism available for that purpose. However, there are two mechanisms available for prevention of tampering. On= e is encryption, the other is use of cryptographic signatures (eg DNSSEC, b= ut possibly also via signing by the resolver, ie DoH server). Exposing some portion of the responses while protecting them via signatures= , is one way of preventing tampering (or at least providing tamper evidence= .) Brian and there's no way to differentiate third parties with good and ill intent.= Focusing on how the decision in resolvers gets made in the first place see= ms to provide more value, as the traffic can be manipulated in the Good Way= s(tm) by the resolver trusted to do so, and not by anyone else along the pa= th. This, I agree with. The main challenge is in the ways of ensuring the corre= ct resolver is being used. That is the rationale for the DoT+DoH idea. I=92= d certainly welcome any other ideas for how that could be done. Brian Enabling Good Ways(tm) tampering by anyone other than the RR the stub is tr= ying to reach just puts us back in square one (classic DNS). Thanks, Tommy ________________________________ From: Add > on behalf of = Eric Rescorla > Sent: Thursday, August 15, 2019 11:19 AM To: Brian Dickson > Cc: Paul Hoffman >; A= DD Mailing list >; Adam Roach > Subject: Re: [Add] [Ext] Validity of network administrator role On Thu, Aug 15, 2019 at 6:52 PM Brian Dickson > wrote: Sent from my iPhone > On Aug 15, 2019, at 1:28 AM, Adam Roach > wrote: Hypothetical (but very important question): If ALL browser DNS traffic was sent over BOTH DoH and DoT in parallel (both= encrypted, sent to the same resolver), do you agree that the privacy would= be the same (same encryption) and the unblockability would be unchanged? The reason for doing this would be to allow the choice of resolver (per cli= ent/app) to be discoverable. This is one significant gap in the DoH-only mo= del. It would not require that the browser (or any other app) wait for both= answers, so would at worst have no affect on performance, and at best woul= d improve performance. I don't understand what this is intended to accomplish. In a later message= , you argue that this would allow a network monitor to determine that this = is a legitimate app that isn't using an undesirable DoH resolver, but I don= 't understand why you think that's true. It's true that the monitor can see= that there are two connections to resolver X (DoH and DoT) but that doesn'= t mean that the app is using those for its resolution; it may be making a t= hird connection to bad resolver Y and using the results from that. One variant to consider would be sending a DoT-like DNS query with only the= query NAME encrypted or hashes (ie completely different from DoT or DoH wh= ere the entire DNS message is encrypted) and to return A and AAAA RDATA and= QID and port number unencrypted (but encrypt all other fields and all othe= r RDATA responses). This would allow IDS/firewall systems to control access= on the basis of DNS answers, without needing to know the question. If all the IDS gets to see is the IP, why don't they just block on the IP d= irectly. -Ekr --_000_MWHPR21MB01924197E936B19A89DF3D75FAAC0MWHPR21MB0192namp_ Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable
brian> However, there are two mechanisms available for prevention o= f tampering. One is encryption, the other is use of cryptographic signature= s (eg DNSSEC, but possibly also via signing by the resolver, ie DoH server)= .
brian>
brian> Exposing some portion of the responses while protecting them= via signatures, is one way of preventing tampering (or at least providing = tamper evidence.)

I agree that DNSSEC provides evidence of tampering, but I think that is les= s valuable than what encryption brings (lack of visibility as well as tampe= r protection).

brian> This, I agree with. The main challenge is in the ways of ens= uring the correct resolver is being used. That is the rationale for the DoT= +DoH idea. I=92d certainly welcome any other ideas for how that could b= e done.

After seeing the discussions on this mailing list, I think our best collect= ive chance at determing the "correct" resolver is to work in the = platform context where the correctness of a DNS server has previously been = expressed. For example, the platform has configuration for deciding whether to trust the network recommendation or to use a manua= lly provided server set, what suffixes to use with single label names, what= exceptions to use for specific domain spaces as dictated by VPN or proxy c= onfigurations, and so forth. As has been pointed out, platform configurations have different sources and h= aving a conversation about how to compare those sources would be my next st= ep forward.

To that end, I am working with some folks offline to see if we can build a = proposal for platform exposure of DNS intent to apps that could provide the= correctness guide we're all looking for. That way, apps would have a cross= -platform way of communicating with the platform about what the user authorities over the device have previous= ly configured, and networks would know what contract they need to meet to p= rove correctness to the platform. Let me know if you're interested in such = a conversation. It's far from perfect, but it would be a distinct improvement over any of these imo:
  • "always trust network recommendation no matter what network"<= /li>
  • "always trust the app, no matter what platform configuration e= xists"
  • "always ask the user, no matter how much or little= they know" (or how much or little administrative control they have ov= er the device or network, since user at keyboard !=3D user with administrat= ive privilege in many cases)
Thanks,
Tommy

From: Bria= n Dickson <brian.peter.dickson@gmail.com>
Sent: Thursday, August 15, 2019 11:56 AM
To: Tommy Jensen <Jensen.Thomas@microsoft.com>
Cc: Eric Rescorla <ekr@rtfm.com>; Paul Hoffman <paul.hoffma= n@icann.org>; ADD Mailing list <add@ietf.org>; Adam Roach <adam= @nostrum.com>
Subject: Re: [Add] [Ext] Validity of network administrator role
 


Sent from my iPhone

On Aug 15, 2019, at 2:39 PM, Tommy Jensen <Jensen.Thomas@microsoft.com> wrote:

ekr> If all the IDS ge= ts to see is the IP, why don't they just block on the IP directly.

Agreed. It doesn't matter how = the client acquired an IP address (DNS, user typing, etc.) if the network k= nows the IP is bad already.

In general, I think any approa= ch to appeasing user privacy and network security that begins with deciding= which parts of traffic to leave unencrypted is heading in the wrong direction. The major point of encrypting traffic i= s to prevent third party boxes from seeing/tampering with the data,

Here=92s what I=92d like to emphasize:

Encrypted data is protected from on-path viewing, and I believe is the= only mechanism available for that purpose.

However, there are two mechanisms available for prevention of tamperin= g. One is encryption, the other is use of cryptographic signatures (eg DNSS= EC, but possibly also via signing by the resolver, ie DoH server).

Exposing some portion of the responses while protecting them via signa= tures, is one way of preventing tampering (or at least providing tamper evi= dence.)

Brian

and there's no way to differen= tiate third parties with good and ill intent. Focusing on how the decision = in resolvers gets made in the first place seems to provide more value, as the traffic can be manipulated in th= e Good Ways(tm) by the resolver trusted to do so, and not by anyone else al= ong the path.

This, I agree with. The main challenge is in the ways of ensuring the = correct resolver is being used. That is the rationale for the DoT+DoH i= dea. I=92d certainly welcome any other ideas for how that could be done.

Brian


Enabling Good Ways(tm) tamperi= ng by anyone other than the RR the stub is trying to reach just puts us bac= k in square one (classic DNS).

Thanks,
Tommy
From: Ad= d <add-bounces@ietf.o= rg> on behalf of Eric Rescorla <ekr@rtfm.com>
Sent: Thursday, August 15, 2019 11:19 AM
To: Brian Dickson <brian.peter.dickson@gmail.com>
Cc: Paul Hoffman <paul.hoffman@icann.org>; ADD Mailing list <add@ietf.org>; Adam Roach <adam@nostrum.com>
Subject: Re: [Add] [Ext] Validity of network administrator role
 


On Thu, Aug 15, 2019 at 6:52 PM B= rian Dickson <brian.peter.dickson@gmail.com> wrote:


Sent from my iPhone
> On Aug 15, 2019, at 1:28 AM, Adam Roach <adam@nostrum.com> wrote:
Hypothetical (but very important question):
If ALL browser DNS traffic was sent over BOTH DoH and DoT in parallel (both= encrypted, sent to the same resolver), do you agree that the privacy would= be the same (same encryption) and the unblockability would be unchanged?

The reason for doing this would be to allow the choice of resolver (per cli= ent/app) to be discoverable. This is one significant gap in the DoH-only mo= del. It would not require that the browser (or any other app) wait for both= answers, so would at worst have no affect on performance, and at best would improve performance.

I don't understand what this is intended to accomplish.  In a lat= er message, you argue that this would allow a network monitor to determine = that this is a legitimate app that isn't using an undesirable DoH resolver,= but I don't understand why you think that's true. It's true that the monitor can see that there are two connect= ions to resolver X (DoH and DoT) but that doesn't mean that the app is usin= g those for its resolution; it may be making a third connection to bad reso= lver Y and using the results from that.

 
One variant to consider would be sending a DoT-like DNS query with only the= query NAME encrypted or hashes (ie completely different from DoT or DoH wh= ere the entire DNS message is encrypted) and to return A and AAAA RDATA and= QID and port number unencrypted (but encrypt all other fields and all other RDATA responses). This would a= llow IDS/firewall systems to control access on the basis of DNS answers, wi= thout needing to know the question.

If all the IDS gets to see is the IP, why don't they just block on the= IP directly.

-Ekr

--_000_MWHPR21MB01924197E936B19A89DF3D75FAAC0MWHPR21MB0192namp_-- From nobody Thu Aug 15 14:58:57 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0A1A21200EC for ; Thu, 15 Aug 2019 14:58:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xKfNTK_a4Za5 for ; Thu, 15 Aug 2019 14:58:53 -0700 (PDT) Received: from mail-io1-xd2c.google.com (mail-io1-xd2c.google.com [IPv6:2607:f8b0:4864:20::d2c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B6C761200C7 for ; Thu, 15 Aug 2019 14:58:53 -0700 (PDT) Received: by mail-io1-xd2c.google.com with SMTP id q22so2268467iog.4 for ; Thu, 15 Aug 2019 14:58:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=NIDyx2+o8+1Hcb3lVLDGJ4bOhF9TM07HTTBpTJEieKM=; b=O/7Ao+jUwqj/Nv/pn5hsm/TEOAAaFl6h8cOxq8Jqfut6nL+ydirMQnq4yVr9x1xOch UhHlgMI7MvpB8h4lqj7MbKgTtiqNnwCDxDtm6BaahC2DtXDhbJS7GHL5XjjRVRejX58c V3yffJjGvb8FRcBDvKhdnmgtSwtiLg9Y2hIbxOIKSLWeE25/7Hrso/3iiUVwo/aBTIwa KbCqRcuD0tzjLvvMGi4WD1Wk6M5LYNcs4eF0nfm4ORdo3YPaSrnH0OhS2OapzrgoDwnP WmUOipmFwbjkY+2XtJ1zY2lOLTQktGHQheX/JofLkvIDz0BEZ3/4cHNDsdr0+r72EZcU GkiQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=NIDyx2+o8+1Hcb3lVLDGJ4bOhF9TM07HTTBpTJEieKM=; b=kzbiC58ban8wKbhX7fqd1dfurLcVFQUxoZt3sVYTyd5HNy9N36qX67ziKQF1jLb/Dr lVViTJG7ZquiKNPwjcqmqRI8QIMT0jXKDZHuBxrryPk0ERy3VHT6ZzX446RrVmIiGwx4 3cGzRLUYrI+7ESfMVdKBMMJRyV77RDScuZE4xbrikajPQ+5h93HIlxsHjuO6iI7/80E5 ewceEDPDiuRKMd7nDW23sUv/T569sMD82ZKEJ1pW1LaRQOLW1tZh1m2v0jGo5d25jPWR W3VXjMiWc5x7hNvE8NSdGk5ULkfVMf4gKE+LIHb5+fQexjJ78q9PxPtPbQETbBK9zFzB JmDg== X-Gm-Message-State: APjAAAVA20U0CNoD+wmKq1164BXw4fLT06M55tSuPArcyQ9KdNQmDxAA NpuEehhj27Y/ZG6X8Hea3eI= X-Google-Smtp-Source: APXvYqwaXF55gDnH2DCN2yUFTTya8xE9bO25sMedXONK8Fpq70zJWRuMc7svMTJVtl3ExXqz6b1SNg== X-Received: by 2002:a6b:4107:: with SMTP id n7mr7296373ioa.12.1565906332983; Thu, 15 Aug 2019 14:58:52 -0700 (PDT) Received: from [172.16.255.50] ([216.194.115.4]) by smtp.gmail.com with ESMTPSA id y19sm4680735ioj.62.2019.08.15.14.58.50 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 15 Aug 2019 14:58:52 -0700 (PDT) From: Bret Jordan Message-Id: <4CC4C262-BEF4-4B39-ACB1-A595AB66D6CD@gmail.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_31CFC063-60E6-42C9-9F73-A1F11A0336AD" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Thu, 15 Aug 2019 15:58:45 -0600 In-Reply-To: Cc: Ted Lemon , ADD Mailing list To: Mikael Abrahamsson References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <8e00891f-2aa2-ee11-559a-b5a8967b22d9@nostrum.com> <2C23D415-84F9-4B6C-B67B-0CC3EB600520@gmail.com> <2704899B-E43D-4978-A3C9-30E9E7CEBEBD@fugue.com> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 21:58:56 -0000 --Apple-Mail=_31CFC063-60E6-42C9-9F73-A1F11A0336AD Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 It would depend on how you phrase the question.. If you say this is = going to prevent anyone from seeing your DNS traffic, you will probably = get one response. If you say, all of your data is going to central = source where it can be correlated and harvested, you might get a = different answer. If you say that the parental controls you have signed = up for and paid money for are no longer going to work, you might get a = different answer. If you say that the malicious activity and prevention = tools you use are no longer going to work, you might get a different = answer. =20 We need to quit thinking that solving a use case for someone at a coffee = shop is somehow good for everyone. Because this is just wrong.=20 It just baffles me silly that we are worried about people seeing DNS = traffic and we are not worried about certain cloud providers harvesting, = mining, and tracking all users behavior on the internet and all of their = interactions (email and such) that they do with the cloud providers. It = seems like if we _REALLY_ wanted to improve privacy and security we = would do something about that. Maybe create an encrypted email system = that was done in the browser and protected all email from being reviewed = and monitored. Further, it would be nice if browsers did a better job = of preventing and denying all tracking tools.=20 Thanks, Bret PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 "Without cryptography vihv vivc ce xhrnrw, however, the only thing that = can not be unscrambled is an egg." > On Aug 15, 2019, at 1:14 PM, Mikael Abrahamsson = wrote: >=20 > On Thu, 15 Aug 2019, Ted Lemon wrote: >=20 >> Blocking is a form of tampering. One purpose of DoH is to make = blocking impractical, so that the end user isn=E2=80=99t forced to = choose a path that=E2=80=99s subject to tampering and intercept. >=20 > As with any technology this is dual use. If the customer has purchased = a solution that's built around certain mechanisms, bypassing these = mechanisms might be against the users' wishes. >=20 > There is no correct answer here, and anyone pretending to know the = correct answer for all situations is wrong. >=20 > So let's fall back on the "principle of least astonishment". If you = tell the users "your browser is now doing DNS lookups using a cloud = provider and your ISP is no longer in that loop", what do you think = their response will be? (might need explanation to the user, but still) >=20 > --=20 > Mikael Abrahamsson email: swmike@swm.pp.se--=20 > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add --Apple-Mail=_31CFC063-60E6-42C9-9F73-A1F11A0336AD Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 It = would depend on how you phrase the question..  If you say this is = going to prevent anyone from seeing your DNS traffic, you will probably = get one response.  If you say, all of your data is going to central = source where it can be correlated and harvested, you might get a = different answer.  If you say that the parental controls you have = signed up for and paid money for are no longer going to work, you might = get a different answer. If you say that the malicious activity and = prevention tools you use are no longer going to work, you might get a = different answer.  

We need to quit thinking that solving a use case for someone = at a coffee shop is somehow good for everyone.  Because this is = just wrong. 

It just baffles me silly that we are worried about people = seeing DNS traffic and we are not worried about certain cloud providers = harvesting, mining, and tracking all users behavior on the internet and = all of their interactions (email and such) that they do with the cloud = providers. It seems like if we _REALLY_ wanted to improve privacy and = security we would do something about that.  Maybe create an = encrypted email system that was done in the browser and protected all = email from being reviewed and monitored.  Further, it would be nice = if browsers did a better job of preventing and denying all tracking = tools. 

Thanks,
Bret
PGP = Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 = 0050
"Without = cryptography vihv vivc ce xhrnrw, however, the only thing that can not = be unscrambled is an = egg."

On Aug 15, 2019, at 1:14 PM, Mikael Abrahamsson <swmike@swm.pp.se> = wrote:

On Thu, 15 Aug 2019, Ted Lemon wrote:

Blocking is a form of = tampering.  One purpose of DoH is to make blocking impractical, so = that the end user isn=E2=80=99t forced to choose a path that=E2=80=99s = subject to tampering and intercept.

As with any technology this is dual use. If the customer has = purchased a solution that's built around certain mechanisms, bypassing = these mechanisms might be against the users' wishes.

There is no correct answer here, and anyone pretending to = know the correct answer for all situations is wrong.

So let's fall back on the "principle of least astonishment". = If you tell the users "your browser is now doing DNS lookups using a = cloud provider and your ISP is no longer in that loop", what do you = think their response will be? (might need explanation to the user, but = still)

--
Mikael Abrahamsson =    email: = swmike@swm.pp.se--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add

= --Apple-Mail=_31CFC063-60E6-42C9-9F73-A1F11A0336AD-- From nobody Thu Aug 15 15:44:23 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 324271200E7 for ; Thu, 15 Aug 2019 15:44:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Ab6updsD_5OA for ; Thu, 15 Aug 2019 15:44:19 -0700 (PDT) Received: from mail-lf1-x130.google.com (mail-lf1-x130.google.com [IPv6:2a00:1450:4864:20::130]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 53E761200C7 for ; Thu, 15 Aug 2019 15:44:19 -0700 (PDT) Received: by mail-lf1-x130.google.com with SMTP id v16so780747lfg.11 for ; Thu, 15 Aug 2019 15:44:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=0U7u8pOjjKe4OypnZ0zESNA325YlSf1znEXwlx0r7QY=; b=UZv26o54aeJ8P/U3Ou1P0+7o9uNBHDbg5iE8xpl96urGH9zgjJ/DjJEblL5yzbm2Oo Vn9bALxK/23K0CbiteYaGnUuhIQOi1pD5+fkJqBs2DtopdD0Qh0L0+2PZf7YQS3EXnQt a2fStSiGH3EuEY/aRNi9+Akni4GVAmc3DC+Jr6sXqxBjahGctohRdBJE0ZK/NV++M085 dUL7wh2j6nOoqonvjeyYGTnswGfLbw1dyvxVZwyTPnsFDWLf8iOfuKajFcobmLK/yyPO zmZGhNQxD5ff0qc2yCYcKkdsdhYwOqlov4hBcW9/jzwuGc5IeTPqK/yY9HhGGyUFSYqM xzVA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=0U7u8pOjjKe4OypnZ0zESNA325YlSf1znEXwlx0r7QY=; b=c0nwykNTsmDS/Z2jZSIu0uwRsAEG7v4kTxmgzyuvGtiOJZXfMyu9UjdWvZl9l81bmp F/CLSyrIE9XjEPkYrSNLKngZiRc/uTN4sF1AiYAg2bCgWtu4GdvvfIOgXVV6LY5TDrVo a4e7oyLA+h1CktOPM5M6VJvhjz+WxZPREAUAUE5z6xbtaQIEYKlnLYSSCsZ8pUsupzIN PaMB+CDfoz+DGc+zVfQOC54VQnCz2EDFnPUZeSH6KB5ufMC7TPwM+TmR1k63NTlDcsR7 vjTtf3j1sCRjRkJ/TgWprNXxnJerv7tDFVrrVNmQKleNRo7sm2LpVswTv8bbKMlfo2OH 3xCQ== X-Gm-Message-State: APjAAAX7VwjCc9ZGsykxRYc6cG1ZFH1RWN7en4c0OZU14tX0kN8Kg9fR BM2PqypNw25gsX6HahCErnWiSgw+G6EtYIKF9k+ItA== X-Google-Smtp-Source: APXvYqzIujHvZFbb1MFTjfLlFVdnKgBhhVIuaw/tDlMMplGtS/RtagtLaNOUyT9M1Dd+6TSGh+MXMJ+c6tEY3itUm5A= X-Received: by 2002:ac2:51a3:: with SMTP id f3mr3419729lfk.94.1565909057542; Thu, 15 Aug 2019 15:44:17 -0700 (PDT) MIME-Version: 1.0 References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <8e00891f-2aa2-ee11-559a-b5a8967b22d9@nostrum.com> <2C23D415-84F9-4B6C-B67B-0CC3EB600520@gmail.com> <2704899B-E43D-4978-A3C9-30E9E7CEBEBD@fugue.com> <4CC4C262-BEF4-4B39-ACB1-A595AB66D6CD@gmail.com> In-Reply-To: <4CC4C262-BEF4-4B39-ACB1-A595AB66D6CD@gmail.com> From: Eric Rescorla Date: Fri, 16 Aug 2019 00:43:39 +0200 Message-ID: To: Bret Jordan Cc: Mikael Abrahamsson , ADD Mailing list , Ted Lemon Content-Type: multipart/alternative; boundary="000000000000202ca105902f9dbf" Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 22:44:22 -0000 --000000000000202ca105902f9dbf Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable n Thu, Aug 15, 2019 at 11:59 PM Bret Jordan wrote: > > It just baffles me silly that we are worried about people seeing DNS > traffic and we are not worried about certain cloud providers harvesting, > mining, and tracking all users behavior on the internet and all of their > interactions (email and such) that they do with the cloud providers. It > seems like if we _REALLY_ wanted to improve privacy and security we would > do something about that. > Who says we're not worried about it? Do you have a concrete plan for addressing it? Maybe create an encrypted email system that was done in the browser and > protected all email from being reviewed and monitored. > Here too, it seems like the question isn't one of desirability but practicality. There have been quite a few attempts at E2E encrypted email, none very successful. Just wishing does not make it so. Further, it would be nice if browsers did a better job of preventing and > denying all tracking tools. > You mean like: https://webkit.org/blog/8828/intelligent-tracking-prevention-2-2/ or https://blog.mozilla.org/blog/2019/06/04/firefox-now-available-with-enhance= d-tracking-protection-by-default/ ? -Ekr > > Thanks, > Bret > PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 > "Without cryptography vihv vivc ce xhrnrw, however, the only thing that > can not be unscrambled is an egg." > > On Aug 15, 2019, at 1:14 PM, Mikael Abrahamsson wrote: > > On Thu, 15 Aug 2019, Ted Lemon wrote: > > Blocking is a form of tampering. One purpose of DoH is to make blocking > impractical, so that the end user isn=E2=80=99t forced to choose a path t= hat=E2=80=99s > subject to tampering and intercept. > > > As with any technology this is dual use. If the customer has purchased a > solution that's built around certain mechanisms, bypassing these mechanis= ms > might be against the users' wishes. > > There is no correct answer here, and anyone pretending to know the correc= t > answer for all situations is wrong. > > So let's fall back on the "principle of least astonishment". If you tell > the users "your browser is now doing DNS lookups using a cloud provider a= nd > your ISP is no longer in that loop", what do you think their response wil= l > be? (might need explanation to the user, but still) > > -- > Mikael Abrahamsson email: swmike@swm.pp.se -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --000000000000202ca105902f9dbf Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
n Thu, Aug 15, 2019 at 11:59 PM Bret Jordan <jordan.ietf@gmail.com> wrote:

It just baffles me silly t= hat we are worried about people seeing DNS traffic and we are not worried a= bout certain cloud providers harvesting, mining, and tracking all users beh= avior on the internet and all of their interactions (email and such) that t= hey do with the cloud providers. It seems like if we _REALLY_ wanted to imp= rove privacy and security we would do something about that.

Who says we're not worried about it? Do y= ou have a concrete plan for addressing it?

=C2=A0Maybe create an encrypted email system t= hat was done in the browser and protected all email from being reviewed and= monitored.

Here too, it seems = like the question isn't one of desirability but practicality. There hav= e been quite a few attempts at E2E encrypted email, none very successful. J= ust wishing does not make it so.


=C2=A0Further, it would be nice if browsers did a bett= er job of preventing and denying all tracking tools.=C2=A0


<= div>-Ekr



Thanks,
Bret
<= span style=3D"font-size:11px">PGP Fingerprint:=C2=A063B= 4 FC53 680A 6B7D 1447 =C2=A0F2C0 74F8 ACAE 7415 0050
"Without cryptography vihv vivc ce xhrnrw, howe= ver, the only thing that can not be unscrambled is an egg."

On Aug 15, 2019, at 1:14 PM, Mikael= Abrahamsson <swmi= ke@swm.pp.se> wrote:

On Thu, 15 Aug 2019, Ted Lemon wrote:
Blocking is a form of tampering.=C2=A0 One p= urpose of DoH is to make blocking impractical, so that the end user isn=E2= =80=99t forced to choose a path that=E2=80=99s subject to tampering and int= ercept.

As with any technology this is dual use. If the= customer has purchased a solution that's built around certain mechanis= ms, bypassing these mechanisms might be against the users' wishes.
<= br>There is no correct answer here, and anyone pretending to know the corre= ct answer for all situations is wrong.

So let's fall back on the= "principle of least astonishment". If you tell the users "y= our browser is now doing DNS lookups using a cloud provider and your ISP is= no longer in that loop", what do you think their response will be? (m= ight need explanation to the user, but still)

--
Mikael Abrahams= son =C2=A0=C2=A0=C2=A0email: swmike@swm.pp.se--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman= /listinfo/add

--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--000000000000202ca105902f9dbf-- From nobody Thu Aug 15 16:17:48 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7F0441200EF for ; Thu, 15 Aug 2019 16:17:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dm2wrl0ThcLD for ; Thu, 15 Aug 2019 16:17:45 -0700 (PDT) Received: from gro.dd.org (host2.dlawren-3-gw.cust.sover.net [207.136.201.30]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 70A081200C7 for ; Thu, 15 Aug 2019 16:17:44 -0700 (PDT) Received: by gro.dd.org (Postfix, from userid 102) id 5ED3D101644; Thu, 15 Aug 2019 19:17:43 -0400 (EDT) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <23893.59415.370880.54691@gro.dd.org> Date: Thu, 15 Aug 2019 19:17:43 -0400 From: Dave Lawrence To: ADD Mailing list In-Reply-To: References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <8e00891f-2aa2-ee11-559a-b5a8967b22d9@nostrum.com> <2C23D415-84F9-4B6C-B67B-0CC3EB600520@gmail.com> Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 23:17:47 -0000 Tommy Jensen writes: > I agree that DNSSEC provides evidence of tampering, but I think that > is less valuable than what encryption brings (lack of visibility as > well as tamper protection). I've seen this come up a couple of times now in ways that seem to imply an equivalence here regarding tamper protection, with at least one time (not on this list) where there was a clear belief that having DoH obviated DNSSEC. To be clear for the discussion, while it is true that DoH protects tampering between the endpoints of a particular DNS transaction (currently expected to usually be a resolver and a client) it does absolutely nothing to address the authenticity of a response. That could still well have been tampered with at many other points in the resolution chain. DNSSEC is currently the only mechanism we have for automatically detecting that. From nobody Thu Aug 15 16:21:22 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DC5611200F1 for ; Thu, 15 Aug 2019 16:21:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EqF6YH40qpP7 for ; Thu, 15 Aug 2019 16:21:17 -0700 (PDT) Received: from NAM04-BN3-obe.outbound.protection.outlook.com (mail-eopbgr680097.outbound.protection.outlook.com [40.107.68.97]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 06BC51200EF for ; Thu, 15 Aug 2019 16:21:16 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=NeiSS1J63PCjJ4cm0/OcZoAPqI6X4EsqZ4fMgThQsGzjLqUzyZLAgXiEQeihq13o2IIu3GcrcUiubbuXA8R1Gv1opRi5ei/kn4WywrS0IsmlQCdqCgmDLw8+bSop2TF3ec0qMfziKOu9hkNNL9mPjtWlDPk//kNQ5s5EiTj45hvWrjncQVWam7zr6pajU/Nz3DWNu3Ff12gx6lsFNevhu2xNo2yA9gT/sqykOfm9xiuczwuDi9zY1t3BPDvkW/OV1ZveRE5C1ZLAT6WVALOILt+mIPuBcT0PwUmOqcIGsktYfVoSbdIVMvPByTEoUoriFLNEow4cwO+zaj2x06R9Uw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=whtjbYWdN7lJabfwb/wDPXcNMuBuoAAwQE8BtHYl9fA=; b=hObFhUxXR9NWP257UX/thy+zVdo5XrlepZX7A985V5qqH0fnFqqIAaRKzjtysQ5jxLbXvKOMhn1OAGKJCOGwYNe8rSOQywEkiK+pseeKOhUgZysnTNHt8WcWWOlipyc2m5108jF8iUuN4AXVtlioM0Q9Jivi1tSz4X5F35QVpmSoSNDjFpVEs2zsvNBjD3QHYL3am67dJf4k0ihQegKET2HjT2CQkMCUN4+NwXPNUqaPg5eowpG1rBNeEcrgt6KUuyxnGsIIC+llf0VFl79silbItTYtB+4VeTYYaqMH43IKDhgwrHXTJByV16oJK3ItIoa7jB3+JwnW6O8pqy3fBQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=microsoft.com; dmarc=pass action=none header.from=microsoft.com; dkim=pass header.d=microsoft.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=whtjbYWdN7lJabfwb/wDPXcNMuBuoAAwQE8BtHYl9fA=; b=lAqRZofsfwkaA9r8BryH7a+AUpqMqYdDt8mplwosB2Zqsge/V4PesUgs+xOLWOnTPobE91tJ+iBLo8eTFZm3J3yr1Gbw6B/bGngEdTLRckDjvbS5+g7iAnAyhPwTZdTkxfsXMqVfWs2ccqO9Zj6xCXbJ3+byD3dIJegl3dp2Yyg= Received: from MWHPR21MB0192.namprd21.prod.outlook.com (10.173.52.138) by MWHPR21MB0846.namprd21.prod.outlook.com (10.173.51.140) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2199.6; Thu, 15 Aug 2019 23:21:15 +0000 Received: from MWHPR21MB0192.namprd21.prod.outlook.com ([fe80::3040:4d29:2935:9a7f]) by MWHPR21MB0192.namprd21.prod.outlook.com ([fe80::3040:4d29:2935:9a7f%3]) with mapi id 15.20.2178.010; Thu, 15 Aug 2019 23:21:15 +0000 From: Tommy Jensen To: Eric Rescorla , Bret Jordan CC: ADD Mailing list , Ted Lemon , Mikael Abrahamsson Thread-Topic: [Add] [Ext] Validity of network administrator role Thread-Index: AQHVUyp4iPKBDVjDIkCVQCaF07YMYKb8bWGAgAAYXgCAAALNx4AAB4wAgAABwwCAAAMtAIAALdqAgAAMjICAAAWfMQ== Date: Thu, 15 Aug 2019 23:21:14 +0000 Message-ID: References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <8e00891f-2aa2-ee11-559a-b5a8967b22d9@nostrum.com> <2C23D415-84F9-4B6C-B67B-0CC3EB600520@gmail.com> <2704899B-E43D-4978-A3C9-30E9E7CEBEBD@fugue.com> <4CC4C262-BEF4-4B39-ACB1-A595AB66D6CD@gmail.com>, In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Jensen.Thomas@microsoft.com; x-originating-ip: [2001:4898:80e8:f:49d4:26fe:1372:35bd] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: b064f044-d944-433c-1385-08d721d744af x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600158)(711020)(4605104)(1401327)(4618075)(2017052603328)(7193020); SRVR:MWHPR21MB0846; x-ms-traffictypediagnostic: MWHPR21MB0846: x-ms-exchange-purlcount: 3 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-forefront-prvs: 01304918F3 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(4636009)(396003)(376002)(39860400002)(346002)(366004)(136003)(199004)(189003)(25786009)(53936002)(8990500004)(10090500001)(33656002)(53546011)(19627405001)(6246003)(236005)(6116002)(229853002)(6506007)(6436002)(186003)(6306002)(55016002)(76176011)(54896002)(105004)(476003)(4326008)(486006)(102836004)(46003)(11346002)(10290500003)(14454004)(9686003)(966005)(446003)(478600001)(7696005)(606006)(22452003)(316002)(74316002)(99286004)(5070765005)(110136005)(86362001)(81156014)(52536014)(81166006)(76116006)(66946007)(2906002)(66446008)(64756008)(66476007)(8936002)(66556008)(54906003)(256004)(14444005)(66574012)(7736002)(8676002)(71200400001)(71190400001)(5660300002); DIR:OUT; SFP:1102; SCL:1; SRVR:MWHPR21MB0846; H:MWHPR21MB0192.namprd21.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: b/QDKM53DPH3wd/Dxr6ZAGFLLi/f2zr0IpPn0unno6aPbXaUxNYszK/ebEFjBpY2a0nENkQ5AbTMWmPuzLUb+fXNpTZQcWrTZ9Fpq2sY3OQyNwvCOBqnya+z5E0SrgjQGpAzA0h1Fzeb1mpA1n18gUo289OgxW8mCJ0aHGm/YL+ZpF+W2IpAXWGH1qjqFLvOL5Xxl1MsNIpgGVzaEbHwKZfPYRTU3Kcb8RbkaIFWVg5Oku2dIN936kY3Pt61lWKGuXEn56qRftvWT8yT8u5+yrh0AN8NllBcglAuxKLsPDvyVv/EfvHvMQwqyOW1wzMm6R1irOO2DKLoA9OsHa0davqk6mhJFiNRGFV1f1Xp8HPKTkwoy7w/bD3Kmp7p2Hj+Fp728WFZbIEJDqKaNPQ8Jn0ApFnW2X9XW9xh2EPn7VI= x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_MWHPR21MB0192B8DE8E8562F70D641856FAAC0MWHPR21MB0192namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: b064f044-d944-433c-1385-08d721d744af X-MS-Exchange-CrossTenant-originalarrivaltime: 15 Aug 2019 23:21:14.8682 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: ymbn6/FyyK18xvC/5XcqrK/B7ntW24DHtJifQw0lSXY7E6ALzd7kOBMGKgW0Gw2rv42bg/C0zO6NWfF7E6/Raw== X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR21MB0846 Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 23:21:21 -0000 --_000_MWHPR21MB0192B8DE8E8562F70D641856FAAC0MWHPR21MB0192namp_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable ekr> Who says we're not worried about it? Do you have a concrete plan for a= ddressing it? I'd suggest having a list of TRRs with the default value being selected ran= domly per client rather than just one TRR distributed to a large geographic= population such as North America. For example, in my Firefox install (Fire= fox Quantum, 68.0.2) under "Enable DNS over HTTPS" I only see "CloudFlare (= Default)" and "Custom" as options. If there were many TRRs listed, and which one labeled as default randomly c= hosen at first launch, then at least there would be some distribution of DN= S traffic for users who will never check that setting (i.e. most users), an= d the same configuration freedom for those those users who will check it. A= nother option might be testing several TRRs from the list at first launch a= nd picking the fastest to respond to attempt some sorting by geographic eff= iciency. Perhaps operators of public DNS servers on this mailing list would be inter= ested in knowing what bar they would have to clear to get on such a list. W= ould it be identical to the existing published terms between Mozilla and Cl= oudFlare? Something else? Would you be willing to collaborate on such terms= with other browsers for a common standard for TRRs? Even in my ideal world where the browser cooperates with the platform on de= ciding when to use which DNS stub, there will be times when the browser wil= l know more about the user's DNS intentions than the platform, and in those= cases there should definitely be a larger variety of TRRs available to any= given large-scale population. Thanks, Tommy ________________________________ From: Add on behalf of Eric Rescorla Sent: Thursday, August 15, 2019 3:43 PM To: Bret Jordan Cc: ADD Mailing list ; Ted Lemon ; Mikael A= brahamsson Subject: Re: [Add] [Ext] Validity of network administrator role n Thu, Aug 15, 2019 at 11:59 PM Bret Jordan > wrote: It just baffles me silly that we are worried about people seeing DNS traffi= c and we are not worried about certain cloud providers harvesting, mining, = and tracking all users behavior on the internet and all of their interactio= ns (email and such) that they do with the cloud providers. It seems like if= we _REALLY_ wanted to improve privacy and security we would do something a= bout that. Who says we're not worried about it? Do you have a concrete plan for addres= sing it? Maybe create an encrypted email system that was done in the browser and pr= otected all email from being reviewed and monitored. Here too, it seems like the question isn't one of desirability but practica= lity. There have been quite a few attempts at E2E encrypted email, none ver= y successful. Just wishing does not make it so. Further, it would be nice if browsers did a better job of preventing and d= enying all tracking tools. You mean like: https://webkit.org/blog/8828/intelligent-tracking-prevention= -2-2/ or https://blo= g.mozilla.org/blog/2019/06/04/firefox-now-available-with-enhanced-tracking-= protection-by-default/? -Ekr Thanks, Bret PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 "Without cryptography vihv vivc ce xhrnrw, however, the only thing that can= not be unscrambled is an egg." On Aug 15, 2019, at 1:14 PM, Mikael Abrahamsson > wrote: On Thu, 15 Aug 2019, Ted Lemon wrote: Blocking is a form of tampering. One purpose of DoH is to make blocking im= practical, so that the end user isn=92t forced to choose a path that=92s su= bject to tampering and intercept. As with any technology this is dual use. If the customer has purchased a so= lution that's built around certain mechanisms, bypassing these mechanisms m= ight be against the users' wishes. There is no correct answer here, and anyone pretending to know the correct = answer for all situations is wrong. So let's fall back on the "principle of least astonishment". If you tell th= e users "your browser is now doing DNS lookups using a cloud provider and y= our ISP is no longer in that loop", what do you think their response will b= e? (might need explanation to the user, but still) -- Mikael Abrahamsson email: swmike@swm.pp.se-- Add mailing list Add@ietf.org https://www.ietf.org/mailman/listinfo/add -- Add mailing list Add@ietf.org https://www.ietf.org/mailman/listinfo/add --_000_MWHPR21MB0192B8DE8E8562F70D641856FAAC0MWHPR21MB0192namp_ Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable
ekr> Who says we're not worried about it? Do you have a concrete plan for addressin= g it?

Perhaps operators of public DNS servers on this mailing list would be inter= ested in knowing what bar they would have to clear to get on such a list. W= ould it be identical to the existing published terms between Mozilla and Cl= oudFlare? Something else? Would you be willing to collaborate on such terms with other browsers for a comm= on standard for TRRs? 

Even in my ideal world where the browser cooperates with the platform on de= ciding when to use which DNS stub, there will be times when the browser wil= l know more about the user's DNS intentions than the platform, and in those= cases there should definitely be a larger variety of TRRs available to any given large-scale population.
From: Add <add-bounces@i= etf.org> on behalf of Eric Rescorla <ekr@rtfm.com>
Sent: Thursday, August 15, 2019 3:43 PM
To: Bret Jordan <jordan.ietf@gmail.com>
Cc: ADD Mailing list <add@ietf.org>; Ted Lemon <mellon@fugu= e.com>; Mikael Abrahamsson <swmike@swm.pp.se>
Subject: Re: [Add] [Ext] Validity of network administrator role
 
n Thu, Aug 15, 2019 at 11:59 PM Bret Jordan <jordan.ietf@gmail.com> wrote:

It just baffles me silly that we are worried about people seeing DNS t= raffic and we are not worried about certain cloud providers harvesting, min= ing, and tracking all users behavior on the internet and all of their inter= actions (email and such) that they do with the cloud providers. It seems like if we _REALLY_ wanted to improv= e privacy and security we would do something about that.

Who says we're not worried about it? Do you have a concrete plan for a= ddressing it?


 Maybe create an encrypted email system that was done in the brow= ser and protected all email from being reviewed and monitored.

Here too, it seems like the question isn't one of desirability but pra= cticality. There have been quite a few attempts at E2E encrypted email, non= e very successful. Just wishing does not make it so.


 Further, it would be nice if browsers did a better job of preven= ting and denying all tracking tools. 

You mean like: https://webkit.org/blog/8828/intelligent-tracking-prevention-2-2/ or https://blog.mozilla.org/blog/2019/06/04/firefox-now-available-with-enhance= d-tracking-protection-by-default/?

-Ekr



Thanks,
Bret
PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050
"Without cryptography vihv vivc ce xhrnrw, however, the only t= hing that can not be unscrambled is an egg."

On Aug 15, 2019, at 1:14 PM, Mikael Abrahamsson <swmike@swm.pp.se> wrote:

On Thu, 15 Aug 2019, Ted Lemon wrote:

Blocking is a form of tampering.  One purpos= e of DoH is to make blocking impractical, so that the end user isn=92t forc= ed to choose a path that=92s subject to tampering and intercept.

As with any technology this is dual use. If the customer has purchased a so= lution that's built around certain mechanisms, bypassing these mechanisms m= ight be against the users' wishes.

There is no correct answer here, and anyone pretending to know the correct = answer for all situations is wrong.

So let's fall back on the "principle of least astonishment". If y= ou tell the users "your browser is now doing DNS lookups using a cloud= provider and your ISP is no longer in that loop", what do you think t= heir response will be? (might need explanation to the user, but still)

--
Mikael Abrahamsson    email: swmike@swm.pp.se--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add

--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/a= dd
--_000_MWHPR21MB0192B8DE8E8562F70D641856FAAC0MWHPR21MB0192namp_-- From nobody Thu Aug 15 16:23:35 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A80DC1200EF for ; Thu, 15 Aug 2019 16:23:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.68 X-Spam-Level: X-Spam-Status: No, score=-1.68 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_INVALID=0.1, DKIM_SIGNED=0.1, T_SPF_HELO_PERMERROR=0.01, T_SPF_PERMERROR=0.01] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=fail (1024-bit key) reason="fail (message has been altered)" header.d=nostrum.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5QxBj4s_uPJ8 for ; Thu, 15 Aug 2019 16:23:30 -0700 (PDT) Received: from nostrum.com (raven-v6.nostrum.com [IPv6:2001:470:d:1130::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D15A41200F1 for ; Thu, 15 Aug 2019 16:23:30 -0700 (PDT) Received: from MacBook-Pro.roach.at (99-152-146-228.lightspeed.dllstx.sbcglobal.net [99.152.146.228]) (authenticated bits=0) by nostrum.com (8.15.2/8.15.2) with ESMTPSA id x7FNNOrI075339 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NO); Thu, 15 Aug 2019 18:23:25 -0500 (CDT) (envelope-from adam@nostrum.com) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=nostrum.com; s=default; t=1565911406; bh=F++cl33xqcZOIbVgSEJIYNbGA0wjzO/SNK5wemY290Y=; h=Subject:To:Cc:References:From:Date:In-Reply-To; b=Ry6oXyRq166T5iZWyYnyAz2el1/7tXyQfoymVQNR2/gOntk4rTrLFRa5iGnD77NxN umjC3YLIpN4JiJb7L4xPftA0aMf17eag6CtiHXviL65a4Pq58NUUQK6EOX8aQG9Wgp tWIfAa+B8M9iAXV+/GTk/ckUPulAtN7Yzx7ORTTg= X-Authentication-Warning: raven.nostrum.com: Host 99-152-146-228.lightspeed.dllstx.sbcglobal.net [99.152.146.228] claimed to be MacBook-Pro.roach.at To: Tommy Jensen , Eric Rescorla , Bret Jordan Cc: ADD Mailing list , Ted Lemon , Mikael Abrahamsson References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <8e00891f-2aa2-ee11-559a-b5a8967b22d9@nostrum.com> <2C23D415-84F9-4B6C-B67B-0CC3EB600520@gmail.com> <2704899B-E43D-4978-A3C9-30E9E7CEBEBD@fugue.com> <4CC4C262-BEF4-4B39-ACB1-A595AB66D6CD@gmail.com> From: Adam Roach Message-ID: <60702830-cec2-d049-554b-1c0a770b78a4@nostrum.com> Date: Thu, 15 Aug 2019 18:23:19 -0500 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Content-Language: en-US Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 23:23:32 -0000 On 8/15/19 6:21 PM, Tommy Jensen wrote: > Perhaps operators of public DNS servers on this mailing list would be > interested in knowing what bar they would have to clear to get on such > a list. This has been asked and answered quite a few times already. https://wiki.mozilla.org/Security/DOH-resolver-policy /a From nobody Thu Aug 15 16:24:32 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DFB6C1200FB for ; Thu, 15 Aug 2019 16:24:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cdt.org Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 26xff60neT_n for ; Thu, 15 Aug 2019 16:24:29 -0700 (PDT) Received: from mail-io1-xd43.google.com (mail-io1-xd43.google.com [IPv6:2607:f8b0:4864:20::d43]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CBDBB1200EF for ; Thu, 15 Aug 2019 16:24:28 -0700 (PDT) Received: by mail-io1-xd43.google.com with SMTP id e20so2648043iob.9 for ; Thu, 15 Aug 2019 16:24:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cdt.org; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=ky0FBkgyDotOzT90Ifpvj+xWAFju871vINs2VNmSsTw=; b=bgazciVwFck0Oo66rIo1/lg73o19PmYvsBI+ozujQsRIeuPE8g5OlSu9hIWKlQNJQ9 mYDhAIDmx9ZoDWCT82AHzEQ14Ei04OgNFADhWXQjECJPtXouceeQ2Ddrb99U1X3QHGwh Tl5bmvmw+DyPyq5HeX6F+zgQrNQBSoo+KevFs= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=ky0FBkgyDotOzT90Ifpvj+xWAFju871vINs2VNmSsTw=; b=rAxCZy6EzcUgZwyyPMyeDTk/5Exx9EE5hUodNn8XAz8c+hdVi/RXF3H6mRqxgsGweE 7HUzlCJXS+zCxj9OkVsr9kWHqNlWRsGx7fHGgkyNGu7HdTxN24+KFZBQpEWORSJF20AZ 4lwczqC2Ve5QO8M/LvxICIa4x49SmE3WG6kiUN2hyB8xuxqJo6xiQcr3dIUL3RhL6PfB VwwBwmEef+Fj+7jG+M9ItWcHG9a8tK5QkVwwNkncOUqakjZpRO7dT+gT74PctsZELvpi GUg/xP5M88pDVrBcEPwJD1U4w9NfGC/7FCoWTmwWKvf2/N3pz1/NdPXrIwWTE8GU6Ks6 19XA== X-Gm-Message-State: APjAAAXS4Ew+/jDTejp2xpnwAJR9qF91x496Vr4qEififfnbxkJRVpCd kSm40BcHn78Y3wzCoV7weu1kQwWQoIlK3yGOsGqQbQ== X-Google-Smtp-Source: APXvYqyPQkK27Nsroo6+9/3+W8IWVvcZx+8nlwnEKbXD8nMwdNKktnW59yyM9fLTfpAG3i6EBRITUz+2du0J/n0bOsQ= X-Received: by 2002:a02:a386:: with SMTP id y6mr8033749jak.90.1565911467213; Thu, 15 Aug 2019 16:24:27 -0700 (PDT) MIME-Version: 1.0 References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <8e00891f-2aa2-ee11-559a-b5a8967b22d9@nostrum.com> <2C23D415-84F9-4B6C-B67B-0CC3EB600520@gmail.com> <2704899B-E43D-4978-A3C9-30E9E7CEBEBD@fugue.com> <4CC4C262-BEF4-4B39-ACB1-A595AB66D6CD@gmail.com> In-Reply-To: From: Joseph Lorenzo Hall Date: Thu, 15 Aug 2019 19:24:16 -0400 Message-ID: To: Tommy Jensen Cc: ADD Mailing list , Bret Jordan , Eric Rescorla , Mikael Abrahamsson , Ted Lemon Content-Type: multipart/alternative; boundary="000000000000c0e0e90590302cd4" Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 23:24:32 -0000 --000000000000c0e0e90590302cd4 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Thu, Aug 15, 2019 at 19:21 Tommy Jensen wrote: > ekr> Who says we're not worried about it? Do you have a concrete plan for > addressing it? > > I'd suggest having a list of TRRs with the default value being selected > randomly per client rather than just one TRR distributed to a large > geographic population such as North America. For example, in my Firefox > install (Firefox Quantum, 68.0.2) under "Enable DNS over HTTPS" I only se= e > "CloudFlare (Default)" and "Custom" as options. > > If there were many TRRs listed, and which one labeled as default randomly > chosen at first launch, then at least there would be some distribution of > DNS traffic for users who will never check that setting (i.e. most users)= , > and the same configuration freedom for those those users who will check i= t. > Another option might be testing several TRRs from the list at first launc= h > and picking the fastest to respond to attempt some sorting by geographic > efficiency. > > Perhaps operators of public DNS servers on this mailing list would be > interested in knowing what bar they would have to clear to get on such a > list. Would it be identical to the existing published terms between Mozil= la > and CloudFlare? Something else? Would you be willing to collaborate on su= ch > terms with other browsers for a common standard for TRRs? > https://blog.mozilla.org/security/2019/04/09/dns-over-https-policy-requirem= ents-for-resolvers/ > Even in my ideal world where the browser cooperates with the platform on > deciding when to use which DNS stub, there will be times when the browser > will know more about the user's DNS intentions than the platform, and in > those cases there should definitely be a larger variety of TRRs available > to any given large-scale population. > > Thanks, > Tommy > ------------------------------ > *From:* Add on behalf of Eric Rescorla < > ekr@rtfm.com> > *Sent:* Thursday, August 15, 2019 3:43 PM > *To:* Bret Jordan > *Cc:* ADD Mailing list ; Ted Lemon ; > Mikael Abrahamsson > *Subject:* Re: [Add] [Ext] Validity of network administrator role > > n Thu, Aug 15, 2019 at 11:59 PM Bret Jordan wrote= : > > > It just baffles me silly that we are worried about people seeing DNS > traffic and we are not worried about certain cloud providers harvesting, > mining, and tracking all users behavior on the internet and all of their > interactions (email and such) that they do with the cloud providers. It > seems like if we _REALLY_ wanted to improve privacy and security we would > do something about that. > > > Who says we're not worried about it? Do you have a concrete plan for > addressing it? > > > Maybe create an encrypted email system that was done in the browser and > protected all email from being reviewed and monitored. > > > Here too, it seems like the question isn't one of desirability but > practicality. There have been quite a few attempts at E2E encrypted email= , > none very successful. Just wishing does not make it so. > > > Further, it would be nice if browsers did a better job of preventing and > denying all tracking tools. > > > You mean like: > https://webkit.org/blog/8828/intelligent-tracking-prevention-2-2/ > > or > https://blog.mozilla.org/blog/2019/06/04/firefox-now-available-with-enhan= ced-tracking-protection-by-default/ > > ? > > -Ekr > > > > Thanks, > Bret > PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 > "Without cryptography vihv vivc ce xhrnrw, however, the only thing that > can not be unscrambled is an egg." > > On Aug 15, 2019, at 1:14 PM, Mikael Abrahamsson wrote: > > On Thu, 15 Aug 2019, Ted Lemon wrote: > > Blocking is a form of tampering. One purpose of DoH is to make blocking > impractical, so that the end user isn=E2=80=99t forced to choose a path t= hat=E2=80=99s > subject to tampering and intercept. > > > As with any technology this is dual use. If the customer has purchased a > solution that's built around certain mechanisms, bypassing these mechanis= ms > might be against the users' wishes. > > There is no correct answer here, and anyone pretending to know the correc= t > answer for all situations is wrong. > > So let's fall back on the "principle of least astonishment". If you tell > the users "your browser is now doing DNS lookups using a cloud provider a= nd > your ISP is no longer in that loop", what do you think their response wil= l > be? (might need explanation to the user, but still) > > -- > Mikael Abrahamsson email: swmike@swm.pp.se -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > > > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --=20 Joseph Lorenzo Hall Chief Technologist, Center for Democracy & Technology [https://www.cdt.org] 1401 K ST NW STE 200, Washington DC 20005-3497 e: joe@cdt.org, p: 202.407.8825, pgp: https://josephhall.org/gpg-key Fingerprint: 3CA2 8D7B 9F6D DBD3 4B10 1607 5F86 6987 40A9 A871 --000000000000c0e0e90590302cd4 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


On Thu, Aug 15, 2019 at 19:21 Tommy Jensen <Jensen.Thoma= s=3D40microsoft.com@dmarc= .ietf.org> wrote:
ekr>=C2=A0Who says we're not worried about it? Do you have a concrete plan for addre= ssing it?

I'd suggest having a list of TRRs with the default value being selected random= ly per client rather than just one TRR distributed to a large geographic po= pulation such as North America. For example, in my Firefox install (Firefox= Quantum, 68.0.2) under "Enable DNS over HTTPS" I only see "CloudFlare (Default)" and "= ;Custom" as options.=C2=A0

If there were many TRRs listed, and which one labeled as default randomly cho= sen at first launch, then at least there would be some distribution of DNS = traffic for users who will never check that setting (i.e. most users), and = the same configuration freedom for those those users who will check it. Another option might be testing sever= al TRRs from the list at first launch and picking the fastest to respond to= attempt some sorting by geographic efficiency.

Perhaps operators of public DNS servers on this mailing list would be inter= ested in knowing what bar they would have to clear to get on such a list. W= ould it be identical to the existing published terms between Mozilla and Cl= oudFlare? Something else? Would you be willing to collaborate on such terms with other browsers for a comm= on standard for TRRs?=C2=A0




Even in my ideal world where the browser cooperates with the platform on de= ciding when to use which DNS stub, there will be times when the browser wil= l know more about the user's DNS intentions than the platform, and in t= hose cases there should definitely be a larger variety of TRRs available to any given large-scale population.

Thanks,
Tommy
From: = Add <add-bounc= es@ietf.org> on behalf of Eric Rescorla <ekr@rtfm.com>
Sent: Thursday, August 15, 2019 3:43 PM
To: Bret Jordan <jordan.ietf@gmail.com>
Cc: ADD Mailing list <add@ietf.org>; Ted Lemon <mellon@fugue.com>; Mikael Abrahamsson <swmike@swm.pp.se><= br> Subject: Re: [Add] [Ext] Validity of network administrator role
=C2=A0
n Thu, Aug 15, 2019 at 11:59 PM Bret Jordan <jordan.ietf@gmail.com&= gt; wrote:

It just baffles me silly that we are worried about people seeing DNS t= raffic and we are not worried about certain cloud providers harvesting, min= ing, and tracking all users behavior on the internet and all of their inter= actions (email and such) that they do with the cloud providers. It seems like if we _REALLY_ wanted to improv= e privacy and security we would do something about that.

Who says we're not worried about it? Do you have a concrete plan f= or addressing it?


=C2=A0Maybe create an encrypted email system that was done in the brow= ser and protected all email from being reviewed and monitored.

Here too, it seems like the question isn't one of desirability but= practicality. There have been quite a few attempts at E2E encrypted email,= none very successful. Just wishing does not make it so.


=C2=A0Further, it would be nice if browsers did a better job of preven= ting and denying all tracking tools.=C2=A0

You mean like: https://webkit.org/blog/8828/intelligent-tracking-prevention-2-2/ or https://blog.mozilla.org/blog/2019/06/04/firefox-now-available-with-enhance= d-tracking-protection-by-default/?

-Ekr



Thanks,<= /span>
Bret
PGP Fingerprint:=C2=A063B4 FC53 680A 6B7D 1447 =C2=A0F2C0 74F8 ACAE 7415 0050
"Without cryptography vihv vivc ce xhrnrw, however, the only thi= ng that can not be unscrambled is an egg."

On Aug 15, 2019, at 1:14 PM, Mikael Abrahamsson <swmike@swm.pp.se> wrote:

On Thu, 15 Aug 2019, Ted Lemon wrote:

Blocking is a form of tampering.=C2=A0 One purpos= e of DoH is to make blocking impractical, so that the end user isn=E2=80=99= t forced to choose a path that=E2=80=99s subject to tampering and intercept= .

As with any technology this is dual use. If the customer has purchased a so= lution that's built around certain mechanisms, bypassing these mechanis= ms might be against the users' wishes.

There is no correct answer here, and anyone pretending to know the correct = answer for all situations is wrong.

So let's fall back on the "principle of least astonishment". = If you tell the users "your browser is now doing DNS lookups using a c= loud provider and your ISP is no longer in that loop", what do you thi= nk their response will be? (might need explanation to the user, but still)

--
Mikael Abrahamsson =C2=A0=C2=A0=C2=A0email: swmike@swm.pp.se--
Add mailing list
Add@ietf.org
https= ://www.ietf.org/mailman/listinfo/add

--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--
Joseph Lorenzo Hall
Chief Technologis= t, Center for Democracy & Technology [h= ttps://www.cdt.org]
1401 K ST NW STE 200, Washington DC 20005-3497e: joe@cdt.org, p: 202.407.8825, pgp: = https://josephhall.org/gpg-key
Fingerprint: 3CA2 8D7B 9F6D DBD3 4B10=C2=A0 1607 5F86 6987 40A9 A871<= /div> --000000000000c0e0e90590302cd4-- From nobody Thu Aug 15 16:24:43 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 993FE120137 for ; Thu, 15 Aug 2019 16:24:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oCURlJBdkF_d for ; Thu, 15 Aug 2019 16:24:32 -0700 (PDT) Received: from NAM04-CO1-obe.outbound.protection.outlook.com (mail-eopbgr690119.outbound.protection.outlook.com [40.107.69.119]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0842B1200EF for ; Thu, 15 Aug 2019 16:24:31 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=YsJKWscnJo8q8h/Z1DF/bjRepWLnlM29yDeHW3hbihgGk3edyPvIIJS8PD5SsoLeSzLIK5W5m92pJ6g7mt5MWFsxyTRbXkFJslD9VqyDxnZKysKI8tj2hax+PdGdp+M/rkjIAgVuO2F2ykFxTe6LT1x1De91ihDArVZJ66jomX/fj3mYeXo4uhlHvAvVuBy3R9x5YBR/G+sOR/hMpa6+oY72AqW0P0f/7B8RevgQJ4Y1r1//o5KYGZhFg75h4kHH5J8/xc+Sz+0AAd59grIRH1ZT/3qBKEPB296KIXC7aqQNO5Whns+Z9K5778PDPceDKhujYWcM/N33a2dyEY0FXA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=OWTQRtwLtY6zXk6jjQhSMXZ+LSIGpdkwoV5poEtBDO4=; b=OLMiVr4SewfZHv5JqY5s2VaDDE996Im8HjLGpxK94xNkP7bHUN1K2f6fKPHgqtaBsmXW+MVU6YWIDngogiZSnJqQ+TKupyzvtxInrlwUqUIIFYyCZua8Gxc3qwczgFJuYeCF6xvMXFTYQZanV6uZwKvpepXDT4dg/ShSZqoEK7Z8cgcfTv9Mh5ufbyVUeBZXjyX6NegdQBReIw4hvR9KluG/bmgkccafAn3lHYiQM9yavv2nJMohJDx/KOPQrgoZCZTkT8WCzdcySY3OVflSyINBei2uyNggrqUhW0WE7yPqLZEfRo/1pKg82ivQ7FcmUxkPcPXOjh3AEMSVqX2bzA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=microsoft.com; dmarc=pass action=none header.from=microsoft.com; dkim=pass header.d=microsoft.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=OWTQRtwLtY6zXk6jjQhSMXZ+LSIGpdkwoV5poEtBDO4=; b=Xsnk1VPBwt/09p9gVMCjR2Of0qIYSXzs5dAVRCCR1myQwFI3Em2BgyFZpKX4+bbP4O4wqzWZZibJmjAK8bVccdIap7dU/fLlNO7WCMRkshmwEzp1zH++lQFVdsygPbBbqEi9aW8PNON7APHUSCCZFNAix6wip3tHvQyeEcouelg= Received: from MWHPR21MB0192.namprd21.prod.outlook.com (10.173.52.138) by MWHPR21MB0781.namprd21.prod.outlook.com (10.173.51.147) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2178.6; Thu, 15 Aug 2019 23:24:29 +0000 Received: from MWHPR21MB0192.namprd21.prod.outlook.com ([fe80::3040:4d29:2935:9a7f]) by MWHPR21MB0192.namprd21.prod.outlook.com ([fe80::3040:4d29:2935:9a7f%3]) with mapi id 15.20.2178.010; Thu, 15 Aug 2019 23:24:29 +0000 From: Tommy Jensen To: Dave Lawrence , ADD Mailing list Thread-Topic: [Add] [Ext] Validity of network administrator role Thread-Index: AQHVUyp4iPKBDVjDIkCVQCaF07YMYKb8bWGAgAAYXgCAAALNx4AAB4wAgAAg8ZCAACfpgIAAAQQ9 Date: Thu, 15 Aug 2019 23:24:29 +0000 Message-ID: References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <8e00891f-2aa2-ee11-559a-b5a8967b22d9@nostrum.com> <2C23D415-84F9-4B6C-B67B-0CC3EB600520@gmail.com> , <23893.59415.370880.54691@gro.dd.org> In-Reply-To: <23893.59415.370880.54691@gro.dd.org> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Jensen.Thomas@microsoft.com; x-originating-ip: [2001:4898:80e8:f:49d4:26fe:1372:35bd] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: fdf03a11-72ed-40a4-8325-08d721d7b893 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600158)(711020)(4605104)(1401327)(4618075)(2017052603328)(7193020); SRVR:MWHPR21MB0781; x-ms-traffictypediagnostic: MWHPR21MB0781: x-ms-exchange-purlcount: 1 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-forefront-prvs: 01304918F3 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(4636009)(346002)(396003)(136003)(366004)(39860400002)(376002)(199004)(189003)(51444003)(102836004)(5660300002)(110136005)(6116002)(46003)(99286004)(446003)(105004)(256004)(7696005)(76176011)(14454004)(22452003)(486006)(186003)(6436002)(316002)(71190400001)(71200400001)(966005)(9686003)(33656002)(2906002)(54896002)(11346002)(53546011)(74316002)(52536014)(6246003)(66946007)(10290500003)(81156014)(81166006)(6306002)(8990500004)(86362001)(66556008)(25786009)(236005)(64756008)(66446008)(476003)(19627405001)(10090500001)(606006)(6506007)(478600001)(7736002)(8676002)(76116006)(53936002)(229853002)(8936002)(55016002)(66476007); DIR:OUT; SFP:1102; SCL:1; SRVR:MWHPR21MB0781; H:MWHPR21MB0192.namprd21.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: 020o/D3B+sb/QV1HBStDBVqTdj+B+U9lZK+n7sc4Yb6r7a9FKFWSMhNOZAnrxI6kDbCSUNwgzZR2DfM6ttoKPE8Lpqd3V2QLFdUsmmIrcgShSGY5vrPkS09N2YJdj7WQi2g4C3yMpFOhUW723XhE+GaprUtPH4t7OiIeC7nais54+p++WT5/SnMqITpgEEwY+bihdiAnUXqrp3V6oLjqz862hAIhdWoqc7S49oz5kpEk8UEWbLLHkme74tJi86nl2FqHMcOJcbe017FKV6SkfgS8Ji0K2oGaPycID0VIW1/KqSIsZswQ+xgly5nZtgn9QKuOO1ELWhPcJJ/wFPgO4lDHBwUdIJs34Gxe2ub2MiMpbJsX4ZjVL05f+OJDYwlJRoFiPnTtsVGQzfyfs2t5g1MO7bUNj3Obj7qbG6pUPqo= x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_MWHPR21MB0192E0596DD23F5B231F1A4BFAAC0MWHPR21MB0192namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: fdf03a11-72ed-40a4-8325-08d721d7b893 X-MS-Exchange-CrossTenant-originalarrivaltime: 15 Aug 2019 23:24:29.3834 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: g8g2T4+uAqaOh22Tgos1l1JIIFHavVkKQlg/s3WugObN8RIN08IA5mUIwTiwXQ7oCT5HONu8a0pzNODxdCTBlg== X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR21MB0781 Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 23:24:41 -0000 --_000_MWHPR21MB0192E0596DD23F5B231F1A4BFAAC0MWHPR21MB0192namp_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Thanks for calling this nuance out explicitly. My intent here was not to sa= y DNSSEC can be replaced by DoH (it can't), but rather to say that use of D= NSSEC and unencrypted (or partially unencrypted) query responses is a step = backward from fully encrypted queries, that's all. Thanks, Tommy ________________________________ From: Add on behalf of Dave Lawrence Sent: Thursday, August 15, 2019 4:17 PM To: ADD Mailing list Subject: Re: [Add] [Ext] Validity of network administrator role Tommy Jensen writes: > I agree that DNSSEC provides evidence of tampering, but I think that > is less valuable than what encryption brings (lack of visibility as > well as tamper protection). I've seen this come up a couple of times now in ways that seem to imply an equivalence here regarding tamper protection, with at least one time (not on this list) where there was a clear belief that having DoH obviated DNSSEC. To be clear for the discussion, while it is true that DoH protects tampering between the endpoints of a particular DNS transaction (currently expected to usually be a resolver and a client) it does absolutely nothing to address the authenticity of a response. That could still well have been tampered with at many other points in the resolution chain. DNSSEC is currently the only mechanism we have for automatically detecting that. -- Add mailing list Add@ietf.org https://nam06.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fwww.iet= f.org%2Fmailman%2Flistinfo%2Fadd&data=3D02%7C01%7CJensen.Thomas%40micro= soft.com%7C2f700228b18d49b6d62908d721d6cccb%7C72f988bf86f141af91ab2d7cd011d= b47%7C1%7C0%7C637015078799476204&sdata=3DD5Yy23jX4Wi%2Fc%2BRMX%2BtPIMT%= 2F9RK1soJQsaCtoIdyqPQ%3D&reserved=3D0 --_000_MWHPR21MB0192E0596DD23F5B231F1A4BFAAC0MWHPR21MB0192namp_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable
Thanks for calling this nuance out explicitly. My intent here was not to sa= y DNSSEC can be replaced by DoH (it can't), but rather to say that use of D= NSSEC and unencrypted (or partially unencrypted) query responses is a step = backward from fully encrypted queries, that's all.

Thanks,
Tommy
From: Add <add-bounces@i= etf.org> on behalf of Dave Lawrence <tale@dd.org>
Sent: Thursday, August 15, 2019 4:17 PM
To: ADD Mailing list <add@ietf.org>
Subject: Re: [Add] [Ext] Validity of network administrator role
 
Tommy Jensen writes:
> I agree that DNSSEC provides evidence of tampering, but I think that > is less valuable than what encryption brings (lack of visibility as > well as tamper protection).

I've seen this come up a couple of times now in ways that seem to
imply an equivalence here regarding tamper protection, with at least
one time (not on this list) where there was a clear belief that having
DoH obviated DNSSEC.

To be clear for the discussion, while it is true that DoH protects
tampering between the endpoints of a particular DNS transaction
(currently expected to usually be a resolver and a client) it does
absolutely nothing to address the authenticity of a response. That
could still well have been tampered with at many other points in the
resolution chain.  DNSSEC is currently the only mechanism we have for<= br> automatically detecting that.

--
Add mailing list
Add@ietf.org
https://n= am06.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fwww.ietf.org%2Fm= ailman%2Flistinfo%2Fadd&amp;data=3D02%7C01%7CJensen.Thomas%40microsoft.= com%7C2f700228b18d49b6d62908d721d6cccb%7C72f988bf86f141af91ab2d7cd011db47%7= C1%7C0%7C637015078799476204&amp;sdata=3DD5Yy23jX4Wi%2Fc%2BRMX%2BtPIMT%2= F9RK1soJQsaCtoIdyqPQ%3D&amp;reserved=3D0
--_000_MWHPR21MB0192E0596DD23F5B231F1A4BFAAC0MWHPR21MB0192namp_-- From nobody Thu Aug 15 16:28:06 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 839B81200F1 for ; Thu, 15 Aug 2019 16:28:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id V_2Y3lbmvMZD for ; Thu, 15 Aug 2019 16:28:00 -0700 (PDT) Received: from NAM02-SN1-obe.outbound.protection.outlook.com (mail-eopbgr770118.outbound.protection.outlook.com [40.107.77.118]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A127A120124 for ; Thu, 15 Aug 2019 16:28:00 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=ZjXl9XEGYVK6bdnRGSJwEQLaccmPqtIPhFSFEOYC+s08K3NXkG7Zw7gdmTrJCBjxu4rrXNkUPDzgpRujoGcTlUx0eWYuNTBS9HwuW8o2wEI43giU+YY4G7JqGGLNXre698I3VZYOVBwjTI/t0sTmCMpeAtyXVH3G2xvrZEl6MdRLyfiIX/MjS8jHj4af5zj5W07Ng5XPcp2bHy/oZqrtvoenMG4j+zeEyAvkhsMxkoncHrHp2TCIuFoFVcqPaO8RpX4q9I1WCQHZqBnnYTBcnNh4WBcNUrFHTyrlhknKAKMubG25LmI1L+2ba3d8dpMojKx5cTr/xsDtRmRKNiUJvA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=R49d43vDEMg2GpF0foIMpoLKmjnzTItNlI9iNEweNlc=; b=JX9O51hFYpSaoDpy6Hnm1xmiNlUyN+ibHWznN3XvzG777wINyAMrI/1KdSMlL8nRKm0EqaRBEIcx/70eNuRmCZKWFf6vgI/ns4qVBuSa+7rKV96dBU+lbOKUtcrZeu4lUW5KVXdADsTLPsVnLYJIuAPfCIBjhQSWaiCPhMs8Cv9IUJ/kLmaJdZOAi0eh+gLwf9S7CAzIx4wZLKo+wBpUwWpL57g18/cy/W9TJ98oU9GTsNBWd/5e/PEb+6oFhAEDy9JmEEJGF8Y/Q6pkdWVE5pJ7QbXwaT7Y4sJGqdj1xDowbliaVC0EFCHsGqBsHGU+t3Tg39FeeTcaE0OZhWbKHw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=microsoft.com; dmarc=pass action=none header.from=microsoft.com; dkim=pass header.d=microsoft.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=R49d43vDEMg2GpF0foIMpoLKmjnzTItNlI9iNEweNlc=; b=lVNjW9tWqLMRr9kZB4YP7rVE6nM/gjCgCn2rlWz/o7ZTxOZxpzZPSwSW4ajaw5GATqSMAaHdFQpXDavFFk6+ePJvzoq6qlIMUn1mCuxarDljZyIf5fNhDuEvNa+efCDq6P5QCnzaBwzLUr7nA3Tsay56O00BJwHfin0e4PRHDQ4= Received: from MWHPR21MB0192.namprd21.prod.outlook.com (10.173.52.138) by MWHPR21MB0637.namprd21.prod.outlook.com (10.175.141.138) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2199.6; Thu, 15 Aug 2019 23:27:58 +0000 Received: from MWHPR21MB0192.namprd21.prod.outlook.com ([fe80::3040:4d29:2935:9a7f]) by MWHPR21MB0192.namprd21.prod.outlook.com ([fe80::3040:4d29:2935:9a7f%3]) with mapi id 15.20.2178.010; Thu, 15 Aug 2019 23:27:58 +0000 From: Tommy Jensen To: Adam Roach , Eric Rescorla , Bret Jordan CC: ADD Mailing list , Ted Lemon , Mikael Abrahamsson Thread-Topic: [Add] [Ext] Validity of network administrator role Thread-Index: AQHVUyp4iPKBDVjDIkCVQCaF07YMYKb8bWGAgAAYXgCAAALNx4AAB4wAgAABwwCAAAMtAIAALdqAgAAMjICAAAWfMYAABXaAgAAAX9Y= Date: Thu, 15 Aug 2019 23:27:58 +0000 Message-ID: References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <8e00891f-2aa2-ee11-559a-b5a8967b22d9@nostrum.com> <2C23D415-84F9-4B6C-B67B-0CC3EB600520@gmail.com> <2704899B-E43D-4978-A3C9-30E9E7CEBEBD@fugue.com> <4CC4C262-BEF4-4B39-ACB1-A595AB66D6CD@gmail.com> , <60702830-cec2-d049-554b-1c0a770b78a4@nostrum.com> In-Reply-To: <60702830-cec2-d049-554b-1c0a770b78a4@nostrum.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Jensen.Thomas@microsoft.com; x-originating-ip: [2001:4898:80e8:7:49dc:26fe:1372:35bd] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 2f4d9625-681b-44f3-22e6-08d721d83557 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600158)(711020)(4605104)(1401327)(4618075)(2017052603328)(7193020); SRVR:MWHPR21MB0637; x-ms-traffictypediagnostic: MWHPR21MB0637: x-ms-exchange-purlcount: 1 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-forefront-prvs: 01304918F3 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(4636009)(39860400002)(136003)(346002)(396003)(376002)(366004)(199004)(189003)(51914003)(54906003)(6246003)(105004)(476003)(66946007)(81166006)(66556008)(446003)(46003)(8936002)(6506007)(81156014)(66476007)(966005)(64756008)(76116006)(10090500001)(66446008)(6116002)(2906002)(99286004)(7696005)(11346002)(110136005)(14454004)(53936002)(25786009)(19627405001)(53546011)(71190400001)(71200400001)(256004)(316002)(102836004)(22452003)(486006)(478600001)(8990500004)(10290500003)(8676002)(186003)(76176011)(4326008)(33656002)(9686003)(236005)(54896002)(6306002)(7736002)(74316002)(55016002)(5660300002)(52536014)(229853002)(6436002)(86362001)(606006); DIR:OUT; SFP:1102; SCL:1; SRVR:MWHPR21MB0637; H:MWHPR21MB0192.namprd21.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: nqosh7JYXfnyI/uJxBhiOKycLMNEYqNAfqT1Yun71prgW9F6DcLbb96hduE4fux7k4JOjVupwXdjpoGPECrRbxpKgd0GQN6PclJwBU32VR4CxUGsnJ1sZ14ZkA3OfTCvBUuHqRf/Z6ioFA3cWjqNoAEW9YHK7erTtlmj+PE4ehjQ/IXwMJM81je8DOUe0cOdon38ZydIcLbGYzigUzpvAgoEmOYSESvxSNvzTAknZ9zV49wWLGePDqyTdYaJbDjOlezs2C9GgrtZ8TCTDoIkRh+19+2pZ8jAIr944MqgMKgJ++roWgrttikXIVWH7UMQrJ3uKB3B9QDboyx+Hk3biEaB/N7A7Buunk3WzmBOCMabX3WTSI4xRUTehOhb0+B2HTcLt3lCzSFFHNaeaegWMJTm27R9vN2Fu5pGmYhfAdM= x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_MWHPR21MB0192A94BA59171A8C09DCE2DFAAC0MWHPR21MB0192namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: 2f4d9625-681b-44f3-22e6-08d721d83557 X-MS-Exchange-CrossTenant-originalarrivaltime: 15 Aug 2019 23:27:58.7309 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: VKwwJFTXrIr9aCSSSQZEBW7vnNvgVlBB7w7W6PTcAetIlK02zhvIF2kpJ5Z15L1WrxQ3QKeYf3nHVP9JkWvTWw== X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR21MB0637 Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 23:28:03 -0000 --_000_MWHPR21MB0192A94BA59171A8C09DCE2DFAAC0MWHPR21MB0192namp_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Perfect, thanks for the link. So that simplifies my answer to: get more TRR= s, and distribute their default assignments so as to minimize the number of= users centralizing on one of them by default. Are there other (publicly known/disclosed) DNS servers applying to this sta= tus? I know Mozilla has said they're exploring European options, but even 1= -2 TRRs per continent is incredibly centralized. Thanks, Tommy ________________________________ From: Adam Roach Sent: Thursday, August 15, 2019 4:23 PM To: Tommy Jensen ; Eric Rescorla ; Bret Jordan Cc: ADD Mailing list ; Ted Lemon ; Mikael A= brahamsson Subject: Re: [Add] [Ext] Validity of network administrator role On 8/15/19 6:21 PM, Tommy Jensen wrote: > Perhaps operators of public DNS servers on this mailing list would be > interested in knowing what bar they would have to clear to get on such > a list. This has been asked and answered quite a few times already. https://nam06.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fwiki.mo= zilla.org%2FSecurity%2FDOH-resolver-policy&data=3D02%7C01%7CJensen.Thom= as%40microsoft.com%7C67fa14fff3da47721f7008d721d79504%7C72f988bf86f141af91a= b2d7cd011db47%7C1%7C0%7C637015082121818180&sdata=3Dgy0w1nYjWfjIHK3ZszFT= Hu1ZYSdAsSFSpWycYrymkbY%3D&reserved=3D0 /a --_000_MWHPR21MB0192A94BA59171A8C09DCE2DFAAC0MWHPR21MB0192namp_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable
Perfect, thanks for the link. So that simplifies my answer to: get more TRR= s, and distribute their default assignments so as to minimize the number of= users centralizing on one of them by default.

Are there other (publicly known/disclosed) DNS servers applying to this sta= tus? I know Mozilla has said they're exploring European options, but even 1= -2 TRRs per continent is incredibly centralized.

Thanks,
Tommy
From: Adam Roach <adam@n= ostrum.com>
Sent: Thursday, August 15, 2019 4:23 PM
To: Tommy Jensen <Jensen.Thomas@microsoft.com>; Eric Rescorla = <ekr@rtfm.com>; Bret Jordan <jordan.ietf@gmail.com>
Cc: ADD Mailing list <add@ietf.org>; Ted Lemon <mellon@fugu= e.com>; Mikael Abrahamsson <swmike@swm.pp.se>
Subject: Re: [Add] [Ext] Validity of network administrator role
 
On 8/15/19 6:21 PM, Tommy Jensen wrote:
> Perhaps operators of public DNS servers on this mailing list would be =
> interested in knowing what bar they would have to clear to get on such=
> a list.


This has been asked and answered quite a few times already.

https:/= /nam06.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fwiki.mozilla.o= rg%2FSecurity%2FDOH-resolver-policy&amp;data=3D02%7C01%7CJensen.Thomas%= 40microsoft.com%7C67fa14fff3da47721f7008d721d79504%7C72f988bf86f141af91ab2d= 7cd011db47%7C1%7C0%7C637015082121818180&amp;sdata=3Dgy0w1nYjWfjIHK3ZszF= THu1ZYSdAsSFSpWycYrymkbY%3D&amp;reserved=3D0

/a

--_000_MWHPR21MB0192A94BA59171A8C09DCE2DFAAC0MWHPR21MB0192namp_-- From nobody Thu Aug 15 16:29:34 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0C51F1200F7 for ; Thu, 15 Aug 2019 16:29:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yfNS743jtSHU for ; Thu, 15 Aug 2019 16:29:32 -0700 (PDT) Received: from gro.dd.org (host2.dlawren-3-gw.cust.sover.net [207.136.201.30]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 87BC21200F1 for ; Thu, 15 Aug 2019 16:29:31 -0700 (PDT) Received: by gro.dd.org (Postfix, from userid 102) id CBD4C101662; Thu, 15 Aug 2019 19:29:30 -0400 (EDT) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <23893.60122.817218.615568@gro.dd.org> Date: Thu, 15 Aug 2019 19:29:30 -0400 From: Dave Lawrence To: ADD Mailing list In-Reply-To: <4CC4C262-BEF4-4B39-ACB1-A595AB66D6CD@gmail.com> References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <8e00891f-2aa2-ee11-559a-b5a8967b22d9@nostrum.com> <2C23D415-84F9-4B6C-B67B-0CC3EB600520@gmail.com> <2704899B-E43D-4978-A3C9-30E9E7CEBEBD@fugue.com> <4CC4C262-BEF4-4B39-ACB1-A595AB66D6CD@gmail.com> Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 23:29:33 -0000 Bret Jordan writes: > It just baffles me silly that we are worried about people seeing DNS > traffic and we are not worried about certain cloud providers > harvesting, mining, and tracking all users behavior on the internet > and all of their interactions (email and such) that they do with the > cloud providers. "and we are not worried about ..." seems to have missed a huge amount of conversation that has in fact swirled around that very topic. One distinction worth observing again is that the experimental Mozilla/CloudFlare DoH setup was only one possible operational model. We can address the issues of that model while also discussing the issues of alternative models, evaluating then against each other to try to get as many of the benefits as possible while bearing as few of the disadvantages as necessary. This is why discovery mechanisms are an interesting area of work for the IETF. It would be an enabler for putting more control back in the hands of network administrators, at least to the point that major, well-behaved applications end up using those channels. (Yes, obviously badly-behaved applications will circumvent the configuration, but as has been observed many times that was an issue before DoH ever came along.) From nobody Thu Aug 15 16:31:08 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CBCF612025D for ; Thu, 15 Aug 2019 16:30:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nohats.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nqyE0B_f8df8 for ; Thu, 15 Aug 2019 16:30:54 -0700 (PDT) Received: from mx.nohats.ca (mx.nohats.ca [193.110.157.68]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3057A12013C for ; Thu, 15 Aug 2019 16:30:54 -0700 (PDT) Received: from localhost (localhost [IPv6:::1]) by mx.nohats.ca (Postfix) with ESMTP id 468jPS2DYvzCLF; Fri, 16 Aug 2019 01:30:52 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nohats.ca; s=default; t=1565911852; bh=6pt7ij02AMMyuyzxhCX6aKjFUabYt3faCF00+wbgDcI=; h=Subject:From:In-Reply-To:Date:Cc:References:To; b=U/i+uXBsA6ZHVOj5pPlhyn16QYUOY2DcwVYGRIY/K1bBTgMEug7zdHnZd5rl6GM9M nVF+XpeMCC6uCzO655xCw5DcWVAb2RYloabViNdLjP5GGiyBzVCKp5FSlSfb26z50X Prin8Vz5Uy+6tr4uEm4qWeePf49QyfOSROZjUBFU= X-Virus-Scanned: amavisd-new at mx.nohats.ca Received: from mx.nohats.ca ([IPv6:::1]) by localhost (mx.nohats.ca [IPv6:::1]) (amavisd-new, port 10024) with ESMTP id a3dIaCRwsVsS; Fri, 16 Aug 2019 01:30:50 +0200 (CEST) Received: from bofh.nohats.ca (bofh.nohats.ca [76.10.157.69]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx.nohats.ca (Postfix) with ESMTPS; Fri, 16 Aug 2019 01:30:50 +0200 (CEST) Received: from [193.111.228.93] (unknown [193.111.228.93]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by bofh.nohats.ca (Postfix) with ESMTPSA id DD758373B; Thu, 15 Aug 2019 19:30:48 -0400 (EDT) DKIM-Filter: OpenDKIM Filter v2.11.0 bofh.nohats.ca DD758373B Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (1.0) From: Paul Wouters X-Mailer: iPhone Mail (16G77) In-Reply-To: <60702830-cec2-d049-554b-1c0a770b78a4@nostrum.com> Date: Thu, 15 Aug 2019 19:30:32 -0400 Cc: Tommy Jensen , Eric Rescorla , Bret Jordan , ADD Mailing list , Ted Lemon , Mikael Abrahamsson Content-Transfer-Encoding: quoted-printable Message-Id: References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <8e00891f-2aa2-ee11-559a-b5a8967b22d9@nostrum.com> <2C23D415-84F9-4B6C-B67B-0CC3EB600520@gmail.com> <2704899B-E43D-4978-A3C9-30E9E7CEBEBD@fugue.com> <4CC4C262-BEF4-4B39-ACB1-A595AB66D6CD@gmail.com> <60702830-cec2-d049-554b-1c0a770b78a4@nos trum.com> To: Adam Roach Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 23:30:59 -0000 > On Aug 15, 2019, at 19:23, Adam Roach wrote: >=20 >=20 >=20 > This has been asked and answered quite a few times already. >=20 > https://wiki.mozilla.org/Security/DOH-resolver-policy =E2=80=9Cat Mozilla=E2=80=99s sole discretion=E2=80=9D It=E2=80=99s always hard not try to gain power to do good, instead of not gi= ving yourself the power for potential abuse or compulsion in the future. I=E2=80=99m also a bit confused that there are no other requirements like ba= ndwidth, stability, ownership of IP space or other requirements for stabilit= y and security. The lack of requiring dnssec has already been mentioned in the past as a fun= damental problem. Paul From nobody Thu Aug 15 16:34:42 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4769D1200F7 for ; Thu, 15 Aug 2019 16:34:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.68 X-Spam-Level: X-Spam-Status: No, score=-1.68 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_INVALID=0.1, DKIM_SIGNED=0.1, T_SPF_HELO_PERMERROR=0.01, T_SPF_PERMERROR=0.01] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=fail (1024-bit key) reason="fail (message has been altered)" header.d=nostrum.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Va46_XxRFSwI for ; Thu, 15 Aug 2019 16:34:40 -0700 (PDT) Received: from nostrum.com (raven-v6.nostrum.com [IPv6:2001:470:d:1130::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0696F1200EF for ; Thu, 15 Aug 2019 16:34:40 -0700 (PDT) Received: from MacBook-Pro.roach.at (99-152-146-228.lightspeed.dllstx.sbcglobal.net [99.152.146.228]) (authenticated bits=0) by nostrum.com (8.15.2/8.15.2) with ESMTPSA id x7FNYb6x077181 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NO); Thu, 15 Aug 2019 18:34:38 -0500 (CDT) (envelope-from adam@nostrum.com) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=nostrum.com; s=default; t=1565912079; bh=sQPXqCDDYvlbVQy8Sai1HcVrzASf1ib5MHBikez7tLo=; h=Subject:To:Cc:References:From:Date:In-Reply-To; b=HDoJYjK6zY61fbFDcHnUEu1PCP0+76sbHqgYse7ttRHd63LV8YnqoVdzzQ9TPNQ/Y U0HAeJ/+M/AdW684cCvll7fhvLJuIbdxV9nmO8x/77lmgl4UjswKli4KZFEwC2QRQ7 zBlwtIza+sgObSHoTq6akGWuizxoTRZt4gjUarYY= X-Authentication-Warning: raven.nostrum.com: Host 99-152-146-228.lightspeed.dllstx.sbcglobal.net [99.152.146.228] claimed to be MacBook-Pro.roach.at To: Paul Wouters Cc: Eric Rescorla , Ted Lemon , ADD Mailing list , Tommy Jensen , Bret Jordan , Mikael Abrahamsson References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <8e00891f-2aa2-ee11-559a-b5a8967b22d9@nostrum.com> <2C23D415-84F9-4B6C-B67B-0CC3EB600520@gmail.com> <2704899B-E43D-4978-A3C9-30E9E7CEBEBD@fugue.com> <4CC4C262-BEF4-4B39-ACB1-A595AB66D6CD@gmail.com> <60702830-cec2-d049-554b-1c0a770b78a4@nos trum.com> From: Adam Roach Message-ID: <4e9e7f2d-dd56-b66b-814b-e9d5a9ffddfd@nostrum.com> Date: Thu, 15 Aug 2019 18:34:32 -0500 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Content-Language: en-US Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 23:34:41 -0000 On 8/15/19 6:30 PM, Paul Wouters wrote: > > > >> On Aug 15, 2019, at 19:23, Adam Roach wrote: >> >> >> >> This has been asked and answered quite a few times already. >> >> https://wiki.mozilla.org/Security/DOH-resolver-policy > “at Mozilla’s sole discretion” > > It’s always hard not try to gain power to do good, instead of not giving yourself the power for potential abuse or compulsion in the future. Given Mozilla's nonprofit status, and given the precepts of its mission, that's a kind of non-sequitur thing to say. /a From nobody Thu Aug 15 16:41:50 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 35C321200EF for ; Thu, 15 Aug 2019 16:41:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nohats.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id imAYfMUlVMcc for ; Thu, 15 Aug 2019 16:41:47 -0700 (PDT) Received: from mx.nohats.ca (mx.nohats.ca [IPv6:2a03:6000:1004:1::68]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 226C91200F1 for ; Thu, 15 Aug 2019 16:41:45 -0700 (PDT) Received: from localhost (localhost [IPv6:::1]) by mx.nohats.ca (Postfix) with ESMTP id 468jdy45r2zCLF; Fri, 16 Aug 2019 01:41:42 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nohats.ca; s=default; t=1565912502; bh=4L2bqSuGfBBGA+jIxCZOeMEq2v6RrY+OAOXQjtn8EWQ=; h=Subject:From:In-Reply-To:Date:Cc:References:To; b=Bs+uZxFqg4oFujPVkWmTgYL9QKESQIMsVloeoJY15XVj1P6VWVHc2HzxBydDekbpk qaSQ/YsFUhROrvUH6RQCNsrw5ItVA/9HeE7EmsK64yPS118nDn1Plh2glAw6oU3pH5 pmeqp9+o9uxMsSTqm9JlwtFp3vfNzndTtkpONTuQ= X-Virus-Scanned: amavisd-new at mx.nohats.ca Received: from mx.nohats.ca ([IPv6:::1]) by localhost (mx.nohats.ca [IPv6:::1]) (amavisd-new, port 10024) with ESMTP id QkeaQFNODX-z; Fri, 16 Aug 2019 01:41:41 +0200 (CEST) Received: from bofh.nohats.ca (bofh.nohats.ca [76.10.157.69]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx.nohats.ca (Postfix) with ESMTPS; Fri, 16 Aug 2019 01:41:40 +0200 (CEST) Received: from [10.160.6.121] (199-7-157-54.eng.wind.ca [199.7.157.54]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by bofh.nohats.ca (Postfix) with ESMTPSA id 12528373B; Thu, 15 Aug 2019 19:41:39 -0400 (EDT) DKIM-Filter: OpenDKIM Filter v2.11.0 bofh.nohats.ca 12528373B Content-Type: multipart/alternative; boundary=Apple-Mail-5F811687-7CC3-4D4A-8AE0-5EA6EE32D33B Mime-Version: 1.0 (1.0) From: Paul Wouters X-Mailer: iPhone Mail (16G77) In-Reply-To: Date: Thu, 15 Aug 2019 19:41:37 -0400 Cc: Dave Lawrence , ADD Mailing list Content-Transfer-Encoding: 7bit Message-Id: References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <8e00891f-2aa2-ee11-559a-b5a8967b22d9@nostrum.com> <2C23D415-84F9-4B6C-B67B-0CC3EB600520@gmail.com> <23893.59415.370880.54691@gro.dd.org> To: Tommy Jensen Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 23:41:48 -0000 --Apple-Mail-5F811687-7CC3-4D4A-8AE0-5EA6EE32D33B Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable M > On Aug 15, 2019, at 19:24, Tommy Jensen wrote: >=20 > Thanks for calling this nuance out explicitly. My intent here was not to s= ay DNSSEC can be replaced by DoH (it can't), but rather to say that use of D= NSSEC and unencrypted (or partially unencrypted) query responses is a step b= ackward from fully encrypted queries, that's all. That statement is still incorrect. Unencrypted dnssec is more secure then en= crypted dns without dnssec because dnssec answers cannot be spoofed. Encrypted dns without dnssec is more private than unencrypted dnssec and the= lack of privacy might cause a physical security issue for the user. Paul= --Apple-Mail-5F811687-7CC3-4D4A-8AE0-5EA6EE32D33B Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 7bit M

On Aug 15, 2019, at 19:24, Tommy Jensen <Jensen.Thomas=40microsoft.com@dmarc.ietf.org> wrote:

Thanks for calling this nuance out explicitly. My intent here was not to say DNSSEC can be replaced by DoH (it can't), but rather to say that use of DNSSEC and unencrypted (or partially unencrypted) query responses is a step backward from fully encrypted queries, that's all.

That statement is still incorrect. Unencrypted dnssec is more secure then encrypted dns without dnssec because dnssec answers cannot be spoofed.

Encrypted dns without dnssec is more private than unencrypted dnssec and the lack of privacy might cause a physical security issue for the user.

Paul
--Apple-Mail-5F811687-7CC3-4D4A-8AE0-5EA6EE32D33B-- From nobody Thu Aug 15 16:51:12 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C46391200F3 for ; Thu, 15 Aug 2019 16:51:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iadlW80Asg73 for ; Thu, 15 Aug 2019 16:51:08 -0700 (PDT) Received: from NAM01-BY2-obe.outbound.protection.outlook.com (mail-eopbgr810099.outbound.protection.outlook.com [40.107.81.99]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B851D1200F1 for ; Thu, 15 Aug 2019 16:51:05 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=M0DdFd+GQmlABjbrdIBZW1eqGzY46jFKyTVVSbYHKvmF+AEAfkDibd5+3PMKQ2pCu+rEpj3KkZCzpOYlDRzLmDpChCxbMq6dthFLtCXisZR13hACOYnOGh0WkxG8lNUWM3YaIwcIZnnhHZ/SfayY6lV+Ph9EnUyIUcli5lN+q7N8GqePvQbAccO8659CPQ/q9JOR9oHbVjVElfen8bD4FiqDjP/B6XTxvvsTB6bV/U4gZNF3YSwrritqB5v/dy2+7Q83rWOTIGqPHnvdcnbWnClzOM9Jf+4dwwe/S/p7Zvg/T5I9wfZKVbnCIradqGckBFaES0Z5JFU3uUtWICAukQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=VKEyk+ABkw0gQaTS1udusX5iLfPq79aeyI54jcPNu34=; b=Ol26VQshSPbdB3n/uscVfS0t2eO3K9EjXNgEpnzKvx1UFGebVxQvdtQqJM6xE4f2deJol2QyUyar98gTGve19j+CNqiilaO0VWwyCMXzDe7Nppt9wvv/0FrHE9Cuh68ESQ4+aSUr4jtA0yMcOSJ82aZRXt+HA3CZ3MUCRs6Gy3FtwJX+UanHrm+o8xZTWzqiPO1Amb4w5ozxxE6sLPfu3SmUaiz5hfNbZ2lKgEFttvVovXRvo7DsWbLJrVole+Bojaf/PgRDehwcAWDGybPNv+Ls4GcFD8fv6YLMItX7iOS8EF0gtmo5L7A/sMntbftE25YpSb6ZIdSaSYiQ5sRuxA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=microsoft.com; dmarc=pass action=none header.from=microsoft.com; dkim=pass header.d=microsoft.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=VKEyk+ABkw0gQaTS1udusX5iLfPq79aeyI54jcPNu34=; b=YitA3k/EL3scimayosMzf2Rs7uMwInd/LtjYQRmfjvix+xUTxF6RfOzYXm9BxepaFzyAccykW+xL3V6dX2Q6aYpEeLKhKDNU2EFqcR4pNNygQugB8JoTCwFbDXwsbZgVcGW75n1jGZNIRvSK1qkTv2fkLAyquK84l7vD4JT3q9U= Received: from MWHPR21MB0192.namprd21.prod.outlook.com (10.173.52.138) by MWHPR21MB0846.namprd21.prod.outlook.com (10.173.51.140) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2199.6; Thu, 15 Aug 2019 23:51:04 +0000 Received: from MWHPR21MB0192.namprd21.prod.outlook.com ([fe80::3040:4d29:2935:9a7f]) by MWHPR21MB0192.namprd21.prod.outlook.com ([fe80::3040:4d29:2935:9a7f%3]) with mapi id 15.20.2178.010; Thu, 15 Aug 2019 23:51:04 +0000 From: Tommy Jensen To: Paul Wouters CC: Dave Lawrence , ADD Mailing list Thread-Topic: [Add] [Ext] Validity of network administrator role Thread-Index: AQHVUyp4iPKBDVjDIkCVQCaF07YMYKb8bWGAgAAYXgCAAALNx4AAB4wAgAAg8ZCAACfpgIAAAQQ9gAAFqoCAAACa0g== Date: Thu, 15 Aug 2019 23:51:03 +0000 Message-ID: References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <8e00891f-2aa2-ee11-559a-b5a8967b22d9@nostrum.com> <2C23D415-84F9-4B6C-B67B-0CC3EB600520@gmail.com> <23893.59415.370880.54691@gro.dd.org> , In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Jensen.Thomas@microsoft.com; x-originating-ip: [131.107.147.184] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: e2ffa405-cc69-47a0-4494-08d721db6f0e x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600158)(711020)(4605104)(1401327)(4618075)(2017052603328)(7193020); SRVR:MWHPR21MB0846; x-ms-traffictypediagnostic: MWHPR21MB0846: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-forefront-prvs: 01304918F3 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(4636009)(396003)(376002)(346002)(39860400002)(366004)(136003)(199004)(189003)(53936002)(25786009)(8990500004)(10090500001)(33656002)(3846002)(53546011)(6246003)(19627405001)(236005)(6116002)(229853002)(486006)(54896002)(6436002)(186003)(26005)(55016002)(76176011)(105004)(476003)(4326008)(102836004)(11346002)(10290500003)(14454004)(9686003)(6506007)(446003)(6916009)(478600001)(7696005)(66066001)(22452003)(316002)(74316002)(99286004)(86362001)(81156014)(52536014)(81166006)(66946007)(76116006)(91956017)(2906002)(66446008)(64756008)(66476007)(8936002)(66556008)(54906003)(256004)(14444005)(7736002)(8676002)(71200400001)(71190400001)(5660300002); DIR:OUT; SFP:1102; SCL:1; SRVR:MWHPR21MB0846; H:MWHPR21MB0192.namprd21.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: aq1/ZrZOXLCT6WF0cbVcsPB0ixr0zSw/rG11aq14okfeAIHL3xtpnjxkLbTPKExLmII8vQ9YclOCta5Qfg64aW9Cq/2h7OxcCIfYJJowRbWkyeDPBM3CNV8E7+5lcPhwu9RER753TpkRn2T2P3FrRp1TR6f2cGHLgecYava5guwkQ1AdQRzDoiLoPRe1UCQvm+iBMgtDDz2cGE6oGfTX7f1p5LJw7avrAtaDI4mONt34ylLtEfVJ2Mb6myixdZhjRTPL/W7Nx0p8R2gftIpvjUZ2PWxkYDUqcqs/Rwwq6hYDgFkB1mwJhbVHvQDQrdjW1r5QqP8r55GoVo2X8/UqwexwBTRBh5woiXWuPdHTnQvSIKFz+eGcshthrNCpKdAAmqA0tMy42E44iiGf9J//nQlJGUNZFmuDFWNpL2qzAJA= x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_MWHPR21MB0192A3284E073D5DE0B19F50FAAC0MWHPR21MB0192namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: e2ffa405-cc69-47a0-4494-08d721db6f0e X-MS-Exchange-CrossTenant-originalarrivaltime: 15 Aug 2019 23:51:03.8923 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: uHImtvwzDHuxDaNWL/9Yhrf6dphvrcQ/3B4ymISmWyNFKTwZAXH65wkwb4NXlmSJrU0ERyS0XJAuJ47RBI96zQ== X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR21MB0846 Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Aug 2019 23:51:11 -0000 --_000_MWHPR21MB0192A3284E073D5DE0B19F50FAAC0MWHPR21MB0192namp_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable paul> That statement is still incorrect. Unencrypted dnssec is more secure = then encrypted dns without dnssec because dnssec answers cannot be spoofed. I was very careful not to say it was more secure. What I said was partially= encrypting the payload and adding DNSSEC would be "a step backward" imo co= nsidering integrity overall (authentication which only DNSSEC can provide a= s well as visibility protection which only encryption can provide as well a= s tamper protection *BETWEEN THE RR AND THE STUB* which either can provide = in different ways). After all, one can simply add DNSSEC to a fully encrypt= ed DNS pipeline and get the best of both worlds, so I wasn't seeing the mer= it in a partially encrypted solution. That's all. ________________________________ From: Paul Wouters Sent: Thursday, August 15, 2019 4:41 PM To: Tommy Jensen Cc: Dave Lawrence ; ADD Mailing list Subject: Re: [Add] [Ext] Validity of network administrator role M On Aug 15, 2019, at 19:24, Tommy Jensen > wrote: Thanks for calling this nuance out explicitly. My intent here was not to sa= y DNSSEC can be replaced by DoH (it can't), but rather to say that use of D= NSSEC and unencrypted (or partially unencrypted) query responses is a step = backward from fully encrypted queries, that's all. That statement is still incorrect. Unencrypted dnssec is more secure then e= ncrypted dns without dnssec because dnssec answers cannot be spoofed. Encrypted dns without dnssec is more private than unencrypted dnssec and th= e lack of privacy might cause a physical security issue for the user. Paul --_000_MWHPR21MB0192A3284E073D5DE0B19F50FAAC0MWHPR21MB0192namp_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable
paul> That statement is still incorrect. Unencrypted dnssec is more= secure then encrypted dns without dnssec because dnssec answers cannot be = spoofed.

I was very careful not to say it was more secure. What I said was partially= encrypting the payload and adding DNSSEC would be "a step backward&qu= ot; imo considering integrity overall (authentication which only DNSSEC can= provide as well as visibility protection which only encryption can provide as well as tamper protection *BETWEEN TH= E RR AND THE STUB* which either can provide in different ways). After all, = one can simply add DNSSEC to a fully encrypted DNS pipeline and get the bes= t of both worlds, so I wasn't seeing the merit in a partially encrypted solution. That's all. 
From: Paul Wouters <paul= @nohats.ca>
Sent: Thursday, August 15, 2019 4:41 PM
To: Tommy Jensen <Jensen.Thomas@microsoft.com>
Cc: Dave Lawrence <tale@dd.org>; ADD Mailing list <add@ietf= .org>
Subject: Re: [Add] [Ext] Validity of network administrator role
 
M

On Aug 15, 2019, at 19:24, Tommy Jensen <Jensen.Thomas=3D40microsoft.com@dmarc.ie= tf.org> wrote:

Thanks for calling this nuance out explicitly. My intent here was not to sa= y DNSSEC can be replaced by DoH (it can't), but rather to say that use of D= NSSEC and unencrypted (or partially unencrypted) query responses is a step = backward from fully encrypted queries, that's all.

That statement is still incorrect. Unencrypted dnssec is more secure then e= ncrypted dns without dnssec because dnssec answers cannot be spoofed.

Encrypted dns without dnssec is more private than unencrypted dnssec a= nd the lack of privacy might cause a physical security issue for the user.<= /div>

Paul
--_000_MWHPR21MB0192A3284E073D5DE0B19F50FAAC0MWHPR21MB0192namp_-- From nobody Thu Aug 15 17:40:23 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AEC14120103 for ; Thu, 15 Aug 2019 17:40:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8bmR2xiYNHVY for ; Thu, 15 Aug 2019 17:40:19 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A3A971200F3 for ; Thu, 15 Aug 2019 17:40:18 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 2BF1DBE20; Fri, 16 Aug 2019 01:40:16 +0100 (IST) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NDLREcHItNtp; Fri, 16 Aug 2019 01:40:14 +0100 (IST) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 9AB74BDCF; Fri, 16 Aug 2019 01:40:14 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1565916014; bh=G4VE5yMIlQ7g3zDBWDpJJshLeKMoGUvrq2FBibXimFA=; h=Subject:To:References:From:Date:In-Reply-To:From; b=O04T4ikUUF+cUV9sFAUJNOcQCkUcHOKeYFHS/RRV9ipeQx4/xFoTp4Vj9krV0JVIY r4rRyhdnk98ah9yQCo55qyWGlLfzAQ9pGR2IbHbJ8ceGMVenSXieJ0zRdXwR1NnKKO mq2ekMRNbuvY0UWKfN7l/g4pBzaoi4XH85Encibw= To: Dave Lawrence , ADD Mailing list References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <8e00891f-2aa2-ee11-559a-b5a8967b22d9@nostrum.com> <2C23D415-84F9-4B6C-B67B-0CC3EB600520@gmail.com> <2704899B-E43D-4978-A3C9-30E9E7CEBEBD@fugue.com> <4CC4C262-BEF4-4B39-ACB1-A595AB66D6CD@gmail.com> <23893.60122.817218.615568@gro.dd.org> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: <6402e345-ce5e-da66-5b16-35412d50801d@cs.tcd.ie> Date: Fri, 16 Aug 2019 01:40:11 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: <23893.60122.817218.615568@gro.dd.org> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="i78A2xCfsBGqOfSDXFsa91TbWCGgHif35" Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 00:40:22 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --i78A2xCfsBGqOfSDXFsa91TbWCGgHif35 Content-Type: multipart/mixed; boundary="3UGBYY7TFpddTysMS9QmRS1lQyRXrgUZx"; protected-headers="v1" From: Stephen Farrell To: Dave Lawrence , ADD Mailing list Message-ID: <6402e345-ce5e-da66-5b16-35412d50801d@cs.tcd.ie> Subject: Re: [Add] [Ext] Validity of network administrator role References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <8e00891f-2aa2-ee11-559a-b5a8967b22d9@nostrum.com> <2C23D415-84F9-4B6C-B67B-0CC3EB600520@gmail.com> <2704899B-E43D-4978-A3C9-30E9E7CEBEBD@fugue.com> <4CC4C262-BEF4-4B39-ACB1-A595AB66D6CD@gmail.com> <23893.60122.817218.615568@gro.dd.org> In-Reply-To: <23893.60122.817218.615568@gro.dd.org> --3UGBYY7TFpddTysMS9QmRS1lQyRXrgUZx Content-Type: multipart/mixed; boundary="------------3246B71D562E813A65E71D2D" Content-Language: en-GB This is a multi-part message in MIME format. --------------3246B71D562E813A65E71D2D Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hiya, On 16/08/2019 00:29, Dave Lawrence wrote: > One distinction worth observing again is that the experimental > Mozilla/CloudFlare DoH setup was only one possible operational model. > We can address the issues of that model while also discussing > the issues of alternative models, evaluating then against each other > to try to get as many of the benefits as possible while bearing as few > of the disadvantages as necessary. I'm also personally leery of the moz/cf model as being a possible one-off. The "we'd like more TRRs" aspiration seems like a good, and genuine, one, but hasn't so far produced other TRRs AFAIK. Continued work on that seems like a good thing. However, I've not seen other (!=3D moz/TRR) models proposed. If someone has one to propose, now and here would seem like a good time and place. By a "proposed model" I mean a worked-out model and not a "not yet even on a beer-mat" nor just a "sent from my iphone" type random thought;-) Cheers, S. --------------3246B71D562E813A65E71D2D Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------3246B71D562E813A65E71D2D-- --3UGBYY7TFpddTysMS9QmRS1lQyRXrgUZx-- --i78A2xCfsBGqOfSDXFsa91TbWCGgHif35 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAl1V+2wACgkQWrL68XsX K+pORA/+Ojf9uEnE5Td1YyqldQ8ZinJVHPdasqel41mqq0WSmHYHgwODsAeSqj6P N22Ng7ZlSbpGmLim41LEk9xE8FZq9lHBYf74tsOS0+m4OEvKyYIjNBIUhPph6cUX 1X1oXtXeuk7DM0L4jCnI6UPIIX4Y/+xrrS7Y9jY/jvpMLu9mEUI6JuF1NAF7yp8H 6ncpbAfTMl/7H+uUzUR1xUypn0RTHvV5+RH3+ynGU2tpUKd187P12kb6zpn+hAua WSRyilJswiFRt9MeNyOLXtCHDJyfZh5AvQDdwi+OdSA/YxPLTaPJ7A1f1OGh3ztE j4gM/a6Wi5SuBLumoBV8+O+C6YyznpFBgjHX9ReOWlqL4Gxn2Sn2thoajRk+PAyl 6TPE1eWxoYfk+Det4kcZRd8M7XhFIdirxbj6eXrCadQnLPHVh5Yjn9ZXFI9pFzS/ GdDAUKWAb3cc3tEsR8tHjDyMFdDZMiZ3b1Ljzhg2irRcOBvoEYw4BC6t716zy6aF AkPi/uJ4OIReCaC7woSzL/nFhywkVfTc4QG9LUHHom+tg0D/1I3XcJf29hRZgxPI mtdWe15ds8D3Qu8/7F2NLIh47sbzcXYH7+GLKJ/R3B2XxeccjRQz3VgS76FCHo8r DmOmv+5X1qK+qmlyUiNumycADT4+u1YYSRd21Y3w0SgvGFCNKH0= =aU7K -----END PGP SIGNATURE----- --i78A2xCfsBGqOfSDXFsa91TbWCGgHif35-- From nobody Thu Aug 15 22:36:16 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C9E57120025 for ; Thu, 15 Aug 2019 22:36:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sxyNH7UIKEVQ for ; Thu, 15 Aug 2019 22:36:12 -0700 (PDT) Received: from mail-io1-xd2a.google.com (mail-io1-xd2a.google.com [IPv6:2607:f8b0:4864:20::d2a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3F824120013 for ; Thu, 15 Aug 2019 22:36:12 -0700 (PDT) Received: by mail-io1-xd2a.google.com with SMTP id j6so3949291ioa.5 for ; Thu, 15 Aug 2019 22:36:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=CrcOjjZM8BfR3hiXoFbgMCMj8JR7RF/rvp51PadFvfY=; b=PDGJkNHULtU9NvCMoDdUVdLWULs+c9jsELqWvTV0NEy3sKlhQDyp6hwg+NgH2gtHO0 Nig/oG9Hf2PFDPsfH6Q+it8H9E8bDGtABu4fbakqk+ojqUtM5p/KjEHS2X8fnLZLV+MU 7mvChhcL0R2NXk5Bj5HDsi1GZ0lNU+HhHYx8SL3SN+OWPVQmg3XW27eT0ezAVM6sJpVU h3BHx2JsbmoJw8P+rEwFB6StZest/VhbAsoz2QF4MrWRrBi4rqNtuk67YuUatdUr7GS7 XpOfn8lG+mrxYIliVFU9W5vUm51NlhYHOeIjx6MvRWddSs2rtj975GkIH9cxH66ThEHD /Zyg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=CrcOjjZM8BfR3hiXoFbgMCMj8JR7RF/rvp51PadFvfY=; b=UZT3O0vm0XoH6t8aWk/W1KDWnWyFsiTexPcJhley41r2u4mplKh3qBw8Dd0S1Sg8lC rnRwEj1CtA9n1w09ER8a2GY8ON1TOo0mbNM+1MOffzGc/rsYaYQ2X/MXS+YI1RIWjJ/J GqleZ4UtHc8hOLHvJ7Jv+deAqYlxptPdz4gwlYZpB3KNs2t0Bf6IUJkn7bV7N46AROBe dANS1ADKzliNPLCyjDgvXIogEvYyUME9oR7LbGkEfW3Og5koEG6k2h3ra2kgJThgNhCj RDjbIoQ1UfutyS33fFZITndCdJkOnHCPpH1i7feOrIpCVQ+rIAJX5i81Ojtp2FSHWR/w d6bg== X-Gm-Message-State: APjAAAVlGrOiQfnlgam96rN5waOk3YDP13bjxWua8SXnTTBdwNtVb4kq +SiiMM/9geM6y2pnsOUm7WeDXXond5FFHerjsfA= X-Google-Smtp-Source: APXvYqwJkQOZnOqoMi3nNmSPtXNcd6mM72IUwe6SZMUK4Nu24YTiAaIa34gMDVvBLtXmIBA9FMh8PabCvkJWGp/kU00= X-Received: by 2002:a05:6602:98:: with SMTP id h24mr9541584iob.49.1565933771273; Thu, 15 Aug 2019 22:36:11 -0700 (PDT) MIME-Version: 1.0 References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <8e00891f-2aa2-ee11-559a-b5a8967b22d9@nostrum.com> <2C23D415-84F9-4B6C-B67B-0CC3EB600520@gmail.com> <23893.59415.370880.54691@gro.dd.org> In-Reply-To: <23893.59415.370880.54691@gro.dd.org> From: Rob Sayre Date: Thu, 15 Aug 2019 22:35:59 -0700 Message-ID: To: Dave Lawrence Cc: ADD Mailing list Content-Type: multipart/alternative; boundary="0000000000002dba920590355e5e" Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 05:36:15 -0000 --0000000000002dba920590355e5e Content-Type: text/plain; charset="UTF-8" On Thu, Aug 15, 2019 at 4:17 PM Dave Lawrence wrote: > To be clear for the discussion, while it is true that DoH protects > tampering between the endpoints of a particular DNS transaction > (currently expected to usually be a resolver and a client) it does > absolutely nothing to address the authenticity of a response. That > could still well have been tampered with at many other points in the > resolution chain. DNSSEC is currently the only mechanism we have for > automatically detecting that. > Isn't the relationship a bit more subtle? In researching this issue, I came across this forum post (please excuse the slightly inflammatory title of the thread): . The author of that reply writes: "Most bizarrely perhaps, is that DNSSEC provides no end-to-end security. Your browser or OS still communicates with your resolver using regular queries, relying on a single unauthenticated bit to 'request' validation. It's as if LAN/wifi-level abuse wasn't a concern at all, or that public resolvers (like OpenDNS and Google Public DNS) didn't exist." These attacks do in fact happen (see < https://mailarchive.ietf.org/arch/msg/add/NIk8gIPZu52GXDsT8zy4S1I4QsM>), so it seems like DoT/DoH would be one step in improving DNSSEC reliability. thanks, Rob --0000000000002dba920590355e5e Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Thu, Aug 15, 2019 at 4:17 PM Dave Lawr= ence <tale@dd.org> wrote:
To be clear for the discussion, while it is true that DoH protects
tampering between the endpoints of a particular DNS transaction
(currently expected to usually be a resolver and a client) it does
absolutely nothing to address the authenticity of a response. That
could still well have been tampered with at many other points in the
resolution chain.=C2=A0 DNSSEC is currently the only mechanism we have for<= br> automatically detecting that.

Isn't= the relationship a bit more subtle? In researching this issue, I came acro= ss this forum post (please excuse the slightly inflammatory title of the th= read): <https= ://news.ycombinator.com/item?id=3D7450281>.

The author of that reply writes: "Most bizarrely perhaps, is that DNS= SEC provides no end-to-end security. Your browser or OS still communicates = with your resolver using regular queries, relying on a single unauthenticat= ed bit to 'request' validation. It's as if LAN/wifi-level abuse= wasn't a concern at all, or that public resolvers (like OpenDNS and Go= ogle Public DNS) didn't exist."

These att= acks do in fact happen (see <https://mailarchive.ietf.org/arch/ms= g/add/NIk8gIPZu52GXDsT8zy4S1I4QsM>), so it seems like DoT/DoH would = be one step in improving DNSSEC reliability.

thank= s,
Rob
--0000000000002dba920590355e5e-- From nobody Thu Aug 15 23:04:25 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B8C00120013 for ; Thu, 15 Aug 2019 23:04:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FROM_EXCESS_BASE64=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=frobbit.se Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Khgw9vTvB0WF for ; Thu, 15 Aug 2019 23:04:20 -0700 (PDT) Received: from mail.frobbit.se (mail.frobbit.se [85.30.129.176]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 97BD012002E for ; Thu, 15 Aug 2019 23:04:20 -0700 (PDT) Received: from [192.165.72.241] (unknown [IPv6:2a02:80:3ffc:0:3170:f094:c31e:1467]) by mail.frobbit.se (Postfix) with ESMTPSA id 744D62193D; Fri, 16 Aug 2019 08:04:18 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=frobbit.se; s=mail; t=1565935458; bh=WFZ3AG15+2gWeZWWX7yFirJYV7DM5wpAZ8IhoE/lKcg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=rGfz3hW7waYkU0IEY/S0JP7eMBiDEXsC8LiLaPfs60tlbkJ1Uzk7eWxWukepFFynX yacXDBWaaQMxPWaBTVwbPjGxncqfnN5c1t/C27ncQZCFvPiBATcizsMnBGP4fWUfuu mZzoAq9f0y07QF1WtIdk5SpiiPdwHWdx1NP1BCXk= From: "Patrik =?utf-8?b?RsOkbHRzdHLDtm0=?=" To: "Stephen Farrell" Cc: "ADD Mailing list" Date: Fri, 16 Aug 2019 08:04:17 +0200 X-Mailer: MailMate (1.12.5r5635) Message-ID: <74A2E5E0-02CE-4C9D-A66B-1D2FBC65B39A@frobbit.se> In-Reply-To: <400b774a-5bd0-d6f4-5640-e561f067a9b5@cs.tcd.ie> References: <400b774a-5bd0-d6f4-5640-e561f067a9b5@cs.tcd.ie> MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=_MailMate_57C7A4F6-ADB1-4C48-B336-EDA3FEE211D0_="; micalg=pgp-sha1; protocol="application/pgp-signature" Archived-At: Subject: Re: [Add] Use Cases - the coffee shop X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 06:04:24 -0000 This is an OpenPGP/MIME signed message (RFC 3156 and 4880). --=_MailMate_57C7A4F6-ADB1-4C48-B336-EDA3FEE211D0_= Content-Type: text/plain Content-Transfer-Encoding: quoted-printable On 15 Aug 2019, at 21:10, Stephen Farrell wrote: > I frankly don't believe that the hotel or similar > really care about choices of DNS recursive. They do when the legislation require certain actions by whoever provides = the service to the end user within the jurisdiction where the access is p= rovided. If they do not fulfil the requirements, legal actions are awaiti= ng the provider of the access service. Patrik --=_MailMate_57C7A4F6-ADB1-4C48-B336-EDA3FEE211D0_= Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iG0EARECAC0WIQRUH/cJI8i4DDUU3qWsxpsaC4jXzQUCXVZHYQ8ccGFmQGZyb2Ji aXQuc2UACgkQrMabGguI182CfgCdGuNo43ot9CNaYRJC5dFIL+YDAsYAnR0PbAcx GCDAPae2FqOkQVAcoGfE =XKpP -----END PGP SIGNATURE----- --=_MailMate_57C7A4F6-ADB1-4C48-B336-EDA3FEE211D0_=-- From nobody Thu Aug 15 23:11:15 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B26F412004D for ; Thu, 15 Aug 2019 23:11:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id npVNah71KFPF for ; Thu, 15 Aug 2019 23:11:11 -0700 (PDT) Received: from mail-yb1-xb2d.google.com (mail-yb1-xb2d.google.com [IPv6:2607:f8b0:4864:20::b2d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CF34812002E for ; Thu, 15 Aug 2019 23:11:11 -0700 (PDT) Received: by mail-yb1-xb2d.google.com with SMTP id y21so1609437ybi.11 for ; Thu, 15 Aug 2019 23:11:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=Udpargn+kS6z+X8SOmZb+J5navML4zqYMtc+ne+24xs=; b=ctbVSh+BY0cBAtrI23mOChIlmo5NRJK5Wc9o35PXNGu/+FNDsWPEOyZjA4vYarhHRN K8E4mgfPEioyY8Puk/20aDe6Mr8uk6qZyqrf6HPC0MpAdZKKtMYJ61vYsU1hvJSrxU2r 4OKJA77O2iPuG7CzClRSF8qV2aa0Dt/GL4NYOKsONKapT1I/9QsoiG/56ePQlNHjJ+F0 E5HuFZpYWkhVSuQB2p4jF6GpE2Arc/krafHenTaqqe8gkAyBp54T2y1fkK0RGE6CUBzv Vz/YxYP4B0S1ZqodcnzLHECIxJUPfxtMlrJTHz4N6bo/zdwA1aSbh5FizYEXIdj9W/zs ijaQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=Udpargn+kS6z+X8SOmZb+J5navML4zqYMtc+ne+24xs=; b=D4hzD0NGnm/YHWu9uA4Y3UIQcDK49J2VDVjHE+z/xaqXSlDujFYEdwyUx7Rv0usOhd FetlMhcNtEh1xoUW7wXRbgBcyqrnnjSSBTubaEvADUmc4ooTOL3NYTQt/jFHXLTA1h5D h0q0hLFdfOsxbZK8VH7iT1ROj2ZxZ/18FVdHB/Uo1zTtYrMy692ZiDiOG0BSCMQCQLEt gHUL86NJ4j/LSaM1A4sx3GuFkWLrPMKXf+0CQyfaguulPJgziw21n9q8TusjSkBCG73d miwlFY8Pjec8AHWxaomBtbLP1eeI89HJ6XNvQIz6dxpsG12cPtRUONYGmZvw1mcWZgh1 r4XQ== X-Gm-Message-State: APjAAAV0aRSjfaqADvV+X5q6NXkcK21rQjevOJUojV6ValMlepcnig8E DhBWOSYInkTLE77TL5GyWx31DMah6HUAKMfEtPg= X-Google-Smtp-Source: APXvYqxopL8d4FiyiY0AsBQvS351IPpVOEH0WabyZmRAPKUdFXlDeiV9DcsVjcG1KsF3YTKyPZd7uJBeC5dPWhsnMxM= X-Received: by 2002:a5b:5ce:: with SMTP id w14mr5803364ybp.25.1565935870800; Thu, 15 Aug 2019 23:11:10 -0700 (PDT) MIME-Version: 1.0 References: <400b774a-5bd0-d6f4-5640-e561f067a9b5@cs.tcd.ie> <74A2E5E0-02CE-4C9D-A66B-1D2FBC65B39A@frobbit.se> In-Reply-To: <74A2E5E0-02CE-4C9D-A66B-1D2FBC65B39A@frobbit.se> From: Alec Muffett Date: Fri, 16 Aug 2019 07:10:59 +0100 Message-ID: To: =?UTF-8?B?UGF0cmlrIEbDpGx0c3Ryw7Zt?= Cc: Stephen Farrell , ADD Mailing list Content-Type: multipart/alternative; boundary="00000000000051f9ad059035db78" Archived-At: Subject: Re: [Add] Use Cases - the coffee shop X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 06:11:14 -0000 --00000000000051f9ad059035db78 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Fri, 16 Aug 2019, 07:04 Patrik F=C3=A4ltstr=C3=B6m, wrote: > On 15 Aug 2019, at 21:10, Stephen Farrell wrote: > > > I frankly don't believe that the hotel or similar > > really care about choices of DNS recursive. > > They do when the legislation require certain actions by whoever provides > the service to the end user within the jurisdiction where the access is > provided. If they do not fulfil the requirements, legal actions are > awaiting the provider of the access service. If this were truly the case then why are hotels and cafes (etc) not routinely being prosecuted for failing to block Tor and VPN usage? -a --00000000000051f9ad059035db78 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Fri, 16 Aug 2019, 07:04 Patrik F=C3=A4ltstr=C3=B6m, <paf= =3D40frobbit.se@dmarc.ietf.o= rg> wrote:
On 15 Aug 2019, a= t 21:10, Stephen Farrell wrote:

> I frankly don't believe that the hotel or similar
> really care about choices of DNS recursive.

They do when the legislation require certain actions by whoever provides th= e service to the end user within the jurisdiction where the access is provi= ded. If they do not fulfil the requirements, legal actions are awaiting the= provider of the access service.
=
If this were truly the case then why are hotels= and cafes (etc) not routinely being prosecuted for failing to block Tor an= d VPN usage?

-a

--00000000000051f9ad059035db78-- From nobody Thu Aug 15 23:21:38 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 042A4120033 for ; Thu, 15 Aug 2019 23:21:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2gsbYHGt7P9M for ; Thu, 15 Aug 2019 23:21:34 -0700 (PDT) Received: from mail-io1-xd2b.google.com (mail-io1-xd2b.google.com [IPv6:2607:f8b0:4864:20::d2b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AE614120013 for ; Thu, 15 Aug 2019 23:21:34 -0700 (PDT) Received: by mail-io1-xd2b.google.com with SMTP id t6so4132907ios.7 for ; Thu, 15 Aug 2019 23:21:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=pnKWUjje4xLm7Ahn9oQOqAi9eZw/SlpYODlptpxytjU=; b=KrJaSEk7Xfus7E7LKWrWL+lEIrMCzAO1y3BVj8glv5cwXaNDHPt6OoSFB0qepMFtZE oDb4GLkulhxJBJQXrR/XlSRdgQ0RK8KHFYBpXXBYFWpYUZxsh0U6PQxpSPW1cTa6R4t+ t7Rcel7dv8a8aV87dxU74xBf618d/b1UMnmiA4LP+XxS0Z9MITFu/van29lVtMWiv0Ao WKI3107yENyuMq1QgRWCi/S9+NlHBR+1lCBgbJuopXl/3zwCqzu7hrvVpc5A+jXiWIoM YibmOPqR7CzOb9AOH7gZCluNeklTlaPofThffD0OrTPwWtgad/MLZKfjaON7lmoPZVac DDsw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=pnKWUjje4xLm7Ahn9oQOqAi9eZw/SlpYODlptpxytjU=; b=kzaASiewFkej1o5kT06nslXW3wSlhsZsMjfh/Rec6n04h7ayC7KhONQ0KZjt6Hu8CU NqSsBh3m4uq4XKqvn+LLVMQf3gdSijXsjclHcr1nA8bt1xJVIGgtywOKV8thK4bIDG9N OZEfIIes9atQ/ruvtHY0FYvdGG//S9e10BE8+J5+ZsrHG4I4NSy5hFr9FGqkkvMCDZ0G DpIzrdbCPvHRtjv/9JKvGtlqPzUazB0MnXKaDBh8iRs7J2IdCoCHBwjR+jSKwCzDhfle ri4bAen+8PUJXnoEuF0UuoY321kre3F5g7/yUmGZbgSvehScvhx0sh17aFfiFBkYbnaz JU5Q== X-Gm-Message-State: APjAAAUKNN++bffkHL8NTTFTY/fNpdTlw+IIXSFUm6I9k3r0CwYD7009 N3AbA5NUj7mZTP3HXvEeDqYv/lDQZCFK+mGhmBU= X-Google-Smtp-Source: APXvYqxHkW6Vef0mQ1nhlXrKzSAsugQaOB34z8C9KfPRYoBELx4/pM5+vYZ074ykDgtMypnVoJKuFikUrmBtOx9WcGc= X-Received: by 2002:a5e:d618:: with SMTP id w24mr9600307iom.73.1565936493910; Thu, 15 Aug 2019 23:21:33 -0700 (PDT) MIME-Version: 1.0 References: <400b774a-5bd0-d6f4-5640-e561f067a9b5@cs.tcd.ie> <74A2E5E0-02CE-4C9D-A66B-1D2FBC65B39A@frobbit.se> In-Reply-To: From: Rob Sayre Date: Thu, 15 Aug 2019 23:21:22 -0700 Message-ID: To: Alec Muffett Cc: =?UTF-8?B?UGF0cmlrIEbDpGx0c3Ryw7Zt?= , ADD Mailing list , Stephen Farrell Content-Type: multipart/alternative; boundary="00000000000075e0ec0590360060" Archived-At: Subject: Re: [Add] Use Cases - the coffee shop X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 06:21:37 -0000 --00000000000075e0ec0590360060 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Thu, Aug 15, 2019 at 11:11 PM Alec Muffett wrote: > On Fri, 16 Aug 2019, 07:04 Patrik F=C3=A4ltstr=C3=B6m, 40frobbit.se@dmarc.ietf.org> wrote: > >> On 15 Aug 2019, at 21:10, Stephen Farrell wrote: >> >> > I frankly don't believe that the hotel or similar >> > really care about choices of DNS recursive. >> >> They do when the legislation require certain actions by whoever provides >> the service to the end user within the jurisdiction where the access is >> provided. If they do not fulfil the requirements, legal actions are >> awaiting the provider of the access service. > > > If this were truly the case then why are hotels and cafes (etc) not > routinely being prosecuted for failing to block Tor and VPN usage? > Ah, yes. I looked into this issue a bit more. My Android phone automatically switches on a VPN if the WiFi access point is in their database and is open (no password, no portal). It turns out it is the default setting on the handset, because it's a Google Fi device. < https://mailarchive.ietf.org/arch/msg/add/exnClgsQMNmVU00v3fEUWBHR9WE> It doesn't seem like these "legal requirements" arguments are very up-to-date. thanks, Rob --00000000000075e0ec0590360060 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Thu, Aug 15, 2019 at 11:11 PM Alec Muf= fett <alec.muffett@gmail.com> wrote:
=
On Fri, 16 Aug 2019, 07:04 Patrik F= =C3=A4ltstr=C3=B6m, <paf=3D40frobbit.se@dmarc.ietf.org> wrote:
On 15 Aug 2019, at 21:10, St= ephen Farrell wrote:

> I frankly don't believe that the hotel or similar
> really care about choices of DNS recursive.

They do when the legislation require certain actions by whoever provides th= e service to the end user within the jurisdiction where the access is provi= ded. If they do not fulfil the requirements, legal actions are awaiting the= provider of the access service.
=
If this were truly the case then why are hotels= and cafes (etc) not routinely being prosecuted for failing to block Tor an= d VPN usage?

Ah, yes. I looked = into this issue a bit more. My Android phone automatically switches on a VP= N if the WiFi access point is in their database and is open (no password, n= o portal). It turns out it is the default setting on the handset, because i= t's a Google Fi device. <https://mailarchive.ietf.org/arch/ms= g/add/exnClgsQMNmVU00v3fEUWBHR9WE>

It doesn= 't seem like these "legal requirements" arguments are very up= -to-date.

thanks,
Rob


--00000000000075e0ec0590360060-- From nobody Thu Aug 15 23:42:59 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 99D041200FD for ; Thu, 15 Aug 2019 23:42:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.698 X-Spam-Level: X-Spam-Status: No, score=-2.698 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FROM_EXCESS_BASE64=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=frobbit.se Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ojxw4cdpwJOJ for ; Thu, 15 Aug 2019 23:42:55 -0700 (PDT) Received: from mail.frobbit.se (mail.frobbit.se [IPv6:2a02:80:3ffe::176]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6C75C120013 for ; Thu, 15 Aug 2019 23:42:54 -0700 (PDT) Received: from [192.165.72.241] (unknown [IPv6:2a02:80:3ffc:0:3170:f094:c31e:1467]) by mail.frobbit.se (Postfix) with ESMTPSA id EBB0220774; Fri, 16 Aug 2019 08:42:51 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=frobbit.se; s=mail; t=1565937772; bh=8+xmposqZAkbiQnzb0Z7CkrPqQ273Lx8d9iZ5e1dvpI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=FJKktnRTUI0sFRx3C8PmQD6R4mZxd21KaoMwmJJ3VMQEnWEGsp9seTkKACcVh9oEB fk2XG8EMQjerWYEtHieX8163BG5TBsxAg+V8PabSnVLjb7+p95wpPTlEKB7QwvY1f5 /CbDZHKEPrSENYfTDFcdOM7Co1VLisRIA2x6FyKU= From: "Patrik =?utf-8?b?RsOkbHRzdHLDtm0=?=" To: "Alec Muffett" Cc: "Stephen Farrell" , "ADD Mailing list" Date: Fri, 16 Aug 2019 08:42:50 +0200 X-Mailer: MailMate (1.12.5r5635) Message-ID: <3611F27A-49A9-4159-A683-3BBD4C2F91EA@frobbit.se> In-Reply-To: References: <400b774a-5bd0-d6f4-5640-e561f067a9b5@cs.tcd.ie> <74A2E5E0-02CE-4C9D-A66B-1D2FBC65B39A@frobbit.se> MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=_MailMate_DCA15C47-2938-4D97-8D9E-DD43BD8FB093_="; micalg=pgp-sha1; protocol="application/pgp-signature" Archived-At: Subject: Re: [Add] Use Cases - the coffee shop X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 06:42:58 -0000 This is an OpenPGP/MIME signed message (RFC 3156 and 4880). --=_MailMate_DCA15C47-2938-4D97-8D9E-DD43BD8FB093_= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On 16 Aug 2019, at 8:10, Alec Muffett wrote: > On Fri, 16 Aug 2019, 07:04 Patrik F=C3=A4ltstr=C3=B6m, 40frobbit.se@dmarc.ietf.org> wrote: > >> On 15 Aug 2019, at 21:10, Stephen Farrell wrote: >> >>> I frankly don't believe that the hotel or similar >>> really care about choices of DNS recursive. >> >> They do when the legislation require certain actions by whoever provid= es >> the service to the end user within the jurisdiction where the access i= s >> provided. If they do not fulfil the requirements, legal actions are >> awaiting the provider of the access service. > > If this were truly the case then why are hotels and cafes (etc) not rou= tinely being prosecuted for failing to block Tor and VPN usage? As have been said so many times on this list before, but it must be repea= ted obviously: Because the legislator believe the blocking access via manipulation of th= e recursive resolver is good enough. If it is not good enough anymore, then there must be a different way for = the access provider to block the access to the same domain names. Today we have the good situation that: - Legislation requires blocking to certain domain names - It is blocked by manipulation of recursive resolvers by the access prov= ider - Legislation believe this blocking is good enough - People can themselves set resolver to quadN or use VPN - Legislation ignores the easy way of circumvent the blocking If the legislator believe the action used is not good enough anymore, the= n we rise the bar regarding technical solutions for blocking and because = of that most certainly decrease the ability for the customer to override = the technical solution chosen by the access provider. Patrik --=_MailMate_DCA15C47-2938-4D97-8D9E-DD43BD8FB093_= Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iG0EARECAC0WIQRUH/cJI8i4DDUU3qWsxpsaC4jXzQUCXVZQag8ccGFmQGZyb2Ji aXQuc2UACgkQrMabGguI182gRACfahTpwuqi65KdRp4XYGCt+XYNfjEAn2xYY+Of tRM0izE5m+8E5X7ig0Oz =G6dn -----END PGP SIGNATURE----- --=_MailMate_DCA15C47-2938-4D97-8D9E-DD43BD8FB093_=-- From nobody Thu Aug 15 23:46:42 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D9EE812004D for ; Thu, 15 Aug 2019 23:46:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FROM_EXCESS_BASE64=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=frobbit.se Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CiBWi4wxogmp for ; Thu, 15 Aug 2019 23:46:38 -0700 (PDT) Received: from mail.frobbit.se (mail.frobbit.se [IPv6:2a02:80:3ffe::176]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 79407120013 for ; Thu, 15 Aug 2019 23:46:38 -0700 (PDT) Received: from [192.165.72.241] (unknown [IPv6:2a02:80:3ffc:0:3170:f094:c31e:1467]) by mail.frobbit.se (Postfix) with ESMTPSA id 8E7C721336; Fri, 16 Aug 2019 08:46:36 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=frobbit.se; s=mail; t=1565937996; bh=yHrmnVS7Jjj/OmFBtUe5a2lanNjRsWh33yXJceEb8Y0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=UprdTTrhBs6fRj0BbN1/7w53mR0U6S44hbsJeUmKt+V7LuT0Gr48KP07Gb+wY0hfG CuFEFbFXtrxYcKeNfFmalgExfK8M2K/UVCE/PSAaNPOemruJqnzwJRxKPIHD1DQ6wt lwIZge9Q0if3AvuLRFlphJ9LQTobGfVqu2+rNS50= From: "Patrik =?utf-8?b?RsOkbHRzdHLDtm0=?=" To: "Rob Sayre" Cc: "Alec Muffett" , "ADD Mailing list" , "Stephen Farrell" Date: Fri, 16 Aug 2019 08:46:36 +0200 X-Mailer: MailMate (1.12.5r5635) Message-ID: <7A1B4640-F865-47B7-8BEC-F6544CCE9101@frobbit.se> In-Reply-To: References: <400b774a-5bd0-d6f4-5640-e561f067a9b5@cs.tcd.ie> <74A2E5E0-02CE-4C9D-A66B-1D2FBC65B39A@frobbit.se> MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=_MailMate_BA0D5F90-5348-4608-B7A3-E35BB4CA7ED3_="; micalg=pgp-sha1; protocol="application/pgp-signature" Archived-At: Subject: Re: [Add] Use Cases - the coffee shop X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 06:46:40 -0000 This is an OpenPGP/MIME signed message (RFC 3156 and 4880). --=_MailMate_BA0D5F90-5348-4608-B7A3-E35BB4CA7ED3_= Content-Type: text/plain On 16 Aug 2019, at 8:21, Rob Sayre wrote: > It doesn't seem like these "legal requirements" arguments are very up-to-date. Do you see this as something positive or negative? Patrik --=_MailMate_BA0D5F90-5348-4608-B7A3-E35BB4CA7ED3_= Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iG0EARECAC0WIQRUH/cJI8i4DDUU3qWsxpsaC4jXzQUCXVZRTA8ccGFmQGZyb2Ji aXQuc2UACgkQrMabGguI1806lwCeNez4xTYjJ1UcWcVWKk04nRtLkDAAnRi+9Usy M9wBfr10acZ838WATBV+ =HFAA -----END PGP SIGNATURE----- --=_MailMate_BA0D5F90-5348-4608-B7A3-E35BB4CA7ED3_=-- From nobody Thu Aug 15 23:49:14 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C1CF6120033 for ; Thu, 15 Aug 2019 23:49:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yGO4BC_CA8Jc for ; Thu, 15 Aug 2019 23:49:10 -0700 (PDT) Received: from mail-io1-xd31.google.com (mail-io1-xd31.google.com [IPv6:2607:f8b0:4864:20::d31]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 95B0A120013 for ; Thu, 15 Aug 2019 23:49:10 -0700 (PDT) Received: by mail-io1-xd31.google.com with SMTP id z3so4240732iog.0 for ; Thu, 15 Aug 2019 23:49:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=Whbc+f/PSSN1qsr65vNBYBxsQ1SjusUbW3klIWYxLsk=; b=hZyUKuk4V5jCs4zeB7CpIcyIoQvcR0U3M7n2ebTRBHQjT28p9RUOXE8AULh32TMSnX HdoqhitxDoQg7EM1Xth29pjdtoCSVbq29U4iKDQVdh7vmBg+tGdqKLZ5GEX+IQDZkxtB cDlCokMH/Dd4YIV8IbHpZsVRRaBCFsAa9FIxB2wExEU778jVFUYZJK3nEd7Vo2UyZsJs RJ8+8BRGRTD2Jsa1DSBqjPyivV1w0x7FV0mTJTJLh7Q4buK9IDzY3+uzLBVHT9DUUCk4 3A3WJ8TJkK7o2TwfrlDTcm1xTgfQQDTkJWC2SXT6Ya3+cR8pVm5C8va3WJDNzGYY7+fa +tYg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=Whbc+f/PSSN1qsr65vNBYBxsQ1SjusUbW3klIWYxLsk=; b=l3RtCN1EOoaOK2lkBbCz3Mfo1lS29dVi+z+E5lsqLVR4U57tMr33htpGl9mLF9TGr/ Nv1l7o+1kl4XjA9ulHbgvPNSxumlYbkaIxs7qZ8UJeDkBG/9yBDPgeUaEUvM7N619OVF vcDiJldi2QGLh2WF+kGW4jR2ikcmn/iM4Snc+QJnoYHu20B5N1Ow8tEtE1yW5W1a2o0p LPceG6GNnRKl9w0qB6m+AWcgAWUrswibkM8hIFgAXUAEVPjiMKAb96ltLS98YE7nS32S Gh8X1ftkyDQLnmKFOG9LHNfRCwzZnnfi9/xwSElYK3bJW7cPkAce9IZnE+2zfrVIqwz/ wCzA== X-Gm-Message-State: APjAAAXXLsIfBZ3cdt0Bpkl2Epav7u+CIF/nSshpkarRxtW8ekEo8wAn JJmfBGVkCL3/Gnv0wRkjbVYD9dDW5Tg4Er/1YH4= X-Google-Smtp-Source: APXvYqyTSOFh92+kGAaF0/7GwKJvgAz+zFx8WMsHSZXxEQJ1DuzXBOz8apaTvkosEY1Vs6Sy2OooM4LtbiPUbrxYZA0= X-Received: by 2002:a5e:d618:: with SMTP id w24mr9687574iom.73.1565938149808; Thu, 15 Aug 2019 23:49:09 -0700 (PDT) MIME-Version: 1.0 References: <400b774a-5bd0-d6f4-5640-e561f067a9b5@cs.tcd.ie> <74A2E5E0-02CE-4C9D-A66B-1D2FBC65B39A@frobbit.se> <3611F27A-49A9-4159-A683-3BBD4C2F91EA@frobbit.se> In-Reply-To: <3611F27A-49A9-4159-A683-3BBD4C2F91EA@frobbit.se> From: Rob Sayre Date: Thu, 15 Aug 2019 23:48:58 -0700 Message-ID: To: =?UTF-8?B?UGF0cmlrIEbDpGx0c3Ryw7Zt?= Cc: Alec Muffett , ADD Mailing list , Stephen Farrell Content-Type: multipart/alternative; boundary="00000000000028e05f059036637e" Archived-At: Subject: Re: [Add] Use Cases - the coffee shop X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 06:49:13 -0000 --00000000000028e05f059036637e Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Thu, Aug 15, 2019 at 11:43 PM Patrik F=C3=A4ltstr=C3=B6m wrote: > If the legislator believe the action used is not good enough anymore, the= n > we rise the bar regarding technical solutions for blocking and because of > that most certainly decrease the ability for the customer to override the > technical solution chosen by the access provider. > This doesn't seem like a very good argument for leaving DNS unencrypted. It's true that government could impose restrictions beyond what we see today in DNS polices, but they already seem to do that in many places. It seems like a net win if the regulators ratchet up enforcement to get the same result they have now, but various common criminals are thwarted (see < https://mailarchive.ietf.org/arch/msg/add/NIk8gIPZu52GXDsT8zy4S1I4QsM>). thanks, Rob --00000000000028e05f059036637e Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Thu, Aug 15, 2019 at 11:43 PM Patrik F= =C3=A4ltstr=C3=B6m <paf=3D40frobbit.se@dmarc.ietf.org> wrote:
If the legislator believe the action used is not good enough anymore, then = we rise the bar regarding technical solutions for blocking and because of t= hat most certainly decrease the ability for the customer to override the te= chnical solution chosen by the access provider.

This doesn't seem like a very good argument for leaving DNS un= encrypted. It's true that government could impose restrictions beyond w= hat we see today in DNS polices, but they already seem to do that in many p= laces.

It seems like a net win if the regulators r= atchet up enforcement to get the same result they have now, but various com= mon criminals are thwarted (see <
https://mailarchive.ietf.o= rg/arch/msg/add/NIk8gIPZu52GXDsT8zy4S1I4QsM>).

thanks,
Rob
--00000000000028e05f059036637e-- From nobody Thu Aug 15 23:52:23 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C6A8212002E for ; Thu, 15 Aug 2019 23:52:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.698 X-Spam-Level: X-Spam-Status: No, score=-2.698 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FROM_EXCESS_BASE64=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=frobbit.se Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id e-tGk-AuWZz7 for ; Thu, 15 Aug 2019 23:52:18 -0700 (PDT) Received: from mail.frobbit.se (mail.frobbit.se [IPv6:2a02:80:3ffe::176]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 97A481200B4 for ; Thu, 15 Aug 2019 23:52:18 -0700 (PDT) Received: from [192.165.72.241] (unknown [IPv6:2a02:80:3ffc:0:3170:f094:c31e:1467]) by mail.frobbit.se (Postfix) with ESMTPSA id 8CA4321818; Fri, 16 Aug 2019 08:52:16 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=frobbit.se; s=mail; t=1565938336; bh=w2cwI85EjlU2jKZij+o+/iI9WAkRHJX9+1nn4sNf+hg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=f7g8WzVsJ7EufcmWwxzmsBgZs9FU+bx491rTtTP1lj0LeKFD1MLIf1JSS4JKOHBjL o59CxXXawnf1YGLSQ8puzC+lM+zZr5x8vAg/MsZeL3KYQNYOfZVzOSbUhZ0pqeNU+V owgndlPUXHVL/k1XGyXTuz5Nla++9eJxH4Cb2lwo= From: "Patrik =?utf-8?b?RsOkbHRzdHLDtm0=?=" To: "Rob Sayre" Cc: "Alec Muffett" , "ADD Mailing list" , "Stephen Farrell" Date: Fri, 16 Aug 2019 08:52:15 +0200 X-Mailer: MailMate (1.12.5r5635) Message-ID: <27D94F9B-8B74-4C9F-B8BC-B2A730647011@frobbit.se> In-Reply-To: References: <400b774a-5bd0-d6f4-5640-e561f067a9b5@cs.tcd.ie> <74A2E5E0-02CE-4C9D-A66B-1D2FBC65B39A@frobbit.se> <3611F27A-49A9-4159-A683-3BBD4C2F91EA@frobbit.se> MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=_MailMate_B92C435D-9119-4A1A-A675-953D90F97104_="; micalg=pgp-sha1; protocol="application/pgp-signature" Archived-At: Subject: Re: [Add] Use Cases - the coffee shop X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 06:52:21 -0000 This is an OpenPGP/MIME signed message (RFC 3156 and 4880). --=_MailMate_B92C435D-9119-4A1A-A675-953D90F97104_= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On 16 Aug 2019, at 8:48, Rob Sayre wrote: > On Thu, Aug 15, 2019 at 11:43 PM Patrik F=C3=A4ltstr=C3=B6m 40frobbit.se@dmarc.ietf.org> wrote: > >> If the legislator believe the action used is not good enough anymore, = then >> we rise the bar regarding technical solutions for blocking and because= of >> that most certainly decrease the ability for the customer to override = the >> technical solution chosen by the access provider. >> > > This doesn't seem like a very good argument for leaving DNS unencrypted= =2E > It's true that government could impose restrictions beyond what we see = today in DNS polices, but they already seem to do that in many places. > > It seems like a net win if the regulators ratchet up enforcement to get= the same result they have now, but various common criminals are thwarted= (see < > https://mailarchive.ietf.org/arch/msg/add/NIk8gIPZu52GXDsT8zy4S1I4QsM>)= =2E I am not arguing in favor of leaving DNS unencrypted. Definitely not. I a= m strongly in favor of encryption of the DNS queries, like DoT. On top of= local validation of DNSSEC signed responses in the client so that the cl= ient do know whether modification of the responses have happened. What I am talking about is the full service resolver. Who runs it, who se= t the default full service resolver, whether this is part of "the access = product or not", and who requires the modification of the responses at th= e end point of the encrypted tunnel used for the DNS queries. Patrik --=_MailMate_B92C435D-9119-4A1A-A675-953D90F97104_= Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iG0EARECAC0WIQRUH/cJI8i4DDUU3qWsxpsaC4jXzQUCXVZSnw8ccGFmQGZyb2Ji aXQuc2UACgkQrMabGguI180ahwCeODrzEmnxdfG9ZW68xsqlYX1gNaIAnAsNXSYi zAJyNK2WUh7N5lSmi0Ir =yxlS -----END PGP SIGNATURE----- --=_MailMate_B92C435D-9119-4A1A-A675-953D90F97104_=-- From nobody Thu Aug 15 23:56:28 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 55B60120033 for ; Thu, 15 Aug 2019 23:56:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=tele.no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nNJjUPr6U_Yq for ; Thu, 15 Aug 2019 23:56:24 -0700 (PDT) Received: from gorgon.tele.no (gorgon.tele.no [IPv6:2001:700:800::70]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 70F1C12002E for ; Thu, 15 Aug 2019 23:56:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=tele.no; s=20180731; h=Content-Transfer-Encoding:Content-Type:In-Reply-To:MIME-Version :Date:Message-ID:From:References:Cc:To:Subject:Sender:Reply-To:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=uEWMvCmp7T9ZocrVzFI+zHLTPYU/jCdvOwUJJsl8waM=; b=QSMOjwelmRLGOwrU4e6WHS+KSa FFBmaoR/AmA/I/guP4ckgPPl631r8KiA3lZstcsBWFJk3ENa3D4NiJ8LzTFNPcD4h7G/22t/j8a78 dFGNFiAucw2VB4qyPqDYscm4YyoJAX+Bt/KCPtt7mZyMxUfI7MSFPXK1aEDeu5MM42FVBYO2N9Xi3 11MNDVQ6pcnOG/EEEArcKOfXt0pUJVGcWTSr3EPbUktamgufaRmScHb7hxjX0j9ux0SItw7Ri7v6L qfgDRbqG1DqY3Qxtk3QlYF6hcOncCb9eEtr1SevLvf1moEGWgWMnzy7Ym1n0XME9PO1dTKf6l2zY/ lkOjibGw==; Received: from pilt1.tele.no ([2001:700:800::20] helo=[IPv6:::1]) by gorgon.tele.no with esmtp (Exim 4.92) (envelope-from ) id 1hyW9t-000487-Qj; Fri, 16 Aug 2019 08:56:21 +0200 To: Bret Jordan Cc: ADD Mailing list References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <8e00891f-2aa2-ee11-559a-b5a8967b22d9@nostrum.com> <2C23D415-84F9-4B6C-B67B-0CC3EB600520@gmail.com> <2704899B-E43D-4978-A3C9-30E9E7CEBEBD@fugue.com> <4CC4C262-BEF4-4B39-ACB1-A595AB66D6CD@gmail.com> From: Frode Kileng Message-ID: Date: Fri, 16 Aug 2019 08:56:21 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: <4CC4C262-BEF4-4B39-ACB1-A595AB66D6CD@gmail.com> Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Content-Language: en-US Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 06:56:27 -0000 On 15/08/2019 23:58, Bret Jordan wrote: > If you say that the parental controls you have signed up for and paid > money for are no longer going to work, you might get a different answer. There are numerous other client-side child-safe products in the markets that will continue to work perfectly well. Please please stop using this "save the children" argument that has been fronted by the "anti-encryption camp" for the last 5 years. frodek From nobody Fri Aug 16 00:00:47 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B811B1200B4 for ; Fri, 16 Aug 2019 00:00:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CnOknuf7vfm1 for ; Fri, 16 Aug 2019 00:00:41 -0700 (PDT) Received: from mail-io1-xd2d.google.com (mail-io1-xd2d.google.com [IPv6:2607:f8b0:4864:20::d2d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C062C12002E for ; Fri, 16 Aug 2019 00:00:41 -0700 (PDT) Received: by mail-io1-xd2d.google.com with SMTP id x4so4266556iog.13 for ; Fri, 16 Aug 2019 00:00:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=QBzd9x+4PvgXwuBTSQzBBShvbBIXdZdlCLVugMqi4F0=; b=rYSCkZwEzW2xcLnLdDBmjTnPbdxBark7SD3phql1etzi6ElXUjHgFHIxc0QqwbRNDd kGiCR1+zpHfatch9tacTpoLcmFu5mZDeTWVyz1F/oDLgAKFZlAvgRhitTfS0NvktEmTV pBvsi9X5s4xoM6drFM5EkWtfPHPAiTzzi5AaUvPXN1gAzpcKeS1mhtrePaiKo4HcXbG6 w/JkylnM21RmBzpK/do1uQZOZD/439Bt3fGCT9mFZ2TISQx/wYubLssXPT2OW1vKeFWx lksD5OY3nxCKRg5A++BSYcBMhMc2mTCkHcLts3Cqsbbf+3OeDdxfw5XZkXxB+IAh/Zpr eiBw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=QBzd9x+4PvgXwuBTSQzBBShvbBIXdZdlCLVugMqi4F0=; b=NtNKHRM3ku4MU3FuE9RbP22gxeFBkSsVc/HfIOcQjogIUkGvCHOZAn8BahJSs5lLBq tqHT+5FzO07AmSGpuytssqrRzZFFEG9TXF48AEWZ/bw7OSuaa+xL8coQ1yje8FkElOMs Cy3qkV4qUPPqLMUgthQHK2bLTjtJYPYP6A0wGcyAMZcrqJYC0+f6EIbPzmNZZwvPzjHQ BvetyEKzgBDl63eIyCDkCP2Rh2le+CzHw6iwA8lsxd/ayqN1ZbsFiIKWz8ARoARnfI1P s2a5XI4F3mDmoKlD6XVjRoA3Glz3PgJM6+QUWdZjWxq5Bkk6ynfpgsjDK1CPUO6h4zKT Tiuw== X-Gm-Message-State: APjAAAUx+dC6GHM0gGiFgTdCp8ZO6xt9hB4FvT9kdz7QKuhXAseKVuTl kzLNPp3AthA4To3mhBzFkgAxJ8FeOYuIYM6zvGA= X-Google-Smtp-Source: APXvYqxkmwd14KJbFFoBvcBUarxXBueruRWpbPrs+hT77mIXbU7X6F//KTgInNzeJK+PpeJaRoqeTDGAWfX5w2Bvn2c= X-Received: by 2002:a02:1a86:: with SMTP id 128mr9341156jai.95.1565938840936; Fri, 16 Aug 2019 00:00:40 -0700 (PDT) MIME-Version: 1.0 References: <400b774a-5bd0-d6f4-5640-e561f067a9b5@cs.tcd.ie> <74A2E5E0-02CE-4C9D-A66B-1D2FBC65B39A@frobbit.se> <3611F27A-49A9-4159-A683-3BBD4C2F91EA@frobbit.se> <27D94F9B-8B74-4C9F-B8BC-B2A730647011@frobbit.se> In-Reply-To: <27D94F9B-8B74-4C9F-B8BC-B2A730647011@frobbit.se> From: Rob Sayre Date: Fri, 16 Aug 2019 00:00:29 -0700 Message-ID: To: =?UTF-8?B?UGF0cmlrIEbDpGx0c3Ryw7Zt?= Cc: Alec Muffett , ADD Mailing list , Stephen Farrell Content-Type: multipart/alternative; boundary="0000000000005aa5570590368c64" Archived-At: Subject: Re: [Add] Use Cases - the coffee shop X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 07:00:45 -0000 --0000000000005aa5570590368c64 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Thu, Aug 15, 2019 at 11:52 PM Patrik F=C3=A4ltstr=C3=B6m wrote: > On 16 Aug 2019, at 8:48, Rob Sayre wrote: > > > On Thu, Aug 15, 2019 at 11:43 PM Patrik F=C3=A4ltstr=C3=B6m > 40frobbit.se@dmarc.ietf.org> wrote: > > > >> If the legislator believe the action used is not good enough anymore, > then > >> we rise the bar regarding technical solutions for blocking and because > of > >> that most certainly decrease the ability for the customer to override > the > >> technical solution chosen by the access provider. > >> > > > > This doesn't seem like a very good argument for leaving DNS unencrypted= . > > It's true that government could impose restrictions beyond what we see > today in DNS polices, but they already seem to do that in many places. > > > > It seems like a net win if the regulators ratchet up enforcement to get > the same result they have now, but various common criminals are thwarted > (see < > > https://mailarchive.ietf.org/arch/msg/add/NIk8gIPZu52GXDsT8zy4S1I4QsM>)= . > > I am not arguing in favor of leaving DNS unencrypted. Definitely not. > I see. I apologize for misrepresenting your opinion. > > What I am talking about is the full service resolver. Who runs it, who se= t > the default full service resolver, whether this is part of "the access > product or not", and who requires the modification of the responses at th= e > end point of the encrypted tunnel used for the DNS queries. > I think these are all valid questions, but they veer into OS APIs, business deals (pre-install deals are big business), etc. They seem to be valid concerns, but not something for a protocol SDO to get involved in. thanks, Rob --0000000000005aa5570590368c64 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Thu, Aug 15, 2019 at 11:52 PM Patr= ik F=C3=A4ltstr=C3=B6m <paf@frobbit.se= > wrote:
= On 16 Aug 2019, at 8:48, Rob Sayre wrote:

> On Thu, Aug 15, 2019 at 11:43 PM Patrik F=C3=A4ltstr=C3=B6m <paf=3D=
> 40fro= bbit.se@dmarc.ietf.org> wrote:
>
>> If the legislator believe the action used is not good enough anymo= re, then
>> we rise the bar regarding technical solutions for blocking and bec= ause of
>> that most certainly decrease the ability for the customer to overr= ide the
>> technical solution chosen by the access provider.
>>
>
> This doesn't seem like a very good argument for leaving DNS unencr= ypted.
> It's true that government could impose restrictions beyond what we= see today in DNS polices, but they already seem to do that in many places.=
>
> It seems like a net win if the regulators ratchet up enforcement to ge= t the same result they have now, but various common criminals are thwarted = (see <
> https://mailarchive.ietf.o= rg/arch/msg/add/NIk8gIPZu52GXDsT8zy4S1I4QsM>).

I am not arguing in favor of leaving DNS unencrypted. Definitely not.

I see. I apologize for misrepresenting your = opinion.
=C2=A0

What I am talking about is the full service resolver. Who runs it, who set = the default full service resolver, whether this is part of "the access= product or not", and who requires the modification of the responses a= t the end point of the encrypted tunnel used for the DNS queries.

I think these are all valid questions, but they = veer into OS APIs, business deals (pre-install deals are big business), etc= . They seem to be valid concerns, but not something for a protocol SDO to g= et involved in.

thanks,
Rob
<= /div> --0000000000005aa5570590368c64-- From nobody Fri Aug 16 00:01:25 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 70E2F1200F3 for ; Fri, 16 Aug 2019 00:01:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uOanx88SBgjT for ; Fri, 16 Aug 2019 00:01:20 -0700 (PDT) Received: from mail-yb1-xb30.google.com (mail-yb1-xb30.google.com [IPv6:2607:f8b0:4864:20::b30]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 480A31200B4 for ; Fri, 16 Aug 2019 00:01:20 -0700 (PDT) Received: by mail-yb1-xb30.google.com with SMTP id t5so1659255ybt.4 for ; Fri, 16 Aug 2019 00:01:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=czM3dLAPmX9msnkAKpSUEyd9kI/Li0F8GyqNN4Lisxw=; b=j+h10WfAngNQRF3kBi+LpkBBJTctTU0/hSOQxnPO3fyZtMHwFRMJHL+UJWuJy8TZ4q X/vGSp6FfTqMEuBTXFrAmwlCnqoUQX1eKrXjYEb0uAsYbhI3sl/+bUEna4kl2ukhpI/o 4oM0tILANOZgYBh5LGIOtwKqdCo8jnvaOAS0vTu/nD6gbtvCl/NGnzKlOKeYfqVzzE1t kcueEA+HAaD2bTu4vb+yilShxmMq0QXEXXwmKKh8n3DSWGEKztHVoOZ/lO5cHev2AeoW IoJdR02znOt8sEf3kVJkE4IAxpGp8mQnxm5gX57Qs59+lNMf7lVm1tXg/m74Rtjti9rU 76OA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=czM3dLAPmX9msnkAKpSUEyd9kI/Li0F8GyqNN4Lisxw=; b=NzTQajV82exOXDUUo04Kx95mv7jF6lxd8yiQjoJrnwDLkSOjDxZvLSaHs70ux2NMgo +c4219kDXTgbe2S3hm3630ezKkIHCSWNa3FpAG3cFEbbyypBMVNiukgZBsU8ifVJxm9e uTCrIaobuJqWOFJetlzgEemTQEemCQRgWXoU0TrBwdjFOXAOIe2p/s9DL2SPBht7a+ns Uvb7ZZ1XfVtLhwWDtPGk/GsGx9wrgAn1Qa2+x/xCl1/qiMN+xmUHZlJZGVt4GN65otMg 7wUnSCDLVlpJuPhLCZg8mx+KPV2BNjphZR4tbw4frgSOWxsT/fd22o55ohiQrR19u0Ju aWHQ== X-Gm-Message-State: APjAAAVaNYVXnzt4aSddANPN6fk+ZauSv69jHdhWJLL/oJ3Th1IKApnC mHpolTWeVjfnqoKfGmvL/rwjSsQ4yOJQ5UYWRb3ygQ== X-Google-Smtp-Source: APXvYqyXrUOHFBq44DfZ1LhtuMKEkx8qyvPWXYbOlP/c7ytwZv1re1z9xUetzC9lWBflDEqz0ILE7vmrpX0vvZ3kTXE= X-Received: by 2002:a5b:5ce:: with SMTP id w14mr5890447ybp.25.1565938879357; Fri, 16 Aug 2019 00:01:19 -0700 (PDT) MIME-Version: 1.0 References: <400b774a-5bd0-d6f4-5640-e561f067a9b5@cs.tcd.ie> <74A2E5E0-02CE-4C9D-A66B-1D2FBC65B39A@frobbit.se> <3611F27A-49A9-4159-A683-3BBD4C2F91EA@frobbit.se> In-Reply-To: <3611F27A-49A9-4159-A683-3BBD4C2F91EA@frobbit.se> From: Alec Muffett Date: Fri, 16 Aug 2019 08:01:08 +0100 Message-ID: To: =?UTF-8?B?UGF0cmlrIEbDpGx0c3Ryw7Zt?= Cc: Stephen Farrell , ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000a4e8ce0590368ea5" Archived-At: Subject: Re: [Add] Use Cases - the coffee shop X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 07:01:23 -0000 --000000000000a4e8ce0590368ea5 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Fri, 16 Aug 2019, 07:42 Patrik F=C3=A4ltstr=C3=B6m, wro= te: > > Because the legislator believe the blocking access via manipulation of th= e > recursive resolver is good enough. > But it's *not* good enough, is it? Anyone can access Tor, and VPNs are extremely popular. On that basis, why are you not lobbying your legislators to crack down on this existing and popular hazard? Evidence: https://www.facebook.com/notes/facebook-over-tor/1-million-people-use-faceb= ook-over-tor/865624066877648/ (disclosure: I had the honour of authoring this) https://thewirecutter.com/reviews/best-vpn-service/ If "DNS lookup filtration" serves as some kind of checkbox censorship in order to satisfy the censorious, then it will continue to do that. Otherwise, if you are willing to accept that VPNs already exist, and that technology will always advance in order to give people more privacy, what _is_ the problem here? -a --000000000000a4e8ce0590368ea5 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


On Fri, 16 Aug 2019, 07:42 Patrik F=C3=A4ltstr=C3=B6m,= <paf@frobbit.se> wrote:
<= blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px= #ccc solid;padding-left:1ex">
Because the legislator believe the blocking access via manipulation of the = recursive resolver is good enough.

But it's *not* good enough, is it? An= yone can access Tor, and VPNs are extremely popular.

On that basis, why are you not lobbying your l= egislators to crack down on this existing and popular hazard?

Evidence:

=
https://w= ww.facebook.com/notes/facebook-over-tor/1-million-people-use-facebook-over-= tor/865624066877648/ (disclosure: I had the honour of authoring this)


= If "DNS lookup filtration" serves as some kind of checkbox censor= ship in order to satisfy the censorious, then it will continue to do that.<= /div>

Otherwise, if you are wi= lling to accept that VPNs already exist, and that technology will always ad= vance in order to give people more privacy, what _is_ the problem here?

-a
<= br>
--000000000000a4e8ce0590368ea5-- From nobody Fri Aug 16 00:01:42 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 69C9C1200F3 for ; Fri, 16 Aug 2019 00:01:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QGe2_Hnl7g8t for ; Fri, 16 Aug 2019 00:01:38 -0700 (PDT) Received: from smtp.guxx.net (smtp.guxx.net [IPv6:2a01:4f8:a0:322c::25:42]) by ietfa.amsl.com (Postfix) with ESMTP id C6D8112002E for ; Fri, 16 Aug 2019 00:01:37 -0700 (PDT) Received: by nyx.guxx.net (Postfix, from userid 107) id C93C55F4234D; Fri, 16 Aug 2019 09:01:36 +0200 (CEST) Received: from [192.168.2.190] (p54B8ABDF.dip0.t-ipconnect.de [84.184.171.223]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by nyx.guxx.net (Postfix) with ESMTPSA id E25635F4224B; Fri, 16 Aug 2019 09:01:35 +0200 (CEST) From: "Ralf Weber" To: "Rob Sayre" Cc: "Dave Lawrence" , "ADD Mailing list" Date: Fri, 16 Aug 2019 09:01:35 +0200 X-Mailer: MailMate (1.12.5r5635) Message-ID: In-Reply-To: References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <8e00891f-2aa2-ee11-559a-b5a8967b22d9@nostrum.com> <2C23D415-84F9-4B6C-B67B-0CC3EB600520@gmail.com> <23893.59415.370880.54691@gro.dd.org> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 07:01:41 -0000 Moin! On 16 Aug 2019, at 7:35, Rob Sayre wrote: > The author of that reply writes: "Most bizarrely perhaps, is that > DNSSEC > provides no end-to-end security. Your browser or OS still communicates > with > your resolver using regular queries, relying on a single > unauthenticated > bit to 'request' validation. It's as if LAN/wifi-level abuse wasn't a > concern at all, or that public resolvers (like OpenDNS and Google > Public > DNS) didn't exist." Well the ideal scenario would be that the end client like the browser would validate DNSSEC. However Browser vendors don’t seem to have interest in that. See the thread on “Mozilla's DoH resolver policy” from April on this mailing list for that. DNSSEC provides end to end security if implemented properly. > > These attacks do in fact happen (see < > https://mailarchive.ietf.org/arch/msg/add/NIk8gIPZu52GXDsT8zy4S1I4QsM>), > so > it seems like DoT/DoH would be one step in improving DNSSEC > reliability. DoH certainly can help to protect the connection between the recursive resolver and the the stub, as would DoT. However for authenticity that would not be needed if the client performed DNSSEC validation. So long -Ralf —- Ralf Weber From nobody Fri Aug 16 00:09:55 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7F1061200FD for ; Fri, 16 Aug 2019 00:09:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FROM_EXCESS_BASE64=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=frobbit.se Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id G5nhkYknQT2O for ; Fri, 16 Aug 2019 00:09:51 -0700 (PDT) Received: from mail.frobbit.se (mail.frobbit.se [85.30.129.176]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7C39A12002E for ; Fri, 16 Aug 2019 00:09:51 -0700 (PDT) Received: from [192.165.72.241] (unknown [IPv6:2a02:80:3ffc:0:3170:f094:c31e:1467]) by mail.frobbit.se (Postfix) with ESMTPSA id B1F761FE67; Fri, 16 Aug 2019 09:09:48 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=frobbit.se; s=mail; t=1565939388; bh=I9hJ/TZsZe/mwHi97C9Tt+ZMmTLh8yltuj5SgQ+DjrE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=u7QdjOVhexsUWFEtVCQEqRE3neREfSSsy+rNAB/Om8qoWPGW147yJxt7+zHBMz1lP PgAmwM6nxRXHRRAt2SwOysy4d/8zFQGLX1uQYDNjf3gji4NIC6qB5yOCL0i909Cmcz LVxKvYewlIxuyaHEORpzOpdK9QyYXwdhqW3PgCgM= From: "Patrik =?utf-8?b?RsOkbHRzdHLDtm0=?=" To: "Alec Muffett" Cc: "Stephen Farrell" , "ADD Mailing list" Date: Fri, 16 Aug 2019 09:09:47 +0200 X-Mailer: MailMate (1.12.5r5635) Message-ID: <904F4219-8BDE-4272-BFDA-20F38D58CB80@frobbit.se> In-Reply-To: References: <400b774a-5bd0-d6f4-5640-e561f067a9b5@cs.tcd.ie> <74A2E5E0-02CE-4C9D-A66B-1D2FBC65B39A@frobbit.se> <3611F27A-49A9-4159-A683-3BBD4C2F91EA@frobbit.se> MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=_MailMate_6518AED6-46F9-47EA-AFC0-E7A63F45B713_="; micalg=pgp-sha1; protocol="application/pgp-signature" Archived-At: Subject: Re: [Add] Use Cases - the coffee shop X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 07:09:54 -0000 This is an OpenPGP/MIME signed message (RFC 3156 and 4880). --=_MailMate_6518AED6-46F9-47EA-AFC0-E7A63F45B713_= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On 16 Aug 2019, at 9:01, Alec Muffett wrote: > On Fri, 16 Aug 2019, 07:42 Patrik F=C3=A4ltstr=C3=B6m, <[paf@frobbit.se= ]()> wrote: > >> Because the legislator believe the blocking access via manipulation o= f the recursive resolver is good enough. > > But it's *not* good enough, is it? Anyone can access Tor, and VPNs are = extremely popular. No, it *is* good enough. > On that basis, why are you not lobbying your legislators to crack down = on this existing and popular hazard? The legislator do not care. They require the access provider to ensure th= ey have blocking which is "good enough". If the legislator one day believ= e the use of Tor and other mechanisms is too high (so that the mechanisms= the access provider have implemented is not good enough) they just tell = the access provider to "do better, or else you get a fine". The legislator just do not care. Its the access provider that is nervous = over some DoH arguments. Patrik --=_MailMate_6518AED6-46F9-47EA-AFC0-E7A63F45B713_= Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iG0EARECAC0WIQRUH/cJI8i4DDUU3qWsxpsaC4jXzQUCXVZWuw8ccGFmQGZyb2Ji aXQuc2UACgkQrMabGguI182PmwCcCIN+YY1XdxawFO67WtRKsmlmoX0AnifmyyeY vWFn3iTuBTPIy1D567I3 =le5I -----END PGP SIGNATURE----- --=_MailMate_6518AED6-46F9-47EA-AFC0-E7A63F45B713_=-- From nobody Fri Aug 16 00:19:07 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8526A120033 for ; Fri, 16 Aug 2019 00:19:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.199 X-Spam-Level: X-Spam-Status: No, score=-4.199 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1ntMLWm53q91 for ; Fri, 16 Aug 2019 00:19:05 -0700 (PDT) Received: from giant.haxx.se (www.haxx.se [IPv6:2a00:1a28:1200:9::2]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A55E8120044 for ; Fri, 16 Aug 2019 00:19:04 -0700 (PDT) Received: from giant.haxx.se (mail [127.0.0.1]) by giant.haxx.se (8.15.2/8.15.2/Debian-4) with ESMTPS id x7G7Iuws028137 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 16 Aug 2019 09:18:56 +0200 Received: from localhost (dast@localhost) by giant.haxx.se (8.15.2/8.15.2/Submit) with ESMTP id x7G7IuJ9028133; Fri, 16 Aug 2019 09:18:56 +0200 X-Authentication-Warning: giant.haxx.se: dast owned process doing -bs Date: Fri, 16 Aug 2019 09:18:56 +0200 (CEST) From: Daniel Stenberg X-X-Sender: dast@giant.haxx.se To: =?ISO-8859-15?Q?Patrik_F=E4ltstr=F6m?= cc: Alec Muffett , ADD Mailing list , Stephen Farrell In-Reply-To: <904F4219-8BDE-4272-BFDA-20F38D58CB80@frobbit.se> Message-ID: References: <400b774a-5bd0-d6f4-5640-e561f067a9b5@cs.tcd.ie> <74A2E5E0-02CE-4C9D-A66B-1D2FBC65B39A@frobbit.se> <3611F27A-49A9-4159-A683-3BBD4C2F91EA@frobbit.se> <904F4219-8BDE-4272-BFDA-20F38D58CB80@frobbit.se> User-Agent: Alpine 2.20 (DEB 67 2015-01-07) X-fromdanielhimself: yes MIME-Version: 1.0 Content-Type: multipart/mixed; BOUNDARY="1129329158-517903539-1565939936=:6529" Archived-At: Subject: Re: [Add] Use Cases - the coffee shop X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 07:19:06 -0000 This message is in MIME format. The first part should be readable text, while the remaining parts are likely unreadable without MIME-aware tools. --1129329158-517903539-1565939936=:6529 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8BIT On Fri, 16 Aug 2019, Patrik Fältström wrote: > The legislator just do not care. Its the access provider that is nervous > over some DoH arguments. User-controlled resolver configuration you mean? Since I'm pretty sure most coffee shops don't intercept or meddle with plain Do53 DNS traffic to the quad servers either... -- / daniel.haxx.se --1129329158-517903539-1565939936=:6529-- From nobody Fri Aug 16 00:26:11 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 284AD120108 for ; Fri, 16 Aug 2019 00:26:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rq5Hzo8LXCkV for ; Fri, 16 Aug 2019 00:26:08 -0700 (PDT) Received: from mail-yw1-xc2e.google.com (mail-yw1-xc2e.google.com [IPv6:2607:f8b0:4864:20::c2e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5D377120033 for ; Fri, 16 Aug 2019 00:26:08 -0700 (PDT) Received: by mail-yw1-xc2e.google.com with SMTP id u141so1510201ywe.4 for ; Fri, 16 Aug 2019 00:26:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=g04r47TODg7ObOvLXsiX5bteQkt5AsC1lj/ZpqEm3NA=; b=AGzzfFOPCLKSFr70C6LIkPF0qCV/jWxj5SYVvYyU73nspn6xwGSCU7iBOnQZYB2BAc cOb/W2BZGsKi6UFXEGy1EJcTAtZObgNryQIJPgKTsJfIICKzlUacf4jH0B7UjFTvHMsk bMQtxu1xMelDYGzoz92jEPlFndNjM/haUcEkEba/GkbXb2YEmt7lAJzFR2EgaU9lwdPW rycRN2wTZQO42Ci4qWWvNA7v3CZ3iSO5iuoULRfqmgogorCP9tP31eUF44+SfWFKyaus eSnduyJ29tvOYdIKfSfub+xRvR2NQA7d6Y6/Cy1yFy4XXIfR2zc1oQmZ9y7g+INSQG8w WcDA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=g04r47TODg7ObOvLXsiX5bteQkt5AsC1lj/ZpqEm3NA=; b=hbG2/ypeujkeJyple8MaGSJK6Xa0KANzucqbPoxMnS4I37DK/cj1oQ2AdDUv6YwvR5 sAjJNynZEL6A14SwMvONW1OVXJDb5BfhDf2aMoWcfTnnzfJqtNtHg/gSiifrPHkN5XDk 7MDiHTeLea0W4HEeEJgSjCscvNuitXV0lsOXmNW2mn9rueL7YwSAqCT8vOHMj82M2ZqR M96nYVCorUFotXTYd9tkE3LvyVVOXAV9d61yWah4mB3LDfvjOMo40vpvR/KnL3rFKKqn EqXvqxvFWmJIqmLlQ/skhzi10l30Ox4D+sV6RgpKN4sH3qHBITpUTwl4wkLpq2Gp1NnY vKRg== X-Gm-Message-State: APjAAAVbs8SeRUFUWAFwMQ+FSB9dE63TNCSGYwucROp0Zj9vjncLHM+X 41kRw+NcCBWo5jfKsqHB/NIeA4HmSi1u8UlSfzxtAQ== X-Google-Smtp-Source: APXvYqxOnPz5uDvaUGVN+0mRe7HBPHfxBhTkVvL7NR1qmGvVdupnuBgHqtKlLGVIC3y7fIXB8BywiUFCD7hwbZ9ha8o= X-Received: by 2002:a81:2bc4:: with SMTP id r187mr4421935ywr.116.1565940367408; Fri, 16 Aug 2019 00:26:07 -0700 (PDT) MIME-Version: 1.0 References: <400b774a-5bd0-d6f4-5640-e561f067a9b5@cs.tcd.ie> <74A2E5E0-02CE-4C9D-A66B-1D2FBC65B39A@frobbit.se> <3611F27A-49A9-4159-A683-3BBD4C2F91EA@frobbit.se> <904F4219-8BDE-4272-BFDA-20F38D58CB80@frobbit.se> In-Reply-To: <904F4219-8BDE-4272-BFDA-20F38D58CB80@frobbit.se> From: Alec Muffett Date: Fri, 16 Aug 2019 08:25:56 +0100 Message-ID: To: =?UTF-8?B?UGF0cmlrIEbDpGx0c3Ryw7Zt?= Cc: Stephen Farrell , ADD Mailing list Content-Type: multipart/alternative; boundary="00000000000056c13c059036e76f" Archived-At: Subject: Re: [Add] Use Cases - the coffee shop X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 07:26:10 -0000 --00000000000056c13c059036e76f Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Fri, 16 Aug 2019, 08:09 Patrik F=C3=A4ltstr=C3=B6m, wro= te: > > The legislator just do not care. Its the access provider that is nervous > over some DoH arguments. > On those I believe that we agree; where we differ is whether everyone else's privacy should continue to suffer, and whether pursuit of technologically easier, better privacy and integrity ever should be chilled or diverted in order to consider this "nervousness". >From repeated experience in my career (including Crack, work assisting Tor Onions, and E2E for FB Messenger) my perspective is that security and privacy advancement is always the better option. But then I build platforms for a living. -a > --00000000000056c13c059036e76f Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Fri, 16 Aug 2019, 08:09 Patrik F=C3=A4ltstr=C3=B6m, <paf@frobbit.se> wrote:

The legislator just do not care. Its the access provider that is nervous ov= er some DoH arguments.

On those I believe that we agree; where we differ is = whether everyone else's privacy should continue to suffer, and whether = pursuit of technologically easier, better privacy and integrity ever should= be chilled or diverted in order to consider this "nervousness".<= /div>

From repeated experience= in my career (including Crack, work assisting Tor Onions, and E2E for FB M= essenger) my perspective is that security and privacy advancement is always= the better option.

But = then I build platforms for a living.

-a


--00000000000056c13c059036e76f-- From nobody Fri Aug 16 00:37:57 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D18BD120125 for ; Fri, 16 Aug 2019 00:37:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FROM_EXCESS_BASE64=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=frobbit.se Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KBHtag22zuIB for ; Fri, 16 Aug 2019 00:37:54 -0700 (PDT) Received: from mail.frobbit.se (mail.frobbit.se [85.30.129.176]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EEF1512011A for ; Fri, 16 Aug 2019 00:37:53 -0700 (PDT) Received: from [192.165.72.22] (unknown [IPv6:2a02:80:3ffc::22]) by mail.frobbit.se (Postfix) with ESMTPSA id 40D7E213BC; Fri, 16 Aug 2019 09:37:51 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=frobbit.se; s=mail; t=1565941071; bh=Mk4BXLFfvtFacbtQ4Ke4k97ou2ILpy+BBZzUQ+7YB9s=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=PsjU1YiUh81MD78BqyGgDqW6W69tUoSK/wzvEzP3/pq+Qnvisd32dKA1/8sedqo0D Q0t0UggVZmLGr3bZfawzf+bBNrCgDl+CT4uQVx0/K68PptuMRAw9O6vZ3su7Rtmc7s 0tFQcPyhegwrkXZHPNOXOfyX0iZ03VKGctEUqI3E= From: "Patrik =?utf-8?b?RsOkbHRzdHLDtm0=?=" To: "Alec Muffett" Cc: "Stephen Farrell" , "ADD Mailing list" Date: Fri, 16 Aug 2019 09:37:49 +0200 X-Mailer: MailMate (2.0BETAr6137) Message-ID: <85CF7EE9-51B8-4431-BCE5-7EA2B9AAF892@frobbit.se> In-Reply-To: References: <400b774a-5bd0-d6f4-5640-e561f067a9b5@cs.tcd.ie> <74A2E5E0-02CE-4C9D-A66B-1D2FBC65B39A@frobbit.se> <3611F27A-49A9-4159-A683-3BBD4C2F91EA@frobbit.se> <904F4219-8BDE-4272-BFDA-20F38D58CB80@frobbit.se> MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=_MailMate_F0A05880-FCC2-4D15-8560-C5CCFEDADCF3_="; micalg=pgp-sha1; protocol="application/pgp-signature" Archived-At: Subject: Re: [Add] Use Cases - the coffee shop X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 07:37:56 -0000 This is an OpenPGP/MIME signed message (RFC 3156 and 4880). --=_MailMate_F0A05880-FCC2-4D15-8560-C5CCFEDADCF3_= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On 16 Aug 2019, at 9:25, Alec Muffett wrote: > On Fri, 16 Aug 2019, 08:09 Patrik F=C3=A4ltstr=C3=B6m, = wrote: > >> The legislator just do not care. Its the access provider that is nervo= us >> over some DoH arguments. > > On those I believe that we agree; where we differ is whether everyone > else's privacy should continue to suffer, and whether pursuit of > technologically easier, better privacy and integrity ever should be chi= lled > or diverted in order to consider this "nervousness". I do not see what end users privacy have to do with this. The end users privacy: 1. Can be protected via encrypted transport 2. Can always be violated at the end point of the encrypted transport You seems to have a claim that having the end point in a different jurisd= iction than the end user and at an entity that the end user do not have e= xplicit contractual agreements with, is better privacy? Can you expand on these two things explicitly please. > From repeated experience in my career (including Crack, work assisting = Tor > Onions, and E2E for FB Messenger) my perspective is that security and > privacy advancement is always the better option. I agree, and this is why I was supporting and helping the Swedish Governm= ent when it supported financially further development of Tor. And why I a= m personally supporting privacy initiatives like Tor. And why I am arguin= g in favour of DNSSEC validation in the client so that "people messing ar= ound with DNS can be detected". > But then I build platforms for a living. So do I. What I am nervous about is to shake the box so much that it will be harde= r to use things like Tor and VPNs. I want the end user having the ability to override the default solution t= he access provider provides. I want the internet access the access provid= er provides be so open that I still can choose my full service resolver. I do NOT want the legislator say the access providers are not doing a goo= d enough job (today) when they "just" are patching the full service resol= ver they provide for their users. Patrik --=_MailMate_F0A05880-FCC2-4D15-8560-C5CCFEDADCF3_= Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iG0EARECAC0WIQRUH/cJI8i4DDUU3qWsxpsaC4jXzQUCXVZdTQ8ccGFmQGZyb2Ji aXQuc2UACgkQrMabGguI183mcACdEUQIhNNQZ/QZxtUAF7fofesnGckAnRGdukbu sMKfbLL7pg+W3+GaYr9J =ucbr -----END PGP SIGNATURE----- --=_MailMate_F0A05880-FCC2-4D15-8560-C5CCFEDADCF3_=-- From nobody Fri Aug 16 00:40:41 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 95241120144 for ; Fri, 16 Aug 2019 00:40:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FROM_EXCESS_BASE64=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=frobbit.se Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GYbnm7rdVk_E for ; Fri, 16 Aug 2019 00:40:36 -0700 (PDT) Received: from mail.frobbit.se (mail.frobbit.se [IPv6:2a02:80:3ffe::176]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 54BDE12012E for ; Fri, 16 Aug 2019 00:40:36 -0700 (PDT) Received: from [192.165.72.22] (unknown [IPv6:2a02:80:3ffc::22]) by mail.frobbit.se (Postfix) with ESMTPSA id 483C41FECD; Fri, 16 Aug 2019 09:40:34 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=frobbit.se; s=mail; t=1565941234; bh=BLlflP4NosRTPz4vy8K5a+EW6FD/tJQYZzlJlf9nvwo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=YZg9jddODZcxcPXj4md0XDOjaaFEnePsSi8cdAHHipehKwd9Jo3U9oxAvTQn+rhH8 D7UK5NMcuell8h6axSEhykUoPmwdz4CP5UDqL2ZPwXGzzkhHyY4OLmaREn25BnAXN0 90LigRKd/4zB2bEh5FlrpHzxQoFftis4LSrXxOuk= From: "Patrik =?utf-8?b?RsOkbHRzdHLDtm0=?=" To: "Daniel Stenberg" Cc: "Patrik =?utf-8?b?RsOkbHRzdHLDtm0=?=" , "Stephen Farrell" , "ADD Mailing list" , "Alec Muffett" Date: Fri, 16 Aug 2019 09:40:33 +0200 X-Mailer: MailMate (2.0BETAr6137) Message-ID: In-Reply-To: References: <400b774a-5bd0-d6f4-5640-e561f067a9b5@cs.tcd.ie> <74A2E5E0-02CE-4C9D-A66B-1D2FBC65B39A@frobbit.se> <3611F27A-49A9-4159-A683-3BBD4C2F91EA@frobbit.se> <904F4219-8BDE-4272-BFDA-20F38D58CB80@frobbit.se> MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=_MailMate_5FE0B596-4369-4132-9E55-73FC2F74F4F0_="; micalg=pgp-sha1; protocol="application/pgp-signature" Archived-At: Subject: Re: [Add] Use Cases - the coffee shop X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 07:40:41 -0000 This is an OpenPGP/MIME signed message (RFC 3156 and 4880). --=_MailMate_5FE0B596-4369-4132-9E55-73FC2F74F4F0_= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On 16 Aug 2019, at 9:18, Daniel Stenberg wrote: > On Fri, 16 Aug 2019, Patrik F=C3=A4ltstr=C3=B6m wrote: > >> The legislator just do not care. Its the access provider that is nervo= us over some DoH arguments. > > User-controlled resolver configuration you mean? Since I'm pretty sure = most coffee shops don't intercept or meddle with plain Do53 DNS traffic t= o the quad servers either... We already have user controlled resolver configuration. What am talking about is: - Not having the access provider configuration as default So that the access provider have to implement blocking in a different way= =2E - Not having resolver configuration per computer So that the number of calls to customer care increases. Patrik --=_MailMate_5FE0B596-4369-4132-9E55-73FC2F74F4F0_= Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iG0EARECAC0WIQRUH/cJI8i4DDUU3qWsxpsaC4jXzQUCXVZd8Q8ccGFmQGZyb2Ji aXQuc2UACgkQrMabGguI1835MwCfeLpQ4H6EKWsLi3tykYz3nhH+HSYAnRVtCqM2 1ZF/cJ7MFov68z8UdLsv =ZJ/q -----END PGP SIGNATURE----- --=_MailMate_5FE0B596-4369-4132-9E55-73FC2F74F4F0_=-- From nobody Fri Aug 16 00:51:15 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A731012011A for ; Fri, 16 Aug 2019 00:51:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yyzQ6ZOETy6H for ; Fri, 16 Aug 2019 00:51:11 -0700 (PDT) Received: from mail-yw1-xc34.google.com (mail-yw1-xc34.google.com [IPv6:2607:f8b0:4864:20::c34]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 23F7C12006A for ; Fri, 16 Aug 2019 00:51:11 -0700 (PDT) Received: by mail-yw1-xc34.google.com with SMTP id e65so1534498ywh.0 for ; Fri, 16 Aug 2019 00:51:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=EDPbUQdDYXP8vOAdtWBfZLnzvX3Bn8nYd+gIxp5SOQo=; b=nJDmLmlei+Vyx2TU/ZawXEgrlsHdUA1dgYQBYtdb9LSKR2pw9Ou/dlnQUFzXwbCoat fPzHkr17ZHAQd78i5RAPoH2LKsmij8Y6N+3I5RY+n8U18NN7WXuQ19FmXKne1Xn3j/Zy i+NFypdAMAzrygj+fvOkkMT/nHa9b3yOLHRCfmbI4VN/viKKoNhYJGcNTIq42LwP6r+b fhYT0NfD/Ibcmszf38dLK1Q6MMxg3lWS2IRzITqxuNQ2sJ4siDfJ70+OYkbItum1pVTn mrfxOQLU78AfINXN+QmmUidE4QyVHdPMgLbZa/Dk7HLuuyfL/xpdhzU/RSIRrSRg7M2V i1YA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=EDPbUQdDYXP8vOAdtWBfZLnzvX3Bn8nYd+gIxp5SOQo=; b=LNoonuJ2Vjl4TifxGipdiTns2Y/eHa6VxitwHX+dim/fYdwKWSymSmn3CPCWg/TVQV AaQIs+8AXy0eXCQMmsNO9Gl5YKOfAUVOPVPX70hdpuiIUzLg1QZgWWUsyvuN+yMavsQJ pCnwAm9VOry4nsJFE+LESu1/LAuAOw/k1gq52IrmXXy1fUKMHQVYA/6s5NsIZxZ6OcJL VOaRDhI+HmoNezsKZ2gMnwD8rYm9Z58bX1yHPollvdKfVE7NI77TZiXjKftZFFuwhu9t l8nRj8K3ZsruGy5zvMNuMqlUvv4xncxRf64oWEN9YvqEOcd2pIj6SpM+po9SGASD9jSq j8Sg== X-Gm-Message-State: APjAAAUgW/UqMVLVQqTFS7MC+xJr3JKeqvS8TBldFsP1u+owoDd3rpTb eqpeX7fRs6MfWfD+VL2TFOugtPIQBbStA+Iw2+PNQQ== X-Google-Smtp-Source: APXvYqyDFXqVA83yz7bD9T0ds0YAggWfH8W5e/JZFIBSAW4iiRZspYb424MyJlNS26ioL0ihZPbT8CTIkIF168h7MII= X-Received: by 2002:a81:2bc4:: with SMTP id r187mr4467676ywr.116.1565941870180; Fri, 16 Aug 2019 00:51:10 -0700 (PDT) MIME-Version: 1.0 References: <400b774a-5bd0-d6f4-5640-e561f067a9b5@cs.tcd.ie> <74A2E5E0-02CE-4C9D-A66B-1D2FBC65B39A@frobbit.se> <3611F27A-49A9-4159-A683-3BBD4C2F91EA@frobbit.se> <904F4219-8BDE-4272-BFDA-20F38D58CB80@frobbit.se> <85CF7EE9-51B8-4431-BCE5-7EA2B9AAF892@frobbit.se> In-Reply-To: <85CF7EE9-51B8-4431-BCE5-7EA2B9AAF892@frobbit.se> From: Alec Muffett Date: Fri, 16 Aug 2019 08:50:59 +0100 Message-ID: To: =?UTF-8?B?UGF0cmlrIEbDpGx0c3Ryw7Zt?= Cc: Stephen Farrell , ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000e93f960590374031" Archived-At: Subject: Re: [Add] Use Cases - the coffee shop X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 07:51:14 -0000 --000000000000e93f960590374031 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Fri, 16 Aug 2019, 08:37 Patrik F=C3=A4ltstr=C3=B6m, wro= te: > > I do NOT want the legislator say the access providers are not doing a goo= d > enough job (today) when they "just" are patching the full service resolve= r > they provide for their users. Then let us "lift all boats" so that any future hypothetical legislator is not in a position to say "the internet has developed far enough and should stop developing now". They tried that with PGP. They tried that with HTTPS. They are yet again attempting it with end-to-end encrypted messaging. I propose that they not be accommodated, for fear of what their next "ask" would be; aside from anything else if we begin to architect *ourselves* in order to accommodate them, they will not appreciate the effort and will simply demand more. Essay: "Lift all boats" https://link.medium.com/xSzR7BE6bZ -a --000000000000e93f960590374031 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


On Fri, 16 Aug 2019, 08:37 Patrik F=C3=A4ltstr=C3=B6m,= <paf@frobbit.se> wrote:

I do NOT want the legislator say the access providers are not doing a good = enough job (today) when they "just" are patching the full service= resolver they provide for their users.

Then let us "lift all boats" s= o that any future hypothetical legislator is not in a position to say "= ;the internet has developed far enough and should stop developing now"= .

They tried that with P= GP. They tried that with HTTPS. They are yet again attempting it with end-t= o-end encrypted messaging.

I propose that they not be accommodated, for fear of what their next &qu= ot;ask" would be; aside from anything else if we begin to architect *o= urselves* in order to accommodate them, they will not appreciate the effort= and will simply demand more.

Essay: "Lift all boats" https://link.medium.com/xSzR7BE6bZ
<= br>
-a

--000000000000e93f960590374031-- From nobody Fri Aug 16 01:27:38 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9DBE0120129 for ; Fri, 16 Aug 2019 01:27:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FROM_EXCESS_BASE64=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=frobbit.se Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gm8WihAa4qaI for ; Fri, 16 Aug 2019 01:27:35 -0700 (PDT) Received: from mail.frobbit.se (mail.frobbit.se [85.30.129.176]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B2F5B120019 for ; Fri, 16 Aug 2019 01:27:33 -0700 (PDT) Received: from [192.165.72.22] (unknown [IPv6:2a02:80:3ffc::22]) by mail.frobbit.se (Postfix) with ESMTPSA id F09CD2315A; Fri, 16 Aug 2019 10:27:30 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=frobbit.se; s=mail; t=1565944050; bh=dYPYZyuIj5Ns3z0p272CJ35eWBuKWzQPPRcJXQc8F9s=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=EPfcFkFpClwFmB4Hix1Ul+yTdeIWCoyPnlefuSUxTt9wxOT9D97039OfixxrnxXaa eTK9Pr1ws9pY7hIRrpuoKPCbRoBeJ7mY0HgGWbGBskw0YT1z/J8gpIZv3iUOelrsFp L5JfyWzydPvczGzWBC+QBHUV5mOgM8ZmFYLQbqmY= From: "Patrik =?utf-8?b?RsOkbHRzdHLDtm0=?=" To: "Alec Muffett" Cc: "Stephen Farrell" , "ADD Mailing list" Date: Fri, 16 Aug 2019 10:27:29 +0200 X-Mailer: MailMate (2.0BETAr6137) Message-ID: In-Reply-To: References: <400b774a-5bd0-d6f4-5640-e561f067a9b5@cs.tcd.ie> <74A2E5E0-02CE-4C9D-A66B-1D2FBC65B39A@frobbit.se> <3611F27A-49A9-4159-A683-3BBD4C2F91EA@frobbit.se> <904F4219-8BDE-4272-BFDA-20F38D58CB80@frobbit.se> <85CF7EE9-51B8-4431-BCE5-7EA2B9AAF892@frobbit.se> MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=_MailMate_3B9D440C-B305-4165-9F43-4015522BE6BC_="; micalg=pgp-sha1; protocol="application/pgp-signature" Archived-At: Subject: Re: [Add] Use Cases - the coffee shop X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 08:27:36 -0000 This is an OpenPGP/MIME signed message (RFC 3156 and 4880). --=_MailMate_3B9D440C-B305-4165-9F43-4015522BE6BC_= Content-Type: text/plain Content-Transfer-Encoding: quoted-printable On 16 Aug 2019, at 9:50, Alec Muffett wrote: > I propose that they not be accommodated, for fear of what their next "a= sk" > would be; aside from anything else if we begin to architect *ourselves*= in > order to accommodate them, they will not appreciate the effort and will= > simply demand more. > > Essay: "Lift all boats" https://link.medium.com/xSzR7BE6bZ My last message on this is, once again, the legislator do not care. They have already told, and will continue to tell, the access provider to= block access to certain domain names. The rest is up to the access provi= der. Patrik --=_MailMate_3B9D440C-B305-4165-9F43-4015522BE6BC_= Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iG0EARECAC0WIQRUH/cJI8i4DDUU3qWsxpsaC4jXzQUCXVZo8Q8ccGFmQGZyb2Ji aXQuc2UACgkQrMabGguI183MRQCfeW8/+rf6b05Pa4uFTCv7z8ApvBcAnjFV4I3F lrS+6GuqHC8vdeGrMRVk =coJW -----END PGP SIGNATURE----- --=_MailMate_3B9D440C-B305-4165-9F43-4015522BE6BC_=-- From nobody Fri Aug 16 01:33:27 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 33BEC120106 for ; Fri, 16 Aug 2019 01:33:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.298 X-Spam-Level: X-Spam-Status: No, score=-4.298 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=open-xchange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7nmrK3LyvCrR for ; Fri, 16 Aug 2019 01:33:24 -0700 (PDT) Received: from mx4.open-xchange.com (alcatraz.open-xchange.com [87.191.39.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DBB5A120058 for ; Fri, 16 Aug 2019 01:33:22 -0700 (PDT) Received: from open-xchange.com (imap.open-xchange.com [10.20.30.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx4.open-xchange.com (Postfix) with ESMTPS id 294CE6A27D for ; Fri, 16 Aug 2019 10:33:18 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=open-xchange.com; s=201705; t=1565944398; bh=a/XmU+1Syc9DbA1cV40y8MK9sTbUcRPjCsRZOo3gWlE=; h=From:Subject:Date:References:To:In-Reply-To:From; b=RcrzPviRiLD4ZHjBvkuYieL39SHnDgL7uDnv8Jtj2cOVLTmyIzW1aqxrns6fYJvxQ QlSBOtbTjaKqxj3I6oEVkFXw9ASOVMoKJm5CmaED4/3wdWi+VZw97m7VVw2DhMMMJe AJXVed1U0I/Jg8PeZZX1c2TIFm5iQC0pFPX7La6fsTFVAp8f6qsx/yQd3xlcfO2oZt vJ6LkT0qR/wei2MwncLjQC7NbJwAiKW1K6lKeN1LlwHESopo0r2oKLXaCWB0hR/CbX vY/flcuI2kRSpLNUmghSdczS8sTD+jc3FuC/dp29C1DrMTfssWj8xM8yznXsOnZ88n g9ilFRx1Ct1eA== Received: from [192.168.1.128] (host31-53-106-255.range31-53.btcentralplus.com [31.53.106.255]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by open-xchange.com (Postfix) with ESMTPSA id 081B03C0481 for ; Fri, 16 Aug 2019 10:33:18 +0200 (CEST) From: Neil Cook Content-Type: multipart/alternative; boundary="Apple-Mail=_B630A24F-FABC-4483-AFED-1985A9E52696" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Fri, 16 Aug 2019 09:33:16 +0100 References: <400b774a-5bd0-d6f4-5640-e561f067a9b5@cs.tcd.ie> To: ADD Mailing list In-Reply-To: <400b774a-5bd0-d6f4-5640-e561f067a9b5@cs.tcd.ie> Message-Id: X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] Use Cases - the coffee shop X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 08:33:26 -0000 --Apple-Mail=_B630A24F-FABC-4483-AFED-1985A9E52696 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii > On 15 Aug 2019, at 20:10, Stephen Farrell = wrote: >=20 > I frankly don't believe that the hotel or similar > really care about choices of DNS recursive. >=20 > I've not heard anything convincing as to why the > hotspot-provider company would really either, though > the caport problem space has it's own complexities > I guess. (I did hear the points about T&C's, legalities > and whatnot, but those mostly seems like normally > necessary business-oriented arse-covering to me.) >=20 Some hotspot providers are telcos, who also provide parental = control/malware filtering to their users, which extends not only to = their broadband connection, but also their mobile network and their Wifi = hotspot network. So when you sign in to their hotspots you get the same = filtering as you do at home. JFYI. Neil Cook neil.cook@open-xchange.com = --------------------------------------------------------------------------= ----------- Open-Xchange AG, Rollnerstr. 14, 90408 Nuremberg, District Court = Nuremberg HRB 24738 Managing Board: Rafael Laguna de la Vera, Carsten Dirks, Michael = Knapstein, Stephan Martin=20 Chairman of the Board: Richard Seibt European Office:=20 Open-Xchange GmbH, Olper Huette 5f, D-57462 Olpe, Germany, District = Court Siegen, HRB 8718=20 Managing Director: Frank Hoberg US Office:=20 Open-Xchange. Inc., 530 Lytton Avenue, Palo Alto, CA 94301, USA=20 = --------------------------------------------------------------------------= ----------- --Apple-Mail=_B630A24F-FABC-4483-AFED-1985A9E52696 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii

On 15 Aug 2019, at 20:10, Stephen Farrell <stephen.farrell@cs.tcd.ie> wrote:

I frankly don't believe that = the hotel or similar
really care about choices of DNS = recursive.

I've not heard anything = convincing as to why the
hotspot-provider company would = really either, though
the caport problem space has it's = own complexities
I guess. (I did hear the points about = T&C's, legalities
and whatnot, but those mostly seems = like normally
necessary business-oriented arse-covering to = me.)


Some hotspot providers are telcos, who also = provide parental control/malware filtering to their users, which extends = not only to their broadband connection, but also their mobile network = and their Wifi hotspot network. So when you sign in to their hotspots = you get the same filtering as you do at home. JFYI.

Neil Cook
neil.cook@open-xchange.com

---------------------------------------------------------------= ----------------------
Open-Xchange AG, Rollnerstr. 14, = 90408 Nuremberg, District Court Nuremberg HRB 24738
Managing Board: Rafael Laguna de la Vera, Carsten Dirks, = Michael Knapstein, Stephan Martin 
Chairman of = the Board: Richard Seibt

European = Office: 
Open-Xchange GmbH, Olper Huette = 5f, D-57462 Olpe, Germany, District Court Siegen, HRB = 8718 
Managing Director: Frank Hoberg
US Office: 
Open-Xchange. Inc., 530 = Lytton Avenue, Palo Alto, CA 94301, USA 
---------------------------------------------------------------= ----------------------

= --Apple-Mail=_B630A24F-FABC-4483-AFED-1985A9E52696-- From nobody Fri Aug 16 02:37:15 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D37B512004F for ; Fri, 16 Aug 2019 02:37:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=netorgft5189650.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pxCMH1tilx7R for ; Fri, 16 Aug 2019 02:37:12 -0700 (PDT) Received: from GBR01-LO2-obe.outbound.protection.outlook.com (mail-eopbgr100053.outbound.protection.outlook.com [40.107.10.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 836EA120024 for ; Fri, 16 Aug 2019 02:37:11 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=Bz0cx6ZfPF8S3N+i/V6W4hEz5CilbAwHsvc7GJfF99JTR3CLqxteA9MnIyOkGLLIavJxUSgxTRbgZrU0Syl5QDISElyRUqxLiGwzDaIAMfyoU6gF3QJuAPQhQRgt1Rzj8idl19lanj2gCPMmpAWZ0PYvPMfwMMgkczNH5j6jryS51iZsLZ5EgAfXmOb7E5/wzVDJ+NiZeDLtXwHdrLep2Tf7rN2Sw/7vNAkl+ImEVNRnG5XUUPf4tM5PW/3xlFqJnkEYQYyfb6Yc89OuSrzTw+9S1A+XbTDQSeihGWvWa1xlwurIl5vMNWoVFdvo3B1yPYtSfuMWzsgXs4mbPsAgjg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=I7DlLWAFGhyBYRi/tWYkQLERbyd3srT7pQSqsbzG3mE=; b=EHi8QUHIWicIMKBBwTB5U9zZH40lgShTra5Np5a5+cWb73IA2MSPC1rq564jxgfTwfbzi6NuSh1PzWJdcgT8d3CDGVNF1T1NxKd2+pM8qj9eIroX+EWGwJrJGAOV4DCDK9t99jRgx7PXjoRGfapZXFhh6FgxPZiH3GQJ2WgU9Z48iRxADvtbq+Lu2xCYSAPoxQCdl2JOwfFguJRfLJTfgT/ZMXskP+OwR5Re+GLj8HrtjOkYwi7FgXNP+espkw0Qwck7qw8GJrOQSxA8rzV30AicEUogK8Mx2IaEfiL7eCMPQSUJ9SqkNCWmT/9k7qqeZmgMaGsF/VEUr7ZAtbRQow== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=419.consulting; dmarc=pass action=none header.from=419.consulting; dkim=pass header.d=419.consulting; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=NETORGFT5189650.onmicrosoft.com; s=selector1-NETORGFT5189650-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=I7DlLWAFGhyBYRi/tWYkQLERbyd3srT7pQSqsbzG3mE=; b=tfrp69rjklVGSjzC1cW+nDhiD8ptXkNKX7Ljsx7pTpcVcsSX15GlDwUwcKoh/REJJbcrXkSH52w/VmSClr7oBdn8OuT+LCcEbxw54lJeNKdLFmzi99w7y76o4gr/P7GGPJlOHbmE3/i2dtx6hhfXULeStBNEymcZPuS9H3z9Go4= Received: from LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM (20.176.138.146) by LO2P265MB1104.GBRP265.PROD.OUTLOOK.COM (20.176.145.148) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2178.16; Fri, 16 Aug 2019 09:37:09 +0000 Received: from LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM ([fe80::64e9:9b9e:59fc:26f]) by LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM ([fe80::64e9:9b9e:59fc:26f%5]) with mapi id 15.20.2157.022; Fri, 16 Aug 2019 09:37:09 +0000 From: Andrew Campling To: Rob Sayre , Alec Muffett CC: =?utf-8?B?UGF0cmlrIEbDpGx0c3Ryw7Zt?= , ADD Mailing list , Stephen Farrell Thread-Topic: [Add] Use Cases - the coffee shop Thread-Index: AdVTdTO8sMFf9NSjRg6hhfqT7Scbe6b9g2ug Date: Fri, 16 Aug 2019 09:37:08 +0000 Message-ID: References: <400b774a-5bd0-d6f4-5640-e561f067a9b5@cs.tcd.ie> <74A2E5E0-02CE-4C9D-A66B-1D2FBC65B39A@frobbit.se> In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=andrew.campling@419.consulting; x-originating-ip: [2a00:23c4:a499:2e00:55a7:59be:7d65:cfb6] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: cdb2ea11-b258-4ce9-431c-08d7222d4f1d x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(7021145)(8989299)(4534185)(7022145)(4603075)(4627221)(201702281549075)(8990200)(7048125)(7024125)(7027125)(7023125)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:LO2P265MB1104; x-ms-traffictypediagnostic: LO2P265MB1104: x-ms-exchange-purlcount: 1 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:7691; x-forefront-prvs: 0131D22242 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(396003)(346002)(376002)(39830400003)(366004)(136003)(189003)(199004)(8676002)(229853002)(25786009)(5660300002)(66476007)(66556008)(53546011)(81166006)(76116006)(66946007)(81156014)(66446008)(64756008)(8936002)(6506007)(4744005)(52536014)(102836004)(4326008)(186003)(6306002)(54896002)(316002)(54906003)(99286004)(6436002)(236005)(110136005)(55016002)(9686003)(44832011)(86362001)(53936002)(71190400001)(6246003)(486006)(476003)(46003)(446003)(11346002)(7736002)(71200400001)(74316002)(76176011)(508600001)(7696005)(33656002)(606006)(2906002)(6116002)(790700001)(14454004)(256004)(14444005)(46492003); DIR:OUT; SFP:1101; SCL:1; SRVR:LO2P265MB1104; H:LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: 419.consulting does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: W+uaEIlzIyww3jFlPRRBlWmqleGxE5+2cmP2EtnJ4ywkpeHD3x7d08WlWLptRwviHTiVjEal67Rk1mkL2uxg+OfpAxkgpZVnwX65W8yycGWrYOv4xxPi5Yf4WKpJ4i3gu9WM6Gmvkr13jab6hN87yrUFBHaNXfwnt2NquH49QfZsNy/1/O6m8j3OBDqFvp0dfpI+jXj/jqzRRGVBLqKSlD5qkYkvPe34RXZ8LT2W2UcBMm7OApZy1MFL2CykPHkZrWLvy7q0MwrN6Eu800TtG1kcNFaDUxYpqr5lLEY7vXpsqkUz+UdYYh1/qYaz1CQHXmy9Iv6djLLKsgEPf7qCFjT8ZcZRGtzc4edUkvY7tpuyRqgSMGQfmNkE5iNNWfJ6S/75yTpdcO2Op4I+ZTUqCD2YNSXiTEZeM/+xHk8srBo= x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_LO2P265MB132779C3E3506E2C01D6FFEBC2AF0LO2P265MB1327GBRP_" MIME-Version: 1.0 X-OriginatorOrg: 419.consulting X-MS-Exchange-CrossTenant-Network-Message-Id: cdb2ea11-b258-4ce9-431c-08d7222d4f1d X-MS-Exchange-CrossTenant-originalarrivaltime: 16 Aug 2019 09:37:09.1145 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 9c2ced3e-7522-4755-87dc-f983abc66ec3 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: +5/OMb1z6sYE1hMiaMFrxkPaOoBGj3EZ7NKqbql5gKGhEkJRts7hrO5zK84tMv0nDzQIffM1jXrKwSUhbc56gxfvJC0JLqfEWW5nzJ8PDlc= X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO2P265MB1104 Archived-At: Subject: Re: [Add] Use Cases - the coffee shop X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 09:37:14 -0000 --_000_LO2P265MB132779C3E3506E2C01D6FFEBC2AF0LO2P265MB1327GBRP_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 T24gRnJpLCBBdWcgMTYsIDIwMTkgYXQgMDc6MjEgUm9iIFNheXJlIDxzYXlyZXJAZ21haWwuY29t PiB3cm90ZToNCj4gQWgsIHllcy4gSSBsb29rZWQgaW50byB0aGlzIGlzc3VlIGEgYml0IG1vcmUu IE15IEFuZHJvaWQgcGhvbmUgYXV0b21hdGljYWxseSBzd2l0Y2hlcyBvbg0KPiBhIFZQTiBpZiB0 aGUgV2lGaSBhY2Nlc3MgcG9pbnQgaXMgaW4gdGhlaXIgZGF0YWJhc2UgYW5kIGlzIG9wZW4gKG5v IHBhc3N3b3JkLCBubyBwb3J0YWwpLiBJdA0KPiB0dXJucyBvdXQgaXQgaXMgdGhlIGRlZmF1bHQg c2V0dGluZyBvbiB0aGUgaGFuZHNldCwgYmVjYXVzZSBpdCdzIGEgR29vZ2xlIEZpIGRldmljZS4N Cj4gPGh0dHBzOi8vbWFpbGFyY2hpdmUuaWV0Zi5vcmcvYXJjaC9tc2cvYWRkL2V4bkNsZ3NRTU5t VlUwMHYzZkVVV0JIUjlXRT4NCj4NCj4gSXQgZG9lc24ndCBzZWVtIGxpa2UgdGhlc2UgImxlZ2Fs IHJlcXVpcmVtZW50cyIgYXJndW1lbnRzIGFyZSB2ZXJ5IHVwLXRvLWRhdGUuDQoNCldoaWNoIG1h cmtldChzKSBkaWQgdGhlc2UgaW52ZXN0aWdhdGlvbnMgY292ZXIsIGJlYXJpbmcgaW4gbWluZCB0 aGF0IGxlZ2FsIHJlcXVpcmVtZW50cyBvbiBib3RoIGFjY2VzcyBwcm92aWRlcnMgYW5kIG90aGVy cyB2YXJ5IGNvbnNpZGVyYWJseSBhcm91bmQgdGhlIHdvcmxkPw0KDQpBbmRyZXcNCg0K --_000_LO2P265MB132779C3E3506E2C01D6FFEBC2AF0LO2P265MB1327GBRP_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBjbTsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQph OmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xv cjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFuLk1z b0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpwdXJw bGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwLk1zb0xpc3RQYXJhZ3JhcGgsIGxp Lk1zb0xpc3RQYXJhZ3JhcGgsIGRpdi5Nc29MaXN0UGFyYWdyYXBoDQoJe21zby1zdHlsZS1wcmlv cml0eTozNDsNCgltYXJnaW4tdG9wOjBjbTsNCgltYXJnaW4tcmlnaHQ6MGNtOw0KCW1hcmdpbi1i b3R0b206MGNtOw0KCW1hcmdpbi1sZWZ0OjM2LjBwdDsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7 DQoJZm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9 DQpwLm1zb25vcm1hbDAsIGxpLm1zb25vcm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHls ZS1uYW1lOm1zb25vcm1hbDsNCgltc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmln aHQ6MGNtOw0KCW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBjbTsN Cglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30N CnNwYW4uRW1haWxTdHlsZTE4DQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZv bnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOndpbmRvd3RleHQ7fQ0KLk1z b0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1mYW1pbHk6 IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJbXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVM7fQ0KQHBh Z2UgV29yZFNlY3Rpb24xDQoJe3NpemU6NjEyLjBwdCA3OTIuMHB0Ow0KCW1hcmdpbjo3Mi4wcHQg NzIuMHB0IDcyLjBwdCA3Mi4wcHQ7fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0 aW9uMTt9DQotLT48L3N0eWxlPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVkZWZh dWx0cyB2OmV4dD0iZWRpdCIgc3BpZG1heD0iMTAyNiIgLz4NCjwveG1sPjwhW2VuZGlmXS0tPjwh LS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVsYXlvdXQgdjpleHQ9ImVkaXQiPg0KPG86 aWRtYXAgdjpleHQ9ImVkaXQiIGRhdGE9IjEiIC8+DQo8L286c2hhcGVsYXlvdXQ+PC94bWw+PCFb ZW5kaWZdLS0+DQo8L2hlYWQ+DQo8Ym9keSBsYW5nPSJFTi1HQiIgbGluaz0iYmx1ZSIgdmxpbms9 InB1cnBsZSI+DQo8ZGl2IGNsYXNzPSJXb3JkU2VjdGlvbjEiPg0KPGRpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj5PbiBGcmksIEF1ZyAxNiwgMjAxOSBhdCAwNzoyMSA8c3BhbiBsYW5n PSJFTi1VUyI+Um9iIFNheXJlICZsdDtzYXlyZXJAZ21haWwuY29tJmd0Ow0KPC9zcGFuPndyb3Rl OjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPiZndDsgQWgsIHllcy4gSSBsb29rZWQgaW50byB0aGlzIGlzc3VlIGEgYml0IG1vcmUuIE15 IEFuZHJvaWQgcGhvbmUgYXV0b21hdGljYWxseSBzd2l0Y2hlcyBvbg0KPG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mZ3Q7IGEgVlBOIGlmIHRoZSBXaUZpIGFjY2VzcyBwb2lu dCBpcyBpbiB0aGVpciBkYXRhYmFzZSBhbmQgaXMgb3BlbiAobm8gcGFzc3dvcmQsIG5vIHBvcnRh bCkuIEl0DQo8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZndDsgdHVybnMg b3V0IGl0IGlzIHRoZSBkZWZhdWx0IHNldHRpbmcgb24gdGhlIGhhbmRzZXQsIGJlY2F1c2UgaXQn cyBhIEdvb2dsZSBGaSBkZXZpY2UuDQo8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPiZndDsgJmx0OzxhIGhyZWY9Imh0dHBzOi8vbWFpbGFyY2hpdmUuaWV0Zi5vcmcvYXJjaC9t c2cvYWRkL2V4bkNsZ3NRTU5tVlUwMHYzZkVVV0JIUjlXRSI+aHR0cHM6Ly9tYWlsYXJjaGl2ZS5p ZXRmLm9yZy9hcmNoL21zZy9hZGQvZXhuQ2xnc1FNTm1WVTAwdjNmRVVXQkhSOVdFPC9hPiZndDs8 bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZndDs8bzpwPiZuYnNwOzwvbzpw PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZndDsgSXQgZG9lc24ndCBzZWVtIGxpa2UgdGhl c2UgJnF1b3Q7bGVnYWwgcmVxdWlyZW1lbnRzJnF1b3Q7IGFyZ3VtZW50cyBhcmUgdmVyeSB1cC10 by1kYXRlLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj5XaGljaCBtYXJrZXQocykgZGlkIHRoZXNlIGludmVzdGlnYXRpb25zIGNvdmVyLCBiZWFy aW5nIGluIG1pbmQgdGhhdCBsZWdhbCByZXF1aXJlbWVudHMgb24gYm90aCBhY2Nlc3MgcHJvdmlk ZXJzIGFuZCBvdGhlcnMgdmFyeSBjb25zaWRlcmFibHkgYXJvdW5kIHRoZSB3b3JsZD8mbmJzcDsN CjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMi4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvYj48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+QW5kcmV3PG86 cD48L286cD48L3NwYW4+PC9iPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+ DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_LO2P265MB132779C3E3506E2C01D6FFEBC2AF0LO2P265MB1327GBRP_-- From nobody Fri Aug 16 02:47:38 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BCB7512004F for ; Fri, 16 Aug 2019 02:47:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=netorgft5189650.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id q6XvUH3Mlmzv for ; Fri, 16 Aug 2019 02:47:34 -0700 (PDT) Received: from GBR01-LO2-obe.outbound.protection.outlook.com (mail-eopbgr100057.outbound.protection.outlook.com [40.107.10.57]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 90903120024 for ; Fri, 16 Aug 2019 02:47:34 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=H1S1VLPRPhT25nJHawf2FEQdBUokY1pbvwbrgpVau+A2IUiOlbsREy/onCM9nn6cf2x0R7JNmMSy/qEGKRnSsJ82SHRexH1IZ0DJe0uempMk4sQFJ3v6VSVFlFxcUuczZGo8vsDZ5LDi8u0RRqQv6JpKGit9/IHGXOi3LptjbxlGugaOwpfTBXNdsfVsNjDc+bzB1863LwWK7uu4SuoWgBxGNvtNqBQ4WZjCqS3LgTfun82tV5btUBshJEpMCND5l78frvVoPxhc0Fs2XsW3n8AZo6VsaUPhFOocnzHZ4fa1R2GTMs8g2ppMOrGw44v/p9zf01OomZWcwljfhMpHfQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=tUbgld/wJcQQQvJY/cxjiJr2+//A5uZ4OTe2x3IEDjQ=; b=AmTzm7bLf9HNPMA/a32660gi0v27ga8oCKcihuEZDp5i6nw+yQPx1pRnzLRdlGXLDMoMDUT8HYvVqorKY89g7+U+mXrF5eurkittS/HZ9gLIK9PzNdakP93dM2A0yP96ghVRlrnGJSk558hlnVRuLYtAwX3Zvft2OjdUh4+rpaH5uS7q3mk6mL2RFk59bMo+wlDyYExzuUZsEvXrTAh6wJFfBEGjmO8x9eT2QwPE6FaV2IMEMElajRQ+bKUdZK8OhA/lBXvP/V4NMqqgGLPqsbis3YFsY47YWNEjE/mfPbYDCR0r/Ca6qKTZPzrGGWzzQ9ftqC18sluuICvO/JlFgg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=419.consulting; dmarc=pass action=none header.from=419.consulting; dkim=pass header.d=419.consulting; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=NETORGFT5189650.onmicrosoft.com; s=selector1-NETORGFT5189650-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=tUbgld/wJcQQQvJY/cxjiJr2+//A5uZ4OTe2x3IEDjQ=; b=gQsXv3ONLIVn1InCSf8EorNt6yDX/esrerdR3jlEGeRXEuyqW0FIKzgsOQRvdthm2goG3Pp8O6SQ02riHUDjMPb1IMhuvlITeJECq2ffeLSA/n16utu8nSXx3jFJDKTKYxtlkY53L5zQd3FeoaBzPsj9qQCvK3B0jGZkgoOXXjI= Received: from LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM (20.176.138.146) by LO2P265MB1311.GBRP265.PROD.OUTLOOK.COM (20.176.143.15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2178.16; Fri, 16 Aug 2019 09:47:32 +0000 Received: from LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM ([fe80::64e9:9b9e:59fc:26f]) by LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM ([fe80::64e9:9b9e:59fc:26f%5]) with mapi id 15.20.2157.022; Fri, 16 Aug 2019 09:47:32 +0000 From: Andrew Campling To: Frode Kileng , Bret Jordan CC: ADD Mailing list Thread-Topic: [Add] [Ext] Validity of network administrator role Thread-Index: AQHVVAByluszgrddA0aqE6+h3qORLKb9hLjA Date: Fri, 16 Aug 2019 09:47:32 +0000 Message-ID: References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <8e00891f-2aa2-ee11-559a-b5a8967b22d9@nostrum.com> <2C23D415-84F9-4B6C-B67B-0CC3EB600520@gmail.com> <2704899B-E43D-4978-A3C9-30E9E7CEBEBD@fugue.com> <4CC4C262-BEF4-4B39-ACB1-A595AB66D6CD@gmail.com> In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=andrew.campling@419.consulting; x-originating-ip: [2a00:23c4:a499:2e00:55a7:59be:7d65:cfb6] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: a7f7ae7b-3aaa-4b09-6ad4-08d7222ec26b x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(7021145)(8989299)(4534185)(7022145)(4603075)(4627221)(201702281549075)(8990200)(7048125)(7024125)(7027125)(7023125)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:LO2P265MB1311; x-ms-traffictypediagnostic: LO2P265MB1311: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:8882; x-forefront-prvs: 0131D22242 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(376002)(396003)(346002)(366004)(39830400003)(136003)(199004)(189003)(81166006)(110136005)(446003)(6116002)(316002)(76116006)(66446008)(66556008)(66946007)(74316002)(7736002)(25786009)(64756008)(66476007)(305945005)(66574012)(71190400001)(71200400001)(102836004)(229853002)(2906002)(53546011)(55016002)(6506007)(7696005)(9686003)(76176011)(186003)(6436002)(46003)(99286004)(508600001)(86362001)(486006)(11346002)(5660300002)(52536014)(8676002)(81156014)(53936002)(44832011)(14454004)(476003)(256004)(14444005)(8936002)(4326008)(33656002)(6246003)(46492003); DIR:OUT; SFP:1101; SCL:1; SRVR:LO2P265MB1311; H:LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: 419.consulting does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: BqpbZkvgqqObnybHd/2McvbHBgDmAAFAr9aemodhz1/u7BgI4/VnArlkJfatlxNUlXh0zAgo4GkMZJA3uVoeSEQDiENKt7W7cWHjkOqEdhYvHaWhsYgeGOlNGr89NkYUPc9JPvwZUoLaPsY6KWhhFkfb9pH6AtWrQ6uahTjDm8P9b/ZWZESmKNsslcnmM2baz1CwcqOPMZZ/I/tbokoVPk0UcyWOGSqRQJUGZzvAFxDGUFY6igTSQrGvqQFrIpZ1Zr1q2lvHrsxOnCvb/msYLyrnP0+LrV9Gp6Kmqfp0rThPvs40RU8h6HV/kBq9+wxaNARg05n/OpNDmCwdtfuOl7XwLL86cLdLFehDx+DeIOLB0d30QatTCt0tgaQ3RjXv58Y74D1eLPFEkCoCl7zkLhcrXdgHNmT8tJfulxaj+PY= x-ms-exchange-transport-forked: True Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: 419.consulting X-MS-Exchange-CrossTenant-Network-Message-Id: a7f7ae7b-3aaa-4b09-6ad4-08d7222ec26b X-MS-Exchange-CrossTenant-originalarrivaltime: 16 Aug 2019 09:47:32.1484 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 9c2ced3e-7522-4755-87dc-f983abc66ec3 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: 5878SBIR+tOgHy3rtEI2+clEhvwXXAWsAJloLfvnhR6Vn8Kvjmr/yVQW+OiSnoDDduqHJs6HQMpg9r5ABkDlVbSnn2q8/FAQmcno1m2a1DA= X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO2P265MB1311 Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 09:47:38 -0000 T24gMTYvMDgvMjAxOSAwNzo1NiwgRnJvZGUgS2lsZW5nIDxmcm9kZWtAdGVsZS5ubz4gd3JvdGU6 DQoNCj4gVGhlcmUgYXJlIG51bWVyb3VzIG90aGVyIGNsaWVudC1zaWRlIGNoaWxkLXNhZmUgcHJv ZHVjdHMgaW4gdGhlIG1hcmtldHMgdGhhdCB3aWxsIA0KPiBjb250aW51ZSB0byB3b3JrIHBlcmZl Y3RseSB3ZWxsLiBQbGVhc2UgcGxlYXNlIHN0b3AgdXNpbmcgdGhpcyAic2F2ZSB0aGUgY2hpbGRy ZW4iIA0KPiBhcmd1bWVudCB0aGF0IGhhcyBiZWVuIGZyb250ZWQgYnkgdGhlICJhbnRpLWVuY3J5 cHRpb24gY2FtcCIgZm9yIHRoZSBsYXN0IDUgeWVhcnMuDQoNCldoaWxzdCB0aGVyZSBtYXkgYmUg YWx0ZXJuYXRpdmUgY2hpbGQtc2FmZSBwcm9kdWN0cywgaXQgc2hvdWxkIGJlIHJlbWVtYmVyZWQg dGhhdCBhdCBsZWFzdCBzb21lIElTUHMgcHJvdmlkZSBwYXJlbnRhbCBjb250cm9scyB1c2luZyBE TlMgZmlsdGVyaW5nIChhbmQgbWFsd2FyZSBwcm90ZWN0aW9uKSBhcyBwYXJ0IG9mIHRoZWlyIHNl cnZpY2UgYnVuZGxlLCBtYWtpbmcgaXQgcmVsYXRpdmVseSBzaW1wbGUgZm9yIHRoZWlyIGN1c3Rv bWVycyB0byBjb25maWd1cmUgYW5kIHVzZSB0aGUgc2VydmljZXMuICBUaGVzZSBhcmUgZ2VuZXJh bGx5IHByb3ZpZGVkIGF0IG5vIGFkZGl0aW9uYWwgY29zdCBhbmQsIGluIHNvbWUgaW5zdGFuY2Vz LCBhcmUgZW5hYmxlZCBieSBkZWZhdWx0LiAgSGF2aW5nIGEgcHJvdG9jb2wgbGlrZSBEb0ggYnlw YXNzIHN1Y2ggc2VydmljZXMgd2l0aG91dCBkdWUgd2FybmluZyB0byB0aG9zZSB1c2VycyBpcyBh IHByb2JsZW0uICBIYXZpbmcgdG8gc2hhcmUgZGF0YSB3aXRoIGFuIGFsdGVybmF0ZSBhcHAgcHJv dmlkZXIgdG8gcmVjdGlmeSB0aGUgc2l0dWF0aW9uIG1heSBhbHNvIGJlIGEgcHJvYmxlbSB0byBz b21lIG9mIHRob3NlIHVzZXJzLCBwYXJ0aWN1bGFybHkgaWYgdGhhdCBwcm92aWRlciBpcyBiYXNl ZCBvZmYtc2hvcmUgZnJvbSB0aGUgdXNlci4gIA0KDQpOQiBUaGlzIGhhcyBub3RoaW5nIHRvIGRv IHdpdGggYW50aS1lbmNyeXB0aW9uLCBpcyBhYm91dCB1bmRlcnN0YW5kaW5nIHRoZSBiZWhhdmlv dXJzIGFuZCBleHBlY3RhdGlvbnMgb2YgcmVndWxhciB1c2VycyAoYW5kIHJlZ3VsYXRvcnMgYW5k IHBvbGl0aWNpYW5zIGZvciB0aGF0IG1hdHRlciwgYWx0aG91Z2ggdGhlc2UgYXJlIHNlcGFyYXRl IGNvbnNpZGVyYXRpb25zKS4gIA0KDQoNCg0KDQo= From nobody Fri Aug 16 02:55:25 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0FCC41200E6 for ; Fri, 16 Aug 2019 02:55:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=netorgft5189650.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Y0VaMM4inDS0 for ; Fri, 16 Aug 2019 02:55:22 -0700 (PDT) Received: from GBR01-CWL-obe.outbound.protection.outlook.com (mail-eopbgr110051.outbound.protection.outlook.com [40.107.11.51]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DF64E120024 for ; Fri, 16 Aug 2019 02:55:21 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=lFpnZwZKn2B8j9kraYrKRhgt30kLAveZZ+hAyoZzjXR1jn0GlODkEOd72k8aYNCoecS1yJDRODhxPFAup1G6LQM5nVDjAGMg5kFi/iVwkqpMpI4o5sfHwjwf9g/Wc4Whi3oC3F9OYAHacddQjsFvRhZ2Ho8+0W4q8kMf5SQscHzBhNiAoZvmUFGgzc7WSvXL2xwlEHEml9Rj/2jGraYg7/4zGKtYy17FT9DnoyIXYBsHoqeedbZlyGp3zHpcC7nfFNFpl7AO97xAfCyX59kDUuUtZWJSbE/O/5VCWUzmGuac4jw+aNDchfY5iqz/WpAlVChYLvlm1t4rvZWjXNOlWg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=YzQk8b7+gIVdZVk0EaZOk7t1pjDcs0n4j5TtJQj6EXE=; b=Kupca8PvsIJ7maERE7Qig42LuVNeRPD7bSFC8B3+lmcIVt3DgUNX9fpyqHlsRgr3JQQPu6tqyX0Q0eFRPGjWxUpnHg1lGXF6BL8c96RpVKQA9bHo6o8ImbfPwxG8WC2szSsy8D+IEwL3nd4Ibt0VmgPGrbUsMB68KXgwd8/wBhhdqzbogV89nzp8S6znodMBavvnMz5wg+WGokj8yNNw5Au+jI9wJA+JC1hDfxi9dAjVfjY5eHmDwuyuHnqZLQXIQS74Cq+qNILsFyTPR8Z9J6awyEBUMdhZD53al6UGv12PAALzyZlVdtjC3dXKT4a9HLTRH1Re4xJvkfA0xlQozw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=419.consulting; dmarc=pass action=none header.from=419.consulting; dkim=pass header.d=419.consulting; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=NETORGFT5189650.onmicrosoft.com; s=selector1-NETORGFT5189650-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=YzQk8b7+gIVdZVk0EaZOk7t1pjDcs0n4j5TtJQj6EXE=; b=as7AVvs0+k6PYvZ2xxwLg0wvn4DvyuYbo9TuXAfinsEog5MMyifOJ/qnfqL/yQsEJbLRygcHuvBihzjMXupS8Zlk/XjaBRcSS9wJzIf6aIf+egTL5V7Dp6Pst4AdHUwkqXwHBIcfC0zH1xjAkQlWbJGgNguduFJIJjCsFBldl0w= Received: from LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM (20.176.138.146) by LO2P265MB1390.GBRP265.PROD.OUTLOOK.COM (20.176.145.10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2178.16; Fri, 16 Aug 2019 09:55:19 +0000 Received: from LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM ([fe80::64e9:9b9e:59fc:26f]) by LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM ([fe80::64e9:9b9e:59fc:26f%5]) with mapi id 15.20.2157.022; Fri, 16 Aug 2019 09:55:19 +0000 From: Andrew Campling To: Alec Muffett , =?utf-8?B?UGF0cmlrIEbDpGx0c3Ryw7Zt?= CC: Stephen Farrell , ADD Mailing list Thread-Topic: [Add] Use Cases - the coffee shop Thread-Index: AdVTdTO8sMFf9NSjRg6hhfqT7Scbe6b9h+AA Date: Fri, 16 Aug 2019 09:55:19 +0000 Message-ID: References: <400b774a-5bd0-d6f4-5640-e561f067a9b5@cs.tcd.ie> <74A2E5E0-02CE-4C9D-A66B-1D2FBC65B39A@frobbit.se> <3611F27A-49A9-4159-A683-3BBD4C2F91EA@frobbit.se> In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=andrew.campling@419.consulting; x-originating-ip: [2a00:23c4:a499:2e00:55a7:59be:7d65:cfb6] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: f181b165-7f83-4b77-eaa0-08d7222fd925 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(7021145)(8989299)(4534185)(7022145)(4603075)(4627221)(201702281549075)(8990200)(7048125)(7024125)(7027125)(7023125)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:LO2P265MB1390; x-ms-traffictypediagnostic: LO2P265MB1390: x-ms-exchange-purlcount: 1 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:6430; x-forefront-prvs: 0131D22242 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(396003)(346002)(376002)(39830400003)(366004)(136003)(189003)(199004)(8676002)(229853002)(66476007)(25786009)(5660300002)(66556008)(66446008)(81166006)(76116006)(66946007)(81156014)(64756008)(8936002)(6506007)(4744005)(66574012)(52536014)(102836004)(4326008)(186003)(6306002)(54896002)(316002)(54906003)(99286004)(6436002)(236005)(55016002)(110136005)(9686003)(44832011)(71190400001)(53936002)(486006)(476003)(46003)(446003)(11346002)(7736002)(71200400001)(86362001)(74316002)(6246003)(76176011)(508600001)(7696005)(606006)(33656002)(2906002)(6116002)(790700001)(14454004)(256004)(14444005)(966005)(46492003); DIR:OUT; SFP:1101; SCL:1; SRVR:LO2P265MB1390; H:LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: 419.consulting does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: Ym+3btvtF4LxKX850B5qcuS8YQ2JnobbiHTxMB4JX+q9gieo/OU3i4EO+AMZ0ZcPeDAoR8iZh1veBXTYItGedNzOyN74Ordqd2q2eGpH9q7rE4dk7CQcJxxaODoxctU2Hrkg+YeB8/6PXtob3oRpSF6Mom2F3xbhcmOFGtxir4Se/vf3anjg3Wiw8tqK9EXm7ooV1l34nmyYckXW8MpKVPWAo9mKmv25bx4pcbpppCXG9gnIloMqGAJOG3v+M5Y/KGGsRsvcOmlEJzs4A0I3t12sSmZw4jlSJaECaJfWr36XouRwjNZMaCKpqt6a32YEtgm0TGft3+6L3NoZEjWtjhwG+EnK21veZ9jX1DiA3cSSHuHDoArRq4N/YgxprqYlmsL4J/eo+w2qwlw28usK2oX0EJcPtTVuz3lxFMxO/rM= x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_LO2P265MB1327B5AB3CD8D1D500FBCEEEC2AF0LO2P265MB1327GBRP_" MIME-Version: 1.0 X-OriginatorOrg: 419.consulting X-MS-Exchange-CrossTenant-Network-Message-Id: f181b165-7f83-4b77-eaa0-08d7222fd925 X-MS-Exchange-CrossTenant-originalarrivaltime: 16 Aug 2019 09:55:19.7542 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 9c2ced3e-7522-4755-87dc-f983abc66ec3 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: KyPXKJvNWc4DHN8G8vjR/p/4IdbpJyoqiA0cv9X2eJr1jg6K/V/ZZmke/uixVmFvR5FffiMs1VGyG0CpOrENSEffO6aeFD3unuiD1g5RcYA= X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO2P265MB1390 Archived-At: Subject: Re: [Add] Use Cases - the coffee shop X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 09:55:24 -0000 --_000_LO2P265MB1327B5AB3CD8D1D500FBCEEEC2AF0LO2P265MB1327GBRP_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 T24gRnJpLCAxNiBBdWcgMjAxOSwgMDg6MDEgQWxlYyBNdWZmZXR0IDxhbGVjLm11ZmZldHRAZ21h aWwuY29tPiB3cm90ZToNCg0KPiBCdXQgaXQncyAqbm90KiBnb29kIGVub3VnaCwgaXMgaXQ/IEFu eW9uZSBjYW4gYWNjZXNzIFRvciwgYW5kIFZQTnMgYXJlIGV4dHJlbWVseSBwb3B1bGFyLg0KPg0K PiBPbiB0aGF0IGJhc2lzLCB3aHkgYXJlIHlvdSBub3QgbG9iYnlpbmcgeW91ciBsZWdpc2xhdG9y cyB0byBjcmFjayBkb3duIG9uIHRoaXMgZXhpc3RpbmcgYW5kIHBvcHVsYXIgaGF6YXJkPw0KPg0K PiBFdmlkZW5jZToNCj4NCj4gaHR0cHM6Ly93d3cuZmFjZWJvb2suY29tL25vdGVzL2ZhY2Vib29r LW92ZXItdG9yLzEtbWlsbGlvbi1wZW9wbGUtdXNlLWZhY2Vib29rLW92ZXItdG9yLzg2NTYyNDA2 Njg3NzY0OC8NCj4gKGRpc2Nsb3N1cmU6IEkgaGFkIHRoZSBob25vdXIgb2YgYXV0aG9yaW5nIHRo aXMpDQoNClRoaXMgcmVwcmVzZW50cyBsZXNzIHRoYW4gb25lIHBlcmNlbnQgb2YgYWN0aXZlIEZh Y2Vib29rIHVzZXJzLCBkb2VzbuKAmXQgYnkgaXRzZWxmIGNoYWxsZW5nZSB0aGUg4oCcZ29vZCBl bm91Z2jigJ0gcG9pbnQgYmVpbmcgbWFkZSBhbmQgY2VydGFpbmx5IGlzbuKAmXQgYSDigJxwb3B1 bGFyIGhhemFyZOKAnSByZWxhdGl2ZSB0byB0aGUgdG90YWwgdW5pdmVyc2Ugb2YgaW50ZXJuZXQg dXNlcnMuDQoNCg0K --_000_LO2P265MB1327B5AB3CD8D1D500FBCEEEC2AF0LO2P265MB1327GBRP_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBjbTsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQph OmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xv cjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFuLk1z b0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpwdXJw bGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwLm1zb25vcm1hbDAsIGxpLm1zb25v cm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCgltc28t bWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGNtOw0KCW1zby1tYXJnaW4tYm90 dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBjbTsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZv bnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCnNwYW4uRW1haWxTdHlsZTE4DQoJe21z by1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5z LXNlcmlmOw0KCWNvbG9yOndpbmRvd3RleHQ7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0eWxl LXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJ bXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVM7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6 NjEyLjBwdCA3OTIuMHB0Ow0KCW1hcmdpbjo3Mi4wcHQgNzIuMHB0IDcyLjBwdCA3Mi4wcHQ7fQ0K ZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQotLT48L3N0eWxlPjwhLS1b aWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVkZWZhdWx0cyB2OmV4dD0iZWRpdCIgc3BpZG1h eD0iMTAyNiIgLz4NCjwveG1sPjwhW2VuZGlmXS0tPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0K PG86c2hhcGVsYXlvdXQgdjpleHQ9ImVkaXQiPg0KPG86aWRtYXAgdjpleHQ9ImVkaXQiIGRhdGE9 IjEiIC8+DQo8L286c2hhcGVsYXlvdXQ+PC94bWw+PCFbZW5kaWZdLS0+DQo8L2hlYWQ+DQo8Ym9k eSBsYW5nPSJFTi1HQiIgbGluaz0iYmx1ZSIgdmxpbms9InB1cnBsZSI+DQo8ZGl2IGNsYXNzPSJX b3JkU2VjdGlvbjEiPg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPk9uIEZyaSwgMTYgQXVnIDIwMTksIDA4OjAxIDxzcGFuIGxhbmc9IkVOLVVTIj5BbGVj IE11ZmZldHQgJmx0O2FsZWMubXVmZmV0dEBnbWFpbC5jb20mZ3Q7DQo8L3NwYW4+d3JvdGU6PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PGJyPg0KJmd0OyBCdXQgaXQncyAqbm90KiBnb29kIGVub3VnaCwgaXMgaXQ/IEFu eW9uZSBjYW4gYWNjZXNzIFRvciwgYW5kIFZQTnMgYXJlIGV4dHJlbWVseSBwb3B1bGFyLjxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jmd0OzxvOnA+ Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPiZndDsgPC9zcGFuPk9uIHRoYXQgYmFzaXMsIHdo eSBhcmUgeW91IG5vdCBsb2JieWluZyB5b3VyIGxlZ2lzbGF0b3JzIHRvIGNyYWNrIGRvd24gb24g dGhpcyBleGlzdGluZyBhbmQgcG9wdWxhciBoYXphcmQ/PG86cD48L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mZ3Q7PG86cD4mbmJzcDs8L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjEyLjBwdCI+Jmd0OyA8L3NwYW4+RXZpZGVuY2U6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mZ3Q7IDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+Jmd0OyA8YSBocmVmPSJodHRwczovL3d3dy5mYWNlYm9vay5jb20vbm90ZXMv ZmFjZWJvb2stb3Zlci10b3IvMS1taWxsaW9uLXBlb3BsZS11c2UtZmFjZWJvb2stb3Zlci10b3Iv ODY1NjI0MDY2ODc3NjQ4LyI+DQpodHRwczovL3d3dy5mYWNlYm9vay5jb20vbm90ZXMvZmFjZWJv b2stb3Zlci10b3IvMS1taWxsaW9uLXBlb3BsZS11c2UtZmFjZWJvb2stb3Zlci10b3IvODY1NjI0 MDY2ODc3NjQ4LzwvYT4NCjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPiZndDsgPC9zcGFuPihkaXNjbG9zdXJlOiBJIGhh ZCB0aGUgaG9ub3VyIG9mIGF1dGhvcmluZyB0aGlzKTxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+VGhpcyByZXByZXNl bnRzIGxlc3MgdGhhbiBvbmUgcGVyY2VudCBvZiBhY3RpdmUgRmFjZWJvb2sgdXNlcnMsIGRvZXNu 4oCZdCBieSBpdHNlbGYgY2hhbGxlbmdlIHRoZSDigJxnb29kIGVub3VnaOKAnSBwb2ludCBiZWlu ZyBtYWRlIGFuZCBjZXJ0YWlubHkgaXNu4oCZdCBhIOKAnHBvcHVsYXIgaGF6YXJk4oCdIHJlbGF0 aXZlIHRvIHRoZSB0b3RhbCB1bml2ZXJzZSBvZiBpbnRlcm5ldA0KIHVzZXJzLiZuYnNwOyA8bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjEyLjBwdCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_LO2P265MB1327B5AB3CD8D1D500FBCEEEC2AF0LO2P265MB1327GBRP_-- From nobody Fri Aug 16 03:05:28 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B627A12010F for ; Fri, 16 Aug 2019 03:05:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=netorgft5189650.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id K72Xve07Cu8f for ; Fri, 16 Aug 2019 03:05:24 -0700 (PDT) Received: from GBR01-CWL-obe.outbound.protection.outlook.com (mail-eopbgr110064.outbound.protection.outlook.com [40.107.11.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 248E0120024 for ; Fri, 16 Aug 2019 03:05:24 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=JyZ48fofgXj7+pB+ud+NXIi9B5ItmNCZX3dJoNplsf+4EhXVdAZ7d+LUegD+wkRMq+HKrDh4raUEHljUSnCZuDZ5RPssJ0hkylgFVqjFOVdrHUy31MnAbp6OkOd2GaQMwCJ1cuZJO+9wsZEUeE+uibPHysFJR0Vz7pEMdUf+lx4omhdkyHTAFqtUl7LWpDIHFcSKMsPJl052iYSTD4z5KR+h1/7GWhR3enyN3tetJYo9ieLsytcs4HvzN6TG02eO/+nB69zhbFbNDVyIsvMfx0qfFt6TL1xAJ/N4vDQg/KUYyizfbObv5FB2oerr34VdTZfCU7Ug4T/uudPOeZXdTw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=k6zFoY5JDDzu85DcDaZ6tphasRFrGt43s5OSYcaElRA=; b=fQ2QqU7MIvL0b6WywYQVCiN79EiuOFJjR3h5bunerRX9hjGaP8o43nt04vcbwNlkBmRPghpK8y+AW5dlpBgUM60bBeRZ3YJTNDWiJAoFqPS+djlN4oQcbcnVwSG9Cpsf/wnShMrV4ttnmuZIcuQZkC8S/7wWs8x69mbuzkOVNAYqqSOIPA/xLvbpIeRhGE6vVWju9DIAnBuu7Bcc+wJQ4PFxn0C+zDIMDafYKDu/vujthkl2VmlTpfeIku2UtcV/xUQLAx0hrP7vS3zxpDiGKXO693t2cveVQf1jW5FLpiBfkFKgYXinnH4d9FF7uVIR2bXJ9wlJ309XvUnfsF8dPw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=419.consulting; dmarc=pass action=none header.from=419.consulting; dkim=pass header.d=419.consulting; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=NETORGFT5189650.onmicrosoft.com; s=selector1-NETORGFT5189650-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=k6zFoY5JDDzu85DcDaZ6tphasRFrGt43s5OSYcaElRA=; b=aNzKbuJpSwBuNe2sUhlqfUn7Ex7GLiziutE7QYg7CyzcE/33k8Fc7Fy1l8FxY2Ej5eMLmFQYRHKwNxllPtKUCo86mCwnCT2bpdY5QKe9HXQM62M7dozTqQHwz+yE8z2PjDoavnc6U57jEWB3S5/SppJStmuro9VU2bx/mf9Hpik= Received: from LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM (20.176.138.146) by LO2P265MB1087.GBRP265.PROD.OUTLOOK.COM (20.176.141.15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2157.14; Fri, 16 Aug 2019 10:05:21 +0000 Received: from LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM ([fe80::64e9:9b9e:59fc:26f]) by LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM ([fe80::64e9:9b9e:59fc:26f%5]) with mapi id 15.20.2157.022; Fri, 16 Aug 2019 10:05:21 +0000 From: Andrew Campling To: Joe Abley , Ted Lemon CC: ADD Mailing list Thread-Topic: [Add] Use Cases - the coffee shop: DoH and Authentication Thread-Index: AdVUGhoAIQuk0GiITnmv9JrxK6MriQ== Date: Fri, 16 Aug 2019 10:05:21 +0000 Message-ID: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=andrew.campling@419.consulting; x-originating-ip: [2a00:23c4:a499:2e00:55a7:59be:7d65:cfb6] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 3eab33e9-618c-4f23-fd81-08d722313fde x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(7021145)(8989299)(4534185)(7022145)(4603075)(4627221)(201702281549075)(8990200)(7048125)(7024125)(7027125)(7023125)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:LO2P265MB1087; x-ms-traffictypediagnostic: LO2P265MB1087: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:7219; x-forefront-prvs: 0131D22242 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(366004)(39830400003)(376002)(346002)(396003)(136003)(199004)(189003)(4326008)(25786009)(81156014)(53936002)(256004)(229853002)(9686003)(81166006)(476003)(55016002)(6436002)(486006)(2906002)(316002)(102836004)(5660300002)(4744005)(8936002)(6506007)(71200400001)(508600001)(186003)(71190400001)(6246003)(33656002)(86362001)(4743002)(64756008)(44832011)(14454004)(99286004)(66556008)(6116002)(8676002)(66476007)(7736002)(74316002)(46003)(7696005)(53546011)(66446008)(52536014)(66946007)(76116006)(110136005)(305945005)(46492003); DIR:OUT; SFP:1101; SCL:1; SRVR:LO2P265MB1087; H:LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: 419.consulting does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: UaNQl4l3lXGpyyzyN+SFc576cyXNwqih1l1mTDNZLrhiA+P1iVwGjAa30g0iJnIjTnyO1kXvQPDPpvnWHd+CgLA7CqjT+nb7EALADa4DvrwfWMTgAC39LjuJpw18Hl8ndrMgS52hESKMwGkQU1iwlmvJ9axeeS912jEbSC33lU1GhxjetkSrPLtTUA05qEZYwHMtjUr3dge6iwJVLJAv2vafpS0L0rpDvuNdXXd++xe+Py55fDlBNVAjO5Wf6Z2IRvltPa5HCs1XDm9tcaViXWh6bBeMIy24ei5GrO9yxw3tCkQLVdtfEF/9SI4XNkrgT+1t0wir9sD1XQpheUaRd10AAYCffvbFEf3Xbg6nmq+aEcjcOduDBzqW+XPTHJJMij/dLGPrBpXNvPEHTcCjvXggt8lPDVEct7SmivAAWnI= x-ms-exchange-transport-forked: True Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: 419.consulting X-MS-Exchange-CrossTenant-Network-Message-Id: 3eab33e9-618c-4f23-fd81-08d722313fde X-MS-Exchange-CrossTenant-originalarrivaltime: 16 Aug 2019 10:05:21.3746 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 9c2ced3e-7522-4755-87dc-f983abc66ec3 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: 3byq6/p8XPDhya6r87n+LbZZ5UOXhem6m/97NkuwqRxt4ALAVCHz3i9nPTDgiVarS8YxoFxU5MEEj5feOQt9KirVvwLqEp/ARkjvwiXus7Q= X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO2P265MB1087 Archived-At: Subject: Re: [Add] Use Cases - the coffee shop: DoH and Authentication X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 10:05:26 -0000 T24gQXVnIDE1LCAyMDE5LCBhdCAxODo1MCwgSm9lIEFibGV5IDxqYWJsZXlAaG9wY291bnQuY2E+ IHdyb3RlOg0KPiBJbiB5b3VyIHZpZXcsIHdoYXQgaXMgbWlzc2luZyBpbiBIVFRQUyBhdXRoZW50 aWNhdGlvbiB0aGF0IGlzIG5lZWRlZCBmb3IgRG9IPw0KDQpPbiBBdWcgMTUsIDIwMTksIGF0IDE4 OjU2LCBUZWQgTGVtb24gPG1lbGxvbkBmdWd1ZS5jb20+d3JvdGU6DQo+IEZvcnR1bmF0ZWx5IERv SCBwcm92aWRlcyBhdXRoZW50aWNhdGlvbi4gDQoNCkJ5IGl0c2VsZiwgRG9IIGRvZXMgbm90aGlu ZyB0byBhZGRyZXNzIHRoZSBhdXRoZW50aWNpdHkgb2YgYSByZXNwb25zZSwgd2hpY2ggY291bGQg c3RpbGwgYmUgdGFtcGVyZWQgd2l0aCBlbHNld2hlcmUuICBPYnZpb3VzbHkgY29tYmluaW5nIERv SCAob3IgRG9UKSB3aXRoIEROU1NFQyBpbXByb3ZlcyB0aGlzIHNpdHVhdGlvbi4NCiAgDQo= From nobody Fri Aug 16 03:09:45 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AC6D11200F3 for ; Fri, 16 Aug 2019 03:09:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id avvPSxzo6eC0 for ; Fri, 16 Aug 2019 03:09:42 -0700 (PDT) Received: from mail-yb1-xb30.google.com (mail-yb1-xb30.google.com [IPv6:2607:f8b0:4864:20::b30]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5BE45120024 for ; Fri, 16 Aug 2019 03:09:42 -0700 (PDT) Received: by mail-yb1-xb30.google.com with SMTP id q5so1794213ybp.1 for ; Fri, 16 Aug 2019 03:09:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=j9kooRKZyXM8zMzVW64Jef6T1rRBX0Qf4adTRDEPMjQ=; b=acX5aEJswa1KrM7afkrpBw5ITIZveZplfAwtKIzwR+oYFZQvhIXzkGltSt8Ki81Bw7 xodt9j6Dc7YiJT1+qbkB0QefZPmO/qIW0J0XSAEQIOdADmffsb2HykWXOv/9XkOmPELq BlE4Z2PF8pFQqTxZmog2xTXDTv+rXyu6F2xtrAoww/P9ddZKHOTixevyjxA+kdWigHO3 hHm5GufXqfJa53zJw9yUKvFLQKrSyHp7Owh0+Wp8btjRO0qHP2YtLVMScqPPyzZDDojK XHoNEv13PPBygtDdlLU7Q4KZzymzO54GsDdBQmkKTZRvkQ8b3j5cTEuo4unUzUFCqsKo fUyw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=j9kooRKZyXM8zMzVW64Jef6T1rRBX0Qf4adTRDEPMjQ=; b=KWc/8hvyobPt9KiEsa0YLrZEYI67f3QLLncaodoEsP3Hm95otE5hDXA7iI8OzP32uo u9+AJ6JWWK4rCHrDDCzqd9bLWxCZUj3GjNnBrtFR8kXHpPkY9+SctFeLtvzaWHc6UESg 3GcWMPvJeO6hpowP+sEbSKxNZqs9syWtWzTHh1wstpjI72Q9eLIg/1nJ0ScMAyfvdVIT hwS8A5NOdmutWTlog5vtlNR4w3eX7p00NiekWOce51QOdD6yIK3jhr/4uePmvwLJp03M e1kZkWmlpVU/DWWnqxLGp+LJAeCBzl9xXoa8zBjpYTnm/f1KtDO6D4hQZ1mqciilJy5e m50g== X-Gm-Message-State: APjAAAUsnNdm3LzMs1MVOPJX/MvrozU12y5zQEF9FoHsyxrHtt02enA6 C4tIsX4utT6LMU0CxVujeTTv1VBx6qv2ssZdSrVKSA== X-Google-Smtp-Source: APXvYqy0hNnCfH1MbH7d2W5iLiNKuXvj1wZzgXboXaLs130EfzYvOjzDuZZv6rf42NbMli7s5tPobAL6rorMV83E09s= X-Received: by 2002:a25:2cc8:: with SMTP id s191mr6953479ybs.269.1565950181503; Fri, 16 Aug 2019 03:09:41 -0700 (PDT) MIME-Version: 1.0 References: <400b774a-5bd0-d6f4-5640-e561f067a9b5@cs.tcd.ie> <74A2E5E0-02CE-4C9D-A66B-1D2FBC65B39A@frobbit.se> <3611F27A-49A9-4159-A683-3BBD4C2F91EA@frobbit.se> In-Reply-To: From: Alec Muffett Date: Fri, 16 Aug 2019 11:09:29 +0100 Message-ID: To: Andrew Campling Cc: =?UTF-8?B?UGF0cmlrIEbDpGx0c3Ryw7Zt?= , Stephen Farrell , ADD Mailing list Content-Type: multipart/alternative; boundary="0000000000004df46005903930a0" Archived-At: Subject: Re: [Add] Use Cases - the coffee shop X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 10:09:44 -0000 --0000000000004df46005903930a0 Content-Type: text/plain; charset="UTF-8" On Fri, 16 Aug 2019, 10:55 Andrew Campling, wrote: > On Fri, 16 Aug 2019, 08:01 Alec Muffett wrote: > > This represents less than one percent of active Facebook users, > Or: Three times the population of Iceland. That's the thing about perspective, at some point you have to talk about absolute numbers. One million people is a lot of people, and it's grown since that time, because the technology has improved to enable it to get larger and better. :-) -a --0000000000004df46005903930a0 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


On Fri, 16 Aug 2019, 10:55 Andrew Campling, &= lt;andrew.campling@419.consulting> wrote:

On Fri, 16 Aug 2019, 08:01 Alec= Muffett <alec.muffett@gmail.com> wrote:

This represents les= s than one percent of active Facebook users,=C2=A0

Or: Three times the populati= on of Iceland.

That'= s the thing about perspective, at some point you have to talk about absolut= e numbers.

One million p= eople is a lot of people, and it's grown since that time, because the t= echnology has improved to enable it to get larger and better. :-)

-a


--0000000000004df46005903930a0-- From nobody Fri Aug 16 03:14:18 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1A147120115 for ; Fri, 16 Aug 2019 03:14:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xgyvVL9lEm0D for ; Fri, 16 Aug 2019 03:14:15 -0700 (PDT) Received: from mail-yb1-xb2c.google.com (mail-yb1-xb2c.google.com [IPv6:2607:f8b0:4864:20::b2c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B969D120024 for ; Fri, 16 Aug 2019 03:14:15 -0700 (PDT) Received: by mail-yb1-xb2c.google.com with SMTP id s142so1791917ybc.6 for ; Fri, 16 Aug 2019 03:14:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=PxE4MYcmTZxv/pFvHOK+XqlussYUlf4TAMNfuJSgd/Q=; b=aEuRtl5oAWmxwz8l6jtIMSeUk/vxWPyNO23lZyX2qMPZ52oUIQku9D1oLjaeq4XW5o zm3ypKZ5hvHpEtqd6HkC02MSje7razMeKeEV0CZohwLvhMt4FLLOyDVuC8JV1YBT8FeE KkXeywmRxOQ2T8NQTr6/y1Y3rUzrcHehxeV6ADgVvFXIWIIxWuGE02tSJnSNoOAhFMW6 tkpoS3oVnkgHWgvT0nT8tg/8z4aC/dAcGTPGcJQnbKpU1S8j46T4gumbct4slD3p5DHy hG56zGyLUnuH6uH9i0W0rrNvhJ9rTYum9w0l2HYzg/YT5i6C0l7OfilMdpo3NYx9ui6i LFFw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=PxE4MYcmTZxv/pFvHOK+XqlussYUlf4TAMNfuJSgd/Q=; b=HBWXdm0hFfcAGKuOyxmiqdfqKr5aVLBJHLlrGdAhfqfW84qUFM/w17fYTd/D218VhW M4eJavzlyIMW+Ulx/xscd4itM5We0wxG3RRHDSjThSO6NWJKHbTuSk/0aPgGDQIDguCm t0SIyz8BHbCYEUn/p+fv47O6ToiSnv+6i9P/IwtKJQv2ZxF3y77gPrvPcFceFXqC42iB 0sK1Uj6lKBOD1iiq0Fn+KY0tUWpd+tK53PKlw91axfDRckHS9Lf9Qs0rRlwBKlwWgy5N 3ZFKfHxHcRx1OA6t6L2ipSeWlGIOM1SDYAWi02+wChDL1jKRwZrjhYyZkDyPl5+cUb/l rvFQ== X-Gm-Message-State: APjAAAVFV6zvQFpb05rOLYtIk7CWBr7kLSnUb0Z6Ig/uVsXXfgMivHiW hmgerKkECpsYb3RKd5I9/ofRBiHBzWRNheh0DY5T0Q== X-Google-Smtp-Source: APXvYqzT9BOXDW/mWfg4udZjAykwU7PkwyqKFO5Dju/MWkDe1dhyMQlGwUxT1nyc/2IARsFM6XuLgTkKiUwjuzLDMYY= X-Received: by 2002:a25:1e07:: with SMTP id e7mr241026ybe.501.1565950454897; Fri, 16 Aug 2019 03:14:14 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Alec Muffett Date: Fri, 16 Aug 2019 11:14:04 +0100 Message-ID: To: Andrew Campling Cc: Joe Abley , Ted Lemon , ADD Mailing list Content-Type: multipart/alternative; boundary="00000000000099a0c505903940ce" Archived-At: Subject: Re: [Add] Use Cases - the coffee shop: DoH and Authentication X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 10:14:17 -0000 --00000000000099a0c505903940ce Content-Type: text/plain; charset="UTF-8" On Fri, 16 Aug 2019, 11:05 Andrew Campling, . > > By itself, DoH does nothing to address the authenticity of a response, > which could still be tampered with elsewhere. > Incorrect, it reduces the attack surface by reducing scope for tampering with client communications. -a --00000000000099a0c505903940ce Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


On Fri, 16 Aug 2019, 11:05 Andrew Campling, .=C2=A0

By itself, DoH does nothing to address the authenticity of a response, whic= h could still be tampered with elsewhere.=C2=A0=C2=A0

Incorrect, it reduces = the attack surface by reducing scope for tampering with client communicatio= ns.

-a


--00000000000099a0c505903940ce-- From nobody Fri Aug 16 03:15:55 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 91BFC12010F for ; Fri, 16 Aug 2019 03:15:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=netorgft5189650.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EN76TGlpDTcu for ; Fri, 16 Aug 2019 03:15:52 -0700 (PDT) Received: from GBR01-CWL-obe.outbound.protection.outlook.com (mail-eopbgr110086.outbound.protection.outlook.com [40.107.11.86]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B43CA120024 for ; Fri, 16 Aug 2019 03:15:51 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=Erp73tEYMfh4tuUtsHkX1GSF0Ond4NltjBSjDToViXrJW4PvQy3KVV7MfteLTeo7Fg+fCuI4z9VqjXMDI83TMuK1z5TyQJrm6xrQ+FiagV4/nb14ZVKi8Ryf5q9m4okaUcdVWbavEMmfNU4Xhbb5IfmBxfOOnAmpN34bVY3oXclaCnj21C/Dq54cD32xvI3td6fGN6qVUDndOMzxZ8xZ1o301WRtmNGGIfqO3GwxDKmELdXUx7SeetWyK2ke6+D0GO5I1fZZU7f8XPjTlzYxubXrCW8u40nIMC1ogKmhq6wIo1TOnAElJ09T55obCoqXyTD40hcBJoL0X+fZqDoxWg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=AtxifZmtBnzkvheGTjbL+FBsDdG0+Mg8Bg4SoGVNPxw=; b=XN5KjR/n2wESEQUrm8/HK0veeLaMgQYEkSeeIWjuZZZs5u+bwsfaD0FCb085WFdlpyRfBWgQAWhU2BCFbRbVZUUJ18wqVYcpCABanDvkpr/pGWsErtEUeKCvPBPfFiTD7F4SX/yFXlUgOr8dKy7COWtCmydTAcAZVXxXtXavXbpBscOJXYIRTtJdqN6euTfshsX48RH35FI7EMPV3YKmO8d/YHx4RKhwm6nnwNS4dBFflvzA5gFUuv/JlKU428jd2ainHOKOfCid50SuehfUaXlV/a7gW5b1oJhB6S/FvUvAlSK59RRU+ccsDuvOUjbTINJKPbcKR4E/w7LwT5C3sQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=419.consulting; dmarc=pass action=none header.from=419.consulting; dkim=pass header.d=419.consulting; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=NETORGFT5189650.onmicrosoft.com; s=selector1-NETORGFT5189650-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=AtxifZmtBnzkvheGTjbL+FBsDdG0+Mg8Bg4SoGVNPxw=; b=o9q0wvSQyMNoxKQBF25eBBkZOE7M++5i4auPIJbaKc8Inviy1QBw5dCHRcYbx/CJlfQ607mtiqfMCViWlmpq0pK1FiayVJncd3lTiRFfMvAKujm3Yb3HfUs+yAUHLDW7jZTCY2HZGhrwfb2S2yVjSH7LYd6huj0aVEYFHfajcKM= Received: from LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM (20.176.138.146) by LO2P265MB1312.GBRP265.PROD.OUTLOOK.COM (20.176.144.13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2178.16; Fri, 16 Aug 2019 10:15:48 +0000 Received: from LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM ([fe80::64e9:9b9e:59fc:26f]) by LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM ([fe80::64e9:9b9e:59fc:26f%5]) with mapi id 15.20.2157.022; Fri, 16 Aug 2019 10:15:48 +0000 From: Andrew Campling To: Alec Muffett CC: =?utf-8?B?UGF0cmlrIEbDpGx0c3Ryw7Zt?= , Stephen Farrell , ADD Mailing list Thread-Topic: [Add] Use Cases - the coffee shop Thread-Index: AdVTdTO8sMFf9NSjRg6hhfqT7Scbe6b9h+AA2QPDGoD///+VcA== Date: Fri, 16 Aug 2019 10:15:48 +0000 Message-ID: References: <400b774a-5bd0-d6f4-5640-e561f067a9b5@cs.tcd.ie> <74A2E5E0-02CE-4C9D-A66B-1D2FBC65B39A@frobbit.se> <3611F27A-49A9-4159-A683-3BBD4C2F91EA@frobbit.se> In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=andrew.campling@419.consulting; x-originating-ip: [2a00:23c4:a499:2e00:55a7:59be:7d65:cfb6] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 81f2ee0a-2af1-4543-7461-08d72232b5be x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(7021145)(8989299)(5600148)(711020)(4605104)(1401327)(4534185)(7022145)(4603075)(4627221)(201702281549075)(8990200)(7048125)(7024125)(7027125)(7023125)(2017052603328)(7193020); SRVR:LO2P265MB1312; x-ms-traffictypediagnostic: LO2P265MB1312: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:8882; x-forefront-prvs: 0131D22242 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(396003)(39830400003)(136003)(376002)(366004)(346002)(199004)(189003)(66476007)(76116006)(66446008)(66556008)(64756008)(476003)(25786009)(4744005)(256004)(53936002)(6116002)(71190400001)(66946007)(71200400001)(186003)(4326008)(33656002)(66574012)(6246003)(14454004)(316002)(54906003)(102836004)(2906002)(6916009)(508600001)(7736002)(486006)(446003)(305945005)(11346002)(7696005)(86362001)(46003)(44832011)(74316002)(99286004)(76176011)(52536014)(6436002)(8676002)(81166006)(81156014)(5660300002)(229853002)(6506007)(8936002)(55016002)(9686003)(46492003); DIR:OUT; SFP:1101; SCL:1; SRVR:LO2P265MB1312; H:LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: 419.consulting does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: NC4TtgyjDN2GxedTh2URLU2kG2w6UYx3iRU6UqkeFuqW9TtkjdGFE4Cevi/Av6lMMSqFoLx/bN1yBPpQG+YOYI60yiq9dsXD6FZzI6YCJHsVMdP7rojrznNAgPOOEllOSbRHsz1YR1IP63Owk6rDx5LVte4XSV+aGtLwr+N67KVPan3YvVJ37mPG5iFHaoXTHQz0rO7LAQ5NnXOxuMVqJh5VPSqnkYZM5WT/DA5TLYt/Jn9wIE9lu00ClI40nqSZeEaNA+CAFNBkWf+DLoS7ffLdd0l8jX2jcfhCX24D/565LIlnE00mSJF9tRvWYvX3fYRDEozogLJIuFtI6c3LIPvZ7Axw/H7PuXgwPILQ+ua7kKpv/0fOvc5Qy3f870dwqDG4piTNtBuAwXYt0pf05KHvFmtD8kdxGXxsDaC3CPU= x-ms-exchange-transport-forked: True Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: 419.consulting X-MS-Exchange-CrossTenant-Network-Message-Id: 81f2ee0a-2af1-4543-7461-08d72232b5be X-MS-Exchange-CrossTenant-originalarrivaltime: 16 Aug 2019 10:15:48.7842 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 9c2ced3e-7522-4755-87dc-f983abc66ec3 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: uRZxTgYlMJeEQwncVe3SQCj+tboT13xZlH1dhrRKthEe+SqDwz9phD05mIQlJIBuIObOO6iQMp710supVltNpPR6o15fQeCo2NwSFdJrBuc= X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO2P265MB1312 Archived-At: Subject: Re: [Add] Use Cases - the coffee shop X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 10:15:54 -0000 T24gRnJpLCAxNiBBdWcgMjAxOSwgMTE6MDkgQWxlYyBNdWZmZXR0IDxhbGVjLm11ZmZldHRAZ21h aWwuY29tPiB3cm90ZToNCj4gT3I6IFRocmVlIHRpbWVzIHRoZSBwb3B1bGF0aW9uIG9mIEljZWxh bmQuDQo+IA0KPiBUaGF0J3MgdGhlIHRoaW5nIGFib3V0IHBlcnNwZWN0aXZlLCBhdCBzb21lIHBv aW50IHlvdSBoYXZlIHRvIHRhbGsgYWJvdXQgYWJzb2x1dGUgbnVtYmVycy4NCj4gDQo+IE9uZSBt aWxsaW9uIHBlb3BsZSBpcyBhIGxvdCBvZiBwZW9wbGUsIGFuZCBpdCdzIGdyb3duIHNpbmNlIHRo YXQgdGltZSwgYmVjYXVzZSB0aGUgdGVjaG5vbG9neSANCj4gaGFzIGltcHJvdmVkIHRvIGVuYWJs ZSBpdCB0byBnZXQgbGFyZ2VyIGFuZCBiZXR0ZXIuIDotKQ0KDQpJIGFncmVlIHdpdGggeW91IHVw IHRvIGEgcG9pbnQgLSBjbGVhcmx5IHRoZSByZWd1bGF0b3IgaW4gSWNlbGFuZCB3b3VsZCBiZSBj b25jZXJuZWQgaWYgdGhlc2UgdXNlcnMgd2VyZSBjb25jZW50cmF0ZWQgdGhlcmUuICBIb3dldmVy LCBmb3IgZXhhbXBsZSwgdGhlIFVLIHJlZ3VsYXRvciB3b3VsZCBoYXZlIGxlc3Mgb2YgYW4gaXNz dWUgYXMsIGV2ZW4gaWYgYWxsIDEgbWlsbGlvbiB3ZXJlIGxvY2F0ZWQgaW4gdGhlIFVLICh1bmxp a2VseSEpIHRoZXkgd291bGQgc3RpbGwgcmVwcmVzZW50IGxlc3MgdGhhbiAxMCUgb2YgdGhlIGlu dGVybmV0IHVzZXIgcG9wdWxhdGlvbiBpbiB0aGF0IGNvdW50cnkuICBJbiByZWFsaXR5LCBzcHJl YWQgYXMgdGhleSBhcmUgYXJvdW5kIHRoZSB3b3JsZCwgYWJzb2x1dGUgbnVtYmVycyBvbmx5IHVz dWFsbHkgbWF0dGVyIHRvIHJlZ3VsYXRvcnMgd2hlbiB0aGV5IGFyZSBjb25zaWRlcmluZyB0aG9z ZSB3aXRoaW4gdGhlaXIganVyaXNkaWN0aW9uLiAgDQo= From nobody Fri Aug 16 03:20:08 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D374412011D for ; Fri, 16 Aug 2019 03:20:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.796 X-Spam-Level: X-Spam-Status: No, score=-1.796 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ktkhqrjEoKFu for ; Fri, 16 Aug 2019 03:20:04 -0700 (PDT) Received: from mail-lj1-x243.google.com (mail-lj1-x243.google.com [IPv6:2a00:1450:4864:20::243]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A9722120115 for ; Fri, 16 Aug 2019 03:20:03 -0700 (PDT) Received: by mail-lj1-x243.google.com with SMTP id x3so770646lji.5 for ; Fri, 16 Aug 2019 03:20:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=7EplUvurKLylC0t6IIcUmignnI6LTWLtetrC+HfyHLc=; b=U/0t2/2tkprrBYsqRHo96YDIAcqKbBn64/XLinA1E7KIWMvM8oKE97bPL8bzOOY7ED 6VK6etpxiKn5uHqC1x46XWH/gkHspzWGCTuSRBo61Lk+aHZC5xE+scI0/2bH0+czfPS7 Vc26+Ld3eeMxrYUE4SQO2xa9x7pRQWBtv6B89kmcf5rnoS6igXKWjzNgXW1Cm38vRtBF iPbwQvPgaKMJ6S1X916DT6+43z5Rv3jAHusi30UDM/e84NB6heCixVOJE3WAkVXJf0OB IxpS8HeeGCE95shm6HUA9w1cwrDZZqHgbISiKx1CjkvVcZHvOvlXED1jwRTlsI4AdewV 5M9w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=7EplUvurKLylC0t6IIcUmignnI6LTWLtetrC+HfyHLc=; b=NR7Q0Y2mOhKRV5XHe8ZYATjxiicSrvC81w1h5CMGH12C/pEiwEjJ2+ggtjGS+70LnA 1yfnFjMyWxVekMSM/qqM0Jk+0LeDP1CiumatntC/6hvbsioCgURu4zL75U7WBvASHHBd io1LHLPoNGSaVOQIW78KawHtxHeGcVvzOSO822OBKmNr7oRh5TE1yqvYKRAMi6X3jZBP lPxGKVz7ajmAvl6FbF0LCerD0xX4SRGbXcdt6cRv3cdrW2oPF6Mr0UqXOzcp+P2Eb7g4 mord7oqXjfJ1tY136e2B5brNHAJix7NPNJKiEZHLV0XJGcZWEw7Ui3R4xL/N/o6JV7wg 7Zmw== X-Gm-Message-State: APjAAAUQkinw/sXJumPTqrallkjh/okWNAzHArSYeLkn/os1QKvSV5cM c79w2ZFAJptadBd8lZgeZQH9xeQt8BVaXP9UeJ3Ujg== X-Google-Smtp-Source: APXvYqyNQXIP0i1ExVMvU5TCQ+xEXV8PopwQjAOET3zzB2xhYL/dc1BdJef3rcxp3q0THVSP856EqZ+SanxjWawycqI= X-Received: by 2002:a2e:b0e6:: with SMTP id h6mr4732765ljl.18.1565950801693; Fri, 16 Aug 2019 03:20:01 -0700 (PDT) MIME-Version: 1.0 References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <8e00891f-2aa2-ee11-559a-b5a8967b22d9@nostrum.com> <2C23D415-84F9-4B6C-B67B-0CC3EB600520@gmail.com> <2704899B-E43D-4978-A3C9-30E9E7CEBEBD@fugue.com> <4CC4C262-BEF4-4B39-ACB1-A595AB66D6CD@gmail.com> In-Reply-To: From: Eric Rescorla Date: Fri, 16 Aug 2019 12:19:25 +0200 Message-ID: To: Tommy Jensen Cc: Bret Jordan , ADD Mailing list , Ted Lemon , Mikael Abrahamsson Content-Type: multipart/alternative; boundary="0000000000004561da05903955f0" Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 10:20:07 -0000 --0000000000004561da05903955f0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Fri, Aug 16, 2019 at 1:21 AM Tommy Jensen wrote: > ekr> Who says we're not worried about it? Do you have a concrete plan for > addressing it? > > I'd suggest having a list of TRRs with the default value being selected > randomly per client rather than just one TRR distributed to a large > geographic population such as North America. For example, in my Firefox > install (Firefox Quantum, 68.0.2) under "Enable DNS over HTTPS" I only se= e > "CloudFlare (Default)" and "Custom" as options. > This is something we have looked at and my do, but given that there are likely to be only about 3-4 resolvers capable of serving as the default for a system as large as Firefox, this doesn't seem like it will improve privacy that much. -Ekr > If there were many TRRs listed, and which one labeled as default randomly > chosen at first launch, then at least there would be some distribution of > DNS traffic for users who will never check that setting (i.e. most users)= , > and the same configuration freedom for those those users who will check i= t. > Another option might be testing several TRRs from the list at first launc= h > and picking the fastest to respond to attempt some sorting by geographic > efficiency. > > Perhaps operators of public DNS servers on this mailing list would be > interested in knowing what bar they would have to clear to get on such a > list. Would it be identical to the existing published terms between Mozil= la > and CloudFlare? Something else? Would you be willing to collaborate on su= ch > terms with other browsers for a common standard for TRRs? > > Even in my ideal world where the browser cooperates with the platform on > deciding when to use which DNS stub, there will be times when the browser > will know more about the user's DNS intentions than the platform, and in > those cases there should definitely be a larger variety of TRRs available > to any given large-scale population. > > Thanks, > Tommy > ------------------------------ > *From:* Add on behalf of Eric Rescorla < > ekr@rtfm.com> > *Sent:* Thursday, August 15, 2019 3:43 PM > *To:* Bret Jordan > *Cc:* ADD Mailing list ; Ted Lemon ; > Mikael Abrahamsson > *Subject:* Re: [Add] [Ext] Validity of network administrator role > > n Thu, Aug 15, 2019 at 11:59 PM Bret Jordan wrote= : > > > It just baffles me silly that we are worried about people seeing DNS > traffic and we are not worried about certain cloud providers harvesting, > mining, and tracking all users behavior on the internet and all of their > interactions (email and such) that they do with the cloud providers. It > seems like if we _REALLY_ wanted to improve privacy and security we would > do something about that. > > > Who says we're not worried about it? Do you have a concrete plan for > addressing it? > > > Maybe create an encrypted email system that was done in the browser and > protected all email from being reviewed and monitored. > > > Here too, it seems like the question isn't one of desirability but > practicality. There have been quite a few attempts at E2E encrypted email= , > none very successful. Just wishing does not make it so. > > > Further, it would be nice if browsers did a better job of preventing and > denying all tracking tools. > > > You mean like: > https://webkit.org/blog/8828/intelligent-tracking-prevention-2-2/ > > or > https://blog.mozilla.org/blog/2019/06/04/firefox-now-available-with-enhan= ced-tracking-protection-by-default/ > > ? > > -Ekr > > > > Thanks, > Bret > PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 > "Without cryptography vihv vivc ce xhrnrw, however, the only thing that > can not be unscrambled is an egg." > > On Aug 15, 2019, at 1:14 PM, Mikael Abrahamsson wrote: > > On Thu, 15 Aug 2019, Ted Lemon wrote: > > Blocking is a form of tampering. One purpose of DoH is to make blocking > impractical, so that the end user isn=E2=80=99t forced to choose a path t= hat=E2=80=99s > subject to tampering and intercept. > > > As with any technology this is dual use. If the customer has purchased a > solution that's built around certain mechanisms, bypassing these mechanis= ms > might be against the users' wishes. > > There is no correct answer here, and anyone pretending to know the correc= t > answer for all situations is wrong. > > So let's fall back on the "principle of least astonishment". If you tell > the users "your browser is now doing DNS lookups using a cloud provider a= nd > your ISP is no longer in that loop", what do you think their response wil= l > be? (might need explanation to the user, but still) > > -- > Mikael Abrahamsson email: swmike@swm.pp.se -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > > > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > > > --0000000000004561da05903955f0 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Fri, Aug 16, 2019 at 1:21 AM Tommy= Jensen <Jensen.Thomas@mi= crosoft.com> wrote:
ekr>=C2=A0Who says we're not worried about it? Do you have a concrete plan for addre= ssing it?

I'd suggest having a list of TRRs with the default value being selected random= ly per client rather than just one TRR distributed to a large geographic po= pulation such as North America. For example, in my Firefox install (Firefox= Quantum, 68.0.2) under "Enable DNS over HTTPS" I only see "CloudFlare (Default)" and "= ;Custom" as options.=C2=A0

This is something we have looked at and my do, but given that there= are likely to be only about 3-4 resolvers capable of serving as the defaul= t for a system as large as Firefox, this doesn't seem like it will impr= ove privacy that much.

-Ekr


If there were many TRRs listed, and which one labeled as default randomly cho= sen at first launch, then at least there would be some distribution of DNS = traffic for users who will never check that setting (i.e. most users), and = the same configuration freedom for those those users who will check it. Another option might be testing sever= al TRRs from the list at first launch and picking the fastest to respond to= attempt some sorting by geographic efficiency.

Perhaps operators of public DNS servers on this mailing list would be inter= ested in knowing what bar they would have to clear to get on such a list. W= ould it be identical to the existing published terms between Mozilla and Cl= oudFlare? Something else? Would you be willing to collaborate on such terms with other browsers for a comm= on standard for TRRs?=C2=A0

Even in my ideal world where the browser cooperates with the platform on de= ciding when to use which DNS stub, there will be times when the browser wil= l know more about the user's DNS intentions than the platform, and in t= hose cases there should definitely be a larger variety of TRRs available to any given large-scale population.

Thanks,
Tommy
From= : Add <add= -bounces@ietf.org> on behalf of Eric Rescorla <ekr@rtfm.com>
Sent: Thursday, August 15, 2019 3:43 PM
To: Bret Jordan <jordan.ietf@gmail.com>
Cc: ADD Mailing list <add@ietf.org>; Ted Lemon <mellon@fugue.com>; Mikael Abrahamsson <swmike@swm.pp.se><= br> Subject: Re: [Add] [Ext] Validity of network administrator role
=C2=A0
n Thu, Aug 15, 2019 at 11:59 PM Bret Jordan <jordan.ietf@gmail.com&= gt; wrote:

It just baffles me silly that we are worried about people seeing DNS t= raffic and we are not worried about certain cloud providers harvesting, min= ing, and tracking all users behavior on the internet and all of their inter= actions (email and such) that they do with the cloud providers. It seems like if we _REALLY_ wanted to improv= e privacy and security we would do something about that.

Who says we're not worried about it? Do you have a concrete plan f= or addressing it?


=C2=A0Maybe create an encrypted email system that was done in the brow= ser and protected all email from being reviewed and monitored.

Here too, it seems like the question isn't one of desirability but= practicality. There have been quite a few attempts at E2E encrypted email,= none very successful. Just wishing does not make it so.


=C2=A0Further, it would be nice if browsers did a better job of preven= ting and denying all tracking tools.=C2=A0

You mean like: https://webkit.org/blog/8828/intelligent-tracking-prevention-2-2/ or https://blog.mozilla.org/blog/2019/06/04/firefox-now-available-with-enhance= d-tracking-protection-by-default/?

-Ekr



Th= anks,
Br= et
PGP Fingerprint:=C2=A063B4 FC53 680A 6B7D 1447 =C2=A0F2C0 74F8 ACAE 7415 0050
"Without cryptography vihv vivc ce xhrnrw, however, the only thi= ng that can not be unscrambled is an egg."

On Aug 15, 2019, at 1:14 PM, Mikael Abrahamsson <swmike@swm.pp.se> wrote:

On Thu, 15 Aug 2019, Ted Lemon wrote:

Blocking is a form of tampering.=C2=A0 One purpos= e of DoH is to make blocking impractical, so that the end user isn=E2=80=99= t forced to choose a path that=E2=80=99s subject to tampering and intercept= .

As with any technology this is dual use. If the customer has purchased a so= lution that's built around certain mechanisms, bypassing these mechanis= ms might be against the users' wishes.

There is no correct answer here, and anyone pretending to know the correct = answer for all situations is wrong.

So let's fall back on the "principle of least astonishment". = If you tell the users "your browser is now doing DNS lookups using a c= loud provider and your ISP is no longer in that loop", what do you thi= nk their response will be? (might need explanation to the user, but still)

--
Mikael Abrahamsson =C2=A0=C2=A0=C2=A0email: swmike@swm.pp.se--
Add mailing list
Add@ietf.org
https= ://www.ietf.org/mailman/listinfo/add

--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--0000000000004561da05903955f0-- From nobody Fri Aug 16 03:20:19 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E9FBD120115 for ; Fri, 16 Aug 2019 03:20:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vPXHeBAaNRZc for ; Fri, 16 Aug 2019 03:20:16 -0700 (PDT) Received: from mail-yw1-xc31.google.com (mail-yw1-xc31.google.com [IPv6:2607:f8b0:4864:20::c31]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3141812080F for ; Fri, 16 Aug 2019 03:20:16 -0700 (PDT) Received: by mail-yw1-xc31.google.com with SMTP id w10so1612870ywa.13 for ; Fri, 16 Aug 2019 03:20:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=KaQEx54t5iOzZ4HS1bDnKqD51vn8BsHCWNEqGhrQD+I=; b=L+WOWo5MRF1sEQY5QV9BeCcY4ToVZG+EOFayGr2SEgmRPY6xJfQqlfySv3PKN107cL RBaNA+V/tCxHxdVGc/xI8wj2K0ijSObySxLj7Op9q48ko5d2Ka+Cg1Ki1KrKfDKOTide tcptB987hhTYlcBTGfKeDRPQvNEwWsXvq4tOHVgdXy19nsQjmLeEt/16FM+QyLa3nmqG wN5kSC8N7lTo7Bk9iE8CUs/WB/R4hlCtpkBPVtvjlZBYs5PbMvu+j/T/qqzZd1L36jPT nMylgu+aDxChvpfqEDBvnYLLCGjYiejnLaEtwQm8YTQ4q6PBt0Eon8eaOpzrsSpKqeGP 1wGA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=KaQEx54t5iOzZ4HS1bDnKqD51vn8BsHCWNEqGhrQD+I=; b=HPu/pSfzb7/oJ+LcY9HBd5Eiov+VawYt+4BQwlTJtr2rfDga8SFG2tKOvahlQmD0JO JD5y2cwA1qJDeHNI1EQRA8Y1GBtg+xfHcUXTqNG7yBC9CVwh5XXkolhw0gzGPqe9AN/h 4tC8nOUFWTqch25YNJTP6KkqczpdU1mgz5MVwQRoe0E2vO/Vottn/Lqck1ElvsNYbiMO CJ859crzZ221vvZek/jN+txRUk20M+SBWEaZp/TgdnTyZBGIvfH2Wsb+AdfgBuBCA6ei jYpL8lLVWhKg/1pV+rzZbyDPjiUHQ1Jb/QBb2w02LQQ98JSDEORGxGwMN7B1jzHH/IdF 7kMw== X-Gm-Message-State: APjAAAUY96oHkyrY4wFqwrhQWeU00pWWQ5lCCzCFhsi3wZyYovJlfrxC gSGTU+xSdzjoX1Y3tZ8hqhLmWuzo2rYg0nqiOiY= X-Google-Smtp-Source: APXvYqwkDsqmiQTPUb7WpTOcx5DBj2YIlBjxSI2qX6XFYLmfyqFO0ElbavGovl+up7rNVLvAS5aX+FiOwCStu5I0zJc= X-Received: by 2002:a0d:e6cb:: with SMTP id p194mr6223004ywe.83.1565950815288; Fri, 16 Aug 2019 03:20:15 -0700 (PDT) MIME-Version: 1.0 References: <400b774a-5bd0-d6f4-5640-e561f067a9b5@cs.tcd.ie> <74A2E5E0-02CE-4C9D-A66B-1D2FBC65B39A@frobbit.se> <3611F27A-49A9-4159-A683-3BBD4C2F91EA@frobbit.se> In-Reply-To: From: Alec Muffett Date: Fri, 16 Aug 2019 11:20:04 +0100 Message-ID: To: Andrew Campling Cc: =?UTF-8?B?UGF0cmlrIEbDpGx0c3Ryw7Zt?= , Stephen Farrell , ADD Mailing list Content-Type: multipart/alternative; boundary="00000000000014c0d60590395653" Archived-At: Subject: Re: [Add] Use Cases - the coffee shop X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 10:20:18 -0000 --00000000000014c0d60590395653 Content-Type: text/plain; charset="UTF-8" On Fri, 16 Aug 2019, 11:15 Andrew Campling, wrote: > In reality, spread as they are around the world, absolute numbers only > usually matter to regulators when they are considering those within their > jurisdiction. > so you're saying the important thing is to not give too many people too much security, for fear of annoying regulators? -a --00000000000014c0d60590395653 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


On Fri, 16 Aug 2019, 11:15 Andrew Campling, <andrew= .campling@419.consulting> wrote:
In = reality, spread as they are around the world, absolute numbers only usually= matter to regulators when they are considering those within their jurisdic= tion.=C2=A0

so you're saying the important thing is to not give too man= y people too much security, for fear of annoying regulators?

-a

<= div dir=3D"auto">

--00000000000014c0d60590395653-- From nobody Fri Aug 16 03:20:29 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4FB9012013F for ; Fri, 16 Aug 2019 03:20:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=netorgft5189650.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7DIWvxi7ubLC for ; Fri, 16 Aug 2019 03:20:25 -0700 (PDT) Received: from GBR01-LO2-obe.outbound.protection.outlook.com (mail-eopbgr100053.outbound.protection.outlook.com [40.107.10.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 21446120241 for ; Fri, 16 Aug 2019 03:20:25 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=Fpdk3BCQgxNQacsUPLPSk3B5//eW2rDY59BqEtY7tGETdpa/WooyZeey0i1hfl5C5aH6zsjl8sdimW0EFMR3gvDNty/M/krqRQXxg+CabXISYqRHEaRTxNY67TfFuOcigiqKbAPoFq23DrkxpV1oInUi+k9COzcaAMZ26yf08zWcBdLVw5OJkkRWVgYjaGxqj979UWvYFE7EmoQbCGJmw0aVkfoHvH1eRrMY0ippfHZ/Wo/pn1utQ2k/jBGK8H/TFVjEvUs5vnKdwUWMZTOTuH6D/s8+ioB1kg5yuCIQ4tRFcqTdnkW+ufzRvrmupSDxuYGrYTfh3dgObxMATQDE7Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=lkx4BGSCVtSHo7tspyrn0LlruADoIeqMZm/4nqNmQ4k=; b=OeTUHPoCmuZ92XCbWIhPFlRjZsI0x5d9ccnOw2bv1pqOWOHqrhBj/Ew6+5HdivecM41MO4W1AU7Ig12sr0mBgsDBwP5JMq1J9wnfdRCUSD/ghhj0cA3s0lreBuNPzncWC8ObnCMn/4gxPXCtHscxF0w7fM1TLTKTXulcyDbJrJVugxeyQ7vHTFY9jvVEWjXKAxBCuR/fOatQOsVXOMBlDceYpOCF3q4JAKvY5k1PcvnNI+Vz0s0+X7DNRXnfu0O22aYNcSP7IPPCXhVQflIjTWvhO8hdk8z/f2Fh505QH/M1hAQtnbHRN6D337vun166iITuery3j46jhPQpJI4e8Q== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=419.consulting; dmarc=pass action=none header.from=419.consulting; dkim=pass header.d=419.consulting; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=NETORGFT5189650.onmicrosoft.com; s=selector1-NETORGFT5189650-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=lkx4BGSCVtSHo7tspyrn0LlruADoIeqMZm/4nqNmQ4k=; b=fD7bjYZil8A2azVJM0Q00/8DCvEMx/kNIgzvZlxnzBydpD5rNbp5SRccjfQMI05GLa8RediZNY+tyzZX8utj34ni1SxOLJBu7ORcJxUxmUTbwtaMA4/lsV51LJL5RCAT3iMjozzYWv01mZM6U1l5FjMvaQWBrUk0/ynJcscYo60= Received: from LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM (20.176.138.146) by LO2P265MB1758.GBRP265.PROD.OUTLOOK.COM (20.176.144.20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2157.15; Fri, 16 Aug 2019 10:20:23 +0000 Received: from LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM ([fe80::64e9:9b9e:59fc:26f]) by LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM ([fe80::64e9:9b9e:59fc:26f%5]) with mapi id 15.20.2157.022; Fri, 16 Aug 2019 10:20:23 +0000 From: Andrew Campling To: Alec Muffett CC: Joe Abley , Ted Lemon , ADD Mailing list Thread-Topic: [Add] Use Cases - the coffee shop: DoH and Authentication Thread-Index: AdVUGhoAIQuk0GiITnmv9JrxK6MriQAATq8AAAAYOnA= Date: Fri, 16 Aug 2019 10:20:22 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=andrew.campling@419.consulting; x-originating-ip: [2a00:23c4:a499:2e00:55a7:59be:7d65:cfb6] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: d658e2d6-20ad-40d0-a96f-08d722335924 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(7021145)(8989299)(4534185)(7022145)(4603075)(4627221)(201702281549075)(8990200)(7048125)(7024125)(7027125)(7023125)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:LO2P265MB1758; x-ms-traffictypediagnostic: LO2P265MB1758: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:7219; x-forefront-prvs: 0131D22242 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(136003)(39830400003)(396003)(346002)(366004)(376002)(199004)(189003)(6246003)(8676002)(4744005)(55016002)(74316002)(9686003)(99286004)(7736002)(53936002)(86362001)(6916009)(5660300002)(52536014)(316002)(229853002)(46003)(305945005)(186003)(4326008)(76176011)(7696005)(54906003)(33656002)(102836004)(6506007)(508600001)(44832011)(11346002)(14454004)(71200400001)(71190400001)(66446008)(66946007)(8936002)(446003)(66476007)(64756008)(66556008)(25786009)(256004)(486006)(6116002)(2906002)(76116006)(81156014)(81166006)(6436002)(476003)(46492003); DIR:OUT; SFP:1101; SCL:1; SRVR:LO2P265MB1758; H:LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: 419.consulting does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: 2o99chX8j+oN25KvBtE9eZQlkQ0PtNoK7p9QZwLLYD87wMpnpovWUUQdKObvkDZX7A16zdweIhaCIGgFE8jce07ePTMG7ya1IWY0KN9oXtzIY+BTOwIdtgHT8NdHa1tx7xIFdypSUyG548BvgZIUleure12fwsbM6+16pUlRoc8xeEir4ih0QPTzghJHDYDhWPvr/1Mkm5vk4LHwAWVzUGTEsXratX13StK/llH3hEv/odv8tBY5owh9DCA5tXa3QsBjKFP+G7u1v3wPykGgHyxShmTxmNJHYYYB0JzK2tXB5hg18iwpvX56Kb5MJSnJcb6Zaj6aY5PWlZAFzZZC8AkqVCjgtYnwEsMPZiQhRb+v64xjRmUSH77DLz/+bteFRZRUjl732LFrEWT+nn0gafnXhQKcYypdfpMws5Z/Ksc= x-ms-exchange-transport-forked: True Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: 419.consulting X-MS-Exchange-CrossTenant-Network-Message-Id: d658e2d6-20ad-40d0-a96f-08d722335924 X-MS-Exchange-CrossTenant-originalarrivaltime: 16 Aug 2019 10:20:22.9276 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 9c2ced3e-7522-4755-87dc-f983abc66ec3 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: BXUKLnkjDhZQCZsC4vPVa31bcDOyuitRk4Xquzjv8+7klgzuZg6f0Sn2H/HGh9q5gAVAituA1J7KASinR175m2K8dCMqJi3OMQkyesiF4Dg= X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO2P265MB1758 Archived-At: Subject: Re: [Add] Use Cases - the coffee shop: DoH and Authentication X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 10:20:27 -0000 T24gRnJpLCAxNiBBdWcgMjAxOSwgMTE6MTQgQWxlYyBNdWZmZXR0IDxhbGVjLm11ZmZldHRAZ21h aWwuY29tPiwgLsKgDQo+PiBCeSBpdHNlbGYsIERvSCBkb2VzIG5vdGhpbmcgdG8gYWRkcmVzcyB0 aGUgYXV0aGVudGljaXR5IG9mIGEgcmVzcG9uc2UsIHdoaWNoIGNvdWxkIHN0aWxsIGJlIHRhbXBl cmVkIHdpdGggZWxzZXdoZXJlLsKgwqANCj4gDQo+IEluY29ycmVjdCwgaXQgcmVkdWNlcyB0aGUg YXR0YWNrIHN1cmZhY2UgYnkgcmVkdWNpbmcgc2NvcGUgZm9yIHRhbXBlcmluZyB3aXRoIGNsaWVu dCBjb21tdW5pY2F0aW9ucy4NCg0KTGV0J3Mgbm90IGZvcmdldCB0aGF0IERvSCBpbnRyb2R1Y2Vz IG5ldyB2dWxuZXJhYmlsaXRpZXMgd2l0aGluIHRoZSBjbGllbnQgZGV2aWNlLiAgDQo= From nobody Fri Aug 16 03:25:17 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 862BF12012E for ; Fri, 16 Aug 2019 03:25:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vRbjKWOfbDx4 for ; Fri, 16 Aug 2019 03:25:13 -0700 (PDT) Received: from mail-lf1-x136.google.com (mail-lf1-x136.google.com [IPv6:2a00:1450:4864:20::136]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7D46B12010F for ; Fri, 16 Aug 2019 03:25:13 -0700 (PDT) Received: by mail-lf1-x136.google.com with SMTP id v16so647237lfg.11 for ; Fri, 16 Aug 2019 03:25:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=yk+bk0OP1X+wefMZo/kdzcQTZuFuTbuE1BPetLIvuO4=; b=mtOJ45N1PmpnAXoTx+ID32ZDi8EvK8q7Actxfu2RTx1XfcaIBQdxcIFzF2xXNwzjiU vHp+b+xTgY28qVsHzDopjKX6nKZ48MmL9BWrqrwoWsLe8bjY/nwz0Vhzz4jCjKMS7HNg dgZ3M/2ZLr3vnkPShb05rFkQtnWhBB7442NrwkKtKfQbl2woRlxKnviDnrkCpllsNA8K KCPmJ+CaO1xLYOpBTJvC50etIPH2PRRqVjmbvsif6n+GedMuAI0EKGs+WDZpW/kIxCEC LjdfAzdzU4VMAJEoiA6wQqYExomw7uh03sfwVNhECthV6DriEZuySBKx2STYlDJ31gNN Rcmg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=yk+bk0OP1X+wefMZo/kdzcQTZuFuTbuE1BPetLIvuO4=; b=X+rvYuh661TSmeTSz9KfwWF6M3tI94xuN+3RDxWmjjoN4fUjzi2yTPsak4MRBr+Lre jDDiC7310qD/3fj7BXXvctHeDQzweZnCq0LIbXtt5ZpvTmN1I1J+EL5cHasXWpbCNQ0s 3R4QTZlz0sW4cIMu5BhZOScXQwklDMWLCfdrB73TyuYoJx2JScNwU1cQMn4T5ZmaLVuL 4aTgcLGHV9Omj7uVoA0nEHcSWJ9Nuf7WeDjyJAh0sOoyEcFtIipby2eJ7PagvhDCB+6n xH/P5zq2PRIFLCCjZ7LtsrjSuTypK4XIdHnl0CxLQ147woYzc5rIaJt0msajszuCnFJ4 CvJA== X-Gm-Message-State: APjAAAV/I2pft+Sh2+dlwoY7YVtowXW15Qlpkok5rx36YDMAEJbMWLNf TBIkd811/62uF3t9vkH0lQd3D7QM+kEJBBdW1FR5wA== X-Google-Smtp-Source: APXvYqxKP6Nt9mhzIBw1EGTmiIfZse+NeLLpQTYx1fwz3gzSAqg/mDaRTF7UG/DjVKhlcgcISGE5uyZUCzBDipIncBs= X-Received: by 2002:a19:7908:: with SMTP id u8mr4816144lfc.178.1565951111739; Fri, 16 Aug 2019 03:25:11 -0700 (PDT) MIME-Version: 1.0 References: <400b774a-5bd0-d6f4-5640-e561f067a9b5@cs.tcd.ie> <74A2E5E0-02CE-4C9D-A66B-1D2FBC65B39A@frobbit.se> <3611F27A-49A9-4159-A683-3BBD4C2F91EA@frobbit.se> <904F4219-8BDE-4272-BFDA-20F38D58CB80@frobbit.se> <85CF7EE9-51B8-4431-BCE5-7EA2B9AAF892@frobbit.se> In-Reply-To: <85CF7EE9-51B8-4431-BCE5-7EA2B9AAF892@frobbit.se> From: Eric Rescorla Date: Fri, 16 Aug 2019 12:24:35 +0200 Message-ID: To: =?UTF-8?B?UGF0cmlrIEbDpGx0c3Ryw7Zt?= Cc: Alec Muffett , ADD Mailing list , Stephen Farrell Content-Type: multipart/alternative; boundary="000000000000c0538c0590396757" Archived-At: Subject: Re: [Add] Use Cases - the coffee shop X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 10:25:15 -0000 --000000000000c0538c0590396757 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Fri, Aug 16, 2019 at 9:38 AM Patrik F=C3=A4ltstr=C3=B6m wrote: > On 16 Aug 2019, at 9:25, Alec Muffett wrote: > > > On Fri, 16 Aug 2019, 08:09 Patrik F=C3=A4ltstr=C3=B6m, = wrote: > > > >> The legislator just do not care. Its the access provider that is nervo= us > >> over some DoH arguments. > > > > On those I believe that we agree; where we differ is whether everyone > > else's privacy should continue to suffer, and whether pursuit of > > technologically easier, better privacy and integrity ever should be > chilled > > or diverted in order to consider this "nervousness". > > I do not see what end users privacy have to do with this. > > The end users privacy: > > 1. Can be protected via encrypted transport > > 2. Can always be violated at the end point of the encrypted transport > > You seems to have a claim that having the end point in a different > jurisdiction than the end user and at an entity that the end user do not > have explicit contractual agreements with, is better privacy? > I don't know what Alec's claim is, but my claim is that when the user gets their resolver from the network, they have no real way of understanding what the privacy behavior of that resolver is: in many cases (public WiFi, etc.) they have no relationship at all with the provider, and even when it's an ISP, the privacy policies are opaque and there is a fairly long history of bad behavior. The intent of TRR is that the application provider is able to negotiate for and assure an acceptable privacy policy on the user's behalf. -Ekr --000000000000c0538c0590396757 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Fri, Aug 16, 2019 at 9:38 AM Patri= k F=C3=A4ltstr=C3=B6m <paf=3D40frobbit.se@dmarc.ietf.org> wrote:
On 16 Aug 2019, at 9:25, Alec Muffett wrot= e:

> On Fri, 16 Aug 2019, 08:09 Patrik F=C3=A4ltstr=C3=B6m, <paf@frobbit.se> wrote:
>
>> The legislator just do not care. Its the access provider that is n= ervous
>> over some DoH arguments.
>
> On those I believe that we agree; where we differ is whether everyone<= br> > else's privacy should continue to suffer, and whether pursuit of > technologically easier, better privacy and integrity ever should be ch= illed
> or diverted in order to consider this "nervousness".

I do not see what end users privacy have to do with this.

The end users privacy:

1. Can be protected via encrypted transport

2. Can always be violated at the end point of the encrypted transport

You seems to have a claim that having the end point in a different jurisdic= tion than the end user and at an entity that the end user do not have expli= cit contractual agreements with, is better privacy?
I don't know what Alec's claim is, but my claim is tha= t when the user gets their resolver from the network, they have no real way= of understanding what the privacy behavior of that resolver is: in many ca= ses (public WiFi, etc.) they have no relationship at all with the provider,= and even when it's an ISP, the privacy policies are opaque and there i= s a fairly long history of bad behavior. The intent of TRR is that the appl= ication provider is able to negotiate for and assure an acceptable privacy = policy on the user's behalf.

-Ekr

--000000000000c0538c0590396757-- From nobody Fri Aug 16 03:26:18 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5E3A8120122 for ; Fri, 16 Aug 2019 03:26:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id B-CC0TJi1WMm for ; Fri, 16 Aug 2019 03:26:15 -0700 (PDT) Received: from mail-lj1-x22b.google.com (mail-lj1-x22b.google.com [IPv6:2a00:1450:4864:20::22b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5D04E12010F for ; Fri, 16 Aug 2019 03:26:15 -0700 (PDT) Received: by mail-lj1-x22b.google.com with SMTP id x4so4843867ljj.6 for ; Fri, 16 Aug 2019 03:26:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=ChoiJ6UYeN4R4bGFkI9KGLavpSRNXNdThF89J+98CzQ=; b=gjizE21bv3bBe+tsF4guHH9BovNGiIQuZD5VTmUiZ+ORA1lG5xpmSFyqqsGKpkcL38 bbxfoZnykdtZN5dpLssJHmXzu2m9ZPsSq78cVGGlg4lM1vlMhkwtmQ6LnkmXY7PP1+zs c7Lky7vZ2BogsqO2ZiKrnTptZNl1HYjHRFnkBXuU3oltzL8wJa5J5Vj6+WvBwG0Y6mOr HuKvH3D3iidfh5bG9u1WZeBat/W5Fv4yXrLOf0SPtLF4y6bcrC1PofPMGuskJbcuixOy zDrgRK1hmWmlJ9V1i2nkjlDyv7unsWONTlG29g147bXkQ9g4b3Mrg+572lm/qC5H35gR +VNw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=ChoiJ6UYeN4R4bGFkI9KGLavpSRNXNdThF89J+98CzQ=; b=XcPXcjt91e/94NgyPFPgUj457zpZo58hLQ5kvSgVQ6DXY1qgQRXZnCTtzpEJriQBoI bl1+855ppEfjS685lVaW4+dHaUjXrI3ctC7zjdDFyahh7sQ7/LYcvCBvigJZrA57W5Iy 7OBcSP4eDH1VjAFedQItS1UWL972ug55y1X7stOJqEWgoImp0MAQgAjhWT40y0/v7RnA DvN4uG4R0TLXWlrVrSFcdu+8YrJI6QSTuoKJP3cvY9OfvJKhXYDDHetKAatLhfNt5mw9 jwjC8PrbgATnhcR1qudmAOnC0SyyktltbWZxgUpx0tMOpknzcPube2pY1vfaBbAgzN0t WUVQ== X-Gm-Message-State: APjAAAXrzCgrh/2++EDNrLZKIhQyxHqVmXukzmOkTbm5BEG/k9VzT37x TSa2J/iil1cdQ2SIChJbCFIcl3G8MS73rWacHfQ3Ww== X-Google-Smtp-Source: APXvYqwLnUd3ypMGcmeqOQEm5ulfiigQCYazXaIsGrh3uHO28z8nrkUprqTlpYc2LIUaA4CENJpS94pAJvSYBoGOGLs= X-Received: by 2002:a2e:9b0c:: with SMTP id u12mr5109256lji.239.1565951173654; Fri, 16 Aug 2019 03:26:13 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Eric Rescorla Date: Fri, 16 Aug 2019 12:25:37 +0200 Message-ID: To: Andrew Campling Cc: Alec Muffett , ADD Mailing list , Ted Lemon , Joe Abley Content-Type: multipart/alternative; boundary="0000000000007111460590396b1e" Archived-At: Subject: Re: [Add] Use Cases - the coffee shop: DoH and Authentication X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 10:26:17 -0000 --0000000000007111460590396b1e Content-Type: text/plain; charset="UTF-8" On Fri, Aug 16, 2019 at 12:20 PM Andrew Campling wrote: > On Fri, 16 Aug 2019, 11:14 Alec Muffett , . > >> By itself, DoH does nothing to address the authenticity of a response, > which could still be tampered with elsewhere. > > > > Incorrect, it reduces the attack surface by reducing scope for tampering > with client communications. > > Let's not forget that DoH introduces new vulnerabilities within the client > device. > What do you believe those vulnerabilties to be? -Ekr -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --0000000000007111460590396b1e Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Fri, Aug 16, 2019 at 12:20 PM Andr= ew Campling <andrew.campling@419.consulting> wrote:
On Fri, 16 Aug 2019, 11:14 Alec M= uffett <alec= .muffett@gmail.com>, .=C2=A0
>> By itself, DoH does nothing to address the authenticity of a respo= nse, which could still be tampered with elsewhere.=C2=A0=C2=A0
>
> Incorrect, it reduces the attack surface by reducing scope for tamperi= ng with client communications.

Let's not forget that DoH introduces new vulnerabilities within the cli= ent device.=C2=A0

What do you believe = those vulnerabilties to be?

-Ekr
--0000000000007111460590396b1e-- From nobody Fri Aug 16 03:26:41 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F076B12012E for ; Fri, 16 Aug 2019 03:26:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wo8wzCw8Kqzl for ; Fri, 16 Aug 2019 03:26:38 -0700 (PDT) Received: from mail-yw1-xc36.google.com (mail-yw1-xc36.google.com [IPv6:2607:f8b0:4864:20::c36]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2DA24120122 for ; Fri, 16 Aug 2019 03:26:38 -0700 (PDT) Received: by mail-yw1-xc36.google.com with SMTP id e65so1640813ywh.0 for ; Fri, 16 Aug 2019 03:26:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=u6e4SFidKgbOZCBrhejJp/mixNcvHQW8EQ3eCCzwzKY=; b=YsEBqOCVZTx7utUTgqRaKWicAsjS6PRgIEp4qzf96dJ/ruu5VaRipv8/Qtlp8alIR4 i2ePsqc/wLQIVUyzvVN+74VtJzzPwOhIcdRc/FN1gO9lcN/DJ+rNqAH36F42vki8p6cH bQfMvyVVX+KLPegRh0BwwR06bhdDouokU7UC5RRDnw3y1iH080hAlMB2QgRArnnsCYBv dF0M8VEOSddYnkbe3JyNS1y1tOqWtYmCPbuOThcE2hcBWYYCV9paelMdUJP4UtkNiXC1 iiVC3t+OJ9Tmu5cdhGM8HC7uRuRpgywCXMsAUT3HlCURfkslRr7KFKG+w+yfNGDR5TSL YQuQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=u6e4SFidKgbOZCBrhejJp/mixNcvHQW8EQ3eCCzwzKY=; b=Y2BCSyEf8qPQXShezzoDAmsKlEBh71XEgfbCW+/J6Ob2l5vuN+v1RV5O0MiT6T90Yi 5XsRiIrxmYEKyZRiudkRKoiEzdw7LyshfAx2LoNm0f9wc1qyZtP9ZV0fBzzXI/2pFq6N ztbgIzswoQ4pggTJVPkVx8NfyCVPmGu4JZJJyu7hsspMMuOtvOq7sclnAilRJfCKVbb1 APOvVKaHWeS9Uo/CxLYNzOqTOYML0vGxnwHueWyf1sEckoZsSZ23SrQdhwYEY3qIVKyN PL+14+/WI5vLlZZKCJYovn3kltqIxJKtIZjCNo/zTSPkVecFqvxlLDRNB1kSKpt5cgAw MQDQ== X-Gm-Message-State: APjAAAWH3ul/G1gS7VIOIUzFrdvnnLv7BvZBXGjXjFYvJgHhaYhNwETR vmVp5Sfyo9ozepJuUnqw7r7KPFJFEKJ8dE0KpoM= X-Google-Smtp-Source: APXvYqx00oLyidTq+7Kh6BjWSYFf/neWccBpn53NQh+9GZPIxdMDvQQrv4AnhXOQ3dRsCPLZakYfFOsGA89lb4TZix0= X-Received: by 2002:a81:8142:: with SMTP id r63mr5849920ywf.367.1565951197241; Fri, 16 Aug 2019 03:26:37 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Alec Muffett Date: Fri, 16 Aug 2019 11:26:26 +0100 Message-ID: To: Andrew Campling Cc: Joe Abley , Ted Lemon , ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000d8e9c30590396c00" Archived-At: Subject: Re: [Add] Use Cases - the coffee shop: DoH and Authentication X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 10:26:40 -0000 --000000000000d8e9c30590396c00 Content-Type: text/plain; charset="UTF-8" On Fri, 16 Aug 2019, 11:20 Andrew Campling, wrote: > > Let's not forget that DoH introduces new vulnerabilities within the client > device. > And now you're just casting aspersions. DoH is an effective "last mile" defence, and to say that it does nothing to protect DNS lookup "because an attack could happen upstream" is as crazy as saying "I don't bother to lock my house front door because someone might rob my bank and it's all the same thing really isn't it?" It's an improvement over where we have been the last 30+ years, it brings change and we will adjust to that change. Politicians will adjust to that change. If the full extent of the web today had been explained to politicians in 1993, I am confident that they would have tried to prevent it happening - but I am glad that we are here. -a --000000000000d8e9c30590396c00 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


On Fri, 16 Aug 2019, 11:20 Andrew Campling, <andrew= .campling@419.consulting> wrote:

Let's not forget that DoH introduces new vulnerabilities within the cli= ent device.=C2=A0

=
And now you're just casting aspersions.

DoH is an effective "last mile&q= uot; defence, and to say that it does nothing to protect DNS lookup "b= ecause an attack could happen upstream" is as crazy as saying "I = don't bother to lock my house front door because someone might rob my b= ank and it's all the same thing really isn't it?"

It's an improvement over where w= e have been the last 30+ years, it brings change and we will adjust to that= change. Politicians will adjust to that change.=C2=A0

If the full extent of the web today had been= explained to politicians in 1993, I am confident that they would have trie= d to prevent it happening - but I am glad that we are here.

-a

<= div dir=3D"auto">
--000000000000d8e9c30590396c00-- From nobody Fri Aug 16 03:27:09 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 13543120122 for ; Fri, 16 Aug 2019 03:27:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=netorgft5189650.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DIQuKDRFNN0r for ; Fri, 16 Aug 2019 03:27:06 -0700 (PDT) Received: from GBR01-CWL-obe.outbound.protection.outlook.com (mail-eopbgr110041.outbound.protection.outlook.com [40.107.11.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4831012010F for ; Fri, 16 Aug 2019 03:27:06 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=mXvPdHLFDULhXNSZ9JiIHdGqUW4flsJEZbzSArZ5r4tvnB1q1082bte3eweVdQdIeLiGuGCCQN9jTDAB46RFTqrKPbnBAFGL5HbeSg+HzKDpGm2RFeQooc8K8IWC4F5X8FB+tcp98Ix6uV7J8MOjWESAUk8dx0j30ow48Q/SQabWdH9sKtmdxMfw7EnL7xDp448YB4pFD7OHBecWI+9BFHtKZd6/2r0lxJtDsyjcUgE/qJg9uzMd1SuKqy9RmO8yIRWTNaml4dthV+2j3zmXe1Yb+44T4sDg2GPc4L/UTxTmnQsAvd6OCfXccZovFxsGrYAgM1osZn7KS/As+I9EOA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Q48H/Qoqu6QgjSBRbFPXh/jUg2YxXlR9sujkOzdWKBE=; b=in/U1slWyYrUMMjlGsqW7pF8vB4rsqFyYE1z/bllipFospQ2TVFHA3DSf+wlWz9i57/cbgzL3gK+tHcaBgVkZ7eXNJSsWat9ZadwR+lFr1WRd7puEmRREkxqEBI0NlBdj2AsDLq8xp8aZHSqe+RzRogMGSxAzzCjsqEIjJWDju41ow21BcGvBovBH5a1KoV4TFYLkWfPDegqTrpQTfTe4TLyrtpSQHREAtmL85dgIvNq49WXCZCRdMOQC70thGhXDtEDHmohaEWHb2EydU6xsDDm8uMiJPiGS0V1JASWlrZdUx+CRP0eysDWk2bkDyWdtNJTmstvs6923iEGAnc9fw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=419.consulting; dmarc=pass action=none header.from=419.consulting; dkim=pass header.d=419.consulting; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=NETORGFT5189650.onmicrosoft.com; s=selector1-NETORGFT5189650-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Q48H/Qoqu6QgjSBRbFPXh/jUg2YxXlR9sujkOzdWKBE=; b=SbElPHLKRsKccxMd8CT17WFvEbrAmiiBq0O9I9vhgxsZBJT4yQdiXEP1olJEBtoB3kcTdz/3geWUx7Q6ISIiApf9o2AouhWgFGr/zdhS5kWF4LX23JrXg95rLqkNsnm96y2qXhbYpLE1Tn3RpVqHqGM0Ge1ynsziuLB8kwuUcdg= Received: from LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM (20.176.138.146) by LO2P265MB1213.GBRP265.PROD.OUTLOOK.COM (20.176.141.146) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2178.16; Fri, 16 Aug 2019 10:27:03 +0000 Received: from LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM ([fe80::64e9:9b9e:59fc:26f]) by LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM ([fe80::64e9:9b9e:59fc:26f%5]) with mapi id 15.20.2157.022; Fri, 16 Aug 2019 10:27:03 +0000 From: Andrew Campling To: Alec Muffett CC: =?utf-8?B?UGF0cmlrIEbDpGx0c3Ryw7Zt?= , Stephen Farrell , ADD Mailing list Thread-Topic: [Add] Use Cases - the coffee shop Thread-Index: AdVTdTO8sMFf9NSjRg6hhfqT7Scbe6b9h+AA2QPDGoD///+VcIAAA2AA////rrA= Date: Fri, 16 Aug 2019 10:27:03 +0000 Message-ID: References: <400b774a-5bd0-d6f4-5640-e561f067a9b5@cs.tcd.ie> <74A2E5E0-02CE-4C9D-A66B-1D2FBC65B39A@frobbit.se> <3611F27A-49A9-4159-A683-3BBD4C2F91EA@frobbit.se> In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=andrew.campling@419.consulting; x-originating-ip: [2a00:23c4:a499:2e00:55a7:59be:7d65:cfb6] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 8dab69c2-5dfa-420b-99bb-08d72234480d x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(7021145)(8989299)(4534185)(7022145)(4603075)(4627221)(201702281549075)(8990200)(7048125)(7024125)(7027125)(7023125)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:LO2P265MB1213; x-ms-traffictypediagnostic: LO2P265MB1213: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:8882; x-forefront-prvs: 0131D22242 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(346002)(376002)(366004)(136003)(396003)(39830400003)(189003)(199004)(54906003)(99286004)(81166006)(6246003)(446003)(7696005)(8936002)(81156014)(66556008)(11346002)(8676002)(5660300002)(53936002)(4744005)(33656002)(52536014)(486006)(305945005)(7736002)(44832011)(76176011)(74316002)(102836004)(186003)(6506007)(46003)(256004)(476003)(71190400001)(86362001)(9686003)(508600001)(229853002)(55016002)(71200400001)(6436002)(2906002)(14444005)(6116002)(14454004)(76116006)(4326008)(6916009)(64756008)(66476007)(66446008)(66946007)(25786009)(316002)(46492003); DIR:OUT; SFP:1101; SCL:1; SRVR:LO2P265MB1213; H:LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: 419.consulting does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: bQH8Nw56gOUc8AGsOPtcdcN5l3oOGTDS39xL3o+26JJ26Apogq6n14vpVz8h/ahIyARAGD1mPf/SCx5B6c9Ot+pwPzPopd4mSPLXlsYmU3gFxwN1fox1DhuCe6USPc3CZ5meT3rvW6C0iCwLkiwyx2jOWSTuLDRpkvzKePeY8L0woJ+kU7LjEYlsRn3g5CD5UC6v1j+CGetCQPLeE5rYsEn5McMbJclbm7Zs0AY3DyAijk9aCK55mm9Nn9gNQe0qUnk/RdPA0jvXPHFe2IrkaCdr+UbHUztre+/QKVAFlWxLj8Aj+HkAe1LektXwAtliiMaxqHRY7onVhi6F8WDKUMn3VFxzuD7GsJAzmGwM1vvXUlBGurrSu3fBOSJNxZ0GNShuHpL/5ZzanacJPAsaMlM33IwziNAmDgtzSS6rzWE= x-ms-exchange-transport-forked: True Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: 419.consulting X-MS-Exchange-CrossTenant-Network-Message-Id: 8dab69c2-5dfa-420b-99bb-08d72234480d X-MS-Exchange-CrossTenant-originalarrivaltime: 16 Aug 2019 10:27:03.7939 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 9c2ced3e-7522-4755-87dc-f983abc66ec3 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: gT2wpeAf+dljLlQHfhRMXZYH0TDmbLeSwBXmWPkZNACrcTVi53R0+wjus47pPp2RqBCGEEuzi49H/zkaM05rTZIfL1B+fvqJTOVdH9w5N/k= X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO2P265MB1213 Archived-At: Subject: Re: [Add] Use Cases - the coffee shop X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 10:27:08 -0000 T24gRnJpLCAxNiBBdWcgMjAxOSwgMTE6MjAgQWxlYyBNdWZmZXR0IDxhbGVjLm11ZmZldHRAZ21h aWwuY29tPiB3cm90ZToNCj4gc28geW91J3JlIHNheWluZyB0aGUgaW1wb3J0YW50IHRoaW5nIGlz IHRvIG5vdCBnaXZlIHRvbyBtYW55IHBlb3BsZSB0b28gbXVjaCBzZWN1cml0eSwgZm9yIGZlYXIg b2YgYW5ub3lpbmcgcmVndWxhdG9ycz8NCg0KVGhhdCdzIG9uZSBpbnRlcnByZXRhdGlvbiBvZiB3 aGF0IFBhdHJpayBzdGF0ZWQgZWFybGllciwgbXkgcG9pbnQgd2FzIHNpbXBseSB0aGF0IHlvdXIg ZXZpZGVuY2UgZGlkIG5vdCB1bmRlcm1pbmUgaGlzIGNvbW1lbnQuICAoSSBtaWdodCBhZ3JlZSB3 aXRoIGEgY29udGVudGlvbiB0aGF0IHNvbWUgcmVndWxhdG9ycywgaW4gc29tZSBjaXJjdW1zdGFu Y2VzIGFuZCBpbiBzb21lIG1hcmtldHMsIG1pZ2h0IGJlIHByZXBhcmVkIHRvIGFjY2VwdCAiZ29v ZCBlbm91Z2giIGJlY2F1c2UgInBlcmZlY3QiIGlzIHRvbyBleHBlbnNpdmUgdG8gZGVsaXZlcnkg dmVyc3VzIHRoZSBhZGRpdGlvbmFsIGJlbmVmaXQgb2YgZG9pbmcgc28gLSBvYnZpb3VzbHkgdGhl cmUgd2lsbCBiZSBleGNlcHRpb25zIHRvIHRoaXMpLiAgICANCg0KU2VwYXJhdGVseSwgd2hldGhl ciBEb0ggYnkgaXRzZWxmIGRlbGl2ZXJzIG9uIGVpdGhlciAic2VjdXJpdHkiIG9yICJwcml2YWN5 IiBpcyBhdCBsZWFzdCBhIG1hdHRlciBvZiBkZWJhdGUsIGFzIGV2aWRlbmNlZCBieSB0aGUgZXhj aGFuZ2VzIGhlcmUuICANCg0KDQoNCg== From nobody Fri Aug 16 03:32:25 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DEDE412012E for ; Fri, 16 Aug 2019 03:32:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=tele.no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id O_mZcd1FkP3o for ; Fri, 16 Aug 2019 03:32:22 -0700 (PDT) Received: from gorgon.tele.no (gorgon.tele.no [IPv6:2001:700:800::70]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CBF20120122 for ; Fri, 16 Aug 2019 03:32:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=tele.no; s=20180731; h=Content-Transfer-Encoding:Content-Type:In-Reply-To:MIME-Version :Date:Message-ID:From:References:Cc:To:Subject:Sender:Reply-To:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=Hn0/5HxEMiHcztnwlSKc60+gG2i9/p6FJA07aj7N6us=; b=WQyz/1oFPyI6ZJ9RQodncJdp2h /5ymgrmD1WycIoPfktfHpC6VryECFmUwurTse8Jy06f7e08HvxvnKcKsQ8MbqxJTXUK2CAftAsiYd VBkFxDMr2RnSWPePVG91SiiRCE5ANj341coupCHK6V1VN0W+JNtvDAz05YmXf9CelhBaz6UH1Y/Rw +A3nK1i0powR4czyguxxH9ZfJlfqdv9hDByaLQPNRpXZ6OLj2CQ7biuKPwC541mS/GvQJ1NpicSUj nNJABIYiv1vqEasVXGYyFkVAGcxumb+H2gXCtBocM7lHwUPiDYIavBjkiMqVCwQkG7mr14ZtN+r7K Kqv2DiQw==; Received: from pilt1.tele.no ([2001:700:800::20] helo=[IPv6:::1]) by gorgon.tele.no with esmtp (Exim 4.92) (envelope-from ) id 1hyZWo-0004DO-Sw; Fri, 16 Aug 2019 12:32:14 +0200 To: Andrew Campling , Bret Jordan Cc: ADD Mailing list References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <8e00891f-2aa2-ee11-559a-b5a8967b22d9@nostrum.com> <2C23D415-84F9-4B6C-B67B-0CC3EB600520@gmail.com> <2704899B-E43D-4978-A3C9-30E9E7CEBEBD@fugue.com> <4CC4C262-BEF4-4B39-ACB1-A595AB66D6CD@gmail.com> From: Frode Kileng Message-ID: Date: Fri, 16 Aug 2019 12:32:14 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Content-Language: en-US Archived-At: Subject: Re: [Add] [Ext] Validity of the "child safety/malware protection" argument X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 10:32:24 -0000 On 16/08/2019 11:47, Andrew Campling wrote: > On 16/08/2019 07:56, Frode Kileng wrote: > >> There are numerous other client-side child-safe products in the markets that will >> continue to work perfectly well. Please please stop using this "save the children" >> argument that has been fronted by the "anti-encryption camp" for the last 5 years. > Whilst there may be alternative child-safe products, it should be remembered that at least some ISPs provide parental controls using DNS filtering (and malware protection) as part of their service bundle, making it relatively simple for their customers to configure and use the services. These are generally provided at no additional cost and, in some instances, are enabled by default. Having a protocol like DoH bypass such services without due warning to those users is a problem. Having to share data with an alternate app provider to rectify the situation may also be a problem to some of those users, particularly if that provider is based off-shore from the user. If the goal is "child safe" environment, the core issue must be the level of protection you provide for children not who provides, cost and "convenience". And those DNS-filtering solutions cannot compare to the client-side solution with regard to the level of protection due to their access to the un-encrypted content and that they protect the children on any network. I strongly disagree that this "protect the children" is a valid argument. > NB This has nothing to do with anti-encryption, is about understanding the behaviours and expectations of regular users (and regulators and politicians for that matter, although these are separate considerations). Sorry for not making this clearer. I intended only to  point out similarities between the this discussion and argumentation with the encryption/anti-encryption discussion. with many of the same arguments repeated from that time. Back then, network operators argued that encryption would have a disastrous effect on network management, undermining their role and also threatens the safety of children and others. I strongly agree with Martin's suggestions to maybe take some lessons from that encryption discussion, i.e. to "produce a dispassionate assessment of each use case in turn, reaching agreement that the analysis was at least accurate, then deciding what was important enough to do something about" [1] . (I was not lucky enough to  experienced such a constructive effort within the communities I participated back then and feel still exhausted when thinking back...). [1] https://mailarchive.ietf.org/arch/msg/add/You2UXZbjDogcASupgZTzjdYVMs Best regards Frode From nobody Fri Aug 16 03:59:18 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 91A29120088 for ; Fri, 16 Aug 2019 03:59:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=netorgft5189650.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id euS9oL82pYxB for ; Fri, 16 Aug 2019 03:59:13 -0700 (PDT) Received: from GBR01-LO2-obe.outbound.protection.outlook.com (mail-eopbgr100061.outbound.protection.outlook.com [40.107.10.61]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 76C94120018 for ; Fri, 16 Aug 2019 03:59:13 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=RPYY9SEZJ5QrhgWTEqrCNa6zTV6QsRgQdkK9vCCfTuTpw/UrDHylfOcgmJ9+hY9b7yNxmmyCFgW7W+eagsTy5yhbarj0ftGESGBIt6azjkM7iiNR377f7Eq5d/+STev6lZ7ooOhgW3U02qvG1HRZRN8O6ONBSvNGhxDr27u2LcX6BEjKy6di8PmmtOSqKkSigPISvhDTsK1wclyNmDT8W43DzSjnULMWvsVUYHrYFky7Q9vIqIIUJU9cWUuL837sFyJZGGh7982WGzPJsqq6GviTZEo/IARCZNDC3PawvksZYIwgoNuReKxX1NFOljsM+rIu5oor6V8M8nRG4M+x/g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=oIz3TTP7dvjrntT2Wab8s5q/YiHTnvd/oECHN5glvuU=; b=IP1C5FECZ60E2/sxfCoOzowLDb3AHMUdrMkC38x3LUKQpb9nMi5ATDp17MXB26cV8QxVZpEOdY4fcYZmqoKtEqxpXcEqFnk1aLWQrslQCwVySj5m704MFqLp1CwSc3vY6O0pD4AdZIlOT7MKYvCYrNm+KKwpK19dE493REHmcPoYWg/QCsLZJM/RGOLBvQnAkjbdtu1pNNFgGrBcFQprzguI6m2nZtDsSyyCIAjDAeL1cWp2d1Gz6Q8Heryg0JuL9lz1NefZJ6hC1HmG7B1zoOqp5dUV2nDGoHT5wc85c7XcPfx9KQWx+SeiixxmxgRjd0zY6XuWk+N2WpNuVZuF6A== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=419.consulting; dmarc=pass action=none header.from=419.consulting; dkim=pass header.d=419.consulting; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=NETORGFT5189650.onmicrosoft.com; s=selector1-NETORGFT5189650-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=oIz3TTP7dvjrntT2Wab8s5q/YiHTnvd/oECHN5glvuU=; b=XCEZ4yJulO2sn0UT2OLKTHn6zEZkpPMVBuf0n9XFDECJASXQv6GU6F8ovgmIvMMvVguKdlpj+C5ywqEYRPR/T2vEEi6ZzwsTVOQi//BDP1yQ30lNSgCPslsD9OsvNCYKK/6RJ7oX4lFb1Y3vVZXpELuYi6mHL8HegPLkFDQO1lk= Received: from LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM (20.176.138.146) by LO2P265MB0496.GBRP265.PROD.OUTLOOK.COM (10.166.98.14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2157.15; Fri, 16 Aug 2019 10:59:11 +0000 Received: from LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM ([fe80::64e9:9b9e:59fc:26f]) by LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM ([fe80::64e9:9b9e:59fc:26f%5]) with mapi id 15.20.2157.022; Fri, 16 Aug 2019 10:59:10 +0000 From: Andrew Campling To: Frode Kileng , Bret Jordan CC: ADD Mailing list Thread-Topic: [Add] [Ext] Validity of the "child safety/malware protection" argument Thread-Index: AQHVVB3jlAxAjhyiQUiT+I9eyRnoC6b9l8MQ Date: Fri, 16 Aug 2019 10:59:10 +0000 Message-ID: References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <8e00891f-2aa2-ee11-559a-b5a8967b22d9@nostrum.com> <2C23D415-84F9-4B6C-B67B-0CC3EB600520@gmail.com> <2704899B-E43D-4978-A3C9-30E9E7CEBEBD@fugue.com> <4CC4C262-BEF4-4B39-ACB1-A595AB66D6CD@gmail.com> In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=andrew.campling@419.consulting; x-originating-ip: [2a00:23c4:a499:2e00:55a7:59be:7d65:cfb6] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 77b8efd5-d937-420d-3d76-08d72238c4b5 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(7021145)(8989299)(5600148)(711020)(4605104)(1401327)(4534185)(7022145)(4603075)(4627221)(201702281549075)(8990200)(7048125)(7024125)(7027125)(7023125)(2017052603328)(7193020); SRVR:LO2P265MB0496; x-ms-traffictypediagnostic: LO2P265MB0496: x-ms-exchange-purlcount: 1 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-forefront-prvs: 0131D22242 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(366004)(136003)(396003)(346002)(376002)(39830400003)(199004)(189003)(110136005)(11346002)(44832011)(76176011)(476003)(14454004)(99286004)(486006)(446003)(74316002)(316002)(6116002)(7696005)(508600001)(256004)(14444005)(81166006)(81156014)(25786009)(46003)(4326008)(8936002)(33656002)(86362001)(9686003)(55016002)(6306002)(6506007)(52536014)(66446008)(102836004)(66946007)(53546011)(6436002)(6246003)(53936002)(966005)(229853002)(5660300002)(71200400001)(71190400001)(64756008)(186003)(7736002)(305945005)(8676002)(2906002)(76116006)(66476007)(66556008)(46492003); DIR:OUT; SFP:1101; SCL:1; SRVR:LO2P265MB0496; H:LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: 419.consulting does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: zM3z51IQ2VGP8I3H38IJZQfZQH3ng3U3yQFA0BOMo44oKxUkcIdGGiHf7z/n1m+GnwVRy9Fnq/SFANnT02bUnyUS/+/ff6/+jNTAT/AwN4wg5ZN8nGMOx9XBXjukZDB4IKHhD+vxNZCwNpz044fGqWBuousL87ZAX8rlDHFy2DwQ4TrpMAF0Oaqr1WZjufnYfoYpX/0VmIMYgLD0gQkbMJEwiaBkmrAiRfb1cSPC9eXoJkfpVyWYhPerN9Ne5TyI786bnClIqTi4xnRItBmCrvih/++kO0dDwSt6ZrQ4jSgoZYY080JOwm9nA+giqTYchheGNdKM9dtrlY8afANg04z5nc1nxawy9xS+xhs9QGuyn3dETxxn+/7V9JeOWJeZgKz3BMysLxZr10HkybXpSkt8lSNqXT/CbiWoiag+OuA= x-ms-exchange-transport-forked: True Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: 419.consulting X-MS-Exchange-CrossTenant-Network-Message-Id: 77b8efd5-d937-420d-3d76-08d72238c4b5 X-MS-Exchange-CrossTenant-originalarrivaltime: 16 Aug 2019 10:59:10.9120 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 9c2ced3e-7522-4755-87dc-f983abc66ec3 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: 30jDhZ4mci3ebU6vbBfG39NUmwL7saJDn1esYodDYzyRC77QerwE1IqNrogG1HQW7+eg8d5Tmt9mBh5l7zcGqyesiVb6DvAKsHjsDZdJZoI= X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO2P265MB0496 Archived-At: Subject: Re: [Add] [Ext] Validity of the "child safety/malware protection" argument X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 10:59:17 -0000 T24gMTYvMDgvMjAxOSAxMTozMiwgRnJvZGUgS2lsZW5nIDxmcm9kZWtAdGVsZS5ubz4gd3JvdGU6 DQo+IElmIHRoZSBnb2FsIGlzICJjaGlsZCBzYWZlIiBlbnZpcm9ubWVudCwgdGhlIGNvcmUgaXNz dWUgbXVzdCBiZSB0aGUgbGV2ZWwgb2YgcHJvdGVjdGlvbiB5b3UgDQo+IHByb3ZpZGUgZm9yIGNo aWxkcmVuIG5vdCB3aG8gcHJvdmlkZXMsIGNvc3QgYW5kICJjb252ZW5pZW5jZSIuIEFuZCB0aG9z ZSBETlMtZmlsdGVyaW5nIA0KPiBzb2x1dGlvbnMgY2Fubm90IGNvbXBhcmUgdG8gdGhlIGNsaWVu dC1zaWRlIHNvbHV0aW9uIHdpdGggcmVnYXJkIHRvIHRoZSBsZXZlbCBvZiBwcm90ZWN0aW9uIA0K PiBkdWUgdG8gdGhlaXIgYWNjZXNzIHRvIHRoZSB1bi1lbmNyeXB0ZWQgY29udGVudCBhbmQgdGhh dCB0aGV5IHByb3RlY3QgdGhlIGNoaWxkcmVuIG9uIA0KPiBhbnkgbmV0d29yay4NCg0KSSBhZ3Jl ZSB0aGF0IHRoZXJlIGFyZSB0cmFkZS1vZmYgaGVyZSwgd2l0aCBzb21lIHNvbHV0aW9ucyBwcm92 aWRpbmcgbW9yZSBjb21wcmVoZW5zaXZlIHByb3RlY3Rpb24sIGFsYmVpdCBzb21lIG9mIHRob3Nl IGFyZSBpbiB0dXJuIHNpZ25pZmljYW50bHkgbW9yZSBpbnRydXNpdmUgdG8gdGhlIGNsaWVudCAo Y2hpbGQpIHdoaWNoIHJhaXNlcyBpdHMgb3duLCBzZXBhcmF0ZSBpc3N1ZXMgLSBwcm9iYWJseSB0 b28gZmFyIG9mZi10b3BpYyB0byBwdXJzdWUgaGVyZS4gIA0KDQo+IEkgc3Ryb25nbHkgZGlzYWdy ZWUgdGhhdCB0aGlzICJwcm90ZWN0IHRoZSBjaGlsZHJlbiIgaXMgYSB2YWxpZCBhcmd1bWVudC4N Cg0KVGhpcyB3aWxsIHZhcnkgaW4gZGlmZmVyZW50IG1hcmtldHMuICBGb3IgZXhhbXBsZSwgaW4g dGhlIFVLIHRoZXJlIGFyZSBuZXcgYW5kIHNwZWNpZmljIHJlcXVpcmVtZW50cyBiZWluZyBpbnRy b2R1Y2VkIGJ5IG9uZSBvZiB0aGUgcmVndWxhdG9ycyAodGhlIEluZm9ybWF0aW9uIENvbW1pc3Np b25lcidzIE9mZmljZSkgcmVxdWlyaW5nIHRlY2ggY29tcGFuaWVzIHRvIHNob3cgaG93IHRoZXkg YXJlIHByb3RlY3RpbmcgdGhlIGRhdGEgb2YgY2hpbGRyZW4gdGhhdCB1c2UgdGhlaXIgc2Vydmlj ZXMuICBJbiBhZGRpdGlvbiwgYSBnZW5lcmFsIGR1dHkgb2YgY2FyZSBpcyBpbiB0aGUgcHJvY2Vz cyBvZiBiZWluZyBpbnRyb2R1Y2VkIHRocm91Z2ggbGVnaXNsYXRpb24sIGN1cnJlbnRseSB0YXJn ZXRlZCBwcmltYXJpbHkgYXQgc29jaWFsIG1lZGlhIHBsYXRmb3JtLCB0byBhZGRyZXNzIGEgcmFu Z2Ugb2YgaXNzdWVzIGNhdXNlZCBieSBvbmxpbmUgaGFybXMuICBZZXMgdGhpcyBwYXJ0aWN1bGFy IGV4YW1wbGUgaXMgVUstc3BlY2lmaWMgYnV0IGRvZXMgcmVxdWlyZSBhIHJhbmdlIG9mIGNvbXBh bmllcyB0byBzaG93IHRoYXQgdGhleSBhcmUgInByb3RlY3RpbmcgdGhlIGNoaWxkcmVuIi4gIEl0 IHdvdWxkIGJlIGhlbHBmdWwgdG8gdW5kZXJzdGFuZCBpZiB0aGlzIGlzIGFuIGlzb2xhdGVkIGV4 YW1wbGUgb3IgaWYgdGhlcmUgYXJlIG90aGVyLCBzaW1pbGFyIGluaXRpYXRpdmVzIGVsc2V3aGVy ZS4gIA0KDQoNCj4gSSBzdHJvbmdseSBhZ3JlZSB3aXRoIE1hcnRpbidzIHN1Z2dlc3Rpb25zIHRv IG1heWJlIHRha2Ugc29tZSBsZXNzb25zIGZyb20gdGhhdCBlbmNyeXB0aW9uIA0KPiBkaXNjdXNz aW9uLCBpLmUuIHRvICJwcm9kdWNlIGEgZGlzcGFzc2lvbmF0ZSBhc3Nlc3NtZW50IG9mIGVhY2gg dXNlIGNhc2UgaW4gdHVybiwgcmVhY2hpbmcgDQo+IGFncmVlbWVudCB0aGF0IHRoZSBhbmFseXNp cyB3YXMgYXQgbGVhc3QgYWNjdXJhdGUsIHRoZW4gZGVjaWRpbmcgd2hhdCB3YXMgaW1wb3J0YW50 IGVub3VnaCANCj4gdG8gZG8gc29tZXRoaW5nIGFib3V0IiBbMV0gLiANCj4gDQo+IFsxXSBodHRw czovL21haWxhcmNoaXZlLmlldGYub3JnL2FyY2gvbXNnL2FkZC9Zb3UyVVhaYmpEb2djQVN1cGda VHpqZFlWTXMNCg0KSGVyZSB3ZSBjYW4gY2VydGFpbmx5IGFncmVlLiAg8J+Yig0KDQoNCkFuZHJl dyAgDQoNCg0K From nobody Fri Aug 16 04:00:57 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 847D4120088 for ; Fri, 16 Aug 2019 04:00:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.298 X-Spam-Level: X-Spam-Status: No, score=-4.298 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=open-xchange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oR2aTVAGVOV1 for ; Fri, 16 Aug 2019 04:00:52 -0700 (PDT) Received: from mx4.open-xchange.com (alcatraz.open-xchange.com [87.191.39.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 46428120018 for ; Fri, 16 Aug 2019 04:00:52 -0700 (PDT) Received: from open-xchange.com (imap.open-xchange.com [10.20.30.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx4.open-xchange.com (Postfix) with ESMTPS id 043856A277 for ; Fri, 16 Aug 2019 13:00:50 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=open-xchange.com; s=201705; t=1565953250; bh=x4sjRelPC/9NUOBmR8lIot2M1ZhFS2H4oocyuwRngXg=; h=From:Subject:Date:References:To:In-Reply-To:From; b=4fHRLwvOJ4ggteMqHRrb8/O/W9nfyGlFJ8QVOA4kX5WhaiMv6vNXw8hOEpTfkGm+5 g/Yki2uQ8CMVNOLTwTe8Ayn7nbzxg/ZI14xN+b7dP5WJTXd7UjY/tVGdN900mDDMEb 5/9PHhpk2xgN8+D63nAn8yorvPgj/z5nw318GELAnnTxVSqkMjG4E02vQRV/qq82FU 3yhjGWssfVgvxyjpXRisML32kx1Ozr0tiHRLuAURZpN9/fQxCt2OChaUpvPFbAouPz em6CAXiiN1rZgcDWpwdk4HOsPsZrwlF4fpoyXDcLa9bKKh4bwkwHFEIUKS0/L3Et1d tCsNa6kSFE1Dw== Received: from [192.168.1.128] (host31-53-106-255.range31-53.btcentralplus.com [31.53.106.255]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by open-xchange.com (Postfix) with ESMTPSA id D5CFD3C028F for ; Fri, 16 Aug 2019 13:00:49 +0200 (CEST) From: Neil Cook Content-Type: multipart/alternative; boundary="Apple-Mail=_4B81FB5B-EFAF-4CA2-8C87-46D1B965C080" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Fri, 16 Aug 2019 12:00:48 +0100 References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <8e00891f-2aa2-ee11-559a-b5a8967b22d9@nostrum.com> <2C23D415-84F9-4B6C-B67B-0CC3EB600520@gmail.com> <2704899B-E43D-4978-A3C9-30E9E7CEBEBD@fugue.com> <4CC4C262-BEF4-4B39-ACB1-A595AB66D6CD@gmail.com> To: ADD Mailing list In-Reply-To: Message-Id: <2E35AAFE-5930-4083-BDC4-18B956291E85@open-xchange.com> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] [Ext] Validity of the "child safety/malware protection" argument X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 11:00:55 -0000 --Apple-Mail=_4B81FB5B-EFAF-4CA2-8C87-46D1B965C080 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 > On 16 Aug 2019, at 11:32, Frode Kileng wrote: >=20 > On 16/08/2019 11:47, Andrew Campling wrote: >> On 16/08/2019 07:56, Frode Kileng wrote: >>=20 >>> There are numerous other client-side child-safe products in the = markets that will >>> continue to work perfectly well. Please please stop using this "save = the children" >>> argument that has been fronted by the "anti-encryption camp" for the = last 5 years. >> Whilst there may be alternative child-safe products, it should be = remembered that at least some ISPs provide parental controls using DNS = filtering (and malware protection) as part of their service bundle, = making it relatively simple for their customers to configure and use the = services. These are generally provided at no additional cost and, in = some instances, are enabled by default. Having a protocol like DoH = bypass such services without due warning to those users is a problem. = Having to share data with an alternate app provider to rectify the = situation may also be a problem to some of those users, particularly if = that provider is based off-shore from the user. >=20 > If the goal is "child safe" environment, the core issue must be the = level of protection you provide for children not who provides, cost and = "convenience". And those DNS-filtering solutions cannot compare to the = client-side solution with regard to the level of protection due to their = access to the un-encrypted content and that they protect the children on = any network. >=20 > I strongly disagree that this "protect the children" is a valid = argument. What people choose to use for parental control, internet filtering, = malware protection etc. is up to them, as is their choice in terms of = the level of protection it provides. You are not the arbiter of that. = You are entitled to your opinion of course, but that=E2=80=99s all it = is. DNS filtering is a valid use-case whether or not it meets your = personal definition of child safety (or malware protection or whatever). Neil Cook neil.cook@open-xchange.com = --------------------------------------------------------------------------= ----------- Open-Xchange AG, Rollnerstr. 14, 90408 Nuremberg, District Court = Nuremberg HRB 24738 Managing Board: Rafael Laguna de la Vera, Carsten Dirks, Michael = Knapstein, Stephan Martin=20 Chairman of the Board: Richard Seibt European Office:=20 Open-Xchange GmbH, Olper Huette 5f, D-57462 Olpe, Germany, District = Court Siegen, HRB 8718=20 Managing Director: Frank Hoberg US Office:=20 Open-Xchange. Inc., 530 Lytton Avenue, Palo Alto, CA 94301, USA=20 = --------------------------------------------------------------------------= ----------- --Apple-Mail=_4B81FB5B-EFAF-4CA2-8C87-46D1B965C080 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8

On 16 Aug 2019, at 11:32, Frode Kileng <frodek@tele.no> = wrote:

On 16/08/2019 11:47, Andrew Campling wrote:
On 16/08/2019 07:56, = Frode Kileng <frodek@tele.no> wrote:

There are numerous other = client-side child-safe products in the markets that will
continue to work perfectly well. Please please stop using = this "save the children"
argument that has been fronted by = the "anti-encryption camp" for the last 5 years.
Whilst there may be alternative child-safe = products, it should be remembered that at least some ISPs provide = parental controls using DNS filtering (and malware protection) as part = of their service bundle, making it relatively simple for their customers = to configure and use the services.  These are generally provided at = no additional cost and, in some instances, are enabled by default. =  Having a protocol like DoH bypass such services without due = warning to those users is a problem.  Having to share data with an = alternate app provider to rectify the situation may also be a problem to = some of those users, particularly if that provider is based off-shore = from the user.

If the goal is = "child safe" environment, the core issue must be the level of protection = you provide for children not who provides, cost and "convenience". And = those DNS-filtering solutions cannot compare to the client-side solution = with regard to the level of protection due to their access to the = un-encrypted content and that they protect the children on any = network.

I strongly disagree that this = "protect the children" is a valid argument.

What = people choose to use for parental control, internet filtering, malware = protection etc. is up to them, as is their choice in terms of the level = of protection it provides. You are not the arbiter of that. You are = entitled to your opinion of course, but that=E2=80=99s all it is. =  DNS filtering is a valid use-case whether or not it meets your = personal definition of child safety (or malware protection or = whatever).

Neil = Cook
neil.cook@open-xchange.com

---------------------------------------------------------------= ----------------------
Open-Xchange AG, Rollnerstr. 14, = 90408 Nuremberg, District Court Nuremberg HRB 24738
Managing Board: Rafael Laguna de la Vera, Carsten Dirks, = Michael Knapstein, Stephan Martin 
Chairman of = the Board: Richard Seibt

European = Office: 
Open-Xchange GmbH, Olper Huette = 5f, D-57462 Olpe, Germany, District Court Siegen, HRB = 8718 
Managing Director: Frank Hoberg
US Office: 
Open-Xchange. Inc., 530 = Lytton Avenue, Palo Alto, CA 94301, USA 
---------------------------------------------------------------= ----------------------

= --Apple-Mail=_4B81FB5B-EFAF-4CA2-8C87-46D1B965C080-- From nobody Fri Aug 16 04:03:24 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id ECF5212008A for ; Fri, 16 Aug 2019 04:03:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.996 X-Spam-Level: X-Spam-Status: No, score=-1.996 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, UNPARSEABLE_RELAY=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=hopcount.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ir09wIGV7wrY for ; Fri, 16 Aug 2019 04:03:21 -0700 (PDT) Received: from mail-lj1-x22e.google.com (mail-lj1-x22e.google.com [IPv6:2a00:1450:4864:20::22e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2F1FC120018 for ; Fri, 16 Aug 2019 04:03:21 -0700 (PDT) Received: by mail-lj1-x22e.google.com with SMTP id x4so4930331ljj.6 for ; Fri, 16 Aug 2019 04:03:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hopcount.ca; s=google; h=from:mime-version:references:in-reply-to:date:message-id:subject:to :cc; bh=ttRWtnBoZ1fE5ikQHC5qXHnBOmJdcGR/HMrtc/SAlyA=; b=hhJc+eV1+aD07aHzxotC6bTF9ASZX6oVsv1BAFkaO/aJsQRAFk3tyxOpb4/jrXcg11 Nyy9V5hoLSC3nzWitGh4ZWRSnZ1TVSnnUgMFjNVc/2k+pOFxmK2D4yHioMl6sLNC4kPa NFd+7zI2ZFD6g4g+KYY41HAvGFWMZ6Wkfpc8c= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:mime-version:references:in-reply-to:date :message-id:subject:to:cc; bh=ttRWtnBoZ1fE5ikQHC5qXHnBOmJdcGR/HMrtc/SAlyA=; b=Gej/+LPFq7Ie2eQ27vAZpgn/n2Zktba+7Ah9PGaaGrssBdFLl6uM453/ej5tTLIUjN RysE0eMLDFn731GpVEW1vCiIgJix2jwmEoBzshDQLtOOawp7P0r0YJ4Uk2xYflE78cbY Zbw/q68Ak4OvtgdAixahGjzE2PXx8LYZimosPvNdmthVeuXdttZfAH5lgUgbZk/KwM7U tUKIQsQoTDnS95btD53L/kEFq4ZYxOVQMDfjLLRM7WWQwCvjPWJdGvYeVdAJs9r/FrrS RKheZXjJE9emZz5+eKli+/2GmZ+c6ZtMAQOD1VgZHA1I7LBjCzZRskzCSJeXAJ/82j4y dGjA== X-Gm-Message-State: APjAAAVybu5EhBoAsaaC1qOh7oTfDP7Uo/bCAdyaXG9eBGIIrLErFAKN 780bsGe74gaFGdle4S+f/mS69BMGFRZ2mf0/cNBqVg== X-Google-Smtp-Source: APXvYqwihoVJPezbPwnTzrtIaQzCSAUlAPXeq3TO5otcfko1ELauTaUE5AyoO806m2BeiUXYRavrE3k81DSD4KI10RE= X-Received: by 2002:a2e:8794:: with SMTP id n20mr5091628lji.116.1565953399152; Fri, 16 Aug 2019 04:03:19 -0700 (PDT) Received: from unknown named unknown by gmailapi.google.com with HTTPREST; Fri, 16 Aug 2019 04:03:18 -0700 From: Joe Abley Mime-Version: 1.0 (1.0) References: In-Reply-To: Date: Fri, 16 Aug 2019 04:03:18 -0700 Message-ID: To: Andrew Campling Cc: Ted Lemon , ADD Mailing list Content-Type: text/plain; charset="UTF-8" Archived-At: Subject: Re: [Add] Use Cases - the coffee shop: DoH and Authentication X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 11:03:23 -0000 On Aug 16, 2019, at 06:05, Andrew Campling wrote: > >> On Aug 15, 2019, at 18:50, Joe Abley wrote: >> In your view, what is missing in HTTPS authentication that is needed for DoH? > > On Aug 15, 2019, at 18:56, Ted Lemon wrote: >> Fortunately DoH provides authentication. > > By itself, DoH does nothing to address the authenticity of a response, which could still be tampered with elsewhere. Agreed. But the question was about authentication, not integrity protection. Are we just using the same words for different things? DoH has no ambition to provide integrity protection, so the simple observation of that as a weakness seems a bit bizarre. It's like criticising a particular type of coffee maker for being bad at mashed potatoes. Joe From nobody Fri Aug 16 04:28:50 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 97E7D120099 for ; Fri, 16 Aug 2019 04:28:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=netorgft5189650.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ukBaE93Lk7fU for ; Fri, 16 Aug 2019 04:28:46 -0700 (PDT) Received: from GBR01-LO2-obe.outbound.protection.outlook.com (mail-eopbgr100071.outbound.protection.outlook.com [40.107.10.71]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 636F1120018 for ; Fri, 16 Aug 2019 04:28:46 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=hz+cexLYP6U8LxjaE5R0Hp6g3jqnJeonwT+CGRi6y73Za8umtd/0Uy6j0EMU9LmpiwZDqVQvoWwhMAahaNeGWWoj8gJfirMJX7B1tcsVr3QyShOOqCFjwojD9V1xdLAR7H/IKhlbwgPo8tAcZlHvBoI7lfaVM6hF2inGf1jyu6XxOJVEO2O6ABRPM1XspPpJXyomVJTe2JM25eyb301zk955C6QC7rvacoq/c5wkMecrhoW/EVHWS03KaSLCP6fce2CfdMOqwzcPgp/Iw8BSNE44CKVD2qvDGcumE63xSUaUgZgMkMamSkWVZbRQ60B1yTe48N+j2jhn6xup18m/PA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=BL/quAGoCLR9UbJiEOnfS7ItaBcohc15A7uFo+CHMM8=; b=d0G5LIW0EDE0W8AeW45LfOTdhTjJ2YeS7X22vVVQhMgh+K7+RXocOFm3iMBS/rytx9j27HnLC6WN//4LjCTfeN0uPu4CwgCNlyAULUS7Zfferk6z63E5bRisxVIBezBYxU09TKFoWW4tGDRDnFxH+4pywRD80T74qUWsioUuvdUjAl3rfsWP4XKvG7sg3ZhwJuBkoTkIWW7TjO8mfp43OZ6idilgNcgtVp2ZiugIk3hjUURjIAOymFZQVmkIWQkI3FZfArh5tGI/lyM8W7Dvjx3p+fwatfDOpTXGijLNP/+JYl8vpH6uf+BNEICAGCuyVUs3zjibcjUkhr77DTziDQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=419.consulting; dmarc=pass action=none header.from=419.consulting; dkim=pass header.d=419.consulting; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=NETORGFT5189650.onmicrosoft.com; s=selector1-NETORGFT5189650-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=BL/quAGoCLR9UbJiEOnfS7ItaBcohc15A7uFo+CHMM8=; b=ksrMwruGaCdcFEmDaKVJrNz4JZQw/IdRSouIjyYsCbobVea9dPGxt4vMYBTMQTvPnwvDHhZMtebWjA6ubABGefPoqICP54shNxtgJt4UnxVcvJVMdPi0k6MSFosjRTyfy4atQgJCUk7FwamGJ8f3R1UUHL9E+TzQEq6s7Fru/co= Received: from LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM (20.176.138.146) by LO2P265MB1407.GBRP265.PROD.OUTLOOK.COM (20.176.138.149) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2157.20; Fri, 16 Aug 2019 11:28:43 +0000 Received: from LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM ([fe80::64e9:9b9e:59fc:26f]) by LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM ([fe80::64e9:9b9e:59fc:26f%5]) with mapi id 15.20.2157.022; Fri, 16 Aug 2019 11:28:43 +0000 From: Andrew Campling To: Alec Muffett , Eric Rescorla CC: Ted Lemon , ADD Mailing list , Joe Abley Thread-Topic: [Add] Use Cases - the coffee shop: DoH and Authentication Thread-Index: AdVUGhoAIQuk0GiITnmv9JrxK6MriQAATq8AAAAYOnAAAFZXAAABZCOw Date: Fri, 16 Aug 2019 11:28:43 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=andrew.campling@419.consulting; x-originating-ip: [2a00:23c4:a499:2e00:55a7:59be:7d65:cfb6] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: bc362dc3-7f52-427e-b937-08d7223ce571 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(7021145)(8989299)(4534185)(7022145)(4603075)(4627221)(201702281549075)(8990200)(7048125)(7024125)(7027125)(7023125)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:LO2P265MB1407; x-ms-traffictypediagnostic: LO2P265MB1407: x-ms-exchange-purlcount: 1 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-forefront-prvs: 0131D22242 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(39830400003)(366004)(136003)(396003)(346002)(376002)(199004)(189003)(71190400001)(508600001)(110136005)(25786009)(14444005)(71200400001)(256004)(2906002)(66574012)(81156014)(53936002)(54906003)(81166006)(55016002)(5660300002)(4326008)(486006)(76176011)(186003)(476003)(446003)(11346002)(44832011)(8676002)(966005)(46003)(7696005)(99286004)(6116002)(6246003)(53546011)(102836004)(6506007)(14454004)(76116006)(316002)(7736002)(305945005)(229853002)(66446008)(64756008)(66946007)(74316002)(9686003)(8936002)(6306002)(33656002)(66476007)(86362001)(52536014)(6436002)(66556008)(46492003); DIR:OUT; SFP:1101; SCL:1; SRVR:LO2P265MB1407; H:LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: 419.consulting does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: HzjWtBNp2tA0VEZC3ZuGUyAUgs8eRSlvCwY+ptxZSd5/+sfO3LfuLtbiPOYEqHhothLJmlrcK907MLkD6vMKjPfhuDMAeKmaplpwoO0fC0eycngh/obyJZdGULSxd6xFVuMvc0T4CwNWyBM+QdY6fabt6vqBdOTglBL9fEuLOt8lY2kNohmzoZlRbJx5FNGQLFNqai5Uezj21AiD1wzHznYMrixhs7pPiaZhSBbWrJT3ajpwb0HyJEYE3MSAfzQFH7ShsFuTx+aPnGHVjVgIDNj+Ous8Hy4qqzOYa3+owQQh30+x0GmywciHE9RVztbi6ebc3UNRlUMiMjw1iIGKYAL2FpjRmLm1uJyQ1VxqGOcJxE2kgwnwy1/hXnQZyEeiLI77g+MHSGTyuX94TeySubjVnCR/OJizFs4BU9FEVNw= x-ms-exchange-transport-forked: True Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: 419.consulting X-MS-Exchange-CrossTenant-Network-Message-Id: bc362dc3-7f52-427e-b937-08d7223ce571 X-MS-Exchange-CrossTenant-originalarrivaltime: 16 Aug 2019 11:28:43.8432 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 9c2ced3e-7522-4755-87dc-f983abc66ec3 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: AmpVTEw0Iciue9uVDSwUwW0GW7vvTSWBHu1QnSvwgqa21tjS7v82q1yt1Iw49/Zu9GEnx0CvxGt2gWUvUVGo6WNwkFoahcFuPIK30+Dabqk= X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO2P265MB1407 Archived-At: Subject: Re: [Add] Use Cases - the coffee shop: DoH and Authentication X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 11:28:48 -0000 T24gRnJpLCAxNiBBdWcgMjAxOSwgMTE6MjYgQWxlYyBNdWZmZXR0IDxhbGVjLm11ZmZldHRAZ21h aWwuY29tPiB3cm90ZToNCg0KPj4gTGV0J3Mgbm90IGZvcmdldCB0aGF0IERvSCBpbnRyb2R1Y2Vz IG5ldyB2dWxuZXJhYmlsaXRpZXMgd2l0aGluIHRoZSBjbGllbnQgZGV2aWNlLsKgIA0KDQo+IEFu ZCBub3cgeW91J3JlIGp1c3QgY2FzdGluZyBhc3BlcnNpb25zLg0KDQpJJ20gc29ycnkgaWYgeW91 IHRvb2sgYnJldml0eSBmb3IgdGhlIGNhc3Rpbmcgb2YgYXNwZXJzaW9ucywgdGhlIGludGVudGlv biB3YXMgc2ltcGx5IHRvIGhpZ2hsaWdodCB0aGF0IHRoZSBzaXR1YXRpb24gd2FzIG5vdCBxdWl0 ZSBhcyBjbGVhciBjdXQgYXMgeW91ciBlYXJsaWVyIHBvc3QgaW1wbGllZC4gIFNlZSBiZWxvdyBm b3IgYSBsaXR0bGUgbW9yZSBkZXRhaWwsIG5vdGluZyBFcmljIGFza2VkIGEgcmVsYXRlZCBxdWVz dGlvbi4gIA0KDQoNCk9uIEZyaSwgQXVnIDE2LCAyMDE5IGF0IDExOjI2IEVyaWMgUmVzY29ybGEg PGVrckBydGZtLmNvbT4gd3JvdGU6DQoNCj4gV2hhdCBkbyB5b3UgYmVsaWV2ZSB0aG9zZSB2dWxu ZXJhYmlsdGllcyB0byBiZT8NCg0KQXMgYW4gZXhhbXBsZSwgc2VlIHRoZSBtZXNzYWdlIHBvc3Rl ZCBvbiAxMnRoIEp1bmUgIkdvb2dsZSdzIERPSChsaWtlKSBiZWluZyB1c2VkIGZvciBldmlsIGFs cmVhZHkiIC0gaHR0cHM6Ly9tYWlsYXJjaGl2ZS5pZXRmLm9yZy9hcmNoL21zZy9hZGQvRGVhVzdX Mk9UYXhUTG16VWpWd0V6bFBTdldVLiAgRG9IIGdpdmVzIGEgaGlkZGVuIHBhdGggZm9yIG1hbHdh cmUgdG8gZXhwbG9pdCAtIGFzIG90aGVycyBoYXZlIG5vdGVkLCB3aGlsc3QgYSBtYWx3YXJlIGRl dmVsb3BlciBjb3VsZCB3cml0ZSB0aGUgY29kZSB0byBkbyBzb21ldGhpbmcgc2ltaWxhciwgRG9I IGdpdmVzIHRoZW0gYSB0b29sIGFuZCBzYXZlcyB0aGVtIHRoZSBlZmZvcnQuICBUaGUgcmVsYXRl ZCB0aHJlYWQgYnJpZWZseSBkaXNjdXNzZXMgc3RlcHMgdGhhdCBjb3VsZCBiZSB0YWtlbiB0byBp bXByb3ZlIHRoaXMuICANCg0KU2VwYXJhdGVseSwgd2l0aG91dCByZWhhc2hpbmcgdG9vIG11Y2gg Z3JvdW5kIGNvdmVyZWQgZWxzZXdoZXJlLCBjb21iaW5pbmcgRG9IIChvciBEb1QpIHdpdGggRE5T U0VDIHdoZXJldmVyIHBvc3NpYmxlIHdvdWxkIHNlZW0gdG8gYmUgYSBzZW5zaWJsZSBzdGVwIGlu IG9yZGVyIHRvIGdpdmUgcmVhc3N1cmFuY2Ugb2YgdGhlIGludGVncml0eSBvZiB0aGUgcmVzcG9u c2UuICBJdCdzIGFsc28gd29ydGggY29uc2lkZXJpbmcgdGhlIGVsZXZhdGlvbiBvZiBETlMgZnJv bSB0aGUgT1MgYW5kIGludG8gdGhlIGFwcCBsYXllciBtYWtlcyBpdCBtb3JlIHZ1bG5lcmFibGUg Z2l2ZW4gdGhlIGFkZGl0aW9uYWwgcHJvdGVjdGlvbnMgYWZmb3JkZWQgdG8gdGhlIE9TIG9uIG1h bnkgZGV2aWNlcy4gIEknbGwgbGVhdmUgb3RoZXJzIHRvIGV4cGFuZCBvbiB0aGlzIGlmIHRoZXkg d2lzaC4gIA0KDQpCeSB0aGUgd2F5LCB0aGVzZSBkbyBub3QgbmVjZXNzYXJpbHkgbWFrZSBEb0gg YmFkIG5vciBzdWdnZXN0IHRoYXQgaXQgc2hvdWxkIGJlIGFiYW5kb25lZC4gIEl0IGlzIGhvd2V2 ZXIgaW1wb3J0YW50IHRvIHJlY29nbmlzZSBpdHMgbGltaXRhdGlvbnMgYW5kIHRyYWRlLW9mZnMs IG90aGVyd2lzZSBwcm9ncmVzcyBjYW5ub3QgYmUgbWFkZS4gIA0KDQoNCkknbGwgcGF1c2UgdGhl cmUgZm9yIG5vdywgY29uc2Npb3VzIG9mIHRoZSB2b2x1bWUgb2YgcmVzcG9uc2VzIGRyb3BwaW5n IGludG8gbWFpbGJveGVzIHRvZGF5LiAgDQo= From nobody Fri Aug 16 05:01:21 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 84B1D12011A for ; Fri, 16 Aug 2019 05:01:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vvt4Li3DWTpS for ; Fri, 16 Aug 2019 05:01:17 -0700 (PDT) Received: from mail-lj1-x231.google.com (mail-lj1-x231.google.com [IPv6:2a00:1450:4864:20::231]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AC5AB12007A for ; Fri, 16 Aug 2019 05:01:16 -0700 (PDT) Received: by mail-lj1-x231.google.com with SMTP id x4so5069663ljj.6 for ; Fri, 16 Aug 2019 05:01:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:to:references:from:message-id:date:user-agent:mime-version :in-reply-to:content-transfer-encoding:content-language; bh=QiVIRhGGQ2ofl6H2yuZllSJ90eOmyJEYNCaR1RWueY4=; b=SxDAilySAwcGLJ24TEZbID5zmUJ1nOv/aegvDwoVAgaspe2RIZ3ixLn+LkuKCLZzqR a9u3U2EKxdntGLjB9E6WOHLL9BuxOehHlTVNWUK6yFMHN2+xW5EdQYk4u0aMc6zjXnX4 EEinwSoApWKWoCLeKBkCMyq2jYUcHAZ65dGhyGRDlz3uuIvs5hidy9/82W5xV98aUHNW eOXJOe5+vkhVc+L21z5++F4lByLrtW69N8goS74Z7I1moszNWR7YEnhWPFy8ffGVHmFb Yd2RJbt38eekzLGnhb6WiJuPcdSW9GrVBAlNaFlo9Zcu46OIT7z+fV5gVYiB/0cnLfNF 2lag== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-transfer-encoding :content-language; bh=QiVIRhGGQ2ofl6H2yuZllSJ90eOmyJEYNCaR1RWueY4=; b=HGxrb4/698ZKfc7KMP7XhTlSWlFF3cbkEbYjgutgLws3q7w+kUCTZ/fX/aXlgj9Zdy HMlmx21AlDNNjHHTT/tMkbEpHzKEbRGfeNCHcluS7gD45QXxCWOnhKYpNfoDt95Wk17S Ru0s6sMFgbaorq6Obda6uOWgJlUnGb0Ho/XppmU/2iPJjwaSNfez0Y7eQ3Lm7658Eg2z 9BIMb3QU8OdIj1KLiFArmDacWQpg7UNWL977nHA9cT3vaTYNszJ+IhteDuCK7Q7yg5VA /0VlvxSmSFlGmnrS4qvSb7hP9lwMul0VsZ19ECPtKaINP1m6vG3f7dt6C49heFvaCZHv NZFA== X-Gm-Message-State: APjAAAW+SPk2MN1ahU8mk0FDM5FGvOUcAevnijWY59DgkjAB8bhMzs9x +k+KW1uwqYVJT/SbN7gR3At+UX9P X-Google-Smtp-Source: APXvYqwUpMV+9cxmiBQddRtBv9LfGiwiKeRKh2ZMVYqk/ztQw6Y+rJPUmyJgI+v4sJ5nxFSM8XYLqw== X-Received: by 2002:a2e:9b0c:: with SMTP id u12mr5324225lji.239.1565956874630; Fri, 16 Aug 2019 05:01:14 -0700 (PDT) Received: from ?IPv6:2001:700:800:0:80d3:55f6:a8df:34eb? ([2001:700:800:0:80d3:55f6:a8df:34eb]) by smtp.googlemail.com with ESMTPSA id k124sm889224lfd.60.2019.08.16.05.01.13 for (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Fri, 16 Aug 2019 05:01:13 -0700 (PDT) To: add@ietf.org References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <8e00891f-2aa2-ee11-559a-b5a8967b22d9@nostrum.com> <2C23D415-84F9-4B6C-B67B-0CC3EB600520@gmail.com> <2704899B-E43D-4978-A3C9-30E9E7CEBEBD@fugue.com> <4CC4C262-BEF4-4B39-ACB1-A595AB66D6CD@gmail.com> <2E35AAFE-5930-4083-BDC4-18B956291E85@open-xchange.com> From: Frode Kileng Message-ID: <850cb5fc-4e21-6251-36cd-69f0a6b8d008@gmail.com> Date: Fri, 16 Aug 2019 14:01:12 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: <2E35AAFE-5930-4083-BDC4-18B956291E85@open-xchange.com> Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Content-Language: en-US Archived-At: Subject: Re: [Add] [Ext] Validity of the "child safety/malware protection" argument X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 12:01:19 -0000 On 16/08/2019 13:00, Neil Cook wrote: > What people choose to use for parental control, internet filtering, > malware protection etc. is up to them, as is their choice in terms of > the level of protection it provides. You are not the arbiter of that. > You are entitled to your opinion of course, but that’s all it is.  DNS > filtering is a valid use-case whether or not it meets your personal > definition of child safety (or malware protection or whatever). So your use case is "Use DNS as filtering mechanism fo provide not child/malware protection", not "provide child/malware protection"? And if so I agree that DoH challenges your use-case..... Best regards Frode From nobody Fri Aug 16 06:17:46 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 089C6120122 for ; Fri, 16 Aug 2019 06:17:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CtF_3ywkKs32 for ; Fri, 16 Aug 2019 06:17:44 -0700 (PDT) Received: from mail-qt1-x82b.google.com (mail-qt1-x82b.google.com [IPv6:2607:f8b0:4864:20::82b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DAF5E1200A1 for ; Fri, 16 Aug 2019 06:17:43 -0700 (PDT) Received: by mail-qt1-x82b.google.com with SMTP id e8so6014817qtp.7 for ; Fri, 16 Aug 2019 06:17:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=content-transfer-encoding:from:mime-version:subject:date:message-id :references:cc:in-reply-to:to; bh=brGD29xZBVIfmViII23LtErFiYhvHjX0GBxL3NPxrk0=; b=QDjM8qrb+uQ3uawb24uPmJ+0DBVwXour/zMuevl1nC1g4XtHj3/1HQU8s9ychQWO+p sqTwEiEZTcxgag9pro77PudGlebtxMSpt1T0G1M9UgiLbg2qpd2aUXkegNIhQXo/KubJ MDQzEhbBnpUfFwBPtnc068MjzEpSR2Yb80RMmMSczyli04ld67fAon+wRYLSurO5YqYv c7sgPu6xwRxcLUOEh9JQLytAt6lCxbFzaWwGGvUD5wTwoPQ2s8y1hJxwf3hDOCYBmrCv YbjRH+Pp09IGkD1faZIXkx1Zoqd1O5ARdk9f24RV1kuRT44fD9uageIzmI5aPDlntvOf 4Bqw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:content-transfer-encoding:from:mime-version :subject:date:message-id:references:cc:in-reply-to:to; bh=brGD29xZBVIfmViII23LtErFiYhvHjX0GBxL3NPxrk0=; b=mVcbRxh0FgRx9uvkXQECgf4Ba2zOOxzsimB0tI1CU+wi7Pa/LDGBRHZhqSjfPF7C+2 SMh7Xdoc1t1c9jfN9KzqhG5Wh/rwo0azYRKl1W/DFWugD8PxGqO3RWOTtPzzMVA+SKtj mk0LOXSdjT0x/79pVPBJtaWVuBGeyyKyc6MhX+eLFHrEB8VHVe6aL9sNxLrRBgeYAf3L 0kQLgmUIbqGWTo66ApL+wqGbmOSdF/GyYdB+7bBQBL6gYsjHTRBn+IDSMVOvGcgyXN8O 14i3Fegs+w0N2Wqgb4N53v3XtbzbWBqS1bRoAmySAZwfzhbHepkjt6hbkvRpWTEQeF7h YVMA== X-Gm-Message-State: APjAAAXFXs+Rvptiaf4dgFavz6gUvRmF/HZmAHIYyGn+lO5tC6i8j2H3 a8zjsM4PN4G33vbzA6wRxiIfiyqiCRBhAQ== X-Google-Smtp-Source: APXvYqwQaHeRJ5Y4RaxeHjk6+fzCudvIkuInm1/5vngCeNMoVIqkrfWLmpIxT/zk3AdvE191iScsOg== X-Received: by 2002:ac8:6890:: with SMTP id m16mr8692867qtq.377.1565961462910; Fri, 16 Aug 2019 06:17:42 -0700 (PDT) Received: from [10.0.100.56] (c-73-186-137-119.hsd1.nh.comcast.net. [73.186.137.119]) by smtp.gmail.com with ESMTPSA id o29sm3131252qtf.19.2019.08.16.06.17.42 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Fri, 16 Aug 2019 06:17:42 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable From: Ted Lemon Mime-Version: 1.0 (1.0) Date: Fri, 16 Aug 2019 09:17:41 -0400 Message-Id: References: Cc: Joe Abley , ADD Mailing list In-Reply-To: To: Andrew Campling X-Mailer: iPhone Mail (17A568) Archived-At: Subject: Re: [Add] Use Cases - the coffee shop: DoH and Authentication X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 13:17:45 -0000 On Aug 16, 2019, at 06:05, Andrew Campling w= rote: >=20 > By itself, DoH does nothing to address the authenticity of a response, whi= ch could still be tampered with elsewhere. Obviously combining DoH (or DoT)= with DNSSEC improves this situation. DoH lets me know that I am talking to the resolver I intended to talk to, wh= ich means that I can reason about whether or not to trust a specific service= provider, rather than just hoping for the best. =20 You are correct that it doesn=E2=80=99t authenticate the data, and I think I= =E2=80=99ve been pretty clear about that in this very conversational thread,= so I=E2=80=99m puzzled to see you bring it up.=20= From nobody Fri Aug 16 06:48:02 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 77A111201DE for ; Fri, 16 Aug 2019 06:48:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fLcB0FWVSxeR for ; Fri, 16 Aug 2019 06:47:58 -0700 (PDT) Received: from mail-lf1-x133.google.com (mail-lf1-x133.google.com [IPv6:2a00:1450:4864:20::133]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5B12E120048 for ; Fri, 16 Aug 2019 06:47:58 -0700 (PDT) Received: by mail-lf1-x133.google.com with SMTP id j17so4110242lfp.3 for ; Fri, 16 Aug 2019 06:47:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=XGMnf1/1cL01B2meiu24snRr1dm25llYqgn09PF4mr0=; b=Lw0DEZUqC+DyODR65Fzcko8I1zw8sQm6s1RQS/BtXzJpJdJk3Upmsw0FB3AKqTsFXl c4+rExxPffmZ8FBF9rZaQiKT/m3JFo1WGk8TkjzIGiCIq1G4jhkF5SMeoOghhsOAD8d3 VGlTugXONUJ3o8NkDnzxfbKVb3nirpb9LLKayxaeVDmjhLypP/5HI9SzgGgGMQm6q248 CpvkPDcN3bzEO6ygXSRIHOOx8i0xTn4V9BC6kGnvmJk81/QI3Wo2PPgMbCCniaFzMdWw vnjjEXSQVCfJVcpTMD0PgwarvNsy/LlMuUmw9/Seh6Jhj5u0V0O1SY7Guggu5ZP13KHA 7weQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=XGMnf1/1cL01B2meiu24snRr1dm25llYqgn09PF4mr0=; b=eSKfaHg1a8mY8KVUPVLwYTQGMaRQ0sRSeuKu2WB8zPjNzcFdvj3ejUINZVOkXXhuF4 +sb3f0kaWRyb05V1K2SWt3PxwDFmyBY2DAfIWDjRR8QLl6e17K/xDyZtOK+gQHJ7QA94 LuK4CndiLGoVAhEIl3smaXkA9c9kggOInbr0yZabHAymLpHAZbxy9NYyQFY6tQ9mWE6A STR+wcH/7sCeYcCQCxhnZIZgmdf9GjFfz1z0arRLV0pUxyOrEgYEy9VjpyebTuuIzZ9g HLTfYAlHSDeP8HCnmiN+omSWhy/79b6WtRlBFV3yEwMeL1EXyII4bEWlYwDfdaScUd69 BNgA== X-Gm-Message-State: APjAAAXS+tFfF9mQqNY05I+PQJzjDz+/8VkfGjz1oqh/btr159r7zyfV Lisw/XEncWpr+f1s29SEyJzkWQ4LZCGixZp5te+/tQ== X-Google-Smtp-Source: APXvYqwIJ652Ok2UolZXzrUgWKpLBqmt4hNwJ7YTieCSC6gL/1gY88KzhXnLCIuOsINagIUW6hM393gepYX5mOLCmZE= X-Received: by 2002:a19:7908:: with SMTP id u8mr5257414lfc.178.1565963276544; Fri, 16 Aug 2019 06:47:56 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Eric Rescorla Date: Fri, 16 Aug 2019 15:47:19 +0200 Message-ID: To: Andrew Campling Cc: Alec Muffett , Ted Lemon , ADD Mailing list , Joe Abley Content-Type: multipart/alternative; boundary="000000000000d4806a05903c3c3b" Archived-At: Subject: Re: [Add] Use Cases - the coffee shop: DoH and Authentication X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 13:48:00 -0000 --000000000000d4806a05903c3c3b Content-Type: text/plain; charset="UTF-8" On Fri, Aug 16, 2019 at 1:28 PM Andrew Campling wrote: > On Fri, 16 Aug 2019, 11:26 Alec Muffett wrote: > > >> Let's not forget that DoH introduces new vulnerabilities within the > client device. > > > And now you're just casting aspersions. > > I'm sorry if you took brevity for the casting of aspersions, the intention > was simply to highlight that the situation was not quite as clear cut as > your earlier post implied. See below for a little more detail, noting Eric > asked a related question. > > > On Fri, Aug 16, 2019 at 11:26 Eric Rescorla wrote: > > > What do you believe those vulnerabilties to be? > > As an example, see the message posted on 12th June "Google's DOH(like) > being used for evil already" - > https://mailarchive.ietf.org/arch/msg/add/DeaW7W2OTaxTLmzUjVwEzlPSvWU. > DoH gives a hidden path for malware to exploit - as others have noted, > whilst a malware developer could write the code to do something similar, > DoH gives them a tool and saves them the effort. The related thread > briefly discusses steps that could be taken to improve this. > I don't think that "introduces new vulnerabilities" is a very accurate characterization of this message. Rather "makes it harder for existing mechanisms designed to counter malware" would be more accurate. OTOH, that's true of encryption in general, and the IETF has, I think, pretty strong consensus that the balance of cost/benefit is on the "encrypt things" side. Separately, without rehashing too much ground covered elsewhere, combining > DoH (or DoT) with DNSSEC wherever possible would seem to be a sensible step > in order to give reassurance of the integrity of the response. Well, we might eventually add DNSSEC to our resolver, but I don't really see that lack of endpoint DNSSEC resolution is any more of a threat with DoH than Do53. To the contrary, because the client is free to select a resolver which it knows validates, the situation with DoH is actually better. > It's also worth considering the elevation of DNS from the OS and into the > app layer makes it more vulnerable given the additional protections > afforded to the OS on many devices. I'll leave others to expand on this if > they wish. > This is too vague for me to form an opinion on one way or the other. -Ekr > By the way, these do not necessarily make DoH bad nor suggest that it > should be abandoned. It is however important to recognise its limitations > and trade-offs, otherwise progress cannot be made. > > > I'll pause there for now, conscious of the volume of responses dropping > into mailboxes today. > --000000000000d4806a05903c3c3b Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Fri, Aug 16, 2019 at 1:28 PM Andre= w Campling <andrew.campling@419.consulting> wrote:
On Fri, 16 Aug 2019, 11:26 Alec Mu= ffett <alec.= muffett@gmail.com> wrote:

>> Let's not forget that DoH introduces new vulnerabilities withi= n the client device.=C2=A0

> And now you're just casting aspersions.

I'm sorry if you took brevity for the casting of aspersions, the intent= ion was simply to highlight that the situation was not quite as clear cut a= s your earlier post implied.=C2=A0 See below for a little more detail, noti= ng Eric asked a related question.=C2=A0


On Fri, Aug 16, 2019 at 11:26 Eric Rescorla <ekr@rtfm.com> wrote:

> What do you believe those vulnerabilties to be?

As an example, see the message posted on 12th June "Google's DOH(l= ike) being used for evil already" - https://mailarchive.ietf.org/arch/msg/add/DeaW7W2OTaxTLmzUjVwEz= lPSvWU.=C2=A0 DoH gives a hidden path for malware to exploit - as other= s have noted, whilst a malware developer could write the code to do somethi= ng similar, DoH gives them a tool and saves them the effort.=C2=A0 The rela= ted thread briefly discusses steps that could be taken to improve this.=C2= =A0

I don't think that "intro= duces new vulnerabilities" is a very accurate characterization of this= message. Rather "makes it harder for existing mechanisms designed to = counter malware" would be more accurate. OTOH, that's true of encr= yption in general, and the IETF has, I think, pretty strong consensus that = the balance of cost/benefit is on the "encrypt things" side.


Separately, without rehashing too much ground covered elsewhere, combining = DoH (or DoT) with DNSSEC wherever possible would seem to be a sensible step= in order to give reassurance of the integrity of the response.=C2=A0

Well, we might eventually add DNSSEC to our reso= lver, but I don't really see that lack of endpoint DNSSEC resolution is= any more of a threat with DoH than Do53. To the contrary, because the clie= nt is free to select a resolver which it knows validates, the situation wit= h DoH is actually better.

=C2=A0
It's also worth considering the = elevation of DNS from the OS and into the app layer makes it more vulnerabl= e given the additional protections afforded to the OS on many devices.=C2= =A0 I'll leave others to expand on this if they wish.=C2=A0

This is too vague for me to form an opinion on on= e way or the other.

-Ekr

<= blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-l= eft:1px solid rgb(204,204,204);padding-left:1ex">
By the way, these do not necessarily make DoH bad nor suggest that it shoul= d be abandoned.=C2=A0 It is however important to recognise its limitations = and trade-offs, otherwise progress cannot be made.=C2=A0


I'll pause there for now, conscious of the volume of responses dropping= into mailboxes today.=C2=A0
--000000000000d4806a05903c3c3b-- From nobody Fri Aug 16 08:12:14 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E6451120288 for ; Fri, 16 Aug 2019 08:12:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nohats.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6sL4j23FAZ03 for ; Fri, 16 Aug 2019 08:12:08 -0700 (PDT) Received: from mx.nohats.ca (mx.nohats.ca [193.110.157.68]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 92FE5120818 for ; Fri, 16 Aug 2019 08:12:08 -0700 (PDT) Received: from localhost (localhost [IPv6:::1]) by mx.nohats.ca (Postfix) with ESMTP id 4696HV0qtjz2fL; Fri, 16 Aug 2019 17:12:06 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nohats.ca; s=default; t=1565968326; bh=udRw+EqHUvaBKalFTF4JZiIQlU5fxFoPvNHOQFLc2ag=; h=Subject:From:In-Reply-To:Date:Cc:References:To; b=lBGuIRuNITAuMUBRAex4uQxY3K6zpSZomyg7E7SxMfXerqpKW4617PZJ2Lpkz5zJM ohxTvtJokGP5Ia4+Zlphsa0S6vr5EbovNVZljYzyHG2MjexnX33NP7Q4R5q6QiFKVl MJ/uuBICvVkdFrhX6kufK6xpz2Gq8Rq3RTq2aIuA= X-Virus-Scanned: amavisd-new at mx.nohats.ca Received: from mx.nohats.ca ([IPv6:::1]) by localhost (mx.nohats.ca [IPv6:::1]) (amavisd-new, port 10024) with ESMTP id KFxCHTsnAUbs; Fri, 16 Aug 2019 17:12:04 +0200 (CEST) Received: from bofh.nohats.ca (bofh.nohats.ca [76.10.157.69]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx.nohats.ca (Postfix) with ESMTPS; Fri, 16 Aug 2019 17:12:04 +0200 (CEST) Received: from [10.168.230.105] (unknown [199.119.233.244]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by bofh.nohats.ca (Postfix) with ESMTPSA id B9E83322DFB; Fri, 16 Aug 2019 11:12:02 -0400 (EDT) DKIM-Filter: OpenDKIM Filter v2.11.0 bofh.nohats.ca B9E83322DFB Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (1.0) From: Paul Wouters X-Mailer: iPhone Mail (16G77) In-Reply-To: Date: Fri, 16 Aug 2019 11:12:00 -0400 Cc: Andrew Campling , ADD Mailing list , Ted Lemon Content-Transfer-Encoding: quoted-printable Message-Id: <52F1411C-7339-45F8-B9E2-70FFE906E2D0@nohats.ca> References: To: Joe Abley Archived-At: Subject: Re: [Add] Use Cases - the coffee shop: DoH and Authentication X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 15:12:12 -0000 On Aug 16, 2019, at 07:03, Joe Abley wrote: >=20 >=20 > DoH has no ambition to provide integrity protection, so the simple > observation of that as a weakness seems a bit bizarre. That we still think of DNS without DNSSEC as a production protocol is one of= IETFs biggest mistakes. We should treat DNS without DNSSEC as an implementa= tion error.. We do that for every single other protocol lacking integrity protection. Paul= From nobody Fri Aug 16 08:13:02 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5C287120288 for ; Fri, 16 Aug 2019 08:13:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mwTNcU57BBDz for ; Fri, 16 Aug 2019 08:12:57 -0700 (PDT) Received: from mail-pf1-x432.google.com (mail-pf1-x432.google.com [IPv6:2607:f8b0:4864:20::432]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B88FF1207FE for ; Fri, 16 Aug 2019 08:12:57 -0700 (PDT) Received: by mail-pf1-x432.google.com with SMTP id 129so3281149pfa.4 for ; Fri, 16 Aug 2019 08:12:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:mime-version:subject:date:references:to:in-reply-to:message-id; bh=/urFfta6WOY73Rq6fqcVxZ02lkDB0T3lRYZmkLQck/U=; b=vM0/iqdIabLwhhN2u3CVh+q1A1vg3oVP/K2A3TtESRwotvO6hElvUxmpJHlxdSHezB C+9wmv0xzkSdfvTDCBiZ5+wDzHzYIG+KcU4zLcxJEuUfi7KVDeqqQ+gB/rC+2CXsSZW1 H+N/9iY6pRoLWLxx2MV5gJnnyVH4vXS/3JiZrDX3P+1Ct5gVGpU+bMfYQNwtXNPY1JUu KRW7LrtRf6HzQ9Vl8s2KsES1RzaDqdqJdN8ObJEU2xTodCIbQOXy6P13U8esTnTNm8ps Xz2YnX4W98KuAlImFKtdk6OnZNtWmprMIpRUH/IxXvCsnCPt1gZN5PhH1ZQtsN2vt/qF EVrQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:mime-version:subject:date:references:to :in-reply-to:message-id; bh=/urFfta6WOY73Rq6fqcVxZ02lkDB0T3lRYZmkLQck/U=; b=dIZ66cXfQQmUEXSvbVMPFB1lMV/TtTFZCkoRX8oiTeZyYB8oCUVrEmNZJbNDcSeZCV 9t3smgV+VKGbgwyJJ0DdddVBIuLXYLA4+9qmnaqc+quhqOlKfUyoO2qs0L6o1pEvSupH GproYxyEk2H7/IQoSWd0yosDsMVQecG6M+H000c7eiO/5/w9nin0gWJ0iuPzKBE7Slx+ DzMejRjqxAZHQBjpj/Mxj58zvXoNoo2muc3TmUL7jydI44oKSoKUIom+UabWiZEsU8yf DmGzI+JLu9xfslUDSiWljwsQ3/AaA2DXCj56ZmI9NjR70KUquPTpo2b0PmUXa71nWdqA pIvw== X-Gm-Message-State: APjAAAXH1EK8Nt85U38OFexUKMAP/W34CPOOiKlsdemAan1aK0lT4d9b 1GOWFkTjLnZrDdRGwurfu84+eJan X-Google-Smtp-Source: APXvYqzZ+gqsF/Dfa+/AbJXc4guqX4RZvuHK/UWURaRIA0rc+EQr3tkQ1LxpUN7G6dxytgBwWM3uSA== X-Received: by 2002:a17:90a:b947:: with SMTP id f7mr7711639pjw.63.1565968376946; Fri, 16 Aug 2019 08:12:56 -0700 (PDT) Received: from [10.128.64.148] ([136.60.227.81]) by smtp.gmail.com with ESMTPSA id f12sm5635750pgo.85.2019.08.16.08.12.55 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 16 Aug 2019 08:12:56 -0700 (PDT) From: Bret Jordan Content-Type: multipart/alternative; boundary="Apple-Mail=_E25310C1-15EA-49C6-85CA-06E6C79F3DA9" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Fri, 16 Aug 2019 09:12:54 -0600 References: To: ADD Mailing list In-Reply-To: Message-Id: X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] When Two Worlds Collide X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 15:13:01 -0000 --Apple-Mail=_E25310C1-15EA-49C6-85CA-06E6C79F3DA9 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 So DoH proponents willfully do not care? =20 Thanks, Bret PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 "Without cryptography vihv vivc ce xhrnrw, however, the only thing that = can not be unscrambled is an egg." > On Aug 15, 2019, at 11:57 AM, Ted Lemon wrote: >=20 > On Aug 15, 2019, at 13:45, Andrew Campling = wrote: >>=20 >> Interestingly I know a number of ISPs that thought some comments, eg = in the material presented at IETF 105, underlined the gulf in = understanding of issues between browser companies and ISPs, clearly = showed that they were talking passed each other. =20 >=20 > I agree that we are taking past each other. But it=E2=80=99s not = because DoH proponents aren=E2=80=99t aware of the problems DoH creates = for network operators.=20 > --=20 > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add --Apple-Mail=_E25310C1-15EA-49C6-85CA-06E6C79F3DA9 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 So = DoH proponents willfully do not care?   

Thanks,
Bret
PGP = Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 = 0050
"Without = cryptography vihv vivc ce xhrnrw, however, the only thing that can not = be unscrambled is an = egg."

On Aug 15, 2019, at 11:57 AM, Ted Lemon <mellon@fugue.com> = wrote:

On Aug 15, 2019, at 13:45, Andrew Campling <andrew.campling@419.consulting> wrote:

Interestingly I know a number of ISPs that thought some = comments, eg in the material presented at IETF 105, underlined the gulf = in understanding of issues between browser companies and ISPs, clearly = showed that they were talking passed each other.  

I agree that we are taking =  past each other.  But it=E2=80=99s not because DoH proponents = aren=E2=80=99t aware of the problems DoH creates for network operators. =
--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add

= --Apple-Mail=_E25310C1-15EA-49C6-85CA-06E6C79F3DA9-- From nobody Fri Aug 16 08:25:53 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8AD0B120832 for ; Fri, 16 Aug 2019 08:25:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NMnH0HQEQzyH for ; Fri, 16 Aug 2019 08:25:37 -0700 (PDT) Received: from mail-yw1-xc35.google.com (mail-yw1-xc35.google.com [IPv6:2607:f8b0:4864:20::c35]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D60821201DE for ; Fri, 16 Aug 2019 08:25:36 -0700 (PDT) Received: by mail-yw1-xc35.google.com with SMTP id f187so1904335ywa.5 for ; Fri, 16 Aug 2019 08:25:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=2TAlGvZ9d2KyvnWxlQsPl1aVYAp3h8iB5fjAVbtjFS0=; b=sbq4pNZfoPNx6btHeQ0AtOvNdFtjZ4v+IbC2WXJzdu4Ivfcv8rmfzSxHqhJ6U6KnwY HzUrGhL3yFbveny5NkGIsLjKq4XP4EQhmQLDr8Bknis4alW4Zfo40+xPrBSxQegUTYR6 /4PVtzFp4uiVZY+Dd8bH+Q+756uDwjd5zIILY5E+Yfyv5zQt+DkZ+oSFuojA1El6W97D T2fbpV99vMCDyF7UJ3GWFVsHmdbcBQdQ5eD3DOeqvsdAIWjN9/GZfXxOgqstNnonHL11 UHY7bg54ME3aK9ADC64Qln+IVXUo6TnXQ/KAE9jd2ScwpqD1r7xX8AUO3rANV1VQ6OwG 5ZNg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=2TAlGvZ9d2KyvnWxlQsPl1aVYAp3h8iB5fjAVbtjFS0=; b=MhWrGUbo7Jl/7eMeaVceYCcvc+lK8FPDCqDfHhc9at4CZcrx9RtNt2xIYGStk3o5ua bTg6Rt58S0dIZxPt8NZCH2yH1qAAC/2/CFIPvO6h4MH7XP0OuyH3LBNpercXUgb37avS 11Hc+vjll/Fe9mKLntmilw7mRfeNBY6+zulA7B0STsUqoa8Qx9Jymkxj96D69i8S2mM3 hPrlYU6j8k61W5CJ8n9Z3a8hn53I261nCPzG0C1bXlyzS1316wdaZ327/NIt+Opf7YBD f1LfJQR0nTxK518H/0F7/S+fbXDmvJroFBMZcIy8n+l4zmpBduLA+e5xzbYO51dpilCw KyIw== X-Gm-Message-State: APjAAAUOcQGjbMYarFqTTVNtKT4K6lJNteLuyl0759QyaXzO+o5laaZk 6o2AJS8a3FW+84nIAOQNc7XrJdcs1kQteXFI7sKQkQ== X-Google-Smtp-Source: APXvYqw+yrc3ymIpzIZBjhMPvrX+BHbdzfdLaV4anF3mDIESz5IXSZO27nnYEbK+88O8RK4QzOht1oI7NvFinSMCg+E= X-Received: by 2002:a0d:e885:: with SMTP id r127mr7357833ywe.7.1565969135791; Fri, 16 Aug 2019 08:25:35 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Alec Muffett Date: Fri, 16 Aug 2019 16:25:24 +0100 Message-ID: To: Bret Jordan Cc: ADD Mailing list Content-Type: multipart/alternative; boundary="00000000000011724d05903d9a95" Archived-At: Subject: Re: [Add] When Two Worlds Collide X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 15:25:52 -0000 --00000000000011724d05903d9a95 Content-Type: text/plain; charset="UTF-8" On Fri, 16 Aug 2019, 16:13 Bret Jordan, wrote: So DoH proponents willfully do not care? > I would characterise my position as: having considered the cost-benefit analysis, DNS over HTTPS wins. It's that simple. I care, but not so much as I care about the benefits that I expect DoH to provide. -a --00000000000011724d05903d9a95 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


On Fri, 16 Aug 2019, 16:13 Bret Jordan, <jordan.ietf@gmail.com> wrote:

So D= oH proponents willfully do not care?=C2=A0 =C2=A0
<= /div>

I would characterise my = position as: having considered the cost-benefit analysis, DNS over HTTPS wi= ns.

It's that simple= . I care, but not so much as I care about the benefits that I expect DoH to= provide.

-a


--00000000000011724d05903d9a95-- From nobody Fri Aug 16 08:34:23 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B78F112080E for ; Fri, 16 Aug 2019 08:34:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id j3h8amSIXySM for ; Fri, 16 Aug 2019 08:34:20 -0700 (PDT) Received: from mail-qt1-x82c.google.com (mail-qt1-x82c.google.com [IPv6:2607:f8b0:4864:20::82c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2FABB12029C for ; Fri, 16 Aug 2019 08:34:20 -0700 (PDT) Received: by mail-qt1-x82c.google.com with SMTP id x4so6513046qts.5 for ; Fri, 16 Aug 2019 08:34:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=content-transfer-encoding:from:mime-version:subject:date:message-id :references:cc:in-reply-to:to; bh=w9IZn/6Tu7FkUO9qpd1P0JVZA/pZTMVUo6V/K3DL+Bs=; b=SuM2UEapdyvTIezU9UmI69v5AOYCHl/m4QQ3F/Kb4tNMIQEPT7dDHhs7XbKih0BL7k iWMtSmemntDQwhNjP2ZJw9lGcWeSISMscisb5omieaNG5achuP4aUNSqpD8b6IZVaF1x ltckwQMga73gVa3uW/qTuDGfSB/IkRXf4tDjhqja6uGaGBZ6ggsAQytCSMBehg5FjG6c IGNOTUk+w2lze4ivXQnCDFOK954gHpI8xavhaiE/SqrISGe5xuwXkImuoWMgifF+9kCm sPl+DcMM2scIFcPZFpkWJsibpb4CGkBkbKjK8OOOjmvbbbUjdcqMaPJX86nnS5/rYKGv 3qkQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:content-transfer-encoding:from:mime-version :subject:date:message-id:references:cc:in-reply-to:to; bh=w9IZn/6Tu7FkUO9qpd1P0JVZA/pZTMVUo6V/K3DL+Bs=; b=kpI2o7pybM1HpytTlSVEg/oUodDV20RKXhoKiW08Sv8fkfkqeVQpIsGMzTqaq+rlMW EJOJyRUUpU6xX1yinwnNalOHdIE/GUYY6ABJ5MHRHjGKVAjkwhJpbIbteItQBOgCDZ5l 20OHbqCL2mu7v3BsxUhqcUuQ9KGjFX2I91fXsERov0nuFYJIVMLzgrp3YF9nMqiUmdTF 2eQDNxs/NQXu/wlFCcXObZZE3Y3YJKKckcrjO0MoGsbxCQhg4AmwNRTiz5sAFbkj9gQI aO57hXmCH7D30XcvF91fp5GQGAq7PP4J+T5mdLEupDfaj12ITaaUZSo4vWilhCokZpAO Naqg== X-Gm-Message-State: APjAAAXuQfHF8Klh90o5vaHDWhu1+tX7DPgqEqEoohzL85nPHdi9W+PM 37s6V+u+3gXfwye4BNLpDwAQUJfrghVNqA== X-Google-Smtp-Source: APXvYqwBbiWrWHC9PnnuiuVfd/zq9EWJYYasoC4Ia4a9b3f62fiVZMsNEcFjJXr/uX6EZmTy+m11qg== X-Received: by 2002:aed:2c84:: with SMTP id g4mr9457748qtd.344.1565969659074; Fri, 16 Aug 2019 08:34:19 -0700 (PDT) Received: from [10.0.100.56] (c-73-186-137-119.hsd1.nh.comcast.net. [73.186.137.119]) by smtp.gmail.com with ESMTPSA id m194sm3084814qke.123.2019.08.16.08.34.18 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Fri, 16 Aug 2019 08:34:18 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable From: Ted Lemon Mime-Version: 1.0 (1.0) Date: Fri, 16 Aug 2019 11:34:17 -0400 Message-Id: <4B746D69-A673-4B8A-A88D-7F0D070971D5@fugue.com> References: Cc: ADD Mailing list In-Reply-To: To: Bret Jordan X-Mailer: iPhone Mail (17A568) Archived-At: Subject: Re: [Add] When Two Worlds Collide X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 15:34:22 -0000 On Aug 16, 2019, at 11:13, Bret Jordan wrote: >=20 > So DoH proponents willfully do not care? =20 Incorrect. I can=E2=80=99t speak for others, but to me it=E2=80=99s a situat= ion where we have to choose. And the choice is very clear. But that does no= t mean that we aren=E2=80=99t aware that we are making a choice, not does it= mean that we aren=E2=80=99t aware of the downsides of the option we feel is= the best choice.=20 If we were talking about how to mitigate the problems, you would see me tryi= ng to help with that. Instead we are talking about which of two options to c= hoose, when the choice has already been made.=20= From nobody Fri Aug 16 08:56:26 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0271C12080A for ; Fri, 16 Aug 2019 08:56:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZeNfutYUDjiV for ; Fri, 16 Aug 2019 08:56:19 -0700 (PDT) Received: from mail-pg1-x532.google.com (mail-pg1-x532.google.com [IPv6:2607:f8b0:4864:20::532]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4A2491207FC for ; Fri, 16 Aug 2019 08:56:19 -0700 (PDT) Received: by mail-pg1-x532.google.com with SMTP id n190so3162804pgn.0 for ; Fri, 16 Aug 2019 08:56:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:mime-version:subject:date:references:to:in-reply-to:message-id; bh=JesB54o7XAhHrI7R0rpBxjVljK7y3IaNlO+RAchDcoI=; b=hdDRHH3dW2vZdr4MoRI2jF10zHin7u5iWKSIkoxDdisCntuzgWkafEXHgr+4aLNJ7F uAYobrgTUDTXScTTwfGVjIYx0h4L02tOrsZXgofjB2fjt6E4ZYAf7KSoThiJsL5eDdys FKLD63v/r9PbUZKhSV4qc0wTmElJZubFJYljz7nElCVu+ksg5EFu0pUPrFJazg5Ztq00 pBq4O6bWO30BT56OA9lsleRwGouZlRaoFPNiMV/9OTN/vdPEgwIfq7A2rV/v3pKxFNz4 YMdemA1VEL0MNR40boh04npi0LlUP+77meIEyqoiR5E+w4ySmJghJC91MQU5ZwUBlOeb iWig== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:mime-version:subject:date:references:to :in-reply-to:message-id; bh=JesB54o7XAhHrI7R0rpBxjVljK7y3IaNlO+RAchDcoI=; b=BrlKTIuhZsh6mxK9ju5kGZ8bdxiGVAwAMxYWu7wfQD7V5wiS5JUwdCFSvsROyBOc5J dNQt1+ePFwRrBPm0jMrMTo9Bks0mZ2iLcNPK7eSfkeI1014oVPmXGTFKXeMqmCacgG4e 2hIntPK+m5W2wHvZDmKsjY6OsU5RvqA0e1uYEhlycOXBETauvOt4qLUOPkloSliK4pve GYvIa4+oPvXTCLLTmdfIIGapBJZ7JiYotH64Q9nR+JeZTFz2LjOh5SEqinRdc6oGlmvU bogCmSlT32ptyKsX8xOFXEW74uVeTWXKoc9EqEdSgeOHe9gdBgv1dcGxX47ngZmSwEO9 DbIw== X-Gm-Message-State: APjAAAXCsivJ7W/7v7x5WLNiY/WZtJ9wy0dmwwdqvZ7CrrBbfsbP97KT nrSoh75YBrDqEV8KEdFM28lUyNy6 X-Google-Smtp-Source: APXvYqwG5/fnXaL13Kt9BsqAMHb/D650xdXohNokqTqj56RG0C/NFmluFJ/7hW6yEqVIm/2eyrOAEQ== X-Received: by 2002:a63:1045:: with SMTP id 5mr8303768pgq.165.1565970977483; Fri, 16 Aug 2019 08:56:17 -0700 (PDT) Received: from [10.128.64.148] ([136.60.227.81]) by smtp.gmail.com with ESMTPSA id y14sm13032285pfq.85.2019.08.16.08.56.16 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 16 Aug 2019 08:56:16 -0700 (PDT) From: Bret Jordan Content-Type: multipart/alternative; boundary="Apple-Mail=_14F3DBC1-FA96-484B-A7FD-083DB792C93B" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Fri, 16 Aug 2019 09:56:15 -0600 References: <400b774a-5bd0-d6f4-5640-e561f067a9b5@cs.tcd.ie> <74A2E5E0-02CE-4C9D-A66B-1D2FBC65B39A@frobbit.se> <3611F27A-49A9-4159-A683-3BBD4C2F91EA@frobbit.se> <904F4219-8BDE-4272-BFDA-20F38D58CB80@frobbit.se> <85CF7EE9-51B8-4431-BCE5-7EA2B9AAF892@frobbit.se> To: ADD Mailing list In-Reply-To: Message-Id: X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] Use Cases - the coffee shop X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 15:56:22 -0000 --Apple-Mail=_14F3DBC1-FA96-484B-A7FD-083DB792C93B Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 So you are asking users to just trust you and your application? Because = you know what is best for them in all situations and conditions?=20 Thanks, Bret PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 "Without cryptography vihv vivc ce xhrnrw, however, the only thing that = can not be unscrambled is an egg." > On Aug 16, 2019, at 4:24 AM, Eric Rescorla wrote: >=20 >=20 >=20 > On Fri, Aug 16, 2019 at 9:38 AM Patrik F=C3=A4ltstr=C3=B6m = > = wrote: > On 16 Aug 2019, at 9:25, Alec Muffett wrote: >=20 > > On Fri, 16 Aug 2019, 08:09 Patrik F=C3=A4ltstr=C3=B6m, = > wrote: > > > >> The legislator just do not care. Its the access provider that is = nervous > >> over some DoH arguments. > > > > On those I believe that we agree; where we differ is whether = everyone > > else's privacy should continue to suffer, and whether pursuit of > > technologically easier, better privacy and integrity ever should be = chilled > > or diverted in order to consider this "nervousness". >=20 > I do not see what end users privacy have to do with this. >=20 > The end users privacy: >=20 > 1. Can be protected via encrypted transport >=20 > 2. Can always be violated at the end point of the encrypted transport >=20 > You seems to have a claim that having the end point in a different = jurisdiction than the end user and at an entity that the end user do not = have explicit contractual agreements with, is better privacy? >=20 > I don't know what Alec's claim is, but my claim is that when the user = gets their resolver from the network, they have no real way of = understanding what the privacy behavior of that resolver is: in many = cases (public WiFi, etc.) they have no relationship at all with the = provider, and even when it's an ISP, the privacy policies are opaque and = there is a fairly long history of bad behavior. The intent of TRR is = that the application provider is able to negotiate for and assure an = acceptable privacy policy on the user's behalf. >=20 > -Ekr >=20 > --=20 > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add --Apple-Mail=_14F3DBC1-FA96-484B-A7FD-083DB792C93B Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 So = you are asking users to just trust you and your application? =  Because you know what is best for them in all situations and = conditions? 


Thanks,
Bret
PGP = Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 = 0050
"Without = cryptography vihv vivc ce xhrnrw, however, the only thing that can not = be unscrambled is an = egg."

On Aug 16, 2019, at 4:24 AM, Eric Rescorla <ekr@rtfm.com> = wrote:



On Fri, Aug 16, 2019 at 9:38 AM Patrik = F=C3=A4ltstr=C3=B6m <paf=3D40frobbit.se@dmarc.ietf.org> wrote:
On 16 Aug 2019, at 9:25, Alec Muffett = wrote:

> On Fri, 16 Aug 2019, 08:09 Patrik F=C3=A4ltstr=C3=B6m, <paf@frobbit.se> wrote:
>
>> The legislator just do not care. Its the access provider that = is nervous
>> over some DoH arguments.
>
> On those I believe that we agree; where we differ is whether = everyone
> else's privacy should continue to suffer, and whether pursuit of
> technologically easier, better privacy and integrity ever should be = chilled
> or diverted in order to consider this "nervousness".

I do not see what end users privacy have to do with this.

The end users privacy:

1. Can be protected via encrypted transport

2. Can always be violated at the end point of the encrypted transport

You seems to have a claim that having the end point in a different = jurisdiction than the end user and at an entity that the end user do not = have explicit contractual agreements with, is better privacy?

I don't know what Alec's claim is, but my claim is that when = the user gets their resolver from the network, they have no real way of = understanding what the privacy behavior of that resolver is: in many = cases (public WiFi, etc.) they have no relationship at all with the = provider, and even when it's an ISP, the privacy policies are opaque and = there is a fairly long history of bad behavior. The intent of TRR is = that the application provider is able to negotiate for and assure an = acceptable privacy policy on the user's behalf.

-Ekr

--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add

= --Apple-Mail=_14F3DBC1-FA96-484B-A7FD-083DB792C93B-- From nobody Fri Aug 16 08:59:02 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0221412081D for ; Fri, 16 Aug 2019 08:58:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1llrStBUNddb for ; Fri, 16 Aug 2019 08:58:48 -0700 (PDT) Received: from mail-pf1-x442.google.com (mail-pf1-x442.google.com [IPv6:2607:f8b0:4864:20::442]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 10EA012083C for ; Fri, 16 Aug 2019 08:58:48 -0700 (PDT) Received: by mail-pf1-x442.google.com with SMTP id g2so3356279pfq.0 for ; Fri, 16 Aug 2019 08:58:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=7TOjCHpLCw7naxZScfEw5A/dogQa/PDvoJzNEzkj5yA=; b=XvDXa0jvUvtDpzprdB4HAuq//oin//G46ilnNtGwaKHwEKYTJKWkwyWIi+pp/2yFuN +krLKN21vQmWRZvbgGli7SCka4iEw7ZZbcAon4L0dTf1RLdJaWtP/tKJaHc6lpMwwF0j rkTbqiKogN0HqIXCD0xpAFO1BnLUpahWIMcnIMwVm68Lizkjj79Pt2O0s+amXO/249DL L6pzsoVZd5KPAyrbuyZOGLEfARnjRMxxcWQA0gjLIkTzQ2Q9pvdqO2nOPoJdnIrnwaOq HIkEa8vUJF/WbHMcnJDzCnBgEcBAHXjpyGWqZXhtZV1BXYXg1YRmEhoNw6KXMcHw/2tO FaKQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=7TOjCHpLCw7naxZScfEw5A/dogQa/PDvoJzNEzkj5yA=; b=cmRF3WHKMnHgsSEnLi8dcGok55UUi+HGQyUJtdHJ+SPX43p6mdUm0IMR+yG2lHzTqP xneMg92TTYf66494v3xbdCD/5OgtEarLhSW1ezX34NCQ3Wngcvt0vj3MNl7TJhtuwEOh Khlr69gNW5QDi65/Ph3/RIDpYSajzo8v7lRdVvDwJuFf7vTcoGA1i5xMyvk4A0zq+ned 5Xam/qJacrVUMWJiuorSn1Uj/Mnyz2CFMT5s2IEuIu/GHjOWuY7fmANE0FTtHl0gdXKZ uMJAUOyb24wxxeAsc0yr5sI1DEwjx4B7NDah6NnitBpjrPDThJEYsYEFtwj8mH/dbUOg nTrA== X-Gm-Message-State: APjAAAW5pMF+woQXwdlp7U+9c91Pup6dmwrcPSPYwpSnUN8ator4QUUt Ef8Jv6YtLwfYHz0JRww6LClfIAd7 X-Google-Smtp-Source: APXvYqziDsrcvkuxOhbRmqTXIHTv8QziK3fWV+v+zpWzevwOz0NrjmpheRorw9jvTJ5xt+oNNKqPoQ== X-Received: by 2002:a17:90a:25ea:: with SMTP id k97mr1359357pje.131.1565971127601; Fri, 16 Aug 2019 08:58:47 -0700 (PDT) Received: from [10.128.64.148] ([136.60.227.81]) by smtp.gmail.com with ESMTPSA id q4sm11395363pff.183.2019.08.16.08.58.46 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 16 Aug 2019 08:58:46 -0700 (PDT) From: Bret Jordan Message-Id: <79AB46BC-7B8E-48A5-AB35-906329C552EC@gmail.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_783CA02B-8BB5-47AA-B1E4-2A441899E31C" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Fri, 16 Aug 2019 09:58:45 -0600 In-Reply-To: <4B746D69-A673-4B8A-A88D-7F0D070971D5@fugue.com> Cc: ADD Mailing list To: Ted Lemon References: <4B746D69-A673-4B8A-A88D-7F0D070971D5@fugue.com> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] When Two Worlds Collide X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 15:58:55 -0000 --Apple-Mail=_783CA02B-8BB5-47AA-B1E4-2A441899E31C Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 The problem is you are trying to make a choice for everyone, assuming = that you know what is best for everyone under every situations and = condition. That sounds like a country that I do not want to visit.=20 Thanks, Bret PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 "Without cryptography vihv vivc ce xhrnrw, however, the only thing that = can not be unscrambled is an egg." > On Aug 16, 2019, at 9:34 AM, Ted Lemon wrote: >=20 > On Aug 16, 2019, at 11:13, Bret Jordan wrote: >>=20 >> So DoH proponents willfully do not care? =20 >=20 > Incorrect. I can=E2=80=99t speak for others, but to me it=E2=80=99s a = situation where we have to choose. And the choice is very clear. But = that does not mean that we aren=E2=80=99t aware that we are making a = choice, not does it mean that we aren=E2=80=99t aware of the downsides = of the option we feel is the best choice.=20 >=20 > If we were talking about how to mitigate the problems, you would see = me trying to help with that. Instead we are talking about which of two = options to choose, when the choice has already been made. --Apple-Mail=_783CA02B-8BB5-47AA-B1E4-2A441899E31C Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 The = problem is you are trying to make a choice for everyone, assuming that = you know what is best for everyone under every situations and condition. =  That sounds like a country that I do not want to visit. 


Thanks,
Bret
PGP = Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 = 0050
"Without = cryptography vihv vivc ce xhrnrw, however, the only thing that can not = be unscrambled is an = egg."

On Aug 16, 2019, at 9:34 AM, Ted Lemon <mellon@fugue.com> = wrote:

On Aug 16, 2019, at 11:13, Bret Jordan <jordan.ietf@gmail.com> wrote:

So DoH proponents willfully do = not care?   

Incorrect. I can=E2=80=99t speak for others, but to me it=E2=80= =99s a situation where we have to choose.  And the choice is very = clear. But that does not mean that we aren=E2=80=99t aware that we are = making a choice, not does it mean that we aren=E2=80=99t aware of the = downsides of the option we feel is the best choice.

If we were talking about how to mitigate the problems, you = would see me trying to help with that. Instead we are talking about = which of two options to choose, when the choice has already been made. =

= --Apple-Mail=_783CA02B-8BB5-47AA-B1E4-2A441899E31C-- From nobody Fri Aug 16 09:08:52 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6FD041202A0 for ; Fri, 16 Aug 2019 09:08:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id q7zp8JTJSEph for ; Fri, 16 Aug 2019 09:08:49 -0700 (PDT) Received: from mail-vk1-xa31.google.com (mail-vk1-xa31.google.com [IPv6:2607:f8b0:4864:20::a31]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 30CD712008D for ; Fri, 16 Aug 2019 09:08:49 -0700 (PDT) Received: by mail-vk1-xa31.google.com with SMTP id 130so1172387vkn.9 for ; Fri, 16 Aug 2019 09:08:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=VxE1dYHRSmODhvD6OBf/F7O27qyqU0q86ONa7VKE+JM=; b=dKjOPfnAJXHFRE0ASuBg6NPxc4rVeSWOlzPaFMek/dVKDEP3ycsJaol10L6y9oXJrv qsWt+RifWXcfiW+2tiajLYotliT7B5yyYCkxQHQAiYbNda4xD9dluiuu+D+EDlRDhOjd x6WfqWGUYP/0TKYIOH6RHbX2LQoIuhEkQJlZVDK2qgRPAT50E2mScC4y309+9xJM0gdx xwzyYCF/4Dm7RQt61Nt2cINgZSCpiWBdGhtfL/sAz3Yj2byxlUlcJ1G8hfrPskkVWhFk CxnDus5ZJ2JAGXEKcU51WivQtHm66mxIDwbiBWf8LYfSYU4E1zJ4QaxWevlIjEOS6B+K rnCQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=VxE1dYHRSmODhvD6OBf/F7O27qyqU0q86ONa7VKE+JM=; b=lQPvCJajIC/tj0toJ34uEfJkOodS3Rzu4UTnakLmN8OxOGmEVRq0Gc3YzXMJy9D+Cw PS3mWrXrmwFvCr9b4t2HEt28UZZ6GugyJh+bPyj2HlhGMhvF2QRPd4UH8cd6RZWPArdb 7hC/0d4FHMjSZvr04zh/zsb+inVuHZrrJ3E3fAA/EjXfL5EI8t+Wrx4KdyXG32w0LeYH 8GeZr8tTNmRu7qjVoan+3CwQ1IV69cfuqXC6eltM2xBXIyoiYZqSSsEHU/dXzNnTjnS2 6Ke3GHA1J7VDetQjlcNazcEe4qG7AyYw0lGTRFzNSyn0EgNPiYov0/V1L1j519aQaPiJ uccg== X-Gm-Message-State: APjAAAUEaE4iRAD3G4ewN1jnjH0I1ae5kDqE2N9CCeFF0Y/kdfqelF65 JQywtNgL4MQwyRf5tT6c0ykMAA4cW3qW3am03BR4+g== X-Google-Smtp-Source: APXvYqwF/FbWKXZVFkjgYJu5TdixTkEhDXyqC1PdJ6IZNtYu9Odmtj0BtEreezHWJGcVJA606MxRZGfbb44g42jAdpY= X-Received: by 2002:a1f:4588:: with SMTP id s130mr154705vka.58.1565971727968; Fri, 16 Aug 2019 09:08:47 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Brian Dickson Date: Fri, 16 Aug 2019 12:08:25 -0400 Message-ID: To: Andrew Campling Cc: ADD Mailing list Content-Type: multipart/alternative; boundary="00000000000092f08b05903e34fe" Archived-At: Subject: Re: [Add] When Two Worlds Collide X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 16:08:52 -0000 --00000000000092f08b05903e34fe Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Thu, Aug 15, 2019 at 10:55 AM Andrew Campling wrote: > Some of the more recent discussions (eg on the validity of the network > administrator role) have made it clear to me that there are fundamental > differences in world view between: (i) the one hand, network operators / > ISPs and others in that ecosystem; and (ii) browser companies / other > applications developers. These differences make it hard if not impossibl= e > to reach a mutual understanding of the potential problems and solutions. > Trying to bridge such differences via email is difficult if not impossibl= e, > as are time constraints at IETF events. > > (NB To be clear, I=E2=80=99m not suggesting that the above is either an o= riginal > or revolutionary observation!) > > With that in mind, would others from each of these two communities see > value in taking time for a more structured discussion in a workshop forma= t, > either face-to-face or virtually, to set out the challenges and benefits > posed by DoH (and possibly also DoT etc if useful)? My hypothesis is tha= t > a better understanding of the perspective of both communities would > simplify discussions here, and at the very least help to focus minds on > what the real issues are from the other=E2=80=99s perspective. This may = in terms > speed our path towards solutions. > > Do you agree with the above analysis and, if so, would you see value in > taking part in such a workshop? By all means email me directly on this i= f > you prefer not to clog up the mail reflector. > > The discussions yesterday on various subjects were IMO helpful in determining corner cases and available mechanisms. I think this ends up reducing to two separate sets of use cases which may require different treatment. I also believe both of those use cases are in need of further work, but I think the work on those can probably "fork" without too much loss of shared benefits. I.e. IMO they are different enough that trying to force a single solution onto both won't work. The way I'd separate the use cases is: 1. Unmanaged devices on partially managed networks which are not trusted (home networks, guest networks at enterprises, coffee shops, etc.) 2. Managed devices on managed networks (the proper enterprise case, plus analogous environments with stricter controls from the operator, such as Paul Vixie's home network.) The root of the 2nd problem's issues have to do with some of the assumptions built into things like split-brain DNS, filtered DNS, etc. Those basically require that there be a single entry point into resolution (single semantically at least, but possibly not physically). There are other problems with having the applications' configurations exposed to users, and with applications having possibly diverging DNS world-views. The 1st problem's issues are smaller in scope, and generally relate to filtering. I have a few ideas there, and I think those would benefit from Andrew's suggestion of workshop(s). My expectation is that some of the 1st problem's work may lead to additional requirements for DoH/DoT to support those. I also expect that these potential additions will add to, rather than subtract from, the privacy support, while preserving the specific benefits of (and in some cases, requirements for) user protection via DNS filtering. Brian --00000000000092f08b05903e34fe Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Thu, Aug 15, 2019 at 10:55 AM Andr= ew Campling <andrew.campling@419.consulting> wrote:
Some of the more recent discussions (eg on the validity of the network= administrator role) have made it clear to me that there are fundamental di= fferences in world view between:=C2=A0 (i) the one hand, network operators = / ISPs and others in that ecosystem; and (ii) browser companies / other applications developers.=C2=A0 These dif= ferences make it hard if not impossible to reach a mutual understanding of = the potential problems and solutions.=C2=A0 Trying to bridge such differenc= es via email is difficult if not impossible, as are time constraints at IETF events.
=C2=A0
(NB To be clear, I=E2=80=99m not suggesting that the above is either a= n original or revolutionary observation!)
=C2=A0
With that in mind, would others from each of these two communities see= value in taking time for a more structured discussion in a workshop format= , either face-to-face or virtually, to set out the challenges and benefits = posed by DoH (and possibly also DoT etc if useful)?=C2=A0 My hypothesis is that a better understanding of t= he perspective of both communities would simplify discussions here, and at = the very least help to focus minds on what the real issues are from the oth= er=E2=80=99s perspective.=C2=A0 This may in terms speed our path towards solutions.=C2=A0
=C2=A0
Do you agree with the above analysis and, if so, would you see value i= n taking part in such a workshop?=C2=A0 By all means email me directly on t= his if you prefer not to clog up the mail reflector.=C2=A0
=C2=A0

The discussions ye= sterday on various subjects were IMO helpful in determining corner cases an= d available mechanisms.

I think this ends up reduc= ing to two separate sets of use cases which may require different treatment= .

I also believe both of those use cases are in ne= ed of further work, but I think the work on those can probably "fork&q= uot; without too much loss of shared benefits. I.e. IMO they are different = enough that trying to force a single solution onto both won't work.

The way I'd separate the use cases is:
=
  1. Unmanaged devices on partially managed networks which are not trust= ed (home networks, guest networks at enterprises, coffee shops, etc.)
    2. <= li>Managed devices on managed networks (the proper enterprise case, plus an= alogous environments with stricter controls from the operator, such as Paul= Vixie's home network.)
The root of the 2nd problem's= issues have to do with some of the assumptions built into things like spli= t-brain DNS, filtered DNS, etc. Those basically require that there be a sin= gle entry point into resolution (single semantically at least, but possibly= not physically). There are other problems with having the applications'= ; configurations exposed to users, and with applications=C2=A0 having possi= bly diverging DNS world-views.=C2=A0

The 1st= problem's issues are smaller in scope, and generally relate to filteri= ng. I have a few ideas there, and I think those would benefit from Andrew&#= 39;s suggestion of workshop(s).

My expectation is = that some of the 1st problem's work may lead to additional requirements= for DoH/DoT to support those.

I also expect that = these potential additions will add to, rather than subtract from, the priva= cy support, while preserving the specific benefits of (and in some cases, r= equirements for) user protection via DNS filtering.

Brian


=C2=A0
--00000000000092f08b05903e34fe-- From nobody Fri Aug 16 09:16:11 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 139D412080E for ; Fri, 16 Aug 2019 09:16:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pxLlHJXrgk-u for ; Fri, 16 Aug 2019 09:16:08 -0700 (PDT) Received: from mail-qk1-x72d.google.com (mail-qk1-x72d.google.com [IPv6:2607:f8b0:4864:20::72d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6548D12029C for ; Fri, 16 Aug 2019 09:16:08 -0700 (PDT) Received: by mail-qk1-x72d.google.com with SMTP id r21so5203812qke.2 for ; Fri, 16 Aug 2019 09:16:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=E11bfhgbqmiJSdZXayE2rZyay7zNXG/68GUMCIoUEhg=; b=1JAohrBetvFjjycwskMstDHtXifw0aagyQJTf8H6NOu+8VYvw+J8SBjt45YamB1rOz OUOqXKCbgrigpmkvZKJo4zs5LFPHPyuzfKEkFPDjdu6AKNpFcdgOXKiTWEkEYlTd4f5E Azlhb/I7rn94M+vSdKZv7WI9q2ayij4/8/VyPckmHPOpPti8LrKlMFjsMtHdxEKXAiUw yJEpwbedVX8fxBD7wHqPiNs50523hPXOPHw1s4xAgvCnMcPwIEr3Ukk+5S1QY5fx877h EHz0Ka4oM9HN/fkIKksbtapSwG4TMlDOJ3+IsjSu+VK91POH2BxHNlnUK3JIsV/gF1IE wpeg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=E11bfhgbqmiJSdZXayE2rZyay7zNXG/68GUMCIoUEhg=; b=bj/mn2Zyr8J8blatss1C4WOXS7I3QvCPBCD1Wozdg5lpL7SkmBSHpON8g/ut51AFP2 16TP4TRyrjx1M1h6PBmFBHWucJxWH323ScfbpQ8qj9t7i4Ulf3XlFFXR6vXQHJTR+U9e ql7fPAkYmUCxsh46EmfL/9an3OjqEwlG/OV9U/WCsWyMXiFMuLPHYlsYDOz1NHv+n4H0 GeB1W+8xzgR8qS3RFp2I7fbSNW522K0HfV8AHaJ0xth0QXoZV4WDYKLq75W5MnJrxa5m y5Rctvi2T3Qe0oDbjrCsPx1HrFs9tKNHa25eHw9X4PGzraDrP8JVRTzCOfUQZvAeZzy4 Kj4w== X-Gm-Message-State: APjAAAX7O9iUqCKtOI3weJM8QiFgdzT9LusL+ol4zLtHI5J/OKfSqHx3 EwKXc/r3eVW/cdhH/I2421YNMg== X-Google-Smtp-Source: APXvYqynYignZMlcfRi+xe4On+8XptVrSy3ttSTlGEFPSIh796adqQZe9y2GuweCxZtp5Ch2sIPxRQ== X-Received: by 2002:a37:9b92:: with SMTP id d140mr9175373qke.443.1565972167568; Fri, 16 Aug 2019 09:16:07 -0700 (PDT) Received: from ?IPv6:2001:470:c1a2:1:7ded:86d1:e927:7777? ([2001:470:c1a2:1:7ded:86d1:e927:7777]) by smtp.gmail.com with ESMTPSA id q62sm3463272qkb.69.2019.08.16.09.16.06 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 16 Aug 2019 09:16:07 -0700 (PDT) From: Ted Lemon Message-Id: <09178E42-08B2-4958-A1C8-AF507AEE8834@fugue.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_C0D41023-15ED-41E6-A861-8EB714FE1321" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Fri, 16 Aug 2019 09:16:05 -0700 In-Reply-To: Cc: Andrew Campling , ADD Mailing list To: Brian Dickson References: X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] When Two Worlds Collide X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 16:16:10 -0000 --Apple-Mail=_C0D41023-15ED-41E6-A861-8EB714FE1321 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 On Aug 16, 2019, at 9:08 AM, Brian Dickson = wrote: > Those basically require that there be a single entry point into = resolution (single semantically at least, but possibly not physically). It would be helpful if we could acknowledge that in the absence of a = completely locked down userland on a device with secure boot validation, = this is completely impossible, and any proposal that is based on the = assumption that it is possible is not worth spending time documenting. = Or if it is worth spending time documenting, I haven=E2=80=99t heard a = good justification for why that=E2=80=99s so. --Apple-Mail=_C0D41023-15ED-41E6-A861-8EB714FE1321 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 On = Aug 16, 2019, at 9:08 AM, Brian Dickson <brian.peter.dickson@gmail.com> wrote:
Those basically require that there be a single entry point = into resolution (single semantically at least, but possibly not = physically).

It would be helpful if we could acknowledge that in the = absence of a completely locked down userland on a device with secure = boot validation, this is completely impossible, and any proposal that is = based on the assumption that it is possible is = not worth spending time documenting.  Or if it is worth spending = time documenting, I haven=E2=80=99t heard a good justification for why = that=E2=80=99s so.

= --Apple-Mail=_C0D41023-15ED-41E6-A861-8EB714FE1321-- From nobody Fri Aug 16 09:25:26 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F283A120858 for ; Fri, 16 Aug 2019 09:25:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4GLsu688f-Yy for ; Fri, 16 Aug 2019 09:25:21 -0700 (PDT) Received: from mail-pl1-x633.google.com (mail-pl1-x633.google.com [IPv6:2607:f8b0:4864:20::633]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4635A120869 for ; Fri, 16 Aug 2019 09:25:16 -0700 (PDT) Received: by mail-pl1-x633.google.com with SMTP id bj8so2647451plb.4 for ; Fri, 16 Aug 2019 09:25:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:mime-version:subject:date:references:to:in-reply-to:message-id; bh=TqUnDtqkmi6nBPBGMhKM0k8Q2mJNU8xdPScWLbd9oMc=; b=UTEC067Snma8lfJlLkmKFgrBe7QdOufVDuU/kFsSnq4LqSfTapPWzzTZtl9MCzaXv4 8XEYqwpitflf7VKSzIcIFzOcUh9vhDDWDCcecL/KAa5BNNz0v9HwG9J2jmhqfZWNhAU6 ta12J641mFk8O1IHrvZFRIhA6iYAkXyQo6av+19qdT0Iwi2OU3IqrFxT1R7qiQ1jAPts b7ctAqnL6is25uf+O4V9znJha0pxJEVkLbO/X73OAFVbS49NgjhSg/VqFzqb/UbuqGJp 3xxSFIp20TNyymVIXrlmFF0MwbqOcPrFFDmC/r0HVUfVvhjntbrAKhhA7iFM09IMijHQ WLtg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:mime-version:subject:date:references:to :in-reply-to:message-id; bh=TqUnDtqkmi6nBPBGMhKM0k8Q2mJNU8xdPScWLbd9oMc=; b=SsY2uqbp0UAXP9KuNcjCj+dQE/f2fFK/EQArqSo9YHbAMAY7RxoG+m0EfoGp6AJaAF Az5BDM0+kQZnBJgQtM19IJVVlHRuV1zaAM26yNNu+UbUNczTKdfy0WBWqfE2WHw3Ygny 08bNy6G40l1TKPuXEuxQs9sWUNdDpVYsKpSv0XEOnEyv0ixIwF+0NZBukMiMqsBHI1v4 ok+mUm9Y/yr7TeASaS2B4IUfydur+wWpvsKUZ4dJI1TKT1C7Qb0wYiFtfCse3jFmn5lS 3JwRnFwsFL945e9mTw/PCNTzxaCW+Jg3btuIvjid/voBsrrnexipPV/eCGaJVZN7bQay 8thQ== X-Gm-Message-State: APjAAAX//81YfopCUArinfBsiEO5EuEhCKKiCgn3AtjgMrLFmg49DhMe QpFiBgMHFOIl8UX+qjxJu+NKtv4O X-Google-Smtp-Source: APXvYqyKSF3s3Mfc9Dudjj38TFZ77b4kQ42Jz0+1jg8fXMq0cUF7Z4r1dBtKcNjDGqRdfqV/kKdyYA== X-Received: by 2002:a17:902:b497:: with SMTP id y23mr10251263plr.68.1565972715381; Fri, 16 Aug 2019 09:25:15 -0700 (PDT) Received: from [10.128.64.148] ([136.60.227.81]) by smtp.gmail.com with ESMTPSA id g1sm5906412pgg.27.2019.08.16.09.25.13 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 16 Aug 2019 09:25:14 -0700 (PDT) From: Bret Jordan Content-Type: multipart/alternative; boundary="Apple-Mail=_8A7970C0-B8DD-49EB-A1C6-3011993BF98C" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Fri, 16 Aug 2019 10:25:13 -0600 References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <8e00891f-2aa2-ee11-559a-b5a8967b22d9@nostrum.com> <2C23D415-84F9-4B6C-B67B-0CC3EB600520@gmail.com> <2704899B-E43D-4978-A3C9-30E9E7CEBEBD@fugue.com> <4CC4C262-BEF4-4B39-ACB1-A595AB66D6CD@gmail.com> <23893.60122.817218.615568@gro.dd.org> <6402e345-ce5e-da66-5b16-35412d50801d@cs.tcd.ie> To: ADD Mailing list In-Reply-To: <6402e345-ce5e-da66-5b16-35412d50801d@cs.tcd.ie> Message-Id: X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 16:25:24 -0000 --Apple-Mail=_8A7970C0-B8DD-49EB-A1C6-3011993BF98C Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Here is an alternate model. Mozilla produces a hardened standalone DoH = server that everyone can run off their home network and expose out to = the internet via their DMZ zone. Then no more centralization. No more = need to trust things outside. Give people back control. =20 Thanks, Bret PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 "Without cryptography vihv vivc ce xhrnrw, however, the only thing that = can not be unscrambled is an egg." > On Aug 15, 2019, at 6:40 PM, Stephen Farrell = wrote: >=20 >=20 > Hiya, >=20 > On 16/08/2019 00:29, Dave Lawrence wrote: >> One distinction worth observing again is that the experimental >> Mozilla/CloudFlare DoH setup was only one possible operational model. >> We can address the issues of that model while also discussing >> the issues of alternative models, evaluating then against each other >> to try to get as many of the benefits as possible while bearing as = few >> of the disadvantages as necessary. >=20 > I'm also personally leery of the moz/cf model as being > a possible one-off. The "we'd like more TRRs" aspiration > seems like a good, and genuine, one, but hasn't so far > produced other TRRs AFAIK. Continued work on that seems > like a good thing. >=20 > However, I've not seen other (!=3D moz/TRR) models proposed. >=20 > If someone has one to propose, now and here would seem > like a good time and place. By a "proposed model" I mean > a worked-out model and not a "not yet even on a beer-mat" > nor just a "sent from my iphone" type random thought;-) >=20 > Cheers, > S. > <0x5AB2FAF17B172BEA.asc>--=20 > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add --Apple-Mail=_8A7970C0-B8DD-49EB-A1C6-3011993BF98C Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii Here = is an alternate model.  Mozilla produces a hardened standalone DoH = server that everyone can run off their home network and expose out to = the internet via their DMZ zone. Then no more centralization. No more = need to trust things outside.  Give people back control.  

Thanks,
Bret
PGP = Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 = 0050
"Without = cryptography vihv vivc ce xhrnrw, however, the only thing that can not = be unscrambled is an = egg."

On Aug 15, 2019, at 6:40 PM, Stephen Farrell <stephen.farrell@cs.tcd.ie> wrote:


Hiya,

On 16/08/2019 00:29, Dave = Lawrence wrote:
One = distinction worth observing again is that the experimental
Mozilla/CloudFlare DoH setup was only one possible = operational model.
We can address the issues of that model = while also discussing
the issues of alternative models, = evaluating then against each other
to try to get as many = of the benefits as possible while bearing as few
of the = disadvantages as necessary.

I'm = also personally leery of the moz/cf model as being
a = possible one-off. The "we'd like more TRRs" aspiration
seems= like a good, and genuine, one, but hasn't so far
produced = other TRRs AFAIK. Continued work on that seems
like a good = thing.

However, I've not seen other (!=3D = moz/TRR) models proposed.

If someone has = one to propose, now and here would seem
like a good time = and place. By a "proposed model" I mean
a worked-out model = and not a "not yet even on a beer-mat"
nor just a "sent = from my iphone" type random thought;-)

Cheers,
S.
<0x5AB2FAF17B172BEA.asc= >--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add

= --Apple-Mail=_8A7970C0-B8DD-49EB-A1C6-3011993BF98C-- From nobody Fri Aug 16 09:30:58 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 368D6120816 for ; Fri, 16 Aug 2019 09:30:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HcnDo74nyP57 for ; Fri, 16 Aug 2019 09:30:54 -0700 (PDT) Received: from mail-pg1-x52b.google.com (mail-pg1-x52b.google.com [IPv6:2607:f8b0:4864:20::52b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 75BBD120823 for ; Fri, 16 Aug 2019 09:30:51 -0700 (PDT) Received: by mail-pg1-x52b.google.com with SMTP id o13so3176778pgp.12 for ; Fri, 16 Aug 2019 09:30:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=q0WP22W1fUEESEunG3hWR9wHxLmjbFxwQ7eg0S2tAeo=; b=pQmF9J8v2uIIB2FSMEfl8YIblxpYkiACR1pwZORgEgQ9ELSlePMc/v5Z7bntPzd4go Hyc1Q/X0BfFcJQ07zzTP/okxr1R2O5TOfAcX/8an7np8v9bWkuqtdvHiBcZNGBc1IthB 9GYr3vj8m9cN28pLJSpHqyW12slxtZa/cAilHGPBTbC0WLbXf46NpvSJ1plD+1hQGrTJ UFvT48r4tKDkPEYf3hNv0ot4+jJDBPUoCbP3oHMmE7aE7duTzmO2YnJL3xKF1caLbKke +15XFVvxLdB+zMcQX/1BGQbp2lRpQXLOxoZpYcfjN5q/41jjnSi2Q6F4PveIbzg3GBiE zDyQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=q0WP22W1fUEESEunG3hWR9wHxLmjbFxwQ7eg0S2tAeo=; b=hNWWeX7RiWLmB7PesBxwg0xmPm/h7kqi+0awF6wT5qgNj7Hc4FdCJ0XmEUcApwSB1h /yZLjjRpx24XOZOwb7xhl99dJJvZBUirHIlwibEwba981lQX70qVA8GuR5pH1NAnjPCX 8TeWRG2unSyNs049Mm+EoxElrrX7CwuOqzQ0deAvc1CfTtKmD2Dj/94rJuKKXJAxeDEo LRM3OysdjDOq41l+KsYd4wpPCBKOZo0mq0ujzFgkdT7rDSK+CD+fLTOV8IMj8hJeuWkh 8XLS3oEZC6LkA45TtdxJCk5yyXE67XppzzMhXZjJsxjxgIs8l47bdg8bSziplYCBZ9Sj po/g== X-Gm-Message-State: APjAAAUcIzQ25Fo9kySQrs/j8BZAcVCxzZ3zEcYFIzrvwCHXn3JhJ5xe QS9Vh0AO+XU8ugrOhP1TBNQ= X-Google-Smtp-Source: APXvYqzKTDq2uCY/5o3NJu5T11yo1HjKKU0RMz9BZOxayGiQWCzH5fPqpdZnts2Ge9h7n9GTvvw+LA== X-Received: by 2002:a62:e401:: with SMTP id r1mr11990647pfh.193.1565973051074; Fri, 16 Aug 2019 09:30:51 -0700 (PDT) Received: from [10.128.64.148] ([136.60.227.81]) by smtp.gmail.com with ESMTPSA id v8sm5893266pjb.6.2019.08.16.09.30.49 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 16 Aug 2019 09:30:50 -0700 (PDT) From: Bret Jordan Message-Id: Content-Type: multipart/alternative; boundary="Apple-Mail=_CAF985F1-E453-485F-8E87-4373B2D8A50C" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Fri, 16 Aug 2019 10:30:48 -0600 In-Reply-To: Cc: Bret Jordan , ADD Mailing list To: Frode Kileng References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <8e00891f-2aa2-ee11-559a-b5a8967b22d9@nostrum.com> <2C23D415-84F9-4B6C-B67B-0CC3EB600520@gmail.com> <2704899B-E43D-4978-A3C9-30E9E7CEBEBD@fugue.com> <4CC4C262-BEF4-4B39-ACB1-A595AB66D6CD@gmail.com> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 16:30:56 -0000 --Apple-Mail=_CAF985F1-E453-485F-8E87-4373B2D8A50C Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Not every devices supports this. Please stop using the =E2=80=9Cendpoints= can do everything=E2=80=9D argument that been fronted by the =E2=80=9Cthe= re is nothing wrong camp=E2=80=9D for the last 5 years.=20 Thanks, Bret PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 "Without cryptography vihv vivc ce xhrnrw, however, the only thing that = can not be unscrambled is an egg." > On Aug 16, 2019, at 12:56 AM, Frode Kileng wrote: >=20 > On 15/08/2019 23:58, Bret Jordan wrote: > >> If you say that the parental controls you have signed up for and paid = money for are no longer going to work, you might get a different answer.=20= >=20 > There are numerous other client-side child-safe products in the = markets that will continue to work perfectly well. Please please stop = using this "save the children" argument that has been fronted by the = "anti-encryption camp" for the last 5 years. >=20 > frodek >=20 >=20 >=20 >=20 > --=20 > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add --Apple-Mail=_CAF985F1-E453-485F-8E87-4373B2D8A50C Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Not = every devices supports this.  Please stop using the =E2=80=9Cendpoint= s can do everything=E2=80=9D argument that been fronted by the =E2=80=9Cth= ere is nothing wrong camp=E2=80=9D for the last 5 years. 

Thanks,
Bret
PGP = Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 = 0050
"Without = cryptography vihv vivc ce xhrnrw, however, the only thing that can not = be unscrambled is an = egg."

On Aug 16, 2019, at 12:56 AM, Frode Kileng <frodek@tele.no> = wrote:

On 15/08/2019 23:58, Bret Jordan wrote:
<snip>
If you say that the parental controls you have signed up for = and paid money for are no longer going to work, you might get a = different answer.

There are = numerous other client-side child-safe products in the markets that will = continue to work perfectly well. Please please stop using this "save the = children" argument that has been fronted by the "anti-encryption camp" = for the last 5 years.

frodek




-- =
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add

= --Apple-Mail=_CAF985F1-E453-485F-8E87-4373B2D8A50C-- From nobody Fri Aug 16 09:33:51 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 379261201DE for ; Fri, 16 Aug 2019 09:33:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Yi7xPIkEZjP6 for ; Fri, 16 Aug 2019 09:33:46 -0700 (PDT) Received: from mail-pg1-x542.google.com (mail-pg1-x542.google.com [IPv6:2607:f8b0:4864:20::542]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A36EE1200B3 for ; Fri, 16 Aug 2019 09:33:46 -0700 (PDT) Received: by mail-pg1-x542.google.com with SMTP id w10so3192233pgj.7 for ; Fri, 16 Aug 2019 09:33:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=QGdrJQ3wzMmUFn/tX2qD9bP9gr06xgif4yYx3zOfr40=; b=nt8RD0s5fXz2zwIgiT2APNlm7r/6TYvdrKONiKqbf6eYmdNm3HQl+cqmup2Y/jHqB4 NtztSK47RGnwCTMO8mrT+qfgfLikmJ4zsITrNG4TXseAfn33sduKYZQlCEZZWEAGj/kc WWcLvmjgKUPyKACX7Od3/+I+/ieabYpBPBmyUIsCzWs3MJT9zHX9xNIrV2ForQn2akA8 iLcjRHG3fVaRLdotbcZ+v6GTdWS+c6flt6/Cfar4Br+2il9t20I10OLQKib7Im3UAaET h+FGRBhZWrgDXNGa2wxCSXODlKayLx5CXNd1nXm6aokjutQV1Szn5Rj8IEBCCffqBXKh gB5Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=QGdrJQ3wzMmUFn/tX2qD9bP9gr06xgif4yYx3zOfr40=; b=AdWI+YBQJ516kL3VNPW/eFbrhG0/j66BAtxOLRLc2ZpB8mxc7RGxa0AKmD3gFtXPSv +nZ5eqWwv3irV8CjFlxlc0eexZVNDRY0AG4c8UE4tPPw8VkLVm2/tZHnviGaRgXnOpIF UUFxPVvC2WiIf61G/ZLV7GV+z5w1AF8LYpsYOq2zmZs1Xr0B79+4Ni37fVT9j8X5avJF +xYLtYozdhtJHTn9vkLgglNRt0ElOnt5BfKoSmBOdl6L3hKviOOcrOTd7G0XMnK5Liir huVAvRCK//Is2nq+A8tdMrUKEVx5tQacebYydilU2zg1VFHnx8IXHQnNkBWOY54GLo5s J/hQ== X-Gm-Message-State: APjAAAVl/Aa1fKQUWBbkih0bUekUg9Dhs3tqccd/QWQ8I1b+b1amq/Ff iIltpvgtyPu1P26lxU3tCgcWS0t8 X-Google-Smtp-Source: APXvYqxokXGKODnHuSgYG2lnaMwtypD9hn/QV9jq5H+X74DLEQoPnS39fHSFhRwW/BPDFMgOXvenMg== X-Received: by 2002:a17:90a:bb91:: with SMTP id v17mr7743234pjr.84.1565973226323; Fri, 16 Aug 2019 09:33:46 -0700 (PDT) Received: from [10.128.64.148] ([136.60.227.81]) by smtp.gmail.com with ESMTPSA id k5sm7893400pfg.167.2019.08.16.09.33.45 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 16 Aug 2019 09:33:45 -0700 (PDT) From: Bret Jordan Message-Id: <4D003B68-5809-4F2B-B81B-28F9CFC23763@gmail.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_1A826C7F-25F8-4384-8838-2C87968770E5" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Fri, 16 Aug 2019 10:33:44 -0600 In-Reply-To: Cc: Frode Kileng , Bret Jordan , ADD Mailing list To: Andrew Campling References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <8e00891f-2aa2-ee11-559a-b5a8967b22d9@nostrum.com> <2C23D415-84F9-4B6C-B67B-0CC3EB600520@gmail.com> <2704899B-E43D-4978-A3C9-30E9E7CEBEBD@fugue.com> <4CC4C262-BEF4-4B39-ACB1-A595AB66D6CD@gmail.com> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 16:33:49 -0000 --Apple-Mail=_1A826C7F-25F8-4384-8838-2C87968770E5 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Yes, I agree. It is about taking choice away. We already know that the = general market does not understand a lot of these things. Taking things = away from them, because you think it will be better for them, is just = wrong. Thanks, Bret PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 "Without cryptography vihv vivc ce xhrnrw, however, the only thing that = can not be unscrambled is an egg." > On Aug 16, 2019, at 3:47 AM, Andrew Campling = wrote: >=20 > On 16/08/2019 07:56, Frode Kileng wrote: >=20 >> There are numerous other client-side child-safe products in the = markets that will=20 >> continue to work perfectly well. Please please stop using this "save = the children"=20 >> argument that has been fronted by the "anti-encryption camp" for the = last 5 years. >=20 > Whilst there may be alternative child-safe products, it should be = remembered that at least some ISPs provide parental controls using DNS = filtering (and malware protection) as part of their service bundle, = making it relatively simple for their customers to configure and use the = services. These are generally provided at no additional cost and, in = some instances, are enabled by default. Having a protocol like DoH = bypass such services without due warning to those users is a problem. = Having to share data with an alternate app provider to rectify the = situation may also be a problem to some of those users, particularly if = that provider is based off-shore from the user. =20 >=20 > NB This has nothing to do with anti-encryption, is about understanding = the behaviours and expectations of regular users (and regulators and = politicians for that matter, although these are separate = considerations). =20 >=20 >=20 >=20 >=20 > --=20 > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add --Apple-Mail=_1A826C7F-25F8-4384-8838-2C87968770E5 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii Yes, = I agree.  It is about taking choice away.  We already know = that the general market does not understand a lot of these things. =  Taking things away from them, because you think it will be better = for them, is just wrong.


Thanks,
Bret
PGP = Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 = 0050
"Without = cryptography vihv vivc ce xhrnrw, however, the only thing that can not = be unscrambled is an = egg."

On Aug 16, 2019, at 3:47 AM, Andrew Campling <andrew.campling@419.consulting> wrote:

On = 16/08/2019 07:56, Frode Kileng <frodek@tele.no> wrote:

There are numerous other = client-side child-safe products in the markets that will
continue to work perfectly well. Please please stop using = this "save the children"
argument that has been fronted = by the "anti-encryption camp" for the last 5 years.

Whilst there may be alternative = child-safe products, it should be remembered that at least some ISPs = provide parental controls using DNS filtering (and malware protection) = as part of their service bundle, making it relatively simple for their = customers to configure and use the services.  These are generally = provided at no additional cost and, in some instances, are enabled by = default.  Having a protocol like DoH bypass such services without = due warning to those users is a problem.  Having to share data with = an alternate app provider to rectify the situation may also be a problem = to some of those users, particularly if that provider is based off-shore = from the user.  

NB This has nothing = to do with anti-encryption, is about understanding the behaviours and = expectations of regular users (and regulators and politicians for that = matter, although these are separate considerations).  




-- =
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add

= --Apple-Mail=_1A826C7F-25F8-4384-8838-2C87968770E5-- From nobody Fri Aug 16 09:35:57 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E7BE112080B for ; Fri, 16 Aug 2019 09:35:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aH7bdR6Bdytd for ; Fri, 16 Aug 2019 09:35:53 -0700 (PDT) Received: from mail-qk1-x742.google.com (mail-qk1-x742.google.com [IPv6:2607:f8b0:4864:20::742]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3059D1200B3 for ; Fri, 16 Aug 2019 09:35:53 -0700 (PDT) Received: by mail-qk1-x742.google.com with SMTP id m2so5177382qkd.10 for ; Fri, 16 Aug 2019 09:35:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=sTOCn9eEB0Op+cYwY7A03PsnRAqMbtOO7xUUSITCVSg=; b=CR+39+aFT+xDw8td3Yk3DD1WFxZw7A/F9cOIykQB46kMKfH7zd7YkP1ouG28Qjwnbx HiNLr4VKuRJcn00cJcI1OhB4fdoCEvpkvqzB4F+eINJQjdCiNWB4EyVK3fraanoX7bh2 vlc3QT062xoLryMJyqVzBoODZwU043IYjbkFkO1Chfo6CpEg5S2bxxw4Qjaq2Pw9shmi HuS5VBy7jj9Wxr0cXd14jTqZKK4Y25XNgsbpExelF++aclEQxIN2/UWp7FLvKJEkDQRI f2JWXZbMZi3nG060dYsYa6JDI+Z57cGpoc3u8UCQKoLVJoJYSNMxCpvSlvikIid30ZNj Sg9w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=sTOCn9eEB0Op+cYwY7A03PsnRAqMbtOO7xUUSITCVSg=; b=E7r+7ALYMWQvaD3ubszbBidUShJF+irC8JmdBWfX051r/NRetxqZmjuuPvCNlyLn15 +q5pZIDrr75EBXBer3IkwaixPgdZhDggL+Tnbb+3+d+g8u72fhKMeClycaqByrNw7Vuf f1jdUkY823TiD3cNVIu+YrvoJy2A3PTYLOa6SLqFSK2V4C7nhYwvg/Yv+heZSb57MQZK 3Hz1JZBNyiN7+0A1O+Ac/y+GFB3MYJrZMwN/g23HD+TQqPby1eSkC2p0k1g62PsasPnW OnPfyGuxvgs/UVbsNfdEOaqodMUqJ4XaMORY2PbmnbYiZTTe5XXDb3ehpJ3bPhBFPg8f PheQ== X-Gm-Message-State: APjAAAULvjexnoWU1phbf5VK/cCHGzLlbh7xwWs3o6YEFry0r94sBlDb P7VI5xf+MMW5wxUQU0acPh9oJA== X-Google-Smtp-Source: APXvYqzt1ncrOc8zg+hOxQQPPNHrzxTu5kDW0b/ntNDegNRYX4/iC7gyXQIvsINTGaCVopwi+FfZkA== X-Received: by 2002:ae9:df84:: with SMTP id t126mr9618317qkf.328.1565973352024; Fri, 16 Aug 2019 09:35:52 -0700 (PDT) Received: from ?IPv6:2001:470:c1a2:1:7ded:86d1:e927:7777? ([2001:470:c1a2:1:7ded:86d1:e927:7777]) by smtp.gmail.com with ESMTPSA id i62sm3168562qke.52.2019.08.16.09.35.51 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 16 Aug 2019 09:35:51 -0700 (PDT) From: Ted Lemon Message-Id: <3A961AB0-1D58-466B-8155-4F614A84BD66@fugue.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_D2696060-3D34-4259-9E0B-6656767AC6A7" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Fri, 16 Aug 2019 09:35:49 -0700 In-Reply-To: Cc: ADD Mailing list To: Bret Jordan References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <8e00891f-2aa2-ee11-559a-b5a8967b22d9@nostrum.com> <2C23D415-84F9-4B6C-B67B-0CC3EB600520@gmail.com> <2704899B-E43D-4978-A3C9-30E9E7CEBEBD@fugue.com> <4CC4C262-BEF4-4B39-ACB1-A595AB66D6CD@gmail.com> <23893.60122.817218.615568@gro.dd.org> <6402e345-ce5e-da66-5b16-35412d50801d@cs.tcd.ie> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 16:35:56 -0000 --Apple-Mail=_D2696060-3D34-4259-9E0B-6656767AC6A7 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 On Aug 16, 2019, at 9:25 AM, Bret Jordan wrote: > Here is an alternate model. Mozilla produces a hardened standalone = DoH server that everyone can run off their home network and expose out = to the internet via their DMZ zone. Then no more centralization. No more = need to trust things outside. Give people back control. =20 This is almost exactly equivalent to just using a DoH resolver provided = by your ISP. Which would certainly be a valid choice, if you consider = your ISP more trustworthy than Google or Cloudflare. If you are getting = your child safety protection through DNS filtering from your ISP, this = is probably a good choice. I certainly don=E2=80=99t object to you = doing this, and it may even be a better solution for some users than = using Google (I really don=E2=80=99t know).=20 But I don=E2=80=99t see this as Mozilla=E2=80=99s job to provide. = Mozilla=E2=80=99s job is to make sure that if you want to do this, = it=E2=80=99s easy to do, and that if you are using some DoH resolver = that=E2=80=99s not under your control, you don=E2=80=99t reveal PII when = you query it. Also, bear in mind that if you are connecting directly to your home to = get this information, that reveals more about you to the local network = than if you were connecting to your ISP or to Google or Cloudflare. So = it would probably be better for your security to connect directly to the = ISP=E2=80=99s DoH resolver, and make sure that your DoH client doesn=E2=80= =99t send PII while doing the query. --Apple-Mail=_D2696060-3D34-4259-9E0B-6656767AC6A7 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 On = Aug 16, 2019, at 9:25 AM, Bret Jordan <jordan.ietf@gmail.com> wrote:
Here is an alternate model.  Mozilla produces a hardened = standalone DoH server that everyone can run off their home network and = expose out to the internet via their DMZ zone. Then no more = centralization. No more need to trust things outside.  Give people = back control.  

This is almost exactly equivalent to just = using a DoH resolver provided by your ISP.   Which would certainly = be a valid choice, if you consider your ISP more trustworthy than Google = or Cloudflare.  If you are getting your child safety protection = through DNS filtering from your ISP, this is probably a good choice. =   I certainly don=E2=80=99t object to you doing this, and it may = even be a better solution for some users than using Google (I really = don=E2=80=99t know). 

But I don=E2=80=99t see this as Mozilla=E2=80=99s job to = provide.  Mozilla=E2=80=99s job is to make sure that if you want to = do this, it=E2=80=99s easy to do, and that if you are using some DoH = resolver that=E2=80=99s not under your control, you don=E2=80=99t reveal = PII when you query it.

Also, bear in mind that if you are connecting directly to = your home to get this information, that reveals more about you to the = local network than if you were connecting to your ISP or to Google or = Cloudflare.   So it would probably be better for your security to = connect directly to the ISP=E2=80=99s DoH resolver, and make sure that = your DoH client doesn=E2=80=99t send PII while doing the = query.

= --Apple-Mail=_D2696060-3D34-4259-9E0B-6656767AC6A7-- From nobody Fri Aug 16 09:36:07 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CA55212085A for ; Fri, 16 Aug 2019 09:36:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=netorgft5189650.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RCJCU5h9pE3z for ; Fri, 16 Aug 2019 09:35:59 -0700 (PDT) Received: from GBR01-CWL-obe.outbound.protection.outlook.com (mail-eopbgr110077.outbound.protection.outlook.com [40.107.11.77]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A480E12081F for ; Fri, 16 Aug 2019 09:35:55 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=G8sijDoICha7OoqmajOfwUfx8BjQy0GLVUdwDoAtAXKLlx9KekXvay4wv8fCpe2scKUWvrgISDPQcYuiRTJvyE6+UyQ/czXo2MHaiT1/32KKsDrKlcq1HRx7MkQmFbtlrwK6SrOp1YsQVPRLG2fgflreDKs503CjHiv9IsmBPfkywvALw6grRPUjQeYleQniouQuNlMT77qdbyN4Ibx7nfmvTRNDVN66NwXdrMCC0toXN+9EraG96P2C5gVyR4EDdXfTRYzU8OmUVYgzlbMUGo5/xVR0e7Rf2ySaiWtEXrWZ4fvUebyI9385FNPHoXHwigxA+vUMsbT7QGhJnNjNWg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=iScFKtKz+6Vp2SzK3qo7ZnazDhoGVrJ/iZ3gIQ0OGmo=; b=mD2bsVJBHAWmltXYejNJ2K73tAwPbwY9pPQEqPIGmRoSRJ8fgZ5rC4GFVQYpk3gmJlYeoI+NDY+e2V7pN7CQlPuTuUW9eUgQEonZZTR7+d+rGcwo/W0kjY4q/Qu6L98F75Y3TvceFqHMS3oG7j7p9e1Onefx1PpTCKtGXsQmXkw4dFkaMD4A38tNTx3Koivz6FG823h28FLlGuSA9Vmf47a1bU1G0fS93X6RT43mY9CM3NQlhDHD0cw9Yb+eoLMMMFtqt51TGZiUJoBuDJUnvwmkKxcMPEPcQ3+jWJDgFoVe2iiTrtrloGmGao3GDypuYBiZbNMbFUFXrV31DXEyHA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=419.consulting; dmarc=pass action=none header.from=419.consulting; dkim=pass header.d=419.consulting; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=NETORGFT5189650.onmicrosoft.com; s=selector1-NETORGFT5189650-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=iScFKtKz+6Vp2SzK3qo7ZnazDhoGVrJ/iZ3gIQ0OGmo=; b=ZyBysXmSOeJVnfPv8RMy/FKjyGp75wG0Okv3YC57nqtlEBNZc1dwP/e0wkoyJ6w3lVN45wvvBACk7RV9RUTy/+ppWDD4DvOGXnNlrpbzcDIaAjxsuSOP4gyoRdea5da2WMrKiwQkFZuMvLoFryXos4GeF6tI8PYt7TFhKeFXYww= Received: from LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM (20.176.138.146) by LO2P265MB0494.GBRP265.PROD.OUTLOOK.COM (10.166.102.18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2157.21; Fri, 16 Aug 2019 16:35:54 +0000 Received: from LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM ([fe80::64e9:9b9e:59fc:26f]) by LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM ([fe80::64e9:9b9e:59fc:26f%5]) with mapi id 15.20.2157.022; Fri, 16 Aug 2019 16:35:53 +0000 From: Andrew Campling To: Eric Rescorla , =?utf-8?B?UGF0cmlrIEbDpGx0c3Ryw7Zt?= CC: Alec Muffett , ADD Mailing list , Stephen Farrell Thread-Topic: [Add] Use Cases - the coffee shop Thread-Index: AdVTdTO8sMFf9NSjRg6hhfqT7Scbe6b99VLA Date: Fri, 16 Aug 2019 16:35:53 +0000 Message-ID: References: <400b774a-5bd0-d6f4-5640-e561f067a9b5@cs.tcd.ie> <74A2E5E0-02CE-4C9D-A66B-1D2FBC65B39A@frobbit.se> <3611F27A-49A9-4159-A683-3BBD4C2F91EA@frobbit.se> <904F4219-8BDE-4272-BFDA-20F38D58CB80@frobbit.se> <85CF7EE9-51B8-4431-BCE5-7EA2B9AAF892@frobbit.se> In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=andrew.campling@419.consulting; x-originating-ip: [2a00:23c4:a499:2e00:55a7:59be:7d65:cfb6] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 09baeab6-5a3b-4999-8474-08d72267ce9e x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(7021145)(8989299)(4534185)(7022145)(4603075)(4627221)(201702281549075)(8990200)(7048125)(7024125)(7027125)(7023125)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:LO2P265MB0494; x-ms-traffictypediagnostic: LO2P265MB0494: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:7219; x-forefront-prvs: 0131D22242 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(39830400003)(396003)(346002)(376002)(136003)(366004)(189003)(199004)(508600001)(2906002)(102836004)(44832011)(76176011)(8936002)(99286004)(14454004)(316002)(5660300002)(305945005)(7736002)(186003)(54906003)(110136005)(476003)(6506007)(11346002)(74316002)(53546011)(446003)(486006)(7696005)(46003)(52536014)(81156014)(81166006)(76116006)(66946007)(6436002)(9686003)(66446008)(66556008)(55016002)(8676002)(229853002)(71200400001)(86362001)(71190400001)(33656002)(53936002)(256004)(14444005)(6246003)(6116002)(4326008)(25786009)(64756008)(66476007)(46492003); DIR:OUT; SFP:1101; SCL:1; SRVR:LO2P265MB0494; H:LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: 419.consulting does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: xI5mYMbq8vMIfzLYK/R2lfqZwpB/ScHLq6aATKOvzJSPo6TQ0fDwR4hhNOJw1mR+4JzpFCD8/xiOJucLwIgI9g1R6oERdtAXYvCXs1a9QHuIMi/ytuf2X25EtDBNlqrn/kJ885dz4MKodcX3/zSAhG36BjBgpu2FmZL9GYOXFPel2sINLoEflcmyCl9cTIulHPPf6TmvNDE5cstBqw2boupinrsH3ydfgvB3Iaa7phCiy9JnhKocWY0CGOZ76WfOzpkSMw7QitEqGGRCDdZkdMV2WhEbCIcUcpl4HBjci82k04gSy7y4zfAXrTycyKOVj8E53MwaY9EDBtXAk2ZOKdVfiJQuUUm2+Ol+0hs+PC2j2/q+K3Vd3oZlsnbc042Vbm4nz8tbAH7mWVmQWwtOFGQzwj8yuw4PtLNl5ZI9BIw= x-ms-exchange-transport-forked: True Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: 419.consulting X-MS-Exchange-CrossTenant-Network-Message-Id: 09baeab6-5a3b-4999-8474-08d72267ce9e X-MS-Exchange-CrossTenant-originalarrivaltime: 16 Aug 2019 16:35:53.8226 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 9c2ced3e-7522-4755-87dc-f983abc66ec3 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: p4S2rpapxYIaetSQ1NIyqP8IY2+Q+hmzRWR9MtilRCoCnBSPEcDiPs7JYyDEpEikKinFT2zqHzgguR2I869MmyKsAjlQBghjFGVWCJyCq80= X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO2P265MB0494 Archived-At: Subject: Re: [Add] Use Cases - the coffee shop X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 16:36:06 -0000 T24gRnJpLCBBdWcgMTYsIDIwMTkgYXQgMTE6MjUgQU0gRXJpYyBSZXNjb3JsYSA8ZWtyQHJ0Zm0u Y29tPiB3cm90ZToNCg0KPiBhbmQgZXZlbiB3aGVuIGl0J3MgYW4gSVNQLCB0aGUgcHJpdmFjeSBw b2xpY2llcyBhcmUgb3BhcXVlIGFuZCB0aGVyZSBpcyBhIGZhaXJseSBsb25nIGhpc3Rvcnkgb2Yg YmFkIGJlaGF2aW91ci4gVGhlIGludGVudCBvZiBUUlIgaXMgdGhhdCB0aGUgYXBwbGljYXRpb24g cHJvdmlkZXIgaXMgYWJsZSB0byBuZWdvdGlhdGUgZm9yIGFuZCBhc3N1cmUgYW4gYWNjZXB0YWJs ZSBwcml2YWN5IHBvbGljeSBvbiB0aGUgdXNlcidzIGJlaGFsZi4NCg0KSSB0aGluayB3ZSBzaG91 bGQgYmUgY2FyZWZ1bCB0byBnZW5lcmFsaXNlIGdpdmVuIHRoZSBzaWduaWZpY2FudCBkaWZmZXJl bmNlcyBiZXR3ZWVuIGdlb2dyYXBoaWVzLiAgV2Ugc2hvdWxkIGFsc28gYWNrbm93bGVkZ2UgdGhh dCwgdW5mb3J0dW5hdGVseSwgbWFueSBhcHBsaWNhdGlvbnMgcHJvdmlkZXJzIGhhdmUgbG9uZyBh bmQgb3BhcXVlIHByaXZhY3kgcG9saWNpZXMqIGNvdXBsZWQgd2l0aCBhIGxvbmcgaGlzdG9yeSBv ZiBiYWQgYmVoYXZpb3VyLCBlc3BlY2lhbGx5IHJlZ2FyZGluZyBwcml2YWN5IHZpb2xhdGlvbnMs IHRoYXQgY29udGludWVzIChub3Rpbmcgb25nb2luZyBpbnZlc3RpZ2F0aW9ucyBpbiB0aGUgRVUs IFVTIGFuZCBlbHNld2hlcmUpLiAgVGhlIGFzc3VtcHRpb24gdGhhdCB1c2VycyBtaWdodCBiZSBl eHBlY3RlZCB0byB0cnVzdCBhIGdpdmVuIGFwcGxpY2F0aW9uIHByb3ZpZGVyIG1vcmUgdGhhbiBh IGdpdmVuIElTUCBkb2VzIG5vdCBhcHBlYXIgdG8gcmVmbGVjdCBjdXJyZW50IHRoZSBsaXRpZ2F0 aW9uLCByZWd1bGF0b3J5IGVuZm9yY2VtZW50IG9yIGxlZ2lzbGF0aXZlIGFjdGlvbnMgdW5kZXJ3 YXkgaW4gYSBudW1iZXIgb2YgbWFqb3IgbWFya2V0cy4gIA0KDQoqIEEgbnVtYmVyIG9mIHRoZXNl IHByaXZhY3kgcG9saWNpZXMgaGF2ZSBwcmV2aW91c2x5IGZlYXR1cmVkIGluIGFydCBpbnN0YWxs YXRpb25zIHRvIHVuZGVybGluZSB0aGVpciBsZW5ndGggYW5kIGNvbXBsZXhpdHkgDQoNCg== From nobody Fri Aug 16 09:40:06 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D00F112009C for ; Fri, 16 Aug 2019 09:40:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lQt70y66OK0J for ; Fri, 16 Aug 2019 09:40:00 -0700 (PDT) Received: from mail-ua1-x92b.google.com (mail-ua1-x92b.google.com [IPv6:2607:f8b0:4864:20::92b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B3A8212006D for ; Fri, 16 Aug 2019 09:40:00 -0700 (PDT) Received: by mail-ua1-x92b.google.com with SMTP id a97so2268185uaa.9 for ; Fri, 16 Aug 2019 09:40:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=JuTPwpDpeY4cJW45nSmRrC5AQYGMIYiGrEgjysnNYSA=; b=BKQhFK4tVWr9qZ9Ao+xyt+/Z8AxmsrpEhmganLtQ1kl7/EwRj5jtNaUCSoWD99Lv/n eez6izw88Pw/9DQFKSUOpHNvimQ4t47+fOlqVSIAw2y5FW7jxLtXste810FlsHurugu5 7MmtXNwef8DiUlwMrblG74Py5/+WA5xhc0NBoOZVJmLzkfsW1BX3VLYoSzENNnVdXaLv kdpm3e8Iv7gxjPc7aMVvHduo5o+LAg9kuig+05AekCi+OwUJuaq3mMA/tDt0PNjFbz3C zT1NYa95PfGjWeFmp5p7J63GMJSSk8pLjwQMXQtqFJVHo2EvllQiIOFQazonnTrnhHOm /DcQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=JuTPwpDpeY4cJW45nSmRrC5AQYGMIYiGrEgjysnNYSA=; b=lmDrH9Y5RyQYW4AMb23UfwJjoGtXV2Qsr+yi3RCunPE52ZIccUnwFTfGmQF6wUcYCm y9+DmF9v64LqWY+WSjJmxgR38/rtihTvFELqR7lrx9VtPuiJju4lQrjodjCRdG46OAdj 9STaQ/w3urGtGAPB5NixZK+q7gMCgfr8tyQMi8QIX8FwlfHpPrp62KxCwaybzTjAzpZx 3szUt7qAJwZQdpgYrWP1Sa4DScUnFURWc926dSTk4MVpkLEGrFFXQQQiJ3IBjH2dLaSb xFA0thcTB/UqPC1L6hlFsCFFmCSuovu3SmkFPeR9z9C9FyGgMlRmnzGc5P7lVBUqZ++i Y7wQ== X-Gm-Message-State: APjAAAXyRgjvdc+E1yqd6qe7dg3GOfWn4/Fhzo6O1tX6fObPVCmLlkeD xThjsF6bgb3v0wzOPph1VrCYXmRgNqyE6nvGDR4= X-Google-Smtp-Source: APXvYqwxYoGwwl8pa+aR2lDLyFNSgdfHaXRbQzrb+AqNYrWz1zorN9dGxJlWk4+OH3rz7aBPgY703bpaSzZNH5lyeio= X-Received: by 2002:ab0:1c0c:: with SMTP id a12mr235956uaj.75.1565973599845; Fri, 16 Aug 2019 09:39:59 -0700 (PDT) MIME-Version: 1.0 References: <09178E42-08B2-4958-A1C8-AF507AEE8834@fugue.com> In-Reply-To: <09178E42-08B2-4958-A1C8-AF507AEE8834@fugue.com> From: Brian Dickson Date: Fri, 16 Aug 2019 12:39:37 -0400 Message-ID: To: Ted Lemon Cc: Andrew Campling , ADD Mailing list Content-Type: multipart/alternative; boundary="00000000000025840d05903ea48b" Archived-At: Subject: Re: [Add] When Two Worlds Collide X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 16:40:06 -0000 --00000000000025840d05903ea48b Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Fri, Aug 16, 2019 at 12:16 PM Ted Lemon wrote: > On Aug 16, 2019, at 9:08 AM, Brian Dickson > wrote: > > Those basically require that there be a single entry point into resolutio= n > (single semantically at least, but possibly not physically). > > > It would be helpful if we could acknowledge that in the absence of a > completely locked down userland on a device with secure boot validation, > this is completely impossible, and any proposal that is based on the > assumption that it *is* possible is not worth spending time documenting. > Or if it is worth spending time documenting, I haven=E2=80=99t heard a go= od > justification for why that=E2=80=99s so. > > That is precisely why I am proposing forking these two use cases. The majority of ongoing discussion should be for the other one, the one that does not meet those requirements. There is a consequence to that forking: mathematical logic says, given a rule that "A implies B", and a statement of fact that "B is false", the implication is that "A is also false". What this means is, from an enterprise network security perspective, if any of those conditions is not satisfied (locked down userland, secure boot, no access to DNS resolution configuration in userland and thus none of the current ADD implementations), the device needs to be treated as unmanaged and insecure, and placed on guest networks only. The other branch of the fork may allow some form of DoT/DoH, albeit with restrictions on configuration of resolver at a minimum. My questions and ideas yesterday were an attempt to discover whether it was possible to combine the two forks in a single solution. I am acknowledging that it is not possible. Brian --00000000000025840d05903ea48b Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Fri, Aug 16, 2019 at 12:16 PM Ted = Lemon <mellon@fugue.com> wrot= e:
On Aug 16, 2019, at 9:08 AM, Brian Dickson <= ;brian.p= eter.dickson@gmail.com> wrote:
Those basically require that = there be a single entry point into resolution (single semantically at least= , but possibly not physically).

It = would be helpful if we could acknowledge that in the absence of a completel= y locked down userland on a device with secure boot validation, this is com= pletely impossible, and any proposal that is based on the assumption that i= t is=C2=A0possible is not worth spending time documenting.=C2=A0 Or = if it is worth spending time documenting, I haven=E2=80=99t heard a good ju= stification for why that=E2=80=99s so.


That is precisely why I am proposing forking these t= wo use cases. The majority of ongoing discussion should be for the other on= e, the one that does not meet those requirements.

= There is a consequence to that forking: mathematical logic says, given a ru= le that "A implies B", and a statement of fact that "B is fa= lse", the implication is that "A is also false".
<= br>
What this means is, from an enterprise network security persp= ective, if any of those conditions is not satisfied (locked down userland, = secure boot, no access to DNS resolution configuration in userland and thus= none of the current ADD implementations), the device needs to be treated a= s unmanaged and insecure, and placed on guest networks only.

=
The other branch of the fork may allow some form of DoT/DoH, alb= eit with restrictions on configuration of resolver at a minimum.
=
My questions and ideas yesterday were an attempt to discover= whether it was possible to combine the two forks in a single solution.

I am acknowledging that it is not possible.

Brian

=C2=A0
--00000000000025840d05903ea48b-- From nobody Fri Aug 16 09:40:31 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F305F1201DE for ; Fri, 16 Aug 2019 09:40:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DVHQPpau_0Vs for ; Fri, 16 Aug 2019 09:40:25 -0700 (PDT) Received: from mail-pf1-x444.google.com (mail-pf1-x444.google.com [IPv6:2607:f8b0:4864:20::444]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 59020120832 for ; Fri, 16 Aug 2019 09:40:21 -0700 (PDT) Received: by mail-pf1-x444.google.com with SMTP id w16so3387133pfn.7 for ; Fri, 16 Aug 2019 09:40:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:mime-version:subject:date:references:to:in-reply-to:message-id; bh=ztPMCU7AuPYs8Lr0rdRxFZPqMU+Zc4DhvRfGNMihfow=; b=RTkapt4GwkQBf7VfJJYjR+6IlxKTku/6gdgG/atYt3FXdLPPrszVM2CwY5plkKhpOn sCAnwnZJ/WXsIXCbHvw6euR7V3iXuzo9Y6vLzBnALqfjH66uZqkdxuu1m3QuJun/iqmQ +q0h+xyp3Qhjmw2iV3zONDOj1b8OV0ummBwFoyFG0cl4aRS2ZaSPYop0T6xKqBPe1uFp NWPUT1XX7VejlCtqlcUFj5TK5DMOiG/FqhZzM8PHOGnNcABp/SxVJqB1BkQPJJQVKg7w aU+SC120DAWwa1CQimFCsBruQZddPsvYrRm1fv4GZQEkV/62f9pxdpO1cbdn6u2Kw3tZ H/mA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:mime-version:subject:date:references:to :in-reply-to:message-id; bh=ztPMCU7AuPYs8Lr0rdRxFZPqMU+Zc4DhvRfGNMihfow=; b=XesyqTEZdqLdamKlnbzZ9NN6dyjGNlXHMZ4KvAxcSnhE49QttkU+m99Scm+v/qBzu7 33/7oFsb3ZZLVIm3HdzA+kwn0bYlHh5KYErqe7PrbtADN1y7DUlBBlSDnfRfsS78hmBg ecC5jCXdZKUXxaUwhitpewwAzuuZ2kwgBpeeF/uiv73vvQVT/2FNipwQp8xM9Rn2weHZ 6WMCQU/beX1dxCv+ntE5iBkQe8gqkHDYMGn+vch67fhwuqk/ETOrDfU3ik7sTzVpjQxZ TZwRPrxhP2t6x8bJgCvOemFofSPJAfLHxvMNM7QMwxvz/aB1WverPMByaJebrt4VXdh4 9ObA== X-Gm-Message-State: APjAAAWjDYoQIsmFNzUBqN1z232m6i5Tqs2SMbwoUadnL9m4Y8CBcf4G UH7VNPgEeQTqtn0+TfVJS8M+dqGE X-Google-Smtp-Source: APXvYqztz5RK0i1Yx60z57xOqeINB63Oq/nU5pSwt2IX1SltFcw+1EnuubRrSwHaOd8RIg3SmRqIFQ== X-Received: by 2002:a17:90a:7304:: with SMTP id m4mr8218678pjk.73.1565973620795; Fri, 16 Aug 2019 09:40:20 -0700 (PDT) Received: from [10.128.64.148] ([136.60.227.81]) by smtp.gmail.com with ESMTPSA id 33sm5366496pgy.22.2019.08.16.09.40.19 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 16 Aug 2019 09:40:19 -0700 (PDT) From: Bret Jordan Content-Type: multipart/alternative; boundary="Apple-Mail=_0141A34D-EBD0-4F8E-A7C7-DF7A6B6065E6" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Fri, 16 Aug 2019 10:40:18 -0600 References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <8e00891f-2aa2-ee11-559a-b5a8967b22d9@nostrum.com> <2C23D415-84F9-4B6C-B67B-0CC3EB600520@gmail.com> <2704899B-E43D-4978-A3C9-30E9E7CEBEBD@fugue.com> <4CC4C262-BEF4-4B39-ACB1-A595AB66D6CD@gmail.com> <2E35AAFE-5930-4083-BDC4-18B956291E85@open-xchange.com> To: Neil Cook , ADD Mailing list In-Reply-To: <2E35AAFE-5930-4083-BDC4-18B956291E85@open-xchange.com> Message-Id: <51C41749-2A59-4350-9CB5-0844C52E029C@gmail.com> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] [Ext] Validity of the "child safety/malware protection" argument X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 16:40:29 -0000 --Apple-Mail=_0141A34D-EBD0-4F8E-A7C7-DF7A6B6065E6 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 I agree. People need to be able to make their own choice and someone = should not be making it for them. Just because some do not like the = solution or use-case does not mean it is not valid and does not meet the = need. Thanks, Bret PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 "Without cryptography vihv vivc ce xhrnrw, however, the only thing that = can not be unscrambled is an egg." > On Aug 16, 2019, at 5:00 AM, Neil Cook = wrote: >=20 >=20 >=20 >> On 16 Aug 2019, at 11:32, Frode Kileng > wrote: >>=20 >> On 16/08/2019 11:47, Andrew Campling wrote: >>> On 16/08/2019 07:56, Frode Kileng > wrote: >>>=20 >>>> There are numerous other client-side child-safe products in the = markets that will >>>> continue to work perfectly well. Please please stop using this = "save the children" >>>> argument that has been fronted by the "anti-encryption camp" for = the last 5 years. >>> Whilst there may be alternative child-safe products, it should be = remembered that at least some ISPs provide parental controls using DNS = filtering (and malware protection) as part of their service bundle, = making it relatively simple for their customers to configure and use the = services. These are generally provided at no additional cost and, in = some instances, are enabled by default. Having a protocol like DoH = bypass such services without due warning to those users is a problem. = Having to share data with an alternate app provider to rectify the = situation may also be a problem to some of those users, particularly if = that provider is based off-shore from the user. >>=20 >> If the goal is "child safe" environment, the core issue must be the = level of protection you provide for children not who provides, cost and = "convenience". And those DNS-filtering solutions cannot compare to the = client-side solution with regard to the level of protection due to their = access to the un-encrypted content and that they protect the children on = any network. >>=20 >> I strongly disagree that this "protect the children" is a valid = argument. >=20 > What people choose to use for parental control, internet filtering, = malware protection etc. is up to them, as is their choice in terms of = the level of protection it provides. You are not the arbiter of that. = You are entitled to your opinion of course, but that=E2=80=99s all it = is. DNS filtering is a valid use-case whether or not it meets your = personal definition of child safety (or malware protection or whatever). >=20 > Neil Cook > neil.cook@open-xchange.com >=20 > = --------------------------------------------------------------------------= ----------- > Open-Xchange AG, Rollnerstr. 14, 90408 Nuremberg, District Court = Nuremberg HRB 24738 > Managing Board: Rafael Laguna de la Vera, Carsten Dirks, Michael = Knapstein, Stephan Martin=20 > Chairman of the Board: Richard Seibt >=20 > European Office:=20 > Open-Xchange GmbH, Olper Huette 5f, D-57462 Olpe, Germany, District = Court Siegen, HRB 8718=20 > Managing Director: Frank Hoberg >=20 > US Office:=20 > Open-Xchange. Inc., 530 Lytton Avenue, Palo Alto, CA 94301, USA=20 > = --------------------------------------------------------------------------= ----------- >=20 > --=20 > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add --Apple-Mail=_0141A34D-EBD0-4F8E-A7C7-DF7A6B6065E6 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 I = agree.  People need to be able to make their own choice and someone = should not be making it for them. Just because some do not like the = solution or use-case does not mean it is not valid and does not meet the = need.


Thanks,
Bret
PGP = Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 = 0050
"Without = cryptography vihv vivc ce xhrnrw, however, the only thing that can not = be unscrambled is an = egg."

On Aug 16, 2019, at 5:00 AM, Neil Cook <neil.cook=3D40open-xchange.com@dmarc.ietf.org> = wrote:



On 16 Aug 2019, at 11:32, Frode Kileng <frodek@tele.no> = wrote:

On 16/08/2019 11:47, Andrew Campling wrote:
On 16/08/2019 07:56, = Frode Kileng <frodek@tele.no> wrote:

There are numerous other = client-side child-safe products in the markets that will
continue to work perfectly well. Please please stop using = this "save the children"
argument that has been fronted by = the "anti-encryption camp" for the last 5 years.
Whilst there may be alternative child-safe = products, it should be remembered that at least some ISPs provide = parental controls using DNS filtering (and malware protection) as part = of their service bundle, making it relatively simple for their customers = to configure and use the services.  These are generally provided at = no additional cost and, in some instances, are enabled by default. =  Having a protocol like DoH bypass such services without due = warning to those users is a problem.  Having to share data with an = alternate app provider to rectify the situation may also be a problem to = some of those users, particularly if that provider is based off-shore = from the user.

If the goal is = "child safe" environment, the core issue must be the level of protection = you provide for children not who provides, cost and "convenience". And = those DNS-filtering solutions cannot compare to the client-side solution = with regard to the level of protection due to their access to the = un-encrypted content and that they protect the children on any = network.

I strongly disagree that this = "protect the children" is a valid argument.

What people choose to use for parental = control, internet filtering, malware protection etc. is up to them, as = is their choice in terms of the level of protection it provides. You are = not the arbiter of that. You are entitled to your opinion of course, but = that=E2=80=99s all it is.  DNS filtering is a valid use-case = whether or not it meets your personal definition of child safety (or = malware protection or whatever).

Neil = Cook
neil.cook@open-xchange.com

---------------------------------------------------------------= ----------------------
Open-Xchange AG, Rollnerstr. 14, = 90408 Nuremberg, District Court Nuremberg HRB 24738
Managing Board: Rafael Laguna de la Vera, Carsten Dirks, = Michael Knapstein, Stephan Martin 
Chairman of = the Board: Richard Seibt

European = Office: 
Open-Xchange GmbH, Olper Huette = 5f, D-57462 Olpe, Germany, District Court Siegen, HRB = 8718 
Managing Director: Frank Hoberg
US Office: 
Open-Xchange. Inc., 530 = Lytton Avenue, Palo Alto, CA 94301, USA 
---------------------------------------------------------------= ----------------------

--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add

= --Apple-Mail=_0141A34D-EBD0-4F8E-A7C7-DF7A6B6065E6-- From nobody Fri Aug 16 09:43:03 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 56C4F12006D for ; Fri, 16 Aug 2019 09:43:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=netorgft5189650.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 26e6mZPdHyQh for ; Fri, 16 Aug 2019 09:43:00 -0700 (PDT) Received: from GBR01-CWL-obe.outbound.protection.outlook.com (mail-eopbgr110041.outbound.protection.outlook.com [40.107.11.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4A1241200F5 for ; Fri, 16 Aug 2019 09:43:00 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=TWlMBHePFYgovaobiCFUslH2T7AuSW06n48P5OEBhsHq1i0Uk9GM7/zW+X+c3rROWfIAmk6vCphilGfWMKD61yicCqKsm7FmafBPI9ValNMGC6nxlI8lUvmLqpqgLMVKFgE6rbGvvImVwnBkAYAyil5gyeLVT2W0D8InTAz2bIjPYns4OIfHKddsoZYoramLduXWbUXR7pXoZcKrBB5eGbydW7oPjQpm/U2KwU5wtbmVvHoUoeBEoXqPGn42JiPu2/yBieUg6qNhf2jO6DNMwePpip7T43tY5T9ouEddbOpWzvonEBoKlCRN5v75bJJxmU154AjpnqDor7iwvtEBjw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=g5D9CeTlUZlfjV57FPdbSndSqpANLUKtnW47g87FI0k=; b=mV+fPwUnBQ9prAOtpbGjP1De8S7KtUKeKr/BQQPJoyd029HzLrG4DV4KRnXGLS3htXw8gtwnxPgde031j4j94t+qAHO/zh1QmaBGd5AWEG8bgpG2PRKZhDYUnPEwC8fue/eHmd8zElTtksA3WSsxL/zl1Cuo40ybMnwfMfnxXScVSZ48D2mrHlozMnvcxbXlR01vJBF/nEU9bDmSU2t69L7tmqkY1NF0Rw0CIkYnYBOcq5E6mYMi69eDuEt3rmorFU5YLAbhSqmfp2awiCaGbOqSZ0BQ2pmLUagrClOc0LrIZAfTxk954Fz0lNTffXfXRMmJ8V68I6F3OAZL7hDBFg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=419.consulting; dmarc=pass action=none header.from=419.consulting; dkim=pass header.d=419.consulting; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=NETORGFT5189650.onmicrosoft.com; s=selector1-NETORGFT5189650-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=g5D9CeTlUZlfjV57FPdbSndSqpANLUKtnW47g87FI0k=; b=VBEkYkRej9Gg38OXA6NeFBh+ffHD4r0o0ESPP/MJFl9vX5mEYXVShsY0M0rYcZ8FXAISS2uWNG6Uj71WN4w3sST6LErAscxwTXVIclB7oy2Eqf6kaY9SfNb+vM4HOuLohlunTCC2I+AkFvfAa3gzWKsWEd0v/DRvGse7n5Wr7eE= Received: from LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM (20.176.138.146) by LO2P265MB0144.GBRP265.PROD.OUTLOOK.COM (10.166.105.141) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2178.16; Fri, 16 Aug 2019 16:42:57 +0000 Received: from LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM ([fe80::64e9:9b9e:59fc:26f]) by LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM ([fe80::64e9:9b9e:59fc:26f%5]) with mapi id 15.20.2157.022; Fri, 16 Aug 2019 16:42:57 +0000 From: Andrew Campling To: Ted Lemon , Brian Dickson CC: ADD Mailing list Thread-Topic: [Add] When Two Worlds Collide Thread-Index: AdVTdyCapVPyep9JQGykvKh9TBzsEAA1bSyAAABEi4AAAPAiMA== Date: Fri, 16 Aug 2019 16:42:57 +0000 Message-ID: References: <09178E42-08B2-4958-A1C8-AF507AEE8834@fugue.com> In-Reply-To: <09178E42-08B2-4958-A1C8-AF507AEE8834@fugue.com> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=andrew.campling@419.consulting; x-originating-ip: [2a00:23c4:a499:2e00:55a7:59be:7d65:cfb6] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: b6d6efcc-f608-411d-1f2f-08d72268cb41 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(7021145)(8989299)(4534185)(7022145)(4603075)(4627221)(201702281549075)(8990200)(7048125)(7024125)(7027125)(7023125)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:LO2P265MB0144; x-ms-traffictypediagnostic: LO2P265MB0144: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-forefront-prvs: 0131D22242 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(396003)(346002)(136003)(39830400003)(376002)(366004)(189003)(199004)(486006)(11346002)(446003)(46003)(476003)(74316002)(7736002)(86362001)(305945005)(44832011)(561944003)(71200400001)(53936002)(71190400001)(6246003)(14444005)(14454004)(256004)(508600001)(76176011)(7696005)(2906002)(6116002)(33656002)(4744005)(66946007)(5660300002)(229853002)(8676002)(25786009)(8936002)(81166006)(6506007)(52536014)(53546011)(76116006)(66476007)(66556008)(66446008)(64756008)(81156014)(99286004)(316002)(110136005)(55016002)(9686003)(6436002)(102836004)(186003)(4326008)(46492003); DIR:OUT; SFP:1101; SCL:1; SRVR:LO2P265MB0144; H:LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: 419.consulting does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: Jz+otIHD72MhLH6SMAcQiC/kT9R0GFVn02ZC2wWGCQKHgAs+cht08fatBKjUD95eU092BFQfZzZ8pqX3eahD9E8WG0L5LkI4EzbRRFt72qwZMffLiHqq9YIH876hFLpbHMb+arcifv4PH1rcceoY+kcxpyhYBecN54wIos+9kzusUjG/CK7kTXt31fbzLv3DB84gtmz82u8eKiTiL31rH0mgsJ/WX8irmL3I7sMGa2ABFxPOkCJo6f8zv8ZvhTp9paQJgeM1vUUCvISqAHZN/cQhZrvOufXFBWJGWZRSkfxhddZcjutNT5TC1W3a3S8Aj5AKah2HDZH8JLTbjFckdBQoSjhW212TPX1rjKCP8ZCxI2vLFDyv0K3jveoARHXkbIv2ALLBD363axYWguWKEob1q/qFg6hHPs686twYO4M= x-ms-exchange-transport-forked: True Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: 419.consulting X-MS-Exchange-CrossTenant-Network-Message-Id: b6d6efcc-f608-411d-1f2f-08d72268cb41 X-MS-Exchange-CrossTenant-originalarrivaltime: 16 Aug 2019 16:42:57.7430 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 9c2ced3e-7522-4755-87dc-f983abc66ec3 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: nFx1HQ6HGllHc7iXV0Hy4IXZhqCTXnqYmZRkfxY27tkh/MBGzQMvquWuJ3de2WIHa5jx1Xmswkh10JN4k5887jaeC9OMm+9SnINeKFyF5Y4= X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO2P265MB0144 Archived-At: Subject: Re: [Add] When Two Worlds Collide X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 16:43:02 -0000 T24gQXVnIDE2LCAyMDE5LCBhdCAxNzoxNiwgVGVkIExlbW9uIDxtZWxsb25AZnVndWUuY29tPiB3 cm90ZToNCg0KPiBJdCB3b3VsZCBiZSBoZWxwZnVsIGlmIHdlIGNvdWxkIGFja25vd2xlZGdlIHRo YXQgaW4gdGhlIGFic2VuY2Ugb2YgYSBjb21wbGV0ZWx5IGxvY2tlZCBkb3duIA0KPiB1c2VybGFu ZCBvbiBhIGRldmljZSB3aXRoIHNlY3VyZSBib290IHZhbGlkYXRpb24sIHRoaXMgaXMgY29tcGxl dGVseSBpbXBvc3NpYmxlLCBhbmQgYW55IHByb3Bvc2FsIA0KPiB0aGF0IGlzIGJhc2VkIG9uIHRo ZSBhc3N1bXB0aW9uIHRoYXQgaXQgaXPCoHBvc3NpYmxlIGlzIG5vdCB3b3J0aCBzcGVuZGluZyB0 aW1lIGRvY3VtZW50aW5nLiDCoE9yIA0KPiBpZiBpdCBpcyB3b3J0aCBzcGVuZGluZyB0aW1lIGRv Y3VtZW50aW5nLCBJIGhhdmVu4oCZdCBoZWFyZCBhIGdvb2QganVzdGlmaWNhdGlvbiBmb3Igd2h5 IHRoYXTigJlzIHNvLg0KDQpQZXJoYXBzIHlvdSBjb3VsZCB5b3Ugc3VnZ2VzdCBhbiBhbHRlcm5h dGUgY2hhcmFjdGVyaXNhdGlvbiBvZiB0aGUgcmVsZXZhbnQgdXNlIGNhc2VzPyAgT3IgaXMgaXQg eW91ciB2aWV3IHRoYXQgdGhlcmUgaXMgb25seSBhIHNpbmdsZSB2YWxpZCB1c2UgY2FzZT8gIA0K From nobody Fri Aug 16 10:00:37 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 25E8A120815 for ; Fri, 16 Aug 2019 10:00:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RUyDYYsysMRF for ; Fri, 16 Aug 2019 10:00:33 -0700 (PDT) Received: from gro.dd.org (host2.dlawren-3-gw.cust.sover.net [207.136.201.30]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D7FFC1200F4 for ; Fri, 16 Aug 2019 10:00:31 -0700 (PDT) Received: by gro.dd.org (Postfix, from userid 102) id 515F2102394; Fri, 16 Aug 2019 13:00:28 -0400 (EDT) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <23894.57644.315545.989451@gro.dd.org> Date: Fri, 16 Aug 2019 13:00:28 -0400 From: Dave Lawrence To: ADD Mailing list In-Reply-To: <3A961AB0-1D58-466B-8155-4F614A84BD66@fugue.com> References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <8e00891f-2aa2-ee11-559a-b5a8967b22d9@nostrum.com> <2C23D415-84F9-4B6C-B67B-0CC3EB600520@gmail.com> <2704899B-E43D-4978-A3C9-30E9E7CEBEBD@fugue.com> <4CC4C262-BEF4-4B39-ACB1-A595AB66D6CD@gmail.com> <23893.60122.817218.615568@gro.dd.org> <6402e345-ce5e-da66-5b16-35412d50801d@cs.tcd.ie> <3A961AB0-1D58-466B-8155-4F614A84BD66@fugue.com> Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 17:00:36 -0000 Ted Lemon writes: > So it would probably be better for your security to connect directly > to the ISP s DoH resolver, and make sure that your DoH client doesn't > send PII while doing the query. FWIW some of the filtering products rely on PII for per-device customization, so for example the kids' devices can be treated different than the parents. From nobody Fri Aug 16 10:04:38 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2A8F912008D for ; Fri, 16 Aug 2019 10:04:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Phd82QD7eMFX for ; Fri, 16 Aug 2019 10:04:30 -0700 (PDT) Received: from mail-qk1-x732.google.com (mail-qk1-x732.google.com [IPv6:2607:f8b0:4864:20::732]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B097012006D for ; Fri, 16 Aug 2019 10:04:30 -0700 (PDT) Received: by mail-qk1-x732.google.com with SMTP id s145so5261357qke.7 for ; Fri, 16 Aug 2019 10:04:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=FNUGHeAKcV9wacerXmJ0W4ZNdawq63OztJD6MqfnpIs=; b=mFdRJ2vO3QK32Vb2sddtX16hCxCs/glKTt86dfC7PkGDXI67WNJlzgQ6llD0Dsu3ky bbxEk+9T0MZmXU4VK/Dnr/yyBpcXw5L7iM4215kMMRTk29k/URo5dH5PWevb/p5trg1F YM1f9db0FYMhvtNgVrvGFDBvqENrFZIoMxkywOhAgbvYcZFVMo0u11J7hntFl8yTerV5 voN410tWgPCE8MLckDDjAgVqOSjJJaQdRWTqXYfdu5l9q5ujaO+LxpC31QsNVZNgeUD2 6w4L/8yU72a+rm08lwDCz8aoL/pYVAvlCltRYW+iFeC5Yo6R8bxcuUqEQOuH0nlUxegX HgyA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=FNUGHeAKcV9wacerXmJ0W4ZNdawq63OztJD6MqfnpIs=; b=EziCDa26AcqhvYbdWk/pogO7GAcwXKxb1Z8I8zKpzGESgca0GkjIlnc4z69+rgnE8v y2/oMY0JYTq+FH+QLJL9VYvD0jteXxPVWPsU6gEGCC8buVUCPCU2Vl4spBAwLjoxMYVu ls08q64Kk/d+wpHDZP6YkevsNW1JSqRSUA5B76CGCrgJwD8818KtJotjCV4EIsmfusYX 43WNnsYA5DgowFLGgs1m29Jko8vCWG9eDWjFACwkoqb8uKlHBI4FzFi7P7AZ+yxHJuvK P3zd1olTnv34osYLRcH8bzM6ke6F+QFOjXG0f1MFyOlRXR3l4w2VnUUzCnWBm3nQHPFP QiPw== X-Gm-Message-State: APjAAAUHSFjTx1+hkoXVI7I3WYvMX+0yZAjNMRF+iTyq0883pdmeZSxo 9hb9g+/3qxrxqLwxz1R2oY9AMg== X-Google-Smtp-Source: APXvYqwGc8k4AMJh5kBumID5f1ituXj0Rg5H12x6cIvMCdefqUSBVyrDs8SlvTW1CcoyiwyYQMDOyg== X-Received: by 2002:a37:71c7:: with SMTP id m190mr9931762qkc.47.1565975069631; Fri, 16 Aug 2019 10:04:29 -0700 (PDT) Received: from ?IPv6:2001:470:c1a2:1:7ded:86d1:e927:7777? ([2001:470:c1a2:1:7ded:86d1:e927:7777]) by smtp.gmail.com with ESMTPSA id 136sm3414793qkg.96.2019.08.16.10.04.28 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 16 Aug 2019 10:04:29 -0700 (PDT) From: Ted Lemon Message-Id: <0BDD4F7F-7301-476A-80DA-0CC84EE4557D@fugue.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_1C196A0B-C074-44A2-BACB-FA759E881B84" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Fri, 16 Aug 2019 10:04:27 -0700 In-Reply-To: Cc: Brian Dickson , ADD Mailing list To: Andrew Campling References: <09178E42-08B2-4958-A1C8-AF507AEE8834@fugue.com> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] When Two Worlds Collide X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 17:04:37 -0000 --Apple-Mail=_1C196A0B-C074-44A2-BACB-FA759E881B84 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 On Aug 16, 2019, at 9:42 AM, Andrew Campling = wrote: > Perhaps you could you suggest an alternate characterisation of the = relevant use cases? Or is it your view that there is only a single = valid use case? =20 Security is always about tradeoffs. There is no such thing as absolute = security. The IETF is doing a lot of hard work to try to make the = ecosystem as secure as possible. This is a different strategy than the = lock-everything-down strategy I just described. But e.g. take a look = at the work being done in TEEP and SUIT. The reason that the security geeks are reacting the way we are to this = discussion is that DoH is part of making the ecosystem as secure as = possible. It is not the only way to do this, but when you compare the = costs and benefits of using DoH to the costs and benefits of trusting = the network=E2=80=99s resolver, it=E2=80=99s pretty clear which of these = choices makes the ecosystem more secure. It=E2=80=99s also clear that = this has a cost in some cases: in some cases the network=E2=80=99s = resolver really is more secure. But we don=E2=80=99t have a way to = validate that assertion, and even if we did, we don=E2=80=99t have a way = to enforce it without locking things down as I described. But again, if your use case is =E2=80=9Csecure, locked down,=E2=80=9D = then do the work to make that happen. Don=E2=80=99t pretend that DHCP = is secure. Don=E2=80=99t pretend that Do53 is secure. The hard shell, = gooey interior model of network security has been definitely shown to be = invalid. If you still imagine that this model works, it=E2=80=99s = going to be hard to have a meaningful discussion. There are real scenarios where we must have the locked down network that = only allows locked down devices to participate. And we don=E2=80=99t = fully understand how to do that. This is an important area of research. = We need this, e.g. for cars, airplanes, power plants, banks, etc. = But the presence or absence of DoH support in Firefox is not going to = make an iota of difference for these use cases. These use cases = require you to assume that DoH is present, and act accordingly, treating = rogue DoH as a threat, and considering friendly DoH that has been = authenticated as a potential piece of the solution. --Apple-Mail=_1C196A0B-C074-44A2-BACB-FA759E881B84 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 On = Aug 16, 2019, at 9:42 AM, Andrew Campling <andrew.campling@419.consulting> wrote:
Perhaps you could you suggest an alternate characterisation = of the relevant use cases?  Or is it your view that there is only a = single valid use case?  

Security is always about tradeoffs.   = There is no such thing as absolute security.  The IETF is doing a = lot of hard work to try to make the ecosystem as secure as possible. =  This is a different strategy than the lock-everything-down = strategy I just described.   But e.g. take a look at the work being = done in TEEP and SUIT.

The reason that the security geeks are reacting the way we = are to this discussion is that DoH is part of making the ecosystem as = secure as possible.  It is not the only way to do this, but when = you compare the costs and benefits of using DoH to the costs and = benefits of trusting the network=E2=80=99s resolver, it=E2=80=99s pretty = clear which of these choices makes the ecosystem more secure. =  It=E2=80=99s also clear that this has a cost in some cases: in = some cases the network=E2=80=99s resolver really is more secure.   But we don=E2=80=99t have a = way to validate that assertion, and even if we did, we don=E2=80=99t = have a way to enforce it without locking things down as I = described.

But = again, if your use case is =E2=80=9Csecure, locked down,=E2=80=9D then = do the work to make that happen.  Don=E2=80=99t pretend that DHCP = is secure.  Don=E2=80=99t pretend that Do53 is secure.   The = hard shell, gooey interior model of network security has been definitely = shown to be invalid.   If you still imagine that this model works, = it=E2=80=99s going to be hard to have a meaningful discussion.

There are real scenarios = where we must have the locked down network that only allows locked down = devices to participate.   And we don=E2=80=99t fully understand how = to do that.  This is an important area of research.   We need = this, e.g. for cars, airplanes, power plants, banks, etc.   But the = presence or absence of DoH support in Firefox is not going to make an = iota of difference for these use cases.   These use cases require you to assume that DoH is present, and act accordingly, = treating rogue DoH as a threat, and considering friendly DoH that has = been authenticated as a potential piece of the = solution.

= --Apple-Mail=_1C196A0B-C074-44A2-BACB-FA759E881B84-- From nobody Fri Aug 16 10:07:07 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A77D112008D for ; Fri, 16 Aug 2019 10:07:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LWGd6XrRWPKv for ; Fri, 16 Aug 2019 10:07:04 -0700 (PDT) Received: from mail-qt1-x836.google.com (mail-qt1-x836.google.com [IPv6:2607:f8b0:4864:20::836]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0B43C12006D for ; Fri, 16 Aug 2019 10:07:04 -0700 (PDT) Received: by mail-qt1-x836.google.com with SMTP id q4so6856915qtp.1 for ; Fri, 16 Aug 2019 10:07:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=SSef1GgufdQREtUolouhskrwAXsannlyydce7EnJ4ow=; b=fAjwgMNi4qqcaCjjuiDtxna+WHRGwf9tBx12G6PFf1TyvFJG0aw0oMaQdJ9U6aJunp VyZgpiB5Dw5O10jf3CCDoGNZcOyadvzY3h7FWtwJ20DDTUXCvG3umdtLHlKEBztxSO1I Jlj/gnlA/SelXpMxCLDo7r2nsmvF8AqAuNYmZblluEwGbALwPUqMpCzkDgj6M7bPHCeK JS3N5bw0sEiYTxKkBulGcU24i0U6tAKHB4e/amkZyY0CkM78wX+GWmU0mJ40PhrAiLUJ elkPaZaR06ib9nYoQNvgkJmJtp5EHjJ08Yky0eNkzmfh498X5sDu9h7wf+vUflP/8VcW M5PQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=SSef1GgufdQREtUolouhskrwAXsannlyydce7EnJ4ow=; b=PBJsVTqzhhEqzsc+trriqi+8IHg6wyp94aDF59eHt7kQD3yOgofkFxiegL2SzOS3bY DVr0SxLd1B9OAyn+CoFfT+sYtOHB2tqTBnYNPfPUxc53nJJu9ssLWsmoBxc1AREXcXno N06hBysJjPtM5WNB1ukgYC9AYi6xZjKqnmk0vwccGCcyoXa8Ed+x3QPYPtrClz80Bfxh FU7IWKxZVHXvjCKpWuM6Pt9aqlcgQ1vIrzavQOqhUSZoWp3OuYZv8dpR6HqQdXa7wFxf xEdaos3shgWo4yjI//+O68uV8l2BSQYcrOImRWi2mUG7D6WoNn6jOgdG4pFd3iLy0ud5 vZOA== X-Gm-Message-State: APjAAAUS8vj1hqAZGpe+7tjaPtRa8kTpxYWCbYtDov6DpQ3OBRwmgkvJ cn72F541VrzefUbmunsv9Cc08A== X-Google-Smtp-Source: APXvYqwTR340rLRSM65s0DNYcCysXghh+6Hp/+lVBaXsd9zNj4SIn5OzdKcHQzEBK3PuesUS/EZweA== X-Received: by 2002:ac8:35f7:: with SMTP id l52mr9740667qtb.299.1565975223200; Fri, 16 Aug 2019 10:07:03 -0700 (PDT) Received: from ?IPv6:2001:470:c1a2:1:7ded:86d1:e927:7777? ([2001:470:c1a2:1:7ded:86d1:e927:7777]) by smtp.gmail.com with ESMTPSA id d71sm3282402qkg.70.2019.08.16.10.07.02 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 16 Aug 2019 10:07:02 -0700 (PDT) From: Ted Lemon Message-Id: <02F583C7-7798-4E56-B708-F57F65C3695D@fugue.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_199AEC9A-4A00-435B-AA03-AA43111BBFA2" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Fri, 16 Aug 2019 10:07:00 -0700 In-Reply-To: <23894.57644.315545.989451@gro.dd.org> Cc: ADD Mailing list To: Dave Lawrence References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <8e00891f-2aa2-ee11-559a-b5a8967b22d9@nostrum.com> <2C23D415-84F9-4B6C-B67B-0CC3EB600520@gmail.com> <2704899B-E43D-4978-A3C9-30E9E7CEBEBD@fugue.com> <4CC4C262-BEF4-4B39-ACB1-A595AB66D6CD@gmail.com> <23893.60122.817218.615568@gro.dd.org> <6402e345-ce5e-da66-5b16-35412d50801d@cs.tcd.ie> <3A961AB0-1D58-466B-8155-4F614A84BD66@fugue.com> <23894.57644.315545.989451@gro.dd.org> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 17:07:06 -0000 --Apple-Mail=_199AEC9A-4A00-435B-AA03-AA43111BBFA2 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 On Aug 16, 2019, at 10:00 AM, Dave Lawrence wrote: > FWIW some of the filtering products rely on PII for per-device > customization, so for example the kids' devices can be treated > different than the parents. I=E2=80=99m aware of this. However, it=E2=80=99s not a requirement that = it be done this way. It would be just as good for the device to just = say what filter properties it wants. This could still be used to = fingerprint the device, but would not be PII per se. --Apple-Mail=_199AEC9A-4A00-435B-AA03-AA43111BBFA2 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 On = Aug 16, 2019, at 10:00 AM, Dave Lawrence <tale@dd.org> = wrote:
FWIW some of = the filtering products rely on PII for per-device
customization, = so for example the kids' devices can be treated
different = than the parents.

I=E2=80=99m aware of this.  However, it=E2=80=99s not a = requirement that it be done this way.   It would be just as good = for the device to just say what filter properties it wants.  This = could still be used to fingerprint the device, but would not be PII per = se.

= --Apple-Mail=_199AEC9A-4A00-435B-AA03-AA43111BBFA2-- From nobody Fri Aug 16 10:34:13 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 30D691200B8 for ; Fri, 16 Aug 2019 10:34:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FlU3bnrmgWb9 for ; Fri, 16 Aug 2019 10:34:09 -0700 (PDT) Received: from mail-lf1-x130.google.com (mail-lf1-x130.google.com [IPv6:2a00:1450:4864:20::130]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 033501200B3 for ; Fri, 16 Aug 2019 10:34:09 -0700 (PDT) Received: by mail-lf1-x130.google.com with SMTP id v16so1518361lfg.11 for ; Fri, 16 Aug 2019 10:34:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=qvfx4Hp6SX0wCnamHa432XtxHZJ4MX+QTFZvO1JlftY=; b=WPdSJUOAyVcQh6UJmxnLFJ4ThWtJXoMnkAWBesqUfnsBmZT2c3LoxUUinr1k8TRYLK /jbNjRy5LOdDKdjcrfOp2zHIBy2pMxH1aBI5PUZfrM00jW3/4L398qHU+lHYGYVTsLY8 7+mxGc0m80ujtCPdrHm8/qk6JPvJZU4HXFqxQEnlGCR8pMYZk5UESGLchb9VnuAhXlOV b5wiS3vqqQESTilUD2qH7zdAC22EQ5mvkxOZaaleR2oHDZOSDblJovrcQ42NGiXpGgRW FP7omDLQelzfC98RbmjH6HMuWxwcl1AnaN7pUTE/75vW7yv7otRahCNiF4d0ddOIu61A kpug== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=qvfx4Hp6SX0wCnamHa432XtxHZJ4MX+QTFZvO1JlftY=; b=TDWONzBWO4l7A1nmDJ+p82CwVuN/BfiN5U4uaMVNHWXZ8YONTEqRXJtw9ffAt7Lmgf NHQ/8lIsGlU3sBYi7AXXlCWekEPwKg0bXpDfPldInIiQQFNlY6Z2nyPNCTXzSrHNkKSC 3IfmlDcDUH1BE3PXhXkBUXSclkJcQXpz0k+xwXCHD0VmoyxfyDYpsGSkUA1NKYUoe7EJ 8RGMUc7Y+5RhcDrGsXViNbO4hLmqExxr+RztMUFTBzEUDYHSF/Doo5qQiokTIy4qfyuB QMpTcfc/JnQMSVVSEtYdu0U1IqHHaPtmFh6+QZF+QI6Ab94T5QGvpOu25pGZpKLPrgzI rdcA== X-Gm-Message-State: APjAAAV6viRWgkzbvxzLmP0LMfoVT6ChEzx8u4BXU6P9PKLw8/5xqgoT AY2PZIs2pGp1jeafDSVo3o+eKEabHCwpnBUO/rW3ug== X-Google-Smtp-Source: APXvYqzRLqGl4FNI8aGJ3z1JYP1XuLww8RtcNtK6ayVeb6kWJghr72YfhWGAqaQbs/76EidCQwXrGWlOa0y+f1XZx9k= X-Received: by 2002:ac2:442d:: with SMTP id w13mr6172753lfl.184.1565976847212; Fri, 16 Aug 2019 10:34:07 -0700 (PDT) MIME-Version: 1.0 References: <400b774a-5bd0-d6f4-5640-e561f067a9b5@cs.tcd.ie> <74A2E5E0-02CE-4C9D-A66B-1D2FBC65B39A@frobbit.se> <3611F27A-49A9-4159-A683-3BBD4C2F91EA@frobbit.se> <904F4219-8BDE-4272-BFDA-20F38D58CB80@frobbit.se> <85CF7EE9-51B8-4431-BCE5-7EA2B9AAF892@frobbit.se> In-Reply-To: From: Eric Rescorla Date: Fri, 16 Aug 2019 19:33:29 +0200 Message-ID: To: Andrew Campling Cc: =?UTF-8?B?UGF0cmlrIEbDpGx0c3Ryw7Zt?= , Alec Muffett , ADD Mailing list , Stephen Farrell Content-Type: multipart/alternative; boundary="000000000000b4765d05903f653a" Archived-At: Subject: Re: [Add] Use Cases - the coffee shop X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 17:34:11 -0000 --000000000000b4765d05903f653a Content-Type: text/plain; charset="UTF-8" On Fri, Aug 16, 2019 at 6:35 PM Andrew Campling wrote: > On Fri, Aug 16, 2019 at 11:25 AM Eric Rescorla wrote: > > > and even when it's an ISP, the privacy policies are opaque and there is > a fairly long history of bad behaviour. The intent of TRR is that the > application provider is able to negotiate for and assure an acceptable > privacy policy on the user's behalf. > > I think we should be careful to generalise given the significant > differences between geographies. We should also acknowledge that, > unfortunately, many applications providers have long and opaque privacy > policies* coupled with a long history of bad behaviour, especially > regarding privacy violations, that continues (noting ongoing investigations > in the EU, US and elsewhere). > Fortunately, no speculation is needed because the privacy requirements for the Mozilla TRR program are short and readily available. https://wiki.mozilla.org/Security/DOH-resolver-policy -Ekr --000000000000b4765d05903f653a Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Fri, Aug 16, 2019 at 6:35 PM Andre= w Campling <andrew.campling@419.consulting> wrote:
On Fri, Aug 16, 2019 at 11:25 AM E= ric Rescorla <ekr@rtfm= .com> wrote:

> and even when it's an ISP, the privacy policies are opaque and the= re is a fairly long history of bad behaviour. The intent of TRR is that the= application provider is able to negotiate for and assure an acceptable pri= vacy policy on the user's behalf.

I think we should be careful to generalise given the significant difference= s between geographies. We should also acknowledge that, unfortunately, many= applications providers have long and opaque privacy policies* coupled with= a long history of bad behaviour, especially regarding privacy violations, = that continues (noting ongoing investigations in the EU, US and elsewhere).=

Fortunately, no speculation is needed= because the privacy requirements for the Mozilla TRR program are short and= readily available. https://wiki.mozilla.org/Security/DOH-resolver-policy
<= div>
-Ekr

--000000000000b4765d05903f653a-- From nobody Fri Aug 16 10:53:52 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 63B581200FF for ; Fri, 16 Aug 2019 10:53:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SKs9y0weVINM for ; Fri, 16 Aug 2019 10:53:44 -0700 (PDT) Received: from mail-pf1-x42b.google.com (mail-pf1-x42b.google.com [IPv6:2607:f8b0:4864:20::42b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C012B1200CD for ; Fri, 16 Aug 2019 10:53:44 -0700 (PDT) Received: by mail-pf1-x42b.google.com with SMTP id 129so3485542pfa.4 for ; Fri, 16 Aug 2019 10:53:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:content-transfer-encoding:mime-version:subject:date:references :to:in-reply-to:message-id; bh=RonZlwsBn2s9yjYCAfelopQU7VG4nFXLH/s4g5Psq0w=; b=MBEMBr/ceNb6eXZ6N7zf7tpU5nFFqXJJ75soZ0SKx3l4v/KjD5FoZxeILYKRAmzJNE LlvLpTiNCKgvuSnbPcj4EunSFbJCPvqaaOuKiKpQ1b3lgDeCAu4ok2cOhYrMzGs+5s3/ fj/K7hRRnsIFhxUBtn43ZL8B4r0m9eEa4dd1VTLFNLt7CLG+l4oMSU4FvZxN7206T1d9 hnjZgrkodQFzmQwKp1vYhz+NMTRJN95C0NPdYmJxpJneiWKlZvsT1iYiPJZDtXXe7mHq za3A5Hdn9xhkGLta1rIpdwIINJIykIHNAQFOlLUXUVJ9Ds9ZpT/b44nH2oinSWoBMSiU zA4g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:content-transfer-encoding:mime-version :subject:date:references:to:in-reply-to:message-id; bh=RonZlwsBn2s9yjYCAfelopQU7VG4nFXLH/s4g5Psq0w=; b=ONGPDXPp92eHk9XW3TR5dKTm4F+T0lnrxuLkbKIicaEOz/BkC7tbCa+WK0rxMp9twB 5N93XH+eP1pMEH6+sQ+n4h+6CZlGP2F+pUFz3njWZ5Ny8IE68WS76jJo1EeZnB7lvhgD OG1SCJ0sf4UZkwQDjE879xD7jZw6G04ec/eUu9WIAkVJFIKXdFCailhdTJfa/KJEhxxv s2P66bC/BmGjNSKvceN3ex9KWPXF2h6r+sH/fhXcLUB8xHnIAuUTaptSmD6G0G+mC7Ob 0FsnNi5/siNcw1fekntbB4ay2Mk3522SEhPDfkr98i1YicXnpiUNTH6m+v9/0LgAiaoL KZrw== X-Gm-Message-State: APjAAAXA4aKX7VfKfk/+tOoJ6cE5hXuCpXFJ933NlsHyfBOdiLLNyez6 KHcMINZps5wZRdqZZeNoMzs= X-Google-Smtp-Source: APXvYqxajPjpqKna0hB6GN7EvubwduFqwvsEgkXWu/DZow+x/h3Lg6PW7LYMPJQNDqRa3k0sNJYpAg== X-Received: by 2002:a62:3347:: with SMTP id z68mr12256053pfz.174.1565978024464; Fri, 16 Aug 2019 10:53:44 -0700 (PDT) Received: from [10.128.64.148] ([136.60.227.81]) by smtp.gmail.com with ESMTPSA id o129sm7234536pfg.1.2019.08.16.10.53.43 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 16 Aug 2019 10:53:43 -0700 (PDT) From: Bret Jordan Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Fri, 16 Aug 2019 11:53:42 -0600 References: <09178E42-08B2-4958-A1C8-AF507AEE8834@fugue.com> <0BDD4F7F-7301-476A-80DA-0CC84EE4557D@fugue.com> To: Ted Lemon , ADD Mailing list In-Reply-To: <0BDD4F7F-7301-476A-80DA-0CC84EE4557D@fugue.com> Message-Id: X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] When Two Worlds Collide X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 17:53:48 -0000 > It is not the only way to do this, but when you compare the costs and = benefits of using DoH to the costs and benefits of trusting the = network=E2=80=99s resolver, it=E2=80=99s pretty clear which of these = choices makes the ecosystem more secure. =20 In your opinion. The problem with this whole debate is the absolutes = and claiming that one=E2=80=99s opinion is the consensus or is by = default the best thing to do. Where is the research and data that backs = that up? =20 Bret= From nobody Fri Aug 16 10:57:14 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 866CA1200D5 for ; Fri, 16 Aug 2019 10:57:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kBSUAIp2Q567 for ; Fri, 16 Aug 2019 10:57:10 -0700 (PDT) Received: from mail-pf1-x435.google.com (mail-pf1-x435.google.com [IPv6:2607:f8b0:4864:20::435]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6052712009C for ; Fri, 16 Aug 2019 10:57:10 -0700 (PDT) Received: by mail-pf1-x435.google.com with SMTP id d85so3500511pfd.2 for ; Fri, 16 Aug 2019 10:57:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=jhJYLpJPQoJUDSRheHXrXFOxK7NYRB6wlJSl83jQJc8=; b=ljrMbGmtm27yeTizpdPqrpIg3EYocNhXXgVTO0OrWpp5F9T73AEbYiYjLZWUwHVTmS o+8BwFnZ0l8AViy5OU0Z9EeRaADuRsI7Nfi7ouyrAH+GQl3vOF+yb4GnHgyp38TDcC64 GSCYXHQQ+O1+DcwVhhn1bS5zLxebnK88ghTAGFoQ2PEF5aJZeIS6CgMHQI15BVEUkLFq I89+0rd5acT1jFfcEYZ4oJPOe4GuJbn0xhTfIOLsYLWc+RRnEcuqnRfHC5pFGsh44V4B YLCzZcvqUBJfrmvFcdzPiV9c5sfTrLqstpJKnApXhiRAmiK8kkvB5WqGMXVYBR65wu3I y31Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=jhJYLpJPQoJUDSRheHXrXFOxK7NYRB6wlJSl83jQJc8=; b=B/iqXUmbFFRFVAOjz19e60YcrZMw6M6QUjw16lAmIaqN+W//EMzoSfMQ0+5UxKb7F1 DrGA5bBAgpct35f/sCs5ik97W+CqmDGSi16FLOAqlOYEx09ghdouxyCALWCpH6cIxmRR m/VJuot5nY+UKoLus9VIHomALDKt/+Syz5CZSKMSCAiZxDUvpWM9TxAATbJ2C+2XpYtQ cWmylb3ic5IY37D0wf2qTRLIamxhEkWRMR+T5tM/EXBfgDZP/9OxjLemjEa21M8mDavG +1vEJ2GEWKORzYn3p4Oz76t15S7/XUgJOUh1vopZ9LlFCab08cU1Rsxyu1JszXXwILOj zJCg== X-Gm-Message-State: APjAAAWxTw07rBhZ5UyWXYH7htmlYVrSARJVsfBtJMr2ycVtNMWaq3EM RFisrQ1tyPRL6KiiIN1dzMQ= X-Google-Smtp-Source: APXvYqxiqM/3AouLnAYJ+qXfle9Y4hlHvDHwraCLU1q3UnjtwU6UeGY2gIutpoPfqRs3DQ9jp3+tuQ== X-Received: by 2002:a17:90a:2c9:: with SMTP id d9mr8481609pjd.134.1565978229919; Fri, 16 Aug 2019 10:57:09 -0700 (PDT) Received: from [10.128.64.148] ([136.60.227.81]) by smtp.gmail.com with ESMTPSA id i124sm7305785pfe.61.2019.08.16.10.57.08 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 16 Aug 2019 10:57:09 -0700 (PDT) From: Bret Jordan Message-Id: Content-Type: multipart/alternative; boundary="Apple-Mail=_4CB386F4-E6AA-4A93-AFC0-48EF8962ED70" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Fri, 16 Aug 2019 11:57:07 -0600 In-Reply-To: Cc: Andrew Campling , =?utf-8?B?UGF0cmlrIEbDpGx0c3Ryw7Zt?= , Stephen Farrell , ADD Mailing list , Alec Muffett To: Eric Rescorla References: <400b774a-5bd0-d6f4-5640-e561f067a9b5@cs.tcd.ie> <74A2E5E0-02CE-4C9D-A66B-1D2FBC65B39A@frobbit.se> <3611F27A-49A9-4159-A683-3BBD4C2F91EA@frobbit.se> <904F4219-8BDE-4272-BFDA-20F38D58CB80@frobbit.se> <85CF7EE9-51B8-4431-BCE5-7EA2B9AAF892@frobbit.se> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] Use Cases - the coffee shop X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 17:57:13 -0000 --Apple-Mail=_4CB386F4-E6AA-4A93-AFC0-48EF8962ED70 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii How are these audited and verified? Who does this auditing and = verification? How frequently is it done? Are the auditors beholden to = any disclosure restrictions? My concerns I raised before are still valid. I also hold that this is = one of the biggest concerns I have: 1) The potential for involuntary mass centralization of DNS data and the = consistent erosion of privacy that comes from it=20 Thanks, Bret PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 "Without cryptography vihv vivc ce xhrnrw, however, the only thing that = can not be unscrambled is an egg." > On Aug 16, 2019, at 11:33 AM, Eric Rescorla wrote: >=20 >=20 >=20 > On Fri, Aug 16, 2019 at 6:35 PM Andrew Campling = wrote: > On Fri, Aug 16, 2019 at 11:25 AM Eric Rescorla > wrote: >=20 > > and even when it's an ISP, the privacy policies are opaque and there = is a fairly long history of bad behaviour. The intent of TRR is that the = application provider is able to negotiate for and assure an acceptable = privacy policy on the user's behalf. >=20 > I think we should be careful to generalise given the significant = differences between geographies. We should also acknowledge that, = unfortunately, many applications providers have long and opaque privacy = policies* coupled with a long history of bad behaviour, especially = regarding privacy violations, that continues (noting ongoing = investigations in the EU, US and elsewhere).=20 >=20 > Fortunately, no speculation is needed because the privacy requirements = for the Mozilla TRR program are short and readily available. = https://wiki.mozilla.org/Security/DOH-resolver-policy = >=20 > -Ekr >=20 > --=20 > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add --Apple-Mail=_4CB386F4-E6AA-4A93-AFC0-48EF8962ED70 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii How = are these audited and verified?  Who does this auditing and = verification?  How frequently is it done?  Are the auditors = beholden to any disclosure restrictions?

My concerns I raised before are still = valid.  I also hold that this is one of the biggest concerns I = have:

1) The potential for involuntary mass = centralization of DNS data and the consistent erosion of privacy that = comes from it




Thanks,
Bret
PGP = Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 = 0050
"Without = cryptography vihv vivc ce xhrnrw, however, the only thing that can not = be unscrambled is an = egg."

On Aug 16, 2019, at 11:33 AM, Eric Rescorla <ekr@rtfm.com> = wrote:



On Fri, Aug 16, 2019 at 6:35 PM Andrew = Campling <andrew.campling@419.consulting> wrote:
On Fri, Aug 16, 2019 at 11:25 AM Eric = Rescorla <ekr@rtfm..com> wrote:

> and even when it's an ISP, the privacy policies are opaque and = there is a fairly long history of bad behaviour. The intent of TRR is = that the application provider is able to negotiate for and assure an = acceptable privacy policy on the user's behalf.

I think we should be careful to generalise given the significant = differences between geographies. We should also acknowledge that, = unfortunately, many applications providers have long and opaque privacy = policies* coupled with a long history of bad behaviour, especially = regarding privacy violations, that continues (noting ongoing = investigations in the EU, US and elsewhere).

Fortunately, no speculation is needed because the privacy = requirements for the Mozilla TRR program are short and readily = available. https://wiki.mozilla.org/Security/DOH-resolver-policy
=

-Ekr

--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add

= --Apple-Mail=_4CB386F4-E6AA-4A93-AFC0-48EF8962ED70-- From nobody Fri Aug 16 11:05:41 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 669161200CD for ; Fri, 16 Aug 2019 11:05:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=umich.edu Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id U2jaShl9hUhm for ; Fri, 16 Aug 2019 11:05:37 -0700 (PDT) Received: from mail-lj1-x232.google.com (mail-lj1-x232.google.com [IPv6:2a00:1450:4864:20::232]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 19CCE12009C for ; Fri, 16 Aug 2019 11:05:36 -0700 (PDT) Received: by mail-lj1-x232.google.com with SMTP id x18so6100941ljh.1 for ; Fri, 16 Aug 2019 11:05:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=umich.edu; s=google-2016-06-03; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=lv0H/F2OzsGGCi17NoMV26+em9YH0GZ2vcU+J2uihFc=; b=YK42NzwBUODjh07G34sq4r53CACGk4Pccb87rDnap2nIFOU7EH1vc4YKgx+T9nltPj 9VA4/gQAZbMkb1K+Zfm63oJca7TqL8Bwp0Iygv5qGoRI3p1gOrBGrrBtQDz1vZD80kgQ gdQZmIbQSZrGOaq0jOOT3W7+7nhIwyeNTUk0aCcPJeTajwQsuT2e6XVMFWJli3Je3yhh JR+bEZ5rtfmeP4aI9GWSN2OJZBmwyhpYCZSN+IAXNTM9AsrvoToM/31TMfuPEJGX/VHd ExMHlPsCw1nNGn+1V8xPSh24Yp1TioRHAOjVvBGJCfKR93xpByjqGnnci8un3h9P2HMy luRA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=lv0H/F2OzsGGCi17NoMV26+em9YH0GZ2vcU+J2uihFc=; b=nnC6HnTdrf9COQ4t8VbCDVWs9f81Uz7f9+EPakmqHKZWtZAikggmrAEigyT2/5VRKQ G33lKkFlxvJqGXyWJeUquewT42ihJ6Dw22wi7+ITYxU1NHtFNf+mFUYpIBdEXwhQltO9 yzCXICV8BHVNiKUIv7es4aSuN+MIklBGOyYnTVPprOeYNJMFRrxj7LME/NLp87gmFMmk jtvurS4dG3tOD+/ZIfLpgHRWmN3epBtyRUHEaHklN2b3KUPiO3vEL3QPPGlI7qh05MeY PXw4icDP45W7KKpDemKNhESy4DLRX1zJpfWBpuGjSdvXs97unxEHG4IiOMQ/Py/B305r t1dg== X-Gm-Message-State: APjAAAXFTB1HSVD5vKvxcDO/18HKDU/nu8smPr8HW+OjBqbzw43RdMww b2xMmeUIlIi6k5Vg2roOi6pCxIqGXaM4zg4Pq7fsJg== X-Google-Smtp-Source: APXvYqwOyMsGOr6sgkikvmroFe89ULVh2nblj7Qr0IivBIxLmcTSmKmUdAOJwUZ8+utjNaxtxnlDyPOLmmB8HgE44Ec= X-Received: by 2002:a2e:958e:: with SMTP id w14mr6177151ljh.126.1565978735075; Fri, 16 Aug 2019 11:05:35 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Bob Harold Date: Fri, 16 Aug 2019 14:05:23 -0400 Message-ID: To: Brian Dickson Cc: Andrew Campling , ADD Mailing list Content-Type: multipart/alternative; boundary="0000000000003afb8905903fd67b" Archived-At: Subject: Re: [Add] When Two Worlds Collide X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 18:05:40 -0000 --0000000000003afb8905903fd67b Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Fri, Aug 16, 2019 at 12:08 PM Brian Dickson < brian.peter.dickson@gmail.com> wrote: > > > On Thu, Aug 15, 2019 at 10:55 AM Andrew Campling > wrote: > >> Some of the more recent discussions (eg on the validity of the network >> administrator role) have made it clear to me that there are fundamental >> differences in world view between: (i) the one hand, network operators = / >> ISPs and others in that ecosystem; and (ii) browser companies / other >> applications developers. These differences make it hard if not impossib= le >> to reach a mutual understanding of the potential problems and solutions. >> Trying to bridge such differences via email is difficult if not impossib= le, >> as are time constraints at IETF events. >> >> (NB To be clear, I=E2=80=99m not suggesting that the above is either an = original >> or revolutionary observation!) >> >> With that in mind, would others from each of these two communities see >> value in taking time for a more structured discussion in a workshop form= at, >> either face-to-face or virtually, to set out the challenges and benefits >> posed by DoH (and possibly also DoT etc if useful)? My hypothesis is th= at >> a better understanding of the perspective of both communities would >> simplify discussions here, and at the very least help to focus minds on >> what the real issues are from the other=E2=80=99s perspective. This may= in terms >> speed our path towards solutions. >> >> Do you agree with the above analysis and, if so, would you see value in >> taking part in such a workshop? By all means email me directly on this = if >> you prefer not to clog up the mail reflector. >> >> > > The discussions yesterday on various subjects were IMO helpful in > determining corner cases and available mechanisms. > > I think this ends up reducing to two separate sets of use cases which may > require different treatment.. > > I also believe both of those use cases are in need of further work, but I > think the work on those can probably "fork" without too much loss of shar= ed > benefits. I.e. IMO they are different enough that trying to force a singl= e > solution onto both won't work. > > The way I'd separate the use cases is: > > 1. Unmanaged devices on partially managed networks which are not > trusted (home networks, guest networks at enterprises, coffee shops, e= tc.) > 2. Managed devices on managed networks (the proper enterprise case, > plus analogous environments with stricter controls from the operator, = such > as Paul Vixie's home network.) > > The root of the 2nd problem's issues have to do with some of the > assumptions built into things like split-brain DNS, filtered DNS, etc. > Those basically require that there be a single entry point into resolutio= n > (single semantically at least, but possibly not physically). There are > other problems with having the applications' configurations exposed to > users, and with applications having possibly diverging DNS world-views. > > The 1st problem's issues are smaller in scope, and generally relate to > filtering. I have a few ideas there, and I think those would benefit from > Andrew's suggestion of workshop(s). > > My expectation is that some of the 1st problem's work may lead to > additional requirements for DoH/DoT to support those. > > I also expect that these potential additions will add to, rather than > subtract from, the privacy support, while preserving the specific benefit= s > of (and in some cases, requirements for) user protection via DNS filterin= g. > > Brian > Unfortunately, we have a third case: (Especially in a university network) 3. Unmanaged devices on a managed network. We know we won't have absolute security, but we need to do the best we can. At the moment, split DNS is necessary, and RPZ is an important layer of security. DoT or DoH to our internal DNS would be fine. We know that some users will use the quads, and that is their choice. But DoH to an external network *without an explicit choice by the user* is not a solution that I can endorse. Does that make sense? --=20 Bob Harold --0000000000003afb8905903fd67b Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable

On Fri, Aug 16, 2019 at 12:08 PM Brian Di= ckson <brian.peter.dick= son@gmail.com> wrote:


On Thu, Aug 15, 2019 at = 10:55 AM Andrew Campling <andrew.campling@419.consulting> wrote:
<= /div>
Some of the more recent discussions (eg on the validity of the network= administrator role) have made it clear to me that there are fundamental di= fferences in world view between:=C2=A0 (i) the one hand, network operators = / ISPs and others in that ecosystem; and (ii) browser companies / other applications developers.=C2=A0 These dif= ferences make it hard if not impossible to reach a mutual understanding of = the potential problems and solutions.=C2=A0 Trying to bridge such differenc= es via email is difficult if not impossible, as are time constraints at IETF events.
=C2=A0
(NB To be clear, I=E2=80=99m not suggesting that the above is either a= n original or revolutionary observation!)
=C2=A0
With that in mind, would others from each of these two communities see= value in taking time for a more structured discussion in a workshop format= , either face-to-face or virtually, to set out the challenges and benefits = posed by DoH (and possibly also DoT etc if useful)?=C2=A0 My hypothesis is that a better understanding of t= he perspective of both communities would simplify discussions here, and at = the very least help to focus minds on what the real issues are from the oth= er=E2=80=99s perspective.=C2=A0 This may in terms speed our path towards solutions.=C2=A0
=C2=A0
Do you agree with the above analysis and, if so, would you see value i= n taking part in such a workshop?=C2=A0 By all means email me directly on t= his if you prefer not to clog up the mail reflector.=C2=A0
=C2=A0

The discussions ye= sterday on various subjects were IMO helpful in determining corner cases an= d available mechanisms.

I think this ends up reduc= ing to two separate sets of use cases which may require different treatment= ..

I also believe both of those use cases are in n= eed of further work, but I think the work on those can probably "fork&= quot; without too much loss of shared benefits. I.e. IMO they are different= enough that trying to force a single solution onto both won't work.

The way I'd separate the use cases is:
  1. Unmanaged devices on partially managed networks which are not trus= ted (home networks, guest networks at enterprises, coffee shops, etc.)
    2. =
  2. Managed devices on managed networks (the proper enterprise case, plus a= nalogous environments with stricter controls from the operator, such as Pau= l Vixie's home network.)
The root of the 2nd problem'= s issues have to do with some of the assumptions built into things like spl= it-brain DNS, filtered DNS, etc. Those basically require that there be a si= ngle entry point into resolution (single semantically at least, but possibl= y not physically). There are other problems with having the applications= 9; configurations exposed to users, and with applications=C2=A0 having poss= ibly diverging DNS world-views.=C2=A0

The 1s= t problem's issues are smaller in scope, and generally relate to filter= ing. I have a few ideas there, and I think those would benefit from Andrew&= #39;s suggestion of workshop(s).

My expectation is= that some of the 1st problem's work may lead to additional requirement= s for DoH/DoT to support those.

I also expect that= these potential additions will add to, rather than subtract from, the priv= acy support, while preserving the specific benefits of (and in some cases, = requirements for) user protection via DNS filtering.

Brian

Unfortunately, w= e have a third case:=C2=A0 (Especially in a university network)
3= . Unmanaged devices on a managed network.

We know = we won't have absolute security, but we need to do the best we can.=C2= =A0 At the moment, split DNS is necessary, and RPZ is an important layer of= security. DoT or DoH to our internal DNS would be fine.=C2=A0 We know that= some users will use the quads, and that is their choice.=C2=A0 But DoH to = an external network *without an explicit choice by the user* is not a solut= ion that I can endorse.=C2=A0 Does that make sense?

--=C2=A0
Bob Harold

--0000000000003afb8905903fd67b-- From nobody Fri Aug 16 11:06:01 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EDF7412009C for ; Fri, 16 Aug 2019 11:05:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xOfPw7vAjflR for ; Fri, 16 Aug 2019 11:05:55 -0700 (PDT) Received: from mail-qt1-x836.google.com (mail-qt1-x836.google.com [IPv6:2607:f8b0:4864:20::836]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 076BD1200F4 for ; Fri, 16 Aug 2019 11:05:55 -0700 (PDT) Received: by mail-qt1-x836.google.com with SMTP id l9so7018024qtu.6 for ; Fri, 16 Aug 2019 11:05:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=lp1MaNF9AGaCSY79dGGtvKhjY7vccxHBhk38dRqalO4=; b=jJm0TsxBUxGjHEzYKoNkpr9P38/HW7ARyE2h5sky0A8Tr/+1vkJLVe9z4jP8FPxdUv 1kwH1Ub6R2ag6TsLd0ShAdl47uIp/qHu5QZ2ltZpvN6EsoNF9oJ9TK7wFs6G6kgoCVZx FlHKSV/aJr1jawC+H8llUX6/4Kqx5NEKbLLY9M6pTeqwVe0s8UCjw9nfBcNG8J4PBSIE Utppwp8mJxoMDWrg33oA7vF37hIZj6S7U73nS+JMbATcQMwmntzCUG/S54OJ1jSdVvst fwK8fEIL9TF8uBAMyevyrpPmE0nQskAsD83Fh0cwJfnx8jCM/ToXDb9FNC2Ril6C/bPp a2Ew== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=lp1MaNF9AGaCSY79dGGtvKhjY7vccxHBhk38dRqalO4=; b=LkiLqJtSfbiWsFSXnu7FniwsFHlorcqX8Y5/YEiMZX+nneriaQjlU6mGSxY+8R2XPW MyWM05hh6wbLz8La7u22o5mRORBtarlbKwi2hb+MZYFbukTWplnHZ9gfA+OedstxuTM2 Sg2dnAyAsVTIQwYGAYu7U8U7VJl9C3bbNDoo2aQ0H/KiGGI8j85EPeo5ywgVzNYZ+7eg uXRCnWgFPOFiIq8glDDBmXeKs0s5QKOuDinUKXYcixbtMRtSQ8+bidaFl2s3d5qPFr5g Pe89MniS4xtfOZft8hS+8Dzjf+7Hz1Y8mCImAI98gnQfZUD/XClhflB4C3GaMhPE1mMh aucw== X-Gm-Message-State: APjAAAUlcMuo3MnADKthxA6z+FVe128ozbfX+yX4h4jrf31zuiJ0G6cr iq/cGIrP+tcm1J/Zg78oB08KGBZWiR3q7A== X-Google-Smtp-Source: APXvYqwngI7VgeD2Bbm7m3fhYL29mhq9IMV0ZoVu/98hh7f2JEN89FFmaex8GGBv9u03P43QsarHHg== X-Received: by 2002:ac8:317a:: with SMTP id h55mr9780392qtb.105.1565978754167; Fri, 16 Aug 2019 11:05:54 -0700 (PDT) Received: from ?IPv6:2001:470:c1a2:1:7ded:86d1:e927:7777? ([2001:470:c1a2:1:7ded:86d1:e927:7777]) by smtp.gmail.com with ESMTPSA id i25sm3256277qki.49.2019.08.16.11.05.53 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 16 Aug 2019 11:05:53 -0700 (PDT) From: Ted Lemon Message-Id: <2BE3565E-4D1D-4C3D-8E5E-9BBF0A6C76EC@fugue.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_808EAEDC-B4E4-44DD-B26F-8438AAA5E136" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Fri, 16 Aug 2019 11:05:51 -0700 In-Reply-To: Cc: ADD Mailing list To: Bret Jordan References: <09178E42-08B2-4958-A1C8-AF507AEE8834@fugue.com> <0BDD4F7F-7301-476A-80DA-0CC84EE4557D@fugue.com> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] When Two Worlds Collide X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 18:05:57 -0000 --Apple-Mail=_808EAEDC-B4E4-44DD-B26F-8438AAA5E136 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 On Aug 16, 2019, at 10:53 AM, Bret Jordan wrote: > In your opinion. The problem with this whole debate is the absolutes = and claiming that one=E2=80=99s opinion is the consensus or is by = default the best thing to do. Where is the research and data that backs = that up? =20 It=E2=80=99s not a matter of opinion, any more than it=E2=80=99s a = matter of opinion that if you have two apples and I give you two more, = you now have four apples. We are continuing to argue this because you = think that math is subject to opinions. DHCP doesn=E2=80=99t provide a way to authenticate it. I know = this=E2=80=94I=E2=80=99m one of the authors of RFC 3315, and the DHC = working group worked for quite a while to come up with an authentication = model for DHCP that made sense. We failed. DoH does provide a way to authenticate it, and it makes it relatively = straightforward for different consumers of DNS resolution to make (and = validate!) different choices of resolver. DoH can=E2=80=99t be blocked without locking down every device on the = network. These are not opinions. These are facts. If you think they are not = facts, let=E2=80=99s see your math. --Apple-Mail=_808EAEDC-B4E4-44DD-B26F-8438AAA5E136 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 On = Aug 16, 2019, at 10:53 AM, Bret Jordan <jordan.ietf@gmail.com> wrote:
In your opinion.  The problem with this whole debate is = the absolutes and claiming that one=E2=80=99s opinion is the consensus = or is by default the best thing to do.  Where is the research and = data that backs that up?  

It=E2=80=99s not a matter of opinion, any = more than it=E2=80=99s a matter of opinion that if you have two apples = and I give you two more, you now have four apples.   We are = continuing to argue this because you think that math is subject to = opinions.

DHCP = doesn=E2=80=99t provide a way to authenticate it.   I know = this=E2=80=94I=E2=80=99m one of the authors of RFC 3315, and the DHC = working group worked for quite a while to come up with an authentication = model for DHCP that made sense.   We failed.
DoH does provide a way to authenticate = it, and it makes it relatively straightforward for different consumers = of DNS resolution to make (and validate!) different choices of = resolver.

DoH = can=E2=80=99t be blocked without locking down every device on the = network.

These = are not opinions.   These are facts.   If you think they are = not facts, let=E2=80=99s see your math.

= --Apple-Mail=_808EAEDC-B4E4-44DD-B26F-8438AAA5E136-- From nobody Fri Aug 16 12:19:35 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6FFD61200C1 for ; Fri, 16 Aug 2019 12:19:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id F1JR_aa2HtlU for ; Fri, 16 Aug 2019 12:19:32 -0700 (PDT) Received: from mail-pl1-x62b.google.com (mail-pl1-x62b.google.com [IPv6:2607:f8b0:4864:20::62b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 40CF51200C3 for ; Fri, 16 Aug 2019 12:19:31 -0700 (PDT) Received: by mail-pl1-x62b.google.com with SMTP id 4so2809613pld.10 for ; Fri, 16 Aug 2019 12:19:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=rL8PawRMRyCLB48/WuEGNxE8dJFPkXLlS02g7hS6/UI=; b=SGxJA3u0dNaVA08BdoZWhvtVbK12sYy3irtqvDIH+5c/jmpjg3UWaVBY6HuxkISqHt JijuWLX3F3dFOXbQc2uqyGL2mRzJS3GRzbbOVxEqpv4bPTvZW+PXOGnU12WyWJW2rAPY WEcuC60/Och4u2ghZEWxpKIjFUwb/a35LAOYVEHDnbjQkGOouRNmyfywskrk/6gdBZB6 x5EkBYfnHvMH80acl36OQUHyeQhvtJuJBQ4EErU1tiSu3Y8lg3aL1p5nZbrvZfGmamOA EzFchmWwiCo5ceTOSW3x/wf5Ci1gssLcO4SYW88UuUADMy0U/4CMxjBp+evP85hF1+/i eDfA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=rL8PawRMRyCLB48/WuEGNxE8dJFPkXLlS02g7hS6/UI=; b=ozI/kCB2LBi20l8iELBXnYEgG1qQm1hfsXz/TMXycPw4o3YFIgei99uPrvfrQ2TEIy ifl5CE6z6qQwMJBm/CT2OjdfOFme8+15K3UbqTeuNt8djuVJX9gzqBFyuuVrXchr/fyK EmMFAs5Nz9pxok6R8w5Snx+uAbkUXAZ++oQ3FN8EQPSx8sMloKh57G2g0MpQ5ZGLcb5G fIBO+SMxtat/GNLD2pEQJqiv7oUol8zGtT5qEteA1fiDO6UcdpSQjCl5UYEk3oDn4fgL d/kEs4nhXWPlQqGthuGcX7QOGboOjEq1iRu/1mNIOs9VU34h7xOvCXOEO3MSoulo9I0E 2W4g== X-Gm-Message-State: APjAAAU1C8HM8EKvjgjrCzjkCR+80wBS4gHZXsO8s1DIXmBEUQMjXJZN QtWVMv+miXlduxpK6Fk9w8UQBnOk X-Google-Smtp-Source: APXvYqzzRfQzwCemfctdLSTa9v+noi5LZVN/pmBk81q02MhhVcBREKi0p26S5gHrDQ8vbFILF/N9hg== X-Received: by 2002:a17:902:ba81:: with SMTP id k1mr11237763pls.213.1565983170928; Fri, 16 Aug 2019 12:19:30 -0700 (PDT) Received: from [10.128.64.148] ([136.60.227.81]) by smtp.gmail.com with ESMTPSA id g8sm5498984pgk.1.2019.08.16.12.19.29 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 16 Aug 2019 12:19:30 -0700 (PDT) From: Bret Jordan Message-Id: <2ECE253B-00C9-4857-A659-83BA3322FE5C@gmail.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_EAFA8A95-66A1-49BA-86DD-D2B38F25BD7C" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Fri, 16 Aug 2019 13:19:28 -0600 In-Reply-To: <2BE3565E-4D1D-4C3D-8E5E-9BBF0A6C76EC@fugue.com> Cc: ADD Mailing list To: Ted Lemon References: <09178E42-08B2-4958-A1C8-AF507AEE8834@fugue.com> <0BDD4F7F-7301-476A-80DA-0CC84EE4557D@fugue.com> <2BE3565E-4D1D-4C3D-8E5E-9BBF0A6C76EC@fugue.com> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] When Two Worlds Collide X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 19:19:34 -0000 --Apple-Mail=_EAFA8A95-66A1-49BA-86DD-D2B38F25BD7C Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 These are opinion statements. Not math. Just because you do not like = the views of the other side, does not mean they are invalid. It is your = opinion that a QuadX DoH resolver is less dangerous than the DNS (DoH or = Do53) that is provided by your internal network. That is your opinion = and clearly not shared by many on this list. Some yes, others no.=20 Which is a bigger risk for Privacy? Getting blocked by some filtering = DNS or having all of your data be capture, stored, analyzed, and cross = correlated? You say DHCP is not authenticated.. You are right. But as a network = administrator you can put in compensating controls to address this. You = can identify very easily if there is more than one DHCP server on your = network or a rouge device performing a race condition to trick = endpoints. I was checking for this back in the late 80s early 90s. Dealing in absolutes and single use-cases and forcing them to apply to = everyone is just not right. =20 Thanks, Bret PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 "Without cryptography vihv vivc ce xhrnrw, however, the only thing that = can not be unscrambled is an egg." > On Aug 16, 2019, at 12:05 PM, Ted Lemon wrote: >=20 > On Aug 16, 2019, at 10:53 AM, Bret Jordan > wrote: >> In your opinion. The problem with this whole debate is the absolutes = and claiming that one=E2=80=99s opinion is the consensus or is by = default the best thing to do. Where is the research and data that backs = that up? =20 >=20 > It=E2=80=99s not a matter of opinion, any more than it=E2=80=99s a = matter of opinion that if you have two apples and I give you two more, = you now have four apples. We are continuing to argue this because you = think that math is subject to opinions. >=20 > DHCP doesn=E2=80=99t provide a way to authenticate it. I know = this=E2=80=94I=E2=80=99m one of the authors of RFC 3315, and the DHC = working group worked for quite a while to come up with an authentication = model for DHCP that made sense. We failed. >=20 > DoH does provide a way to authenticate it, and it makes it relatively = straightforward for different consumers of DNS resolution to make (and = validate!) different choices of resolver. >=20 > DoH can=E2=80=99t be blocked without locking down every device on the = network. >=20 > These are not opinions. These are facts. If you think they are not = facts, let=E2=80=99s see your math. >=20 --Apple-Mail=_EAFA8A95-66A1-49BA-86DD-D2B38F25BD7C Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 These= are opinion statements.  Not math.  Just because you do not = like the views of the other side, does not mean they are invalid. It is = your opinion that a QuadX DoH resolver is less dangerous than the DNS = (DoH or Do53) that is provided by your internal network.  That is = your opinion and clearly not shared by many on this list.  Some = yes, others no. 

Which is a bigger risk for Privacy?  Getting blocked by = some filtering DNS or having all of your data be capture, stored, = analyzed, and cross correlated?

You say DHCP is not authenticated.. You = are right. But as a network administrator you can put in compensating = controls to address this.  You can identify very easily if there is = more than one DHCP server on your network or a rouge device performing a = race condition to trick endpoints.  I was checking for this back in = the late 80s early 90s.

Dealing in absolutes and single use-cases and forcing them to = apply to everyone is just not right.  

Thanks,
Bret
PGP = Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 = 0050
"Without = cryptography vihv vivc ce xhrnrw, however, the only thing that can not = be unscrambled is an = egg."

On Aug 16, 2019, at 12:05 PM, Ted Lemon <mellon@fugue.com> = wrote:

On Aug 16, 2019, at = 10:53 AM, Bret Jordan <jordan.ietf@gmail.com> wrote:
In your opinion.  The problem with this whole debate is = the absolutes and claiming that one=E2=80=99s opinion is the consensus = or is by default the best thing to do.  Where is the research and = data that backs that up?  

It=E2=80=99s not a matter of opinion, any = more than it=E2=80=99s a matter of opinion that if you have two apples = and I give you two more, you now have four apples.   We are = continuing to argue this because you think that math is subject to = opinions.

DHCP = doesn=E2=80=99t provide a way to authenticate it.   I know = this=E2=80=94I=E2=80=99m one of the authors of RFC 3315, and the DHC = working group worked for quite a while to come up with an authentication = model for DHCP that made sense.   We failed.
DoH does provide a way to authenticate = it, and it makes it relatively straightforward for different consumers = of DNS resolution to make (and validate!) different choices of = resolver.

DoH = can=E2=80=99t be blocked without locking down every device on the = network.

These = are not opinions.   These are facts.   If you think they are = not facts, let=E2=80=99s see your math.


= --Apple-Mail=_EAFA8A95-66A1-49BA-86DD-D2B38F25BD7C-- From nobody Fri Aug 16 12:35:17 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1C8821200EB for ; Fri, 16 Aug 2019 12:35:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id o12WWj68IJ7h for ; Fri, 16 Aug 2019 12:35:13 -0700 (PDT) Received: from mx0a-00191d01.pphosted.com (mx0a-00191d01.pphosted.com [67.231.149.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DAB3E1200C3 for ; Fri, 16 Aug 2019 12:35:13 -0700 (PDT) Received: from pps.filterd (m0048589.ppops.net [127.0.0.1]) by m0048589.ppops.net-00191d01. (8.16.0.27/8.16.0.27) with SMTP id x7GJYlMo038726; Fri, 16 Aug 2019 15:35:10 -0400 Received: from alpi154.enaf.aldc.att.com (sbcsmtp6.sbc.com [144.160.229.23]) by m0048589.ppops.net-00191d01. with ESMTP id 2ue2re013y-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 16 Aug 2019 15:35:10 -0400 Received: from enaf.aldc.att.com (localhost [127.0.0.1]) by alpi154.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id x7GJZ7NG029707; Fri, 16 Aug 2019 15:35:08 -0400 Received: from zlp30487.vci.att.com (zlp30487.vci.att.com [135.47.91.176]) by alpi154.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id x7GJYuMZ029311 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Fri, 16 Aug 2019 15:35:05 -0400 Received: from zlp30487.vci.att.com (zlp30487.vci.att.com [127.0.0.1]) by zlp30487.vci.att.com (Service) with ESMTP id 8037D4009E67; Fri, 16 Aug 2019 19:34:56 +0000 (GMT) Received: from GAALPA1MSGHUBAE.ITServices.sbc.com (unknown [130.8.218.154]) by zlp30487.vci.att.com (Service) with ESMTPS id 6F3B34009E66; Fri, 16 Aug 2019 19:34:56 +0000 (GMT) Received: from GAALPA1MSGUSRBF.ITServices.sbc.com ([169.254.5.177]) by GAALPA1MSGHUBAE.ITServices.sbc.com ([130.8.218.154]) with mapi id 14.03.0439.000; Fri, 16 Aug 2019 15:34:56 -0400 From: "STARK, BARBARA H" To: "'Ted Lemon'" , "'Bret Jordan'" CC: "'ADD Mailing list'" Thread-Topic: [Add] When Two Worlds Collide Thread-Index: AdVTdyCapVPyep9JQGykvKh9TBzsEAA9zvCAAABEjIAAAPA1gAAAwDmAAAG4VQAAAGyhgAAFbQVw Date: Fri, 16 Aug 2019 19:34:55 +0000 Message-ID: <2D09D61DDFA73D4C884805CC7865E6114E279D3E@GAALPA1MSGUSRBF.ITServices.sbc.com> References: <09178E42-08B2-4958-A1C8-AF507AEE8834@fugue.com> <0BDD4F7F-7301-476A-80DA-0CC84EE4557D@fugue.com> <2BE3565E-4D1D-4C3D-8E5E-9BBF0A6C76EC@fugue.com> In-Reply-To: <2BE3565E-4D1D-4C3D-8E5E-9BBF0A6C76EC@fugue.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [130.10.216.153] Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-08-16_08:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_policy_notspam policy=outbound_policy score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=743 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1906280000 definitions=main-1908160195 Archived-At: Subject: Re: [Add] When Two Worlds Collide X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 19:35:15 -0000 PiBEb0ggY2Fu4oCZdCBiZSBibG9ja2VkIHdpdGhvdXQgbG9ja2luZyBkb3duIGV2ZXJ5IGRldmlj ZSBvbiB0aGUgbmV0d29yay4NCg0KSXTigJlzIGVhc3kgZW5vdWdoIHRvIGJsb2NrIHdlbGwta25v d24gcHVibGljIEROUyByZXNvbHZlciBJUCBhZGRyZXNzZXMgKG9yIHB1YmxpYyBETlMgcmVzb2x2 ZXJzIHVzaW5nIHBvcnQgNDQzKSB3aXRob3V0IGxvY2tpbmcgZG93biBldmVyeSBkZXZpY2UuIFBy ZXR0eSB0cml2aWFsLCByZWFsbHkuDQpJJ3ZlIGJlZW4gZXhwZXJpbWVudGluZyB3aXRoIGhvdyB0 byBkbyB0aGlzIGVmZmVjdGl2ZWx5IG9uIG15IGhvbWUgbmV0d29yaywgc28gSSdsbCBiZSByZWFk eSB3aGVuIGFwcGxpY2F0aW9ucyB0cnkgdG8gaGlqYWNrIG15IEROUyBjaG9pY2VzLg0KQmFyYmFy YQ0K From nobody Fri Aug 16 12:43:54 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8E39F12080C for ; Fri, 16 Aug 2019 12:43:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ELqo2BWLx82S for ; Fri, 16 Aug 2019 12:43:50 -0700 (PDT) Received: from mail-pg1-x531.google.com (mail-pg1-x531.google.com [IPv6:2607:f8b0:4864:20::531]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B35981200D6 for ; Fri, 16 Aug 2019 12:43:50 -0700 (PDT) Received: by mail-pg1-x531.google.com with SMTP id d1so2837249pgp.4 for ; Fri, 16 Aug 2019 12:43:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:mime-version:subject:date:references:to:in-reply-to:message-id; bh=Q9itF9yekBiCJI5oaDD8Osfl9vRLWJZfp20j3ypY4O4=; b=VutjpByVX769VgRxXMGVjjZ/tTzEmK7Gn5og8jQXHnGv02g2p54/DyCwH8f+oCbawB Qpi0VBCmCK6j5FhpE2zUUSl7TcxC01AOLZg1CWh1fj7IM6QIOzmQxR+zVCmEGdh/zcK8 Vvta7cJq/6r6FqlT6oGrYG+xWoqXMuicYlApF8q14RCrVZ8PXG7GDQOCLbjAtAvOrOrK 7StI0E4cYciDeXw+OXURSerwhyi1r8ZtPMkUEcmAIXHvy99APaFqVRFAQh7Pxndew4+w /Y/4405731wy2xIuE3JxT4v8hGB91sSppc2CDyvRQyo79ar2qotUTBAHsfjGAslly2d6 5ewA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:mime-version:subject:date:references:to :in-reply-to:message-id; bh=Q9itF9yekBiCJI5oaDD8Osfl9vRLWJZfp20j3ypY4O4=; b=c+59uj0Ed7nARpZA9WfgUIe43CQlSE3N0tzjgLEJRZaSeYoRyiqrBJPK/RNVydcrGt gtx8WOyUMfUtq9qTiNt/Vdeb2XRVneqwn64ZUR894OHLX556DL5hPfDm8KI7GtBq9Vk6 FYhUbiXUDyBRIgiGGGtfZiQ/i7CpSfRUw3SFHzvYge2xw6S/0R6gEP+EiUOuI4y1e4Wx JbrscsiIbLsQXyEfNgxFLhLBPHg/Zo5NRESVihTRwl11V6HDlIvL7Fzw+qAmlyBhMhJM xFKGcAOq4Nwy/YB3W//2fqirxU2VdOppqkezR3k+YjyEDL7tW5YjnVKsQ1P+PtdbyMye MapA== X-Gm-Message-State: APjAAAW9aea2SUKVukl4tGV/gMuSYLLX5HXsa8oZX5PdQkTYL1JlQv8X vPKMNBCpmO4ROBaxq2wLs9s= X-Google-Smtp-Source: APXvYqxwl/grA8diXrrh9FKGXHjWgNR8ImkueprXb1XLGfVohYHjx0OPTs0YyhCp2J3CmxuHLZNrXg== X-Received: by 2002:a62:58c4:: with SMTP id m187mr12231983pfb.147.1565984630240; Fri, 16 Aug 2019 12:43:50 -0700 (PDT) Received: from [10.128.64.148] ([136.60.227.81]) by smtp.gmail.com with ESMTPSA id 10sm11243619pfv.63.2019.08.16.12.43.48 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 16 Aug 2019 12:43:49 -0700 (PDT) From: Bret Jordan Content-Type: multipart/alternative; boundary="Apple-Mail=_3B782AE3-42FA-42DB-A4B4-CBDF3ED8E6A8" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Fri, 16 Aug 2019 13:43:47 -0600 References: <09178E42-08B2-4958-A1C8-AF507AEE8834@fugue.com> <0BDD4F7F-7301-476A-80DA-0CC84EE4557D@fugue.com> <2BE3565E-4D1D-4C3D-8E5E-9BBF0A6C76EC@fugue.com> <2D09D61DDFA73D4C884805CC7865E6114E279D3E@GAALPA1MSGUSRBF.ITServices.sbc.com> To: "STARK, BARBARA H" , ADD Mailing list In-Reply-To: <2D09D61DDFA73D4C884805CC7865E6114E279D3E@GAALPA1MSGUSRBF.ITServices.sbc.com> Message-Id: X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] When Two Worlds Collide X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 19:43:53 -0000 --Apple-Mail=_3B782AE3-42FA-42DB-A4B4-CBDF3ED8E6A8 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Just like there are threat intelligence feeds that track bot nets [1] = and things like Shodan [2], I am sure someone will come along and = produce a threat feed for DoH servers that you can subscribe to or = search for. You can then just list all of them in your IPS or Firewall = or as ACLs at your edge and block them. For organizations that do = analysis at the Firewall or have a Proxy, this is super trivial to = address and even rewrite on the fly. I have even seen Cisco showing of = tools that can do analysis of encrypted traffic without decrypting it. = So I am sure there will be many solutions that can block DoH without = hardening the endpoint. =20 [1] https://abuse.ch/ [2] https://www.shodan.io/ Thanks, Bret PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 "Without cryptography vihv vivc ce xhrnrw, however, the only thing that = can not be unscrambled is an egg." > On Aug 16, 2019, at 1:34 PM, STARK, BARBARA H wrote: >=20 >> DoH can=E2=80=99t be blocked without locking down every device on the = network. >=20 > It=E2=80=99s easy enough to block well-known public DNS resolver IP = addresses (or public DNS resolvers using port 443) without locking down = every device. Pretty trivial, really. > I've been experimenting with how to do this effectively on my home = network, so I'll be ready when applications try to hijack my DNS = choices. > Barbara --Apple-Mail=_3B782AE3-42FA-42DB-A4B4-CBDF3ED8E6A8 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8
Just like there are threat intelligence feeds that track bot = nets [1] and things like Shodan [2], I am sure someone will come along = and produce a threat feed for DoH servers that you can subscribe to or = search for.  You can then just list all of them in your IPS or = Firewall or as ACLs at your edge and block them.  For organizations = that do analysis at the Firewall or have a Proxy, this is super trivial = to address and even rewrite on the fly. I have even seen Cisco showing = of tools that can do analysis of encrypted traffic without decrypting = it. So I am sure there will be many solutions that can block DoH without = hardening the endpoint.  

[1] https://abuse.ch/
[2] https://www.shodan.io/



Thanks,
Bret
PGP = Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 = 0050
"Without = cryptography vihv vivc ce xhrnrw, however, the only thing that can not = be unscrambled is an = egg."

On Aug 16, 2019, at 1:34 PM, STARK, BARBARA H <bs7652@att.com> = wrote:

DoH can=E2=80=99t be = blocked without locking down every device on the network.

It=E2=80=99s easy enough to block = well-known public DNS resolver IP addresses (or public DNS resolvers = using port 443) without locking down every device. Pretty trivial, = really.
I've been experimenting with how to do this = effectively on my home network, so I'll be ready when applications try = to hijack my DNS choices.
Barbara

= --Apple-Mail=_3B782AE3-42FA-42DB-A4B4-CBDF3ED8E6A8-- From nobody Fri Aug 16 12:52:25 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0E48C1200D6 for ; Fri, 16 Aug 2019 12:52:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=hopcount.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id f9YLZ92AJzKY for ; Fri, 16 Aug 2019 12:52:21 -0700 (PDT) Received: from mail-io1-xd32.google.com (mail-io1-xd32.google.com [IPv6:2607:f8b0:4864:20::d32]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0A58C120090 for ; Fri, 16 Aug 2019 12:52:21 -0700 (PDT) Received: by mail-io1-xd32.google.com with SMTP id o9so8544186iom.3 for ; Fri, 16 Aug 2019 12:52:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hopcount.ca; s=google; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=ukUJk2U7/NmnVEvXylnsF6hIU2rgn/NWExKBfZ9NnFk=; b=HTCtODNFuyJ288wIcrZY9zLHnRgqjVZSMAWGj8TFg6dw4PxRy4m1iepn2UvGaenqRy PerCkHqVZBlP4H3r04481iLlQstxNSIJe7gc6WVTu0prNctqFrof3RwBTBGSDNQnrk8q 6hH3e6PwayM9oKW6VDjlgQWS5SrgloES0Cbrg= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=ukUJk2U7/NmnVEvXylnsF6hIU2rgn/NWExKBfZ9NnFk=; b=KqbFauiMS7FdiDB1LKxLqRD0ewmixJdOqAuJXIptyi2mOFnB281XnUsaOFH0BSl+c0 1SNCP1rcuScDSxM1nel/hZ56QfSc/h4RBd/gT4i7ytKp2MAWn6G5q26RrgXPcAT9DfRA xC1soTvE/NDBkgV/a5k6Em6KdYvMfUw7s/sex3wiVwEPy+UB5FzU7BEF/kRs5BGKVqqK e9RMbk7ZZcHPb70+8AJI7cLRt5JJ9GCRnnZ/LGO/hxCIBxcWDNJHq82nVOeHSXrfB3FZ 8bAiM5VeTGiyB8AI91/QZTkiYqq+Ep+PaQxgCtMxF+/qeurYWDfmC7wXIuLQnCUC19S5 mU/Q== X-Gm-Message-State: APjAAAVdicYTCi7NXWa3GEDgS48laM4O/TpkGaHmzyt74UVUUZLvCV7q 79fg/hQ+0e+VRxo3wBmuNdagtQ== X-Google-Smtp-Source: APXvYqyEfIV+R7HZKpExPuVomhP8ktL/wtrY5GEFBzSSfWTmWHlZGcrHYe3xInJPJ56qt+hhk8R4Aw== X-Received: by 2002:a02:1441:: with SMTP id 62mr13286691jag.21.1565985139998; Fri, 16 Aug 2019 12:52:19 -0700 (PDT) Received: from ?IPv6:2607:f2c0:e786:128f:80ee:69e7:9906:351e? ([2607:f2c0:e786:128f:80ee:69e7:9906:351e]) by smtp.gmail.com with ESMTPSA id i3sm5465071ion.9.2019.08.16.12.52.18 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 16 Aug 2019 12:52:18 -0700 (PDT) From: Joe Abley Message-Id: Content-Type: multipart/signed; boundary="Apple-Mail=_F1062A6B-3399-4FE8-BE51-556A470897B1"; protocol="application/pgp-signature"; micalg=pgp-sha1 Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Fri, 16 Aug 2019 15:52:17 -0400 In-Reply-To: <2D09D61DDFA73D4C884805CC7865E6114E279D3E@GAALPA1MSGUSRBF.ITServices.sbc.com> Cc: Ted Lemon , Bret Jordan , ADD Mailing list To: "STARK, BARBARA H" References: <09178E42-08B2-4958-A1C8-AF507AEE8834@fugue.com> <0BDD4F7F-7301-476A-80DA-0CC84EE4557D@fugue.com> <2BE3565E-4D1D-4C3D-8E5E-9BBF0A6C76EC@fugue.com> <2D09D61DDFA73D4C884805CC7865E6114E279D3E@GAALPA1MSGUSRBF.ITServices.sbc.com> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] When Two Worlds Collide X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 19:52:23 -0000 --Apple-Mail=_F1062A6B-3399-4FE8-BE51-556A470897B1 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 On 16 Aug 2019, at 15:34, STARK, BARBARA H wrote: >> DoH can=E2=80=99t be blocked without locking down every device on the = network. >=20 > It=E2=80=99s easy enough to block well-known public DNS resolver IP = addresses (or public DNS resolvers using port 443) without locking down = every device. Several people who run substantial IT networks have told me that they = were already set up to strip SSL at their border and inspect the = contents of all TLS-wrapped traffic before DoH was even standardised. = They did this because it fit the security posture they had already = identified as being necessary based on a risk analysis. They distribute = organisation-specific certificates to devices used on their network to = make this work. A couple of them have recommended particular firewall products to do = this. A couple of them are already happily blocking DoH because they have = their own requirements for devices to use internally-operated resolvers = that (e.g.) block resolution of certain domains, e.g. as part of a = malware mitigation strategy. They are blocking DoH without needing to = curate a list of well-known DoH services by address. I understand that in many IT networks that use DNS-based control planes = much of what I described above is extra work and extra expense. However, = having unmanaged devices on your network means that all of this is = always a moving target. Security is not absolute; you do the amount that = makes sense given your risk analysis. Some people have laughed bitterly about the fact that DoH (for privacy!) = has the run-on effect of SSL-stripping *all* TLS traffic at your border = (for surveillance!) and so the outcome doesn't match the goal. I suspect = that the situations where that's true are places where there was already = limited expectations of privacy (many corporate networks I have attached = to, the Internet within the borders of some jurisdictions, home networks = operated by Paul Vixie who very reasonably imposes his own rules), = although I am wary of generalisation. People used to spend nothing on security. Now they spend more. Tomorrow = the costs will go up. This is kind of the nature of the game. I don't understand why people insist that blocking DoH is impossible, = when what they really mean is that there's a threat today that wasn't = there yesterday, and now we have to deal with that as well. Joe --Apple-Mail=_F1062A6B-3399-4FE8-BE51-556A470897B1 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iF0EARECAB0WIQSAt40QkiztAcvphdg0jwy9hlI6LAUCXVcJcQAKCRA0jwy9hlI6 LBBBAJ47HmSxr7N6YSBv/ImbmkDO7Kw4rQCfYb1ITAVHSrzXzQ6vwIppBejRYK0= =gq8W -----END PGP SIGNATURE----- --Apple-Mail=_F1062A6B-3399-4FE8-BE51-556A470897B1-- From nobody Fri Aug 16 12:55:16 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B8A6B1200D6 for ; Fri, 16 Aug 2019 12:55:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id p3pM_FH3lzMM for ; Fri, 16 Aug 2019 12:55:11 -0700 (PDT) Received: from mail-qt1-x841.google.com (mail-qt1-x841.google.com [IPv6:2607:f8b0:4864:20::841]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 86E2D120090 for ; Fri, 16 Aug 2019 12:55:11 -0700 (PDT) Received: by mail-qt1-x841.google.com with SMTP id t12so7362589qtp.9 for ; Fri, 16 Aug 2019 12:55:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=rmbMpCZJmybyItBy0ZVfOxoe/6+3wQ3au1iQ//hL5F0=; b=cQE4HfPc3wWG4U5oxFSFmdvZLYk3OmNveLdIcFAuOw4JzXozmNsW37N0PXsN++7NVb XzwtGNljnkKiNPJz3UgSXm/tw5o8Nb2QdpypjzV6Yy3U6HOV4K29MKuTlx2TcVmKDomz aevGaU0B7ap2VWFkdHAZFbsOlHDuqf9XWH/g3FnALxEdJVv9oDp0EqiF+8H3a4jPwxKk Mupbs31RafKTXJ4W7goKLTJkt1/IyX7OCZyPuY9I1Qunsr+dddK7d/4oiiuN15hb78VW GobUQo7EUv/skkwNqJVTH6x6lhOBvmhzbi/vY/14NpXrwibcKkcNt8wTwvrP+gAZtQRI 2NXQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=rmbMpCZJmybyItBy0ZVfOxoe/6+3wQ3au1iQ//hL5F0=; b=g9l8seocKZjpvzBAfYqWLgUxvi50U+4lbExhFyLxQsEw8ufAQExFswIFEUrfTptRYF c1SeKFuCVxbTrmaMLsIs9M1jOL5yQShu7d06NKd7esDINBUTPLkbvLMfHw7vC/JUek70 t1BMHuuuS7KZ1wl+tlTtdo7rCunAQDEoTDgVVeYqOwLGzzl4gAGkZDD1JO0C0DIe9ic5 cbomvoZJzaDy9wNsvagyoPx/oLHP1L5JKwmAdyDfueBvjEfXkVUEGS5z3l1XT4SqF2Qv tyhO7H/8WJs3SxK5UjBRLAB0Eiph2GrmZg2wqJ9ODJOdGTpIO45gdvCDgIEQT/pjmznt uHBQ== X-Gm-Message-State: APjAAAX0+B3eUIlcEjuqgrZRvkA5X6E07R4NhPEfK+7wYgtKA0GUQIFc j+O/33OGWzDQZT450og5B5tJiA== X-Google-Smtp-Source: APXvYqxoEC+fYi1mJMIi+I/nY8b8f8AZXD+3d04TGM4V+VToxq7jrC4kr/bNBj/M7iQ4/K2/+c57xQ== X-Received: by 2002:ac8:44c4:: with SMTP id b4mr10204576qto.224.1565985310579; Fri, 16 Aug 2019 12:55:10 -0700 (PDT) Received: from ?IPv6:2001:470:c1a2:1:7ded:86d1:e927:7777? ([2001:470:c1a2:1:7ded:86d1:e927:7777]) by smtp.gmail.com with ESMTPSA id y26sm4374621qta.39.2019.08.16.12.55.09 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 16 Aug 2019 12:55:09 -0700 (PDT) From: Ted Lemon Message-Id: <7172E0DB-7782-41DD-B344-02694035BD20@fugue.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_3E9EFA07-4219-4C3B-94DA-8AF12A5536DA" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Fri, 16 Aug 2019 12:55:06 -0700 In-Reply-To: <2ECE253B-00C9-4857-A659-83BA3322FE5C@gmail.com> Cc: ADD Mailing list To: Bret Jordan References: <09178E42-08B2-4958-A1C8-AF507AEE8834@fugue.com> <0BDD4F7F-7301-476A-80DA-0CC84EE4557D@fugue.com> <2BE3565E-4D1D-4C3D-8E5E-9BBF0A6C76EC@fugue.com> <2ECE253B-00C9-4857-A659-83BA3322FE5C@gmail.com> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] When Two Worlds Collide X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 19:55:15 -0000 --Apple-Mail=_3E9EFA07-4219-4C3B-94DA-8AF12A5536DA Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 On Aug 16, 2019, at 12:19 PM, Bret Jordan wrote: > It is your opinion that a QuadX DoH resolver is less dangerous than = the DNS (DoH or Do53) that is provided by your internal network.=20 I=E2=80=99m sorry, maybe I haven=E2=80=99t been very skillful in = responding to you on this. I think I see where the disconnect is now. = I don=E2=80=99t actually think this. Let=E2=80=99s enumerate the = players here: Do53 resolver on the local network DoT resolver on the local network DoH resolver on the local network DoH resolver on QuadX, as you put it DoH resolver on my home network, reachable from outside DoH resolver on my ISP=E2=80=99s network, reachable from outside And: Locked down host, can=E2=80=99t access any resolver other than that = configured by the operator BYO host, not controlled by the operator If we have host (1), is it better off communicating with resolvers (1), = (2), or (3)? That is, what should the local operator configure? The answer is that it depends on the network. If the network is locked = down as you say, and the device can=E2=80=99t leave the facility, then = it=E2=80=99s probably just a matter of whether the operator cares that = the queries are going over the wire in the clear. If, on the other = hand, the network can=E2=80=99t be locked down quite that tightly, then = it may be worthwhile to have PKI authentication. If I were setting = this up, I=E2=80=99d install a cert on all site-owned devices, and use = that to validate that I=E2=80=99m really talking to the DoT or DoH = resolver I intend. Now, whether to use DoT or Doh is just down to = whether I=E2=80=99m concerned about blocking. If I=E2=80=99m concerned = about blocking, DoH is better; if I=E2=80=99m not, I think it=E2=80=99s = about even. Now, what if we have device (2) on a locked-down network? The operator = has two choices. Either allow the device to do DoH, or block all = outgoing connections that aren=E2=80=99t explicitly permitted, including = connections to port 443. If such hosts want to connect out, they have = to go through a proxy that can look at the HTTP traffic. Now, consider the case of your own device. If you are carrying it = around, there will be places where your traffic can be snooped. But = it=E2=80=99s not going to be easy to aggregate it (probably, depends on = the operators of the networks amongst which you wander, and the = configuration of your handset). If you connect to resolver (4), then = your queries can be aggregated and perhaps correlated with your web = traffic. I agree that that=E2=80=99s bad, and something to try to = avoid. I also agree that a resolver on your home network that you connect to = from off-site may be better than (4), even though it allows your ISP to = track your DNS traffic. But what I was talking about was not this sort of modeling. What I was = talking about are simply the security properties of the various players. = Any DoH or DoT resolver can be authenticated, because you are = connecting to it over TLS. No Do53 resolver can be authenticated. If = you are able to authenticate the network, meaning that you are using = 802.1X and evaluating the cert in a secure way (which is not trivial to = configure), and you know that it is operated in such a way that a rogue = Do53 resolver would not be reachable by your device, then when you are = on that network, that resolver is equivalently safe whether you are = talking to it with Do53, DoT or DoH. When you are on some other = network, it is only safe it you talk to it using DoH or DoT. Another security property: DoH can be used on any network where HTTPS = traffic is allowed to exit without being examined. Sure, you can = maintain a blocklist, but this is going to be a losing battle: the = people who are motivated to make DoH work will figure out ways to make = it work around your block list. Another security property: DoT can be blocked, because it doesn=E2=80=99t = look just like HTTPS traffic. These security properties are facts. Which resolver is safer to use is = an opinion. I have a great deal of sympathy for your opinion about = QuadX resolvers, and had no intention of arguing with you about that = opinion. Where the disconnect came in is that it appeared that you = were contradicting facts in the process of arguing your opinion. --Apple-Mail=_3E9EFA07-4219-4C3B-94DA-8AF12A5536DA Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 On = Aug 16, 2019, at 12:19 PM, Bret Jordan <jordan.ietf@gmail.com> wrote:
 It is your = opinion that a QuadX DoH resolver is less dangerous than the DNS (DoH or = Do53) that is provided by your internal network. 

I=E2=80=99m sorry, maybe I haven=E2=80=99= t been very skillful in responding to you on this.   I think I see = where the disconnect is now.   I don=E2=80=99t actually think this. =   Let=E2=80=99s enumerate the players here:

  1. Do53 resolver on the local network
  2. DoT = resolver on the local network
  3. DoH resolver on the = local network
  4. DoH resolver on QuadX, as you put = it
  5. DoH resolver on my home network, reachable from = outside
  6. DoH resolver on my ISP=E2=80=99s network, = reachable from outside

And:
  1. Locked down host, can=E2=80=99t = access any resolver other than that configured by the operator
  2. BYO host, not controlled by the operator

If we have host = (1), is it better off communicating with resolvers (1), (2), or (3)? =   That is, what should the local operator configure?

The answer is that it = depends on the network.   If the network is locked down as you say, = and the device can=E2=80=99t leave the facility, then it=E2=80=99s = probably just a matter of whether the operator cares that the queries = are going over the wire in the clear.  If, on the other hand, the = network can=E2=80=99t be locked down quite that tightly, then it may be = worthwhile to have PKI authentication.   If I were setting this up, = I=E2=80=99d install a cert on all site-owned devices, and use that to = validate that I=E2=80=99m really talking to the DoT or DoH resolver I = intend.   Now, whether to use DoT or Doh is just down to whether = I=E2=80=99m concerned about blocking.   If I=E2=80=99m concerned = about blocking, DoH is better; if I=E2=80=99m not, I think it=E2=80=99s = about even.

Now,= what if we have device (2) on a locked-down network?   The = operator has two choices.   Either allow the device to do DoH, or = block all outgoing connections that aren=E2=80=99t explicitly permitted, = including connections to port 443.   If such hosts want to connect = out, they have to go through a proxy that can look at the HTTP = traffic.

Now, = consider the case of your own device.  If you are carrying it = around, there will be places where your traffic can be snooped.   = But it=E2=80=99s not going to be easy to aggregate it (probably, depends = on the operators of the networks amongst which you wander, and the = configuration of your handset).  If you connect to resolver (4), = then your queries can be aggregated and perhaps correlated with your web = traffic.   I agree that that=E2=80=99s bad, and something to try to = avoid.

I also = agree that a resolver on your home network that you connect to from = off-site may be better than (4), even though it allows your ISP to track = your DNS traffic.

But what I was talking about was not this sort of modeling. =   What I was talking about are simply the security properties of = the various players.   Any DoH or DoT resolver can be = authenticated, because you are connecting to it over TLS.   No Do53 = resolver can be authenticated.   If you are able to authenticate = the network, meaning that you are using 802.1X and evaluating the cert = in a secure way (which is not trivial to configure), and you know that = it is operated in such a way that a rogue Do53 resolver would not be = reachable by your device, then when you are on that = network, that = resolver is equivalently safe whether you are talking to it with Do53, = DoT or DoH.   When you are on some other network, it is only safe = it you talk to it using DoH or DoT.

Another security property: DoH can be used on any network = where HTTPS traffic is allowed to exit without being examined.   = Sure, you can maintain a blocklist, but this is going to be a losing = battle: the people who are motivated to make DoH work will figure out = ways to make it work around your block list.

Another security property: DoT can be = blocked, because it doesn=E2=80=99t look just like HTTPS = traffic.

These = security properties are facts.   Which resolver is safer to use is = an opinion.   I have a great deal of sympathy for your opinion = about QuadX resolvers, and had no intention of arguing with you about = that opinion.   Where the disconnect came in is that it appeared = that you were contradicting facts in the process of arguing your = opinion.

= --Apple-Mail=_3E9EFA07-4219-4C3B-94DA-8AF12A5536DA-- From nobody Fri Aug 16 12:55:50 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7BC05120823 for ; Fri, 16 Aug 2019 12:55:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, TO_MALFORMED=0.1, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=tele.no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jnTMggJ_Brhs for ; Fri, 16 Aug 2019 12:55:45 -0700 (PDT) Received: from gorgon.tele.no (gorgon.tele.no [IPv6:2001:700:800::70]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BFA4C120090 for ; Fri, 16 Aug 2019 12:55:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=tele.no; s=20180731; h=Content-Transfer-Encoding:Content-Type:In-Reply-To:MIME-Version :Date:Message-ID:From:References:Cc:To:Subject:Sender:Reply-To:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=6aoTOpya23CegzcuK3RxgvBTr98ZAf8KQORD/Nt9jMU=; b=QCFTZ0JRf6nyjS4tcjfIePSjxM CD2lOAlV33gypbq2+JcGxCuvHxU6qtm3+z9Dd6jz2BNokLENAEHo+Mf78EU0wCYb8cwJigBcAvori GJHNRq+yv/QoaOabR0QmdW4cBtvBo5UuwbZYSp3sPB7jg+qeX7cuyLWZOWbGBJw5+QQr8PR9BdN9J J46K6zPdJ2VSix/EgczNamLRE/4I58//GBLU92PHKKCWsVkyu61Q0jc9jABxDJlaEl0/A2R6tUEZk 0M4i813P5kFBvqgJeq1mpDdpKqn0z+o1zscNlpmBAnZy3C77kYwKOV71AhgNyQ+IuaR/d9V+sYZFY mfIeDD8A==; Received: from pilt1.tele.no ([2001:700:800::20] helo=[IPv6:::1]) by gorgon.tele.no with esmtp (Exim 4.92) (envelope-from ) id 1hyiK6-0004QA-Qa; Fri, 16 Aug 2019 21:55:42 +0200 To: Bret Jordan Cc: ADD Mailing list References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <8e00891f-2aa2-ee11-559a-b5a8967b22d9@nostrum.com> <2C23D415-84F9-4B6C-B67B-0CC3EB600520@gmail.com> <2704899B-E43D-4978-A3C9-30E9E7CEBEBD@fugue.com> <4CC4C262-BEF4-4B39-ACB1-A595AB66D6CD@gmail.com> From: Frode Kileng Message-ID: Date: Fri, 16 Aug 2019 21:55:42 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Content-Language: en-US Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 19:55:49 -0000 On 16/08/2019 18:30, Bret Jordan wrote: > Not every devices supports this.  Please stop using the “endpoints can > do everything” argument that been fronted by the “there is nothing > wrong camp” for the last 5 years. How can "your" ISP DNS-filtering solution protect my children when not connected that specific network? How can it protect if the end-point bypass the network specific DNS using DoT or some "hidden" mechanisms? How can a "FQDN matching rule" protect when the malware/"dangerous content" is distributed from a previously un-classified source or distributed from a source normally considered safe? Wanting to add competitive advantages compared to other ISPs by offering a DNS-based filtering solution is a perfectly good business argument but I cannot understand the argument that this is the only or best solution for this specific use-case. Frode > > Thanks, > Bret > PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050 > "Without cryptography vihv vivc ce xhrnrw, however, the only thing > that can not be unscrambled is an egg." > >> On Aug 16, 2019, at 12:56 AM, Frode Kileng > > wrote: >> >> On 15/08/2019 23:58, Bret Jordan wrote: >> >>> If you say that the parental controls you have signed up for and >>> paid money for are no longer going to work, you might get a >>> different answer. >> >> There are numerous other client-side child-safe products in the >> markets that will continue to work perfectly well. Please please stop >> using this "save the children" argument that has been fronted by the >> "anti-encryption camp" for the last 5 years. >> >> frodek >> >> >> >> >> -- >> Add mailing list >> Add@ietf.org >> https://www.ietf.org/mailman/listinfo/add > From nobody Fri Aug 16 12:57:35 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1A4C8120823 for ; Fri, 16 Aug 2019 12:57:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pdeATF_dzXLv for ; Fri, 16 Aug 2019 12:57:31 -0700 (PDT) Received: from mail-qt1-x82c.google.com (mail-qt1-x82c.google.com [IPv6:2607:f8b0:4864:20::82c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4FF96120090 for ; Fri, 16 Aug 2019 12:57:31 -0700 (PDT) Received: by mail-qt1-x82c.google.com with SMTP id 44so7360805qtg.11 for ; Fri, 16 Aug 2019 12:57:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=65U+QYNaQMRzUqhuiDtEyIYA2XX++o4mWnUSFE8ktxI=; b=xDYeVzRZv9yNbz3PIbskBne3g4jqU6iRQZZ1Ou8FJEN4e60kyu6c2BOcmGoMMX6yJ5 q34NDR02Oansmn1ks7n7AypwWOwPk44oowE9cwRh85ehG7B/aQ0ewqkSD1dBh7/lSAXu yAdsLoM+5caJcMUgf2iKAH0qtJLp4rB8GXRi5roniN+vNqMuoZdyLV15fgCTGZ/tQVG+ SszUDENDQfxb+lejly5HLncc3hIzzcECFrZZmV/W9FsDRNm39/pXk2vngePPjdkPjA1+ m17Ev00lfeB4GwHBtqqGnwPMGZu8r2W/v/yuM5WTN2lrHs9H1493da1kn/iPn4wav2a9 1YxA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=65U+QYNaQMRzUqhuiDtEyIYA2XX++o4mWnUSFE8ktxI=; b=Vd6e3nBdi+7G8+SL0m21tWibjuLV2h7rD4UNE4l9d16xuMtmPevP3QuLQNI5NHWLWB HNO8NnSdLR1xYib49I/oH18dHR7iiA5TD/AstwwS5oDo4Yq+lr+Zn9+Nc2GT/bWYRCFy Ke1OyAhwDY0fx5Yc1jKiSsFaRl1CSJmdOkp+f2eLZJd5BCUJxOQQWQtlWpudu/uIM7h8 QPoUF4SrxSb3v3Y0QUnhnleaqIbjS9u4g+aZAJiX2goDZAi4oG9hU68t71UqZHqAHodJ 0ZTlopCnYxJ5YqhSAvEeA+3fVacKAdzbUrdmkUJ18XcflXu/Y8j5p6xEGZXsw+2f48Dg cb4A== X-Gm-Message-State: APjAAAUSNrskgotVGTEUkxo2KEb7kNfkylpakmH6cll95hofvZoUz85j RVzx37/O9hdeMdYAq28nn0Lv/g== X-Google-Smtp-Source: APXvYqwjJN4X+SGCYR4qm9DlwyixeL9a0vg1s/uTh/tXr2vRju08lG8YjlJVBrdQByjRQaPt24kSuQ== X-Received: by 2002:ac8:6996:: with SMTP id o22mr10268782qtq.233.1565985450480; Fri, 16 Aug 2019 12:57:30 -0700 (PDT) Received: from ?IPv6:2001:470:c1a2:1:7ded:86d1:e927:7777? ([2001:470:c1a2:1:7ded:86d1:e927:7777]) by smtp.gmail.com with ESMTPSA id v7sm3271145qte.86.2019.08.16.12.57.29 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 16 Aug 2019 12:57:30 -0700 (PDT) From: Ted Lemon Message-Id: Content-Type: multipart/alternative; boundary="Apple-Mail=_2CD546FF-1B51-49AA-AD48-8345CEFFE9D0" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Fri, 16 Aug 2019 12:57:28 -0700 In-Reply-To: Cc: "STARK, BARBARA H" , Bret Jordan , ADD Mailing list To: Joe Abley References: <09178E42-08B2-4958-A1C8-AF507AEE8834@fugue.com> <0BDD4F7F-7301-476A-80DA-0CC84EE4557D@fugue.com> <2BE3565E-4D1D-4C3D-8E5E-9BBF0A6C76EC@fugue.com> <2D09D61DDFA73D4C884805CC7865E6114E279D3E@GAALPA1MSGUSRBF.ITServices.sbc.com> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] When Two Worlds Collide X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 19:57:34 -0000 --Apple-Mail=_2CD546FF-1B51-49AA-AD48-8345CEFFE9D0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 On Aug 16, 2019, at 12:52 PM, Joe Abley wrote: > Some people have laughed bitterly about the fact that DoH (for = privacy!) has the run-on effect of SSL-stripping *all* TLS traffic at = your border (for surveillance!) and so the outcome doesn't match the = goal. In a sense, it=E2=80=99s a win that this is the case: if people whose = security model depends on this kind of blocking weren=E2=80=99t doing it = before, they were at risk. The prevalence of DoH is forcing them to do = what they ought to have been doing in the first place. As an added bonus, no sensible person would use a network that does this = for anything but its intended purpose. --Apple-Mail=_2CD546FF-1B51-49AA-AD48-8345CEFFE9D0 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 On = Aug 16, 2019, at 12:52 PM, Joe Abley <jabley@hopcount.ca> = wrote:
Some people = have laughed bitterly about the fact that DoH (for privacy!) has the = run-on effect of SSL-stripping *all* TLS traffic at your border (for = surveillance!) and so the outcome doesn't match the = goal.

In a = sense, it=E2=80=99s a win that this is the case: if people whose = security model depends on this kind of blocking weren=E2=80=99t doing it = before, they were at risk.   The prevalence of DoH is forcing them = to do what they ought to have been doing in the first place.

As an added bonus, no = sensible person would use a network that does this for anything but its = intended purpose.

= --Apple-Mail=_2CD546FF-1B51-49AA-AD48-8345CEFFE9D0-- From nobody Fri Aug 16 13:28:23 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CD50E1200E5 for ; Fri, 16 Aug 2019 13:28:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id R_ycw8nsY8zg for ; Fri, 16 Aug 2019 13:28:20 -0700 (PDT) Received: from mail-yw1-xc2e.google.com (mail-yw1-xc2e.google.com [IPv6:2607:f8b0:4864:20::c2e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 04EFD120830 for ; Fri, 16 Aug 2019 13:28:20 -0700 (PDT) Received: by mail-yw1-xc2e.google.com with SMTP id l79so2176825ywe.11 for ; Fri, 16 Aug 2019 13:28:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=cV6J+FX48kV2ejKooG617M3bEJ5Ob3z6g/OiKn6Ihx8=; b=Tf51w+IWwbh7uUydo1V9wYspSWN9wclDi/EihCWMaY1dy6UbPQLAwg8mg1swshvHJW AP7eudpPWN2DrlGZ+kIdXUufDOUPICCVE76e3WzgDifhcoEOyyDm+NhjfWyRfYCIaJYc VAXtpSjgwze5sEaA9DjQBxPXxhIJFCdPZI02CDLBR0zVY50BuslD3f7Hqwpds5ACGfuw sw5w9lYG4m+Kmq/YTOhrL8SfhbV1nKYotCAqZvamKi0J4GkF7xrdWqiVxA7TSFKDFxJf waDR2QYWyr12PA29QDcQQ7JA91Gorum6tNGQaMfSieYT2qOEGDEnfjvCfBpNnbNQjxEh +BcA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=cV6J+FX48kV2ejKooG617M3bEJ5Ob3z6g/OiKn6Ihx8=; b=gtjSZT20R4Y10qzERwcvrvLYVmMtnljGAnkFVLd6uD3OnnwwVQs/fRGU+jzK2muU9t 7yD+YXdAREA31u/Hb2qhH57ZRy4mKO8Bp62b3Kl1pU4LQo8G/W0pSDprKklAQADvuK3n Q3OIAFdnKDWd/1/I43nnII948z+MwP3g5Gg8O/7FcISk8Ia5523mTVVBXbKqSplikZ3S ZcTVH22oAIkgg1lZBm3911F4nXrU1lxuyF5Pp92DnOR7Z2plH3P0s6ecOekPGCp0Od71 vMDmzIL2Gswc6RRN/bwxIlTrPTVsiGsifySjN4e7kf+APGqYMF3tGxXaaDj+kjR+kGYb X3Zw== X-Gm-Message-State: APjAAAUhQ63Cky6osztnlXO7Q1X7v3LhYZ6iUSa7At26UNXQGVkAS5PT ZB4k2b4ywwxd8ghUSvMebLcVTslWpk7xp3ClJqU= X-Google-Smtp-Source: APXvYqz/PSX4f8dQDQu3cx+mzrqLWP5hZDVTMdCI2mx3g6UMiL9RUv5jJXASgEXXYbWG73l5vpmXjbg/Kz0lhccnqdk= X-Received: by 2002:a0d:e6cb:: with SMTP id p194mr8283418ywe.83.1565987299070; Fri, 16 Aug 2019 13:28:19 -0700 (PDT) MIME-Version: 1.0 References: <09178E42-08B2-4958-A1C8-AF507AEE8834@fugue.com> <0BDD4F7F-7301-476A-80DA-0CC84EE4557D@fugue.com> <2BE3565E-4D1D-4C3D-8E5E-9BBF0A6C76EC@fugue.com> <2D09D61DDFA73D4C884805CC7865E6114E279D3E@GAALPA1MSGUSRBF.ITServices.sbc.com> In-Reply-To: From: Alec Muffett Date: Fri, 16 Aug 2019 21:28:08 +0100 Message-ID: To: Joe Abley Cc: "STARK, BARBARA H" , ADD Mailing list , Ted Lemon , Bret Jordan Content-Type: multipart/alternative; boundary="000000000000af184c059041d48f" Archived-At: Subject: Re: [Add] When Two Worlds Collide X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 20:28:22 -0000 --000000000000af184c059041d48f Content-Type: text/plain; charset="UTF-8" On Fri, 16 Aug 2019, 20:52 Joe Abley, wrote: > > Some people have laughed bitterly about the fact that DoH (for privacy!) > has the run-on effect of SSL-stripping *all* TLS traffic at your border > (for surveillance!) and so the outcome doesn't match the goal. > I would be surprised if DoH was truly the cause of that, since (unless you embrace instrumenting the clients) I understand that full MITM will be a necessity for filtering TLS 1.3, which will be far more impactful than DoH in this respect: https://forums.theregister.co.uk/forum/all/2018/08/13/tls_13_approved/ -a --000000000000af184c059041d48f Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Fri, 16 Aug 2019, 20:52 Joe Abley, <jabley@hopcount.ca> wrote:

Some people have laughed bitterly about the fact that DoH (for privacy!) ha= s the run-on effect of SSL-stripping *all* TLS traffic at your border (for = surveillance!) and so the outcome doesn't match the goal.

I would be sur= prised if DoH was truly the cause of that, since (unless you embrace instru= menting the clients) I understand that full MITM will be a necessity for fi= ltering TLS 1.3, which will be far more impactful than DoH in this respect:=


-a


<= blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px= #ccc solid;padding-left:1ex">
--000000000000af184c059041d48f-- From nobody Fri Aug 16 13:30:34 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3DB1112008B for ; Fri, 16 Aug 2019 13:30:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9Isqt24xGszd for ; Fri, 16 Aug 2019 13:30:30 -0700 (PDT) Received: from mail-yb1-xb32.google.com (mail-yb1-xb32.google.com [IPv6:2607:f8b0:4864:20::b32]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9095A120018 for ; Fri, 16 Aug 2019 13:30:30 -0700 (PDT) Received: by mail-yb1-xb32.google.com with SMTP id b16so2389952ybq.0 for ; Fri, 16 Aug 2019 13:30:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=vig7zEdRyaa+p+sLtzHpAcLKXAMp5AOgWoMK9os3cy4=; b=bT9jgzM3aPART3XGI5g93hpdkOWDRtRqwiTm88EIrPEkDwQ3aZgqRphZRe8x2Iu6A+ aaRryU8UOk4rDBotWxFRt+Bq2GZ/O1ZW6mOEUY5kQb4QXshn1HD9roJTQSlEPWt5Ldp5 wPnITV/0Gjwd8NskfnbjLhQYDCftmjtMvw9T8ZhjWkBV0125cF4cF5FtmCmNugzMPFTG 8O1vZOHRou0XS6eGUetTuvMViubRA7amhu2ntUz81FTNyxheXFWemWnyduYovvE1enHE 0lC4cBgc8gSFJ6mkkoV8t+iIXBqOEtHIdaHr7mC6OqB4sbB1YpRALXjEahvY10MpNbSt gLSQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=vig7zEdRyaa+p+sLtzHpAcLKXAMp5AOgWoMK9os3cy4=; b=uiIA5kXBDayw8BdAwOPQDE/P6ZUOeeOVAx3ykKVKabIu2zXe8+NTn/rKfImEPI75Pk RTBK7WrhYXovOp5qIe+jeVqUK/+rlPlTpwGNoXiU4C5O2Hlp1yC1MbKBB/RXArAhuW9V WhQgJ+bitWO+n4gamE64LCxZxEJcvGC1erGFBMUITrxsSIOh+IWY3veMCoKACxj5Stp9 7Y9ssEgCn/EHUGjCQCYydZ5tTKa90Lk2AM07Bn8cxePac2tYBZrhlR4hVSup9SKfPSYt b58/iMhxc9YbqS6lOEC5vyYqiiu/b9kFCcBDJE8eDlu4p+jBaC+X0xtxc4vVjoK1JQg0 8l0A== X-Gm-Message-State: APjAAAUJy3PfdHp3CcgmPbYqUCqJMrVYp17FUagtYhg/ZqLflfta6e5X 7Co4iS21v59oJYWlqRwcXQF6/BkilGLwy7WSd0E= X-Google-Smtp-Source: APXvYqzwBGstZsvcNPZTwK9MEKZA0/tR80gduGizHjW8d7Y833wlLGM+ClyljYYpjo1aPMihbcgZiYlD6y6dGssFvHk= X-Received: by 2002:a5b:642:: with SMTP id o2mr9152029ybq.70.1565987429660; Fri, 16 Aug 2019 13:30:29 -0700 (PDT) MIME-Version: 1.0 References: <09178E42-08B2-4958-A1C8-AF507AEE8834@fugue.com> <0BDD4F7F-7301-476A-80DA-0CC84EE4557D@fugue.com> <2BE3565E-4D1D-4C3D-8E5E-9BBF0A6C76EC@fugue.com> <2D09D61DDFA73D4C884805CC7865E6114E279D3E@GAALPA1MSGUSRBF.ITServices.sbc.com> In-Reply-To: From: Alec Muffett Date: Fri, 16 Aug 2019 21:30:19 +0100 Message-ID: To: Joe Abley Cc: "STARK, BARBARA H" , ADD Mailing list , Ted Lemon , Bret Jordan Content-Type: multipart/alternative; boundary="00000000000077bc85059041dcbd" Archived-At: Subject: Re: [Add] When Two Worlds Collide X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 20:30:32 -0000 --00000000000077bc85059041dcbd Content-Type: text/plain; charset="UTF-8" On Fri, 16 Aug 2019, 21:28 Alec Muffett, wrote: > > I would be surprised if DoH was truly the cause of that, since (unless you > embrace instrumenting the clients) I understand that full MITM will be a > necessity for filtering TLS 1.3, which will be far more impactful than DoH > in this respect: > > https://forums.theregister.co.uk/forum/all/2018/08/13/tls_13_approved/ > Oops; article link: https://www.theregister.co.uk/2018/08/13/tls_13_approved/ -a --00000000000077bc85059041dcbd Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


On Fri, 16 Aug 2019, 21:28 Alec Muffett, <= alec.muffett@gmail.com> wr= ote:

<= /div>
I would be surprised if DoH was truly the cause of t= hat, since (unless you embrace instrumenting the clients) I understand that= full MITM will be a necessity for filtering TLS 1.3, which will be far mor= e impactful than DoH in this respect:

https://forums.t= heregister.co.uk/forum/all/2018/08/13/tls_13_approved/

Oops; article l= ink:=C2=A0

-a
=


<= br>
--00000000000077bc85059041dcbd-- From nobody Fri Aug 16 13:47:25 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BCC481200C4 for ; Fri, 16 Aug 2019 13:47:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7epZ8xhxgHn6 for ; Fri, 16 Aug 2019 13:47:21 -0700 (PDT) Received: from mail-yw1-xc2a.google.com (mail-yw1-xc2a.google.com [IPv6:2607:f8b0:4864:20::c2a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AF648120018 for ; Fri, 16 Aug 2019 13:47:21 -0700 (PDT) Received: by mail-yw1-xc2a.google.com with SMTP id n205so2192975ywb.10 for ; Fri, 16 Aug 2019 13:47:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=77UZK0izcUXzPmUU5lCaPhzI8EjK4tLU+Z65bAqP42c=; b=afLyJrDTaPmB/hl8cq8B4BmgETLtUrvLXlEB9Er9NR3Zl7eaTA6ZVRSy9/jqOhLg31 P23Bh7hA6sQHIuSGAfmi1hUQ8v5X+vgoH88Nw/KDwp4EdXm+Rwbn8CMD8LWTQsB0PbvV uGy/YBKdZ2Kkxxz949SFts05VgVGV4XTVAmPfdC8Ik/LQ5DL+X7byEhx4rucU46a59Ca hT1YEQ4EyQnlcbruTRXA7CTrMeF+vAgFvXswizkOjPqvbhmCzc2UZNWseulR8mO9nCmR 2KCeVW1mkoFGYrKigcet5LSZbXDbrf6KXrDkVz2VZPt8cNAlbncA3bNR+OO+IFz+kA7k TAEw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=77UZK0izcUXzPmUU5lCaPhzI8EjK4tLU+Z65bAqP42c=; b=uQdxfmP5Lxi+GJTrn7uCLkTlTPLblER7UvDriILaR2rPflM+Dwo3aIcz6xd0XAzr5K ROqPoRjySoYzp5wQs1OxJFEdHiqGkETfRzOGs/hliKH925CIhWi64dfmUSkhhWmx5oOd 6RsEjo5eklz2cmg6dhpuqN5O98CFNAEeUDynbqcUHJknMhZnwWB45N41HtxkpV3t5dvB elWcVDsfCD3ZetZzQWKrvxwTyZDsPZNmL7LYikKOOcicg2mzuWRGufb+7ezZCZI4hHW2 QXGU+/XPcD4PDjUhPg76zYV6gUJXDhJjLmH0bAq4E0ai1zCC/dnYcGBY6qT96BrTg2UL bHow== X-Gm-Message-State: APjAAAUSQoI7JbeSvXHxiLRslPkj7jlFA6RLqaEjki8ganii5Di4jJrL zp/bCHtyrVkjVwJW/W8ojhMGYPboYsP4V1248tw= X-Google-Smtp-Source: APXvYqx2xLriKFULtcvDMakGb2NQGJ97BXfJUzYcSCebp/DICnP2K3sNmFwjLBK08yaQFAp2WQe/BYzOIhFv7OpfCMY= X-Received: by 2002:a0d:fc44:: with SMTP id m65mr7798122ywf.109.1565988440747; Fri, 16 Aug 2019 13:47:20 -0700 (PDT) MIME-Version: 1.0 References: <09178E42-08B2-4958-A1C8-AF507AEE8834@fugue.com> <0BDD4F7F-7301-476A-80DA-0CC84EE4557D@fugue.com> <2BE3565E-4D1D-4C3D-8E5E-9BBF0A6C76EC@fugue.com> <2D09D61DDFA73D4C884805CC7865E6114E279D3E@GAALPA1MSGUSRBF.ITServices.sbc.com> In-Reply-To: From: Alec Muffett Date: Fri, 16 Aug 2019 21:47:11 +0100 Message-ID: To: Joe Abley Cc: "STARK, BARBARA H" , ADD Mailing list , Ted Lemon , Bret Jordan Content-Type: multipart/alternative; boundary="000000000000bbb7830590421886" Archived-At: Subject: Re: [Add] When Two Worlds Collide X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 20:47:24 -0000 --000000000000bbb7830590421886 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Incidentally, for anyone who is unfamiliar with exactly this same argument as applied to TLS 1.3, this Twitter thread of mine from 2018 may serve as a primer: https://twitter.com/AlecMuffett/status/977267092541100039 >A source in the room described it to me as having been (attempted to be) "packed" with people to support the [surveillance] extension, ostensibly in support of banking compliance =E2=80=94 link below =E2=80=94 irrespective t= hat /my/ friends in the City are quite sanguine about TLS1.3. [images] --000000000000bbb7830590421886 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Incidentally, for anyone who is unfamiliar with exactly t= his same argument as applied to TLS 1.3, this Twitter thread of mine from 2= 018 may serve as a primer:


&g= t;A source in the room described it to me as having been (attempted to be) = "packed" with people to support the [surveillance] extension, ost= ensibly in support of banking compliance =E2=80=94 link below =E2=80=94 irr= espective that /my/ friends in the City are quite sanguine about TLS1.3.
[images]



--000000000000bbb7830590421886-- From nobody Fri Aug 16 14:10:55 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6D920120071 for ; Fri, 16 Aug 2019 14:10:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xULryJZyFAyO for ; Fri, 16 Aug 2019 14:10:52 -0700 (PDT) Received: from mail-lf1-x12e.google.com (mail-lf1-x12e.google.com [IPv6:2a00:1450:4864:20::12e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C8462120018 for ; Fri, 16 Aug 2019 14:10:51 -0700 (PDT) Received: by mail-lf1-x12e.google.com with SMTP id 62so4967379lfa.8 for ; Fri, 16 Aug 2019 14:10:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=Gz1bSTJsKETjtscWYZvUupWJBfccx9lzN+GJAVcnZU4=; b=RQMXwpnK/Jb836F3k7IYwRIHiX/c6MzsFTbIaxDhYnnsDQq1irTPk3nYyo80jCXarZ iRYEMx5wGjL8ap+NAVBy5CwDVU3McH619BvuhByerVxLvSwlH0g0uVoCnmbfT+E8xypF 4UrrOP4Wap1H8EHS0l5OXrgeyU7Y/BDQ8iNo35xJG9V7tzlRb+0KDqfDkCwCA1OtGfBQ Jcp4eMImvRzLRr1ZJnaUrffnxMZVCUCFZKy/8fx+xmbZWcRqS9QTKXhgT79/z12DdHou XtFwzlq63gMHI6UXLFXGFszlB/4usmEQUY1Thv/sRQeYx4HyueAOT+F3GxqyONaI5LoL 99Uw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=Gz1bSTJsKETjtscWYZvUupWJBfccx9lzN+GJAVcnZU4=; b=tj3/3obrfRs6SEWZ02yv8i01lX/ApR+08Nq5BUJGNSXIGvI0zucBY97urrkffeqsxz fab56PNmKTOV3D7cybRw09Paidyk8YKrdafspDky1D/6qOh+bvCIigtvaDhDLY6WU2ep CegyZiMMLvTIHCGS1PEaaS06LfUFdUWuyfpjwGUVt3aXZbCZkU+MirBBjia7mZR/VTKN E7TfgKPa6mhU/StwveIZwC45qr3nmzlwrPyh1pd/6uRgEKjWw7y1uee3bLV8VQrI6MDG x6PV8FgzZWAW6nuA5SKbMPbdURlxdiVN6o3a5a1UG7aAmJwVO5BXm21OuHWfGyK2r15x bwhA== X-Gm-Message-State: APjAAAVAQbh5wPTNoYg6XfjmtQ3HPnb645b3l99Z8dvjvqo3gwY5GrCg b3zlbRTTt3N9dpY7v8wJUQBsL7XQU5zH/DUnWFPvcA== X-Google-Smtp-Source: APXvYqyJs/RrIiw+ibkeyH/h+ZyceELj2Be9bbh4vU4Q2ogOX24Qlqkrk5shMop1m4mITXKaOJmkecERKqSEEnjWpnA= X-Received: by 2002:ac2:442d:: with SMTP id w13mr6630288lfl.184.1565989849992; Fri, 16 Aug 2019 14:10:49 -0700 (PDT) MIME-Version: 1.0 References: <09178E42-08B2-4958-A1C8-AF507AEE8834@fugue.com> <0BDD4F7F-7301-476A-80DA-0CC84EE4557D@fugue.com> <2BE3565E-4D1D-4C3D-8E5E-9BBF0A6C76EC@fugue.com> <2D09D61DDFA73D4C884805CC7865E6114E279D3E@GAALPA1MSGUSRBF.ITServices.sbc.com> In-Reply-To: From: Eric Rescorla Date: Fri, 16 Aug 2019 23:10:13 +0200 Message-ID: To: Joe Abley Cc: "STARK, BARBARA H" , ADD Mailing list , Ted Lemon , Bret Jordan Content-Type: multipart/alternative; boundary="000000000000bb23830590426c61" Archived-At: Subject: Re: [Add] When Two Worlds Collide X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 21:10:55 -0000 --000000000000bb23830590426c61 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable I'd like to note that it's not necessary to MITM DoH traffic. In order to deploy a MITM proxy, you need to control the devices in the network (so you can install a trust anchor). In this case, you can simply use that same access to disable DoH directly or point it at your own server. -Ekr On Fri, Aug 16, 2019 at 9:52 PM Joe Abley wrote: > On 16 Aug 2019, at 15:34, STARK, BARBARA H wrote: > > >> DoH can=E2=80=99t be blocked without locking down every device on the = network. > > > > It=E2=80=99s easy enough to block well-known public DNS resolver IP add= resses > (or public DNS resolvers using port 443) without locking down every devic= e. > > Several people who run substantial IT networks have told me that they wer= e > already set up to strip SSL at their border and inspect the contents of a= ll > TLS-wrapped traffic before DoH was even standardised. They did this becau= se > it fit the security posture they had already identified as being necessar= y > based on a risk analysis. They distribute organisation-specific > certificates to devices used on their network to make this work. > > A couple of them have recommended particular firewall products to do this= . > > A couple of them are already happily blocking DoH because they have their > own requirements for devices to use internally-operated resolvers that > (e.g.) block resolution of certain domains, e.g. as part of a malware > mitigation strategy. They are blocking DoH without needing to curate a li= st > of well-known DoH services by address. > > I understand that in many IT networks that use DNS-based control planes > much of what I described above is extra work and extra expense. However, > having unmanaged devices on your network means that all of this is always= a > moving target. Security is not absolute; you do the amount that makes sen= se > given your risk analysis. > > Some people have laughed bitterly about the fact that DoH (for privacy!) > has the run-on effect of SSL-stripping *all* TLS traffic at your border > (for surveillance!) and so the outcome doesn't match the goal. I suspect > that the situations where that's true are places where there was already > limited expectations of privacy (many corporate networks I have attached > to, the Internet within the borders of some jurisdictions, home networks > operated by Paul Vixie who very reasonably imposes his own rules), althou= gh > I am wary of generalisation. > > People used to spend nothing on security. Now they spend more. Tomorrow > the costs will go up. This is kind of the nature of the game. > > I don't understand why people insist that blocking DoH is impossible, whe= n > what they really mean is that there's a threat today that wasn't there > yesterday, and now we have to deal with that as well. > > > Joe > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --000000000000bb23830590426c61 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
I'd like to note that it's not necessary to M= ITM DoH traffic. In order to deploy a MITM proxy, you need to control the d= evices in the network (so you can install a trust anchor). In this case, yo= u can simply use that same access to disable DoH directly or point it at yo= ur own server.

-Ekr

<= br>

On Fri, Aug 16, 2019 at 9:52 PM Joe Abley <jabley@hopcount.ca> wrote:
On 16 Aug 2019, at 15:34, STARK, BARBAR= A H <bs7652@att.com<= /a>> wrote:

>> DoH can=E2=80=99t be blocked without locking down every device on = the network.
>
> It=E2=80=99s easy enough to block well-known public DNS resolver IP ad= dresses (or public DNS resolvers using port 443) without locking down every= device.

Several people who run substantial IT networks have told me that they were = already set up to strip SSL at their border and inspect the contents of all= TLS-wrapped traffic before DoH was even standardised. They did this becaus= e it fit the security posture they had already identified as being necessar= y based on a risk analysis. They distribute organisation-specific certifica= tes to devices used on their network to make this work.

A couple of them have recommended particular firewall products to do this.<= br>
A couple of them are already happily blocking DoH because they have their o= wn requirements for devices to use internally-operated resolvers that (e.g.= ) block resolution of certain domains, e.g. as part of a malware mitigation= strategy. They are blocking DoH without needing to curate a list of well-k= nown DoH services by address.

I understand that in many IT networks that use DNS-based control planes muc= h of what I described above is extra work and extra expense. However, havin= g unmanaged devices on your network means that all of this is always a movi= ng target. Security is not absolute; you do the amount that makes sense giv= en your risk analysis.

Some people have laughed bitterly about the fact that DoH (for privacy!) ha= s the run-on effect of SSL-stripping *all* TLS traffic at your border (for = surveillance!) and so the outcome doesn't match the goal. I suspect tha= t the situations where that's true are places where there was already l= imited expectations of privacy (many corporate networks I have attached to,= the Internet within the borders of some jurisdictions, home networks opera= ted by Paul Vixie who very reasonably imposes his own rules), although I am= wary of generalisation.

People used to spend nothing on security. Now they spend more. Tomorrow the= costs will go up. This is kind of the nature of the game.

I don't understand why people insist that blocking DoH is impossible, w= hen what they really mean is that there's a threat today that wasn'= t there yesterday, and now we have to deal with that as well.


Joe
--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--000000000000bb23830590426c61-- From nobody Fri Aug 16 14:15:57 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 82B4B120018 for ; Fri, 16 Aug 2019 14:15:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.68 X-Spam-Level: X-Spam-Status: No, score=-1.68 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_INVALID=0.1, DKIM_SIGNED=0.1, T_SPF_HELO_PERMERROR=0.01, T_SPF_PERMERROR=0.01] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=fail (1024-bit key) reason="fail (message has been altered)" header.d=nostrum.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7crl_D5O-d9C for ; Fri, 16 Aug 2019 14:15:54 -0700 (PDT) Received: from nostrum.com (raven-v6.nostrum.com [IPv6:2001:470:d:1130::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0CA64120071 for ; Fri, 16 Aug 2019 14:15:54 -0700 (PDT) Received: from MacBook-Pro.roach.at (99-152-146-228.lightspeed.dllstx.sbcglobal.net [99.152.146.228]) (authenticated bits=0) by nostrum.com (8.15.2/8.15.2) with ESMTPSA id x7GLFmGk036219 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NO); Fri, 16 Aug 2019 16:15:50 -0500 (CDT) (envelope-from adam@nostrum.com) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=nostrum.com; s=default; t=1565990151; bh=YDOw18IajahUIBFzdDvikM012GrL6imXG0HRU3eYSws=; h=Subject:To:References:From:Date:In-Reply-To; b=AFULj3gkd4MGWTtjgw947gdM8M7LHZjQF60BoYXsqiweqMZYVxHzLe+ARHVGAy51f 7tHTKKPgByMPfv0hT4J/uqz5xr5de0PJC21AYQZS8IqDLTARUuERPUO/Q/SXQooylf XIsDRce1qB0ZQ3+pOHrehQi9jKJc5PGqbVpWEOOA= X-Authentication-Warning: raven.nostrum.com: Host 99-152-146-228.lightspeed.dllstx.sbcglobal.net [99.152.146.228] claimed to be MacBook-Pro.roach.at To: Bret Jordan , Ted Lemon , ADD Mailing list References: <09178E42-08B2-4958-A1C8-AF507AEE8834@fugue.com> <0BDD4F7F-7301-476A-80DA-0CC84EE4557D@fugue.com> From: Adam Roach Message-ID: <6698db4f-89ff-e5be-09a5-eb544f76ebc9@nostrum.com> Date: Fri, 16 Aug 2019 16:15:43 -0500 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Content-Language: en-US Archived-At: Subject: Re: [Add] When Two Worlds Collide X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 21:15:56 -0000 On 8/16/19 12:53 PM, Bret Jordan wrote: >> It is not the only way to do this, but when you compare the costs and benefits of using DoH to the costs and benefits of trusting the network’s resolver, it’s pretty clear which of these choices makes the ecosystem more secure. > In your opinion. The problem with this whole debate is the absolutes and claiming that one’s opinion is the consensus or is by default the best thing to do. Where is the research and data that backs that up? This seems unlikely to be productive. When people bring up the behaviors that are driving applications to directly use encrypted DNS, there is a certain subset of operators who feel attacked, and who claim they're being painted as "the bad guys." I've received off-list correspondence indicating that at least one operator felt that their participation in this conversation was becoming more difficult exactly because of this factor. So I think it would be far more useful to focus on solvable problems -- like "best practices for deploying DoH and DoT" -- than it would be trying (almost certainly in vain) to come to consensus on which approach is actually "more secure." /a From nobody Fri Aug 16 14:26:26 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E8675120071 for ; Fri, 16 Aug 2019 14:26:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4SUCDwO2GPLL for ; Fri, 16 Aug 2019 14:26:23 -0700 (PDT) Received: from mail-io1-xd2a.google.com (mail-io1-xd2a.google.com [IPv6:2607:f8b0:4864:20::d2a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EE818120018 for ; Fri, 16 Aug 2019 14:26:22 -0700 (PDT) Received: by mail-io1-xd2a.google.com with SMTP id x4so8997160iog.13 for ; Fri, 16 Aug 2019 14:26:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=K+wUbpjnFdTAneg+TizylW7CLbCxAuOa0PN7ptymBa8=; b=TgwJ3qh2bYL65V7F70TMHAhjOvSFT2NuOOAxhcWJynkIBMi9BfekiZrJ97dZywZqs4 5zM7jSvODM40I4R+vuybmwXpGkjZ2DUsBESRIiucuzqPIKDR3b/6dJ74cUhM2/5HmAW6 eAqqjlUTbokAu9oNlU/5YIsHxftG7XJfaB60J6DBzuvoc6ALzUJ75ZCaex14OhWXJ9Eg mihjjIO3copXzhbIBNPq9Ah16HPNpqLTY7DB4q+o7MCHkvqM5Z+GvO0Osy0NYp8iju/e iePDAca0MUy32v/+8b3jLALVQHGfjwZrr1TILar+IuoRG2lqBzSb0p8nwG7JqUNxDGcW Ta1A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=K+wUbpjnFdTAneg+TizylW7CLbCxAuOa0PN7ptymBa8=; b=G2EEvH7rcD5oxgehpf6Pvu6PuYxr9QdfXDZDEukiw+LLjo4ueB6b6QzL9XNYd1f9Xq PN9U2AsFPmbXinN9/lFbeepNBPQ1Gg/87a0gs4y9PE/k76MJ0wIxempOPKCDl7uWlRAk Le5RchpfyetCxsSBkTRvzCdQcx0R+XflI9wrzAwsOBI7SSG8zdxDjhbjKvj+5J7WeRRh I4ZHjwKh1i4qo2WoC1ChPdULUJW5hdZsZP4RRNCIPpbLY7Yqi5MSljGLNlEqbVDbVknC CraBxsh+AiPg75j7uZmMZOC3Wx22ia9WK7EL0EUK0xNoWVVBxHsKJG5+cX4OSHtkWjiq NycA== X-Gm-Message-State: APjAAAXGYNIhqT3yjlpUXTTPXM2gp1XJyR1fFKz8o3njJxLDMbwHA3Ii opDZHmkZpX9nRu/ONtNqB3/bugOeR/05LB2qn5g= X-Google-Smtp-Source: APXvYqxxN3No+ZC2fJjAG9uj8nT1LcMkJ27JNGyvzWnhyyq3sW62ewttvdDt2qHzhlqzZOOryZ9KQ8IOiLXq2s4GksY= X-Received: by 2002:a6b:7e07:: with SMTP id i7mr4373885iom.254.1565990782156; Fri, 16 Aug 2019 14:26:22 -0700 (PDT) MIME-Version: 1.0 References: <09178E42-08B2-4958-A1C8-AF507AEE8834@fugue.com> <0BDD4F7F-7301-476A-80DA-0CC84EE4557D@fugue.com> <6698db4f-89ff-e5be-09a5-eb544f76ebc9@nostrum.com> In-Reply-To: <6698db4f-89ff-e5be-09a5-eb544f76ebc9@nostrum.com> From: Rob Sayre Date: Fri, 16 Aug 2019 14:26:10 -0700 Message-ID: To: Adam Roach Cc: Bret Jordan , Ted Lemon , ADD Mailing list Content-Type: multipart/alternative; boundary="0000000000004ac525059042a4a2" Archived-At: Subject: Re: [Add] When Two Worlds Collide X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 21:26:25 -0000 --0000000000004ac525059042a4a2 Content-Type: text/plain; charset="UTF-8" On Fri, Aug 16, 2019 at 2:16 PM Adam Roach wrote: > So I think it would be far more useful to focus on solvable problems -- > like "best practices for deploying DoH and DoT" > Documents like that tend to be more effective when there's more deployment experience. It seems a little premature to write one of those right now. Doing nothing, and then seeing what happens, is always an option. A lot of the suggestions have veered into UI preferences and OS APIs, both of which are out of scope for the IETF. It seems like a subset of list participants want a document that says shipping software that defaults to a centralized resolver is against the rules in some way. I'm not sure there's a useful way to specify that, at least in the IETF. thanks, Rob --0000000000004ac525059042a4a2 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Fri, Aug 16, 2019 at 2:16 PM Adam Roac= h <adam@nostrum.com> wrote:
So I think it would be far more useful to focus on solvable problems -- like "best practices for deploying DoH and DoT"
<= div>
Documents like that tend to be more effective when there= 's more deployment experience. It seems a little premature to write one= of those right now. Doing nothing, and then seeing what happens, is always= an option.

A lot of the suggestions have veered i= nto UI preferences and OS APIs, both of which are out of scope for the IETF= .

It seems like a subset of list participants want= a document that says shipping software that defaults to a centralized reso= lver is against the rules in some way. I'm not sure there's a usefu= l way to specify that, at least in the IETF.

thank= s,
Rob

--0000000000004ac525059042a4a2-- From nobody Fri Aug 16 14:30:08 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BBB43120018 for ; Fri, 16 Aug 2019 14:30:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id e9qNqoswgy5n for ; Fri, 16 Aug 2019 14:30:02 -0700 (PDT) Received: from NAM03-CO1-obe.outbound.protection.outlook.com (mail-eopbgr790091.outbound.protection.outlook.com [40.107.79.91]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A8EF0120071 for ; Fri, 16 Aug 2019 14:30:02 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=GLMYeNEy6mhkIEjkST4MMKP9kepCFjQq/QLx0XR0VuPfcQjLFLlqG/eLolyOouUUi7jNO/v7wf+nmeYpOpBdbrIGXndqcSpa/mJLGcnHShEGFE7tVC1WxLkBKq6B3zY7atv0qAmDODbhxCCzy7kJpoy6UYWoNcTJTLBcItkVCX+9+wKWmu50v1bfRBL3AuPqlLtpdAkY6CfHoRSEG2Qw89D9crcSw2cItltOjE7HvpwmBCDGYpJTDzHvHGUVfswlien88O3z69IJ4jz0lnRO0DmZYrZnulgXhxYmufkF112rpLeBpj2dbQiVfN0VXZ4FB6bxe/swft57MqzsImi1Cg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=WmyQ43gNrzphCELGx05BZjqN9r5JrqTvb5l+2jcBZwk=; b=muph+YkGriTWTErQNQNLC2E1KCq55e0JqAI0aQY3nD08ScibK2XWoe4YE2IKPItfKCq95ffQe8hw1v+hPP+ccA9jCr1OaHBktChAr6Lg1Qs70ryPgCvfQOQNbkHjP7233eBmJ3emHFOg4MuiaXINuPhUhWt8ov4YwU3b69T/Od/VgLpNFxT1tVHPWPOauOhGOYHwNQjR1ilSxy/VOiZj22Vvi/DMsNIUr2wcjwzVQ4d3i8pc1tFXkVeuf+spennxxRzk1D/pnGxRBer7GfgDxIghu1bWqAVD0Vuv1BWwGg5+ZIVMSZOLRUsoZuGQM2aLUlj4IPY5K3Bsvyy8gfavvA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=microsoft.com; dmarc=pass action=none header.from=microsoft.com; dkim=pass header.d=microsoft.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=WmyQ43gNrzphCELGx05BZjqN9r5JrqTvb5l+2jcBZwk=; b=T1fveu7iY5tENufowcJfDhbV8pmOBzTGtJotQw0tHhBgsLUec2UtVTDtysfH5z1VmKBsPJCS6eEqTxchFBTn2UPIw34l6mnl95HemYeWZRAfg+JbURoEHT75jaIss2uDG5Lb/fAm+9GVIbTBjhSp36CFZv5kDsnPZxi/dBd2g0o= Received: from MWHPR21MB0192.namprd21.prod.outlook.com (10.173.52.138) by MWHPR21MB0189.namprd21.prod.outlook.com (10.173.52.135) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2178.6; Fri, 16 Aug 2019 21:30:01 +0000 Received: from MWHPR21MB0192.namprd21.prod.outlook.com ([fe80::3040:4d29:2935:9a7f]) by MWHPR21MB0192.namprd21.prod.outlook.com ([fe80::3040:4d29:2935:9a7f%3]) with mapi id 15.20.2178.010; Fri, 16 Aug 2019 21:30:01 +0000 From: Tommy Jensen To: Eric Rescorla CC: Bret Jordan , ADD Mailing list , Ted Lemon , Mikael Abrahamsson Thread-Topic: [Add] [Ext] Validity of network administrator role Thread-Index: AQHVUyp4iPKBDVjDIkCVQCaF07YMYKb8bWGAgAAYXgCAAALNx4AAB4wAgAABwwCAAAMtAIAALdqAgAAMjICAAAWfMYAAvMaAgAC5ge0= Date: Fri, 16 Aug 2019 21:30:00 +0000 Message-ID: References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <8e00891f-2aa2-ee11-559a-b5a8967b22d9@nostrum.com> <2C23D415-84F9-4B6C-B67B-0CC3EB600520@gmail.com> <2704899B-E43D-4978-A3C9-30E9E7CEBEBD@fugue.com> <4CC4C262-BEF4-4B39-ACB1-A595AB66D6CD@gmail.com> , In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Jensen.Thomas@microsoft.com; x-originating-ip: [131.107.147.184] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 01ec3880-4821-413c-49be-08d72290e52b x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600158)(711020)(4605104)(1401327)(4618075)(2017052603328)(7193020); SRVR:MWHPR21MB0189; x-ms-traffictypediagnostic: MWHPR21MB0189: x-ms-exchange-purlcount: 3 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-forefront-prvs: 0131D22242 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(4636009)(136003)(376002)(346002)(366004)(396003)(39860400002)(189003)(199004)(229853002)(54906003)(6916009)(22452003)(6116002)(186003)(446003)(99286004)(66556008)(19627405001)(14444005)(81166006)(6436002)(2906002)(102836004)(256004)(966005)(33656002)(76176011)(81156014)(5070765005)(3846002)(14454004)(64756008)(6506007)(7696005)(76116006)(316002)(10290500003)(53546011)(66476007)(66446008)(66946007)(8936002)(478600001)(5660300002)(71200400001)(66574012)(6306002)(7736002)(26005)(55016002)(105004)(6246003)(236005)(476003)(86362001)(8990500004)(74316002)(71190400001)(66066001)(4326008)(53936002)(9686003)(52536014)(10090500001)(25786009)(606006)(11346002)(54896002)(486006)(8676002); DIR:OUT; SFP:1102; SCL:1; SRVR:MWHPR21MB0189; H:MWHPR21MB0192.namprd21.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: xNUFG7kaw0lS93tJXWsuWmEHKzVXnZhF8w4gPa4lPxZFMRRjXfGzmPxU7Rk0jwrjklY/j2hAptFmmikC6k1t5+SUMGRgNG4IavRTsJo0YxUj2SeyVD9/SjlWmIlkWIKWzcqooKkOnQmUhO0qgKP4nBA8Gt6OdS3Wv4Qt0rDy4rvNcPyPljqRabuQkdTADU3J6oUFGMdGZQzMN3TSukgY7wxVSa4DdzIUdfWkx8ZpodFFfEi9esVGZDTCLDHjVL/+0DUAtKCG/cOSSW0LMu16bg2lhfi7/SGxCMnJdrsI0xq7qM5lnLVqkDr3hy58SxmzrwZ7gy2dLicEHLSH8H+lf8vqCzFJh/u2r0OPmA6BqmBG29SmuNJ0qUEvdcExNTuuwoQpXrXxgnx6xxrvYviTlCldt3AVuqE76UWwW7pRG2E= x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_MWHPR21MB019247C1BF5D1C2F421C8D46FAAF0MWHPR21MB0192namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: 01ec3880-4821-413c-49be-08d72290e52b X-MS-Exchange-CrossTenant-originalarrivaltime: 16 Aug 2019 21:30:00.9467 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: HUYkQlWFseNa2TMcMxPWrByBT/2VvO2rDBPFlQ4C6+w9CUVM9tfAi54cwwvE25xSCDsxJbZnlnWnaL7PohtZrw== X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR21MB0189 Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 21:30:07 -0000 --_000_MWHPR21MB019247C1BF5D1C2F421C8D46FAAF0MWHPR21MB0192namp_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable ekr> This is something we have looked at and my do, but given that there ar= e likely to be only about 3-4 resolvers capable of serving as the default f= or a system as large as Firefox, this doesn't seem like it will improve pri= vacy that much. However, that is only a drawback if the random selection has equal weights = for each server. By adding a growing right tail of smaller DNS servers whic= h carry weights of, for example, ~0.1 or ~0.01 versus CloudFlare's 1.0 you = could distribute default selection according to each provider's estimated v= olume handling. This would provide more decentralization than ~1-2 provider= s per continent at least. Thanks, Tommy ________________________________ From: Eric Rescorla Sent: Friday, August 16, 2019 3:19 AM To: Tommy Jensen Cc: Bret Jordan ; ADD Mailing list ; T= ed Lemon ; Mikael Abrahamsson Subject: Re: [Add] [Ext] Validity of network administrator role On Fri, Aug 16, 2019 at 1:21 AM Tommy Jensen > wrote: ekr> Who says we're not worried about it? Do you have a concrete plan for a= ddressing it? I'd suggest having a list of TRRs with the default value being selected ran= domly per client rather than just one TRR distributed to a large geographic= population such as North America. For example, in my Firefox install (Fire= fox Quantum, 68.0.2) under "Enable DNS over HTTPS" I only see "CloudFlare (= Default)" and "Custom" as options. This is something we have looked at and my do, but given that there are lik= ely to be only about 3-4 resolvers capable of serving as the default for a = system as large as Firefox, this doesn't seem like it will improve privacy = that much. -Ekr If there were many TRRs listed, and which one labeled as default randomly c= hosen at first launch, then at least there would be some distribution of DN= S traffic for users who will never check that setting (i.e. most users), an= d the same configuration freedom for those those users who will check it. A= nother option might be testing several TRRs from the list at first launch a= nd picking the fastest to respond to attempt some sorting by geographic eff= iciency. Perhaps operators of public DNS servers on this mailing list would be inter= ested in knowing what bar they would have to clear to get on such a list. W= ould it be identical to the existing published terms between Mozilla and Cl= oudFlare? Something else? Would you be willing to collaborate on such terms= with other browsers for a common standard for TRRs? Even in my ideal world where the browser cooperates with the platform on de= ciding when to use which DNS stub, there will be times when the browser wil= l know more about the user's DNS intentions than the platform, and in those= cases there should definitely be a larger variety of TRRs available to any= given large-scale population. Thanks, Tommy ________________________________ From: Add > on behalf of = Eric Rescorla > Sent: Thursday, August 15, 2019 3:43 PM To: Bret Jordan > Cc: ADD Mailing list >; Ted Lemon >; Mikael Abrahamsson > Subject: Re: [Add] [Ext] Validity of network administrator role n Thu, Aug 15, 2019 at 11:59 PM Bret Jordan > wrote: It just baffles me silly that we are worried about people seeing DNS traffi= c and we are not worried about certain cloud providers harvesting, mining, = and tracking all users behavior on the internet and all of their interactio= ns (email and such) that they do with the cloud providers. It seems like if= we _REALLY_ wanted to improve privacy and security we would do something a= bout that. Who says we're not worried about it? Do you have a concrete plan for addres= sing it? Maybe create an encrypted email system that was done in the browser and pr= otected all email from being reviewed and monitored. Here too, it seems like the question isn't one of desirability but practica= lity. There have been quite a few attempts at E2E encrypted email, none ver= y successful. Just wishing does not make it so. Further, it would be nice if browsers did a better job of preventing and d= enying all tracking tools. You mean like: https://webkit.org/blog/8828/intelligent-tracking-prevention= -2-2/ or https://blog.mo= zilla.org/blog/2019/06/04/firefox-now-available-with-enhanced-tracking-prot= ection-by-default/? -Ekr Thanks, Bret PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 "Without cryptography vihv vivc ce xhrnrw, however, the only thing that can= not be unscrambled is an egg." On Aug 15, 2019, at 1:14 PM, Mikael Abrahamsson > wrote: On Thu, 15 Aug 2019, Ted Lemon wrote: Blocking is a form of tampering. One purpose of DoH is to make blocking im= practical, so that the end user isn=92t forced to choose a path that=92s su= bject to tampering and intercept. As with any technology this is dual use. If the customer has purchased a so= lution that's built around certain mechanisms, bypassing these mechanisms m= ight be against the users' wishes. There is no correct answer here, and anyone pretending to know the correct = answer for all situations is wrong. So let's fall back on the "principle of least astonishment". If you tell th= e users "your browser is now doing DNS lookups using a cloud provider and y= our ISP is no longer in that loop", what do you think their response will b= e? (might need explanation to the user, but still) -- Mikael Abrahamsson email: swmike@swm.pp.se-- Add mailing list Add@ietf.org https://www.ietf.org/mailman/listinfo/add -- Add mailing list Add@ietf.org https://www.ietf.org/mailman/listinfo/add --_000_MWHPR21MB019247C1BF5D1C2F421C8D46FAAF0MWHPR21MB0192namp_ Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable
ekr> This is something we have looked at and my do, but given that there are likely = to be only about 3-4 resolvers capable of serving as the default for a syst= em as large as Firefox, this doesn't seem like it will improve privacy that= much.

However, that is only a drawback if the random selection has equal weights = for each server. By adding a growing right tail of smaller DNS servers whic= h carry weights of, for example, ~0.1 or ~0.01 versus CloudFlare's 1.0 you = could distribute default selection according to each provider's estimated volume handling. This would provide= more decentralization than ~1-2 providers per continent at least.

Thanks,
Tommy
From: Eric Rescorla <ekr= @rtfm.com>
Sent: Friday, August 16, 2019 3:19 AM
To: Tommy Jensen <Jensen.Thomas@microsoft.com>
Cc: Bret Jordan <jordan.ietf@gmail.com>; ADD Mailing list <= add@ietf.org>; Ted Lemon <mellon@fugue.com>; Mikael Abrahamsson &l= t;swmike@swm.pp.se>
Subject: Re: [Add] [Ext] Validity of network administrator role
 


On Fri, Aug 16, 2019 at 1:21 AM Tom= my Jensen <Jensen.Thomas@= microsoft.com> wrote:
ekr> Who says we're not worried about it? = Do you have a concrete plan for addressing it?

I'd suggest having a list of TRRs with the default= value being selected randomly per client rather than just one TRR distribu= ted to a large geographic population such as North America. For example, in my Firefox install (Firefox Quantum= , 68.0.2) under "Enable DNS over HTTPS" I only see "CloudFla= re (Default)" and "Custom" as options. 

This is something we have looked at and my do, but given that there ar= e likely to be only about 3-4 resolvers capable of serving as the default f= or a system as large as Firefox, this doesn't seem like it will improve pri= vacy that much.

-Ekr


If there were many TRRs listed, and which one labe= led as default randomly chosen at first launch, then at least there would b= e some distribution of DNS traffic for users who will never check that setting (i.e. most users), and the sam= e configuration freedom for those those users who will check it. Another op= tion might be testing several TRRs from the list at first launch and pickin= g the fastest to respond to attempt some sorting by geographic efficiency.

Perhaps operators of public DNS servers on this mailing list would be inter= ested in knowing what bar they would have to clear to get on such a list. W= ould it be identical to the existing published terms between Mozilla and Cl= oudFlare? Something else? Would you be willing to collaborate on such terms with other browsers for a comm= on standard for TRRs? 

Even in my ideal world where the browser cooperates with the platform on de= ciding when to use which DNS stub, there will be times when the browser wil= l know more about the user's DNS intentions than the platform, and in those= cases there should definitely be a larger variety of TRRs available to any given large-scale population.

Thanks,
Tommy
Fr= om: Add <a= dd-bounces@ietf.org> on behalf of Eric Rescorla <ekr@rtfm.com>=
Sent: Thursday, August 15, 2019 3:43 PM
To: Bret Jordan <jordan.ietf@gmail.com>
Cc: ADD Mailing list <add@ietf.org>; Ted Lemon <mellon@fugue.com>; Mikael Abrahamsson <swmike@swm.pp.se><= br> Subject: Re: [Add] [Ext] Validity of network administrator role
 
n Thu, Aug 15, 2019 at 11:59 PM Bret Jordan <jordan.ietf@gmail.com&= gt; wrote:

It just baffles me silly that we are worried about people seeing DNS t= raffic and we are not worried about certain cloud providers harvesting, min= ing, and tracking all users behavior on the internet and all of their inter= actions (email and such) that they do with the cloud providers. It seems like if we _REALLY_ wanted to improv= e privacy and security we would do something about that.

Who says we're not worried about it? Do you have a concrete plan for a= ddressing it?


 Maybe create an encrypted email system that was done in the brow= ser and protected all email from being reviewed and monitored.

Here too, it seems like the question isn't one of desirability but pra= cticality. There have been quite a few attempts at E2E encrypted email, non= e very successful. Just wishing does not make it so.


 Further, it would be nice if browsers did a better job of preven= ting and denying all tracking tools. 

You mean like: https://webkit.org/blog/8828/intelligent-tracking-prevention-2-2/ or https://blog.mozilla.org/blog/2019/06/04/firefox-now-available-with-enhance= d-tracking-protection-by-default/?

-Ekr



Thanks,
Bret
PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050
"Without cryptography vihv vivc ce xhrnrw, however, the only t= hing that can not be unscrambled is an egg."

On Aug 15, 2019, at 1:14 PM, Mikael Abrahamsson <swmike@swm.pp.se> wrote:

On Thu, 15 Aug 2019, Ted Lemon wrote:

Blocking is a form of tampering.  One purpos= e of DoH is to make blocking impractical, so that the end user isn=92t forc= ed to choose a path that=92s subject to tampering and intercept.

As with any technology this is dual use. If the customer has purchased a so= lution that's built around certain mechanisms, bypassing these mechanisms m= ight be against the users' wishes.

There is no correct answer here, and anyone pretending to know the correct = answer for all situations is wrong.

So let's fall back on the "principle of least astonishment". If y= ou tell the users "your browser is now doing DNS lookups using a cloud= provider and your ISP is no longer in that loop", what do you think t= heir response will be? (might need explanation to the user, but still)

--
Mikael Abrahamsson    email: swmike@swm.pp.se--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add

--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add=
--_000_MWHPR21MB019247C1BF5D1C2F421C8D46FAAF0MWHPR21MB0192namp_-- From nobody Fri Aug 16 14:32:14 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5128D12007C for ; Fri, 16 Aug 2019 14:32:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=hopcount.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4mZxRilS6PjT for ; Fri, 16 Aug 2019 14:32:10 -0700 (PDT) Received: from mail-io1-xd2d.google.com (mail-io1-xd2d.google.com [IPv6:2607:f8b0:4864:20::d2d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C2776120018 for ; Fri, 16 Aug 2019 14:32:10 -0700 (PDT) Received: by mail-io1-xd2d.google.com with SMTP id s21so9065438ioa.1 for ; Fri, 16 Aug 2019 14:32:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hopcount.ca; s=google; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=Q4+HxNxX8zNakAb2DHFko5xP2rzk4H4SZMP/fHulUrY=; b=Ov4py9Ayy0Kpt4JWM52fW1IsCtIOIyosMCtKx1byBAsKSvrW7FgvQeQaymqsruhtmw 45w6Z/KfGxP3TLMCsCQh4tVgCybhsTDx1erw7TOLZNxoPWxW22B1jJ616n6qJ8VIcMLR vtnwpM5hZitNC7KO6Jbbsxt+yQoNQSrshN6cg= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=Q4+HxNxX8zNakAb2DHFko5xP2rzk4H4SZMP/fHulUrY=; b=Rj5jCCJJZfHdZ6mLvsbTEHl/0tuJkmLCKewkcFS7sgk9a5yt+++OlM5VHLvtcudcSC wCQpdqRgfAc6+0D/OWyD8vCJY992E6Za7T6zs9GCLOdfw8F2HbQ7Tb7qEZSpIcryxzfa ThXQZPjGfAG9uPssn9s2Gt/DEHhV9dp+1OhQ+f9RNjfs1bxEXfRHdz0+56P3gLhtL6AE gLRbF2IHG7O6u+uYcEPuWqZF71Wn0hH8xgn2ECbpUJUIMW0e7MLe2n9j6oo4ys7FiekE Oqq2owq8yv4jgOqA/Nq3tybGA2Mp3RCbf+IQEaCzMniNEccu1zknJnq8YiOzJQeS6rwr tcEw== X-Gm-Message-State: APjAAAWEubIcVC/rHXAaf6nSY2W0LjvJue7fYczedDl37Hn9xIdLUjsk AM5wqKBmFlKhQ1urGN7DoTjr1w== X-Google-Smtp-Source: APXvYqwVGbgycPKIQDvkoPfHA1xCdrxpQjind7XUZ3D7pnXIAA1Su907Or0B8crqkYPa2qE9fye28A== X-Received: by 2002:a6b:bcc4:: with SMTP id m187mr13653097iof.16.1565991129561; Fri, 16 Aug 2019 14:32:09 -0700 (PDT) Received: from ?IPv6:2607:f2c0:e786:128f:80ee:69e7:9906:351e? ([2607:f2c0:e786:128f:80ee:69e7:9906:351e]) by smtp.gmail.com with ESMTPSA id b17sm6508014ion.55.2019.08.16.14.32.07 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 16 Aug 2019 14:32:08 -0700 (PDT) From: Joe Abley Message-Id: <50618337-3358-4F81-AEAF-F479330488A7@hopcount.ca> Content-Type: multipart/signed; boundary="Apple-Mail=_2C595D08-EC0E-473B-A9EA-610A568471B2"; protocol="application/pgp-signature"; micalg=pgp-sha1 Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Fri, 16 Aug 2019 17:32:06 -0400 In-Reply-To: Cc: "STARK, BARBARA H" , ADD Mailing list , Ted Lemon , Bret Jordan To: Eric Rescorla References: <09178E42-08B2-4958-A1C8-AF507AEE8834@fugue.com> <0BDD4F7F-7301-476A-80DA-0CC84EE4557D@fugue.com> <2BE3565E-4D1D-4C3D-8E5E-9BBF0A6C76EC@fugue.com> <2D09D61DDFA73D4C884805CC7865E6114E279D3E@GAALPA1MSGUSRBF.ITServices.sbc.com> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] When Two Worlds Collide X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 21:32:12 -0000 --Apple-Mail=_2C595D08-EC0E-473B-A9EA-610A568471B2 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Hey, On 16 Aug 2019, at 17:10, Eric Rescorla wrote: > I'd like to note that it's not necessary to MITM DoH traffic. In order = to deploy a MITM proxy, you need to control the devices in the network = (so you can install a trust anchor). In this case, you can simply use = that same access to disable DoH directly or point it at your own server. Insisting on a local certificate to be trusted being trusted by those = uncontrolled devices is straightforward; device owners either install = the certificate or you don't get to use HTTPS. It's the kind of problem = that solves itself. It's control without the need for direct management. I agree that if you don't allow unmanaged devices on your network you = have a different set of options. Joe --Apple-Mail=_2C595D08-EC0E-473B-A9EA-610A568471B2 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iF0EARECAB0WIQSAt40QkiztAcvphdg0jwy9hlI6LAUCXVcg1gAKCRA0jwy9hlI6 LMD0AJ9PLwJQ9Vr274OdGpv6yJrKkCBFAQCfeTJkddDeigxL39tZaMhnbVja8l8= =GRVr -----END PGP SIGNATURE----- --Apple-Mail=_2C595D08-EC0E-473B-A9EA-610A568471B2-- From nobody Fri Aug 16 14:36:16 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5276A12007C for ; Fri, 16 Aug 2019 14:36:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id q4EFZDhEX3TF for ; Fri, 16 Aug 2019 14:36:13 -0700 (PDT) Received: from mail-lf1-x130.google.com (mail-lf1-x130.google.com [IPv6:2a00:1450:4864:20::130]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 50C07120018 for ; Fri, 16 Aug 2019 14:36:13 -0700 (PDT) Received: by mail-lf1-x130.google.com with SMTP id 62so5001889lfa.8 for ; Fri, 16 Aug 2019 14:36:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=Da68p/uRgVPn7jOKBz/W8wtZKzqZhdTMR0fCPn14ao0=; b=KP7BbMAdxqhKvXGmQvdzJ69kPOex3iTgwFQ2TBgQgdXR0K/uUSqRRTQJQwBFAsZ0Oj hYtMiF24sMBgggan5zJFlTBC492nSd/KgTWOwpVk7WHR1v1GkBvgCwTU8iC3rMlFAqdf Y0pA5W9R6tq5OIZugRjWZ3zq3t7iHZI/EIclBbr165laez4a97L9V9NsadVpUjPc89qL TYLoPFOYbqV4kmREWVMnGFaNUOv/H72PpiwtiwBi13So9EV7M/8c1YVSd9KTO8O6tw05 zs17/QhQvkNGpRSn3yuCi/c8IKCIon8uofvVRbahh9vIudwcJafcv89Bdei2tJRycUT0 FSDg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=Da68p/uRgVPn7jOKBz/W8wtZKzqZhdTMR0fCPn14ao0=; b=bO8lNmLB6xuX2BqcAuFJqC/7aVGb1UI/St7GD11r0W7WMakZhBJWnX07G/QgNEwG37 kSMSb+iwhF99Qhlo2nnLwam3yP2yZfPjDfgPLWyOssEOCMRfgBaWDoNI/Iuek5PizJ3f 9xlKUu8tvLKW+J/jSIIYJT/IUymN9pWVvp3pCMvlGA/KmE/BBJcNt9q0fte+gElqfv+8 1xKQ1lC8du78g3z1QImUuLdqtszahphSMTJSC49fodsafSbU0gaPmheqQbPKlYsGu1Kh UO1zXsoOAVJmbRnluun2viEqn1FFJvut7PGWGkMUTkkyeZIFeDnjtRgW+hRcMin0Yk7c SCmw== X-Gm-Message-State: APjAAAX9MdFifDLD35+mpPTCafUYqBiGM0OtP7LuvyDzTRb2N4jXc0GJ TJyeu6HCMWg0qMpSb9Bbw/dybrEDFSrRvYtYiJ1Dpw== X-Google-Smtp-Source: APXvYqy0L92UDVcJDCYnnR/IH/1I6fc7XbK5I2XkNpeD5T+bZBKbUgF7UQ1HEjWwpy+rc7npwMvUgYb+oNCsfd7U6m0= X-Received: by 2002:a19:7908:: with SMTP id u8mr6296765lfc.178.1565991371528; Fri, 16 Aug 2019 14:36:11 -0700 (PDT) MIME-Version: 1.0 References: <09178E42-08B2-4958-A1C8-AF507AEE8834@fugue.com> <0BDD4F7F-7301-476A-80DA-0CC84EE4557D@fugue.com> <2BE3565E-4D1D-4C3D-8E5E-9BBF0A6C76EC@fugue.com> <2D09D61DDFA73D4C884805CC7865E6114E279D3E@GAALPA1MSGUSRBF.ITServices.sbc.com> <50618337-3358-4F81-AEAF-F479330488A7@hopcount.ca> In-Reply-To: <50618337-3358-4F81-AEAF-F479330488A7@hopcount.ca> From: Eric Rescorla Date: Fri, 16 Aug 2019 23:35:34 +0200 Message-ID: To: Joe Abley Cc: "STARK, BARBARA H" , ADD Mailing list , Ted Lemon , Bret Jordan Content-Type: multipart/alternative; boundary="0000000000006bf03e059042c787" Archived-At: Subject: Re: [Add] When Two Worlds Collide X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 21:36:15 -0000 --0000000000006bf03e059042c787 Content-Type: text/plain; charset="UTF-8" On Fri, Aug 16, 2019 at 11:32 PM Joe Abley wrote: > Hey, > > On 16 Aug 2019, at 17:10, Eric Rescorla wrote: > > > I'd like to note that it's not necessary to MITM DoH traffic. In order > to deploy a MITM proxy, you need to control the devices in the network (so > you can install a trust anchor). In this case, you can simply use that same > access to disable DoH directly or point it at your own server. > > Insisting on a local certificate to be trusted being trusted by those > uncontrolled devices is straightforward; device owners either install the > certificate or you don't get to use HTTPS. It's the kind of problem that > solves itself. It's control without the need for direct management. > My impression is that generally this is not done through manual installation but rather through some sort of management system. In any case, if you can get users to do this you can get them to disable DoH. -Ekr > I agree that if you don't allow unmanaged devices on your network you have > a different set of options. > > > Joe > > --0000000000006bf03e059042c787 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Fri, Aug 16, 2019 at 11:32 PM Joe = Abley <jabley@hopcount.ca> = wrote:
Hey,

On 16 Aug 2019, at 17:10, Eric Rescorla <ekr@rtfm.com> wrote:

> I'd like to note that it's not necessary to MITM DoH traffic. = In order to deploy a MITM proxy, you need to control the devices in the net= work (so you can install a trust anchor). In this case, you can simply use = that same access to disable DoH directly or point it at your own server.
Insisting on a local certificate to be trusted being trusted by those uncon= trolled devices is straightforward; device owners either install the certif= icate or you don't get to use HTTPS. It's the kind of problem that = solves itself. It's control without the need for direct management.
=

My impression is that generally this is no= t done through manual installation but rather through some sort of manageme= nt system.

In any case, if you can get users to do= this you can get them to disable DoH.

-Ekr


I agree that if you don't allow unmanaged devices on your network you h= ave a different set of options.


Joe

--0000000000006bf03e059042c787-- From nobody Fri Aug 16 14:42:37 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 53156120018 for ; Fri, 16 Aug 2019 14:42:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=hopcount.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iruAV_ZkW0nI for ; Fri, 16 Aug 2019 14:42:34 -0700 (PDT) Received: from mail-io1-xd29.google.com (mail-io1-xd29.google.com [IPv6:2607:f8b0:4864:20::d29]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F1670120071 for ; Fri, 16 Aug 2019 14:42:33 -0700 (PDT) Received: by mail-io1-xd29.google.com with SMTP id l7so9097986ioj.6 for ; Fri, 16 Aug 2019 14:42:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hopcount.ca; s=google; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=sMSRqMtGI/21bzd21SHNcaAbKCYYDiSqudHF/G993j8=; b=TBhn2HZN1SqqlZNaKSg4ldPjle+8My3cfgFUOn36p0jZsfhQsxfUjE1EQfC0HPfJP4 qcaEkVTKg0+ANETmXw4RzZZkEMULobrzCvoPGH7hWfa0woY7QPVoiOf5Lnwtkk7E/wSI dj7qqHeTd0H+xxuE99JWVO6bzXuDwKrDHzk5g= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=sMSRqMtGI/21bzd21SHNcaAbKCYYDiSqudHF/G993j8=; b=ufiSmiz3o/DyULzGLq9yLD08GBS/8fM7pmO8BB48KvHsZh7apDpsWA0l9B394Wbbaa TBekGfnwu0USJcZULfdHQQxXBOkTtWeWTHepoTWW/Uke4NJLF9Njij5VM4SjxNc5r03r laVP+0i6Ftr5qG3Sl/fkv6/yBbBxDp+SqL51dgqnIxztMEanu0Dflww6enas1EWGZ+88 LIoj/yeamM6w960fs27ShDZLGntVbaZzfsLKDBQG91l0sc188TacKnx7GWpUB5xZxqQi EauqcTLxy7tYqZSoZf1zoG9mp7mKcFdDiz0hiXxy1GIOeYT5Qv7LGLGm4AIQhy3X948j P0nA== X-Gm-Message-State: APjAAAXuMDC16MeBAkaO4jBPt7qLdphc+d96nu+KyUIyZgPdynrmTu8L ABML/f3027RqkJ2nLfIZqJ8jtg== X-Google-Smtp-Source: APXvYqzGYQ5zk9oUDvR4UGdfllUQSgXakiS5U047qV57adTECPPOZ9vqbHbI2RXdGhCLUzh0ezXJjg== X-Received: by 2002:a5e:9917:: with SMTP id t23mr1188476ioj.23.1565991753173; Fri, 16 Aug 2019 14:42:33 -0700 (PDT) Received: from ?IPv6:2607:f2c0:e786:128f:c5e9:214c:3f97:cf02? ([2607:f2c0:e786:128f:c5e9:214c:3f97:cf02]) by smtp.gmail.com with ESMTPSA id t2sm13698464iod.81.2019.08.16.14.42.31 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 16 Aug 2019 14:42:32 -0700 (PDT) From: Joe Abley Message-Id: <4F898538-E82D-487C-88AF-0EB803690204@hopcount.ca> Content-Type: multipart/signed; boundary="Apple-Mail=_FE809BD9-5A49-476B-AF57-E6109594CE4F"; protocol="application/pgp-signature"; micalg=pgp-sha1 Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Fri, 16 Aug 2019 17:42:30 -0400 In-Reply-To: Cc: "STARK, BARBARA H" , ADD Mailing list , Ted Lemon , Bret Jordan To: Eric Rescorla References: <09178E42-08B2-4958-A1C8-AF507AEE8834@fugue.com> <0BDD4F7F-7301-476A-80DA-0CC84EE4557D@fugue.com> <2BE3565E-4D1D-4C3D-8E5E-9BBF0A6C76EC@fugue.com> <2D09D61DDFA73D4C884805CC7865E6114E279D3E@GAALPA1MSGUSRBF.ITServices.sbc.com> <50618337-3358-4F81-AEAF-F479330488A7@hopcount.ca> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] When Two Worlds Collide X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 21:42:35 -0000 --Apple-Mail=_FE809BD9-5A49-476B-AF57-E6109594CE4F Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii On 16 Aug 2019, at 17:35, Eric Rescorla wrote: > My impression is that generally this is not done through manual = installation but rather through some sort of management system. No doubt that would be a better approach, if you had some sort of = management system. > In any case, if you can get users to do this you can get them to = disable DoH. I believe the concern is that users may be unwittingly carrying in = devices containing software they either don't understand the behaviour = of or don't realise is there. Joe --Apple-Mail=_FE809BD9-5A49-476B-AF57-E6109594CE4F Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iF0EARECAB0WIQSAt40QkiztAcvphdg0jwy9hlI6LAUCXVcjRgAKCRA0jwy9hlI6 LEWtAJ9+lDFOsCweCb15IW4zGWK4rw1IYgCbBEKOE4OlRH0z03fR1O/xUmkQGGI= =3THB -----END PGP SIGNATURE----- --Apple-Mail=_FE809BD9-5A49-476B-AF57-E6109594CE4F-- From nobody Fri Aug 16 14:51:39 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 28ED2120052 for ; Fri, 16 Aug 2019 14:51:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GV4c5UZbNNzz for ; Fri, 16 Aug 2019 14:51:36 -0700 (PDT) Received: from mail-lj1-x22c.google.com (mail-lj1-x22c.google.com [IPv6:2a00:1450:4864:20::22c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4DD97120018 for ; Fri, 16 Aug 2019 14:51:36 -0700 (PDT) Received: by mail-lj1-x22c.google.com with SMTP id m24so6515468ljg.8 for ; Fri, 16 Aug 2019 14:51:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=O4eTxXJ0b5b3VN39TQ/cEU+7A0NzGPKwgXI9Lc2xyis=; b=D1Y5Xke9oVCWHQgW0WzO/lVwpsN/9NFtkECPIoCVJ7XfHuUfG/xX+zjtFqzXHQ0jCb O+Ai/QjeqqkodMrRy/pzpSWtvFfc6KQVBlL9UERTnmDmvqMePedMR/F5D1YOVIe5EWI1 xJ3fk4aQrRS1gP5nx5bN/RWxSqJHtiT89aYVCLf0BJxqaScLJSEWrlOKzHeP2T+KfGGA 5luixKJd3Uy5ajzd1qDMqjIelwFBUQCDikS1/IY1eqLjpYyQCW1Vhfl34uhX+Jjntf8J Zz+prBjgQRIMzNfe1CRyiC57WUBG1VFxsaFhMseKSOp3WPxa0L7EWYV5PUwVfsK5NbAT AB9g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=O4eTxXJ0b5b3VN39TQ/cEU+7A0NzGPKwgXI9Lc2xyis=; b=rwEi7VzbSkd7Gb4PX6lUfp71pkJhCTn8VxwBV6ggpOSqMNMhgczb01mB63/Va8bft6 JS0TLLy5lxHvOOFQTMFK6HZ/GuHUXPm7FTZ7NVdUFYWmtGy5doWYZM0hPZg8AGL1GnqN 1UXRsSjAjDr0P+nyRdGBABiAuq2w/kb9ePpTNGgZfeAyqz50x7EZTOUr5v890SVIdZIj Yn3cWSIBeN4NUg2gAtO4aebC0xNJFYlfxRIHrM5PlDaP6Lzv23Fzv1KdRqfGBHEuJ9ma KhIkHBinDmVevfAVspvHqt9nZ9L3WhtM+k6EQmQYOEkcYp3veutK9fcisaW7uvwglb33 TNvw== X-Gm-Message-State: APjAAAXYc1YXPQxscF7QCaZiLwBOKyuBN7vozbFIgmkyBMjr0K4LTbn8 lrhgpbOi5DzpzFl36VW8eyP2PHzCGip2lRu/xQc/5A== X-Google-Smtp-Source: APXvYqwPPqU+3A8pluVv+N+3QU5MdNy+d9URRWm1zg/B40JxRdr/EcsAiPzTrmSB/JiVq1qBlaRO2H/noZCnSBwcN40= X-Received: by 2002:a2e:9b84:: with SMTP id z4mr6677451lji.75.1565992294579; Fri, 16 Aug 2019 14:51:34 -0700 (PDT) MIME-Version: 1.0 References: <09178E42-08B2-4958-A1C8-AF507AEE8834@fugue.com> <0BDD4F7F-7301-476A-80DA-0CC84EE4557D@fugue.com> <2BE3565E-4D1D-4C3D-8E5E-9BBF0A6C76EC@fugue.com> <2D09D61DDFA73D4C884805CC7865E6114E279D3E@GAALPA1MSGUSRBF.ITServices.sbc.com> <50618337-3358-4F81-AEAF-F479330488A7@hopcount.ca> <4F898538-E82D-487C-88AF-0EB803690204@hopcount.ca> In-Reply-To: <4F898538-E82D-487C-88AF-0EB803690204@hopcount.ca> From: Eric Rescorla Date: Fri, 16 Aug 2019 23:50:58 +0200 Message-ID: To: Joe Abley Cc: "STARK, BARBARA H" , ADD Mailing list , Ted Lemon , Bret Jordan Content-Type: multipart/alternative; boundary="0000000000007090cb059042fe84" Archived-At: Subject: Re: [Add] When Two Worlds Collide X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 21:51:38 -0000 --0000000000007090cb059042fe84 Content-Type: text/plain; charset="UTF-8" On Fri, Aug 16, 2019 at 11:42 PM Joe Abley wrote: > On 16 Aug 2019, at 17:35, Eric Rescorla wrote: > > > My impression is that generally this is not done through manual > installation but rather through some sort of management system. > > No doubt that would be a better approach, if you had some sort of > management system. > > > In any case, if you can get users to do this you can get them to disable > DoH. > > I believe the concern is that users may be unwittingly carrying in devices > containing software they either don't understand the behaviour of or don't > realise is there. > No, I get that but then you wont be able to MITM either. My point is that either (1) you can do MITM, in which case you can disable DoH or (2) you cannot disable DoH, in which case you won't be able to MITM anyway. But in neither case should you need to MITM DoH. -Ekr > Joe > > --0000000000007090cb059042fe84 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Fri, Aug 16, 2019 at 11:42 PM Joe = Abley <jabley@ho= pcount.ca> wrote:
On 16 Aug 2019, at 17:35, Eric Rescorla <ekr@rtfm.com> wrote:

> My impression is that generally this is not done through manual instal= lation but rather through some sort of management system.

No doubt that would be a better approach, if you had some sort of managemen= t system.

> In any case, if you can get users to do this you can get them to disab= le DoH.

I believe the concern is that users may be unwittingly carrying in devices = containing software they either don't understand the behaviour of or do= n't realise is there.

No, I get tha= t=C2=A0 but then you wont be able to MITM either.

= My point is that either (1) you can do MITM, in which case you can disable = DoH or (2) you cannot disable DoH, in which case you won't be able to M= ITM anyway. But in neither case should you need to MITM DoH.
=
-Ekr


Joe

--0000000000007090cb059042fe84-- From nobody Fri Aug 16 14:54:36 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9FCA1120052 for ; Fri, 16 Aug 2019 14:54:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0_8uXba5IwxP for ; Fri, 16 Aug 2019 14:54:33 -0700 (PDT) Received: from mail-io1-xd2f.google.com (mail-io1-xd2f.google.com [IPv6:2607:f8b0:4864:20::d2f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1594F120018 for ; Fri, 16 Aug 2019 14:54:33 -0700 (PDT) Received: by mail-io1-xd2f.google.com with SMTP id z3so9147582iog.0 for ; Fri, 16 Aug 2019 14:54:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=r40jVdzHq6oW5znnOWQZK30CZwQtN0PbHtuGhRXvvpY=; b=TATewdv75Puk5x0EKh9LiuVjYfDZZ06gP8wSLydjbTNGiGAxB9kf39zixLekLdDrt0 DioYt1zIVlT9sNmt0OdB6Ht+F84jDVfJ+Es22fECISZTkwRVRUTi0jScVeV5wwbU6xxj 1n+pL23tRWu5cQJ96j9f2qsZTgPKIhMyGEiPaXcBTlGxwMyNXygutoPfFhaWE0k0/NDD 4kwW22m0prjdWSAUnVK1NcRM0+nJY9TDpAj+9kEm79U8vopgEqpFax4f6+xg1CPejtue efXvuu9XctKDsL4oRSPD2ILBk1fq5HtToTZru0FFmVKF2tZ7TGC/cxc7yBjL9v6PR6J7 +jqw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=r40jVdzHq6oW5znnOWQZK30CZwQtN0PbHtuGhRXvvpY=; b=WJpsTKxQCFjSTUwv+utPFzyEUokTHUm9cYhpSlvlR4oQKlkz1RfIjftpEn5sfX2/6n 3GeRXbviY11zkviI/pafw39KYYyOwskX8jAz4axizv6IZY7vm2sQ+1ewSJmWVCAKXyfU rhguQUhZbQ68C9ezfDEVLbKdQBh6IFh8ZXlASUZkMXoE6OCxxbRws5s4n32t+U62BCx9 ayJtdfPaw7U0XPMQxMlw07kCPlPQd72oRVH7GTT86MNcAW74U7qKLtfcO6hIZVtfi8r4 CoAgYjer68kcqEPkDnxIVJ72xuVqpJieIdChQ8xmaxP2M0bZYAOwkpgVZ/AUs69NRDvC 7kuA== X-Gm-Message-State: APjAAAUauIMI+jBIICV1VLxilN2JMM6B+l/7YZDWbRN85ey7AMN2IqFT sNLTimeDZBsyc4DK5N12a1W/2fc6YwMhujyvC68= X-Google-Smtp-Source: APXvYqzS1WqlmURc6beT+K4ihML7GqunVRb+MSCskNpbGcIAd8gT9DKhFDq5A8NBeJ5JHr0Uu1RAbsEZB4b3jrIus1w= X-Received: by 2002:a5d:8457:: with SMTP id w23mr2001178ior.189.1565992472325; Fri, 16 Aug 2019 14:54:32 -0700 (PDT) MIME-Version: 1.0 References: <09178E42-08B2-4958-A1C8-AF507AEE8834@fugue.com> <0BDD4F7F-7301-476A-80DA-0CC84EE4557D@fugue.com> <2BE3565E-4D1D-4C3D-8E5E-9BBF0A6C76EC@fugue.com> <2D09D61DDFA73D4C884805CC7865E6114E279D3E@GAALPA1MSGUSRBF.ITServices.sbc.com> <50618337-3358-4F81-AEAF-F479330488A7@hopcount.ca> <4F898538-E82D-487C-88AF-0EB803690204@hopcount.ca> In-Reply-To: <4F898538-E82D-487C-88AF-0EB803690204@hopcount.ca> From: Rob Sayre Date: Fri, 16 Aug 2019 14:54:20 -0700 Message-ID: To: Joe Abley Cc: Eric Rescorla , ADD Mailing list , Ted Lemon , "STARK, BARBARA H" , Bret Jordan Content-Type: multipart/alternative; boundary="00000000000008b16b059043096d" Archived-At: Subject: Re: [Add] When Two Worlds Collide X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 21:54:35 -0000 --00000000000008b16b059043096d Content-Type: text/plain; charset="UTF-8" On Fri, Aug 16, 2019 at 2:42 PM Joe Abley wrote: > > I believe the concern is that users may be unwittingly carrying in devices > containing software they either don't understand the behaviour of or don't > realise is there. > Yes, "bring your own device". I think the tension is that DoH will make it more difficult to call these arrangements "secure", but all of the proposals that aim to preserve this claim amount to a backdoor or in-the-clear downgrade that weakens security for all internet users. Organizations that actually value security will provide devices and manage them. thanks, Rob --00000000000008b16b059043096d Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Fri, Aug 16, 2019 at 2:42 PM Joe Abley= <jabley@hopcount.ca> wrote= :

I believe the concern is that users may be unwittingly carrying in devices = containing software they either don't understand the behaviour of or do= n't realise is there.

Yes, "br= ing your own device". I think the tension is that DoH will make it mor= e difficult to call these arrangements "secure", but all of the p= roposals that aim to preserve this claim amount to a backdoor or in-the-cle= ar downgrade that weakens security for all internet users. Organizations th= at actually value security will provide devices and manage them.
=
thanks,
Rob

--00000000000008b16b059043096d-- From nobody Fri Aug 16 15:07:19 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B2EDF12008B for ; Fri, 16 Aug 2019 15:07:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YObOxWxzgdHM for ; Fri, 16 Aug 2019 15:07:16 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AE21A120018 for ; Fri, 16 Aug 2019 15:07:15 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id BF80EBE58; Fri, 16 Aug 2019 23:07:13 +0100 (IST) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id naddyZHBTvcn; Fri, 16 Aug 2019 23:07:12 +0100 (IST) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 241C0BE56; Fri, 16 Aug 2019 23:07:12 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1565993232; bh=gU41VFPF/2V44PIc0PQNwk6fvYA2eZA3yHNnS70Flzk=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From; b=rVGxqB23fX4qmybVfPcOPjQQ08Kko8ACEQKSbONZZ85C5dW4eB4zip+fdprwsy8xQ YG6vAH3CSuxH8yLXvm6LydG08Q6sL1qYi55WLyorTT4uJ3IOiELnNownQerePleBK3 Yqt9dQFWXiw24x9rmNy5lKwmhVLaVES4sWkfGeZI= To: Eric Rescorla , Joe Abley Cc: ADD Mailing list , Ted Lemon , "STARK, BARBARA H" , Bret Jordan References: <09178E42-08B2-4958-A1C8-AF507AEE8834@fugue.com> <0BDD4F7F-7301-476A-80DA-0CC84EE4557D@fugue.com> <2BE3565E-4D1D-4C3D-8E5E-9BBF0A6C76EC@fugue.com> <2D09D61DDFA73D4C884805CC7865E6114E279D3E@GAALPA1MSGUSRBF.ITServices.sbc.com> <50618337-3358-4F81-AEAF-F479330488A7@hopcount.ca> <4F898538-E82D-487C-88AF-0EB803690204@hopcount.ca> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: <51040aae-4769-ee6b-7f5e-dcc54e10b705@cs.tcd.ie> Date: Fri, 16 Aug 2019 23:07:10 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="nATqJgK7OLKE0xGM6BfdxAR5SrpB7Uf4d" Archived-At: Subject: Re: [Add] When Two Worlds Collide X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 22:07:18 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --nATqJgK7OLKE0xGM6BfdxAR5SrpB7Uf4d Content-Type: multipart/mixed; boundary="hMH2qUaXU9h2GMjx8niArwb5rnmUWPJ9F"; protected-headers="v1" From: Stephen Farrell To: Eric Rescorla , Joe Abley Cc: ADD Mailing list , Ted Lemon , "STARK, BARBARA H" , Bret Jordan Message-ID: <51040aae-4769-ee6b-7f5e-dcc54e10b705@cs.tcd.ie> Subject: Re: [Add] When Two Worlds Collide References: <09178E42-08B2-4958-A1C8-AF507AEE8834@fugue.com> <0BDD4F7F-7301-476A-80DA-0CC84EE4557D@fugue.com> <2BE3565E-4D1D-4C3D-8E5E-9BBF0A6C76EC@fugue.com> <2D09D61DDFA73D4C884805CC7865E6114E279D3E@GAALPA1MSGUSRBF.ITServices.sbc.com> <50618337-3358-4F81-AEAF-F479330488A7@hopcount.ca> <4F898538-E82D-487C-88AF-0EB803690204@hopcount.ca> In-Reply-To: --hMH2qUaXU9h2GMjx8niArwb5rnmUWPJ9F Content-Type: multipart/mixed; boundary="------------A894192CA8BE896351E625BC" Content-Language: en-GB This is a multi-part message in MIME format. --------------A894192CA8BE896351E625BC Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hiya, On 16/08/2019 22:50, Eric Rescorla wrote: > My point is that either (1) you can do MITM, in which case you can disa= ble > DoH or (2) you cannot disable DoH, in which case you won't be able to M= ITM > anyway. But in neither case should you need to MITM DoH. Well.... not quite. I think you're assuming how mozilla are implementing DoH - some other application might not have a way to disable DoH at all. And of course, some enterprise admin might conclude that it's easier for them to MitM TLS than to document HOWTO disable DoH for different versions of many different applications, if they can infest an OS root store covering all those applications. All of which is IMO pretty shitty, but might argue for some guidance as to how to achieve a bit more consistency in a few aspects of how clients implement DoH. (Not very confident of that though TBH, could be that encouraging radical diversity in implementation strategy might be as not-good-but-less-bad as consistency;-) Cheers, S. --------------A894192CA8BE896351E625BC Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------A894192CA8BE896351E625BC-- --hMH2qUaXU9h2GMjx8niArwb5rnmUWPJ9F-- --nATqJgK7OLKE0xGM6BfdxAR5SrpB7Uf4d Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAl1XKQ4ACgkQWrL68XsX K+ojpw/9FP/HkbtZ4EwwtllrF+KLCupdTsePdumDL0XH/Of6APAqXyn99+rE5Zr7 t8ZVP4Wp8DtS0+JF4MkT3MboFGcqxtfQ4RZEoHEkAEBKP1JETYUWKnQJRg1qJLbB opW/xFsp1pQa0MM+LgrKdwbQYe44me1zTNAT+YcXHsATxNxTrrenr3JEKtJNusVc URcAqGR5gVr/mK0Vl1zDW7kF0Cqcw3YDFEx2L2U4peOL5mUDzLOZDNlPkpeMgE4K VPTe4tIEMXjSidG+gX7ru+ZAGQ/rz3uVhUWgzCD/6nXCiq2se8rLLCF3whhg42B1 JuW0eRtN2Uhej8Sds+ODUBES7+6IY7E66/iRVWHtud70o+4LWFaUlTiNlZ+Ha2Oi +qCgVTQgKj9+MdvCOm5QulDCD4/5lMzJ0btxXwhlaSe6tVBg+XAmtzjVm7ajlJHU NBORKdNDHXI/JIQ7vV+7qPMVODJi4H/LjqKrukKdURtPGWDnLF1J3/t3ydQpd2Fk xyWb7UIoVpJCUyinTcuqukLwsMDEUXPzcmwXp+Z0lIXZG207ys52744iAD5gmCrz oVPPoJFNRPBros9hbB38dYShdmX8tq8CAGNKiYSUIq4EcgWM/PhlluEaapYGKoc/ gsTSxemeK5hOkp7DhHmiABqhjKW29CzdogbyVtGPD4VDsC58TZA= =zJOK -----END PGP SIGNATURE----- --nATqJgK7OLKE0xGM6BfdxAR5SrpB7Uf4d-- From nobody Fri Aug 16 15:08:34 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1E67C1200C4 for ; Fri, 16 Aug 2019 15:08:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=hopcount.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xFPnLlCWCzeG for ; Fri, 16 Aug 2019 15:08:31 -0700 (PDT) Received: from mail-io1-xd32.google.com (mail-io1-xd32.google.com [IPv6:2607:f8b0:4864:20::d32]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1F0C8120018 for ; Fri, 16 Aug 2019 15:08:31 -0700 (PDT) Received: by mail-io1-xd32.google.com with SMTP id z3so9205032iog.0 for ; Fri, 16 Aug 2019 15:08:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hopcount.ca; s=google; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=blH2O1cdIjzfk2qqnMkh8h5V188vuYK+J85XTY7u434=; b=BrcbhyXAXqHyFpVb+p3QDRHSEfSfI0Gk4VAL1JAJcQ9YRWNQJ0/S2PYUiSxR+pH9qK o/BXYbe5U6kmFUgXaXBnLCb2ShCnhvdoO6i81gPhTbFOaOghuNu0MuKB4Obpa6LgtDwv JxYsJrfcE/+NpmM2xQispoX0QyOfnbviz40rc= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=blH2O1cdIjzfk2qqnMkh8h5V188vuYK+J85XTY7u434=; b=VKy65ioWnlWVQ8G+iWVVg6gZ+eOsduAGeAv9z1GVyTpo1j+DK2x+0u9x++KGwg8sMx Nt9y7APzTA9sGihiW548V+OfU14JJuWvajpTD5enrEyofOT01k076RbXwxBmQx07YKdI gu6FFacneH+Y1H41thZ9MG4nBb+D5jKuED9hlfTxbPIfIeL46agHXpxWenwd15hw08M3 6+b6H2+yntegp0+REDZ6JJ7ve7RyXa4iYxKWk0FE3HY9JQfCVvqUcuFSouGyAfKe2vKt fjyw9LVWBGwv3p+By3m3UVOl1rFwSKpB2PWQbiq0lnGyYKohjuZC3Q+VnX9ns+US6E3G YJ6A== X-Gm-Message-State: APjAAAUBijWKS9IplvWMgX6mcFiFBufbg7jOlqhdUOr330CGJkYhR7JZ 2BTXKVP+yJctnd9MQ++P4CaAZg== X-Google-Smtp-Source: APXvYqy7/7MYtn6YhmucCbxLrTjF2Pmq3FS2X7iG4TWsybWNgRBP1k0x7Ddh28rzJ8GcuJ3xjydvow== X-Received: by 2002:a05:6602:228e:: with SMTP id d14mr13526433iod.85.1565993310125; Fri, 16 Aug 2019 15:08:30 -0700 (PDT) Received: from ?IPv6:2607:f2c0:e786:128f:c5e9:214c:3f97:cf02? ([2607:f2c0:e786:128f:c5e9:214c:3f97:cf02]) by smtp.gmail.com with ESMTPSA id b17sm6555627ion.55.2019.08.16.15.08.28 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 16 Aug 2019 15:08:28 -0700 (PDT) From: Joe Abley Message-Id: <3ACBFB29-45C2-41CB-9619-30C679ADB646@hopcount.ca> Content-Type: multipart/signed; boundary="Apple-Mail=_5913764C-63F5-46CD-AC44-33CB73BAC635"; protocol="application/pgp-signature"; micalg=pgp-sha1 Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Fri, 16 Aug 2019 18:08:27 -0400 In-Reply-To: Cc: "STARK, BARBARA H" , ADD Mailing list , Ted Lemon , Bret Jordan To: Eric Rescorla References: <09178E42-08B2-4958-A1C8-AF507AEE8834@fugue.com> <0BDD4F7F-7301-476A-80DA-0CC84EE4557D@fugue.com> <2BE3565E-4D1D-4C3D-8E5E-9BBF0A6C76EC@fugue.com> <2D09D61DDFA73D4C884805CC7865E6114E279D3E@GAALPA1MSGUSRBF.ITServices.sbc.com> <50618337-3358-4F81-AEAF-F479330488A7@hopcount.ca> <4F898538-E82D-487C-88AF-0EB803690204@hopcount.ca> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] When Two Worlds Collide X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 22:08:33 -0000 --Apple-Mail=_5913764C-63F5-46CD-AC44-33CB73BAC635 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii On 16 Aug 2019, at 17:50, Eric Rescorla wrote: > My point is that either (1) you can do MITM, in which case you can = disable DoH or (2) you cannot disable DoH, in which case you won't be = able to MITM anyway. But in neither case should you need to MITM DoH. I'm confused. This is not unusual. A user walks into the office with their personal, unmanaged phone. They = join the wifi. Some things work, but many things do not. User not = technical. What happen. Call IT. User's problems relate to the fact that all HTTPS is effectively blocked = because much software on their device reacts badly to the certificates = being presented by the corporate firewall, which is MITMing all the = HTTPS traffic it can identify through destination port number or deep = packet inspection. IT person says here, scan this QR code on the poster and follow the = instructions. Some eye-rolling accompanies the need to point finger at = large, obvious poster; some inference that most people don't need finger = to notice poster. User does that, all now work. The certificate that the user's device retrieved was served from an = internal server and is installed on the unmanaged device as a trust = anchor. Maybe the certificate that is installed through this process is = insufficient for some applications, but most of them now seem to work = just fine. The certificate presented by the MITMming corporate firewall = is now accepted by the user's applications, and the firewall ALGs them = all through to their external destinations with whatever meddling it = feels like doing to the plain text as data is shuffled back and forth. User now happy. I should hasten to add that I haven't tried this myself, I've just = listened to people who do. Is there some nuance here that I am missing? Joe --Apple-Mail=_5913764C-63F5-46CD-AC44-33CB73BAC635 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iF0EARECAB0WIQSAt40QkiztAcvphdg0jwy9hlI6LAUCXVcpWwAKCRA0jwy9hlI6 LBSwAJ9xCaLQQ467wNqc+3OXcetxP4lbEQCfVv9Q4xswziGSsN7ymNxBOKY/R2U= =umGa -----END PGP SIGNATURE----- --Apple-Mail=_5913764C-63F5-46CD-AC44-33CB73BAC635-- From nobody Fri Aug 16 15:14:48 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 41BA11200F8 for ; Fri, 16 Aug 2019 15:14:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tih7MQsXyr9y for ; Fri, 16 Aug 2019 15:14:45 -0700 (PDT) Received: from mail-qk1-x736.google.com (mail-qk1-x736.google.com [IPv6:2607:f8b0:4864:20::736]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E661D1200CC for ; Fri, 16 Aug 2019 15:14:44 -0700 (PDT) Received: by mail-qk1-x736.google.com with SMTP id s145so5981442qke.7 for ; Fri, 16 Aug 2019 15:14:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=WAaPT2xbYVJ3nSsBLb6Z17YgYE4BHb5q4so/V2NpJaQ=; b=HBwRl0vmoAykjNNYMPo7BeJrJNK40P5qm7Ghq7x2FcpwA6MTLxPDE4ZY4m4luUTnsy kPVSh5HBe0kEuzY3emgQ2E9WyZO7UApUa7wCSVa5SQuGoU2jkvrQzOZK4E807pcVoOWe E2LpsAQ4tSuDrsZmI0bDtADNFNbZm3XdEIqsm+8lKnxarYlqZ+U9mojXhhSDzCgmn5Jn M2/I1PL0kCij6B0C2rXASzmkaDpzVN7SLxcMr6FSm0ArORY5fr6tGdmtrKkx3t3Y2rMe CCN1ngMPsVrH/3E4yBIdSS2cR4ZB4+CzpEb98Zr1lYLrnH+QpAXtM7pGnaZu3qp61fil VcBg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=WAaPT2xbYVJ3nSsBLb6Z17YgYE4BHb5q4so/V2NpJaQ=; b=UyumRcsUJiQ1O2zrn71MA2I8Lg3qRnN/00hjTIHi4Rer+hgoz1bhLYF2jc1nwZxSbF b/TWX0ZEu+I256bPqgl83GTCAdBrSuQv5T8aVwsR+278yyrivuA5Z5+Mv4ZJFTmrnoWp mc5GqeaZKovqalEQBU/WXLTHXbM7gvVLjB9rwofT7TSbsuxouHTo1sP7XfSjTdL08Vh9 8DbtbNl219ZRC4CM8cMuz/Y+lFWUWFXgUKeDspxN8GKhcDJunShrBm/LgB0uzrwWvgs9 utDAwgxtd1aiiTitDoIR62Phhiv0USOGcdIriYIDefLiS00U2EBaLexf36EtVu3H+i3L CSLg== X-Gm-Message-State: APjAAAVr/4ogC6TjDy4ycQeoPVCUi8KBRBhOP+3DYmyHku0rbm72qjr0 RPTGRiUbrXIzBDhMVjn75Lkn1w== X-Google-Smtp-Source: APXvYqyB8X4+Wv4oXNt8hiSK5VUlXzmIYUWRqsgDlSvkcaTto1MKAakMkg46XJ978iRrfPkKFzWN8w== X-Received: by 2002:a05:620a:1518:: with SMTP id i24mr11096591qkk.276.1565993682549; Fri, 16 Aug 2019 15:14:42 -0700 (PDT) Received: from ?IPv6:2001:470:c1a2:1:7ded:86d1:e927:7777? ([2001:470:c1a2:1:7ded:86d1:e927:7777]) by smtp.gmail.com with ESMTPSA id u16sm3395604qkj.107.2019.08.16.15.14.41 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 16 Aug 2019 15:14:42 -0700 (PDT) From: Ted Lemon Message-Id: <0A667EDA-322D-4AD9-A97B-0EDE69C9588B@fugue.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_C9E8AF02-2974-402A-AC8C-71C8B81D4448" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Fri, 16 Aug 2019 15:14:39 -0700 In-Reply-To: <3ACBFB29-45C2-41CB-9619-30C679ADB646@hopcount.ca> Cc: Eric Rescorla , "STARK, BARBARA H" , ADD Mailing list , Bret Jordan To: Joe Abley References: <09178E42-08B2-4958-A1C8-AF507AEE8834@fugue.com> <0BDD4F7F-7301-476A-80DA-0CC84EE4557D@fugue.com> <2BE3565E-4D1D-4C3D-8E5E-9BBF0A6C76EC@fugue.com> <2D09D61DDFA73D4C884805CC7865E6114E279D3E@GAALPA1MSGUSRBF.ITServices.sbc.com> <50618337-3358-4F81-AEAF-F479330488A7@hopcount.ca> <4F898538-E82D-487C-88AF-0EB803690204@hopcount.ca> <3ACBFB29-45C2-41CB-9619-30C679ADB646@hopcount.ca> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] When Two Worlds Collide X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 22:14:47 -0000 --Apple-Mail=_C9E8AF02-2974-402A-AC8C-71C8B81D4448 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii On Aug 16, 2019, at 3:08 PM, Joe Abley wrote: > I should hasten to add that I haven't tried this myself, I've just = listened to people who do. Is there some nuance here that I am missing? I think Eric is making the very narrow technical point that if you are = able to intercept the DoH connection, there is no need to then terminate = it on its intended server. You can just do the DoH resolution at the = point of intercept. Hence, there is no middle, and no man in the = middle. --Apple-Mail=_C9E8AF02-2974-402A-AC8C-71C8B81D4448 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii On = Aug 16, 2019, at 3:08 PM, Joe Abley <jabley@hopcount.ca> = wrote:
I should = hasten to add that I haven't tried this myself, I've just listened to = people who do. Is there some nuance here that I am missing?

I think Eric is making the very narrow technical point that = if you are able to intercept the DoH connection, there is no need to = then terminate it on its intended server.  You can just do the DoH = resolution at the point of intercept.   Hence, there is no middle, = and no man in the middle.

= --Apple-Mail=_C9E8AF02-2974-402A-AC8C-71C8B81D4448-- From nobody Fri Aug 16 15:16:47 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5A42D1200CC for ; Fri, 16 Aug 2019 15:16:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.499 X-Spam-Level: X-Spam-Status: No, score=-17.499 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Waw86kjMBJAw for ; Fri, 16 Aug 2019 15:16:44 -0700 (PDT) Received: from mail-io1-xd2b.google.com (mail-io1-xd2b.google.com [IPv6:2607:f8b0:4864:20::d2b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3A364120018 for ; Fri, 16 Aug 2019 15:16:44 -0700 (PDT) Received: by mail-io1-xd2b.google.com with SMTP id z3so9237270iog.0 for ; Fri, 16 Aug 2019 15:16:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=b8OGMjjHzLvVzexyFKssEDFj//5jlmLTcs28v+j0sxU=; b=Jz2c8i8WwZQVk4zsvBtCYkTs5R3LGLuasNDPq7QEj/WMtwKVtkMjbpPuKiRcJXwMjE dOiHEkf0cZaHlJI+Br3rfe1+6n4X4+jrRlnZKswkny1jF9uB7po7UMGXDyMmBmsaHI8A NS67Dq63WiQgqcP995yxZsOpslr60Ks1y+PB2JvPl8PkHyLPCD193UVJNGRW91EBkWsf 47CkVznNfMlMTgXDuDbRFFjGX3OPW3k9iSS0KWLhZqHgFzVcyEzQIeD0amsb4AU9XoFL PO5eXU5XN9mCEyM+6iCnSmG3Po56lxqNLaSH3ac2eJvRS2tEbDtYBtBmsn/4fgf8Bj21 RBUQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=b8OGMjjHzLvVzexyFKssEDFj//5jlmLTcs28v+j0sxU=; b=Z/ZcYPDYxJTbgZEYcD7ICkMX91O5pG16vkBZmQTEYzbBbBYE13PrAfdc+TK6KcVkkD TXD4jXfVGc5AqhaIWrMPc3MMdS8WVT2qZ4D9LfCj0lx35/suybO1D6dbpM77aGuoOu2n ivnZDaVAA5aOBNYcSFjPz7yjrLX9SfURTGJHzyAtIqzgnqQsBoAw1PIRQlCokyg2XUls pbleXu3RmbKYVtl/ydSAlCDAskB4hB1qp7ZGZ5rcIDG7QLGrVGSkcICMd1vJ7KvvEH69 Ux8EbmG6Fdx3VdSVKsFz+KLYOkOYKXQbvNzG3kcHqRBcyO+E/FmSc9/WSCgejaIiUVrk iOMg== X-Gm-Message-State: APjAAAWOY4PW9c0VWTdO0b/PCoSybcOIBrXjTIl6lnQuMTP9gNfqpKTN An4GyPo1+7wi+cWjvABXe67rxi10wRLrQ5Oyaxn/dA== X-Google-Smtp-Source: APXvYqx7U8yF2xohuczyGVQ1L7eERobvf/e3Vyv5OsnPkjwqOLkRPawrVbPCE6weZn4NvQljRSRwZMB/M2rweDnh7jQ= X-Received: by 2002:a5d:8194:: with SMTP id u20mr9980023ion.193.1565993803181; Fri, 16 Aug 2019 15:16:43 -0700 (PDT) MIME-Version: 1.0 References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <8e00891f-2aa2-ee11-559a-b5a8967b22d9@nostrum.com> <2C23D415-84F9-4B6C-B67B-0CC3EB600520@gmail.com> <23893.59415.370880.54691@gro.dd.org> In-Reply-To: From: Ben Schwartz Date: Fri, 16 Aug 2019 18:16:31 -0400 Message-ID: To: Ralf Weber Cc: Rob Sayre , ADD Mailing list , Dave Lawrence Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="00000000000064495205904358da" Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 22:16:46 -0000 --00000000000064495205904358da Content-Type: multipart/alternative; boundary="0000000000005c656d059043588c" --0000000000005c656d059043588c Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Fri, Aug 16, 2019 at 3:01 AM Ralf Weber wrote: > Moin! > > > On 16 Aug 2019, at 7:35, Rob Sayre wrote: > > The author of that reply writes: "Most bizarrely perhaps, is that > > DNSSEC > > provides no end-to-end security. Your browser or OS still communicates > > with > > your resolver using regular queries, relying on a single > > unauthenticated > > bit to 'request' validation. It's as if LAN/wifi-level abuse wasn't a > > concern at all, or that public resolvers (like OpenDNS and Google > > Public > > DNS) didn't exist." > Well the ideal scenario would be that the end client like the browser > would > validate DNSSEC. However Browser vendors don=E2=80=99t seem to have inter= est > in that. > See the thread on =E2=80=9CMozilla's DoH resolver policy=E2=80=9D from Ap= ril on this > mailing > list for that. DNSSEC provides end to end security if implemented > properly. > > > > > These attacks do in fact happen (see < > > https://mailarchive.ietf.org/arch/msg/add/NIk8gIPZu52GXDsT8zy4S1I4QsM>)= , > > > so > > it seems like DoT/DoH would be one step in improving DNSSEC > > reliability. > DoH certainly can help to protect the connection between the recursive > resolver and the the stub, as would DoT. However for authenticity that > would > not be needed if the client performed DNSSEC validation. > I don't view DoH and DNSSEC as being substantially in competition. To the contrary, I think that ADD with DoH greatly improves the likelihood of end-to-end DNSSEC being widely deployed. The main barriers I'm aware of to stub DNSSEC deployment (broken middleboxes, broken recursives, split-DNS name squatting, restrictive query APIs with opaque error reporting, ancient system stub implementations, reflection attacks, truncation retry delays, ...) are all potentially solved when the application is speaking directly to a known, modern DoH server. In an ADD world, I'm much more optimistic about DNSSEC. (Especially if we can get more deployment support for RFC 7901.) > So long > -Ralf > =E2=80=94- > Ralf Weber > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --0000000000005c656d059043588c Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Fri, Aug 16, 2019 at 3:01 AM Ralf = Weber <dns@fl1ger.de> wrote:
=
Moin!


On 16 Aug 2019, at 7:35, Rob Sayre wrote:
> The author of that reply writes: "Most bizarrely perhaps, is that=
> DNSSEC
> provides no end-to-end security. Your browser or OS still communicates=
> with
> your resolver using regular queries, relying on a single
> unauthenticated
> bit to 'request' validation. It's as if LAN/wifi-level abu= se wasn't a
> concern at all, or that public resolvers (like OpenDNS and Google
> Public
> DNS) didn't exist."
Well the ideal scenario would be that the end client like the browser
would
validate DNSSEC. However Browser vendors don=E2=80=99t seem to have interes= t
in that.
See the thread on =E2=80=9CMozilla's DoH resolver policy=E2=80=9D from = April on this
mailing
list for that. DNSSEC provides end to end security if implemented
properly.

>
> These attacks do in fact happen (see <
> https://mailarchive.ietf.o= rg/arch/msg/add/NIk8gIPZu52GXDsT8zy4S1I4QsM>),
> so
> it seems like DoT/DoH would be one step in improving DNSSEC
> reliability.
DoH certainly can help to protect the connection between the recursive
resolver and the the stub, as would DoT. However for authenticity that
would
not be needed if the client performed DNSSEC validation.

I don't view DoH and DNSSEC as being substantially in= competition.=C2=A0 To the contrary, I think that ADD with DoH greatly impr= oves the likelihood of end-to-end DNSSEC being widely deployed.=C2=A0 The m= ain barriers I'm aware of to stub DNSSEC deployment (broken middleboxes= , broken recursives, split-DNS name squatting, restrictive query APIs with = opaque error reporting, ancient system stub implementations, reflection att= acks, truncation retry delays, ...) are all potentially solved when the app= lication is speaking directly to a known, modern DoH server.
=
In an ADD world, I'm much more optimistic about DNSSEC.= =C2=A0 (Especially if we can get more deployment support for RFC 7901.)


So long
-Ralf
=E2=80=94-
Ralf Weber

--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--0000000000005c656d059043588c-- --00000000000064495205904358da Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIIS5wYJKoZIhvcNAQcCoIIS2DCCEtQCAQExDzANBglghkgBZQMEAgEFADALBgkqhkiG9w0BBwGg ghBNMIIEXDCCA0SgAwIBAgIOSBtqDm4P/739RPqw/wcwDQYJKoZIhvcNAQELBQAwZDELMAkGA1UE BhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVy c29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hBMjU2IC0gRzIwHhcNMTYwNjE1MDAwMDAwWhcNMjEw NjE1MDAwMDAwWjBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xvYmFsU2lnbiBudi1zYTEiMCAG A1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC AQoCggEBALR23lKtjlZW/17kthzYcMHHKFgywfc4vLIjfq42NmMWbXkNUabIgS8KX4PnIFsTlD6F GO2fqnsTygvYPFBSMX4OCFtJXoikP2CQlEvO7WooyE94tqmqD+w0YtyP2IB5j4KvOIeNv1Gbnnes BIUWLFxs1ERvYDhmk+OrvW7Vd8ZfpRJj71Rb+QQsUpkyTySaqALXnyztTDp1L5d1bABJN/bJbEU3 Hf5FLrANmognIu+Npty6GrA6p3yKELzTsilOFmYNWg7L838NS2JbFOndl+ce89gM36CW7vyhszi6 6LqqzJL8MsmkP53GGhf11YMP9EkmawYouMDP/PwQYhIiUO0CAwEAAaOCASIwggEeMA4GA1UdDwEB /wQEAwIBBjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwEgYDVR0TAQH/BAgwBgEB/wIB ADAdBgNVHQ4EFgQUyzgSsMeZwHiSjLMhleb0JmLA4D8wHwYDVR0jBBgwFoAUJiSSix/TRK+xsBtt r+500ox4AAMwSwYDVR0fBEQwQjBAoD6gPIY6aHR0cDovL2NybC5nbG9iYWxzaWduLmNvbS9ncy9n c3BlcnNvbmFsc2lnbnB0bnJzc2hhMmcyLmNybDBMBgNVHSAERTBDMEEGCSsGAQQBoDIBKDA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzANBgkqhkiG 9w0BAQsFAAOCAQEACskdySGYIOi63wgeTmljjA5BHHN9uLuAMHotXgbYeGVrz7+DkFNgWRQ/dNse Qa4e+FeHWq2fu73SamhAQyLigNKZF7ZzHPUkSpSTjQqVzbyDaFHtRBAwuACuymaOWOWPePZXOH9x t4HPwRQuur57RKiEm1F6/YJVQ5UTkzAyPoeND/y1GzXS4kjhVuoOQX3GfXDZdwoN8jMYBZTO0H5h isymlIl6aot0E5KIKqosW6mhupdkS1ZZPp4WXR4frybSkLejjmkTYCTUmh9DuvKEQ1Ge7siwsWgA NS1Ln+uvIuObpbNaeAyMZY0U5R/OyIDaq+m9KXPYvrCZ0TCLbcKuRzCCBB4wggMGoAMCAQICCwQA AAAAATGJxkCyMA0GCSqGSIb3DQEBCwUAMEwxIDAeBgNVBAsTF0dsb2JhbFNpZ24gUm9vdCBDQSAt IFIzMRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWduMB4XDTExMDgwMjEw MDAwMFoXDTI5MDMyOTEwMDAwMFowZDELMAkGA1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24g bnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVyc29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hB MjU2IC0gRzIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCg/hRKosYAGP+P7mIdq5NB Kr3J0tg+8lPATlgp+F6W9CeIvnXRGUvdniO+BQnKxnX6RsC3AnE0hUUKRaM9/RDDWldYw35K+sge C8fWXvIbcYLXxWkXz+Hbxh0GXG61Evqux6i2sKeKvMr4s9BaN09cqJ/wF6KuP9jSyWcyY+IgL6u2 52my5UzYhnbf7D7IcC372bfhwM92n6r5hJx3r++rQEMHXlp/G9J3fftgsD1bzS7J/uHMFpr4MXua eoiMLV5gdmo0sQg23j4pihyFlAkkHHn4usPJ3EePw7ewQT6BUTFyvmEB+KDoi7T4RCAZDstgfpzD rR/TNwrK8/FXoqnFAgMBAAGjgegwgeUwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8C AQEwHQYDVR0OBBYEFCYkkosf00SvsbAbba/udNKMeAADMEcGA1UdIARAMD4wPAYEVR0gADA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzA2BgNVHR8E LzAtMCugKaAnhiVodHRwOi8vY3JsLmdsb2JhbHNpZ24ubmV0L3Jvb3QtcjMuY3JsMB8GA1UdIwQY MBaAFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQACAFVjHihZCV/IqJYt 7Nig/xek+9g0dmv1oQNGYI1WWeqHcMAV1h7cheKNr4EOANNvJWtAkoQz+076Sqnq0Puxwymj0/+e oQJ8GRODG9pxlSn3kysh7f+kotX7pYX5moUa0xq3TCjjYsF3G17E27qvn8SJwDsgEImnhXVT5vb7 qBYKadFizPzKPmwsJQDPKX58XmPxMcZ1tG77xCQEXrtABhYC3NBhu8+c5UoinLpBQC1iBnNpNwXT Lmd4nQdf9HCijG1e8myt78VP+QSwsaDT7LVcLT2oDPVggjhVcwljw3ePDwfGP9kNrR+lc8XrfClk WbrdhC2o4Ui28dtIVHd3MIIDXzCCAkegAwIBAgILBAAAAAABIVhTCKIwDQYJKoZIhvcNAQELBQAw TDEgMB4GA1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjMxEzARBgNVBAoTCkdsb2JhbFNpZ24x EzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMDkwMzE4MTAwMDAwWhcNMjkwMzE4MTAwMDAwWjBMMSAw HgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMzETMBEGA1UEChMKR2xvYmFsU2lnbjETMBEG A1UEAxMKR2xvYmFsU2lnbjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMwldpB5Bngi FvXAg7aEyiie/QV2EcWtiHL8RgJDx7KKnQRfJMsuS+FggkbhUqsMgUdwbN1k0ev1LKMPgj0MK66X 17YUhhB5uzsTgHeMCOFJ0mpiLx9e+pZo34knlTifBtc+ycsmWQ1z3rDI6SYOgxXG71uL0gRgykmm KPZpO/bLyCiR5Z2KYVc3rHQU3HTgOu5yLy6c+9C7v/U9AOEGM+iCK65TpjoWc4zdQQ4gOsC0p6Hp sk+QLjJg6VfLuQSSaGjlOCZgdbKfd/+RFO+uIEn8rUAVSNECMWEZXriX7613t2Saer9fwRPvm2L7 DWzgVGkWqQPabumDk3F2xmmFghcCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQF MAMBAf8wHQYDVR0OBBYEFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQBL QNvAUKr+yAzv95ZURUm7lgAJQayzE4aGKAczymvmdLm6AC2upArT9fHxD4q/c2dKg8dEe3jgr25s bwMpjjM5RcOO5LlXbKr8EpbsU8Yt5CRsuZRj+9xTaGdWPoO4zzUhw8lo/s7awlOqzJCK6fBdRoyV 3XpYKBovHd7NADdBj+1EbddTKJd+82cEHhXXipa0095MJ6RMG3NzdvQXmcIfeg7jLQitChws/zyr VQ4PkX4268NXSb7hLi18YIvDQVETI53O9zJrlAGomecsMx86OyXShkDOOyyGeMlhLxS67ttVb9+E 7gUJTb0o2HLO02JQZR7rkpeDMdmztcpHWD9fMIIEZDCCA0ygAwIBAgIMb5MwaN/thbS6tcoSMA0G CSqGSIb3DQEBCwUAMEwxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMSIw IAYDVQQDExlHbG9iYWxTaWduIEhWIFMvTUlNRSBDQSAxMB4XDTE5MDgxMDA4MjIyMVoXDTIwMDIw NjA4MjIyMVowIjEgMB4GCSqGSIb3DQEJAQwRYmVtYXNjQGdvb2dsZS5jb20wggEiMA0GCSqGSIb3 DQEBAQUAA4IBDwAwggEKAoIBAQCapo7ARc1spX97SqdC5FrntcF1TsMY92BYdzbflXSKxq0yT835 3LNJtJ/J4lZC5QSgloRVy9U70CWQVLQUY+kXzFrEZkpgnHAtnlqZITjGGCj7+RAjWXbRHdOtvA/t EJKQJjEsuggE8qjMH2FoThWpOoAFfvLSw8aSir96C2tA8MV59tyI8ewdRBWKvQT6QTLPpPFmKJPJ H1idNM5tnwsWzADF6Xmz2tdLu4Nec4bGyzwHv4jGWrMfW6i5XO3cxFDLluvf7J6A2m+85dRtTC5q 2eqFRCpqqDsHcxsd8OFxpEe9ZhRw1XcMPjZmqHEPpJToDt9ReYetEffXx5DNqIcHAgMBAAGjggFu MIIBajAcBgNVHREEFTATgRFiZW1hc2NAZ29vZ2xlLmNvbTBQBggrBgEFBQcBAQREMEIwQAYIKwYB BQUHMAKGNGh0dHA6Ly9zZWN1cmUuZ2xvYmFsc2lnbi5jb20vY2FjZXJ0L2dzaHZzbWltZWNhMS5j cnQwHQYDVR0OBBYEFE77YQLCDddBAx5p+gBVO6KLah3VMB8GA1UdIwQYMBaAFMs4ErDHmcB4koyz IZXm9CZiwOA/MEwGA1UdIARFMEMwQQYJKwYBBAGgMgEoMDQwMgYIKwYBBQUHAgEWJmh0dHBzOi8v d3d3Lmdsb2JhbHNpZ24uY29tL3JlcG9zaXRvcnkvMDsGA1UdHwQ0MDIwMKAuoCyGKmh0dHA6Ly9j cmwuZ2xvYmFsc2lnbi5jb20vZ3NodnNtaW1lY2ExLmNybDAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0l BBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMA0GCSqGSIb3DQEBCwUAA4IBAQAW/09trVYeHUY5xMK3 1EuuFQyc7RaPOn+3qWJuDt4DVjNJl0uH27JsA30H70YGSPgNLo/KtC/1ejCAF2SjJrL+Qb93j4Cq BLI0djN/I9AHm7BVy4l+evwS6/7b8xwhKZSt+b2FuMSdpYRfxavlFKYo+WILW6gGx15o+KDRPusJ mo2s2mZDRTUfZ9e87SLTOUe/APBMIeKd+2Z9nnnBh0+d4LCn3tA4vmD1A/pIubUYaaTlLeZIQhpa D41mXEZUHdUVnGaIdPzJKNSkCeIUztyVBUJyYk3ROz9bCBjsHcUy2iqwuLGLaPI3bWjdwvxZ4kG4 dhjPuHq6t95sxpJ1F1X/MYICXjCCAloCAQEwXDBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xv YmFsU2lnbiBudi1zYTEiMCAGA1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMQIMb5MwaN/t hbS6tcoSMA0GCWCGSAFlAwQCAQUAoIHUMC8GCSqGSIb3DQEJBDEiBCD5yXNRZYWFGRMX7XNj3G+O rsvlESMe0QfJRYpgHxejDzAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEP Fw0xOTA4MTYyMjE2NDNaMGkGCSqGSIb3DQEJDzFcMFowCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQB FjALBglghkgBZQMEAQIwCgYIKoZIhvcNAwcwCwYJKoZIhvcNAQEKMAsGCSqGSIb3DQEBBzALBglg hkgBZQMEAgEwDQYJKoZIhvcNAQEBBQAEggEAXaABE0mX7HQbyc7gK1PWaHqAX5mn94ic5LuPPYEU S9vAqSgXZOi+GqCBtXrLWgaKaEK+em1FxMhnKQck3JvBOTRSgU3nUQOo02e1Dcv18ItfECfHcPmj cGvCHReuBGZH7GKKDEiaqr1OINmtl6xBHkBrkVBOyM1ezPebhGgEvsdmFqOkraHNk+aIsMG6XTCZ sdyTb30FKPqku+2Rw/5KF9N3jZtQSWmMkk6JrKE/+w0C2c7fFafH6FPY0c0LdswObDQKRR1lh6iU ri+xeyiP0oPfla59A2i2b47mknfdsS8KFbsKml4zdj+J3j1xGk+1fIg2yMuhgVG//YJwEYowhQ== --00000000000064495205904358da-- From nobody Fri Aug 16 15:26:28 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 40F4E120018 for ; Fri, 16 Aug 2019 15:26:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FtuTKJdyrEh4 for ; Fri, 16 Aug 2019 15:26:26 -0700 (PDT) Received: from ppa5.dc.icann.org (ppa5.dc.icann.org [192.0.46.78]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E82DC1200DE for ; Fri, 16 Aug 2019 15:26:25 -0700 (PDT) Received: from PFE112-CA-1.pexch112.icann.org (out.west.pexch112.icann.org [64.78.40.7]) by ppa5.dc.icann.org (8.16.0.27/8.16.0.27) with ESMTPS id x7GMQJqg011261 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT); Fri, 16 Aug 2019 22:26:20 GMT Received: from PMBX112-W1-CA-1.pexch112.icann.org (64.78.40.21) by PMBX112-W1-CA-2.pexch112.icann.org (64.78.40.23) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Fri, 16 Aug 2019 15:26:18 -0700 Received: from PMBX112-W1-CA-1.pexch112.icann.org ([64.78.40.21]) by PMBX112-W1-CA-1.PEXCH112.ICANN.ORG ([64.78.40.21]) with mapi id 15.00.1473.005; Fri, 16 Aug 2019 15:26:17 -0700 From: Paul Hoffman To: Stephen Farrell CC: ADD Mailing list Thread-Topic: [Ext] [Add] When Two Worlds Collide Thread-Index: AQHVVIGerFvGUIAN1k+eP2tEofq8PQ== Date: Fri, 16 Aug 2019 22:26:17 +0000 Message-ID: <05A2D829-0BF9-461A-A3D4-BB042605C331@icann.org> References: <09178E42-08B2-4958-A1C8-AF507AEE8834@fugue.com> <0BDD4F7F-7301-476A-80DA-0CC84EE4557D@fugue.com> <2BE3565E-4D1D-4C3D-8E5E-9BBF0A6C76EC@fugue.com> <2D09D61DDFA73D4C884805CC7865E6114E279D3E@GAALPA1MSGUSRBF.ITServices.sbc.com> <50618337-3358-4F81-AEAF-F479330488A7@hopcount.ca> <4F898538-E82D-487C-88AF-0EB803690204@hopcount.ca> <51040aae-4769-ee6b-7f5e-dcc54e10b705@cs.tcd.ie> In-Reply-To: <51040aae-4769-ee6b-7f5e-dcc54e10b705@cs.tcd.ie> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [192.0.32.234] x-source-routing-agent: Processed Content-Type: text/plain; charset="us-ascii" Content-ID: <5519DBCA4C144E47A121D34858B633E6@pexch112.icann.org> Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-08-16_10:, , signatures=0 Archived-At: Subject: Re: [Add] [Ext] When Two Worlds Collide X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 22:26:27 -0000 On Aug 16, 2019, at 3:07 PM, Stephen Farrell wr= ote: >=20 > On 16/08/2019 22:50, Eric Rescorla wrote: >> My point is that either (1) you can do MITM, in which case you can disab= le >> DoH or (2) you cannot disable DoH, in which case you won't be able to MI= TM >> anyway. But in neither case should you need to MITM DoH. >=20 > Well.... not quite. I think you're assuming how mozilla are > implementing DoH Agree. > - some other application might not have a > way to disable DoH at all. And yet other applications might not use TRRs, but just set up their own Do= H server that firewall admins don't even know about. If some started hard-w= iring classic DNS on 8.8.8.8 (and it appears that some non-Google apps have= done this, more data to collect), then little is to stop them from hardwir= ing DoH or some non-standard DNS over HTTPS to their own infrastructure. --Paul Hoffman= From nobody Fri Aug 16 15:44:40 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D51AC12008B for ; Fri, 16 Aug 2019 15:44:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id V1gj2EnumyQD for ; Fri, 16 Aug 2019 15:44:36 -0700 (PDT) Received: from mail-lj1-x22a.google.com (mail-lj1-x22a.google.com [IPv6:2a00:1450:4864:20::22a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8A513120018 for ; Fri, 16 Aug 2019 15:44:36 -0700 (PDT) Received: by mail-lj1-x22a.google.com with SMTP id t14so6629821lji.4 for ; Fri, 16 Aug 2019 15:44:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=lNqzxLHqSYcId64ZuG86aZ3suVnHAznPJSZX1rrL1D4=; b=Af5DsYxaetWEMUPcJqeVlmy7hcYxyhzytkA2v9uI2VrbQe+gSdj+owSWDt8AmOu1e9 iIpxdiyNWnNT/TEiwgVafEWr67loy74jF7HZv2r6m9lKGpERu2kvYC9QvpwmeluREJL4 5PURWkb8yL8aFMDrvk+lzUCdqYICxrc/hfBt2DBwnCwgIIhriAkmd6P2oLvK3WC7WNdA UtD5G9y86B/kCxpYz9+RyKGoj4IKXpwPvtHWu3lBefFKbHkvHxJ7XuUQ0wFvotTEoxpG G6yrdPhiqK7iVJ//DQNMTzC8A6wkt0YoVvvOFfjh9w6B3Aib/Jd2n5qFgEmA87R2RbXN rnzA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=lNqzxLHqSYcId64ZuG86aZ3suVnHAznPJSZX1rrL1D4=; b=Sew/T0ZBpmnqsVLU+VejL2nxVv79h+WzCwD08VVko3KariCv+c+2HgLkVLFhmwsO6v IKRa+5LDAHH+x35u29ku0dGzIzCiwEbHWqXL/g+UGPTJixZO3bdkYAd37STxQ9nkvsdb QKKOk64YHmCawEhm5Z8Xf1sM2k0tKD7avWdCwrEB1CMDCKly8eJLFzl/drGNpmy2Y8sX oG5+Aja167txf7haKRxfbkPqG1vhv49XIujx6PO3vbZ0CpAS8UPAYvZDL5QH0keUWHf4 tm5v+AU8QpMl+cEY8eA07G0cD4aPzhr8kxZKwySj73ctrAmy3He2UBZdhn5L44b8sC7q ot2Q== X-Gm-Message-State: APjAAAWZ9vJmfHAG+ISrISwc1U6juieTRR7DRuF2HdaHoITXENe4fFag /H2np+ec+0h6G9+qmzArCuGgmUMnv4nuXE3OBNXhgA== X-Google-Smtp-Source: APXvYqz1pC4UTxzUucBPYSnaTOXNaahtz9MSm1aiTtBaJI0ppG3LSvXgisF5CDiyFC3G20p33fmwG3c1415364e/XyM= X-Received: by 2002:a2e:9b84:: with SMTP id z4mr6759227lji.75.1565995474723; Fri, 16 Aug 2019 15:44:34 -0700 (PDT) MIME-Version: 1.0 References: <09178E42-08B2-4958-A1C8-AF507AEE8834@fugue.com> <0BDD4F7F-7301-476A-80DA-0CC84EE4557D@fugue.com> <2BE3565E-4D1D-4C3D-8E5E-9BBF0A6C76EC@fugue.com> <2D09D61DDFA73D4C884805CC7865E6114E279D3E@GAALPA1MSGUSRBF.ITServices.sbc.com> <50618337-3358-4F81-AEAF-F479330488A7@hopcount.ca> <4F898538-E82D-487C-88AF-0EB803690204@hopcount.ca> <3ACBFB29-45C2-41CB-9619-30C679ADB646@hopcount.ca> In-Reply-To: <3ACBFB29-45C2-41CB-9619-30C679ADB646@hopcount.ca> From: Eric Rescorla Date: Sat, 17 Aug 2019 00:43:57 +0200 Message-ID: To: Joe Abley Cc: "STARK, BARBARA H" , ADD Mailing list , Ted Lemon , Bret Jordan Content-Type: multipart/alternative; boundary="000000000000fdb4b4059043bb65" Archived-At: Subject: Re: [Add] When Two Worlds Collide X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 22:44:39 -0000 --000000000000fdb4b4059043bb65 Content-Type: text/plain; charset="UTF-8" On Sat, Aug 17, 2019 at 12:08 AM Joe Abley wrote: > On 16 Aug 2019, at 17:50, Eric Rescorla wrote: > > > My point is that either (1) you can do MITM, in which case you can > disable DoH or (2) you cannot disable DoH, in which case you won't be able > to MITM anyway. But in neither case should you need to MITM DoH. > > I'm confused. This is not unusual. > > A user walks into the office with their personal, unmanaged phone. They > join the wifi. Some things work, but many things do not. User not > technical. What happen. Call IT. > > User's problems relate to the fact that all HTTPS is effectively blocked > because much software on their device reacts badly to the certificates > being presented by the corporate firewall, which is MITMing all the HTTPS > traffic it can identify through destination port number or deep packet > inspection. > > IT person says here, scan this QR code on the poster and follow the > instructions. Some eye-rolling accompanies the need to point finger at > large, obvious poster; some inference that most people don't need finger to > notice poster. User does that, all now work. > Why can't those instructions describe how to turn off DoH? -Ekr > The certificate that the user's device retrieved was served from an > internal server and is installed on the unmanaged device as a trust anchor. > Maybe the certificate that is installed through this process is > insufficient for some applications, but most of them now seem to work just > fine. The certificate presented by the MITMming corporate firewall is now > accepted by the user's applications, and the firewall ALGs them all through > to their external destinations with whatever meddling it feels like doing > to the plain text as data is shuffled back and forth. > > User now happy. > > I should hasten to add that I haven't tried this myself, I've just > listened to people who do. Is there some nuance here that I am missing? > > > Joe > --000000000000fdb4b4059043bb65 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Sat, Aug 17, 2019 at 12:08 AM Joe = Abley <jabley@hopcount.ca> = wrote:
On 16 Aug= 2019, at 17:50, Eric Rescorla <ekr@rtfm.com> wrote:

> My point is that either (1) you can do MITM, in which case you can dis= able DoH or (2) you cannot disable DoH, in which case you won't be able= to MITM anyway. But in neither case should you need to MITM DoH.

I'm confused. This is not unusual.

A user walks into the office with their personal, unmanaged phone. They joi= n the wifi. Some things work, but many things do not. User not technical. W= hat happen. Call IT.

User's problems relate to the fact that all HTTPS is effectively blocke= d because much software on their device reacts badly to the certificates be= ing presented by the corporate firewall, which is MITMing all the HTTPS tra= ffic it can identify through destination port number or deep packet inspect= ion.

IT person says here, scan this QR code on the poster and follow the instruc= tions. Some eye-rolling accompanies the need to point finger at large, obvi= ous poster; some inference that most people don't need finger to notice= poster. User does that, all now work.

= Why can't those instructions describe how to turn off DoH?
-Ekr


The certificate that the user's device retrieved was served from an int= ernal server and is installed on the unmanaged device as a trust anchor. Ma= ybe the certificate that is installed through this process is insufficient = for some applications, but most of them now seem to work just fine. The cer= tificate presented by the MITMming corporate firewall is now accepted by th= e user's applications, and the firewall ALGs them all through to their = external destinations with whatever meddling it feels like doing to the pla= in text as data is shuffled back and forth.

User now happy.

I should hasten to add that I haven't tried this myself, I've just = listened to people who do. Is there some nuance here that I am missing?


Joe
--000000000000fdb4b4059043bb65-- From nobody Fri Aug 16 17:08:20 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AB468120128 for ; Fri, 16 Aug 2019 17:08:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.996 X-Spam-Level: X-Spam-Status: No, score=-1.996 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, UNPARSEABLE_RELAY=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=hopcount.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ADepndJCundW for ; Fri, 16 Aug 2019 17:08:17 -0700 (PDT) Received: from mail-lj1-x22a.google.com (mail-lj1-x22a.google.com [IPv6:2a00:1450:4864:20::22a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AFF0E120113 for ; Fri, 16 Aug 2019 17:08:16 -0700 (PDT) Received: by mail-lj1-x22a.google.com with SMTP id f9so6692479ljc.13 for ; Fri, 16 Aug 2019 17:08:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hopcount.ca; s=google; h=from:mime-version:references:in-reply-to:date:message-id:subject:to :cc; bh=OQrftnIQyDC9VVUk9srBFaW0dKa9Q022L2ynMN1lULg=; b=cwAv/xkF5uMfJpA8CjjIs7bxlpfSjpeV5sDTYpFDNlCmgHDbXAveY/EdfvPdH4C5As 6nJj2/ngrDru0bpfmXnYn/+RHWjsVRdxpodIuTpaOp71lbtoB2WDWbDhZLa66DtuuZmO 4GBpWyKcj9PvqBMMjZIYWWaW/z7wira9DCMvc= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:mime-version:references:in-reply-to:date :message-id:subject:to:cc; bh=OQrftnIQyDC9VVUk9srBFaW0dKa9Q022L2ynMN1lULg=; b=deo7rWuUqsJT0Zl4Nbg/anbUnyBRkVIqoCGlLC/TNMt6Hwk9cSO7zJ2Lqa+xKybORo XV1KkB8tw8uJYeF1TpbvQ8LzG69PmnGkozzPdJojGuV1hhW77cPvrRjSDVb3pmaOmZXJ HWAQttobv0S/9zZp0KlePyF5fk1Tn7tnIS80HY2iElgixUGXo7Xayi+vclGwx5Xjk91Y KLIumRA578VMg+6koKMURUugeieLnLl0R4mroa7V3e0WqiJ8e7vkS3hXVBOjyYd3iLhi 8rdhMUajbA+Mf/3jNSAiO5z4eWdY2yEBUcc450YG2dhEXDX+ZEES+DP0ZVcVBiAfPHcx +VhQ== X-Gm-Message-State: APjAAAViGlZ+PtBZS43XFQ8GkNIW4E8hCgFuS5AAGOm2q586u5o7V3RF CcSxxRAgJ40vhjONa/8nKChh5FJmQynwoIpUFBE0Nw== X-Google-Smtp-Source: APXvYqxFgXEnAuBU1yxYQG4gzXgVjLfVBRHGvAKGPtXcZFTwZzlumSoFCCU1ZExlqG2ITGTZzkS0ZhrplnbkjsZukr0= X-Received: by 2002:a2e:96d5:: with SMTP id d21mr7018688ljj.170.1566000494781; Fri, 16 Aug 2019 17:08:14 -0700 (PDT) Received: from unknown named unknown by gmailapi.google.com with HTTPREST; Fri, 16 Aug 2019 17:08:13 -0700 From: Joe Abley Mime-Version: 1.0 (1.0) References: <09178E42-08B2-4958-A1C8-AF507AEE8834@fugue.com> <0BDD4F7F-7301-476A-80DA-0CC84EE4557D@fugue.com> <2BE3565E-4D1D-4C3D-8E5E-9BBF0A6C76EC@fugue.com> <2D09D61DDFA73D4C884805CC7865E6114E279D3E@GAALPA1MSGUSRBF.ITServices.sbc.com> <50618337-3358-4F81-AEAF-F479330488A7@hopcount.ca> <4F898538-E82D-487C-88AF-0EB803690204@hopcount.ca> <3ACBFB29-45C2-41CB-9619-30C679ADB646@hopcount.ca> In-Reply-To: Date: Fri, 16 Aug 2019 17:08:13 -0700 Message-ID: To: Eric Rescorla Cc: "STARK, BARBARA H" , ADD Mailing list , Ted Lemon , Bret Jordan Content-Type: multipart/alternative; boundary="00000000000035bc9c059044e7c7" Archived-At: Subject: Re: [Add] When Two Worlds Collide X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 17 Aug 2019 00:08:19 -0000 --00000000000035bc9c059044e7c7 Content-Type: text/plain; charset="UTF-8" On Aug 16, 2019, at 18:43, Eric Rescorla wrote: On Sat, Aug 17, 2019 at 12:08 AM Joe Abley wrote: > On 16 Aug 2019, at 17:50, Eric Rescorla wrote: > > > My point is that either (1) you can do MITM, in which case you can > disable DoH or (2) you cannot disable DoH, in which case you won't be able > to MITM anyway. But in neither case should you need to MITM DoH. > > I'm confused. This is not unusual. > > A user walks into the office with their personal, unmanaged phone. They > join the wifi. Some things work, but many things do not. User not > technical. What happen. Call IT. > > User's problems relate to the fact that all HTTPS is effectively blocked > because much software on their device reacts badly to the certificates > being presented by the corporate firewall, which is MITMing all the HTTPS > traffic it can identify through destination port number or deep packet > inspection. > > IT person says here, scan this QR code on the poster and follow the > instructions. Some eye-rolling accompanies the need to point finger at > large, obvious poster; some inference that most people don't need finger to > notice poster. User does that, all now work. > Why can't those instructions describe how to turn off DoH? That seems like a degenerate case of modifying the traffic carried within HTTPS, which is what I was trying to describe. So I don't really understand the question. Perhaps what is missing is the need to MITM HTTPS for reasons other than DoH in a network that accepts unmanaged devices, which I mentioned earlier. Joe --00000000000035bc9c059044e7c7 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Aug 16, 2019, at 18:43, Eric Rescorla <ekr@rtfm.com> wrote:


=
On Sat, Au= g 17, 2019 at 12:08 AM Joe Abley <= jabley@hopcount.ca> wrote:
On 16 Aug 2019, at 17:50, Eric Rescorla <ekr@rtfm.com> wrote:

> My point is that either (1) you can do MITM, in which case you can dis= able DoH or (2) you cannot disable DoH, in which case you won't be able= to MITM anyway. But in neither case should you need to MITM DoH.

I'm confused. This is not unusual.

A user walks into the office with their personal, unmanaged phone. They joi= n the wifi. Some things work, but many things do not. User not technical. W= hat happen. Call IT.

User's problems relate to the fact that all HTTPS is effectively blocke= d because much software on their device reacts badly to the certificates be= ing presented by the corporate firewall, which is MITMing all the HTTPS tra= ffic it can identify through destination port number or deep packet inspect= ion.

IT person says here, scan this QR code on the poster and follow the instruc= tions. Some eye-rolling accompanies the need to point finger at large, obvi= ous poster; some inference that most people don't need finger to notice= poster. User does that, all now work.

= Why can't those instructions describe how to turn off DoH?
<= /div>

That seems like a degenerate ca= se of modifying the traffic carried within HTTPS, which is what I was tryin= g to describe. So I don't really understand the question.
Perhaps what is missing is the need to MITM HTTPS for reasons o= ther than DoH in a network that accepts unmanaged devices, which I mentione= d earlier.=C2=A0


Joe
--00000000000035bc9c059044e7c7-- From nobody Fri Aug 16 17:33:59 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id ED5F81200FA for ; Fri, 16 Aug 2019 17:33:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9ci4by2tTZPO for ; Fri, 16 Aug 2019 17:33:56 -0700 (PDT) Received: from mail-lf1-x134.google.com (mail-lf1-x134.google.com [IPv6:2a00:1450:4864:20::134]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 912E21200F1 for ; Fri, 16 Aug 2019 17:33:55 -0700 (PDT) Received: by mail-lf1-x134.google.com with SMTP id j17so5212391lfp.3 for ; Fri, 16 Aug 2019 17:33:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=QsDClcFIisVknIksykSZVsuXJXH0aprPcTOgrSmakNo=; b=CQwX06cQ1Rdi2KphbDjNacPtEIM/4CaWKPQTKbi6yLoqfGaYrNXWKHY2/kQ3TkUpH7 bCuB/tul6hSNoph4iliBT8o/l+hQyKkkUjrP7Fp2ZHB/303ryoExppf0CChFJkdPmFJ6 xGo3zYLZz7CB/2BpgwEHoD0KDSNsPp4aM1OpgkkBsEhI6h9mvL8xd0L43xn0b8Epwl/r LfkpH7c3bJTQnAPkT39tP16fovwqTuQjteZ7k85V92/JYyTUVWoQaF8194OC7VKJGVcz XS0XG7cwxKZugwPIFHzZuhnZxKFF6+9Z/R77NJRKmOD2DeRBiHC2m3ogGZur2lLph46J JP3g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=QsDClcFIisVknIksykSZVsuXJXH0aprPcTOgrSmakNo=; b=UZ9CQ+gOLjfOasNqSjgYYr4lhHxQBE58wkxlUCxCi6FOqqSPOBxqAN89EJ8NvMrpem oVGEjsYtM70Xt4V4Ara3nwB9sjBuwbkNk8MIC1yJU2NphJuU8k5NWhN9Rf5JFu88Dvks syvgTJCNAfA1DzzatU5qqp3cW5JO+uZ5w+8031oVLeBsBpf57PUQT6RBenx+8JAURnx6 btQ4x2u0ykP5RvoGJoglRyT0mJGilQJ8bDcIzyvJ3mfWG497IHxQCp6rN9X8KP41JvAe fXBgmq5S28i7q6J30jT2i+ea/YCACUXAdT7C43p9TPlUsuCFmvAXwLFUiyMU0lGqY2Sw DhOg== X-Gm-Message-State: APjAAAUMWmbcY8+y2kMa5nrtVm4/uxsV+ga+2NTPqcKKxbKTet5yBmHv Wl0Ne728F64CmQLOkwG7p+fHQg1W2TCpaVUAqpdYyg== X-Google-Smtp-Source: APXvYqxkovO20U1+1l92l6NpQFtuPzNEZHM6i8Mpkn6yF5fupmT8rhIK6EYaPZ03KUKjWMDavkyE737rKhtlPqwJysk= X-Received: by 2002:ac2:51a3:: with SMTP id f3mr6290369lfk.94.1566002033837; Fri, 16 Aug 2019 17:33:53 -0700 (PDT) MIME-Version: 1.0 References: <09178E42-08B2-4958-A1C8-AF507AEE8834@fugue.com> <0BDD4F7F-7301-476A-80DA-0CC84EE4557D@fugue.com> <2BE3565E-4D1D-4C3D-8E5E-9BBF0A6C76EC@fugue.com> <2D09D61DDFA73D4C884805CC7865E6114E279D3E@GAALPA1MSGUSRBF.ITServices.sbc.com> <50618337-3358-4F81-AEAF-F479330488A7@hopcount.ca> <4F898538-E82D-487C-88AF-0EB803690204@hopcount.ca> <3ACBFB29-45C2-41CB-9619-30C679ADB646@hopcount.ca> In-Reply-To: From: Eric Rescorla Date: Sat, 17 Aug 2019 02:33:16 +0200 Message-ID: To: Joe Abley Cc: "STARK, BARBARA H" , ADD Mailing list , Ted Lemon , Bret Jordan Content-Type: multipart/alternative; boundary="000000000000f1dd4405904542dc" Archived-At: Subject: Re: [Add] When Two Worlds Collide X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 17 Aug 2019 00:33:58 -0000 --000000000000f1dd4405904542dc Content-Type: text/plain; charset="UTF-8" On Sat, Aug 17, 2019 at 2:08 AM Joe Abley wrote: > On Aug 16, 2019, at 18:43, Eric Rescorla wrote: > > > On Sat, Aug 17, 2019 at 12:08 AM Joe Abley wrote: > >> On 16 Aug 2019, at 17:50, Eric Rescorla wrote: >> >> > My point is that either (1) you can do MITM, in which case you can >> disable DoH or (2) you cannot disable DoH, in which case you won't be able >> to MITM anyway. But in neither case should you need to MITM DoH. >> >> I'm confused. This is not unusual. >> >> A user walks into the office with their personal, unmanaged phone. They >> join the wifi. Some things work, but many things do not. User not >> technical. What happen. Call IT. >> >> User's problems relate to the fact that all HTTPS is effectively blocked >> because much software on their device reacts badly to the certificates >> being presented by the corporate firewall, which is MITMing all the HTTPS >> traffic it can identify through destination port number or deep packet >> inspection. >> >> IT person says here, scan this QR code on the poster and follow the >> instructions. Some eye-rolling accompanies the need to point finger at >> large, obvious poster; some inference that most people don't need finger to >> notice poster. User does that, all now work. >> > > Why can't those instructions describe how to turn off DoH? > > > That seems like a degenerate case of modifying the traffic carried within > HTTPS, which is what I was trying to describe. So I don't really understand > the question. > > Perhaps what is missing is the need to MITM HTTPS for reasons other than > DoH in a network that accepts unmanaged devices, which I mentioned earlier. > I also do not understand your question. This is not about managed versus unmanaged. Suppose that you have a policy that requires some level of HTTPS MITM. In order to execute that policy, you need to modify user's computers (either via a management interface or otherwise) or convince the user to modify their computers. At that time, you can also disable DoH or convince users to disable DoH (assuming, as Stephen says, that DoH can be disabled). Therefore, there should not be a need to MITM DoH traffic, because you can just divert it to Do53. -Ekr > > Joe > --000000000000f1dd4405904542dc Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Sat, Aug 17, 2019 at 2:08 AM Joe A= bley <jabley@hopcount.ca> w= rote:
On Aug 16, 2019, at 18:43= , Eric Rescorla <ekr@r= tfm.com> wrote:

On Sat, Aug 17, 20= 19 at 12:08 AM Joe Abley <jabley@hopcount.ca> wrote:
On 16 Aug 2019, at 17:50, Eric Rescorla <<= a href=3D"mailto:ekr@rtfm.com" target=3D"_blank">ekr@rtfm.com> wrote= :

> My point is that either (1) you can do MITM, in which case you can dis= able DoH or (2) you cannot disable DoH, in which case you won't be able= to MITM anyway. But in neither case should you need to MITM DoH.

I'm confused. This is not unusual.

A user walks into the office with their personal, unmanaged phone. They joi= n the wifi. Some things work, but many things do not. User not technical. W= hat happen. Call IT.

User's problems relate to the fact that all HTTPS is effectively blocke= d because much software on their device reacts badly to the certificates be= ing presented by the corporate firewall, which is MITMing all the HTTPS tra= ffic it can identify through destination port number or deep packet inspect= ion.

IT person says here, scan this QR code on the poster and follow the instruc= tions. Some eye-rolling accompanies the need to point finger at large, obvi= ous poster; some inference that most people don't need finger to notice= poster. User does that, all now work.

= Why can't those instructions describe how to turn off DoH?
<= /div>

That seems like a degenerate ca= se of modifying the traffic carried within HTTPS, which is what I was tryin= g to describe. So I don't really understand the question.
Perhaps what is missing is the need to MITM HTTPS for reasons o= ther than DoH in a network that accepts unmanaged devices, which I mentione= d earlier.=C2=A0

I also do not = understand your question. This is not about managed versus unmanaged.
<= /div>

Suppose that you have a policy that requires some = level of HTTPS MITM. In order to execute that policy, you need to modify us= er's computers (either via a management interface or otherwise) or conv= ince the user to modify their computers. At that time, you can also disable= DoH or convince users to disable DoH (assuming, as Stephen says, that DoH = can be disabled). Therefore, there should not be a need to MITM DoH traffic= , because you can just divert it to Do53.

-Ekr=



Joe
--000000000000f1dd4405904542dc-- From nobody Fri Aug 16 17:39:43 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 39E86120113 for ; Fri, 16 Aug 2019 17:39:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jorLata-08-C for ; Fri, 16 Aug 2019 17:39:40 -0700 (PDT) Received: from mail-io1-xd2d.google.com (mail-io1-xd2d.google.com [IPv6:2607:f8b0:4864:20::d2d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8526A1200F1 for ; Fri, 16 Aug 2019 17:39:40 -0700 (PDT) Received: by mail-io1-xd2d.google.com with SMTP id t3so9708333ioj.12 for ; Fri, 16 Aug 2019 17:39:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=ze7XtsF/D1cVpNy8Ql9M9V0bnGI/SzBFCnPzhsczcFs=; b=jxpOsGSHMcLRfcYqQxjX5eNt3RbO6RhAtl9oaLxBzIQvMi0fL8u05ShQ9YldsHaIl6 ChPe/bBdty2vJXBZY1X2ot9hXPOhDprmjfAKMa8XSgfHcVoJoS+sIiz6Xms+dpnOOSoM zTQSjezCcULsBXABR6B4qyJVXl8TT4HXWpMVktKyy1J44NkZ5imb2RM/xfN79scFjWeC NvUkzh/pR2r4rr9J8PS6Ol53Eh5H+tUzfN9++IDltYhPpkMMtrZitK7Y7YDD/sMrDgfm o85Yf7OvP6+8tvze2sSmDxZPdEeuhzxjYEtJtViprzvKAzUwndM2K0g9OTZlbzKr8VW7 z/hg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=ze7XtsF/D1cVpNy8Ql9M9V0bnGI/SzBFCnPzhsczcFs=; b=Pek8ETPsVFuT+PMAWM3WxsfQ/7Io5fvltv4WKvQsZ2aOLb2kqpdfyPu3cKDrUUli6D w816v/MWvvdEpMmHA5tH20DQMcXLRBpFWvsFmT63RKQK4JY8Qglwt91cQfL6wcHUP5MF 0d1plAvwV4F9xnHrVJvy5GQ7ShF6VJ1AV+BniJh8IyRElz+zv/rQDEPDNsVQLsfquR2P 7PQ2mqb2kZnN40z1Nf37OWQ9pLzz3iB15YUkxRlm39waGFoAr6xptUCUNuerdZlGRKbM Qnc/95NlhFiiuA0oNviKh1ZuRQqJgHMP/KB+Ik7N1EFEG5DGaOKEHSUwGy9MRW1eM7mq W95A== X-Gm-Message-State: APjAAAXmjGYGDQr9Y9dsY3L99xbAluOaWTzKKtzc3jBtVaRSnRY1CHMN S10DiSnYcEph0fME9+GQtVsD00g6Fl6IkExZce8= X-Google-Smtp-Source: APXvYqwwShgWErKANV/HftSS4Z2ONclnwuYaE/uInT+ncBM4bKj/4alqrQI/swjIkSU3l4uhTkmvwVOqQicV+al8uB0= X-Received: by 2002:a05:6602:98:: with SMTP id h24mr14307515iob.49.1566002379745; Fri, 16 Aug 2019 17:39:39 -0700 (PDT) MIME-Version: 1.0 References: <09178E42-08B2-4958-A1C8-AF507AEE8834@fugue.com> <0BDD4F7F-7301-476A-80DA-0CC84EE4557D@fugue.com> <2BE3565E-4D1D-4C3D-8E5E-9BBF0A6C76EC@fugue.com> <2D09D61DDFA73D4C884805CC7865E6114E279D3E@GAALPA1MSGUSRBF.ITServices.sbc.com> <50618337-3358-4F81-AEAF-F479330488A7@hopcount.ca> <4F898538-E82D-487C-88AF-0EB803690204@hopcount.ca> <3ACBFB29-45C2-41CB-9619-30C679ADB646@hopcount.ca> In-Reply-To: From: Rob Sayre Date: Fri, 16 Aug 2019 17:39:28 -0700 Message-ID: To: Eric Rescorla Cc: Joe Abley , ADD Mailing list , Ted Lemon , "STARK, BARBARA H" , Bret Jordan Content-Type: multipart/alternative; boundary="0000000000008feeef0590455761" Archived-At: Subject: Re: [Add] When Two Worlds Collide X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 17 Aug 2019 00:39:42 -0000 --0000000000008feeef0590455761 Content-Type: text/plain; charset="UTF-8" On Fri, Aug 16, 2019 at 5:34 PM Eric Rescorla wrote: > On Sat, Aug 17, 2019 at 2:08 AM Joe Abley wrote: > >> Perhaps what is missing is the need to MITM HTTPS for reasons other than >> DoH in a network that accepts unmanaged devices, which I mentioned earlier. >> > > I also do not understand your question. This is not about managed versus > unmanaged. > I don't understand it either. Do people really think DNS isn't currently happening over HTTPS in unstandardized ways? Is the idea that we're all supposed to pretend that ineffective security works because someone sells it? thanks, Rob --0000000000008feeef0590455761 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Fri, Aug 16, 2019 at 5:34 PM Eric Resc= orla <ekr@rtfm.com> wrote:
On Sat, Aug 17, 2019 at 2:08 AM Joe Abley <jabley@hopcount.ca> wrote:
Perhaps what is missing is the need to MITM HTTPS for reasons other than D= oH in a network that accepts unmanaged devices, which I mentioned earlier.= =C2=A0

I also do not understand= your question. This is not about managed versus unmanaged.=C2=A0

I don't understand it either. = Do people really think DNS isn't currently happening over HTTPS in unst= andardized ways?

Is the idea that we're all su= pposed to pretend that ineffective security works because someone sells it?=

thanks,
Rob
--0000000000008feeef0590455761-- From nobody Fri Aug 16 18:15:31 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8F1641200DE for ; Fri, 16 Aug 2019 18:15:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Xqder37_L0ks for ; Fri, 16 Aug 2019 18:15:27 -0700 (PDT) Received: from mail-io1-xd2e.google.com (mail-io1-xd2e.google.com [IPv6:2607:f8b0:4864:20::d2e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E22CA12008B for ; Fri, 16 Aug 2019 18:15:26 -0700 (PDT) Received: by mail-io1-xd2e.google.com with SMTP id z3so9820828iog.0 for ; Fri, 16 Aug 2019 18:15:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=QGiiujLI8z8diqieDfDVNNXwIZj/fMjsqtGNSw2b2iE=; b=GXFXun/nT8zQ+q4KsU8rLF9sdy94oWWDhq/2+7Su1I3uGRvX5PJEgZtsUQkRYFw8gP r5XxxczJ3S9W65pNEwMXMEoJ9RgW0WgrlsznRHLoyM4Cnek6qfB/CC2IAu6QUz5VX06l rKBm3MKM5YdD+5OGuDRWYu62PdiIupY5SpLXzoltkeytZ63PpVMt3gUoFE4p8o3luNBh 3eco3dP+b3S7B6KBM83axXZRbjXu11bnstBE/zo3E6rD+sd65gnyc0harXAFjJfWhf/+ xKE6kRmmp+RVk2NMRi0VTNc/aKfey3DEdAV4PjV559fA8guOdbHXs5RWIKoZrQsM7oHx 6IIA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=QGiiujLI8z8diqieDfDVNNXwIZj/fMjsqtGNSw2b2iE=; b=B9vCbvFI5ZbILztM2ZikllkLD4cnomZTQ39gaAwlGG8t91zSYCWzTlSDsEZOtnV6u4 LeXHTFkoY2cokhqfMImqJopCZnIrW+bwFlPeTfd17YKptgmfoqQnP8b0yyj4ly/iN1o8 lz9F1NJGfX22HWLds7PdFyFMTb+SpYK00+sMr8LpI/cOBSDFXGlaWk80e1n3t/zhoMB6 e0qxqzU+wBjnUUp3T3UQ5ghF9R3E1LQ5qHQycxxI60c+69vGxUqMZC2QfQYv4y662o07 TaHRtnNogcvqxFKKNRm6LwJOecUrFdFoLn4LiM9P/W1teUEsNij5oy48fHWUeZ6+Bdye sDYA== X-Gm-Message-State: APjAAAVZAQN8WPkD9q7gqOOsWm5RGUTKKelY9vOAWIhIXlCNPZLekPhx GkpS7IcUDMaThNd1OxGFFVPDQ38rj5MJIkX+Zfo= X-Google-Smtp-Source: APXvYqzZvEih0BHz9KRwidGCW2GzIQU2LEmgZmSNRVswFnNMEburVsCCM652fuWCxgN6oiLelwJ3ulfDpO0HH/ADbTU= X-Received: by 2002:a02:1087:: with SMTP id 129mr14592225jay.131.1566004525950; Fri, 16 Aug 2019 18:15:25 -0700 (PDT) MIME-Version: 1.0 References: <09178E42-08B2-4958-A1C8-AF507AEE8834@fugue.com> <0BDD4F7F-7301-476A-80DA-0CC84EE4557D@fugue.com> <6698db4f-89ff-e5be-09a5-eb544f76ebc9@nostrum.com> In-Reply-To: <6698db4f-89ff-e5be-09a5-eb544f76ebc9@nostrum.com> From: Rob Sayre Date: Fri, 16 Aug 2019 18:15:14 -0700 Message-ID: To: Adam Roach Cc: Bret Jordan , Ted Lemon , ADD Mailing list Content-Type: multipart/alternative; boundary="0000000000007c6f0d059045d72d" Archived-At: Subject: [Add] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 17 Aug 2019 01:15:30 -0000 --0000000000007c6f0d059045d72d Content-Type: text/plain; charset="UTF-8" On Fri, Aug 16, 2019 at 2:16 PM Adam Roach wrote: > When people bring up the behaviors > that are driving applications to directly use encrypted DNS, there is a > certain subset of operators who feel attacked, and who claim they're > being painted as "the bad guys." I've received off-list correspondence > indicating that at least one operator felt that their participation in > this conversation was becoming more difficult exactly because of this > factor. > Well, I guess the salient question is "so what?". It seems weird to view giant telecom companies as oppressed participants. Maybe their arguments just aren't very good. thanks, Rob --0000000000007c6f0d059045d72d Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Fri, Aug 16, 2019 at 2:16 PM Adam Roac= h <adam@nostrum.com> wrote:
When people bring up the behaviors
that are driving applications to directly use encrypted DNS, there is a certain subset of operators who feel attacked, and who claim they're being painted as "the bad guys." I've received off-list corre= spondence
indicating that at least one operator felt that their participation in
this conversation was becoming more difficult exactly because of this
factor.

Well, I guess the salient quest= ion is "so what?". It seems weird to view giant telecom companies= as oppressed participants.

Maybe their arguments = just aren't very good.

thanks,
Rob
--0000000000007c6f0d059045d72d-- From nobody Fri Aug 16 18:20:17 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B3B941200DE for ; Fri, 16 Aug 2019 18:20:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id D7NaKmWXA9EK for ; Fri, 16 Aug 2019 18:20:13 -0700 (PDT) Received: from mail-qk1-x72c.google.com (mail-qk1-x72c.google.com [IPv6:2607:f8b0:4864:20::72c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2CAEF12008B for ; Fri, 16 Aug 2019 18:20:13 -0700 (PDT) Received: by mail-qk1-x72c.google.com with SMTP id d79so6211970qke.11 for ; Fri, 16 Aug 2019 18:20:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=ECcfZ+I8LsqsfpSy+HrbH730QA6GXaerfT95KnjK0G0=; b=NoUTndFM537SBoU6CrJjgObU6GdhaYt/nKmeJh+wuCksI1v5Nl7CNcBVA9P7imsp07 EbmgDdCj5sSLFXOnWe0jcFxzqEoyaD4hYlYZX3Uh9zRiwHA+ZhQvwmoux+JBffgLqmgy a8sgvFOg/rcDqTWbEHMsEQLaMSihfthyMDMDjudaynkpzbb2LZatVMVyB3A3rMsKvMwL F3IU0qbPQZfJb8hheLucs6d0Hz1yczHVKxmWFV3A48CHTeJxVyLXpSuU0U6+OGdqe6Y0 XnlLM6mNDWyYvo+q4PRzMkMEfJIHolAD3AyhUKZDcCPBACxicnfjAslK91HTtSkD6d4t 5PDg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=ECcfZ+I8LsqsfpSy+HrbH730QA6GXaerfT95KnjK0G0=; b=sYv77ym5AAJFd5uK2Yqn+S7NY5cBuVXugWGCU4WAGvYV4GiV0miCVkS70o1xXc1LwW eH6XNp9MTn+jBCEQ7lI4TqWiy5E+/izGKCV8eS+Ya2zM9aAO9A302VNxhHrUjoyRKfXJ 7IueUTNEINJ1ft2tYC5/zbkT+5jl6jtufvET1x1nfNKVnpVShRIj5T6RX9mNQoG2wGZX v9sTHSk4MkRLBe05xl2VpaHna5ZI8bgd5DwrQaSKXTp22MAWDTxToaAHHZgytP4gnRTr rtsEBIcgSb1JVb8NaxdkxCDofiPLvemrNNL8sUvM3X5A6vc1Iqmtrs4EezITaCeSdbkB PhOg== X-Gm-Message-State: APjAAAWTkS0M3ImCYePfoFKdJqOR37ES5WI/Sw5go1fm6cG5c5VH/DZN IGe6byiWcY//k3KbLG4eMnk= X-Google-Smtp-Source: APXvYqxPG4/zBRIqYjYhF8/kP/gJnN4lM4QqkELfqJT37S0+ozL8RdSwFsTZU+GB57H1DZkX6x1LBA== X-Received: by 2002:a37:6783:: with SMTP id b125mr11235414qkc.338.1566004812195; Fri, 16 Aug 2019 18:20:12 -0700 (PDT) Received: from [192.168.2.4] (cpe-76-179-66-50.maine.res.rr.com. [76.179.66.50]) by smtp.gmail.com with ESMTPSA id b1sm3466445qkk.8.2019.08.16.18.20.11 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 16 Aug 2019 18:20:11 -0700 (PDT) Content-Type: multipart/alternative; boundary=Apple-Mail-BA9C6CB1-BD14-4ED1-9B50-8AE3E5EBD9E1 Mime-Version: 1.0 (1.0) From: Brian Dickson X-Mailer: iPhone Mail (16G77) In-Reply-To: Date: Fri, 16 Aug 2019 21:20:10 -0400 Cc: Joe Abley , ADD Mailing list , Ted Lemon , "STARK, BARBARA H" , Bret Jordan Content-Transfer-Encoding: 7bit Message-Id: References: <09178E42-08B2-4958-A1C8-AF507AEE8834@fugue.com> <0BDD4F7F-7301-476A-80DA-0CC84EE4557D@fugue.com> <2BE3565E-4D1D-4C3D-8E5E-9BBF0A6C76EC@fugue.com> <2D09D61DDFA73D4C884805CC7865E6114E279D3E@GAALPA1MSGUSRBF.ITServices.sbc.com> <50618337-3358-4F81-AEAF-F479330488A7@hopcount.ca> <4F898538-E82D-487C-88AF-0EB803690204@hopcount.ca> <3ACBFB29-45C2-41CB-9619-30C679ADB646@hopcount.ca> To: Eric Rescorla Archived-At: Subject: Re: [Add] When Two Worlds Collide X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 17 Aug 2019 01:20:16 -0000 --Apple-Mail-BA9C6CB1-BD14-4ED1-9B50-8AE3E5EBD9E1 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable > On Aug 16, 2019, at 8:33 PM, Eric Rescorla wrote: >=20 >=20 >=20 >> On Sat, Aug 17, 2019 at 2:08 AM Joe Abley wrote: >>> On Aug 16, 2019, at 18:43, Eric Rescorla wrote: >>>=20 >>>=20 >>>> On Sat, Aug 17, 2019 at 12:08 AM Joe Abley wrote: >>>> On 16 Aug 2019, at 17:50, Eric Rescorla wrote: >>>>=20 >>>> > My point is that either (1) you can do MITM, in which case you can di= sable DoH or (2) you cannot disable DoH, in which case you won't be able to M= ITM anyway. But in neither case should you need to MITM DoH. >>>>=20 >>>> I'm confused. This is not unusual. >>>>=20 >>>> A user walks into the office with their personal, unmanaged phone. They= join the wifi. Some things work, but many things do not. User not technical= . What happen. Call IT. >>>>=20 >>>> User's problems relate to the fact that all HTTPS is effectively blocke= d because much software on their device reacts badly to the certificates bei= ng presented by the corporate firewall, which is MITMing all the HTTPS traff= ic it can identify through destination port number or deep packet inspection= . >>>>=20 >>>> IT person says here, scan this QR code on the poster and follow the ins= tructions. Some eye-rolling accompanies the need to point finger at large, o= bvious poster; some inference that most people don't need finger to notice p= oster. User does that, all now work. >>>=20 >>> Why can't those instructions describe how to turn off DoH? >>=20 >> That seems like a degenerate case of modifying the traffic carried within= HTTPS, which is what I was trying to describe. So I don't really understand= the question. >>=20 >> Perhaps what is missing is the need to MITM HTTPS for reasons other than D= oH in a network that accepts unmanaged devices, which I mentioned earlier.=20= >=20 > I also do not understand your question. This is not about managed versus u= nmanaged.=20 >=20 > Suppose that you have a policy that requires some level of HTTPS MITM. In o= rder to execute that policy, you need to modify user's computers (either via= a management interface or otherwise) or convince the user to modify their c= omputers. At that time, you can also disable DoH or convince users to disabl= e DoH (assuming, as Stephen says, that DoH can be disabled). Therefore, ther= e should not be a need to MITM DoH traffic, because you can just divert it t= o Do53. >=20 > -Ekr Hi, Ekr, Many messages from you today have talked about turning off DoH or diverting t= o Do53. I=E2=80=99m confused by this, since AFAICT you are in favor of DoH. Why woul= d you advocate turning off DoH? Given the potential number of apps doing DNS, the possibility of unknown app= s doing DNS, and the possibility that those might be using different resolve= rs, MitM on DoH would appear to scale better and enable many of the services= that non-MitM DoH effectively disabled. This could be accomplished by redir= ecting to a different DoH server, or by implementing the needed features as a= transparent network function (eg RPZ), particularly on the responses rather= than on the queries. I=E2=80=99d rather see the benefits of DoH, than block it entirely. The vast= majority of =E2=80=9Cblock=E2=80=9D use cases is where the preferred or req= uired resolver isn=E2=80=99t the one being used by the app, or where split-d= ns is needed, or where RPZ is needed, or a rogue resolver is being used. If a query isn=E2=80=99t internal, is not on a DNS black list (especially a r= eal time one), and is going to an approved quadX resolver, having that occur= over DoH isn=E2=80=99t terrible. There are other things where the choice of resolver might be suboptimal, or w= here use of ECS is desired or necessary. Redirecting to a different DoH reso= lver (especially internal) may make sense in that use case. I don=E2=80=99t see anyone asking for Do53, actually, so I=E2=80=99m confuse= d... why do that? Brian= --Apple-Mail-BA9C6CB1-BD14-4ED1-9B50-8AE3E5EBD9E1 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable

On Aug 16, 2019, a= t 8:33 PM, Eric Rescorla <ekr@rtfm.com> wrote:



On Sat, Aug 17, 2019 at 2:08 AM Joe Abley <= jabley@hopcount.ca> wrote:
<= /div>
On Aug 16, 2019, at 18:43, Eric Rescorla= <ekr@rtfm.com> w= rote:


=
On Sat, Aug 17, 2019 at 12:08 AM Joe A= bley <jabley@hopc= ount.ca> wrote:
On 16 Aug 2019, at 17:50, Eric Rescorla <ekr@rtfm.com> wrote:

> My point is that either (1) you can do MITM, in which case you can disa= ble DoH or (2) you cannot disable DoH, in which case you won't be able to MI= TM anyway. But in neither case should you need to MITM DoH.

I'm confused. This is not unusual.

A user walks into the office with their personal, unmanaged phone. They join= the wifi. Some things work, but many things do not. User not technical. Wha= t happen. Call IT.

User's problems relate to the fact that all HTTPS is effectively blocked bec= ause much software on their device reacts badly to the certificates being pr= esented by the corporate firewall, which is MITMing all the HTTPS traffic it= can identify through destination port number or deep packet inspection.
=
IT person says here, scan this QR code on the poster and follow the instruct= ions. Some eye-rolling accompanies the need to point finger at large, obviou= s poster; some inference that most people don't need finger to notice poster= . User does that, all now work.

Why can'= t those instructions describe how to turn off DoH?

That seems like a degenerate case of modifyin= g the traffic carried within HTTPS, which is what I was trying to describe. S= o I don't really understand the question.

Perhaps w= hat is missing is the need to MITM HTTPS for reasons other than DoH in a net= work that accepts unmanaged devices, which I mentioned earlier. 
<= /div>

I also do not understand your question= . This is not about managed versus unmanaged.

= Suppose that you have a policy that requires some level of HTTPS MITM. In or= der to execute that policy, you need to modify user's computers (either via a= management interface or otherwise) or convince the user to modify their com= puters. At that time, you can also disable DoH or convince users to disable D= oH (assuming, as Stephen says, that DoH can be disabled). Therefore, there s= hould not be a need to MITM DoH traffic, because you can just divert it to D= o53.

-Ekr
<= br>
Hi, Ekr,

Many messages from you today have t= alked about turning off DoH or diverting to Do53.

I= =E2=80=99m confused by this, since AFAICT you are in favor of DoH. Why would= you advocate turning off DoH?

Given the potential n= umber of apps doing DNS, the possibility of unknown apps doing DNS, and the p= ossibility that those might be using different resolvers, MitM on DoH would a= ppear to scale better and enable many of the services that non-MitM DoH effe= ctively disabled. This could be accomplished by redirecting to a different D= oH server, or by implementing the needed features as a transparent network f= unction (eg RPZ), particularly on the responses rather than on the queries.<= /div>

I=E2=80=99d rather see the benefits of DoH, than bl= ock it entirely. The vast majority of =E2=80=9Cblock=E2=80=9D use cases is w= here the preferred or required resolver isn=E2=80=99t the one being used by t= he app, or where split-dns is needed, or where RPZ is needed, or a rogue res= olver is being used.

If a query isn=E2=80=99t inter= nal, is not on a DNS black list (especially a real time one), and is going t= o an approved quadX resolver, having that occur over DoH isn=E2=80=99t terri= ble.

There are other things where the choice of res= olver might be suboptimal, or where use of ECS is desired or necessary. Redi= recting to a different DoH resolver (especially internal) may make sense in t= hat use case.

I don=E2=80=99t see anyone asking for= Do53, actually, so I=E2=80=99m confused... why do that?

Brian
= --Apple-Mail-BA9C6CB1-BD14-4ED1-9B50-8AE3E5EBD9E1-- From nobody Fri Aug 16 18:54:01 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BC6671200E9 for ; Fri, 16 Aug 2019 18:53:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id G4xN94GPqxcy for ; Fri, 16 Aug 2019 18:53:56 -0700 (PDT) Received: from mail-lf1-x130.google.com (mail-lf1-x130.google.com [IPv6:2a00:1450:4864:20::130]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1B6F21200D5 for ; Fri, 16 Aug 2019 18:53:56 -0700 (PDT) Received: by mail-lf1-x130.google.com with SMTP id a30so5252208lfk.12 for ; Fri, 16 Aug 2019 18:53:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=XNBYYkDVXo+9jWEqAiXbo5czD0gotAdtKyDRMWvqUwQ=; b=G6ixLo7KGgh1p+7qfuy6nJ2ZlScm2lDSNaGLom2c3e5WTzcunWREFSq38/DKZ3o0vF TphiHYUBKNGnKZVxvQc2KCA+DrfClr2Eq+RUXtv4UhY8o1B1hjouto0tl+XmgFEY8wea Q8Rv+fwuYTh7TYNDHIj14+ixQWeIz0mTIJM7Bkxa/M0MH8czXr/qsOc5qjzzTY9VrJWL Cd5VH3EMYeYdIGwy4tqBNdLJyQ/FxRdnSPUq3Om+ecgS+ScMY9W9j0CGtWq/SgF8qfMA kUe1+0nvMDGrq3y48wdT7Ji/TcndE+3l6GUTji9W6ROZEkHmAnVuLhv/rNr5Jgu50/iL 41aQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=XNBYYkDVXo+9jWEqAiXbo5czD0gotAdtKyDRMWvqUwQ=; b=Mo37lDnmFOXxHsfj7Mk2U+4ujBarDyeoF3JvnAxfjbakOXBQLOuA/i6B9SKkoufp0W vog3YSw8UABNjI3erkAjR15FHDQ6ZlEv0qnaRwYO/Xr+O9GVUa0KirZLLTcGJvW2TroJ UXcjvArpo6fcN0YvK7mI9EtrZeByPKtcjv6dLsWhI7FigyEUOlA0UQA6w6/w2Oz0Iili JyKC4DYNaay+xs9WMbowcSmm0NuOglgdlGgltiKgUyJ21HJA/S9THkV3FujEv8yyJPCd FwKUptLvBTc6KHlZGb5SZJ9rGkU+JqgdhWWA4g3ncRmzdoz6a9CLBkDQV8jW7nRNEgmy a9qg== X-Gm-Message-State: APjAAAVDzsY2mxcLU0GDkVigwYl5VOBTosCL3/bvXAckfah8bEJBKsTp VuIOwkaVcQJOUStDJC/AEOp+kXTdlOGZnPnHKuhWjw== X-Google-Smtp-Source: APXvYqxcVFX6B6fS5yZN52rO/snzhO5Bbd3RBCFcySNZrzXm9eQXUpvJ0Ij4Vd3ItERnDgMLkm9w/jJktxvLeNP68DY= X-Received: by 2002:a19:7908:: with SMTP id u8mr6680987lfc.178.1566006834370; Fri, 16 Aug 2019 18:53:54 -0700 (PDT) MIME-Version: 1.0 References: <09178E42-08B2-4958-A1C8-AF507AEE8834@fugue.com> <0BDD4F7F-7301-476A-80DA-0CC84EE4557D@fugue.com> <2BE3565E-4D1D-4C3D-8E5E-9BBF0A6C76EC@fugue.com> <2D09D61DDFA73D4C884805CC7865E6114E279D3E@GAALPA1MSGUSRBF.ITServices.sbc.com> <50618337-3358-4F81-AEAF-F479330488A7@hopcount.ca> <4F898538-E82D-487C-88AF-0EB803690204@hopcount.ca> <3ACBFB29-45C2-41CB-9619-30C679ADB646@hopcount.ca> In-Reply-To: From: Eric Rescorla Date: Sat, 17 Aug 2019 03:53:17 +0200 Message-ID: To: Brian Dickson Cc: Joe Abley , ADD Mailing list , Ted Lemon , "STARK, BARBARA H" , Bret Jordan Content-Type: multipart/alternative; boundary="000000000000143867059046610c" Archived-At: Subject: Re: [Add] When Two Worlds Collide X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 17 Aug 2019 01:53:59 -0000 --000000000000143867059046610c Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Sat, Aug 17, 2019 at 3:20 AM Brian Dickson wrote: > > > On Aug 16, 2019, at 8:33 PM, Eric Rescorla wrote: > > > > On Sat, Aug 17, 2019 at 2:08 AM Joe Abley wrote: > >> On Aug 16, 2019, at 18:43, Eric Rescorla wrote: >> >> >> On Sat, Aug 17, 2019 at 12:08 AM Joe Abley wrote: >> >>> On 16 Aug 2019, at 17:50, Eric Rescorla wrote: >>> >>> > My point is that either (1) you can do MITM, in which case you can >>> disable DoH or (2) you cannot disable DoH, in which case you won't be a= ble >>> to MITM anyway. But in neither case should you need to MITM DoH. >>> >>> I'm confused. This is not unusual. >>> >>> A user walks into the office with their personal, unmanaged phone. They >>> join the wifi. Some things work, but many things do not. User not >>> technical. What happen. Call IT. >>> >>> User's problems relate to the fact that all HTTPS is effectively blocke= d >>> because much software on their device reacts badly to the certificates >>> being presented by the corporate firewall, which is MITMing all the HTT= PS >>> traffic it can identify through destination port number or deep packet >>> inspection. >>> >>> IT person says here, scan this QR code on the poster and follow the >>> instructions. Some eye-rolling accompanies the need to point finger at >>> large, obvious poster; some inference that most people don't need finge= r to >>> notice poster. User does that, all now work. >>> >> >> Why can't those instructions describe how to turn off DoH? >> >> >> That seems like a degenerate case of modifying the traffic carried withi= n >> HTTPS, which is what I was trying to describe. So I don't really underst= and >> the question. >> >> Perhaps what is missing is the need to MITM HTTPS for reasons other than >> DoH in a network that accepts unmanaged devices, which I mentioned earli= er. >> > > I also do not understand your question. This is not about managed versus > unmanaged. > > Suppose that you have a policy that requires some level of HTTPS MITM. In > order to execute that policy, you need to modify user's computers (either > via a management interface or otherwise) or convince the user to modify > their computers. At that time, you can also disable DoH or convince users > to disable DoH (assuming, as Stephen says, that DoH can be disabled). > Therefore, there should not be a need to MITM DoH traffic, because you ca= n > just divert it to Do53. > > -Ekr > > > Hi, Ekr, > > Many messages from you today have talked about turning off DoH or > diverting to Do53. > > I=E2=80=99m confused by this, since AFAICT you are in favor of DoH. Why w= ould you > advocate turning off DoH? > I'm not advocating turning off DoH. I'm saying that if you control the device, you can configure Firefox (and I would assume many other DoH-using apps) either talk to some DoH resolver of your choice or to defer to the system resolver. However, I expect that n the vast majority of those settings, the resolver in question will be Do53, because that's what's widely available. -Ekr --000000000000143867059046610c Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Sat, Aug 17, 2019 at 3:20 AM Brian= Dickson <brian.peter.d= ickson@gmail.com> wrote:


On Aug 16, 2019,= at 8:33 PM, Eric Rescorla <ekr@rtfm.com> wrote:



On Sat, Aug 17, 2019= at 2:08 AM Joe Abley <jabley@hopcount.ca> wrote:
On Aug 16, 2019, at 18:43, Eric Rescorla <ekr@rtfm.com> wrote:


On Sat, Aug 17, 2019 at 12:08 AM Joe Abley <jabley@hopcount.ca> wrot= e:
On 16 Aug 201= 9, at 17:50, Eric Rescorla <ekr@rtfm.com> wrote:

> My point is that either (1) you can do MITM, in which case you can dis= able DoH or (2) you cannot disable DoH, in which case you won't be able= to MITM anyway. But in neither case should you need to MITM DoH.

I'm confused. This is not unusual.

A user walks into the office with their personal, unmanaged phone. They joi= n the wifi. Some things work, but many things do not. User not technical. W= hat happen. Call IT.

User's problems relate to the fact that all HTTPS is effectively blocke= d because much software on their device reacts badly to the certificates be= ing presented by the corporate firewall, which is MITMing all the HTTPS tra= ffic it can identify through destination port number or deep packet inspect= ion.

IT person says here, scan this QR code on the poster and follow the instruc= tions. Some eye-rolling accompanies the need to point finger at large, obvi= ous poster; some inference that most people don't need finger to notice= poster. User does that, all now work.

= Why can't those instructions describe how to turn off DoH?
<= /div>

That seems like a degenerate ca= se of modifying the traffic carried within HTTPS, which is what I was tryin= g to describe. So I don't really understand the question.
Perhaps what is missing is the need to MITM HTTPS for reasons o= ther than DoH in a network that accepts unmanaged devices, which I mentione= d earlier.=C2=A0

I also do not = understand your question. This is not about managed versus unmanaged.
<= /div>

Suppose that you have a policy that requires some = level of HTTPS MITM. In order to execute that policy, you need to modify us= er's computers (either via a management interface or otherwise) or conv= ince the user to modify their computers. At that time, you can also disable= DoH or convince users to disable DoH (assuming, as Stephen says, that DoH = can be disabled). Therefore, there should not be a need to MITM DoH traffic= , because you can just divert it to Do53.

-Ekr=

Hi, Ekr,

=
Many messages from you today have talked about turning off DoH or dive= rting to Do53.

I=E2=80=99m confused by this, since= AFAICT you are in favor of DoH. Why would you advocate turning off DoH?

I'm not advocating turning of= f DoH. I'm saying that if you control the device, you can configure Fir= efox (and I would assume many other DoH-using apps) either talk to some DoH= resolver of your choice or to defer to the system resolver. However, I exp= ect that n the vast majority of those settings, the resolver in question wi= ll be Do53, because that's what's widely available.
<= br>
-Ekr

--000000000000143867059046610c-- From nobody Fri Aug 16 19:08:04 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 94CDC1200E9 for ; Fri, 16 Aug 2019 19:08:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=nomountain-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YLJ-pL9RMdrq for ; Fri, 16 Aug 2019 19:08:01 -0700 (PDT) Received: from mail-pf1-x42a.google.com (mail-pf1-x42a.google.com [IPv6:2607:f8b0:4864:20::42a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D37E21200D5 for ; Fri, 16 Aug 2019 19:08:00 -0700 (PDT) Received: by mail-pf1-x42a.google.com with SMTP id c81so4003605pfc.11 for ; Fri, 16 Aug 2019 19:08:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nomountain-net.20150623.gappssmtp.com; s=20150623; h=subject:to:references:from:openpgp:autocrypt:message-id:date :user-agent:mime-version:in-reply-to; bh=slIgG4WpOjK3QS3xqRmXO1P3LTBwpZbc9JwGjjGKOPw=; b=aEP9uEjM2p3wIQjo/KwkBv3TFlHaeQyGyhlGa8cY81w6U8bUAK01MQLCraIJRsdQTF PEAt7e9FzNpCdqg7OXWp3ZYN9ZxhomkfFBmUUTk4dAiPZKOpSscGCF9d9HtsFGtcuSao JEyVa29Lw2N19h1SkrlpZfafWxDnBsAPMOsWLExvYthW4WBoJJyh0EJ5JLCUmfDC0UrZ MuTsVx/R9rblo6ALnWa2eehNnIeG+s29YQHmf6VrOeOL2EYuMhcOl0M/kPoIEAZZ0YCc fp4YvgBQ+BWiGdC6mNdxiJHdv0Y6/VTM28qFQBO+fAXpeSejZ1iZqgzMNPPmPX3qTyk8 iS4w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:references:from:openpgp:autocrypt :message-id:date:user-agent:mime-version:in-reply-to; bh=slIgG4WpOjK3QS3xqRmXO1P3LTBwpZbc9JwGjjGKOPw=; b=pm4TAU32gCARK+/Ohq+mLxpu+B+L/FrdfqrLHcFryVX6X7C5rluRlOjpz5aGF+h7lX XIhty+k50C+AaVmAbl0tTvD/0aehw+DevZPAw9weh+Ka+KizNoAqePxSfvrPj2/Lnpp/ FRv8UmyjY9Rynj4hltnMPio2mAr23oaq/ndqtj0XaV9VLvyt0SFEv/KgZqY7pSA3BkQn RQ8LTZ6ktykGT98qHFabWcQYz6h8eLL5IhspBv5m3cUiwDWQC/YVWMEcg+Mf4ySzRLaZ MEeri2K2+zQ4/MGMk8QGy0WWk4e3xYMs/KBf3ZKCVx01Rz4DM2hW+CqG6c4A/+hB05Ki 1L4w== X-Gm-Message-State: APjAAAUalj6SgYZPRZlsvdR8nA55fDHpTkJHhlZzlwIc+TlMjhopCs5N WZQUdSB6tLYg+EsQnxYw4TQtwrfUlA== X-Google-Smtp-Source: APXvYqxllqytMbJj9JuX3WT96v0A4kOjFxK+UMJsJBx8M8yFRPAJ60E7qDncg1uk+fOFMtO3VtUKGA== X-Received: by 2002:a63:f941:: with SMTP id q1mr10239939pgk.350.1566007680022; Fri, 16 Aug 2019 19:08:00 -0700 (PDT) Received: from aspen.local (63-140-73-7-rb1.jnu.dsl.dynamic.acsalaska.net. [63.140.73.7]) by smtp.gmail.com with ESMTPSA id 185sm9440785pfd.125.2019.08.16.19.07.58 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 16 Aug 2019 19:07:59 -0700 (PDT) To: add@ietf.org References: <09178E42-08B2-4958-A1C8-AF507AEE8834@fugue.com> <0BDD4F7F-7301-476A-80DA-0CC84EE4557D@fugue.com> <6698db4f-89ff-e5be-09a5-eb544f76ebc9@nostrum.com> From: Melinda Shore Openpgp: preference=signencrypt Autocrypt: addr=melinda.shore@nomountain.net; prefer-encrypt=mutual; keydata= mQINBFppZ0gBEADFwxAi5szDOsM/6+CH4pbYTX7D+2gjLY4xEE7ydQcAF1WVLvcWXrpZM0GO /eA4N1PJ+OT5o8o9zVr7izMJkiLwcnQmxHdlYgZ9E+Cm8hDtMyEPBQwsYTkE5kpbGCmBAZ+W rHNHjvDg366uZQHzJejenB1/V4+rxMZs1Ak34Az2MVOz9Doecaiadpw3NpH3+1VXY/qilqnM lznINSANqD0ktxB/CVKjxl3/K5JnVnLp0h2kiUqt19hQPX2JmLcgaHzu+Ceb34/HZWhs0CiF c4auhQ3A9PcccOprQh6IGW1xo6RP3OEbeRFqeovgBWS+DIWzMIM0a3G2LDid0889QYwEv0zZ RPDCcF3g15mlkeUUmwKQ6eAagPyTqLtTiOKULqy9bQahyX2eqlySrF+HqlwGeNoG+A4l1Z2Y S7NCBLPIzUk2RuSKMBaKw86ORzvg2Advrw4bdv7kbDkArGzywky61SEB/q+GqR466mekXx2F O+m8RuoSnWrBsKvD/bhELHcneorIBleGz+VL7i5adU0rIydG3jPTfUeXoCZIeNx1LannxnAR ihKdh5+FE26WiiK6VmZWkvFjaPFwWGjvAsi82Pd9QgHhnG/XzINpXw/3HF4wtBTU5nIExMzC +FbJxCPq1kXpqSxJqg7hgUFvD5jUD9lpN5Br/S2dUgJj95bbPQARAQABtCxNZWxpbmRhIFNo b3JlIDxtZWxpbmRhLnNob3JlQG5vbW91bnRhaW4ubmV0PokCVAQTAQoAPgIbAwUJCWdTAAUL CQgHAwUVCgkICwUWAgMBAAIeAQIXgBYhBE9oLZMqF5b4IPI0wN+4kXKadtuPBQJaaXRaAAoJ EN+4kXKadtuPVioP/3nVzx33yjiEtqLKTEHwofnLT15CV5wAcGa0DTbqgiomVKzSRkkhbF3Z KIHYrnjVpTcYJuW+PmFSIjNizNVr+vvjNP6ptRqx5orWmK4EBe/B9mrpmIshxUwkYr46uwN4 h06xJS3KCzhfhSsnesH5vlGBkUod0+nQhbSLyLRpxmaKaeAl4dxFSBLU0vUJMLH8PXTZVNof 5Yo+ThqCzu1pwOkBQ8gST2J6zdy4PjU9ENQ9RLAamlAG/6rGHEKLFcnUpEg7Tcu1hSzAsqR8 kjX2Prpu4A9DyLCjTOvfOPQa8WjZy18ZdYOxuPxdrTazeCRVJIvYRflhBCZb744jhMyfAiSW eckwRBVSCnBuvWBJl9Ua1wp8SOUXXhgGI8WGvSkvul6kKSkHQKDggd4cojAhxWLfvmjxn5pz 0BNbvrEBGqgWwO1ZMuJpmv3P8YK5Aytsl85NZoMMUJIDxEQhBUgYz5QTQANBKPi8RsfOntho rhzXLqnPPQcE4Xf9O9XIyy077F0JoyiPx74Zsl1dTxmT73pezpfhKUQR7/QlmJ/FAADpb6SO V0tlgBtR6FAZToBYPDiss57AcKM1zzyJ7sHIZkxQelykYSet6hp2WGcwMXQveWqFMQ4fiGQx XNEPO+KZKNj+0sfINzSLP88O5TniM/l/JrjZZNT/lVAQDTdkCBGyuQINBFppZ0gBEACgZuM1 8ghzSuhuv+n0kWyWCeEWrx9Ey03EgFj5alBt55+OLv3dOsdyBHJxjtd0cZS1XaKZlgr1YZ0O pQNv/Wyy8uSW2BZ6hyG1SKN9/1MmfJLNnjjxaBQP4yaMwDdS3wX7hoWY19IpVPZHYDR35FAg SnG/s6we+IOITM1TJoOJs4+ygeK5dC7LfRoj+lkEHYrTcglYVuwsyK2FNz/sF8kJW1fEZHM6 6phSbhCvwbECWbb4eDGXbKZY92W1RTQ5U5td8DMLXyYipQphrcoeRXpb18DbOnE0WwIQV0yB gc/rTiUt/wVjasd1RrsCPBQC/uJ+ZHknvr2MoxIWBBsRtKYHG66aOL+nDV8X1miuF6j4cztv gmdqrwPHpAKVxhfwd/G4suNBunYw4/kAV9b2+eidX5em3NtPPNl/qNjsmEHQGn/5JKRHRvQs 0yuigXDhN2N0keoHrbGCE8kyA/d83L7E9d95hsf3JxpRzmeaTze+NpcIaX5uXdKOaCBjLtx1 tOrDA4XX7Y3nY+waKZYa3RvC7yulFJiKfYWDSriWeQXcXj06p8H6vF6sy9LeX9xRRjTI7qDH FxwuMQIKGqgufXtxu0pxxcMqXTEUPZnxUWUvuFjjYvEmtO92+Ot/NuotV8JvRPwg2OnYjMJo dU1X7hzEs8djtgZG+t3FEGK3i1EJUQARAQABiQI8BBgBCgAmFiEET2gtkyoXlvgg8jTA37iR cpp2248FAlppZ0gCGwwFCQlnUwAACgkQ37iRcpp2248krg/9H896KtAQCAV0RcV3QqZ75iY5 pCxpRyxAaR0PjE5jiYV5gUHPCKtr9UPZt4Bi+bzNLQ2KJK6Rx4XNf5lQWopEo1IxtOiFPjkr QIpNkYmFWyOGpKpSIDhgsJpswZqxPDLpo+59GNlSUG6v3sMAnx+Gvtvqczkvg6UPDN/JYK75 BIGoCGZMyor1B0EmRYj98LdwjT95dQZXjZvWBDeIx+NxUZKoA7AlR/xgsN3PHGq4SApMLL0R /qbiLIzUPnTPt5sBs0peflVvMrtgIMiZ9FdYPE+VWy5+X2AmeFg6Zl5W76HQUP6eYZQV5abZ +iiW9lY1TmqsqpTIDu/ZMy7pLknxV5E1vQy+wsihluDYydaQ4HWoNaY7QFb+x7TsvjJRi+cH 7By4jxohTWUuaukuMmT0eEaesWJSraAmxsffqJwDpsi0chZskuXjEm9gX6rY7MhzOZl7Vz9F +6MYTtTmT1mpkLAMWf1/JuKUCfnSAHRlDxUOAG6QSJoHWAGqYy3XiF9bN63yQ6xllloSbbMv P9VW0e/iFKMKEIvfIvAg0IrlPcfKAGuuT1axwIU7da/N7LOcXyDDSEUuSzvXL/BkWyjxuLzd LY6eTvC6ZT/fA5iS/PAUj0WbrWNrHQtQ5OY2+al2v6JdLu/w6IZJCBpTosOAOzzmre+31fk1 HKwqd9xRxC8= Message-ID: Date: Fri, 16 Aug 2019 18:07:56 -0800 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="2wXg8T0ephbcWkDhT5GJOsA7sLNVar4K6" Archived-At: Subject: Re: [Add] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 17 Aug 2019 02:08:04 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --2wXg8T0ephbcWkDhT5GJOsA7sLNVar4K6 Content-Type: multipart/mixed; boundary="8VtFXQkIpw3rjVxMQSOTL7wymSZI1b6nF"; protected-headers="v1" From: Melinda Shore To: add@ietf.org Message-ID: Subject: Re: [Add] Participation References: <09178E42-08B2-4958-A1C8-AF507AEE8834@fugue.com> <0BDD4F7F-7301-476A-80DA-0CC84EE4557D@fugue.com> <6698db4f-89ff-e5be-09a5-eb544f76ebc9@nostrum.com> In-Reply-To: --8VtFXQkIpw3rjVxMQSOTL7wymSZI1b6nF Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: quoted-printable On 8/16/19 5:15 PM, Rob Sayre wrote: > Well, I guess the salient question is "so what?". It seems weird to vie= w > giant telecom companies as oppressed participants. > Maybe their arguments just aren't very good. obNoHats: I'm in the process of catching up on the discussion and am fairly dismayed by the tone. If their arguments aren't very good, refute them. Comments like this don't move the technical discussion at all. The primary thing I'm looking for as I'm sifting through the discussion is to try to identify useful work that's within the IETF's purview, and to understand the assumptions that various parties are bringing to the table. I think that policy impacts are inevitable but we are not primarily a policy organization and tend to be more successful when we focus on technical discussion. Melinda --=20 Melinda Shore melinda.shore@nomountain.net Software longa, hardware brevis --8VtFXQkIpw3rjVxMQSOTL7wymSZI1b6nF-- --2wXg8T0ephbcWkDhT5GJOsA7sLNVar4K6 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEET2gtkyoXlvgg8jTA37iRcpp2248FAl1XYX0ACgkQ37iRcpp2 249Ksg//Y91stu2L8Y1+iQZNLlbqYOzihAmzhI8lZ6s+hXeN8zDiDaOVq96WzrRv IB1i3HBHxW9AIbjlU6Su7pVkKqhYa+26kfazC5iimXmPjhXuuMGX4FmRxVNO56uK kkCX9HDEUsXShPJDsoGS0PkJHC3StLa9xpA7bmNiDDrzaN22GOgnPGhiPptPKKMs ksPgWd8kCufeRaX0nTGLXrc6kXmmyEzKfjnzGvtkOopF3+BcXOBFEI7k4tgAdJbo APoy9BOXhgSXzk1AKaIzHZA1ftFvf4D7b4MWGiACfCUTSSLiojaIxHCHv5KZ4nB8 ylJUCkWnYT53n7bISVWnLKB8hHoirWJ8NLFDCXoIuDqhRKHZ+vo88FJVAzxJS7pV kN71k72EkaMikHkUFgUUZYbBByuLDRTHXgSdCCEwj3eqtZQrvd53W1pjerRp2QRG NDAWsPKpSdvKln1At3HJVbmZW+hXRKHSdF3XyqkFDiIZO+Xv12U/Fjqvzw67+CA6 /OrywZbi08/tIRsmaWj6y8q9jLqGqjrxS1EtpF5EEjygWPledHQFsVjwYXSwboLb IMRjYSBFtyUVZyHkhzEDIdH+egQNg6NIxXJvOdCI/dTTtEBzpFqRrdONQBuu+unS JYP6LvI+X+mIDeffvoQ2VDRbIcIi4W4D7hODOsc/nUS8SSkFzhA= =4iPE -----END PGP SIGNATURE----- --2wXg8T0ephbcWkDhT5GJOsA7sLNVar4K6-- From nobody Fri Aug 16 22:35:10 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D0F0612012C for ; Fri, 16 Aug 2019 22:35:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, UNPARSEABLE_RELAY=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=hopcount.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MmT-Nwj6CXzo for ; Fri, 16 Aug 2019 22:35:07 -0700 (PDT) Received: from mail-lj1-x22b.google.com (mail-lj1-x22b.google.com [IPv6:2a00:1450:4864:20::22b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9004012003E for ; Fri, 16 Aug 2019 22:35:06 -0700 (PDT) Received: by mail-lj1-x22b.google.com with SMTP id z17so7116331ljz.0 for ; Fri, 16 Aug 2019 22:35:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hopcount.ca; s=google; h=mime-version:from:in-reply-to:references:date:message-id:subject:to :cc:content-transfer-encoding; bh=bGI92TIlsm8iFR32Mf1bNNEGpxk7crL2I3F1X6Io1yY=; b=Ch3F6yhJ3yYkloj8gqhOWqdgIfA0NHT0nZs1vlh5yQhZW4rfWUEwiz41wEwwtcOplK B8Cedum6KuxL8JkBmWK2BZaJmCsoWH+YKsVXa3Aj/aLqJb8/gfgG3YyRwO0HIy2YWOon 5p44NvPHilgXODdhA3gaxByBYsXli+1idBCYU= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:in-reply-to:references:date :message-id:subject:to:cc:content-transfer-encoding; bh=bGI92TIlsm8iFR32Mf1bNNEGpxk7crL2I3F1X6Io1yY=; b=dbR1TzEQ0dTZKcQ4+4ii1ItrZxik+s6gQjO255DmeNwJ1tTKwvquDq8xExYX2LE18B 1KmsO3GWWV0tSau3XaZqZvJnCs2tvygJ3JXY2iMg1lPFI9fbZi56CXG+Iwd04NTke46s UW7We/pBMN02v/2EEPEm5NLKub976ZqCJsseUEXO8mPRAOjw42e3CpC5LcyIr4c4Wz12 NAZ/qK6uFBoZFbvPs2RXd2WhFvrRMzTNcg4zqYIDxTHFpqXLeArPOFjbRCAKg0JZuz7t q8ZrTs9sgj1JnxhakLR7RgUllg958Q3+pxdjr1i3aAuID9//Cq8dVszCWOtSV+6okDAm jTXw== X-Gm-Message-State: APjAAAU2jYzy0OAmwYbQKnSzrrA25Q8cbSP17+rG00ZKSfgcr+z2bkeS Gi2ps/RM41YHl/WQ3cv9zdQIQh+v71YmhkAensjVig== X-Google-Smtp-Source: APXvYqwylzxV6PgjKI+Ah5jfn+Z65hFEByJVy8Hbx584vWWb0cryfs8dMoQUIxgnAfZDudRKX/gnsRlTBTyx1JHmdSw= X-Received: by 2002:a2e:8e99:: with SMTP id z25mr7335575ljk.121.1566020104543; Fri, 16 Aug 2019 22:35:04 -0700 (PDT) Received: from unknown named unknown by gmailapi.google.com with HTTPREST; Fri, 16 Aug 2019 22:35:03 -0700 Mime-Version: 1.0 (1.0) From: Joe Abley In-Reply-To: References: <09178E42-08B2-4958-A1C8-AF507AEE8834@fugue.com> <0BDD4F7F-7301-476A-80DA-0CC84EE4557D@fugue.com> <2BE3565E-4D1D-4C3D-8E5E-9BBF0A6C76EC@fugue.com> <2D09D61DDFA73D4C884805CC7865E6114E279D3E@GAALPA1MSGUSRBF.ITServices.sbc.com> <50618337-3358-4F81-AEAF-F479330488A7@hopcount.ca> <4F898538-E82D-487C-88AF-0EB803690204@hopcount.ca> <3ACBFB29-45C2-41CB-9619-30C679ADB646@hopcount.ca> Date: Fri, 16 Aug 2019 22:35:03 -0700 Message-ID: To: Eric Rescorla Cc: "STARK, BARBARA H" , ADD Mailing list , Ted Lemon , Bret Jordan Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Archived-At: Subject: Re: [Add] When Two Worlds Collide X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 17 Aug 2019 05:35:09 -0000 > On Aug 16, 2019, at 20:33, Eric Rescorla wrote: > > I also do not understand your question. This is not about managed versus = unmanaged. I don't actually think I was asking a question, but I still feel like I'm missing something. So here we go. > Suppose that you have a policy that requires some level of HTTPS MITM. In= order to execute that policy, you need to modify user's computers (either = via a management interface or otherwise) or convince the user to modify the= ir computers. At that time, you can also disable DoH or convince users to d= isable DoH (assuming, as Stephen says, that DoH can be disabled). Ok. > Therefore, there should not be a need to MITM DoH traffic, because you ca= n just divert it to Do53. Well, this is where I think we differ in the way we are thinking about managed vs unmanaged. We're talking here about a one-time change to an unmanaged device. However, subsequent changes can be made and new applications can be installed by the user without the network administrator's supervision. Those could include removing whatever change made the device compliant, e.g. re-enabling DoH or installing a new application like a future Firefox that uses it by default. These changes don't necessarily need to be deliberate on the part of the end-user. So this one-time action by the user or the IT administrator doesn't seem, on its own, like a permanent application of policy to a single device. Even if an administrator trying to enforce local policy could have full knowledge of the range of configuration that might exist on an unfamiliar/unmanaged device with an array of applications at one point in time, I don't see how they could expect that state to be invariant on a device that somebody else manages. You are suggesting, I think, that a one time change to an otherwise unmanaged device is sufficient to bring an unmanaged device into line with an enterprise network policy that requires MITM of HTTPS traffic, including DoH. I don't see how that works. Right now it feels like MITM is the prudent choice for a network that has such a policy. If the answer to all of this is that allowing unmanaged devices to connect to a network that has such policy is not reasonable, then I think we should say so clearly. There are lots of such networks in the world. This not a corner case. Anyway, the point I was making originally was that people are doing this kind of MITM today, or at least it's possible for people to do this today, and hence the suggestion that blocking DoH is impossible seems false. Joe From nobody Fri Aug 16 22:50:47 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B036512016E for ; Fri, 16 Aug 2019 22:50:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xSflZyigq01K for ; Fri, 16 Aug 2019 22:50:42 -0700 (PDT) Received: from mail-io1-xd34.google.com (mail-io1-xd34.google.com [IPv6:2607:f8b0:4864:20::d34]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 342A112003E for ; Fri, 16 Aug 2019 22:50:42 -0700 (PDT) Received: by mail-io1-xd34.google.com with SMTP id j6so10536783ioa.5 for ; Fri, 16 Aug 2019 22:50:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=3B4fmmOCepY8sYcby9gwabZdCYWqi3ukBTJ5ZXCQ8I0=; b=lpNBaLHJIn4Qhv5W1vPIIewX7q5+cslyau/fxPdZ1A9f6uYwYxZLGB/jQ9QX7GZ62l PE57YvCCOtaQDj8C/WmGZ7Fm88IZBXJfuT9yqx58uvuX31rAI2fUp9TeRKSuxIw7UqCa Vjxe282NRMicG4WV1jji/azO2ZgW1KoKxgPTm9zf4HRjphr5cpalXfPDMC9/53R/ZCzP 9LRBn85BXBBzWliDspoE3ldsY0xoCdYpeyfcFTAoy0uBdqzw51LK7C+kV4wui5PIsh8q 2BFYHvTnDbPrtzwdbtWvOqjevZUcHF2GsBfdHM0tv3v/aLq2ibr2kjVdlffx4b43yyjo i4Kw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=3B4fmmOCepY8sYcby9gwabZdCYWqi3ukBTJ5ZXCQ8I0=; b=UMidBOadViDo8mKPFei+nYNVSE3oZgD9K7bXwcCWEqqJEN7ROsfNGEJhrvEGr+EruC g02rxfPUBJz1qVjwqIgw/5Z1sHldIz3OE/lLQz4IYq3AQQ2lLhAxOsy83drKDmopG5HB rBoGaS1FUe2as0B961Lc94mzEH2Nw/78rdnOQmsei8Lntwb5qHUFc24ld0UTjGFt+Fm0 Yeo6I5qRdo8+uiIuZ5Aoaoj9q1JksFFdyVHlMzYlz1j9sYOW6K7NymSn4BoYYRc0fOvV 7JEhlFVJWGFF4wD3irovLd8LKXrqqExBM3iWbD1RbV5Q06Jv2Iocm3BHKoRUsugxECRP yaQQ== X-Gm-Message-State: APjAAAXA8S/FTlLXyb+55ZVNcTI7TryfAAeIVLH7Uldv+nldMkSgQSeC FWW1XBmXv+rs6zi9bGE7hg7CAJHivTFWqFRi+AnN6koAAJPBXGpr X-Google-Smtp-Source: APXvYqwZsga2tYIXlOx/w6BVj5b0dxmoLoBb9AxA7AqP3/GjYagfludnTRs0ARvBddXVze1jRyjZ2wP16yTmRX4FzpU= X-Received: by 2002:a5d:9583:: with SMTP id a3mr14642615ioo.54.1566021041262; Fri, 16 Aug 2019 22:50:41 -0700 (PDT) MIME-Version: 1.0 References: <09178E42-08B2-4958-A1C8-AF507AEE8834@fugue.com> <0BDD4F7F-7301-476A-80DA-0CC84EE4557D@fugue.com> <6698db4f-89ff-e5be-09a5-eb544f76ebc9@nostrum.com> In-Reply-To: From: Rob Sayre Date: Fri, 16 Aug 2019 22:50:30 -0700 Message-ID: To: Melinda Shore Cc: ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000e01345059049af70" Archived-At: Subject: Re: [Add] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 17 Aug 2019 05:50:45 -0000 --000000000000e01345059049af70 Content-Type: text/plain; charset="UTF-8" On Fri, Aug 16, 2019 at 7:08 PM Melinda Shore wrote: > I'm in the process of catching up on the discussion and am > fairly dismayed by the tone. If their arguments aren't > very good, refute them. Comments like this don't move the > technical discussion at all. > If you give things a close read, I think you'll see various anti-encryption arguments come up over and over. They are obviously non-technical, and talk about things like "policy", "regulation", "parental control", "operational concerns", etc. Even though these arguments are non-technical, I think you will find all of them thoroughly debunked on this list. There are better ways than DNS to accomplish all of them. > The primary thing I'm looking for as I'm sifting through the > discussion is to try to identify useful work that's within > the IETF's purview > While I don't want to stop anyone from writing software, I don't think there is any useful work for the IETF to do at this time. I also think some parties have overestimated their negotiation position. It's always possible to deploy something, and document it later (as in RFC 6108). thanks, Rob --000000000000e01345059049af70 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Fri, Aug 16, 2019 at 7:08 PM Melinda S= hore <melinda.shore@nomo= untain.net> wrote:
I'm in the process of catching up on the discussion and am
fairly dismayed by the tone.=C2=A0 If their arguments aren't
very good, refute them.=C2=A0 Comments like this don't move the
technical discussion at all.

If you giv= e things a close read, I think you'll see various anti-encryption argum= ents come up over and over. They are obviously non-technical, and talk abou= t things like "policy", "regulation", "parental co= ntrol", "operational concerns", etc. Even though these argum= ents are non-technical, I think you will find all of them thoroughly debunk= ed on this list. There are better ways than DNS to accomplish all of them.<= /div>
=C2=A0
The primary thing I'm looking for as I'm sifting through the
discussion is to try to identify useful work that's within
the IETF's purview

While I don'= t want to stop anyone from writing software, I don't think there is any= useful work for the IETF to do at this time.

I al= so think some parties have overestimated their negotiation position. It'= ;s always possible to deploy something, and document it later (as in RFC 61= 08).

thanks,
Rob
=C2=A0
<= /div>
--000000000000e01345059049af70-- From nobody Fri Aug 16 23:05:19 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 033AC1201B7 for ; Fri, 16 Aug 2019 23:05:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cWugn1ZIx9Q0 for ; Fri, 16 Aug 2019 23:05:16 -0700 (PDT) Received: from smtp.guxx.net (smtp.guxx.net [IPv6:2a01:4f8:a0:322c::25:42]) by ietfa.amsl.com (Postfix) with ESMTP id CF0A0120025 for ; Fri, 16 Aug 2019 23:05:15 -0700 (PDT) Received: by nyx.guxx.net (Postfix, from userid 107) id 244015F42D43; Sat, 17 Aug 2019 08:05:14 +0200 (CEST) Received: from [192.168.2.190] (p54B8ABDF.dip0.t-ipconnect.de [84.184.171.223]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by nyx.guxx.net (Postfix) with ESMTPSA id 364AF5F40949; Sat, 17 Aug 2019 08:05:12 +0200 (CEST) From: "Ralf Weber" To: "Ben Schwartz" Cc: "ADD Mailing list" , "Dave Lawrence" , "Rob Sayre" Date: Sat, 17 Aug 2019 08:05:11 +0200 X-Mailer: MailMate (1.12.5r5635) Message-ID: <4D2E6E02-F0A9-47EC-9D65-08583E4912C2@fl1ger.de> In-Reply-To: References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <8e00891f-2aa2-ee11-559a-b5a8967b22d9@nostrum.com> <2C23D415-84F9-4B6C-B67B-0CC3EB600520@gmail.com> <23893.59415.370880.54691@gro.dd.org> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 17 Aug 2019 06:05:18 -0000 Moin! On 17 Aug 2019, at 0:16, Ben Schwartz wrote: > I don't view DoH and DNSSEC as being substantially in competition. To > the > contrary, I think that ADD with DoH greatly improves the likelihood of > end-to-end DNSSEC being widely deployed. Agreed. It could also be a DoT server. As others said DNSSEC and DoH/DoT are complementary and should be used both in a modern name resolution setup. > The main barriers I'm aware of to > stub DNSSEC deployment (broken middleboxes, broken recursives, > split-DNS > name squatting, restrictive query APIs with opaque error reporting, > ancient > system stub implementations, reflection attacks, truncation retry > delays, > ....) are all potentially solved when the application is speaking > directly > to a known, modern DoH server. Absolutely, some of this is of course something the DoH/DoT server still will have to cope with. The question is which DoH server. I’d rather see the current DNS server upgraded to DoH or DoT and not switch to another server just for the sake of doing DoH. > In an ADD world, I'm much more optimistic about DNSSEC. (Especially > if we > can get more deployment support for RFC 7901.) I admire your optimism. We do unfortunately have the example one of the first application using DoH not doing DNSSEC. So long -Ralf From nobody Fri Aug 16 23:32:55 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 377831200C1 for ; Fri, 16 Aug 2019 23:32:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FROM_EXCESS_BASE64=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=frobbit.se Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id b8BPqvtKcFJi for ; Fri, 16 Aug 2019 23:32:52 -0700 (PDT) Received: from mail.frobbit.se (mail.frobbit.se [85.30.129.176]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D8830120025 for ; Fri, 16 Aug 2019 23:32:51 -0700 (PDT) Received: from [192.165.72.241] (unknown [IPv6:2a02:80:3ffc:0:28c4:dd8a:3909:e0bc]) by mail.frobbit.se (Postfix) with ESMTPSA id 99A2F2300D; Sat, 17 Aug 2019 08:32:48 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=frobbit.se; s=mail; t=1566023568; bh=f7NGLTzRaEWyk4o5cyQdFGAvfxOkrGDnsUt+E00AC2E=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=OZZbPwZkLr4hyj4LOVd0H8CGm2gbCwRPQOK4QheuYmfSAU32CCQhDdfkmW6Z6cVC2 XWo5lRi8FrLM7B1IsOeoPPZKBfgy9G4FzWoJG3p9P68EgPFHFxv3u35I4KzSjwDGkW iaP2v1vsV/5JgOJLf9zQAfg1gmSrLU4AN4bUKSMo= From: "Patrik =?utf-8?b?RsOkbHRzdHLDtm0=?=" To: "Joe Abley" Cc: "Eric Rescorla" , "ADD Mailing list" , "Ted Lemon" , "STARK, BARBARA H" , "Bret Jordan" Date: Sat, 17 Aug 2019 08:32:47 +0200 X-Mailer: MailMate (1.12.5r5635) Message-ID: <21FBAE18-EB64-4B64-99A1-19B734C62366@frobbit.se> In-Reply-To: <3ACBFB29-45C2-41CB-9619-30C679ADB646@hopcount.ca> References: <09178E42-08B2-4958-A1C8-AF507AEE8834@fugue.com> <0BDD4F7F-7301-476A-80DA-0CC84EE4557D@fugue.com> <2BE3565E-4D1D-4C3D-8E5E-9BBF0A6C76EC@fugue.com> <2D09D61DDFA73D4C884805CC7865E6114E279D3E@GAALPA1MSGUSRBF.ITServices.sbc.com> <50618337-3358-4F81-AEAF-F479330488A7@hopcount.ca> <4F898538-E82D-487C-88AF-0EB803690204@hopcount.ca> <3ACBFB29-45C2-41CB-9619-30C679ADB646@hopcount.ca> MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=_MailMate_C1788E90-40F2-4A0A-ACFB-8AE006E8E722_="; micalg=pgp-sha1; protocol="application/pgp-signature" Archived-At: Subject: Re: [Add] When Two Worlds Collide X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 17 Aug 2019 06:32:54 -0000 This is an OpenPGP/MIME signed message (RFC 3156 and 4880). --=_MailMate_C1788E90-40F2-4A0A-ACFB-8AE006E8E722_= Content-Type: text/plain Content-Transfer-Encoding: quoted-printable On 17 Aug 2019, at 0:08, Joe Abley wrote: > The certificate that the user's device retrieved was served from an int= ernal server and is installed on the unmanaged device as a trust anchor. = Maybe the certificate that is installed through this process is insuffici= ent for some applications, but most of them now seem to work just fine. T= he certificate presented by the MITMming corporate firewall is now accept= ed by the user's applications, and the firewall ALGs them all through to = their external destinations with whatever meddling it feels like doing to= the plain text as data is shuffled back and forth. > > User now happy. > > I should hasten to add that I haven't tried this myself, I've just list= ened to people who do. Is there some nuance here that I am missing? s/Corporate/Access Provider/ Patrik --=_MailMate_C1788E90-40F2-4A0A-ACFB-8AE006E8E722_= Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iG0EARECAC0WIQRUH/cJI8i4DDUU3qWsxpsaC4jXzQUCXVefjw8ccGFmQGZyb2Ji aXQuc2UACgkQrMabGguI1820PACcCR9QHXQ+0J8qNWz/c8cz5aVGfr0Anj5yC2xU 8uYnquxw1dm3s3z1aEaz =vmuU -----END PGP SIGNATURE----- --=_MailMate_C1788E90-40F2-4A0A-ACFB-8AE006E8E722_=-- From nobody Sat Aug 17 01:28:00 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0E405120108 for ; Sat, 17 Aug 2019 01:27:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.299 X-Spam-Level: X-Spam-Status: No, score=-4.299 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=open-xchange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uCsVRtwkk4jx for ; Sat, 17 Aug 2019 01:27:56 -0700 (PDT) Received: from mx4.open-xchange.com (alcatraz.open-xchange.com [87.191.39.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9753E120105 for ; Sat, 17 Aug 2019 01:27:56 -0700 (PDT) Received: from open-xchange.com (imap.open-xchange.com [10.20.30.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx4.open-xchange.com (Postfix) with ESMTPS id 183D76A30B; Sat, 17 Aug 2019 10:27:54 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=open-xchange.com; s=201705; t=1566030474; bh=bnLgNMHPSljUR/gdyOtqT+ZVpdePHoyyLYLqZfygK4o=; h=From:Subject:Date:In-Reply-To:Cc:To:References:From; b=f11ha4nlWrCkH05YEb11QdOTz17wnV3c12DsOxduUZSyqFHOkIxnYUC9ZJ31qUxnY cYTA/rv9fCDK2W4zQf1NSx9oi+aCbtzOpjOaVULBCxqu5J8ffXJ+gltdfy6yAn9AZb IhiJrnwdU4aWRBCMJyWgc7LYrM9W/P85VJiWj5i3fgyOiTGLUAu9jyCM4KVkHjmOg8 VccTnKDoIN1II0ODVdVI0vG6yntb8Jag4TZv9shQaHst7bp3HMCl6ikh9oR/562t40 xzI1lN7Ep68+WOnPgkIKoFQqxEfk8F3l+moJBt1qBNYgCUswIbrXZw7YJatrif1MBR ulx5NMlldNOMg== Received: from [192.168.1.128] (host31-53-106-255.range31-53.btcentralplus.com [31.53.106.255]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by open-xchange.com (Postfix) with ESMTPSA id C5E813C036E; Sat, 17 Aug 2019 10:27:53 +0200 (CEST) From: Neil Cook Message-Id: <7F6E2B9A-7151-49FE-9C4A-7FE86F4E9066@open-xchange.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_9864E434-9B57-4696-92E9-560748EBBC9D" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Sat, 17 Aug 2019 09:27:52 +0100 In-Reply-To: Cc: Bret Jordan , ADD Mailing list To: Frode Kileng References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <8e00891f-2aa2-ee11-559a-b5a8967b22d9@nostrum.com> <2C23D415-84F9-4B6C-B67B-0CC3EB600520@gmail.com> <2704899B-E43D-4978-A3C9-30E9E7CEBEBD@fugue.com> <4CC4C262-BEF4-4B39-ACB1-A595AB66D6CD@gmail.com> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 17 Aug 2019 08:27:59 -0000 --Apple-Mail=_9864E434-9B57-4696-92E9-560748EBBC9D Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 >=20 > Wanting to add competitive advantages compared to other ISPs by = offering a DNS-based filtering solution is a perfectly good business = argument but I cannot understand the argument that this is the only or = best solution for this specific use-case. >=20 I=E2=80=99ve not seen anyone arguing that. The fact is that they exist = and in widespread use. That is all that is relevant for this list. Neil >>=20 >> Thanks, >> Bret >> PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 >> "Without cryptography vihv vivc ce xhrnrw, however, the only thing = that can not be unscrambled is an egg." >>=20 >>> On Aug 16, 2019, at 12:56 AM, Frode Kileng > wrote: >>>=20 >>> On 15/08/2019 23:58, Bret Jordan wrote: >>> >>>> If you say that the parental controls you have signed up for and = paid money for are no longer going to work, you might get a different = answer. >>>=20 >>> There are numerous other client-side child-safe products in the = markets that will continue to work perfectly well. Please please stop = using this "save the children" argument that has been fronted by the = "anti-encryption camp" for the last 5 years. >>>=20 >>> frodek >>>=20 >>>=20 >>>=20 >>>=20 >>> --=20 >>> Add mailing list >>> Add@ietf.org >>> https://www.ietf.org/mailman/listinfo/add >>=20 >=20 > --=20 > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add Neil Cook neil.cook@open-xchange.com = --------------------------------------------------------------------------= ----------- Open-Xchange AG, Rollnerstr. 14, 90408 Nuremberg, District Court = Nuremberg HRB 24738 Managing Board: Rafael Laguna de la Vera, Carsten Dirks, Michael = Knapstein, Stephan Martin=20 Chairman of the Board: Richard Seibt European Office:=20 Open-Xchange GmbH, Olper Huette 5f, D-57462 Olpe, Germany, District = Court Siegen, HRB 8718=20 Managing Director: Frank Hoberg US Office:=20 Open-Xchange. Inc., 530 Lytton Avenue, Palo Alto, CA 94301, USA=20 = --------------------------------------------------------------------------= ----------- --Apple-Mail=_9864E434-9B57-4696-92E9-560748EBBC9D Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8

Wanting to add competitive advantages compared = to other ISPs by offering a DNS-based filtering solution is a perfectly = good business argument but I cannot understand the argument that this is = the only or best solution for this specific use-case.


I=E2=80= =99ve not seen anyone arguing that. The fact is that they exist and in = widespread use. That is all that is relevant for this = list.

Neil


Thanks,
Bret
PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 =  F2C0 74F8 ACAE 7415 0050
"Without cryptography vihv = vivc ce xhrnrw, however, the only thing that can not be unscrambled is = an egg."

On Aug 16, 2019, at 12:56 AM, Frode Kileng <frodek@tele.no <mailto:frodek@tele.no>> wrote:

On 15/08/2019 23:58, Bret Jordan wrote:
<snip>
If you say that the parental controls you have signed up for = and paid money for are no longer going to work, you might get a = different answer.

There are = numerous other client-side child-safe products in the markets that will = continue to work perfectly well. Please please stop using this "save the = children" argument that has been fronted by the "anti-encryption camp" = for the last 5 years.

frodek




-- =
Add mailing list
Add@ietf.org <mailto:Add@ietf.org>
https://www.ietf.org/mailman/listinfo/add


-- =
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add


Neil Cook
neil.cook@open-xchange.com

---------------------------------------------------------------= ----------------------
Open-Xchange AG, Rollnerstr. 14, = 90408 Nuremberg, District Court Nuremberg HRB 24738
Managing Board: Rafael Laguna de la Vera, Carsten Dirks, = Michael Knapstein, Stephan Martin 
Chairman of = the Board: Richard Seibt

European = Office: 
Open-Xchange GmbH, Olper Huette = 5f, D-57462 Olpe, Germany, District Court Siegen, HRB = 8718 
Managing Director: Frank Hoberg
US Office: 
Open-Xchange. Inc., 530 = Lytton Avenue, Palo Alto, CA 94301, USA 
---------------------------------------------------------------= ----------------------

= --Apple-Mail=_9864E434-9B57-4696-92E9-560748EBBC9D-- From nobody Sat Aug 17 08:23:06 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B5AFB1200A4 for ; Sat, 17 Aug 2019 08:23:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Mw3SgzODjOY4 for ; Sat, 17 Aug 2019 08:23:03 -0700 (PDT) Received: from mail-qt1-x843.google.com (mail-qt1-x843.google.com [IPv6:2607:f8b0:4864:20::843]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C22D8120121 for ; Sat, 17 Aug 2019 08:23:03 -0700 (PDT) Received: by mail-qt1-x843.google.com with SMTP id z4so9433260qtc.3 for ; Sat, 17 Aug 2019 08:23:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=MB2I4iL3VUxWeEr60aIHnE1bCY1O0dE1Ua5z0vVM/gQ=; b=CRIVDf1lIfTo2gkgvqaTgKSBMb4c56Tux97ogmxuYRKTPfJmvdIS9wC/vSGprzCq71 LZqv7uwLjYGrwrhhWUy4TNwcz4Vb6CQK/OxCL7eOu8RkZxh35LBUi96X2XgsGJ8VO279 sqjO5gOeVSM0Zs9pSHEEStBnnx4/7xt+Xicujbjnu3m7ZUStB5jmQn5s1NebNjwLH/Cz P9nNWf0hbyrfSiMhn2098wmKbdYAsY3/eP87QlcnbL+PJ/AngXtImHc3booTZ4/RX2Xs M8X7Gn7b1KjkWFiQgwqEVNKBPo5j1RuK+jD1huR+YFU7rGl5fjb+Qa4UQL8hj2GpiBV3 LR2A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=MB2I4iL3VUxWeEr60aIHnE1bCY1O0dE1Ua5z0vVM/gQ=; b=csY7t8X2/z/JsO83HPYjiFCNF12h5Y/XtX83Lb47LMMg/yuByZu8ia3t3N5N0SSsFt pOM8a5Bb2Ilsdw5LWPxp5ij2RHIKFSGDZDEXKpk9Anopzaqb33u2I5ZtOXPw6aU0OGn4 55scnsUoCmGTtnxqRHQMncwJaQ7CINRkqYJQ81NL5vmirlwTcdcjph1SB7x8jb/kWCXw Qa1nM+2HmZ5kiXRUaiDA85JpHNxq+oAuRKlUfRoFA6aESwFffHo21WPkhZXB2PiZM5/x j3K5cc+7gGDnfesXNjSrDuIjtve3W0zSUtlK7arAi3tpMf2ZyWtdh/Vv7vBbAov8vtti q2ww== X-Gm-Message-State: APjAAAUV5ystYy+2JM8Kd/F9M6nDnluE0LIDRQmEQ2mrGGBE/ERFp0hL WwImq3Nb10JMzXJ1oaGsLZGvrP21 X-Google-Smtp-Source: APXvYqyX9yM2oM/n76Lf5mwPQhM1DZvLgAZyHaj2zmq+ggKN6Y5kRtLkPUMWrOMsu5pDmILMgAfTIw== X-Received: by 2002:ac8:4a12:: with SMTP id x18mr13163647qtq.218.1566055382695; Sat, 17 Aug 2019 08:23:02 -0700 (PDT) Received: from ?IPv6:2607:fb90:6088:f3ef:87b:8640:ef58:a5bb? ([2607:fb90:6088:f3ef:87b:8640:ef58:a5bb]) by smtp.gmail.com with ESMTPSA id o18sm4835215qtb.53.2019.08.17.08.23.01 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Sat, 17 Aug 2019 08:23:02 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (1.0) From: Brian Dickson X-Mailer: iPhone Mail (16G77) In-Reply-To: Date: Sat, 17 Aug 2019 11:23:00 -0400 Cc: add@ietf.org Content-Transfer-Encoding: quoted-printable Message-Id: References: <09178E42-08B2-4958-A1C8-AF507AEE8834@fugue.com> <0BDD4F7F-7301-476A-80DA-0CC84EE4557D@fugue.com> <6698db4f-89ff-e5be-09a5-eb544f76ebc9@nostrum.com> To: Melinda Shore Archived-At: Subject: Re: [Add] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 17 Aug 2019 15:23:06 -0000 Sent from my iPhone > On Aug 16, 2019, at 10:07 PM, Melinda Shore = wrote: >=20 >> On 8/16/19 5:15 PM, Rob Sayre wrote: >> Well, I guess the salient question is "so what?". It seems weird to view >> giant telecom companies as oppressed participants. >=20 >> Maybe their arguments just aren't very good. >=20 > obNoHats: >=20 > I'm in the process of catching up on the discussion and am > fairly dismayed by the tone. If their arguments aren't > very good, refute them. Comments like this don't move the > technical discussion at all. >=20 > The primary thing I'm looking for as I'm sifting through the > discussion is to try to identify useful work that's within > the IETF's purview, and to understand the assumptions that > various parties are bringing to the table. IMHO it isn=E2=80=99t enough to limit this to assumptions. It needs to inclu= de requirements, at least where those are reasonable, common, and well docum= ented and well understood. The IETF may not primarily be a policy organization, but failing to accommod= ate policy requirements would be unhelpful, IMHO. Providing guidance on standardization for implementers of applications doing= DNS could better accommodate interoperability between network operators and= those applications. One relatively simple example might be: check for a DNS server accepting con= nections on localhost (::1 or 127.0.0.1). If present, use it. That would provide a standard place for a managed host to install its own se= rvice to implement whatever policies it desires, without requiring MitM. Brian > I think that > policy impacts are inevitable but we are not primarily a policy > organization and tend to be more successful when we focus on > technical discussion. From nobody Sat Aug 17 10:00:36 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5BE5E120170 for ; Sat, 17 Aug 2019 10:00:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wtXIlOZkizXn for ; Sat, 17 Aug 2019 10:00:32 -0700 (PDT) Received: from mail.dragon.net (mail.dragon.net [IPv6:2001:4f8:3:36::235]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6CAFD120154 for ; Sat, 17 Aug 2019 10:00:32 -0700 (PDT) Received: from fafnir.remote.dragon.net (localhost [IPv6:::1]) by mail.dragon.net (Postfix) with ESMTP id C48D2374029C; Sat, 17 Aug 2019 10:00:31 -0700 (PDT) Received: by fafnir.remote.dragon.net (Postfix, from userid 501) id 6F71C1691138; Sat, 17 Aug 2019 11:00:31 -0600 (MDT) Received: from fafnir.local (localhost [127.0.0.1]) by fafnir.remote.dragon.net (Postfix) with ESMTP id 6A3A21691137; Sat, 17 Aug 2019 11:00:31 -0600 (MDT) From: Paul Ebersman To: Rob Sayre cc: ADD Mailing list , Melinda Shore In-reply-to: References: <09178E42-08B2-4958-A1C8-AF507AEE8834@fugue.com> <0BDD4F7F-7301-476A-80DA-0CC84EE4557D@fugue.com> <6698db4f-89ff-e5be-09a5-eb544f76ebc9@nostrum.com> Comments: In-reply-to Rob Sayre message dated "Fri, 16 Aug 2019 22:50:30 -0700." X-Mailer: MH-E 7.4.2; nmh 1.7.1; XEmacs 21.4 (patch 22) MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-ID: <58768.1566061231.1@fafnir.local> Date: Sat, 17 Aug 2019 11:00:31 -0600 Message-Id: <20190817170031.6F71C1691138@fafnir.remote.dragon.net> Archived-At: Subject: Re: [Add] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 17 Aug 2019 17:00:34 -0000 sayrer> If you give things a close read, I think you'll see various sayrer> anti-encryption arguments come up over and over. They are sayrer> obviously non-technical, and talk about things like "policy", sayrer> "regulation", "parental control", "operational concerns", sayrer> etc. Even though these arguments are non-technical, I think you sayrer> will find all of them thoroughly debunked on this list. There sayrer> are better ways than DNS to accomplish all of them. Really? Thoroughly debunked? By one slide deck you agree with versus multiple folks with relevant market and industry experience saying the contrary and multiple examples of this in use? How do you feel about climate change? Your own personal experiences are not proof. And yes, DNS filtering is not 100%. But it is sufficiently useful and deployable widely. What alternatives are as available, as deployable and more effective? From nobody Sat Aug 17 10:24:24 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2F2951200D7 for ; Sat, 17 Aug 2019 10:24:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TKPmTIuejuj7 for ; Sat, 17 Aug 2019 10:24:19 -0700 (PDT) Received: from mail-qt1-x82f.google.com (mail-qt1-x82f.google.com [IPv6:2607:f8b0:4864:20::82f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9AA91120145 for ; Sat, 17 Aug 2019 10:24:19 -0700 (PDT) Received: by mail-qt1-x82f.google.com with SMTP id u34so9679619qte.2 for ; Sat, 17 Aug 2019 10:24:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=content-transfer-encoding:from:mime-version:subject:date:message-id :references:cc:in-reply-to:to; bh=s9djwU8WEWA5qKyuapVo7HS2OQqAR8OCJlS9C6wAym8=; b=UBS8JRmyrm70/SoXRwGEe8i+BRlbWaU/tIVgaqNxJRwQuRcaCDunZv6U6I+3czP51n AV/tjFYHdfJScGY7FI6YQfNK0kYIKYRpf6W5xpCqkiVz0J0SIgd5k6eROLr5keLL+Qu3 JUmGX3TL84+wpM05hluBM/RREgpU9eJKf2fKmAawG8tfKt3/1WxSLfDb7rKAHzw1bv2j DjhmIbD8la52RluRuMlOGfmWlzGK5SpMP4fe8TTkObMYb7hdh8Dvf1k5zUcC9gBw3kV9 54C71Jw0Azet4xuzl1XLRD9SqPgxn7/94vDiOP1QREjWD18YlSQPZc/5S6kXkD4ExyOs X/NQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:content-transfer-encoding:from:mime-version :subject:date:message-id:references:cc:in-reply-to:to; bh=s9djwU8WEWA5qKyuapVo7HS2OQqAR8OCJlS9C6wAym8=; b=DAOx1I+MZvbOPS0RdTXZPKiB9KHZUa0GvbRbCuBhIHFAhzt7H2a6YbdDCDaEuEVWM5 4KLih8OeDpxLNAQrUyDh/vcvM0qNEnMMGGOABXdZ0Cs7p9uny5VTBBF65VSlkQ312G2b s/B+Lr3128xtaCIq4TYlK7uv3jraqMp4Oh6wWOEvSz9+3xG5bhvhk3KVG9ALPNydoBBn 3Ct8IAA+t+z53tdWsqq+eIOviXrL3uihk4ywrJOT6/pwiX7k16fWNduvAp9T+GM6pOsH zuJB2/YtgU0nP419q5N/73nJWM4ae3M4kdDnpY+tEUoUpue01jdMG7r0NAgqAgx4VkjF qqYQ== X-Gm-Message-State: APjAAAXUqDmnGlN74MsX2jv6M65ZWvS8cVaVT3QoTksq6SKo68HU8cep ay9HM7BtEkyy0VBXYRc3b0DStA== X-Google-Smtp-Source: APXvYqxNw/ClMDX2VLYq6k3YUEOIiQ3GdquHqCXSeq8UiLXaqsUayxc7f+jpUBgsQEZCyvxc/sdIBA== X-Received: by 2002:a0c:e145:: with SMTP id c5mr5622906qvl.180.1566062658573; Sat, 17 Aug 2019 10:24:18 -0700 (PDT) Received: from [10.0.100.56] (c-73-186-137-119.hsd1.ma.comcast.net. [73.186.137.119]) by smtp.gmail.com with ESMTPSA id i5sm5266616qti.0.2019.08.17.10.24.18 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Sat, 17 Aug 2019 10:24:18 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable From: Ted Lemon Mime-Version: 1.0 (1.0) Date: Sat, 17 Aug 2019 13:24:17 -0400 Message-Id: <5ED23002-7608-4A76-8181-E344E3FC6469@fugue.com> References: <20190817170031.6F71C1691138@fafnir.remote.dragon.net> Cc: Rob Sayre , Melinda Shore , ADD Mailing list In-Reply-To: <20190817170031.6F71C1691138@fafnir.remote.dragon.net> To: Paul Ebersman X-Mailer: iPhone Mail (17A568) Archived-At: Subject: Re: [Add] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 17 Aug 2019 17:24:22 -0000 Just a reminder: DoH resolvers can (and do) do DNS filtering.=20 Sent from my iPhone > On Aug 17, 2019, at 13:00, Paul Ebersman wrote: >=20 > =EF=BB=BFsayrer> If you give things a close read, I think you'll see vario= us > sayrer> anti-encryption arguments come up over and over. They are > sayrer> obviously non-technical, and talk about things like "policy", > sayrer> "regulation", "parental control", "operational concerns", > sayrer> etc. Even though these arguments are non-technical, I think you > sayrer> will find all of them thoroughly debunked on this list. There > sayrer> are better ways than DNS to accomplish all of them. >=20 > Really? Thoroughly debunked? By one slide deck you agree with versus > multiple folks with relevant market and industry experience saying the > contrary and multiple examples of this in use? How do you feel about > climate change? >=20 > Your own personal experiences are not proof. >=20 > And yes, DNS filtering is not 100%. But it is sufficiently useful and > deployable widely. What alternatives are as available, as deployable and > more effective? >=20 > --=20 > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add From nobody Sat Aug 17 12:10:47 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0AEF11200D8 for ; Sat, 17 Aug 2019 12:10:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5OMfA0VtJvoj for ; Sat, 17 Aug 2019 12:10:44 -0700 (PDT) Received: from mail-io1-xd33.google.com (mail-io1-xd33.google.com [IPv6:2607:f8b0:4864:20::d33]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2F4BB1200CD for ; Sat, 17 Aug 2019 12:10:44 -0700 (PDT) Received: by mail-io1-xd33.google.com with SMTP id o9so12921352iom.3 for ; Sat, 17 Aug 2019 12:10:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=1eMh13fb2ii1Kl5+GHSL0uAxApodWOUiptA2hJ12oZs=; b=fbdVnddI3R+HPOmQJN2HlsqJ9Gm/7pA5uBUw1nz4/rcYLK3tABhK6nK90o4itKHZMr cuT7P7SPoe50k1qhK9fli4pZyFngrid7y0yAFA5eVjzrviW/ee0esEdD5v2orUi3D1dx x8lNSr03rTDzYMje5OjgusbVQIKaJzzwY169rXXPczm7/NoNJQW3X1UNaM2byM9vi/CT nknWAUjG3+C40+/XqApZw28CCCc+Ggo/gpnl+dX4InM4SfzoPcsa5kY7RJMOCBhIt9Ti UMSlYvpZ2VqxHJ+B8wGNjKeOItyxM2K7huqjJ5GDddl9B7TtQQnV3HlbSJEo29lhmBqs XAXQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=1eMh13fb2ii1Kl5+GHSL0uAxApodWOUiptA2hJ12oZs=; b=XN8WFJMq5NX5+tbcVe5IUeDvLng7SOxXc/F8NXxhgr99IhtRrqiHYYIb7CVOIHGdkI FiwTzRypHHV0iEf+Eygu/392gqfeDzDoWVlKXox2PcCkN2hkoQbOgo974dOnLuSpy5PO Lmvf037VvPXElpBKpMQHFtsuvZiN6dEBQ2kpie90QOZZb4vPi/IdHI7KhsrsC8UW8Krq rFvW9jFV5SxrQf4tmuCJvhvQh7eeM0MFamG6sknfjoMqGfCgCRwNgYAS+UuLe7AWhEZP I7hj1OqgHMFVjy0ECtO8Rg55WBQuTiVeQikKF5II2p2Xwapl0BEih3PJ/Nx6+QQrQ3L9 LzpQ== X-Gm-Message-State: APjAAAXAX6BquxBfocvlyvLSeN3BtZ+LraLXgTnsiMwuIh1BFPhgkPvX CXXP3uavW0dy4vicUpALAn1KVdLhETXhfY1JEEhxMwPOrimKOw== X-Google-Smtp-Source: APXvYqy9kS/Ilt7AoLnvNahsBVGQH6PUdh1vrbhyvpc6VohjmSwdrY8uIKzvQdRJ5LvbnibCFUWQwFV8bhppl/bSbY0= X-Received: by 2002:a5d:8457:: with SMTP id w23mr6000311ior.189.1566069043268; Sat, 17 Aug 2019 12:10:43 -0700 (PDT) MIME-Version: 1.0 References: <09178E42-08B2-4958-A1C8-AF507AEE8834@fugue.com> <0BDD4F7F-7301-476A-80DA-0CC84EE4557D@fugue.com> <6698db4f-89ff-e5be-09a5-eb544f76ebc9@nostrum.com> <20190817170031.6F71C1691138@fafnir.remote.dragon.net> In-Reply-To: <20190817170031.6F71C1691138@fafnir.remote.dragon.net> From: Rob Sayre Date: Sat, 17 Aug 2019 12:10:31 -0700 Message-ID: To: Paul Ebersman Cc: ADD Mailing list , Melinda Shore Content-Type: multipart/alternative; boundary="000000000000049171059054ddc6" Archived-At: Subject: Re: [Add] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 17 Aug 2019 19:10:46 -0000 --000000000000049171059054ddc6 Content-Type: text/plain; charset="UTF-8" On Sat, Aug 17, 2019 at 10:00 AM Paul Ebersman wrote: > sayrer> If you give things a close read, I think you'll see various > sayrer> anti-encryption arguments come up over and over. They are > sayrer> obviously non-technical, and talk about things like "policy", > sayrer> "regulation", "parental control", "operational concerns", > sayrer> etc. Even though these arguments are non-technical, I think you > sayrer> will find all of them thoroughly debunked on this list. There > sayrer> are better ways than DNS to accomplish all of them. > > Really? Thoroughly debunked? By one slide deck you agree with versus > multiple folks with relevant market and industry experience saying the > contrary and multiple examples of this in use? I don't mean to imply there is consensus. In fact, I think there is none, and no work should happen. That said, an IETF DNS working group is the last place on earth I would expect good security standards to come from. It's been at least 20 years since the security problems with Classic DNS became apparent. > How do you feel about > climate change? > ?? > Your own personal experiences are not proof. > They actually are, in the same way that people talk about their "home networks" on this list. > > And yes, DNS filtering is not 100%. But it is sufficiently useful and > deployable widely. What alternatives are as available, as deployable and > more effective? > Well, the problem is that it's hard to tell who's doing the filtering. For example, see this attack: Sending encrypted DNS directly to 8.8.8.8 or equivalent mitigates this attack. One thing I want to note is that the advantage of encrypted DNS here has nothing to do with privacy, it's the message integrity encryption brings that mitigates this attack. This seems like a pretty standard encryption trade-off, and the IETF has been pretty clear about its approach to those: encrypt. DNS isn't special. thanks, Rob --000000000000049171059054ddc6 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Sat, Aug 17, 2019 at 10:00 AM Paul= Ebersman <list-add@dragon.net> wrote:
say= rer> If you give things a close read, I think you'll see various
sayrer> anti-encryption arguments come up over and over. They are
sayrer> obviously non-technical, and talk about things like "policy= ",
sayrer> "regulation", "parental control", "oper= ational concerns",
sayrer> etc. Even though these arguments are non-technical, I think you<= br> sayrer> will find all of them thoroughly debunked on this list. There sayrer> are better ways than DNS to accomplish all of them.

Really? Thoroughly debunked? By one slide deck you agree with versus
multiple folks with relevant market and industry experience saying the
contrary and multiple examples of this in use?

=
I don't mean to imply there is consensus. In fact, I think there i= s none, and no work should happen.

That said, an I= ETF DNS working group is the last place on earth I would expect good securi= ty standards to come from. It's been at least 20 years since the securi= ty problems with Classic DNS became apparent.
=C2=A0
How do you feel about
climate change?

??
=C2=A0
Your own personal experiences are not proof.

This see= ms like a pretty standard encryption trade-off, and the IETF has been prett= y clear about its approach to those: encrypt. DNS isn't special.
<= div>
thanks,
Rob

=C2=A0
--000000000000049171059054ddc6-- From nobody Sat Aug 17 12:32:57 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C3D89120100 for ; Sat, 17 Aug 2019 12:32:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, UNPARSEABLE_RELAY=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=hopcount.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Bg6d15-zHiT5 for ; Sat, 17 Aug 2019 12:32:55 -0700 (PDT) Received: from mail-lf1-x134.google.com (mail-lf1-x134.google.com [IPv6:2a00:1450:4864:20::134]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 218BE12009C for ; Sat, 17 Aug 2019 12:32:55 -0700 (PDT) Received: by mail-lf1-x134.google.com with SMTP id v16so3224478lfg.11 for ; Sat, 17 Aug 2019 12:32:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hopcount.ca; s=google; h=from:mime-version:references:in-reply-to:date:message-id:subject:to :cc; bh=+H0lq2DgEn9BlvNbT+hg11us4kwpr19vmhg9cybmMzk=; b=VC8/8Ec1pyfXPqmMFgW1+/xhjDQDb9B+sTssuAP7pEjuTxO1ExxpR6MB3ivT7P1klM jGVMagH0f4UjAQ6ggnCqFjMgEjyyb+W0wr5Ds7CkE2mQWhgC5W4eOES+r75ySS1hp0Wa GRkFCHS2y155QlXturIXp6Pe5jge64t8HS2Ks= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:mime-version:references:in-reply-to:date :message-id:subject:to:cc; bh=+H0lq2DgEn9BlvNbT+hg11us4kwpr19vmhg9cybmMzk=; b=WwRM5E14Kdo12KyVyQXXidK06HJ94wIth+2vhfhldn4wiU/ZQz1Oer5U8/HuFtlLMO 4bBm1fstC2ULoY5UsOWLaRxGDlZvs2pfyAa3Uvq+lm2AUVtcs2d53W+gRa+U+SHSEb6k AfLZF+ddWWCbJ92agqh0Q6FHzpoAXAMAF9xlBV+u4XeipZ6KaDqUUfjOsbNAdShlydcP r7BEXUIkXfK8lyMCB6+ZKG2waBugDJ2iO7G92qNgrJC49oOaDGwyrh3XpSM/PXEie4Pf s8CB7+0stlQvRKlHMUrDlRLfXOWItDsjlnBJ2Mn4a/zQD35L2oi7DfB0FjePdMdl0SPO wzcA== X-Gm-Message-State: APjAAAVvI8R3rFPPdcVCddvHVipRZ7en6qf4e/P0kpoU1yXuctNTEP+P 2fD7+dr2LGWCH+qzegIRfhHrj++ZPF9k9EnlTiSdIw== X-Google-Smtp-Source: APXvYqzphbtFUJCMGqMW9ztkYQYJ0XvdzUSaFXHzCab8QdSpGKxvgGJZj5UdMSajn11Ng0axHENPVW3Xx95Fym6Z7fo= X-Received: by 2002:ac2:5b49:: with SMTP id i9mr8180297lfp.116.1566070373225; Sat, 17 Aug 2019 12:32:53 -0700 (PDT) Received: from unknown named unknown by gmailapi.google.com with HTTPREST; Sat, 17 Aug 2019 12:32:52 -0700 From: Joe Abley Mime-Version: 1.0 (1.0) References: <09178E42-08B2-4958-A1C8-AF507AEE8834@fugue.com> <0BDD4F7F-7301-476A-80DA-0CC84EE4557D@fugue.com> <6698db4f-89ff-e5be-09a5-eb544f76ebc9@nostrum.com> <20190817170031.6F71C1691138@fafnir.remote.dragon.net> In-Reply-To: Date: Sat, 17 Aug 2019 12:32:52 -0700 Message-ID: To: Rob Sayre Cc: Paul Ebersman , Melinda Shore , ADD Mailing list Content-Type: text/plain; charset="UTF-8" Archived-At: Subject: Re: [Add] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 17 Aug 2019 19:32:57 -0000 Hi Rob, On Aug 17, 2019, at 15:10, Rob Sayre wrote: > That said, an IETF DNS working group is the last place on earth I would expect good security standards to come from. It's been at least 20 years since the security problems with Classic DNS became apparent. ... and during that time work in and adjacent to dnsop has resulted in a lot of good security standards. On the general topic of privacy a whole other working group was spun up. A global PKI was designed, implemented and deployed. I'm a little tired of this general line of anti-dnsop rhetoric, to be honest. I find it unproductive, inaccurate and insulting to a lot of people who have put in a lot of work over a long time. I do not see how it moves the conversation here any closer to any kind of consensus. Joe From nobody Sat Aug 17 12:38:54 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 575C4120100 for ; Sat, 17 Aug 2019 12:38:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JiwQDsYYgWou for ; Sat, 17 Aug 2019 12:38:51 -0700 (PDT) Received: from mail-io1-xd2c.google.com (mail-io1-xd2c.google.com [IPv6:2607:f8b0:4864:20::d2c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6E20812003F for ; Sat, 17 Aug 2019 12:38:51 -0700 (PDT) Received: by mail-io1-xd2c.google.com with SMTP id o9so12994347iom.3 for ; Sat, 17 Aug 2019 12:38:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=/Uv2bK6fOwrcRwIStvLi6guA1cvEKvhFS2462feXcU0=; b=lheY4HHWz7lL3TjNmOR2DiPvs0MIgNjApuxNYCOpvDU/4W/BI99LbNXH+NtLhJYKNt bzGvOdjkDjidpJ08wXEqysA4PN2zwsbul7KNpuVNOSHbDgytGsr67/hcsBwyiV4dWNL3 Wo3fDgpgbnu6XA9E+pS93C2NerWjvP1RUF+VmNvTcXIkisnuE+HtyIwNO7tNFEkgmdlm 5CLa23tSZO6D6N2WuKFv3aNA8uB56LHu6Pc8vyEQmGm1r8GqLgCzqfAvLAiZMjQrokPi uRtlbF049TJxiy8x8uT17PqTtO2f5xlMqrPwycFV7Y+/H5O3OOM+wQHWr/eABJkvzM1y qDnw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=/Uv2bK6fOwrcRwIStvLi6guA1cvEKvhFS2462feXcU0=; b=uI21yeW6EhysK2fMtOjQRDx7oxF5F5Kpg2OrHDxFN1TJvv8txH/9rMs4FFCXev9ins pEtNi18QQuZa/VSjJLUNcGwFInfyTi5Cxj5Y/MFuVSaKm/dM0G1IO6WJ/RBwM2ucrPYq dfiIW7RVj+sEsmRSuusRwjYZWLObdao7eacmVpoohKnqQCh4SJU6Q9jgIcg5kjwn67eN 6p/odUmkLXjb1k0uVUjbZ/CQyHCwfdcJSNplL6nIGzRmmrJxof06Cry0ONOU6usPaF6g hGF14t8lUa2y4HNRHLy4Nz1vMCsj7TSFwneZjhQTzCLLzgXUotsoaXoZ+D3EG5XqVeet Ep7w== X-Gm-Message-State: APjAAAUR10DNwKCafJZRA+MdL/aeE3lXi4sGK2B71uHjtNVJjtcyzSXk G5Z++DPahm/+wnJw8zcpdh9kLzuesxIlbWXbMXA= X-Google-Smtp-Source: APXvYqyRt0rc7AIo8OpZ3EjTcKwDlzuVTo4uFxALqEGZPJud+HyplHdPq1sXB0jfWH7ZlI+PisTv6aw23aUPJotiq3Q= X-Received: by 2002:a02:1087:: with SMTP id 129mr18653353jay.131.1566070730591; Sat, 17 Aug 2019 12:38:50 -0700 (PDT) MIME-Version: 1.0 References: <09178E42-08B2-4958-A1C8-AF507AEE8834@fugue.com> <0BDD4F7F-7301-476A-80DA-0CC84EE4557D@fugue.com> <6698db4f-89ff-e5be-09a5-eb544f76ebc9@nostrum.com> <20190817170031.6F71C1691138@fafnir.remote.dragon.net> In-Reply-To: From: Rob Sayre Date: Sat, 17 Aug 2019 12:38:39 -0700 Message-ID: To: Joe Abley Cc: Paul Ebersman , Melinda Shore , ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000971bdb0590554192" Archived-At: Subject: Re: [Add] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 17 Aug 2019 19:38:53 -0000 --000000000000971bdb0590554192 Content-Type: text/plain; charset="UTF-8" On Sat, Aug 17, 2019 at 12:32 PM Joe Abley wrote: > I'm a little tired of this general line of anti-dnsop rhetoric, to be > honest. > Maybe we should just focus on why this attack is still possible: thanks, Rob --000000000000971bdb0590554192 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Sat, Aug 17, 2019 at 12:32 PM Joe Able= y <jabley@hopcount.ca> wrot= e:
I'm a little tired of this general line of anti-dnsop rhetoric, to be honest.=C2=A0

Maybe we should just focu= s on why this attack is still possible:


thanks,
Rob=C2=A0
--000000000000971bdb0590554192-- From nobody Sat Aug 17 13:07:22 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8438912011D for ; Sat, 17 Aug 2019 13:07:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.996 X-Spam-Level: X-Spam-Status: No, score=-1.996 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=hopcount.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MXWuUpNtewkq for ; Sat, 17 Aug 2019 13:07:17 -0700 (PDT) Received: from mail-io1-xd41.google.com (mail-io1-xd41.google.com [IPv6:2607:f8b0:4864:20::d41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 17B1E12003F for ; Sat, 17 Aug 2019 13:07:17 -0700 (PDT) Received: by mail-io1-xd41.google.com with SMTP id 18so13075076ioe.10 for ; Sat, 17 Aug 2019 13:07:17 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hopcount.ca; s=google; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=e6O9YuJORYlm3JJe5YUKISZDlLytNk5e93rNbjJynV8=; b=eLTJJTdTVPzt+nH0Q44x9e9rHD7Oyj/j41N5FZ6g79B6tzOcDIOeTaoQ6IfstWgKjQ Ld7Zg+lmHxK4iMrZKXRbUa8sqYY+l3FTAkYQTeeCdV5RFTSwW98DSPdvbKdGIjR0M5GG sZsuKPI3/56dXFNMEXiOdBis57ZfobSPyX87c= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=e6O9YuJORYlm3JJe5YUKISZDlLytNk5e93rNbjJynV8=; b=tEN2YHcKI/HHAgS8sDLeOVlRAZfV90QDhSOT2P0bGeWqbzyy4d7uif/5LTPgHdPIXG ipxExeDx5A9WVxoTmRpc9dRbEuNYzXmq3f+AwJXuCL2Y2ptcarIUk5JW82JS5RBGPmPN jVE5YNJf9g1tdSrVIYy4YQDKDDZe9mAcgjANV+GdN4aMTmoKhqzL4vJrDfDeP2KybTxu I/QIKf9Mro+uKSOTLgfFm1TiKKG56SFUY62QBu0oX71Q6o+A5GQyNYl7HROpZ1Kkg9BL miE7603wBXhmZ3jBWKUKvA1qc1faE1w2eX3fV8ZXhnwqRKqsgAb9o4HC4ygSyxDv4QyX PrZA== X-Gm-Message-State: APjAAAX5245jVAH3KhbYFKqm8eynZyEEbRA0DvnJV5o9KbqJR8gn0QbK St3KxAkm+y+q5KZdXQkaFziqrg== X-Google-Smtp-Source: APXvYqxyXwT1lcjls5ZpAt2oRxntibrUpJgQNbjgymMli4rf3pXbr95V2gRpXpydJCx4y4V0AKLw/Q== X-Received: by 2002:a6b:b748:: with SMTP id h69mr11692290iof.30.1566072436237; Sat, 17 Aug 2019 13:07:16 -0700 (PDT) Received: from ?IPv6:2607:f2c0:e786:128f:419a:dc29:4208:bb27? ([2607:f2c0:e786:128f:419a:dc29:4208:bb27]) by smtp.gmail.com with ESMTPSA id k26sm6766634ios.38.2019.08.17.13.07.14 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Sat, 17 Aug 2019 13:07:15 -0700 (PDT) Content-Type: multipart/alternative; boundary=Apple-Mail-6C279307-9C41-434F-9612-EAA18747E2D6 Mime-Version: 1.0 (1.0) From: Joe Abley X-Mailer: iPad Mail (16G77) In-Reply-To: Date: Sat, 17 Aug 2019 16:07:13 -0400 Cc: Paul Ebersman , Melinda Shore , ADD Mailing list Content-Transfer-Encoding: 7bit Message-Id: References: <09178E42-08B2-4958-A1C8-AF507AEE8834@fugue.com> <0BDD4F7F-7301-476A-80DA-0CC84EE4557D@fugue.com> <6698db4f-89ff-e5be-09a5-eb544f76ebc9@nostrum.com> <20190817170031.6F71C1691138@fafnir.remote.dragon.net> To: Rob Sayre Archived-At: Subject: Re: [Add] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 17 Aug 2019 20:07:21 -0000 --Apple-Mail-6C279307-9C41-434F-9612-EAA18747E2D6 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable On Aug 17, 2019, at 15:38, Rob Sayre wrote: >> On Sat, Aug 17, 2019 at 12:32 PM Joe Abley wrote: >=20 >> I'm a little tired of this general line of anti-dnsop rhetoric, to be >> honest.=20 >=20 > Maybe we should just focus on why this attack is still possible: >=20 > Home gateways are well known to be vulnerable to a broad set of platform-bas= ed attacks. They are mass-produced using very low margins that rarely do not= support the cost of even rudimentary software maintenance. See also dnschan= ger, which was a similar attack that exploited consumer operating systems. T= hese attacks use the DNS, but they are not attacking the DNS protocol; they a= re attacking platforms that use the DNS. For a long time, DNS protocol work was done in dnsext and the operation of t= he resulting implementations was handled in dnsop. dnsext was closed with th= e idea that indvidual, more tightly-chartered working groups would be create= d for specific new protocol development work instead. To answer your question, the dane working group produced standards for verif= ication of certificate authenticity that is (I am told) quite commonly used i= n mail systems but not so much in browsers. Integrity protection of the DNS r= esults themselves in the form of DNSSEC was designed in dnsext and the opera= tion of the resulting global system is within the dnsop charter. If the appl= ications involved in the phishing enabled by this attack had been using DoH (= doh working group) then the change of DNS settings in the router would not h= ave affected them. Use of TLSA (dane) and DNSSEC (dnsext) in applications, or applications usin= g DoH with a suitable, non-compromised resolver, might well have helped to m= itigate the attack you mentioned. TLSA and DNSSEC validation are not deploye= d by default in any browser that I know about, but that's not because the st= andards don't exist. DoH in the application is of course precisely what we a= re talking about here in another venue that has been spun up out of dnsop an= d dprive. I may well have got some of the fine details wrong in the ietf dns family tr= ee here, but you get the idea. It feels like you intended that link (and that message) to be a pithy exampl= e of a tremendous failure in dnsop and other dns working groups, but I reall= y don't see it that way. Joe --Apple-Mail-6C279307-9C41-434F-9612-EAA18747E2D6 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable
On Aug 17, 2019, at 15:38, Rob Sayre <sayrer@gmail.com> wrote:

On Sat, Aug 17, 2019 at 12:32 PM Joe Abley <jabley@hopcount.ca> wrote:
I'm a little tired of this general line of anti-dnsop rhetoric, to be
honest. 

Maybe we should just focus= on why this attack is still possible:


Home gateways are well= known to be vulnerable to a broad set of platform-based attacks. They are m= ass-produced using very low margins that rarely do not support the cost of e= ven rudimentary software maintenance. See also dnschanger, which was a simil= ar attack that exploited consumer operating systems. These attacks use the D= NS, but they are not attacking the DNS protocol; they are attacking platform= s that use the DNS.

For a long time, DNS protocol w= ork was done in dnsext and the operation of the resulting implementations wa= s handled in dnsop. dnsext was closed with the idea that indvidual, more tig= htly-chartered working groups would be created for specific new protocol dev= elopment work instead.

To answer your question, the= dane working group produced standards for verification of certificate authe= nticity that is (I am told) quite commonly used in mail systems but not so m= uch in browsers. Integrity protection of the DNS results themselves in the f= orm of DNSSEC was designed in dnsext and the operation of the resulting glob= al system is within the dnsop charter. If the applications involved in the p= hishing enabled by this attack had been using DoH (doh working group) then t= he change of DNS settings in the router would not have affected them.
<= div>
Use of TLSA (dane) and DNSSEC (dnsext) in applications, o= r applications using DoH with a suitable, non-compromised resolver, might we= ll have helped to mitigate the attack you mentioned. TLSA and DNSSEC validat= ion are not deployed by default in any browser that I know about, but that's= not because the standards don't exist. DoH in the application is of course p= recisely what we are talking about here in another venue that has been spun u= p out of dnsop and dprive.

I may well have got some= of the fine details wrong in the ietf dns family tree here, but you get the= idea.

It feels like you intended that link (and th= at message) to be a pithy example of a tremendous failure in dnsop and other= dns working groups, but I really don't see it that way.


Joe

= --Apple-Mail-6C279307-9C41-434F-9612-EAA18747E2D6-- From nobody Sat Aug 17 13:33:49 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AD7A2120152 for ; Sat, 17 Aug 2019 13:33:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JahF2NUgbY7I for ; Sat, 17 Aug 2019 13:33:45 -0700 (PDT) Received: from mail-io1-xd2f.google.com (mail-io1-xd2f.google.com [IPv6:2607:f8b0:4864:20::d2f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 188A9120118 for ; Sat, 17 Aug 2019 13:33:45 -0700 (PDT) Received: by mail-io1-xd2f.google.com with SMTP id q22so13124700iog.4 for ; Sat, 17 Aug 2019 13:33:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=bcOH2V7pln+qlNs600UJHgdQJEJzrRgQGDR7+IYeS2g=; b=Rfmld7M46eUZPzHChGPerFlUMbGMlNJo+6Xh3hT71sEM4pga7AvDYJ3QdmKjAjnetJ La8HTmA0TxIxEbsdWGK/FSbRgsLkXxvnrcPCJDYMarG+tnwdr01P4cKnzbsHLCOFAWQz 5pXArmGMOUqnqly6thqedpXjVOoRsSHisehrwbHtAVHkEvUsBMjQ3O39dm/TIt4Y4IRg LF2t8cK0zNd8pXfpp89gFsm1Mjq9WVIWKhsCJa841iufIkEbONqU9ycz0HY5VshmF9nr 5quPyO8WNOaI5rcKbgmTxcnKwAmqicH1R0SZn+XJgCS2oKPrEP7SfumtZbrKYrH4LI/x HHaw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=bcOH2V7pln+qlNs600UJHgdQJEJzrRgQGDR7+IYeS2g=; b=KUTx3NhhuFnpDR3mspgRy7+H+BitsUMl+vG6wdJNG+wUH1awUcxzziuRix/T1y8Sya +Tc/hT9BdqmKALX/xNyOznIlnKyuXfte43O7up8O3ItiJ43leMFkxoMLAhmd9Hx34ygn 6MTlTuilYetyzWPLtnWakgTT+TU77l+XlE5voqg6Fsgpmhz79Uk9AiQg9Ry5Sz+aXJN2 EvWH7FbGtkt9spund2fEsFsvO9F6JBHiRgIySD8Ham6OFbZeYoTN5Rx4hjDCRAmtNut0 UXjvji3VjYsG8Z/UIFWMuNOtgUDtzLZR3Bvoz3Vo9/d5n0q50TY+u7LD9wtzTCpfa2kH A+Xw== X-Gm-Message-State: APjAAAVXOjqXyctAwa859enD12lrNfVROKsk7eO+w2pyaZXe95h1Z4/V 6WHL0XwGFWF6hPu2zlO/oK2qRjFFobJ1NatLpUo= X-Google-Smtp-Source: APXvYqxTTX0Q0CURmgWL1bhE2PwEuHYj7atJbVpe7Qa76vlS2hD8QrhiQyltl1Eu07QNxCyRjQoNOn4uv1jL54MBTWY= X-Received: by 2002:a02:5a02:: with SMTP id v2mr4997143jaa.124.1566074024140; Sat, 17 Aug 2019 13:33:44 -0700 (PDT) MIME-Version: 1.0 References: <09178E42-08B2-4958-A1C8-AF507AEE8834@fugue.com> <0BDD4F7F-7301-476A-80DA-0CC84EE4557D@fugue.com> <6698db4f-89ff-e5be-09a5-eb544f76ebc9@nostrum.com> <20190817170031.6F71C1691138@fafnir.remote.dragon.net> In-Reply-To: From: Rob Sayre Date: Sat, 17 Aug 2019 13:33:32 -0700 Message-ID: To: Joe Abley Cc: Paul Ebersman , Melinda Shore , ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000e6aa9b05905605ee" Archived-At: Subject: Re: [Add] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 17 Aug 2019 20:33:48 -0000 --000000000000e6aa9b05905605ee Content-Type: text/plain; charset="UTF-8" On Sat, Aug 17, 2019 at 1:07 PM Joe Abley wrote: > These attacks use the DNS, but they are not attacking the DNS protocol; > they are attacking platforms that use the DNS. > That sentence doesn't make sense to me. Isn't this precisely the kind of attack TLS and HTTPS mitigate? See RFC 1958, section 6: "Endpoints should not depend on the confidentiality or integrity of the carriers." < https://tools.ietf.org/html/rfc1958#section-6> > > For a long time, DNS protocol work was done in dnsext and the operation of > the resulting implementations was handled in dnsop. dnsext was closed with > the idea that indvidual, more tightly-chartered working groups would be > created for specific new protocol development work instead. > > To answer your question, the dane working group produced standards for > verification of certificate authenticity that is (I am told) quite commonly > used in mail systems but not so much in browsers. Integrity protection of > the DNS results themselves in the form of DNSSEC was designed in dnsext and > the operation of the resulting global system is within the dnsop charter. > Yes, it seems like DNSSEC does provide integrity and authentication in some sense, but it's vulnerable to tampering on the wire (intentional or not). > If the applications involved in the phishing enabled by this attack had > been using DoH (doh working group) then the change of DNS settings in the > router would not have affected them. > Agreed. The question is whether there's a way to enable automatically-negotiated "DNS filtering" while preventing that attack. I don't think there is. I also happen to think DNS filtering is pretend security, and some parties are really more interested in monetizing unencrypted DNS queries. But, reasonable people can disagree on that last sentence. > It feels like you intended that link (and that message) to be a pithy > example of a tremendous failure in dnsop and other dns working groups, but > I really don't see it that way. > I think this is a cultural disconnect. In my part of the internet, long messages are usually viewed as disrespectful or at least presumptuous. Since I responded to a message that quite publicly questioned my expertise, I hope you can understand that a few pointed comments might come back in a reply. thanks, Rob --000000000000e6aa9b05905605ee Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Sat, Aug 17, 2019 at 1:07 PM Joe A= bley <jabley@hopcount.ca> w= rote:
=C2=A0These attacks use the DNS,= but they are not attacking the DNS protocol; they are attacking platforms = that use the DNS.

T= hat sentence doesn't make sense to me. Isn't this precisely the kin= d of attack TLS and HTTPS mitigate? See RFC 1958, section 6: "Endpoint= s should not depend on the confidentiality or integrity of the carriers.&qu= ot; <https://t= ools.ietf.org/html/rfc1958#section-6>
=C2=A0

For a long time, DNS protocol work w= as done in dnsext and the operation of the resulting implementations was ha= ndled in dnsop. dnsext was closed with the idea that indvidual, more tightl= y-chartered working groups would be created for specific new protocol devel= opment work instead.

To answer your question, the = dane working group produced standards for verification of certificate authe= nticity that is (I am told) quite commonly used in mail systems but not so = much in browsers. Integrity protection of the DNS results themselves in the= form of DNSSEC was designed in dnsext and the operation of the resulting g= lobal system is within the dnsop charter.

Yes, it seems like DNSSEC does provide integrity an= d authentication in some sense, but it's vulnerable to tampering on the= wire (intentional or not).=C2=A0
=C2=A0
If the applications involved in the phishing enabled by this= attack had been using DoH (doh working group) then the change of DNS setti= ngs in the router would not have affected them.

Agreed. The question is whether there's a = way to enable automatically-negotiated "DNS filtering" while prev= enting that attack. I don't think there is. I also happen to think DNS = filtering is pretend security, and some parties are really more interested = in monetizing unencrypted DNS queries. But, reasonable people can disagree = on that last sentence.

=C2=A0
It feels like you intended that link (and that message) to= be a pithy example of a tremendous failure in dnsop and other dns working = groups, but I really don't see it that way.

I think this is a cultural disconnect. In my p= art of the internet, long messages are usually viewed as disrespectful or a= t least presumptuous.

Since I responded to a messa= ge that quite publicly questioned my expertise, I hope you can understand t= hat a few pointed comments might come back in a reply.

=
thanks,
Rob
--000000000000e6aa9b05905605ee-- From nobody Sat Aug 17 13:55:23 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0340A120074 for ; Sat, 17 Aug 2019 13:55:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WihSNyKohvfG for ; Sat, 17 Aug 2019 13:55:18 -0700 (PDT) Received: from mail.dragon.net (mail.dragon.net [IPv6:2001:4f8:3:36::235]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 369E6120072 for ; Sat, 17 Aug 2019 13:55:18 -0700 (PDT) Received: from fafnir.remote.dragon.net (localhost [IPv6:::1]) by mail.dragon.net (Postfix) with ESMTP id 3CD9E3740183; Sat, 17 Aug 2019 13:55:17 -0700 (PDT) Received: by fafnir.remote.dragon.net (Postfix, from userid 501) id 1128E16936B5; Sat, 17 Aug 2019 14:55:17 -0600 (MDT) Received: from fafnir.local (localhost [127.0.0.1]) by fafnir.remote.dragon.net (Postfix) with ESMTP id 0B21F16936B4; Sat, 17 Aug 2019 14:55:17 -0600 (MDT) From: Paul Ebersman To: Rob Sayre cc: Joe Abley , Melinda Shore , ADD Mailing list In-reply-to: References: <09178E42-08B2-4958-A1C8-AF507AEE8834@fugue.com> <0BDD4F7F-7301-476A-80DA-0CC84EE4557D@fugue.com> <6698db4f-89ff-e5be-09a5-eb544f76ebc9@nostrum.com> <20190817170031.6F71C1691138@fafnir.remote.dragon.net> Comments: In-reply-to Rob Sayre message dated "Sat, 17 Aug 2019 13:33:32 -0700." X-Mailer: MH-E 7.4.2; nmh 1.7.1; XEmacs 21.4 (patch 22) MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-ID: <63983.1566075316.1@fafnir.local> Date: Sat, 17 Aug 2019 14:55:16 -0600 Message-Id: <20190817205517.1128E16936B5@fafnir.remote.dragon.net> Archived-At: Subject: Re: [Add] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 17 Aug 2019 20:55:21 -0000 jabley> These attacks use the DNS, but they are not attacking the DNS jabley> protocol; they are attacking platforms that use the DNS. sayrer> That sentence doesn't make sense to me. Isn't this precisely the sayrer> kind of attack TLS and HTTPS mitigate? See RFC 1958, section 6: sayrer> "Endpoints should not depend on the confidentiality or integrity sayrer> of the carriers." sayrer> <[[https://tools.ietf.org/html/rfc1958#section-6]]> No, the point is if the device OS doesn't protect the code the device runs or allows configuration file changes, you can't secure the device. That's what the article you referenced is highlighting. No protocol can be secured or trusted if the underlying OS isn't secure. Consumer CPEs are rife with default or backdoor admin passwords, which makes them inherently insecure. Claiming that changing what transport or DNS server you're using is pointless, since this can be trivially changed by the "bad guys". That security issue is addressed by having better CPE devices and there are a number of efforts to help CPE vendors turn out better products. sayrer> Yes, it seems like DNSSEC does provide integrity and sayrer> authentication in some sense, but it's vulnerable to tampering sayrer> on the wire (intentional or not). How is DNSSEC vulnerable to tampering? It's vulnerable to denial of service, because you can break validation and the end user/device doesn't get an answer. That's not at all the same thing. And how is the integrity "in some sense". I'd agree that DNSSEC doesn't provide authentication but it does provide integrity. jabley> If the applications involved in the phishing enabled by this jabley> attack had been using DoH (doh working group) then the change of jabley> DNS settings in the router would not have affected them. sayrer> Agreed. The question is whether there's a way to enable sayrer> automatically-negotiated "DNS filtering" while preventing that sayrer> attack. I don't think there is. That's non-sequitor. The ability to bypass the device OS DNS settings has nothing to do with DNS filtering being negotiated. sayrer> I think this is a cultural disconnect. In my part of the sayrer> internet, long messages are usually viewed as disrespectful or sayrer> at least presumptuous. Or an attempt to address the range of statements and questions you pose. I don't know what "part of the internet" you inhabit, but on IETF lists, we try to achieve consensus by responding to what's written. From nobody Sat Aug 17 13:58:25 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 48D651200BA for ; Sat, 17 Aug 2019 13:58:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id s2ovlLXtaBQo for ; Sat, 17 Aug 2019 13:58:21 -0700 (PDT) Received: from mail-qt1-x829.google.com (mail-qt1-x829.google.com [IPv6:2607:f8b0:4864:20::829]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AC70B120074 for ; Sat, 17 Aug 2019 13:58:21 -0700 (PDT) Received: by mail-qt1-x829.google.com with SMTP id 44so9982735qtg.11 for ; Sat, 17 Aug 2019 13:58:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=XaC8Bl5xWGAr2/SfvIzmPdgtvPmWJuizgOiEFNUWSmg=; b=LOroYiNSzqXrG0TVV9SfMiFaWZQkIKM3CddPLzR+0LJEs9myJRrUles3HCYpxPW9Ae TfeJjZkq/JIR2d+wpOSgptErHylvroujBCN//A+k5h310f6i0UACDNomZ4wsCwJPn8eU 9rLEeJPamUHuFdjB8iIV3eCW0fBotWp+It+GpOvllhiuRdXtOr0apKjMlDw9DnXwdG2B Yr8Yr3uyzpgUPoIzMvPOxkL/bynvSwi92UmntPNWBaBKTm28bGd0Wr0crxRfJnlugUB5 px4sTV0cZMbHrA5bRnbkDmW4EDLkII5Nczt0HZbiHMk/nhUNGW6W2B9BIw28+h1+EXhI S5+w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=XaC8Bl5xWGAr2/SfvIzmPdgtvPmWJuizgOiEFNUWSmg=; b=gRrr8D0oU8al+Qgi7JewnxjntGxErq7zQwyQQ2VxF45YCLhL6UT52T7oGUMXH1SB+P lL7N1d/8xhJgZnRzbseiJzQ1hMASg7bXEjy+5grlhIVi2wuBs6ZC+oKgYB30fDbLYdH4 z1ao1CRTw/43QYCr3kXn5KQleaiHBNIsrViwf82Zd93lb9ePSYHX9v1R7bzE44rSAKWZ Mryj2fo1QWoESuspJWkiZOGYDEGlONLDTaFzz6mPDlNHfBPS0OfCXpSZgDTrktjpBVLI DOQXs18WsnG12oc0HxihNgUMTjkHqjBzrW3w1X5l6LEUZ/zExBnDvNUHAFljp2HMnacM D+bQ== X-Gm-Message-State: APjAAAXDp8LiSzcFb+MGTjRT25zysQXDaeJ5Cb52dLQdPd6zyLXjAWWJ HgcDh8SnHU7AGTfFOzbINu4= X-Google-Smtp-Source: APXvYqx86e3S7GuKEFWiKGJEjwEOSdYl4+mnJRqMmYv8KLe3h2FrOwNMnspwl9pu5U7sYuOwMu52Dw== X-Received: by 2002:a0c:8a76:: with SMTP id 51mr6129903qvu.210.1566075500699; Sat, 17 Aug 2019 13:58:20 -0700 (PDT) Received: from ?IPv6:2607:fb90:3b31:4ff5:1c3:c9ec:b868:8d9? ([2607:fb90:3b31:4ff5:1c3:c9ec:b868:8d9]) by smtp.gmail.com with ESMTPSA id o50sm5231341qtj.17.2019.08.17.13.58.19 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Sat, 17 Aug 2019 13:58:20 -0700 (PDT) Content-Type: multipart/alternative; boundary=Apple-Mail-1B1324DC-02FF-41AE-B626-9E3642124960 Mime-Version: 1.0 (1.0) From: Brian Dickson X-Mailer: iPhone Mail (16G77) In-Reply-To: Date: Sat, 17 Aug 2019 16:58:19 -0400 Cc: Joe Abley , Melinda Shore , Paul Ebersman , ADD Mailing list Content-Transfer-Encoding: 7bit Message-Id: References: <09178E42-08B2-4958-A1C8-AF507AEE8834@fugue.com> <0BDD4F7F-7301-476A-80DA-0CC84EE4557D@fugue.com> <6698db4f-89ff-e5be-09a5-eb544f76ebc9@nostrum.com> <20190817170031.6F71C1691138@fafnir.remote.dragon.net> To: Rob Sayre Archived-At: Subject: Re: [Add] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 17 Aug 2019 20:58:24 -0000 --Apple-Mail-1B1324DC-02FF-41AE-B626-9E3642124960 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Sent from my iPhone > On Aug 17, 2019, at 3:38 PM, Rob Sayre wrote: >=20 >> On Sat, Aug 17, 2019 at 12:32 PM Joe Abley wrote: >=20 >> I'm a little tired of this general line of anti-dnsop rhetoric, to be >> honest.=20 >=20 > Maybe we should just focus on why this attack is still possible: >=20 > >=20 Okay, let=E2=80=99s. The attack is attempted because pointing a DNS forwarder at a malicious DNS r= esolver is effective in spoofing web sites, if the client host or client app= can be convinced that the web site is authentic. It succeeds only because b= rowsers believe the attacker. Consider how these attacks would be mitigated if the host performed DNSSEC v= alidation and the domain was DNSSEC signed: the result of changing the DNS r= esolver would at worst result in denial of DNS resolution for the targeted s= ites. Use of TLSA records, if validated by the browser, would further protec= t against advanced attacks involving certificates issued by rogue CAs.=20 In fact, browsers implementing DNS client functions would facilitate much of= these improvements by bypassing limitations of the host OS resolver librari= es. Browsers would be able to do TLSA queries directly, and bypass forwarder= s which fail to do DNSSEC validation. Standardizing selection of resolver, transport protocol (DoH vs DoT), along w= ith DNSSEC validation and DANE support would seem to be an enormous win/win.= It would not make the above attack impossible (it would still be possible to= change the DNS server) but it would make it futile (forged results would be= ignored) and discourage further attempts. Brian --Apple-Mail-1B1324DC-02FF-41AE-B626-9E3642124960 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable

Sent from my iPhone

On Aug 17, 2019, at 3:38= PM, Rob Sayre <sayrer@gmail.com&= gt; wrote:

On Sat, Aug 17, 2019 at 12:32 PM Joe Abley <jabley@hopcount.ca> wrote:
<= div class=3D"gmail_quote">
I'm a little tired of this general line of anti-dnsop rhetoric, to be
honest. 

Maybe we should just focus= on why this attack is still possible:


Okay, let=E2=80=99= s.

The attack is attempted because pointing a DNS f= orwarder at a malicious DNS resolver is effective in spoofing web sites, if t= he client host or client app can be convinced that the web site is authentic= . It succeeds only because browsers believe the attacker.

Consider how these attacks would be mitigated if the host performed D= NSSEC validation and the domain was DNSSEC signed: the result of changing th= e DNS resolver would at worst result in denial of DNS resolution for the tar= geted sites. Use of TLSA records, if validated by the browser, would further= protect against advanced attacks involving certificates issued by rogue CAs= . 

In fact, browsers implementing DNS client f= unctions would facilitate much of these improvements by bypassing limitation= s of the host OS resolver libraries. Browsers would be able to do TLSA queri= es directly, and bypass forwarders which fail to do DNSSEC validation.
=

Standardizing selection of resolver, transport protocol (= DoH vs DoT), along with DNSSEC validation and DANE support would seem to be a= n enormous win/win.

It would not make the above att= ack impossible (it would still be possible to change the DNS server) but it w= ould make it futile (forged results would be ignored) and discourage further= attempts.

Brian


= --Apple-Mail-1B1324DC-02FF-41AE-B626-9E3642124960-- From nobody Sat Aug 17 14:07:20 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 43899120164 for ; Sat, 17 Aug 2019 14:07:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0I2OUaKF0toM for ; Sat, 17 Aug 2019 14:07:16 -0700 (PDT) Received: from mail-io1-xd31.google.com (mail-io1-xd31.google.com [IPv6:2607:f8b0:4864:20::d31]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A442D120118 for ; Sat, 17 Aug 2019 14:07:16 -0700 (PDT) Received: by mail-io1-xd31.google.com with SMTP id e20so13192651iob.9 for ; Sat, 17 Aug 2019 14:07:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=DR0rf7KzPp431MS+d7O/DKkxlg+U+r8Xx8Dd2WWIhhk=; b=NMRS8yAvhHG+jviJsREbTjBIPZI26hu8MIO9cPgvBuVw2j7DuNqq/+QqcgS7UNW4K/ ib61+Ftz1s7OFQorvFwJ8IGdl06tE2sxE5iiOawemuEN4e6xTvGsBoZ/jvyhGmuHh+2o m9V6pt9HEyCjUuQegUcqiWT2aE+HeF8J3NSibsNbauMmE5e8iT6ifzenEeWbk+/gWH3k 5MINV52Tj22QU8ZTVRqPBEtJYy7sbu6oggBwP2SVIzvW9A9ZRvHd8NG1Vpevzhmp5Ke0 mQmom/RCaSBYvvLRJ+F+YxickqATxnTHbRELo/3TmGU7v6NSiqpR7R0uSEpH0gXqXrY4 bJIQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=DR0rf7KzPp431MS+d7O/DKkxlg+U+r8Xx8Dd2WWIhhk=; b=r0/66CO78Dxet4jv1tMuubrKKkEb0HbWFVGvVSAHBmP+J/pGjDFw4JEV1qM07Xdh7I hPE4eK8dV5+3KGur/MGE+9yJ3wgMyzKidpXXx1iwDUqr+svPwi6MK4pacRpePrtvxNvH xhUn9xFjj00Cs9l6I7Ggdx97yttHlXngG+0akGuWwX5iOpc5EdewAY5VvbuzqnGouS1y rkISv/1g06a6kNb4SoL8IGr+ELzoSmAcEGKWMMkMi+cVNE8Di1a4iOWsDYqdX2hmAV4a 5btlrZ9PAgLIGVp6+E3TCUkL+nljHE7T3ECPGm9cW3xNKovB0KeDiTq5NeLNkfO3yyjV FsVw== X-Gm-Message-State: APjAAAVGZrQDWpGvsfnLZ0Z8pSaG0EkW8g9ZUeg7HCLeB714YvpG66pF 3FVa0bVui836zPxkwCBdZuAA25lKNS1ZL7eU2Nk= X-Google-Smtp-Source: APXvYqzd8HoFtJJ9k0o2J2vprtdueYOWVhd8EuLkvUWAtkgnCYnakHLLF1kMheg1gg8WXP3bgHgApaUeLinR6IkEmGY= X-Received: by 2002:a5d:8457:: with SMTP id w23mr6329230ior.189.1566076035771; Sat, 17 Aug 2019 14:07:15 -0700 (PDT) MIME-Version: 1.0 References: <09178E42-08B2-4958-A1C8-AF507AEE8834@fugue.com> <0BDD4F7F-7301-476A-80DA-0CC84EE4557D@fugue.com> <6698db4f-89ff-e5be-09a5-eb544f76ebc9@nostrum.com> <20190817170031.6F71C1691138@fafnir.remote.dragon.net> <20190817205517.1128E16936B5@fafnir.remote.dragon.net> In-Reply-To: <20190817205517.1128E16936B5@fafnir.remote.dragon.net> From: Rob Sayre Date: Sat, 17 Aug 2019 14:07:04 -0700 Message-ID: To: Paul Ebersman Cc: Joe Abley , Melinda Shore , ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000cdb4f80590567d27" Archived-At: Subject: Re: [Add] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 17 Aug 2019 21:07:19 -0000 --000000000000cdb4f80590567d27 Content-Type: text/plain; charset="UTF-8" On Sat, Aug 17, 2019 at 1:55 PM Paul Ebersman wrote: > jabley> These attacks use the DNS, but they are not attacking the DNS > jabley> protocol; they are attacking platforms that use the DNS. > > sayrer> That sentence doesn't make sense to me. Isn't this precisely the > sayrer> kind of attack TLS and HTTPS mitigate? See RFC 1958, section 6: > sayrer> "Endpoints should not depend on the confidentiality or integrity > sayrer> of the carriers." > sayrer> <[[https://tools.ietf.org/html/rfc1958#section-6]]> > > No, the point is if the device OS doesn't protect the code the device > runs or allows configuration file changes, you can't secure the > device. That's what the article you referenced is highlighting. > No, it's pointing out that the router may be compromised, and that the endpoints shouldn't trust it. sayrer> Yes, it seems like DNSSEC does provide integrity and > sayrer> authentication in some sense, but it's vulnerable to tampering > sayrer> on the wire (intentional or not). > > How is DNSSEC vulnerable to tampering? "Most bizarrely perhaps, is that DNSSEC provides no end-to-end security. Your browser or OS still communicates with your resolver using regular queries, relying on a single unauthenticated bit to "request" validation. It's as if LAN/wifi-level abuse wasn't a concern at all, or that public resolvers (like OpenDNS and Google Public DNS) didn't exist." Or an attempt to address the range of statements and questions you pose. > I don't know what "part of the internet" you inhabit, but on IETF lists, > we try to achieve consensus by responding to what's written. > Sure. I think a close reading of the list will lead you to predict a result that resembles this meeting: . thanks, Rob --000000000000cdb4f80590567d27 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Sat, Aug 17, 2019 at 1:55 PM Paul = Ebersman <list-add@dragon.net= > wrote:
jabl= ey> These attacks use the DNS, but they are not attacking the DNS
jabley> protocol; they are attacking platforms that use the DNS.

sayrer> That sentence doesn't make sense to me. Isn't this preci= sely the
sayrer> kind of attack TLS and HTTPS mitigate? See RFC 1958, section 6:<= br> sayrer> "Endpoints should not depend on the confidentiality or inte= grity
sayrer> of the carriers."
sayrer> <[[https://tools.ietf.org/html/rfc1958#s= ection-6]]>

No, the point is if the device OS doesn't protect the code the device runs or allows configuration file changes, you can't secure the
device. That's what the article you referenced is highlighting.

No, it's pointing out that the router may = be compromised, and that the endpoints shouldn't trust it.

sayrer> Yes, it seems like DNSSEC does provide integrity and
sayrer> authentication in some sense, but it's vulnerable to tamperi= ng
sayrer> on the wire (intentional or not).

How is DNSSEC vulnerable to tampering?

&qu= ot;Most bizarrely perhaps, is that DNSSEC provides no end-to-end security. = Your browser or OS still communicates with your resolver using regular quer= ies, relying on a single unauthenticated bit to "request" validat= ion. It's as if LAN/wifi-level abuse wasn't a concern at all, or th= at public resolvers (like OpenDNS and Google Public DNS) didn't exist.&= quot;

<https://news.ycombinator.com/item?id=3D7450281>

Or an attempt to address the range of statements and questions you pose. I don't know what "part of the internet" you inhabit, but on = IETF lists,
we try to achieve consensus by responding to what's written.

Sure. I think a close reading of the list will le= ad you to predict a result that resembles this meeting:=C2=A0<https://youtu.be/7hclQbuCBws?t=3D34= 32>.

thanks,
Rob=C2=A0
--000000000000cdb4f80590567d27-- From nobody Sat Aug 17 14:18:20 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 71E9412006F for ; Sat, 17 Aug 2019 14:18:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2c293CMOc1-V for ; Sat, 17 Aug 2019 14:18:16 -0700 (PDT) Received: from mail-io1-xd2a.google.com (mail-io1-xd2a.google.com [IPv6:2607:f8b0:4864:20::d2a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C7E70120041 for ; Sat, 17 Aug 2019 14:18:16 -0700 (PDT) Received: by mail-io1-xd2a.google.com with SMTP id 18so13247441ioe.10 for ; Sat, 17 Aug 2019 14:18:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=h6RT9qDNNuhkvxgBnOmrCqxk2yqTyPPHeAI01LvJ81A=; b=E4z31iUBIbABkY3t/qNkul65jHQvEur2Hr+m16PKvl08lM8LeRbdJqSiar668sQpuP M/QZfvvi5ubyMJm8o0ddmF5ZBbCkBh1VmgJhBJAeYFEmgIt62jlItDHDJMgm9vdrW/9Q Ew0B6wGLWoDnpjjmhjY3R1vyi7bO4l4mMqSDHfRBr4/gQswGgkCtDX9+HwL7aeSTHQcJ YcWQzuANbabuwRcvcoyDmJRFEKFD4tPly7dvh2h1rrJB4tOYIc+Kd6Os7J0YrBDyRE/g 1AyIfs0ecLlAd0R9OFDz9LTtPggEKb50C9ZaIxjmgkd7VJlgnC5mRv+GW9uvbUV6jKT2 xsmQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=h6RT9qDNNuhkvxgBnOmrCqxk2yqTyPPHeAI01LvJ81A=; b=itFzPna1TfQhYkWtWREzbc883gVuLY0C7hVjnws/cItDsYPtR+t4mjiNtQL4MxuANs DAN7bSix5tqpC942hyJxdX14MYZJW8SN8/bTQUjzyo5RkSH7Xvjx1eL8hD6z1B/upBwK tC2tYzYFry4EV+LFzSBt5WAoUJPJUzHZ5Yvluy6WChKiIFIgxlva6IvyLLUAyvvM9QWD /IusRQJN4vAoYtunrlWIPgVNpq4cukKYqurDBUXTAnixuc74IlF37ZNlW9a9m3k+TI4A 1dRFm7xOD8SmqwItC1Y5CigasB+v5Tvlrj9q8BYUdw3ylIj/jbawe23Txw29f80n3FRh vNOw== X-Gm-Message-State: APjAAAUmclyA2sOnWKqk4XVh2Y9S0B/asqrYnDX76TxXMOwxhOQUxtu0 +m+a4Zb7HmOFBmf6GKFiJi93hYceT9qbLLXXJzs= X-Google-Smtp-Source: APXvYqxyK6I9wMUKf/DH/aWBcbIR4qpS/FHplI1ckJxvAc06j1wfwuD4L+3fMMPiy9tQ30l3UGfbHxEnHSGyW2tJie8= X-Received: by 2002:a5e:d618:: with SMTP id w24mr2021505iom.73.1566076696072; Sat, 17 Aug 2019 14:18:16 -0700 (PDT) MIME-Version: 1.0 References: <09178E42-08B2-4958-A1C8-AF507AEE8834@fugue.com> <0BDD4F7F-7301-476A-80DA-0CC84EE4557D@fugue.com> <6698db4f-89ff-e5be-09a5-eb544f76ebc9@nostrum.com> <20190817170031.6F71C1691138@fafnir.remote.dragon.net> In-Reply-To: From: Rob Sayre Date: Sat, 17 Aug 2019 14:18:04 -0700 Message-ID: To: Brian Dickson Cc: Joe Abley , Melinda Shore , Paul Ebersman , ADD Mailing list Content-Type: multipart/alternative; boundary="0000000000002914aa059056a584" Archived-At: Subject: Re: [Add] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 17 Aug 2019 21:18:19 -0000 --0000000000002914aa059056a584 Content-Type: text/plain; charset="UTF-8" On Sat, Aug 17, 2019 at 1:58 PM Brian Dickson wrote: > > Consider how these attacks would be mitigated if the host performed DNSSEC > validation and the domain was DNSSEC signed > DNSSEC adoption is directly correlated with use of Google's centralized DNS service. thanks, Rob --0000000000002914aa059056a584 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Sat, Aug 17, 2019 at 1:58 PM Brian Dic= kson <brian.peter.dicks= on@gmail.com> wrote:

Consider how these attacks would be mitigated if the host performed DNSSE= C validation and the domain was DNSSEC signed
=
DNSSEC adoption is directly correlated with use of Google= 9;s centralized DNS service.


thanks,
Rob
--0000000000002914aa059056a584-- From nobody Sat Aug 17 14:33:46 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 76600120164 for ; Sat, 17 Aug 2019 14:33:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Ylrw4cIzdM-g for ; Sat, 17 Aug 2019 14:33:43 -0700 (PDT) Received: from smtp.guxx.net (nyx.guxx.net [85.10.208.173]) by ietfa.amsl.com (Postfix) with ESMTP id D75D8120118 for ; Sat, 17 Aug 2019 14:33:42 -0700 (PDT) Received: by nyx.guxx.net (Postfix, from userid 107) id 34E855F42D42; Sat, 17 Aug 2019 23:33:40 +0200 (CEST) Received: from [172.19.152.61] (p54B8ABDF.dip0.t-ipconnect.de [84.184.171.223]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by nyx.guxx.net (Postfix) with ESMTPSA id DE2495F40329; Sat, 17 Aug 2019 23:33:39 +0200 (CEST) From: "Ralf Weber" To: "Rob Sayre" Cc: "Paul Ebersman" , "Melinda Shore" , "ADD Mailing list" , "Joe Abley" Date: Sat, 17 Aug 2019 23:33:39 +0200 X-Mailer: MailMate (1.12.5r5635) Message-ID: <9FB124AF-79CB-48B9-87BB-DC6F2D532F10@fl1ger.de> In-Reply-To: References: <09178E42-08B2-4958-A1C8-AF507AEE8834@fugue.com> <0BDD4F7F-7301-476A-80DA-0CC84EE4557D@fugue.com> <6698db4f-89ff-e5be-09a5-eb544f76ebc9@nostrum.com> <20190817170031.6F71C1691138@fafnir.remote.dragon.net> <20190817205517.1128E16936B5@fafnir.remote.dragon.net> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [Add] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 17 Aug 2019 21:33:45 -0000 Moin! On 17 Aug 2019, at 23:07, Rob Sayre wrote: > No, it's pointing out that the router may be compromised, and that the > endpoints shouldn't trust it. Well the application could also be compromised. What are we doing then? At one point in time everything can be compromised. That doesn’t mean we should no longer use the technology in general. Otherwise we would not use computers at all. > "Most bizarrely perhaps, is that DNSSEC provides no end-to-end security. > Your browser or OS still communicates with your resolver using regular > queries, relying on a single unauthenticated bit to "request" validation. > It's as if LAN/wifi-level abuse wasn't a concern at all, or that public > resolvers (like OpenDNS and Google Public DNS) didn't exist." > > You bring that at least the second time. And repeating doesn’t make it true. DNSSEC when deployed with validation at the stub resolver can detect tampering of the data either by the party I selected to talk to or by something someone is trying to hand me. So it is end to end secure from the moment someone entered the data into an authoritative server up to me as a client or application. As said before DNSSEC and DoH/DoT are complementary and solve different problems. So long -Ralf —-- Ralf Weber From nobody Sat Aug 17 14:36:36 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E94B3120164 for ; Sat, 17 Aug 2019 14:36:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9bgX8GmvxoCu for ; Sat, 17 Aug 2019 14:36:33 -0700 (PDT) Received: from mail-io1-xd34.google.com (mail-io1-xd34.google.com [IPv6:2607:f8b0:4864:20::d34]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3686C120118 for ; Sat, 17 Aug 2019 14:36:33 -0700 (PDT) Received: by mail-io1-xd34.google.com with SMTP id s21so13289148ioa.1 for ; Sat, 17 Aug 2019 14:36:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=2p0AMHaIT+Uy+Tje8BGBiTOHPVKNRL4cIFZutETh2YU=; b=Y9Bh7JPK2X/f6nzVOwHHPtZyB3Z+um6o99wJiHakdDdBYXzVneGCLJKs09zqh6gbRY wyQyzUfJ5G3n9xBoWZ/IT0cyi57n1Yp05P6odGIjTt/zjBMdh37EkFyxraHkYClclHrs tZ0kbutckXNhTQNN8E0MpXtBcuUQZHFm/8NrCuI2pS978q7gJMrOTGdY9u1qiJj8oy65 +pmSZ07IDFf/hpXIYFlfkdBnh3UxpSBcIObtlszxhf/GZs5NRPS95OPLhsVXZp3fJZp3 gHIX4COk2yqf6YoHGuXjef65CxWl+Qc0IjPwlUDZrQ9Aam2aeZ0gAkwkcy2RMqFQPoDH QY3Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=2p0AMHaIT+Uy+Tje8BGBiTOHPVKNRL4cIFZutETh2YU=; b=e4M97hKSVENfy7pFcjg7Etrbb7m1aRjwjdFXfv+r88G83BGc7ci//f5tmwh2YT+Q+i s4tkj5tmuk/3e39QEfHtbHMMiBL6vnE07l/wjBv7hBLqMpXWjYyNEiU2Yj+VW7T0qork 6nT2XjJRm1/X3JqsZfKC0fmETe8slUOk0D/+S6bUNzUc4sZD0voGGxDLp7VgtBEVDwOz Wneo7+JRmIB/OK3omSrx+S+844QOIPjSzgd5zij5ltSl2mEAXAwvGxSeB3qtHgqcDAii Ye9Y8y1KfGYhHUwu6uwoV5wghzpra06eIz3h9Le4JwhrWtJmxxhhY4ZujrHiYKD/d5Wh bUiw== X-Gm-Message-State: APjAAAW77hLKQJB1LhOVfjyGY0dFdOMV9JCAV3A1f9b+IY1ZSxMfCE8s H2Rf5sfWMH9RgSvstxwhPGPzGz92bYkMaygZlP4= X-Google-Smtp-Source: APXvYqyhbJCn3UGVZt4kNPNwMetgb91GM6tZauTV0AcF8wbiwHU3v0mi0jIumsf8QB0mfoI6CzqbPIABQRA/ho8VavQ= X-Received: by 2002:a02:1a86:: with SMTP id 128mr18611085jai.95.1566077792382; Sat, 17 Aug 2019 14:36:32 -0700 (PDT) MIME-Version: 1.0 References: <09178E42-08B2-4958-A1C8-AF507AEE8834@fugue.com> <0BDD4F7F-7301-476A-80DA-0CC84EE4557D@fugue.com> <6698db4f-89ff-e5be-09a5-eb544f76ebc9@nostrum.com> <20190817170031.6F71C1691138@fafnir.remote.dragon.net> In-Reply-To: From: Rob Sayre Date: Sat, 17 Aug 2019 14:36:21 -0700 Message-ID: To: Brian Dickson Cc: Joe Abley , Melinda Shore , Paul Ebersman , ADD Mailing list Content-Type: multipart/alternative; boundary="0000000000008172f0059056e6f5" Archived-At: Subject: Re: [Add] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 17 Aug 2019 21:36:35 -0000 --0000000000008172f0059056e6f5 Content-Type: text/plain; charset="UTF-8" On Sat, Aug 17, 2019 at 2:18 PM Rob Sayre wrote: > On Sat, Aug 17, 2019 at 1:58 PM Brian Dickson < > brian.peter.dickson@gmail.com> wrote: > >> >> Consider how these attacks would be mitigated if the host performed >> DNSSEC validation and the domain was DNSSEC signed >> > > DNSSEC adoption is directly correlated with use of Google's centralized > DNS service. > > > I was brought to my attention that these estimates may be a bit on the optimistic side. "...maybe 20% of recursives may have 'adopted' validation. Sadly, only about 1% of zones have really adopted and signed." thanks, Rob --0000000000008172f0059056e6f5 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Sat, Aug 17, 2019 at 2:18 PM Rob S= ayre <sayrer@gmail.com> wrote= :
On Sat, Aug 17, 2019 at 1:58 PM Brian Dickson <brian.peter.d= ickson@gmail.com> wrote:

Consider how these attacks would be mitigated if the host performed D= NSSEC validation and the domain was DNSSEC signed
<= div>
DNSSEC adoption is directly correlated with use of Googl= e's centralized DNS service.




<= /div> --0000000000008172f0059056e6f5-- From nobody Sat Aug 17 14:39:15 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1725512006F for ; Sat, 17 Aug 2019 14:39:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TLtpYnnqI4me for ; Sat, 17 Aug 2019 14:39:12 -0700 (PDT) Received: from mail-io1-xd33.google.com (mail-io1-xd33.google.com [IPv6:2607:f8b0:4864:20::d33]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5103F120041 for ; Sat, 17 Aug 2019 14:39:12 -0700 (PDT) Received: by mail-io1-xd33.google.com with SMTP id t3so13269814ioj.12 for ; Sat, 17 Aug 2019 14:39:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=rEO/ps89FIn4mcJhHyARVphO+wqsG7PCDV3vwEDX3qU=; b=ZW94B4ZjkXNMObJegnDTtW2Zu6CbSY5olVLyOFuwyFZ3IspjaZg5EZz5t5sGmhqlef Y4nIoAfO8BZSjnHbx9hFJZyKlSkxnG5mc12FsAsg8qclTZTSk3n6jcd/Yx4pADtWO8eK liKlR0PcU2PT/ZMx0k/V3RrJffWYvLSQLoQqi9dL4Ty0reZvcIeHqygkMnP7IVFsTyTS GJINqdJ3vZ5TN0RnCrjt0ZTnn6cYZV114PSkSj4qRmht7KMepfhZ7qdI8PdDg0McXDqa OQ+JTrAhV+xOINQStjQlOAnzNABZDu14JFE8SRESthqfm/FbiFyyQoPWkfz1pVs7hq2S aumA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=rEO/ps89FIn4mcJhHyARVphO+wqsG7PCDV3vwEDX3qU=; b=jTVzIK59Yjr4TiEO4hgLfQ3KrMTNoH6bXfNYoSMkD47DH8oom7kARLdT+yJ35EUMRk sYHGJSSheo2NprYVO1APjy6axg7Sc1hQgo/ZstGHDPnubgzBnJkPFIT+lWxq0hhOWltD ZV7c3RDNgHSjVYNLeMJdAHJvwmwmm+gRnRIBUAL1/c/T/I1692JeGXeKV684E4cVOjSM 9fFCBnHjQa09jhOPaJEaJCuwUr13s42GDVjBwqSWhLqT05iTDADWzfv83najc8+7bo88 2FxUIcia2OuH0g36FNmlasxvRvcEJpNFWAqtZWZSZiAs304aV+1MCLWHay0/dojF/n90 Qplg== X-Gm-Message-State: APjAAAWeoWJSe218ZbeU3LYIcUS+v8cYlCM2CIWLPkSjx7qnIwP3bjcl 0iUIRqZPUTh6QDdZnxuFpg8RFWnL9VpmWfJmFv4= X-Google-Smtp-Source: APXvYqxQwJYph9DxmM9+un0Oqs73y21iLolYyZD6+ogiArHGw5Ow2bSv7ByFSopBP1M+7rEy9srZ4MtevCAmzYaog74= X-Received: by 2002:a05:6638:303:: with SMTP id w3mr10270581jap.103.1566077951591; Sat, 17 Aug 2019 14:39:11 -0700 (PDT) MIME-Version: 1.0 References: <09178E42-08B2-4958-A1C8-AF507AEE8834@fugue.com> <0BDD4F7F-7301-476A-80DA-0CC84EE4557D@fugue.com> <6698db4f-89ff-e5be-09a5-eb544f76ebc9@nostrum.com> <20190817170031.6F71C1691138@fafnir.remote.dragon.net> <20190817205517.1128E16936B5@fafnir.remote.dragon.net> <9FB124AF-79CB-48B9-87BB-DC6F2D532F10@fl1ger.de> In-Reply-To: <9FB124AF-79CB-48B9-87BB-DC6F2D532F10@fl1ger.de> From: Rob Sayre Date: Sat, 17 Aug 2019 14:39:00 -0700 Message-ID: To: Ralf Weber Cc: Paul Ebersman , Melinda Shore , ADD Mailing list , Joe Abley Content-Type: multipart/alternative; boundary="000000000000fec8c9059056efca" Archived-At: Subject: Re: [Add] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 17 Aug 2019 21:39:14 -0000 --000000000000fec8c9059056efca Content-Type: text/plain; charset="UTF-8" On Sat, Aug 17, 2019 at 2:33 PM Ralf Weber wrote: > As said before DNSSEC and DoH/DoT are complementary and solve different > problems. > Agreed. But I think people are looking for a way to break DoH/DoT, in a well-meaning way. So, bringing up DNSSEC is actually kind of a distraction. thanks, Rob --000000000000fec8c9059056efca Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
As said before DNSSEC and DoH/DoT are complementary and solve different
problems.

Agreed. But I think people ar= e looking for a way to break DoH/DoT, in a well-meaning way. So, bringing u= p DNSSEC is actually kind of a distraction.

thanks= ,
Rob
--000000000000fec8c9059056efca-- From nobody Sat Aug 17 14:42:27 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8FB9E12006F for ; Sat, 17 Aug 2019 14:42:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sc2n6P9dI9zG for ; Sat, 17 Aug 2019 14:42:23 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 09A2E120041 for ; Sat, 17 Aug 2019 14:42:23 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 16A30BE50; Sat, 17 Aug 2019 22:42:21 +0100 (IST) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wdHIPrVs6vvH; Sat, 17 Aug 2019 22:42:15 +0100 (IST) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id A48D1BE47; Sat, 17 Aug 2019 22:42:15 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1566078135; bh=BobhG+EU9VGMAIiEqpNXR4hMiWciVo+SgBi3QWNgArY=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From; b=EyQK1/ZVrE9a0bDXxWJxBFtYiISP31XMsFCDZkVaMAgO3v5ZNk8Wjj4rq5H3tfEb9 rvCudOkQoS6rLFGu5rXGlvV+fl2LnIL4zzwr7t6zcPoxgF6aXlLjGM8OBi6N92DN2L UBlgHwwQ8Pr2JF8KXEACNjRmR9KbRYSJbpZTQR70= To: Rob Sayre , Brian Dickson Cc: Melinda Shore , Paul Ebersman , ADD Mailing list , Joe Abley References: <0BDD4F7F-7301-476A-80DA-0CC84EE4557D@fugue.com> <6698db4f-89ff-e5be-09a5-eb544f76ebc9@nostrum.com> <20190817170031.6F71C1691138@fafnir.remote.dragon.net> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: <93523c14-1a58-3d51-98d9-ae42b685ecdb@cs.tcd.ie> Date: Sat, 17 Aug 2019 22:42:14 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="hnGYB1dK60dHtbFO5MabfoGgCVwSqPQTi" Archived-At: Subject: Re: [Add] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 17 Aug 2019 21:42:26 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --hnGYB1dK60dHtbFO5MabfoGgCVwSqPQTi Content-Type: multipart/mixed; boundary="E7ZvLPAE7Qsk2FYKs96ksfdWOdOh2wYQi"; protected-headers="v1" From: Stephen Farrell To: Rob Sayre , Brian Dickson Cc: Melinda Shore , Paul Ebersman , ADD Mailing list , Joe Abley Message-ID: <93523c14-1a58-3d51-98d9-ae42b685ecdb@cs.tcd.ie> Subject: Re: [Add] Participation References: <09178E42-08B2-4958-A1C8-AF507AEE8834@fugue.com> <0BDD4F7F-7301-476A-80DA-0CC84EE4557D@fugue.com> <6698db4f-89ff-e5be-09a5-eb544f76ebc9@nostrum.com> <20190817170031.6F71C1691138@fafnir.remote.dragon.net> In-Reply-To: --E7ZvLPAE7Qsk2FYKs96ksfdWOdOh2wYQi Content-Type: multipart/mixed; boundary="------------C3A431380A5E4A767D01169E" Content-Language: en-GB This is a multi-part message in MIME format. --------------C3A431380A5E4A767D01169E Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hiya, On 17/08/2019 22:36, Rob Sayre wrote: >=20 > "...maybe 20% of recursives may have 'adopted' validation. Sadly, only > about 1% of zones have really adopted and signed." That was a quote from me. (Which is just fine, I was trying not to add to the list traffic so much;-) Anyway, I think the above numbers may be close enough to correct. But the reason for this mail is just to say that I fully agree with those who say that DNSSEC is complementary to DoH or DoT. They just provide different services. DNSSEC can provide origin authentication for DNS answers. DoH/DoT can provide confidentiality between stub and recursive and authentication of a recursive. Claims that there's a conflict there or that one is better or worse than the other make no sense. Cheers, S. --------------C3A431380A5E4A767D01169E Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------C3A431380A5E4A767D01169E-- --E7ZvLPAE7Qsk2FYKs96ksfdWOdOh2wYQi-- --hnGYB1dK60dHtbFO5MabfoGgCVwSqPQTi Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAl1YdLYACgkQWrL68XsX K+rorw/9Ffpv8UX3FylF/AwjwdgqfnI0U2zELPDYlpkct0IXfd1eUq/qOBzH7Kd8 +6OBdn9m/K//fydAFQB6zDV6SeRODmpym/YY+K6gF6UXcIvLB5kTSv07aX5B2Oh+ qAh41+EODD0Od9I5dnusPKkgzCHMUwYp/6VbjQT21zpIpxb5uaSRorgs/yfSvVur 47ulLvTZRq19VUuqV4yM7M6xzJX9SA3JdwV5D3SE5/Bs+LW8msZec4Soe1yBGkiX wKPl8R82BlPFBLLvjEIL1SotZ1m4GcLmNP43AJEf3aAF7AFaY3Gyt9qHy8Kn7OQW vS6BESRs5pAPnAlXHkz4Xqx6Ub573svOnGnLYkXrE4eGBG2YupqD3xwhVSnK2cRz WRcdGDz0etjtaqL4TD8HSbGNvlacVIMfyYGA3z7nQUXX+w+ZC1jUIt7X2sPKOE+v qyrCe/qxHOckleR/nZY2j2fQKsJfYPkok0r6lVChU5/97GaCQW6x8heMmoukPn/P O4VjVvQt4TMTUVKDWqnLdcj2SwN1m8isYbKodHVUeHDz+dtLOnAXm2lMbJ0nSZId gcIQSfVDE25en+/Dk3UkzzyPLdAh1rI/UXAJesFFezrZrps6+QWOtnDXe0Jm3siP aWFKA3yksLp7jXy72hjcXxI3H+zNs9nnHHawuRcLZC6HDBI3wkg= =lVT4 -----END PGP SIGNATURE----- --hnGYB1dK60dHtbFO5MabfoGgCVwSqPQTi-- From nobody Sat Aug 17 14:46:07 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A000512006F for ; Sat, 17 Aug 2019 14:46:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.9 X-Spam-Level: X-Spam-Status: No, score=-6.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sFqqDP0MOgqT for ; Sat, 17 Aug 2019 14:46:03 -0700 (PDT) Received: from mx.pao1.isc.org (mx.pao1.isc.org [IPv6:2001:4f8:0:2::2b]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 63FE2120041 for ; Sat, 17 Aug 2019 14:46:03 -0700 (PDT) Received: from zmx1.isc.org (zmx1.isc.org [149.20.0.20]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx.pao1.isc.org (Postfix) with ESMTPS id 0594B3AB002; Sat, 17 Aug 2019 21:46:03 +0000 (UTC) Received: from zmx1.isc.org (localhost [127.0.0.1]) by zmx1.isc.org (Postfix) with ESMTPS id E30521600B3; Sat, 17 Aug 2019 21:46:02 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by zmx1.isc.org (Postfix) with ESMTP id C5C981600B2; Sat, 17 Aug 2019 21:46:02 +0000 (UTC) Received: from zmx1.isc.org ([127.0.0.1]) by localhost (zmx1.isc.org [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id wjSYfnGBpHhu; Sat, 17 Aug 2019 21:46:02 +0000 (UTC) Received: from [172.30.42.67] (c27-253-115-14.carlnfd2.nsw.optusnet.com.au [27.253.115.14]) by zmx1.isc.org (Postfix) with ESMTPSA id 92C47160050; Sat, 17 Aug 2019 21:46:01 +0000 (UTC) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) From: Mark Andrews In-Reply-To: Date: Sun, 18 Aug 2019 07:45:58 +1000 Cc: Paul Ebersman , Melinda Shore , ADD Mailing list , Joe Abley Content-Transfer-Encoding: quoted-printable Message-Id: <43F0291E-1471-4747-9EC4-703013DA99D9@isc.org> References: <09178E42-08B2-4958-A1C8-AF507AEE8834@fugue.com> <0BDD4F7F-7301-476A-80DA-0CC84EE4557D@fugue.com> <6698db4f-89ff-e5be-09a5-eb544f76ebc9@nostrum.com> <20190817170031.6F71C1691138@fafnir.remote.dragon.net> <20190817205517.1128E16936B5@fafnir.remote.dragon.net> To: Rob Sayre X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: Re: [Add] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 17 Aug 2019 21:46:06 -0000 > On 18 Aug 2019, at 7:07 am, Rob Sayre wrote: >=20 >=20 >=20 > On Sat, Aug 17, 2019 at 1:55 PM Paul Ebersman = wrote: > jabley> These attacks use the DNS, but they are not attacking the DNS > jabley> protocol; they are attacking platforms that use the DNS. >=20 > sayrer> That sentence doesn't make sense to me. Isn't this precisely = the > sayrer> kind of attack TLS and HTTPS mitigate? See RFC 1958, section = 6: > sayrer> "Endpoints should not depend on the confidentiality or = integrity > sayrer> of the carriers."=20 > sayrer> <[[https://tools.ietf.org/html/rfc1958#section-6]]> >=20 > No, the point is if the device OS doesn't protect the code the device > runs or allows configuration file changes, you can't secure the > device. That's what the article you referenced is highlighting. >=20 > No, it's pointing out that the router may be compromised, and that the = endpoints shouldn't trust it. >=20 >=20 > sayrer> Yes, it seems like DNSSEC does provide integrity and > sayrer> authentication in some sense, but it's vulnerable to tampering > sayrer> on the wire (intentional or not). >=20 > How is DNSSEC vulnerable to tampering? >=20 > "Most bizarrely perhaps, is that DNSSEC provides no end-to-end = security. Your browser or OS still communicates with your resolver using = regular queries, relying on a single unauthenticated bit to "request" = validation. It's as if LAN/wifi-level abuse wasn't a concern at all, or = that public resolvers (like OpenDNS and Google Public DNS) didn't = exist.=E2=80=9D > DNSSEC was *designed* to be validated on the end device. It really = isn=E2=80=99t hard to do. Its achievable using the stub resolver = shipped in BSD 4.2. Thats a 30 year old stub resolver. It does require = the recursive resolver to *also* support DNSSEC and will MOSTLY work = when that recursive server is NOT validating. The corner cases require = that the recursive server also validates. You can quote DISINFORMATION all you like. It doesn=E2=80=99t make it = correct. > Or an attempt to address the range of statements and questions you = pose. > I don't know what "part of the internet" you inhabit, but on IETF = lists, > we try to achieve consensus by responding to what's written. >=20 > Sure. I think a close reading of the list will lead you to predict a = result that resembles this meeting: = . >=20 > thanks, > Rob=20 > --=20 > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add --=20 Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka@isc.org From nobody Sat Aug 17 14:48:31 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 759AF1200BA for ; Sat, 17 Aug 2019 14:48:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7wWvUtY5rYRS for ; Sat, 17 Aug 2019 14:48:28 -0700 (PDT) Received: from smtp.guxx.net (nyx.guxx.net [85.10.208.173]) by ietfa.amsl.com (Postfix) with ESMTP id 188C8120041 for ; Sat, 17 Aug 2019 14:48:28 -0700 (PDT) Received: by nyx.guxx.net (Postfix, from userid 107) id F05A85F42D40; Sat, 17 Aug 2019 23:48:26 +0200 (CEST) Received: from [172.19.152.61] (p54B8ABDF.dip0.t-ipconnect.de [84.184.171.223]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by nyx.guxx.net (Postfix) with ESMTPSA id B90375F40D96; Sat, 17 Aug 2019 23:48:24 +0200 (CEST) From: "Ralf Weber" To: "Rob Sayre" Cc: "Melinda Shore" , "Paul Ebersman" , "ADD Mailing list" , "Joe Abley" Date: Sat, 17 Aug 2019 23:48:24 +0200 X-Mailer: MailMate (1.12.5r5635) Message-ID: In-Reply-To: References: <09178E42-08B2-4958-A1C8-AF507AEE8834@fugue.com> <0BDD4F7F-7301-476A-80DA-0CC84EE4557D@fugue.com> <6698db4f-89ff-e5be-09a5-eb544f76ebc9@nostrum.com> <20190817170031.6F71C1691138@fafnir.remote.dragon.net> <20190817205517.1128E16936B5@fafnir.remote.dragon.net> <9FB124AF-79CB-48B9-87BB-DC6F2D532F10@fl1ger.de> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [Add] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 17 Aug 2019 21:48:30 -0000 Moin! On 17 Aug 2019, at 23:39, Rob Sayre wrote: > On Sat, Aug 17, 2019 at 2:33 PM Ralf Weber wrote: > >> As said before DNSSEC and DoH/DoT are complementary and solve different >> problems. >> > > Agreed. But I think people are looking for a way to break DoH/DoT, in a > well-meaning way. Can’t speak for people, but I’m looking for a way to deploy DoH (DoT never was a problem) so that we get the benefits of our current distributed architecture plus the benefits of encryption. > So, bringing up DNSSEC is actually kind of a distraction. Sigh. There have been, and there are still are people working on DNSSEC deployment. IMHO it something we have to do and not a distraction. So long -Ralf —-- Ralf Weber From nobody Sat Aug 17 15:22:32 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9BD741200BA for ; Sat, 17 Aug 2019 15:22:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yt85PQ3oXaCu for ; Sat, 17 Aug 2019 15:22:27 -0700 (PDT) Received: from mail-vs1-xe29.google.com (mail-vs1-xe29.google.com [IPv6:2607:f8b0:4864:20::e29]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3D0FD120072 for ; Sat, 17 Aug 2019 15:22:27 -0700 (PDT) Received: by mail-vs1-xe29.google.com with SMTP id 66so974044vsz.8 for ; Sat, 17 Aug 2019 15:22:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=j3UI0ibe6NGQ+oGBH+9CbBzH+oi4Z0QwHdRW9JRQ5hs=; b=cB2aYPcccnDlzmR7mkt/tMH02nQfIcTbfZ5k4/JwWPqKZKIFQUo3jxB0ozn1V9hILJ pCecRA8/VSt74P7rbime2KQOa3antyFFPsKEhWifdnO0dPjeUEIlmIyI0hceC1LmOyas WhikC1nMh/VwAElCWZxZpwTgp5Hkly/zVD/0S2NDv9Je37bE14a1gq5ogP0sKzHaTahc E37agoI7jWQCzYXUTh4LvbJOzX1oFzRhxjtAnv/XGEq5wxR8MbHRlexx090Ccy2FPQFm EgdVHYG+olp+U58CWghcWRJq+CxR4qWLpZX27czQl9v0kZJwIoBWE82bo3Y0G7MHoYVM jwlg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=j3UI0ibe6NGQ+oGBH+9CbBzH+oi4Z0QwHdRW9JRQ5hs=; b=mdKHWPfD8RZ98DDeP0jCUZs51fqs1SpaVzD0Yh/6WqDMBZ68ebDEi+Fjllk1i8iVXj SoouMI0R/jOSb9EdTHF2j1MjY0SrBctyIVy32ciSbfAJ0tHRjzy3XdkjilQkISVoh6w7 R6LLA8x+0fg38DaICd0vae1aDx21mJrvlCHxnwqd2vcD+iVTO8hhSXbgcsHvgAhDZlEQ a8+louaHetbGxACjntVYDlbla7giezzacfAMiG/5nmB7g0TJQ7SXXBd+EIhw7qyZkIlZ AmoRIQHjhNL0aSfFhXq4yBGlSgQKSt/azLLozlDWGzf5/bkt+cKJ7iW/T2RtQBsjvcez ov2A== X-Gm-Message-State: APjAAAXKs0c0oTcs94ZTa67/vW/yjcv8bM5MVz8sV5wrWWjSkD3fXY28 ZyIx3s4Y3e5TlGCdIeXJ8BoRxpOhKWj83+A+NRw= X-Google-Smtp-Source: APXvYqz69F9lU+L49DQEcyWb8NfVNSZzpIkbNdWj53XGqcjprxYKaUGF4+8yixkMNwilt4xfXllriB7Gsbg5xcaIcqM= X-Received: by 2002:a67:d812:: with SMTP id e18mr10681308vsj.199.1566080546191; Sat, 17 Aug 2019 15:22:26 -0700 (PDT) MIME-Version: 1.0 References: <09178E42-08B2-4958-A1C8-AF507AEE8834@fugue.com> <0BDD4F7F-7301-476A-80DA-0CC84EE4557D@fugue.com> <6698db4f-89ff-e5be-09a5-eb544f76ebc9@nostrum.com> <20190817170031.6F71C1691138@fafnir.remote.dragon.net> <20190817205517.1128E16936B5@fafnir.remote.dragon.net> In-Reply-To: From: Brian Dickson Date: Sat, 17 Aug 2019 18:22:03 -0400 Message-ID: To: Rob Sayre Cc: Paul Ebersman , Melinda Shore , ADD Mailing list , Joe Abley Content-Type: multipart/alternative; boundary="000000000000a53eba0590578a87" Archived-At: Subject: Re: [Add] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 17 Aug 2019 22:22:31 -0000 --000000000000a53eba0590578a87 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Aug 17, 2019, at 5:07 PM, Rob Sayre wrote: On Sat, Aug 17, 2019 at 1:55 PM Paul Ebersman wrote: > > sayrer> Yes, it seems like DNSSEC does provide integrity and > sayrer> authentication in some sense, but it's vulnerable to tampering > sayrer> on the wire (intentional or not). > > How is DNSSEC vulnerable to tampering? "Most bizarrely perhaps, is that DNSSEC provides no end-to-end security. Your browser or OS still communicates with your resolver using regular queries, relying on a single unauthenticated bit to "request" validation. It's as if LAN/wifi-level abuse wasn't a concern at all, or that public resolvers (like OpenDNS and Google Public DNS) didn't exist." (I=E2=80=99m not sure if you read any of the comments on that article. They= provide some clues regarding client validation. Still, it seems you may need a bit more clarity on client validation, which I=E2=80=99m happy to provide below= .) DNS resolvers which are DNSSEC aware are able to perform validation, and signal successful validation with the AD bit. However, clients do NOT need to depend on this, and in fact DNSSEC was designed so that resolver validation is technically optional. DNS clients can signal their awareness of DNSSEC with EDNS and having the DO bit set. When this is done, extra DNSSEC responses are returned alongside the regular DNS responses. This means a DNSSEC-aware client has everything it needs to independently validate the answer, as long as it already has the DNSSEC delegation information already. The client can obtain the delegation chain of DNSSEC data from its resolver if it doesn't already have it. Long answer short: DNSSEC does not rely on unsigned DNS responses over unprotected communication on the last mile, and is in fact designed from the ground up to support client validation, which does not require protection of the last mile itself. DNSSEC protects the DNS data over the last mile from being tampered with, or more precisely, allows the client to detect any tampering. The only reasons I can see for not validating are blockers on the OS API for DNS, and/or implementers of clients that don't have enough cycles or have not prioritized doing so. There are several open source resolver implementations of validation, whose code potentially could be integrated depending on licensing limitations. Similarly it is quite feasible to deploy forwarding-only validating resolvers on hosts to protect the last mile while benefiting from the use of the shared upstream resolver=E2=80=99s cache. Closer integration to the = app makes more sense in the long term. All of the important details are in RFC 4035, in section 4.9: https://tools.ietf.org/html/rfc4035#section-4.9 I recommend you read that section at a minimum. It is the "lingua franca" for talking about DNSSEC, particularly for stub (client) context. Brian --000000000000a53eba0590578a87 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable

On Aug 17, 2019, at 5:07 PM, Rob Sayre <sayrer@gmail.com> wrote:


On Sat, Aug 17, 2019 at 1:55 PM Paul Ebersman <list-add@dragon.net> wrote:

sayrer> Yes, it seems like DNSSEC does provide integrity and
sayrer> authentication in some sense, but it's vulnerable to tamperi= ng
sayrer> on the wire (intentional or not).

How is DNSSEC vulnerable to tampering?

&qu= ot;Most bizarrely perhaps, is that DNSSEC provides no end-to-end security. = Your browser or OS still communicates with your resolver using regular quer= ies, relying on a single unauthenticated bit to "request" validat= ion. It's as if LAN/wifi-level abuse wasn't a concern at all, or th= at public resolvers (like OpenDNS and Google Public DNS) didn't exist.&= quot;


(I=E2=80=99= m not sure if you read any of the comments on that article. They provide so= me clues regarding client validation. Still, it seems you may need a bit mo= re clarity on client validation, which I=E2=80=99m happy to provide below.)=

DNS resolvers which are DNSSEC aware are able to = perform validation, and signal successful validation with the AD bit. Howev= er, clients do NOT need to depend on this, and in fact DNSSEC was designed = so that resolver validation is technically optional.

DNS clients can signal their awareness of DNSSEC with EDNS and having th= e DO bit set. When this is done, extra DNSSEC responses are returned alongs= ide the regular DNS responses. This means a DNSSEC-aware client has everyth= ing it needs to independently validate the answer, as long as it already ha= s the DNSSEC delegation information already. The client can obtain the dele= gation chain of DNSSEC data from its resolver if it doesn't already hav= e it.

Long answer short: DNSSEC does not rely on u= nsigned DNS responses over unprotected communication on the last mile, and = is in fact designed from the ground up to support client validation, which = does not require protection of the last mile itself. DNSSEC protects the DN= S data over the last mile from being tampered with, or more precisely, allo= ws the client to detect any tampering. The only reasons I can see for not v= alidating are blockers on the OS API for DNS, and/or implementers of client= s that don't have enough cycles or have not prioritized doing so.=C2=A0=

There are several open source resolver implementa= tions of validation, whose code potentially could be integrated depending o= n licensing limitations. Similarly it is quite feasible to deploy forwardin= g-only validating resolvers on hosts to protect the last mile while benefit= ing from the use of the shared upstream resolver=E2=80=99s cache. Closer in= tegration to the app makes more sense in the long term.

All of the important details are in RFC 4035, in section 4.9:=C2=A0https://tools.iet= f.org/html/rfc4035#section-4.9

I recommend you= read that section at a minimum. It is the "lingua franca" for ta= lking about DNSSEC, particularly for stub (client) context.

<= /div>
Brian


--000000000000a53eba0590578a87-- From nobody Sat Aug 17 15:27:33 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C641C1200C5 for ; Sat, 17 Aug 2019 15:27:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kdjj3Mqnmw-5 for ; Sat, 17 Aug 2019 15:27:29 -0700 (PDT) Received: from mail-vs1-xe2e.google.com (mail-vs1-xe2e.google.com [IPv6:2607:f8b0:4864:20::e2e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C50BD120072 for ; Sat, 17 Aug 2019 15:27:29 -0700 (PDT) Received: by mail-vs1-xe2e.google.com with SMTP id i7so6023415vsp.0 for ; Sat, 17 Aug 2019 15:27:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=EBroIrNTlrG2a1v4cTX9lpZkyGoW96Sq5/mB0PO7Boo=; b=SGjdug71xsxOLO7qyPHXCOUtpN8yF5+T5FR1ZlemAs+B7b8fDB2fj8kQ18kikEE4BA X8gyFubWVKmZ7s9k4v4OJ42dNHwOm3EH6rBpbfWijH1XyiskYrrrwwgYkYHZpTTvTF0J BPv/Fw34IbKad1D7SPC5db2uZ8SOe6BYobKVSpYNrKbBsJhvn3nOK3eTvOJoZR0u902W SWW7o/XRyu2gsAcT9/WH87knw3IocsW/Ct8EmdzZ13/qo8T7RbaQISyJB1EOYLKBplTH ilkjzXBSx+iK15dElGsTMgcwDvXeVdBSdbk1g1mW5cleQCZr84gkw+VAj9NAmanyNQAw OWBQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=EBroIrNTlrG2a1v4cTX9lpZkyGoW96Sq5/mB0PO7Boo=; b=HPXtKuII9I6V7tMZDXE3A/gikZuqK0DRyw9VLHY1G1tCF/lCkQVCF4UyaQJJTOfWH8 +3HJewqRuBPRKdoHwmfCw6lDjlRKhsGxdZnz2wyWy2jicbZY43C0ZRYRSOAMIYRbiEPu EnXPzqO3Az6jAOwswP+N+0rxOtdpc0HcBfcRISg48vmL0pU9rzkBuGkQnMWiKiPtwC0b oGxcPnYu0rLl5lQmnjaNhYgiLXTNSAVFtNHy6sZZNzvmVdkTIdhwTqVJUS7DXONeafd/ CbbHmf/5lmnLbM4QCgJgXah4HMJlv8Gr/FgCuP6l5eCPsT4LTyZ2uUlDXcjjqd/SJgud zJYQ== X-Gm-Message-State: APjAAAUMHFNUhj6zU/9LfbZNUhPPTokwoC2xv1Ydq0jttWnA3hjLfQoU oeRO9DSUFiUYJU0J+FuZWyZQLz3mHIu4A248D8c= X-Google-Smtp-Source: APXvYqyt+zMzdJhgmPN4DBhd1056ouEYrbxk7uM5gg9XAPV6WxnWZN+VNblH6ZiZCg2SxaLynVuFDMMVfjfYMWhJRIc= X-Received: by 2002:a67:6d06:: with SMTP id i6mr10222746vsc.5.1566080848906; Sat, 17 Aug 2019 15:27:28 -0700 (PDT) MIME-Version: 1.0 References: <09178E42-08B2-4958-A1C8-AF507AEE8834@fugue.com> <0BDD4F7F-7301-476A-80DA-0CC84EE4557D@fugue.com> <6698db4f-89ff-e5be-09a5-eb544f76ebc9@nostrum.com> <20190817170031.6F71C1691138@fafnir.remote.dragon.net> In-Reply-To: From: Brian Dickson Date: Sat, 17 Aug 2019 18:27:05 -0400 Message-ID: To: Rob Sayre Cc: Joe Abley , Melinda Shore , Paul Ebersman , ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000b04e690590579cc6" Archived-At: Subject: Re: [Add] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 17 Aug 2019 22:27:32 -0000 --000000000000b04e690590579cc6 Content-Type: text/plain; charset="UTF-8" On Sat, Aug 17, 2019 at 5:36 PM Rob Sayre wrote: > > > On Sat, Aug 17, 2019 at 2:18 PM Rob Sayre wrote: > >> On Sat, Aug 17, 2019 at 1:58 PM Brian Dickson < >> brian.peter.dickson@gmail.com> wrote: >> >>> >>> Consider how these attacks would be mitigated if the host performed >>> DNSSEC validation and the domain was DNSSEC signed >>> >> >> DNSSEC adoption is directly correlated with use of Google's centralized >> DNS service. >> >> >> > > I was brought to my attention that these estimates may be a bit on the > optimistic side. > > "...maybe 20% of recursives may have 'adopted' validation. Sadly, only > about 1% of zones have really adopted and signed." > > I don't want to over-commit in this regard, but that 1% value may be changing substantially in the relatively near future. (Substantial would be on the order of increasing that from 1% to on the order of 40%, and relatively near is likely measured months.) Hopefully this will provide motivation for anyone considering their own participation in the DNSSEC ecosystem, either as a resolver operator, zone owner, zone operator, or client developer. (Browser participants, I am hoping you take note.) Brian --000000000000b04e690590579cc6 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Sat, Aug 17, 2019 at 5:36 PM Rob S= ayre <sayrer@gmail.com> wrote= :


On Sat, Aug 17, 2019 at 2:18 PM Rob Sayre <sayrer@gmail.com> w= rote:
On Sat, Aug 17, 2019 at 1:58 PM Brian Dickson <= ;brian.p= eter.dickson@gmail.com> wrote:
<= blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-l= eft:1px solid rgb(204,204,204);padding-left:1ex">
Consider how these attacks would be mitigated if the host perfo= rmed DNSSEC validation and the domain was DNSSEC signed

DNSSEC adoption is directly correlated with use of= Google's centralized DNS service.


I was = brought to my attention that these estimates may be a bit on the optimistic= side.

"...maybe 20% of recursives may have &= #39;adopted' validation. Sadly, only about 1% of zones have really adop= ted and signed."

I don't want to over-commit in this regard, but that 1% val= ue may be changing substantially in the relatively near future.
(= Substantial would be on the order of increasing that from 1% to on the orde= r of 40%, and relatively near is likely measured months.)

Hopefully this will provide motivation for anyone considering their= own participation in the DNSSEC ecosystem, either as a resolver operator, = zone owner, zone operator, or client developer.
(Browser particip= ants, I am hoping you take note.)

Brian
--000000000000b04e690590579cc6-- From nobody Sat Aug 17 15:29:56 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 00D321200C5 for ; Sat, 17 Aug 2019 15:29:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QQdyNXBfWoqP for ; Sat, 17 Aug 2019 15:29:52 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 83F9C120072 for ; Sat, 17 Aug 2019 15:29:52 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 90511BE53; Sat, 17 Aug 2019 23:29:50 +0100 (IST) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jSZ-1-8_pUAh; Sat, 17 Aug 2019 23:29:49 +0100 (IST) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id F40FBBE51; Sat, 17 Aug 2019 23:29:48 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1566080989; bh=bT5/3e3z1Na/ejKCilOTryJYzHHxT0S4DSZjxg/+Uyc=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From; b=rwZaoZoK32PbCfK9N2GqV8BocgkxUj66jPIpden7VctCm3GW3+23ATgY/w5g9YD23 aW8kV0FNd0kWSFO94Q7R/fKg3yIEfpiVZOk/Vri57c7qjdsXsrQvL0XwkPqRPbNhvk XdW770/2dzimEti1cebxka4JoY3ljmB4KJScv+48= To: Brian Dickson , Rob Sayre Cc: Melinda Shore , Paul Ebersman , ADD Mailing list , Joe Abley References: <0BDD4F7F-7301-476A-80DA-0CC84EE4557D@fugue.com> <6698db4f-89ff-e5be-09a5-eb544f76ebc9@nostrum.com> <20190817170031.6F71C1691138@fafnir.remote.dragon.net> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: <0d9c20b9-ea6e-4098-68bd-8b6c3ad7c91f@cs.tcd.ie> Date: Sat, 17 Aug 2019 23:29:47 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="wN9VQKCZ1NU0kQxFEGRou0jHROBiKCAxH" Archived-At: Subject: Re: [Add] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 17 Aug 2019 22:29:55 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --wN9VQKCZ1NU0kQxFEGRou0jHROBiKCAxH Content-Type: multipart/mixed; boundary="TwEPGat4qziUzfM36bndQwmRps9GmBtEH"; protected-headers="v1" From: Stephen Farrell To: Brian Dickson , Rob Sayre Cc: Melinda Shore , Paul Ebersman , ADD Mailing list , Joe Abley Message-ID: <0d9c20b9-ea6e-4098-68bd-8b6c3ad7c91f@cs.tcd.ie> Subject: Re: [Add] Participation References: <09178E42-08B2-4958-A1C8-AF507AEE8834@fugue.com> <0BDD4F7F-7301-476A-80DA-0CC84EE4557D@fugue.com> <6698db4f-89ff-e5be-09a5-eb544f76ebc9@nostrum.com> <20190817170031.6F71C1691138@fafnir.remote.dragon.net> In-Reply-To: --TwEPGat4qziUzfM36bndQwmRps9GmBtEH Content-Type: multipart/mixed; boundary="------------76EF062A4ABB5DF972B16F09" Content-Language: en-GB This is a multi-part message in MIME format. --------------76EF062A4ABB5DF972B16F09 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hiya, On 17/08/2019 23:27, Brian Dickson wrote: > I don't want to over-commit in this regard, but that 1% value may be > changing substantially in the relatively near future. > (Substantial would be on the order of increasing that from 1% to on the= > order of 40%, and relatively near is likely measured months.) That'd be great. I'd be v. interested in details as and when possible, on or offlist. S. --------------76EF062A4ABB5DF972B16F09 Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------76EF062A4ABB5DF972B16F09-- --TwEPGat4qziUzfM36bndQwmRps9GmBtEH-- --wN9VQKCZ1NU0kQxFEGRou0jHROBiKCAxH Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAl1Yf9sACgkQWrL68XsX K+pWNRAAn42RJzj3nBk/kCzwFwa7FUC9I3R2lFo8z3FCOGLyTlSYRcp76V6REaLR 0155C47gOiqhFrH4gPw39bQ/xCQ94iUzpPprZGeHnj52yumdoyjNGt8f73C19kie gdPEbBqxnSzs3ucHtzLQcZnA8pPyx1N/PPU+hUxNvrJ0qShIo7OkMo6YOv40KvH3 N+jFSL2dm+vVJSAW/jyAjfvlSgU3NXfBvgSwjArb9vAhhrbt58WsgTudTDkBydB9 H0w7x1sBoilbDJvg4E6umcAu2lh8hzUinbFKV8wFWWt3+jvTFaxSYaDZIMKRy+xW /4Mz4OkG9nudVCgbx6DY8c1ENgRSW5XraSMcquNJ0yVdsU24viPsIAiOlY1mDaD+ cEgSOSLUJIUYPFXIsmMGTAytiW7a0fEGlQ/htVuWZRL7ePqIsLybnOJ3H+FLqPFc r9IIt7frnkL3qfc0LC9WJB4Hx2jqefJURYW7TCrtYBuecQTsvjhTz6hiaJG++8be cFGsOgYHRkDRQVK+F9bTjQ5mARIKQc6Yh68J6C/vn4Zx8nyfAF5Lvu0csGZHhv9y iL88tuqBnBEEc/jqZ4MQMTQDjrzz4+w0kIhDGvc7hshyQ96nPjURP/9rS39wPxgf jQUIaM1tLgO101zZae+MdYwt9lLvbPTxN03jm2YZO+dJ5fdTgmM= =+vg9 -----END PGP SIGNATURE----- --wN9VQKCZ1NU0kQxFEGRou0jHROBiKCAxH-- From nobody Sat Aug 17 15:51:00 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C1B65120147 for ; Sat, 17 Aug 2019 15:50:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cns5BQdVXSXP for ; Sat, 17 Aug 2019 15:50:56 -0700 (PDT) Received: from mail-vs1-xe29.google.com (mail-vs1-xe29.google.com [IPv6:2607:f8b0:4864:20::e29]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 852AA1200E5 for ; Sat, 17 Aug 2019 15:50:56 -0700 (PDT) Received: by mail-vs1-xe29.google.com with SMTP id b187so786769vsc.9 for ; Sat, 17 Aug 2019 15:50:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=vvSKT2CYYSl2ZqqdvP4EBQ49Rc18eAeEYWzGdV0E9vI=; b=fSWh41bv+cu0bpg6S2RYwAwsMLW0SJKbOmRCB5mmnLr0s9WHcEr5yKfO0JJgrSlZKc P22SxKTrLEraTmgwlbgOFGX/h1VttJwHCZVi1vss23Qp5uQgRDm25EaFGIhG+kyMAu5s zXlKdh8XegonCxJkBICZ7LdbfvlCZA4nFBsfcDzD8dGP9jh7OsQCVJruVoX2XjifJTQM P6eV1ylArUCxjrSVYzogQ+rR4yNJra59T4/d6w2slndPyzHw8ht6HMMRoL7jhQqkhH03 hu7kSxTmAVfmUQqnkdAkSp46dCq0TxVB0S3ZyCt+xsXNfvut86HbqZPhZI+gFBP9EorI S5zA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=vvSKT2CYYSl2ZqqdvP4EBQ49Rc18eAeEYWzGdV0E9vI=; b=HUVhtnH0OGMKyWtdPi/f/0DAu42+S1LxE/1Yticbcutp+1kF6ySy5D+s3btwsblhBE JkJGh5DSHmg2m7XZgpV2iqSnDL1Z7MG3a91v3ddEXfsiYvnyUhxqwIsn3ktcA+wPSeZV VhqPPVfQkwN+CyOjO6vBL0cKgOZpn7fL2sFByQ0aJjD9q/0gRr6fQydQbp6dpnfsaMt/ wAl+OGteWzAP2FAVFxqN3QeJ/XjN2VsADw5xtGAsQxmOa5eSwTebbjhY1Ve++NxCzV4g 5H7IfCSzvJ2V791ER8ia+6xRitztQa+/I8vT39R8lw9g1xzoF0bm3DayaGtG/KsftjGg uLXw== X-Gm-Message-State: APjAAAWiOjnyfCLaAuWQjRTLn7YpdEBTdaXUhsKhW92DXsLb3oCCo+/W HEWsOhanaLQDj5VJGWzQDsolQvWTudtob6ohK7s= X-Google-Smtp-Source: APXvYqzsQ1sbYqcEXOGyeB+S+KXlzygXxo3uGFnXwKp3JcUJxUfpBmsvWHWANzFwW+AXb7baVFkwM8FnkESfwvopRWg= X-Received: by 2002:a67:d812:: with SMTP id e18mr10723735vsj.199.1566082255710; Sat, 17 Aug 2019 15:50:55 -0700 (PDT) MIME-Version: 1.0 References: <09178E42-08B2-4958-A1C8-AF507AEE8834@fugue.com> <0BDD4F7F-7301-476A-80DA-0CC84EE4557D@fugue.com> <6698db4f-89ff-e5be-09a5-eb544f76ebc9@nostrum.com> <20190817170031.6F71C1691138@fafnir.remote.dragon.net> <20190817205517.1128E16936B5@fafnir.remote.dragon.net> <9FB124AF-79CB-48B9-87BB-DC6F2D532F10@fl1ger.de> In-Reply-To: From: Brian Dickson Date: Sat, 17 Aug 2019 18:50:32 -0400 Message-ID: To: Rob Sayre Cc: Ralf Weber , Melinda Shore , Paul Ebersman , ADD Mailing list , Joe Abley Content-Type: multipart/alternative; boundary="0000000000008a6dc2059057f074" Archived-At: Subject: Re: [Add] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 17 Aug 2019 22:50:59 -0000 --0000000000008a6dc2059057f074 Content-Type: text/plain; charset="UTF-8" On Sat, Aug 17, 2019 at 5:39 PM Rob Sayre wrote: > On Sat, Aug 17, 2019 at 2:33 PM Ralf Weber wrote: > >> As said before DNSSEC and DoH/DoT are complementary and solve different >> problems. >> > [...] > > But I think people are looking for a way to break DoH/DoT, in a > well-meaning way. > I'm not sure if you are counting me in the population of "people", but if so, you are WAY wrong, or at least mistaken on intent. I'm looking for ways of breaking involuntary change of DNS resolver choice. This applies to both managed and unmanaged devices, hosts, virtual hosts, infrastructure, and those of any partner companies, sister companies, subsidiaries, outsource companies, or customers. That the target (ie new choice of) DNS resolver might happen to be doing DoH is completely irrelevant. What matters is that the resolver is changed, not the protocol being used. Incidentally, I am strongly in favor of upgrading all DNS client connections-to-resolvers in our larger ecosystem, to be DoT. If it is not possible to convince browsers to do DoT, the alternative may be in-host proxy services that do DoH to DoT conversion. Those are nearly trivial to implement. Mostly choosing DoT over DoH is about not adding any HTTP junk to DNS resolution on the server side. Our DNS servers do not do HTTP anything. We want the greatest amount of flexibility in choice of servers, and the smallest available attack surface. Adding TLS to a regular DNS server (which is what DoT amounts to) is the simplest option. This is the exact opposite of wanting to break DoH/DoT. Wanting to continue to operate infrastructure for DNS resolution, and maintain (or add) existing DNS-based toolsets, is a significant driver in this philosophy. When you operate DNS infrastructure at scale, and offer DNS services at scale as well, any attempt by any software vendor to interfere with that, regardless of motivation or intention, is going to provoke a strong negative response, and justifiably so. So, in short, please stop what folks like I am doing, as being anti-encryption or anti-DoH/DoT, because it isn't. Brian --0000000000008a6dc2059057f074 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable



On Sat, Aug 17, 2019 at 5:39 PM Rob Sayre <sayrer@gmail.com> wrote:
On Sat, Aug 17, 2019 at 2:33 PM Ralf Weber <dns@fl1ger.de> wrote:
As said before DNSSEC and DoH/DoT are complementary and solve different
problems.
[.= ..]=C2=A0
=C2=A0
<= /div>
But= I think people are looking for a way to break DoH/DoT, in a well-meaning w= ay.
=C2=A0
I'm not s= ure if you are counting me in the population of "people", but if = so, you are WAY wrong, or at least mistaken on intent.

=
I'm looking for ways of breaking involuntary change of DNS resolve= r choice. This applies to both managed and unmanaged devices, hosts, virtua= l hosts, infrastructure, and those of any partner companies, sister compani= es, subsidiaries, outsource companies, or customers.

That the target (ie new choice of) DNS resolver might happen to be doing= DoH is completely irrelevant. What matters is that the resolver is changed= , not the protocol being used.

Incidentally, I am = strongly in favor of upgrading all DNS client connections-to-resolvers in o= ur larger ecosystem, to be DoT.

If it is not possi= ble to convince browsers to do DoT, the alternative may be in-host proxy se= rvices that do DoH to DoT conversion. Those are nearly trivial to implement= .

Mostly choosing DoT over DoH is about not adding= any HTTP junk to DNS resolution on the server side. Our DNS servers do not= do HTTP anything. We want the greatest amount of flexibility in choice of = servers, and the smallest available attack surface.

Adding TLS to a regular DNS server (which is what DoT amounts to) is the = simplest option.

This is the exact opposite of wan= ting to break DoH/DoT.

Wanting to continue to oper= ate infrastructure for DNS resolution, and maintain (or add) existing DNS-b= ased toolsets, is a significant driver in this philosophy.

When you operate DNS infrastructure at scale, and offer DNS servic= es at scale as well, any attempt by any software vendor to interfere with t= hat, regardless of motivation or intention, is going to provoke a strong ne= gative response, and justifiably so.

So, in short,= please stop what folks like I am doing, as being anti-encryption or anti-D= oH/DoT, because it isn't.

Brian
--0000000000008a6dc2059057f074-- From nobody Sat Aug 17 16:13:11 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A631812006D for ; Sat, 17 Aug 2019 16:13:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Ah0YUWYPqwbX for ; Sat, 17 Aug 2019 16:13:08 -0700 (PDT) Received: from mail-io1-xd2e.google.com (mail-io1-xd2e.google.com [IPv6:2607:f8b0:4864:20::d2e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0B9691200E5 for ; Sat, 17 Aug 2019 16:13:08 -0700 (PDT) Received: by mail-io1-xd2e.google.com with SMTP id l7so13510990ioj.6 for ; Sat, 17 Aug 2019 16:13:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=1hfE2oESpT4FPiaynIZQLUpVKwcfKrIwwZzJtbqfjms=; b=Bz7Zj4+m5rT4NxmmSU16JYnmlLHYqwQiSvFBy31+2SZMB6hoX4Xh+AnvSgiBM80JJm 1vdfLBJPHXyJHf7Xuwh9Ni+g9ZttxNPsd4voQWgM/mF+K6LxfpUn94x9bQIAUyclCZTE G0AkpZ1nRg+KBhyMEQt2o7puCJe358nqbXZ67hn66jj13CJthnwcX4yRc0zI35wzoZsI XftALqI/YewEQJYJU/494NrPdDsJhrtOlDlPUGfsLZ8qkkBOT3DnYylwFSU8LaAuRuyi 5TJobdo3B6a/UXhS0GL7sGi25PS48Wmu20cINL0znTggQnhFurtYsrPfmz3pX4+P1luE sDBA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=1hfE2oESpT4FPiaynIZQLUpVKwcfKrIwwZzJtbqfjms=; b=ixsxXYhPrr9q0z1quFOgU6ydV/k0Wd632ZIy+owEdhipN+dHG5hEmapeQGVQigR+1y leOAF7DHeXb8lNNTPXp3Q75UnbPFNu371nPjQl4AK/zieGdDJ8NGlwSIDB8AdAYAG4qk B3GAFNvds4xr3guT6R60giUWCcYKHDHOHWuW1Z9hWuPlXO4sv3u7k1ImcQeBf8PR94aX H853ogjRhG4KE4SJ1+F3Y4WMGPj479dyIPOLd4m0eTJ91rr6x5hmXadoCWEGnJ+BtLXd TG3ayEWTTQa6PQc3pz6CarT9weSEZQU8rOEJXh1Ym9A73DUEJlcDKIuy6LP/tWDsC+SQ aTAQ== X-Gm-Message-State: APjAAAWLbl+V2s9CZprPzlv0UMEGHcMjfoNyIzelN2NTmVestfJCTbf4 pJfMlMQjhC5i5bI8x89MiFtnAABXyZK22S+yFkg= X-Google-Smtp-Source: APXvYqxulumS95hvqclySvHBiG/SSVITdp1WIDnISt8zhKtNzSg5iox0p9zeXxMNMPqGaIoboBOJGk4+WgXdbqs+6Nk= X-Received: by 2002:a6b:7e07:: with SMTP id i7mr9570948iom.254.1566083587161; Sat, 17 Aug 2019 16:13:07 -0700 (PDT) MIME-Version: 1.0 References: <09178E42-08B2-4958-A1C8-AF507AEE8834@fugue.com> <0BDD4F7F-7301-476A-80DA-0CC84EE4557D@fugue.com> <6698db4f-89ff-e5be-09a5-eb544f76ebc9@nostrum.com> <20190817170031.6F71C1691138@fafnir.remote.dragon.net> <20190817205517.1128E16936B5@fafnir.remote.dragon.net> <43F0291E-1471-4747-9EC4-703013DA99D9@isc.org> In-Reply-To: <43F0291E-1471-4747-9EC4-703013DA99D9@isc.org> From: Rob Sayre Date: Sat, 17 Aug 2019 16:12:55 -0700 Message-ID: To: Mark Andrews Cc: Paul Ebersman , Melinda Shore , ADD Mailing list , Joe Abley Content-Type: multipart/alternative; boundary="000000000000e6c5f10590583f34" Archived-At: Subject: Re: [Add] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 17 Aug 2019 23:13:10 -0000 --000000000000e6c5f10590583f34 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Sat, Aug 17, 2019 at 2:46 PM Mark Andrews wrote: > > You can quote DISINFORMATION all you like. It doesn=E2=80=99t make it co= rrect. > After 14 years or so, I think DNSSEC adoption rates speak for themselves. thanks, Rob --000000000000e6c5f10590583f34 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Sat, Aug 17, 2019 at 2:46 PM Mark = Andrews <marka@isc.org> wrote:

You can quote DISINFORMATION all you like.=C2=A0 It doesn=E2=80=99t make it= correct.

After 14 years or so, I think= DNSSEC adoption rates speak for themselves.

thank= s,
Rob
--000000000000e6c5f10590583f34-- From nobody Sat Aug 17 16:19:08 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 47690120071 for ; Sat, 17 Aug 2019 16:19:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9ZPBUm67m5Ba for ; Sat, 17 Aug 2019 16:19:03 -0700 (PDT) Received: from mail-io1-xd2a.google.com (mail-io1-xd2a.google.com [IPv6:2607:f8b0:4864:20::d2a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A9C3512006D for ; Sat, 17 Aug 2019 16:19:03 -0700 (PDT) Received: by mail-io1-xd2a.google.com with SMTP id i22so13519890ioh.2 for ; Sat, 17 Aug 2019 16:19:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=v/hhRygAg/6EOI9LzkiuN8CD/r0ZfPnmjgW9wqIuXR0=; b=nvE/gzvNuZ9JlzJYZw0OS9t2f03Er0xKB3i1sZ0JpW2k/9n+pI0MNMVDdnTPr61mY2 A3l7efGmIl3p5tDyj4ELcsG3468CIlQp81N5F/rZlsfWcxoW11H5coPiTCBMAhqRTNoJ NjN5rAeS3U20jNKOHJ5QuomyN4fsrlfTrQmxkV54CuTaHijJrNN3hRduvFc4i+TdsE4Y z6nwg7OXKzLvzWEAOn+4Aln4TDTzp6VNRXvnNp7MWp1+cZFBkTDRujCWwn/u2bNm+tsh eESKWXWmrGH19a8y0vwMFisody3bZIhKZDZB23TuyO4T2rso2aNmqjINwRkHpXzFWcjG iwww== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=v/hhRygAg/6EOI9LzkiuN8CD/r0ZfPnmjgW9wqIuXR0=; b=qSuQmn2h1AD1pIY5JlrmJUULlykO+TC+dRqJVnpdyWBNdDQMN0pq5v15fZBwcr/rLR 6Wn8rCdDGkxinZJjuHEd5D8cowiU0pmI9kOMz63dNyOdM5wgp3Kq6MYelds3gPb45s1i He6C1oaZjG3ykHXvWSRTDiVM+rcQHsV+SsPoRxq1YT/rhtQ9aRnP6kU5a9cMm6RMxZtx +pSwkyIvX0sk4uFZjU5v6rBWVs0XQLpCT2VottbZStDpZ9E4cHuRNG+b4cF2JVvDXhD0 abGEKaixFkWqXmcQePWOwDqMvw9sjByBJbcO8jZ4aIgfGkdQ7/PAtUv32nS7Pw62PVFJ TSnQ== X-Gm-Message-State: APjAAAUqcqq0SVJTWcbSH9EBb2CQF7IsyYQOTxO6iEIWgHI35S/Kj9Lo hiNQygRhoAFVWDc+8z2CZJTci94KPM+tomo2Axc= X-Google-Smtp-Source: APXvYqxkXopOuFAkLd1NRJjxqBdaSpXX9t0XsGQEU1RQr62QGnFGnalH0x4nI5dOrWuRgZ9e8ribR2ELkAnxmx/DNTE= X-Received: by 2002:a5e:9515:: with SMTP id r21mr18547612ioj.257.1566083942875; Sat, 17 Aug 2019 16:19:02 -0700 (PDT) MIME-Version: 1.0 References: <09178E42-08B2-4958-A1C8-AF507AEE8834@fugue.com> <0BDD4F7F-7301-476A-80DA-0CC84EE4557D@fugue.com> <6698db4f-89ff-e5be-09a5-eb544f76ebc9@nostrum.com> <20190817170031.6F71C1691138@fafnir.remote.dragon.net> <20190817205517.1128E16936B5@fafnir.remote.dragon.net> <9FB124AF-79CB-48B9-87BB-DC6F2D532F10@fl1ger.de> In-Reply-To: From: Rob Sayre Date: Sat, 17 Aug 2019 16:18:51 -0700 Message-ID: To: Brian Dickson Cc: Ralf Weber , Melinda Shore , Paul Ebersman , ADD Mailing list , Joe Abley Content-Type: multipart/alternative; boundary="0000000000001a88270590585564" Archived-At: Subject: Re: [Add] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 17 Aug 2019 23:19:05 -0000 --0000000000001a88270590585564 Content-Type: text/plain; charset="UTF-8" On Sat, Aug 17, 2019 at 3:50 PM Brian Dickson wrote: > > I'm looking for ways of breaking involuntary change of DNS resolver > choice. > Hmm. I'm not sure this rhetoric is particularly convincing, but I'll think more about it. thanks, Rob --0000000000001a88270590585564 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Sat, Aug 17, 2019 at 3:50 PM Brian Dic= kson <brian.peter.dicks= on@gmail.com> wrote:

I'm looking for ways of br= eaking involuntary change of DNS resolver choice.=C2=A0

Hmm. I'm not sure this rhetori= c is particularly convincing, but I'll think more about it.
<= br>
thanks,
Rob=C2=A0=C2=A0
--0000000000001a88270590585564-- From nobody Sat Aug 17 18:12:09 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 311E01200C4 for ; Sat, 17 Aug 2019 18:12:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JrV6PrD09Fy8 for ; Sat, 17 Aug 2019 18:12:05 -0700 (PDT) Received: from mail-io1-xd2c.google.com (mail-io1-xd2c.google.com [IPv6:2607:f8b0:4864:20::d2c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 10CF112006D for ; Sat, 17 Aug 2019 18:12:05 -0700 (PDT) Received: by mail-io1-xd2c.google.com with SMTP id l7so13771633ioj.6 for ; Sat, 17 Aug 2019 18:12:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to; bh=oQjmbM/COVt00J1FHtpvvDY9vR6F8hq3MDB+9FoqJN8=; b=mZzg83PSqZd+v1ahagePuuBnSMBV4Y9wjo/LlDIzUmTxWhD6CXpg/KvtpeJR0QXPs2 SLZjvyULkOvzWxMjn0AaLhan4gQ6pAynfGSCu/Tmj6tB5q/Y3MIr5N1K0YE2ynlhjTfS blpK/9TDNJna9NtXAso6J96fK2Q4f8BWULt8ri3imMUGvCEYlD0Qpf+pHnVtw/RPxVI8 SVJbHeXs24qvmZsFCR2kowzB6N1vexk1hLpy+HzznnQ6TjFQbussRn//UWYRlNX8+SGl zBk0+gWMt2Xvyv2SCrScL+uUGuubDbqw+wv1gde4315jJdlpE4jE0wLUQvl/D6zaZ1JP PxuQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=oQjmbM/COVt00J1FHtpvvDY9vR6F8hq3MDB+9FoqJN8=; b=djhGlJiaRqQxg6b+Hm60bBjzrA+huz5Nd1RAnuyLl3lDg7LlCqsg+WfxWFtr1VWZ20 X2EXPlkXUOadikk7SO9h+hmDksTDQXW9untY4PtbcubO2I7MNPJjtBUhjKUmEVWEri9G FoYw2Gbg8mNlaWbfdMfNeBXS+QUoz9iTBq1jyaL5N4+H+gU9msGKdGpQjwxLned55PXX Yth0xGAn9RbWia7p21Fz1Fjk5xa5MkCQA84v3nk0/Ki26BWuW50+nZQSZhf+yx6nO0/o W4yVmYgijM/zcjuhaVoBQB6BHp1k3k48nqnWqhslbAxPNk60bzZlG0FjgxCfNpMwLuol 6Oug== X-Gm-Message-State: APjAAAXOdO9a5EX3K2gUMf3R+A3wMLez77WR6az8j935RV+37CZQg+PK aXMaHZ1pNnkZbKE7TmAyjS8DcLst6C7nEZnV4DZED0SNBzmdrw== X-Google-Smtp-Source: APXvYqy0nH2TACgCuvyQ3isOd0XjvAu6lI8fpBnCtPT/wk5NQT0kCmH1NRm7th2D+y1q96vfddFpyWaLocA4m3hstig= X-Received: by 2002:a5d:8457:: with SMTP id w23mr7136691ior.189.1566090723420; Sat, 17 Aug 2019 18:12:03 -0700 (PDT) MIME-Version: 1.0 From: Rob Sayre Date: Sat, 17 Aug 2019 18:11:52 -0700 Message-ID: To: ADD Mailing list Content-Type: multipart/alternative; boundary="0000000000004175ad059059e940" Archived-At: Subject: [Add] Telecom Ad Networks X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 18 Aug 2019 01:12:07 -0000 --0000000000004175ad059059e940 Content-Type: text/plain; charset="UTF-8" Hi! I thought it might be good to point out that self-identified "operators" may have many lines of business. For example: "AT&T Advertising & Analytics Lays Foundation of a Premium TV and Video Ad Marketplace Fueled By Data, Technology, Premium Content and Distribution" or "ANY WAY YOUR AUDIENCE WATCHES: CONSIDER THEM FOUND" I'm sure there are other telephone companies that do similar things--these are just two examples. I think this is all fine, actually. It's nevertheless a good data point. And, of course, any data point along these lines must take this context into account: "Ever since Congress voted to repeal the FCC's broadband privacy protections due to come into force later this year - which would have prevented internet service providers like AT&T, Comcast, Time Warner, Sprint and Verizon from selling personal data like web browsing history without prior consent..." < https://www.forbes.com/sites/thomasbrewster/2017/03/30/fcc-privacy-rules-how-isps-will-actually-sell-your-data/#3402e4c621d1 > I have to say, I don't really like anyone tracking me (including Google), but I don't see the IETF performing a useful role here. It often seems like the goal is to write an RFC that weakens encryption so more companies can have ad networks. thanks, Rob --0000000000004175ad059059e940 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi!

I thought it might be good to point= out that self-identified "operators" may have many lines of busi= ness.

For=C2=A0example:
"AT&T A= dvertising & Analytics Lays Foundation of a Premium TV and Video Ad Mar= ketplace Fueled By Data, Technology, Premium Content and Distribution"=

or

"ANY WAY YOUR AUDIENCE WAT= CHES: CONSIDER THEM FOUND"

=
I'm sure there are other telephone companies that do similar= things--these are just two examples. I think this is all fine, actually. I= t's nevertheless a good data point.

And, of co= urse, any data point along these lines must take this context into account:=

"Ever since Congress voted to repeal the FCC= 's broadband privacy protections due to come into force later this year= - which would have prevented internet service providers like AT&T, Com= cast, Time Warner, Sprint and Verizon from selling personal data like web b= rowsing history without prior consent..."

I have to say, = I don't really like anyone tracking me (including Google), but I don= 9;t see the IETF performing a useful role here. It often seems like the goa= l is to write an RFC that weakens encryption so more companies can have ad = networks.

thanks,
Rob
--0000000000004175ad059059e940-- From nobody Sat Aug 17 22:58:01 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 381C712022A for ; Sat, 17 Aug 2019 22:57:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.895 X-Spam-Level: X-Spam-Status: No, score=-1.895 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=lastpresslabel-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id htGBp2SepH6u for ; Sat, 17 Aug 2019 22:57:51 -0700 (PDT) Received: from mail-wr1-x436.google.com (mail-wr1-x436.google.com [IPv6:2a00:1450:4864:20::436]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C0F111200EC for ; Sat, 17 Aug 2019 22:57:50 -0700 (PDT) Received: by mail-wr1-x436.google.com with SMTP id s18so5387317wrn.1 for ; Sat, 17 Aug 2019 22:57:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lastpresslabel-com.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=B9iAdWW5ZKhWEkAOiA1uCxyhE96RDJfrnfHYF/b/yh8=; b=vsHq45mNFOrP8MIAnQ5RjmlNpvP2+yGEWY6OG8YMkJl/P7nxCLUMxcOXHoyzuOhhwd vzPJPWuIfV1XxkmqupPvIBDxZ1566AdW4FQn47NCWecycALcJmJOGtQoUy7r7y8qHZyT h+/G1LRicoNGm2FatowI8wjjxOxmMOoULhZ2VVVyq/+eSl8do4fc2kzSlkUq0uinNec6 po2BTIe5JSAJE3Mim7z7C99Eb5kQxjgQFM1vy251hugUdO6eW10uL4Gd0NK8CORFS/BQ gkc5kUGfDIgsbUxc2QsYY5ID9OfhDP/Q8OcKQCsXYfzL7dG8ddfAIibVeGdMAr3ONAYI nyFw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=B9iAdWW5ZKhWEkAOiA1uCxyhE96RDJfrnfHYF/b/yh8=; b=p10sP6p2U1VWRriLl4HM18gk5uNf7psBJIpnHZx38SzGaDsH7aQBA8EtVpyBd+uY1g ndMJNLwc4H2ZN1srvJcFN8ab286b+6as8ZOhFBYDjvFAPWO5ElTp0BDyHPGIfwRbSLgF xnDPg+byUMUmsonCiiGsH3YOfkLSMwfgE8Da/dYesTlyPNpY0vI7CfLMBUjiTcR2QNVg NRhosXuzhutfz6g/op5w8Fx0ghmUaD+FGh5vpyF3Vi7Z912xtFsII05CA7VkmHbAUPP8 yxmGIb0u8sKQtsLcW7oDCAuyqagC6CXUU4rE8XD+LabqkZ1kWFGnWV+AsSfmBRZneP5F Kg4g== X-Gm-Message-State: APjAAAUuNVa9ioMT6FKEFkbaFdnutLpa/nSfn45OQOU4NLHe49eoeK5W ezub5MlmQb7aBNnW02L6UinN0MVpT/8= X-Google-Smtp-Source: APXvYqywLeTZdXRQ0ootrknGsPZusCY50gyegGEVWxLfHeWxQ+zrodCfJi3MvbYmdeI9rbDNcH6tXg== X-Received: by 2002:adf:90e7:: with SMTP id i94mr18042079wri.224.1566107868696; Sat, 17 Aug 2019 22:57:48 -0700 (PDT) Received: from ?IPv6:2a00:23c5:cda3:8400:40c3:4aae:e674:872f? ([2a00:23c5:cda3:8400:40c3:4aae:e674:872f]) by smtp.gmail.com with ESMTPSA id p13sm12161538wrw.90.2019.08.17.22.57.47 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Sat, 17 Aug 2019 22:57:47 -0700 (PDT) Content-Type: multipart/alternative; boundary=Apple-Mail-FBA8B5DF-A16B-4BEF-8C25-698665E0B6E9 Mime-Version: 1.0 (1.0) From: Dominique Lazanski X-Mailer: iPhone Mail (16G77) In-Reply-To: Date: Sun, 18 Aug 2019 06:57:45 +0100 Cc: ADD Mailing list Content-Transfer-Encoding: 7bit Message-Id: <52AC14D8-E2DC-480A-B306-36E7C5987259@lastpresslabel.com> References: To: Rob Sayre Archived-At: Subject: Re: [Add] Telecom Ad Networks X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 18 Aug 2019 05:58:00 -0000 --Apple-Mail-FBA8B5DF-A16B-4BEF-8C25-698665E0B6E9 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable > On 18 Aug 2019, at 02:11, Rob Sayre wrote: >=20 > Hi! >=20 > I thought it might be good to point out that self-identified "operators" m= ay have many lines of business. >=20 > For example: > "AT&T Advertising & Analytics Lays Foundation of a Premium TV and Video Ad= Marketplace Fueled By Data, Technology, Premium Content and Distribution" > >=20 > or >=20 > "ANY WAY YOUR AUDIENCE WATCHES: CONSIDER THEM FOUND" > >=20 > I'm sure there are other telephone companies that do similar things--these= are just two examples. I think this is all fine, actually. It's nevertheles= s a good data point. >=20 > And, of course, any data point along these lines must take this context in= to account: >=20 > "Ever since Congress voted to repeal the FCC's broadband privacy protectio= ns due to come into force later this year - which would have prevented inter= net service providers like AT&T, Comcast, Time Warner, Sprint and Verizon fr= om selling personal data like web browsing history without prior consent..."= > >=20 > I have to say, I don't really like anyone tracking me (including Google), b= ut I don't see the IETF performing a useful role here. It often seems like t= he goal is to write an RFC that weakens encryption so more companies can hav= e ad networks. >=20 But this is just the two biggest operators in the US and isn=E2=80=99t true g= lobally. According to the GSMA the top five largest operators globally aren=E2= =80=99t American and don=E2=80=99t run ad networks though they do have servi= ces like mobile money. (China Mobile, Vodafone, Telefonica...) Your point reflects a very American mindset, but we really need to think glo= bally about this.=20 -dml > thanks, > Rob > --=20 > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add --Apple-Mail-FBA8B5DF-A16B-4BEF-8C25-698665E0B6E9 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable

On 18 Aug 2019, at= 02:11, Rob Sayre <sayrer@gmail.com> wrote:

Hi!

I thought it might be good to point out th= at self-identified "operators" may have many lines of business.
For example:
"AT&T Advertising & Analyti= cs Lays Foundation of a Premium TV and Video Ad Marketplace Fueled By Data, T= echnology, Premium Content and Distribution"

or

<= /div>
"ANY WAY YOUR AUDIENCE WATCHES: CONSIDER THEM FOUND"
<https://www.comcastspotlig= ht.com>

I'm sure there are other telephone c= ompanies that do similar things--these are just two examples. I think this i= s all fine, actually. It's nevertheless a good data point.

And, of course, any data point along these lines must take this cont= ext into account:

"Ever since Congress voted to rep= eal the FCC's broadband privacy protections due to come into force later thi= s year - which would have prevented internet service providers like AT&T= , Comcast, Time Warner, Sprint and Verizon from selling personal data like w= eb browsing history without prior consent..."

I have to say, I don'= t really like anyone tracking me (including Google), but I don't see the IET= F performing a useful role here. It often seems like the goal is to write an= RFC that weakens encryption so more companies can have ad networks.


But this is just t= he two biggest operators in the US and isn=E2=80=99t true globally. Accordin= g to the GSMA the top five largest operators globally aren=E2=80=99t America= n and don=E2=80=99t run ad networks though they do have services like mobile= money. (China Mobile, Vodafone, Telefonica...)

You= r point reflects a very American mindset, but we really need to think global= ly about this. 

-dml

thanks,
Rob
=
= --Apple-Mail-FBA8B5DF-A16B-4BEF-8C25-698665E0B6E9-- From nobody Sat Aug 17 23:42:00 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E7AC41200C4 for ; Sat, 17 Aug 2019 23:41:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FROM_EXCESS_BASE64=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=frobbit.se Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fHa_7bSRMetU for ; Sat, 17 Aug 2019 23:41:57 -0700 (PDT) Received: from mail.frobbit.se (mail.frobbit.se [IPv6:2a02:80:3ffe::176]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E93BA12001A for ; Sat, 17 Aug 2019 23:41:56 -0700 (PDT) Received: from [192.165.72.241] (unknown [IPv6:2a02:80:3ffc:0:3d13:5003:aa48:988c]) by mail.frobbit.se (Postfix) with ESMTPSA id CCAFE20869; Sun, 18 Aug 2019 08:41:52 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=frobbit.se; s=mail; t=1566110512; bh=yDDFL4BG921BoYi7UlBA/w5dh7rk9TA8zLimy9YIlug=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=lnaC74dRLXc2RULyH8ibvTPeBxRRRFQT/kPF5A2TzVh2985FJTCaUD+KbAuZu7l+J pRJvFiMfmSDCmv6SFnrJpPHUBykAn+NnzEqdgUboJ3h6TpeTG3UhOwrmYyPzuAoKkV Irl5BsFGxa8qZjlWrTG/hI81Up5Ti+u84rINNhO0= From: "Patrik =?utf-8?b?RsOkbHRzdHLDtm0=?=" To: "Rob Sayre" Cc: "Ralf Weber" , "Melinda Shore" , "Paul Ebersman" , "ADD Mailing list" , "Joe Abley" Date: Sun, 18 Aug 2019 08:41:52 +0200 X-Mailer: MailMate (1.12.5r5635) Message-ID: <86C84088-9965-4B39-8572-ECBF3D7FC8B9@frobbit.se> In-Reply-To: References: <09178E42-08B2-4958-A1C8-AF507AEE8834@fugue.com> <0BDD4F7F-7301-476A-80DA-0CC84EE4557D@fugue.com> <6698db4f-89ff-e5be-09a5-eb544f76ebc9@nostrum.com> <20190817170031.6F71C1691138@fafnir.remote.dragon.net> <20190817205517.1128E16936B5@fafnir.remote.dragon.net> <9FB124AF-79CB-48B9-87BB-DC6F2D532F10@fl1ger.de> MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=_MailMate_C4DBD110-B703-4DE4-A207-303EBB7D1C7C_="; micalg=pgp-sha1; protocol="application/pgp-signature" Archived-At: Subject: Re: [Add] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 18 Aug 2019 06:41:59 -0000 This is an OpenPGP/MIME signed message (RFC 3156 and 4880). --=_MailMate_C4DBD110-B703-4DE4-A207-303EBB7D1C7C_= Content-Type: text/plain Content-Transfer-Encoding: quoted-printable On 17 Aug 2019, at 23:39, Rob Sayre wrote: > Agreed. But I think people are looking for a way to break DoH/DoT, in a= well-meaning way. So, bringing up DNSSEC is actually kind of a distracti= on. No, because only by validating the DNSSEC signed response in the client y= ou can detect whether the resolver has modified the result. Regardless of= how the DNS response reach the client. As Ralf wrote, the question of transport for DNS packets and DNSSEC are _= complementary_. You still need DNSSEC validation in the client, regardless of what transp= ort protocol is in use. Patrik --=_MailMate_C4DBD110-B703-4DE4-A207-303EBB7D1C7C_= Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iG0EARECAC0WIQRUH/cJI8i4DDUU3qWsxpsaC4jXzQUCXVjzMA8ccGFmQGZyb2Ji aXQuc2UACgkQrMabGguI183mzwCeOMXh9jEMR2tSiGmVpkm+FaZj+YwAoJTVPBXG 5IG3iplpWCCXqJIy1DQ3 =put1 -----END PGP SIGNATURE----- --=_MailMate_C4DBD110-B703-4DE4-A207-303EBB7D1C7C_=-- From nobody Sun Aug 18 00:07:28 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CDC7D1200D7 for ; Sun, 18 Aug 2019 00:07:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Um0cXd2DmVun for ; Sun, 18 Aug 2019 00:07:25 -0700 (PDT) Received: from mail-io1-xd2b.google.com (mail-io1-xd2b.google.com [IPv6:2607:f8b0:4864:20::d2b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 318FC12001A for ; Sun, 18 Aug 2019 00:07:25 -0700 (PDT) Received: by mail-io1-xd2b.google.com with SMTP id l7so14455619ioj.6 for ; Sun, 18 Aug 2019 00:07:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=U11n7ZylKM0vi7xKedVG12CM2M33B3KTBJsnzU/fT9U=; b=KF4fqbwlYcwRZeAIoaRKRCdmQZjxL6WcWheOIGXQnCBicAVKlxCqo4MKyY5lJ4rEXm oGsznP6HKO+NLHtU7tJcO0rCU8oUMBz1gK0DOnCywKoCqi4hTC82ldotG2NZIxqv3VJy yNuOWtdlZiex1iSx6bcYz2qcLMj3l9NqXj0pTssMocPzC94H68R2RRcTg8k4y5EnlAqD lyZKiOCRpP6CKDH4tMfWVTPF5e0XoVRc42dQDXXZ219IVWGvuaQqOtBr+YnzppajSy6n wVfZ/DwhPrY2Ngkwqy0IOJ0ddFsg3isnGjY1DZguAwCnNbRw1wwq4mdd5plEPMRJoOq6 K8sw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=U11n7ZylKM0vi7xKedVG12CM2M33B3KTBJsnzU/fT9U=; b=dz8WidNPVskqd8uhfVwyRR3bezDB9+bi+xozzM6zy8rnzAEtAjqRbCoKW/NOmwjqzt IdqN5wHj+c6Jx52ISkM+v9GUyXpIHxx4PJwpbxMu1uYEF6gMWil9m0TfM3Q2jNgUGHEF 6uasoa2OycrPshjc4QtfZwbic1kJvrYlgSo754qr2G/uAsu4rfuCGfhlw1LXgVc7OsWM goqq3PVTkZ4MXyizMoMEOhFKL7fO0Shb/F0OpjImj8VzGyI5BOg+OvpzvoX0gkqBc9RV jo9efWkOicMGVYO8UqA4QluE0YjGfyecyklm1tNeCBTVKtFpprALrel1U2xDXaQmddtr WVrQ== X-Gm-Message-State: APjAAAWp2nxW6mGE1910/F38Jb2zN1Pbjv3M6ASXUDftMg3YkWKFzzv2 X1OBhLU7nJyggJaNO5fHdZawWh4XeFDPEAQIR2oAO/uRmP0= X-Google-Smtp-Source: APXvYqynXQYgj29+rRWuIhHeYzJaM0s0Ny7WLIit+IUjYWXy6OKdNvaTwXGM1RQcPEWgFobMIz6lTiNhBPyuqRfJVOQ= X-Received: by 2002:a05:6602:98:: with SMTP id h24mr20161721iob.49.1566112044344; Sun, 18 Aug 2019 00:07:24 -0700 (PDT) MIME-Version: 1.0 References: <52AC14D8-E2DC-480A-B306-36E7C5987259@lastpresslabel.com> In-Reply-To: <52AC14D8-E2DC-480A-B306-36E7C5987259@lastpresslabel.com> From: Rob Sayre Date: Sun, 18 Aug 2019 00:07:12 -0700 Message-ID: To: Dominique Lazanski Cc: ADD Mailing list Content-Type: multipart/alternative; boundary="00000000000014ee7d05905ee076" Archived-At: Subject: Re: [Add] Telecom Ad Networks X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 18 Aug 2019 07:07:27 -0000 --00000000000014ee7d05905ee076 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Sat, Aug 17, 2019 at 10:57 PM Dominique Lazanski wrote: > But this is just the two biggest operators in the US and isn=E2=80=99t tr= ue > globally. According to the GSMA the top five largest operators globally > aren=E2=80=99t American and don=E2=80=99t run ad networks though they do = have services like > mobile money. (China Mobile, Vodafone, Telefonica...) > > Your point reflects a very American mindset, but we really need to think > globally about this. > Oh, this is a wonderful point. I think it's great to have ITU participants[1] from outside of the US bring their perspectives. I did find that this issue has actually been straightforwardly used as a bargaining tool in the past, though: "Digicel=E2=80=99s announcement explicitly refers to adblocking as a tool t= o force 'companies like Google, Yahoo and Facebook to enter into revenue sharing agreements'. The UK ISPs are understandably also attracted to the idea of using adblocking on their networks as a new bargaining chip with which to force Google and other advertising companies to share revenue with them" < https://pagefair.com/blog/2015/despite-the-hype-isp-adblocking-is-a-no-go-i= n-europe/ > As I said before, I think that's all fair, but I don't think the IETF should get in the middle of it. thanks, Rob [1] https://www.itu.int/en/ITU-T/Workshops-and-Seminars/201606/Pages/LAZANSKI-D= ominique.aspx --00000000000014ee7d05905ee076 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Sat, Aug 17, 2019 at 10:57 PM Dominiqu= e Lazanski <dml@lastpresslabel= .com> wrote:
But this is just th= e two biggest operators in the US and isn=E2=80=99t true globally. Accordin= g to the GSMA the top five largest operators globally aren=E2=80=99t Americ= an and don=E2=80=99t run ad networks though they do have services like mobi= le money. (China Mobile, Vodafone, Telefonica...)

= Your point reflects a very American mindset, but we really need to think gl= obally about this.=C2=A0

Oh, th= is is a wonderful point. I think it's great to have ITU participants[1]= from outside of the US bring their perspectives.

= I did find that this issue has actually been straightforwardly used as a ba= rgaining tool in the past, though:

"Digicel= =E2=80=99s announcement explicitly refers to adblocking as a tool to force = 'companies like Google, Yahoo and Facebook to enter into revenue sharin= g agreements'. The UK ISPs are understandably also attracted to the ide= a of using adblocking on their networks as a new bargaining chip with which= to force Google and other advertising companies to share revenue with them= "
=
As I said before, I think that's all fair, but I don'= ;t think the IETF should get in the middle of it.

= thanks,
Rob

=C2=A0
--00000000000014ee7d05905ee076-- From nobody Sun Aug 18 00:32:15 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C463F120026 for ; Sun, 18 Aug 2019 00:32:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.299 X-Spam-Level: X-Spam-Status: No, score=-4.299 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=swm.pp.se Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OF8nx_CZmNM4 for ; Sun, 18 Aug 2019 00:32:11 -0700 (PDT) Received: from uplift.swm.pp.se (ipv6.swm.pp.se [IPv6:2a00:801::f]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BA0B912001A for ; Sun, 18 Aug 2019 00:32:11 -0700 (PDT) Received: by uplift.swm.pp.se (Postfix, from userid 501) id 6C840B7; Sun, 18 Aug 2019 09:32:09 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=swm.pp.se; s=mail; t=1566113529; bh=Q5FRAk8PpngoXaLfmv+IXMuqgeZHkOUqbgS8seCnayk=; h=Date:From:To:cc:Subject:In-Reply-To:References:From; b=lysQp7VwxxhMtL66sxnXmiz/FQpmDe0UP/Z3L40xVJrFuOQzdsUQU6NcqoBYoBWyb 8zCIF6Xr9UwuPLU9AJnPtyokD85kfk+Cp4krkIOmoOvn3gurYMxzlgNLbT1HleFt76 n81MtX2nO63H4wbp5Y2ngNNjZseYJP83fCSW7je8= Received: from localhost (localhost [127.0.0.1]) by uplift.swm.pp.se (Postfix) with ESMTP id 68362B5; Sun, 18 Aug 2019 09:32:09 +0200 (CEST) Date: Sun, 18 Aug 2019 09:32:09 +0200 (CEST) From: Mikael Abrahamsson To: Rob Sayre cc: Dominique Lazanski , ADD Mailing list In-Reply-To: Message-ID: References: <52AC14D8-E2DC-480A-B306-36E7C5987259@lastpresslabel.com> User-Agent: Alpine 2.20 (DEB 67 2015-01-07) Organization: People's Front Against WWW MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII; format=flowed Archived-At: Subject: Re: [Add] Telecom Ad Networks X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 18 Aug 2019 07:32:14 -0000 On Sun, 18 Aug 2019, Rob Sayre wrote: > As I said before, I think that's all fair, but I don't think the IETF > should get in the middle of it. Where do you think people working at operators and browser vendors should exchange views and opinions on this topic? Do you have a better venue in mind? Just because we're discussing things here and producing documents to sum up the discussions doesn't mean IETF has to prescribe anything in those documents. -- Mikael Abrahamsson email: swmike@swm.pp.se From nobody Sun Aug 18 00:48:35 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1988C12001A for ; Sun, 18 Aug 2019 00:48:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id L_JXxAZxzoQg for ; Sun, 18 Aug 2019 00:48:32 -0700 (PDT) Received: from mail-io1-xd2a.google.com (mail-io1-xd2a.google.com [IPv6:2607:f8b0:4864:20::d2a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 69628120026 for ; Sun, 18 Aug 2019 00:48:32 -0700 (PDT) Received: by mail-io1-xd2a.google.com with SMTP id e20so14518637iob.9 for ; Sun, 18 Aug 2019 00:48:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=OaNPYxw1N57XNm03R6cEBvTLy3mYLz0rWbSHyFYKQx8=; b=mQFPmvk0+MRKbtAg9mtrj7jN4/ldeNy51el2LlfZeI9abCqITpuXtMNPRmGQJaL/h7 ab6K3N6IBvT/eFXoeEN611D1d/lRn+m2dkFlN8oAGqESTZdyojqifzzKHSDlmAyFlgsd 4cCcvP6Cv5UnayQ6+gkMRQGskM9/QjBhCAa+b5dCcBRdBLdQ8OffTNBZ0KotbkokWYUK t8OVpMNBKVINUJ0r0rakylSP9gn7U/HlMZ/FckYDT9m2i30PAHtba7xmVUdxzrg+rrHr hxgPznRKREJ2PTMR74oVudYQX+dIdHVyrlVFSm90PJG6K9oxi/VENrP6q5AYJ4LafMEn UWvQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=OaNPYxw1N57XNm03R6cEBvTLy3mYLz0rWbSHyFYKQx8=; b=OD+Q1LEYpeDtDzGli5QMdgTIRXVvoHwn52Vu2TSyiSJixCnpJiqjI6UX/nKrqDhdtc WFy0O6L4KsPYwjRLFd/4NJytOcXU02fiawF+75IQRCP6mIcLspzoKkWdPighJV/ph9Vt AmAF+oE6WN+pDPzdMewquXizw/lao3PUfuM9UR9egStZ3OkrtDqvkGT5b7JbZFKPoWHj 0CsfhZiHAmPsh6L4KyrmXUNv4hvzHLJxE3yuAkLlIdkJ1HZnzB2PZbhfjPo6I/RDhq44 sNoIv0KwBAE/9d1Pg/fzz0+QMs9UdT6QlaKoyjvWw/z+nJ4wt/gdGmGnAq3/M5QZ3u6q dTKQ== X-Gm-Message-State: APjAAAUjaJsnNNGT7dAc2C56QStFOgP+l+pJn3K/oc+/Z6G4RNnxIguD IzxaEnR0ALsji12uQvtACBVPrh9A9fe0E8M7sWo= X-Google-Smtp-Source: APXvYqytCPXowDnJ10C2WF5Wv2arjiHDqgi4rzdckRGDIglRCclsO/Xv3Xv/3tHT3TuTnGKr5BAtL8+y86RfQBB209k= X-Received: by 2002:a5e:c00e:: with SMTP id u14mr886118iol.196.1566114511623; Sun, 18 Aug 2019 00:48:31 -0700 (PDT) MIME-Version: 1.0 References: <52AC14D8-E2DC-480A-B306-36E7C5987259@lastpresslabel.com> In-Reply-To: From: Rob Sayre Date: Sun, 18 Aug 2019 00:48:20 -0700 Message-ID: To: Mikael Abrahamsson Cc: Dominique Lazanski , ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000249f3705905f738f" Archived-At: Subject: Re: [Add] Telecom Ad Networks X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 18 Aug 2019 07:48:34 -0000 --000000000000249f3705905f738f Content-Type: text/plain; charset="UTF-8" On Sun, Aug 18, 2019 at 12:32 AM Mikael Abrahamsson wrote: > On Sun, 18 Aug 2019, Rob Sayre wrote: > > > As I said before, I think that's all fair, but I don't think the IETF > > should get in the middle of it. > > Where do you think people working at operators and browser vendors should > exchange views and opinions on this topic? Do you have a better venue in > mind? > It's a fair question. Using your construction, I don't think the browser vendors need to consult the operators. Of course, some browser vendors are operators, and some operators are browser vendors, so it's not that simple. > > Just because we're discussing things here and producing documents to sum > up the discussions doesn't mean IETF has to prescribe anything in those > documents. > That's true, and the IETF does produce a large amount of useless documents. This isn't a bad thing--it's good that ideas get documented and tried. But if someone points out that a proposed work area might solely produce useless documents, the IETF should consider that it may harm the reputation of the IETF itself. thanks, Rob --000000000000249f3705905f738f Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Sun, Aug 18, 2019 at 12:32 AM Mikael A= brahamsson <swmike@swm.pp.se>= wrote:
On Sun, 18 Aug 2019, Rob Sayre wrote:

> As I said before, I think that's all fair, but I don't think t= he IETF
> should get in the middle of it.

Where do you think people working at operators and browser vendors should <= br> exchange views and opinions on this topic? Do you have a better venue in mind?

It's a fair question. Using y= our construction, I don't think the browser vendors need to consult the= operators.

Of course, some browser vendors are op= erators, and some operators are browser vendors, so it's not that simpl= e.
=C2=A0

Just because we're discussing things here and producing documents to su= m
up the discussions doesn't mean IETF has to prescribe anything in those=
documents.

That's true, and the IET= F does produce a large amount of useless documents. This isn't a bad th= ing--it's good that ideas get documented and tried. But if someone poin= ts out that a proposed work area might solely produce useless documents, th= e IETF should consider that it may harm the reputation of the IETF itself.<= /div>

thanks,
Rob
--000000000000249f3705905f738f-- From nobody Sun Aug 18 00:52:23 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 96576120026 for ; Sun, 18 Aug 2019 00:52:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.299 X-Spam-Level: X-Spam-Status: No, score=-4.299 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=swm.pp.se Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cP6L1WhPIR9K for ; Sun, 18 Aug 2019 00:52:21 -0700 (PDT) Received: from uplift.swm.pp.se (swm.pp.se [212.247.200.143]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 83FBB12001A for ; Sun, 18 Aug 2019 00:52:21 -0700 (PDT) Received: by uplift.swm.pp.se (Postfix, from userid 501) id 4B27BB7; Sun, 18 Aug 2019 09:52:19 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=swm.pp.se; s=mail; t=1566114739; bh=FkDvdORD5APXJf8GYAjSiXNR6omi082CPpd7F1H5JWY=; h=Date:From:To:cc:Subject:In-Reply-To:References:From; b=buLuc93tOCrpdCdeRZzOwjqgHiXhgw5jeqpSQ7IvdtelKju1WX352vh24dL4DFQFJ 2k1Fct+KJAU4/SSr+Tm1of8Sl7QQCBzruiyoeO8EF+d1il3IjJ8yqMEKGlNrV89ntS fb/hiAURf+FF8v8zHX01NmgLY5hlG8NU9Z3AtCek= Received: from localhost (localhost [127.0.0.1]) by uplift.swm.pp.se (Postfix) with ESMTP id 47A14B5; Sun, 18 Aug 2019 09:52:19 +0200 (CEST) Date: Sun, 18 Aug 2019 09:52:19 +0200 (CEST) From: Mikael Abrahamsson To: Rob Sayre cc: Dominique Lazanski , ADD Mailing list In-Reply-To: Message-ID: References: <52AC14D8-E2DC-480A-B306-36E7C5987259@lastpresslabel.com> User-Agent: Alpine 2.20 (DEB 67 2015-01-07) Organization: People's Front Against WWW MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII; format=flowed Archived-At: Subject: Re: [Add] Telecom Ad Networks X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 18 Aug 2019 07:52:22 -0000 On Sun, 18 Aug 2019, Rob Sayre wrote: > It's a fair question. Using your construction, I don't think the browser > vendors need to consult the operators. Care to elaborate on this? At first reading, my first thought was just "wow". -- Mikael Abrahamsson email: swmike@swm.pp.se From nobody Sun Aug 18 00:56:40 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 16FFB120041 for ; Sun, 18 Aug 2019 00:56:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id y4JfVFh4awGq for ; Sun, 18 Aug 2019 00:56:36 -0700 (PDT) Received: from mail-io1-xd2a.google.com (mail-io1-xd2a.google.com [IPv6:2607:f8b0:4864:20::d2a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0F578120026 for ; Sun, 18 Aug 2019 00:56:36 -0700 (PDT) Received: by mail-io1-xd2a.google.com with SMTP id z3so14547736iog.0 for ; Sun, 18 Aug 2019 00:56:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=FGHfLxTvAPJ8qrp9uFCfd3JjPs1izS35TcyTQg7g4Hg=; b=g20Qfk/QpwnMUP877PbhBz3ZKKZ4/u0TwVa9oZr5gpER4gdgPb/bQ5agD54bLW9/ts p23rCuAZ4D9xqw4kIgrADOzdNYrpXdcptMbYPLEP0nyXiGkVDJVrmvse1BPzzDhV2Vjv Pb7sCquC+8kDDMTDAEBet7ZZrZ+hP+dwCS6O6NL4MPeCw5WbYzY8IlZLl89Q3BCTf0St WfqevslETNGdbxd+q/G91k3AahcNwPK7ZeuHDH0YyzJoM1YxRg+dYqpPAWzba4UeT2R4 Je3iFD8cmPjlNRPIjC1ffAu6isIXOrRHqsTaAMJ0G774W6igm3u8EzON9xpadnAGMFuM S5OQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=FGHfLxTvAPJ8qrp9uFCfd3JjPs1izS35TcyTQg7g4Hg=; b=Ykd3gr7HmGezjt8PAMkYp5AytlYZ+0mPR3E8kcsSgVGBnusTmpcQ5z1HPYa/5ZzCSV IW7DL2fkrYjg6Fp6lwj34vG6tQhmExtEvtjtWQ9ApuqR0n9VGgu0Kf/ANFz2PTJuWx0x yh+t/P9m4IgSOaqF7YLUeK21xAuy4rEgyRKosaUSXOm3ktFbzs4WsnoAZxcIECsqJRcQ bHdgeh0gqrlheeBAT/QFaa+pCpDO/EmJFtXUry783PnZYzlX5mvRrOl8/hrH17I7Dkci dKExxcREvSvxqgLLgUZue0ZjCzO9yY0Fj2Jft5dUxHV1LzpBLPaj93aUww5ekq/ww/SY IJPg== X-Gm-Message-State: APjAAAWr35zADGfPj1XAXFghUnqR+Mfw1Aumf9W0OKCqmC6yRgiUpx/b cy6R7V/cbwyxB8Ohh6YOCZ8/2nHTpYxABAbHh9I= X-Google-Smtp-Source: APXvYqxWvUuFqtMGvcbVF9AhzeUnCb7i0Ojt6k0/D8g4RtVfzxAMiCu5X0DoXRrfueshOGOe/4fjXo8yHqTXDjGCyZg= X-Received: by 2002:a5d:8457:: with SMTP id w23mr8130340ior.189.1566114995256; Sun, 18 Aug 2019 00:56:35 -0700 (PDT) MIME-Version: 1.0 References: <52AC14D8-E2DC-480A-B306-36E7C5987259@lastpresslabel.com> In-Reply-To: From: Rob Sayre Date: Sun, 18 Aug 2019 00:56:24 -0700 Message-ID: To: Mikael Abrahamsson Cc: Dominique Lazanski , ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000f843bf05905f8fe0" Archived-At: Subject: Re: [Add] Telecom Ad Networks X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 18 Aug 2019 07:56:38 -0000 --000000000000f843bf05905f8fe0 Content-Type: text/plain; charset="UTF-8" On Sun, Aug 18, 2019 at 12:52 AM Mikael Abrahamsson wrote: > On Sun, 18 Aug 2019, Rob Sayre wrote: > > > It's a fair question. Using your construction, I don't think the browser > > vendors need to consult the operators. > > Care to elaborate on this? > > At first reading, my first thought was just "wow". > Sure. There are only four or five companies that can provide a browser. There are lots of networking companies, and none of them can afford to break any of the browsers. I don't work for either side, but it seems pretty obvious to me. thanks, Rob --000000000000f843bf05905f8fe0 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Sun, Aug 18, 2019 at 12:52 AM Mikael A= brahamsson <swmike@swm.pp.se>= wrote:
On Sun, 18 Aug 2019, Rob Sayre wrote:

> It's a fair question. Using your construction, I don't think t= he browser
> vendors need to consult the operators.

Care to elaborate on this?

At first reading, my first thought was just "wow".

Sure. There are only four or five companies that can = provide a browser.

There are lots of networking co= mpanies, and none of them can afford to break any of the browsers.

I don't work for either side, but it seems pretty obvi= ous to me.

thanks,
Rob

--000000000000f843bf05905f8fe0-- From nobody Sun Aug 18 06:44:21 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5207A120024 for ; Sun, 18 Aug 2019 06:44:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id r6HL1A_jvGvn for ; Sun, 18 Aug 2019 06:44:14 -0700 (PDT) Received: from mail-lj1-x234.google.com (mail-lj1-x234.google.com [IPv6:2a00:1450:4864:20::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7DA15120098 for ; Sun, 18 Aug 2019 06:44:14 -0700 (PDT) Received: by mail-lj1-x234.google.com with SMTP id x4so9161469ljj.6 for ; Sun, 18 Aug 2019 06:44:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=gC0PG8dYQBNZSc1D2x0qtnB8v0MWaK2nG7/uVBVUEaU=; b=HOmrR13cxfgCqllM5mVha/ZY5JmiXUHdPbZMA2UPeTEixQ3NDQuU6IEhOWcthZp50V 6fpGCVtldDQtqrXtzzovXD/u9jW9jDgklkXsARxT0GyuSm1FKZvhl7M+CGbWwGHLW4ux T/3awGv10qCOLWwen2+3A/zzNu8hBO58kO1Q6hsxX7hzYdmKy7MTHmEfFrQLKRI5dnAk L/ro5/KQDae54BZLgDWb6GxiJnjjka7J3/EALH1klYWg0KKtk4DJEi2rmccq/x28HOF7 hNaA6gDSZVlpCeWL1yDroLIb5I+Y7Ztg3iptDljgw7knmIwq873Ciig8g8kQ6bG4oxpD RG3w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=gC0PG8dYQBNZSc1D2x0qtnB8v0MWaK2nG7/uVBVUEaU=; b=LFu4hgPlVLnc5adQxZK4IBs3CLmmI6gj4Z+Mz3chk6y7MuphDAxam2hQJ5nsBI7tek by4/VLKZe5TsIhNoDd5HvYmIUwFqCD6hm4PN3smlAZIbxf2fdszGaF/jvrXKocbQlq+0 Kxfm3k6a17OOjZFJZto+fryQaplF1AqIG4dMsUTb/pGdVFPcfAnnlsT3mCUfa983nkRE 5Pvu459roIQ+3t2QVDauhxeEISY2grIE/mGJnT4/OepLGWJfChNpwLdSBuRnx/OfM/e/ MfxNOyN1456xL/SR/BTNZuJwWvkwO56H1I1RNKEEDVvV+w7FbjN4zuPxDo98KdW9P0EY oA7A== X-Gm-Message-State: APjAAAWSAeOwxr3AteSFueUoevYt5SZPYVAsIQ+xjKHM3P90Cs0oVzoV xWBhm8qc7wIu1rlkJ1YuggAWz925BzFNGFclIpwMqQ== X-Google-Smtp-Source: APXvYqz2SOnie1CtZgyg28KNvwNN2agSCnRlGlw1jm6iKU1ovbwtZ/J3qkhv6EjTDIGV+2EJ08P6arFzwxeZf5QX/xQ= X-Received: by 2002:a2e:9a50:: with SMTP id k16mr3435001ljj.75.1566135852695; Sun, 18 Aug 2019 06:44:12 -0700 (PDT) MIME-Version: 1.0 References: <52AC14D8-E2DC-480A-B306-36E7C5987259@lastpresslabel.com> In-Reply-To: <52AC14D8-E2DC-480A-B306-36E7C5987259@lastpresslabel.com> From: Eric Rescorla Date: Sun, 18 Aug 2019 15:43:36 +0200 Message-ID: To: Dominique Lazanski Cc: Rob Sayre , ADD Mailing list Content-Type: multipart/alternative; boundary="0000000000002b9bd20590646bcf" Archived-At: Subject: Re: [Add] Telecom Ad Networks X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 18 Aug 2019 13:44:17 -0000 --0000000000002b9bd20590646bcf Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable It's certainly not the case that DNS modification and surveillance is limited to the US, although it may not be for the purposes of advertising. Here's a good place to start to see the extent of DNS-based tampering: https://www.usenix.org/system/files/conference/usenixsecurity18/sec18-liu_0= .pdf It's of course possible that some of this is being done by enterprises and the like, not ISPs, but, for instance, the authors find that China Mobile, which you site above, intercepts DNS (see S 5.1). -Ekr On Sun, Aug 18, 2019 at 7:58 AM Dominique Lazanski wrote: > > > On 18 Aug 2019, at 02:11, Rob Sayre wrote: > > Hi! > > I thought it might be good to point out that self-identified "operators" > may have many lines of business. > > For example: > "AT&T Advertising & Analytics Lays Foundation of a Premium TV and Video A= d > Marketplace Fueled By Data, Technology, Premium Content and Distribution" > > > or > > "ANY WAY YOUR AUDIENCE WATCHES: CONSIDER THEM FOUND" > > > I'm sure there are other telephone companies that do similar things--thes= e > are just two examples. I think this is all fine, actually. It's > nevertheless a good data point. > > And, of course, any data point along these lines must take this context > into account: > > "Ever since Congress voted to repeal the FCC's broadband privacy > protections due to come into force later this year - which would have > prevented internet service providers like AT&T, Comcast, Time Warner, > Sprint and Verizon from selling personal data like web browsing history > without prior consent..." > < > https://www.forbes.com/sites/thomasbrewster/2017/03/30/fcc-privacy-rules-= how-isps-will-actually-sell-your-data/#3402e4c621d1 > > > > I have to say, I don't really like anyone tracking me (including Google), > but I don't see the IETF performing a useful role here. It often seems li= ke > the goal is to write an RFC that weakens encryption so more companies can > have ad networks. > > > But this is just the two biggest operators in the US and isn=E2=80=99t tr= ue > globally. According to the GSMA the top five largest operators globally > aren=E2=80=99t American and don=E2=80=99t run ad networks though they do = have services like > mobile money. (China Mobile, Vodafone, Telefonica...) > > Your point reflects a very American mindset, but we really need to think > globally about this. > > -dml > > thanks, > Rob > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --0000000000002b9bd20590646bcf Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
It's certainly not the case that DNS modification= and surveillance is limited to the US, although it may not be for the purp= oses of advertising.=C2=A0 Here's a good place to start to see the exte= nt of DNS-based tampering:





On Sun, Aug 18= , 2019 at 7:58 AM Dominique Lazanski <dml@lastpresslabel.com> wrote:


On= 18 Aug 2019, at 02:11, Rob Sayre <sayrer@gmail.com> wrote:

Hi!

I tho= ught it might be good to point out that self-identified "operators&quo= t; may have many lines of business.

For=C2=A0examp= le:
"AT&T Advertising & Analytics Lays Foundation of= a Premium TV and Video Ad Marketplace Fueled By Data, Technology, Premium = Content and Distribution"

or

"ANY WAY YOUR AUDIENCE WATCHES: CONSIDER THEM FOUND&q= uot;

I'm sure there are other telephone companies that do similar things-= -these are just two examples. I think this is all fine, actually. It's = nevertheless a good data point.

And, of course, an= y data point along these lines must take this context into account:

"Ever since Congress voted to repeal the FCC's b= roadband privacy protections due to come into force later this year - which= would have prevented internet service providers like AT&T, Comcast, Ti= me Warner, Sprint and Verizon from selling personal data like web browsing = history without prior consent..."

I hav= e to say, I don't really like anyone tracking me (including Google), bu= t I don't see the IETF performing a useful role here. It often seems li= ke the goal is to write an RFC that weakens encryption so more companies ca= n have ad networks.


<= /div>
But this is just the two biggest operators in the US and isn=E2= =80=99t true globally. According to the GSMA the top five largest operators= globally aren=E2=80=99t American and don=E2=80=99t run ad networks though = they do have services like mobile money. (China Mobile, Vodafone, Telefonic= a...)

Your point reflects a very American mindset,= but we really need to think globally about this.=C2=A0
--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--0000000000002b9bd20590646bcf-- From nobody Sun Aug 18 10:24:30 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 210B3120059 for ; Sun, 18 Aug 2019 10:24:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XAReHqz86Gfw for ; Sun, 18 Aug 2019 10:24:26 -0700 (PDT) Received: from mail-io1-xd29.google.com (mail-io1-xd29.google.com [IPv6:2607:f8b0:4864:20::d29]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 94F8A12002E for ; Sun, 18 Aug 2019 10:24:26 -0700 (PDT) Received: by mail-io1-xd29.google.com with SMTP id i22so15941461ioh.2 for ; Sun, 18 Aug 2019 10:24:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to; bh=IVt2kqhj5zCm6qSZhYRtvDqkoDXnGP1E6MFoO8EYnHo=; b=anQtucAtGkvlD6Hct0NGdQ7ipLqKNxEeRPbHXy+sFyuM7IUD+XdhRFv3yz9ZDbcmhU RRJoUEtII2jVAWhVZXcm/imHcW37fOXfLHWPjyIbJaVTB03mz/w7ci2SEIYzVGZgHEGF fin92fQ2EintYHX0FAMf/8d/652FNlyalgr3kgONGsRe3lcvMKZRfGk+DbJsqqeTGyjS uQqNsBjBpplZ4X0px/FIcxyg/IZroMWD99iLxqLAKmNYtDaATjdmWbnaN8ae5rkBySUt 22V1+iYPB1AsUnhpxdaNnuxeLmRzp8o7fdIQqEpDcPa9lZnhRFPJRlL5Rz+VTX3EU7T4 m0Rg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=IVt2kqhj5zCm6qSZhYRtvDqkoDXnGP1E6MFoO8EYnHo=; b=BVAP8QUX3f6hTPNBK4MLeYnyydZHXtBrDJ88kbrMwo0pC8EypoPA3lwiFdx46dvB3o KzvJVOarLNzZpzi5JN49+Z5bdmW9vlNy7utvMOOur3A90B5RAVtBhs1l0bM2JGkUvZ0X zjhWu0xY01EXYWAYaUE5dr3t62v8Op3ckvpwwFdBpiKg/g1z3N4r5dTFfHgzAgWRAh6Z x2tbDDHSdyjyJ3Hh51TJh+6RMgwpda5cPSm+OOCtkHhFRw13Iy3Ruil/XkzlZI8EiLIM +l2JRfxuRXpPggoAb6TDGAjzAI2ZCwNS7ZdCshT0eOZ7OLujJ/Ai4dlLLgbB1/eXjwLW iWDA== X-Gm-Message-State: APjAAAUtlkuJfhOhRDi5Z4Uil3aqEcbLPWmmCbQbNhxzhuhXorpNF+xJ 1KMwlNqUFMTREQc1uxXasbio8RqYtk3QrYIOIKg/arvIUWUHOQ== X-Google-Smtp-Source: APXvYqzB6UiVugVdEdy97FG10eptuTK3OtkLCs6091mhDZPKRwsR7scwYaZJqMx5ADN3MP1GeVlKQXv38lU/HzjcVmM= X-Received: by 2002:a5d:8457:: with SMTP id w23mr9882668ior.189.1566149065480; Sun, 18 Aug 2019 10:24:25 -0700 (PDT) MIME-Version: 1.0 From: Rob Sayre Date: Sun, 18 Aug 2019 10:24:14 -0700 Message-ID: To: ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000b6a3430590677e7d" Archived-At: Subject: [Add] Home routers with their own DNS servers X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 18 Aug 2019 17:24:29 -0000 --000000000000b6a3430590677e7d Content-Type: text/plain; charset="UTF-8" Hi, I was reading the paper ekr recommended: < https://www.usenix.org/system/files/conference/usenixsecurity18/sec18-liu_0.pdf > and I noticed they provide a service here: I ran this in Firefox with DoH. As expected, I got a result that indicated my resolver was Cloudflare. In other browsers, I found that my resolver was run by Google[1]. I was a little puzzled at first, since Google is not my ISP. But, then I remembered that my router is a Google Wifi product. I guess it uses its own DNS servers sometimes. I don't think it always does this, because I do occasionally see DNS redirect pages[2] from my ISP for NXDOMAIN responses, although I don't right now. Another possibility is that my ISP sometimes intercepts this traffic. I only bring this up to point out how fluid the terms used on this list can be. I guess I'm the network administrator of my house, and it appears that I've purchased a router that uses Google's DNS servers by default (fine with me). I hope my router is using DoH or DoT. If it's not, it might get updated to do so at some point--its software self updates all the time. thanks, Rob [1] https://www.whois.com/whois/172.253.0.2 [2] https://tools.ietf.org/html/draft-livingood-dns-redirect-03 --000000000000b6a3430590677e7d Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi,

I was reading the paper ekr recomme= nded:

=
and I noticed they provide a service here:


I ran this in Firefox with DoH.= As expected, I got a result that indicated my resolver was Cloudflare.

In other browsers, I found that my resolver was run b= y Google[1]. I was a little puzzled at first, since Google is not my ISP. B= ut, then I remembered that my router is a Google Wifi product. I guess it u= ses its own DNS servers sometimes. I don't think it always does this, b= ecause I do occasionally see DNS redirect pages[2] from my ISP for NXDOMAIN= responses, although I don't right now. Another possibility is that my = ISP sometimes intercepts this traffic.

I only brin= g this up to point out how fluid the terms used on this list can be. I gues= s I'm the network administrator of my house, and it appears that I'= ve purchased a router that uses Google's DNS servers by default (fine w= ith me). I hope my router is using DoH or DoT. If it's not, it might ge= t updated to do so at some point--its software self updates all the time.

thanks,
Rob

--000000000000b6a3430590677e7d-- From nobody Sun Aug 18 10:54:08 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D8D24120121 for ; Sun, 18 Aug 2019 10:54:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EF_fClXqoAll for ; Sun, 18 Aug 2019 10:54:04 -0700 (PDT) Received: from mail-io1-xd36.google.com (mail-io1-xd36.google.com [IPv6:2607:f8b0:4864:20::d36]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9EAE9120059 for ; Sun, 18 Aug 2019 10:54:03 -0700 (PDT) Received: by mail-io1-xd36.google.com with SMTP id j6so16006488ioa.5 for ; Sun, 18 Aug 2019 10:54:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to; bh=W0qdiyNGxMvIrCpNltVe203pQRpRbzJlgEecfUiZAZg=; b=KIaMVtnH876Vr9kaSuTrTT/Y4QhGn9UKJd2v+wweJBQ8V9hAOmyoCmcMiH/pKdsSek XCI50Y4Gf8I6ySJAiHDxsokR+1BVX4afz5VMzVEAMwqIKZ5lC9LqphO6e3CHH5snK/lo kY5vD3BbWQ6y9EUC8ka0+pfFF//ulxpa/VBXETntf7Txcy8QOpgh7UVZ3z56h0Z0NT/l KDPyyckBtZDkB+gm8y7B2Xbz73bgx4Kj5U3YN+tivskGxSOlkEiTsqtVgAFrfeGqkOLN pequ5Rth2n1nhPgymQ4CIsr9gR6RHRKPldGDeuyzO4oZ+PzRUZVY8DQO13kwD40oGiRR KfLw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to; bh=W0qdiyNGxMvIrCpNltVe203pQRpRbzJlgEecfUiZAZg=; b=kpmzau5AyO9FHzRK49kF7PIO0ERvlz4cL/znLnITgRZILlUk08GrVa21Zli8n+c299 TjAQIV3ZMICCCr9+myCQvGHLYh3eKzx8Im/SeQG+MahpBuT5LHjqdJmu6UNoGO7sKsDC ezZUVtqKrMVeea7h99V6/LQQ7SqGgRS4xQF0TEPchl0CRrBne8hh8SYaGcI4t097dOUh zoAurNn7ozx+YSZHLDwm8k80wyaYCSaO8+neUNTd/NRNxTxNREN7cRz9kOEWyS4ZKsFd u9YPqGIwB++6jTJz/xgYzR8evyLvAw1ynejxgbPirZokiDFmVw2gl5mnTZswm9ncZclH MCsQ== X-Gm-Message-State: APjAAAW5VMyqW5pMVHHurRfw9nlzXN8JxFDNoiMdv1MxZyEHToQmjJ6T 0D5STLkM31ZtZkp6+x8serR8ZubT7bVoaPYpBLRuJ+HUB2M= X-Google-Smtp-Source: APXvYqxLIu4SAezvT/OF1gfVNYXNEKaHV05NOAbXb2a/P0RQBJtbx5e0MDg+lPEfp160b+Cb7uXAvThiQM3CB52rSRA= X-Received: by 2002:a5d:9583:: with SMTP id a3mr21432926ioo.54.1566150841958; Sun, 18 Aug 2019 10:54:01 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Rob Sayre Date: Sun, 18 Aug 2019 10:53:50 -0700 Message-ID: To: ADD Mailing list Content-Type: multipart/mixed; boundary="00000000000099b41b059067e84c" Archived-At: Subject: Re: [Add] Home routers with their own DNS servers X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 18 Aug 2019 17:54:06 -0000 --00000000000099b41b059067e84c Content-Type: multipart/alternative; boundary="00000000000099b417059067e84a" --00000000000099b417059067e84a Content-Type: text/plain; charset="UTF-8" It looks like it uses some local telemetry to decide whether to use the ISP's DNS servers. I've attached a screenshot of its management application. thanks, Rob On Sun, Aug 18, 2019 at 10:24 AM Rob Sayre wrote: > Hi, > > I was reading the paper ekr recommended: > > < > https://www.usenix.org/system/files/conference/usenixsecurity18/sec18-liu_0.pdf > > > > and I noticed they provide a service here: > > > > I ran this in Firefox with DoH. As expected, I got a result that indicated > my resolver was Cloudflare. > > In other browsers, I found that my resolver was run by Google[1]. I was a > little puzzled at first, since Google is not my ISP. But, then I remembered > that my router is a Google Wifi product. I guess it uses its own DNS > servers sometimes. I don't think it always does this, because I do > occasionally see DNS redirect pages[2] from my ISP for NXDOMAIN responses, > although I don't right now. Another possibility is that my ISP sometimes > intercepts this traffic. > > I only bring this up to point out how fluid the terms used on this list > can be. I guess I'm the network administrator of my house, and it appears > that I've purchased a router that uses Google's DNS servers by default > (fine with me). I hope my router is using DoH or DoT. If it's not, it might > get updated to do so at some point--its software self updates all the time. > > thanks, > Rob > > [1] https://www.whois.com/whois/172.253.0.2 > [2] https://tools.ietf.org/html/draft-livingood-dns-redirect-03 > --00000000000099b417059067e84a Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
It looks like it uses some local telemetry to decide wheth= er to use the ISP's DNS servers.

I've attached a= screenshot of its management application.

thanks,=
Rob


On Sun, Aug 18, 2019 at 10:24 AM Rob Say= re <sayrer@gmail.com> wrote:<= br>
and I noticed they provide a service here:

<= /div>

I ran this = in Firefox with DoH. As expected, I got a result that indicated my resolver= was Cloudflare.

In other browsers, I found that m= y resolver was run by Google[1]. I was a little puzzled at first, since Goo= gle is not my ISP. But, then I remembered that my router is a Google Wifi p= roduct. I guess it uses its own DNS servers sometimes. I don't think it= always does this, because I do occasionally see DNS redirect pages[2] from= my ISP for NXDOMAIN responses, although I don't right now. Another pos= sibility is that my ISP sometimes intercepts this traffic.

I only bring this up to point out how fluid the terms used on this= list can be. I guess I'm the network administrator of my house, and it= appears that I've purchased a router that uses Google's DNS server= s by default (fine with me). I hope my router is using DoH or DoT. If it= 9;s not, it might get updated to do so at some point--its software self upd= ates all the time.

thanks,
Rob

--00000000000099b417059067e84a-- --00000000000099b41b059067e84c Content-Type: image/png; name="googlewifi.png" Content-Disposition: attachment; filename="googlewifi.png" Content-Transfer-Encoding: base64 Content-ID: X-Attachment-Id: f_jzh9qmq20 iVBORw0KGgoAAAANSUhEUgAABGUAAAYuCAYAAADi6pHYAAABYWlDQ1BrQ0dDb2xvclNwYWNlRGlz cGxheVAzAAAokWNgYFJJLCjIYWFgYMjNKykKcndSiIiMUmB/yMAOhLwMYgwKicnFBY4BAT5AJQww GhV8u8bACKIv64LMOiU1tUm1XsDXYqbw1YuvRJsw1aMArpTU4mQg/QeIU5MLikoYGBhTgGzl8pIC ELsDyBYpAjoKyJ4DYqdD2BtA7CQI+whYTUiQM5B9A8hWSM5IBJrB+API1klCEk9HYkPtBQFul8zi gpzESoUAYwKuJQOUpFaUgGjn/ILKosz0jBIFR2AopSp45iXr6SgYGRiaMzCAwhyi+nMgOCwZxc4g xJrvMzDY7v////9uhJjXfgaGjUCdXDsRYhoWDAyC3AwMJ3YWJBYlgoWYgZgpLY2B4dNyBgbeSAYG 4QtAPdHFacZGYHlGHicGBtZ7//9/VmNgYJ/MwPB3wv//vxf9//93MVDzHQaGA3kAFSFl7jXH0fsA AAAJcEhZcwAAITgAACE4AUWWMWAAAAI8aVRYdFhNTDpjb20uYWRvYmUueG1wAAAAAAA8eDp4bXBt ZXRhIHhtbG5zOng9ImFkb2JlOm5zOm1ldGEvIiB4OnhtcHRrPSJYTVAgQ29yZSA1LjQuMCI+CiAg IDxyZGY6UkRGIHhtbG5zOnJkZj0iaHR0cDovL3d3dy53My5vcmcvMTk5OS8wMi8yMi1yZGYtc3lu dGF4LW5zIyI+CiAgICAgIDxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSIiCiAgICAgICAgICAg IHhtbG5zOmV4aWY9Imh0dHA6Ly9ucy5hZG9iZS5jb20vZXhpZi8xLjAvIgogICAgICAgICAgICB4 bWxuczp0aWZmPSJodHRwOi8vbnMuYWRvYmUuY29tL3RpZmYvMS4wLyI+CiAgICAgICAgIDxleGlm OlBpeGVsWURpbWVuc2lvbj4yNDM2PC9leGlmOlBpeGVsWURpbWVuc2lvbj4KICAgICAgICAgPGV4 aWY6UGl4ZWxYRGltZW5zaW9uPjExMjU8L2V4aWY6UGl4ZWxYRGltZW5zaW9uPgogICAgICAgICA8 dGlmZjpSZXNvbHV0aW9uVW5pdD4yPC90aWZmOlJlc29sdXRpb25Vbml0PgogICAgICAgICA8dGlm ZjpPcmllbnRhdGlvbj4xPC90aWZmOk9yaWVudGF0aW9uPgogICAgICA8L3JkZjpEZXNjcmlwdGlv bj4KICAgPC9yZGY6UkRGPgo8L3g6eG1wbWV0YT4KCYk4AQAAQABJREFUeAHsvWm0XNWZpvlF3EHz gCYEAiQZgZDAIAYz2gbPGJfTmXZWdQ6VNa2q7srq1f2r1upeq//0j171o3p1r16ruzpdmVWuysrO 0U4705lpY2O7bMBgMPMgCRCDJDQgJKHxSneIiH7fvc+OiHt1JV2BrkJIz5ZunBPn7LOH5+y943zv 2UNtwQ0PtAIHAQhAAAIQgAAEIAABCEAAAhCAAAQgcE4J1M9pbEQGAQhAAAIQgAAEIAABCEAAAhCA AAQgkAggylAQIAABCEAAAhCAAAQgAAEIQAACEIBADwggyvQAOlFCAAIQgAAEIAABCEAAAhCAAAQg AAFEGcoABCAAAQhAAAIQgAAEIAABCEAAAhDoAQFEmR5AJ0oIQAACEIAABCAAAQhAAAIQgAAEIIAo QxmAAAQgAAEIQAACEIAABCAAAQhAAAI9IIAo0wPoRAkBCEAAAhCAAAQgAAEIQAACEIAABBBlKAMQ gAAEIAABCEAAAhCAAAQgAAEIQKAHBBBlegCdKCEAAQhAAAIQgAAEIAABCEAAAhCAAKIMZQACEIAA BCAAAQhAAAIQgAAEIAABCPSAAKJMD6ATJQQgAAEIQAACEIAABCAAAQhAAAIQQJShDEAAAhCAAAQg AAEIQAACEIAABCAAgR4QQJTpAXSihAAEIAABCEAAAhCAAAQgAAEIQAACiDKUAQhAAAIQgAAEIAAB CEAAAhCAAAQg0AMCiDI9gE6UEIAABCAAAQhAAAIQgAAEIAABCEAAUYYyAAEIQAACEIAABCAAAQhA AAIQgAAEekAAUaYH0IkSAhCAAAQgAAEIQAACEIAABCAAAQggylAGIAABCEAAAhCAAAQgAAEIQAAC EIBADwggyvQAOlFCAAIQgAAEIAABCEAAAhCAAAQgAAFEGcoABCAAAQhAAAIQgAAEIAABCEAAAhDo AQFEmR5AJ0oIQAACEIAABCAAAQhAAAIQgAAEIIAoQxmAAAQgAAEIQAACEIAABCAAAQhAAAI9IIAo 0wPoRAkBCEAAAhCAAAQgAAEIQAACEIAABBBlKAMQgAAEIAABCEAAAhCAAAQgAAEIQKAHBBBlegCd KCEAAQhAAAIQgAAEIAABCEAAAhCAAKIMZQACEIAABCAAAQhAAAIQgAAEIAABCPSAAKJMD6ATJQQg AAEIQAACEIAABCAAAQhAAAIQQJShDEAAAhCAAAQgAAEIQAACEIAABCAAgR4QQJTpAXSihAAEIAAB CEAAAhCAAAQgAAEIQAACiDKUAQhAAAIQgAAEIAABCEAAAhCAAAQg0AMCiDI9gE6UEIAABCAAAQhA AAIQgAAEIAABCEAAUYYyAAEIQAACEIAABCAAAQhAAAIQgAAEekAAUaYH0IkSAhCAAAQgAAEIQAAC EIAABCAAAQggylAGIAABCEAAAhCAAAQgAAEIQAACEIBADwggyvQAOlFCAAIQgAAEIAABCEAAAhCA AAQgAAFEGcoABCAAAQhAAAIQgAAEIAABCEAAAhDoAQFEmR5AJ0oIQAACEIAABCAAAQhAAAIQgAAE IIAoQxmAAAQgAAEIQAACEIAABCAAAQhAAAI9IIAo0wPoRAkBCEAAAhCAAAQgAAEIQAACEIAABBBl KAMQgAAEIAABCEAAAhCAAAQgAAEIQKAHBBBlegCdKCEAAQhAAAIQgAAEIAABCEAAAhCAAKIMZQAC EIAABCAAAQhAAAIQgAAEIAABCPSAAKJMD6ATJQQgAAEIQAACEIAABCAAAQhAAAIQQJShDEAAAhCA AAQgAAEIQAACEIAABCAAgR4QQJTpAXSihAAEIAABCEAAAhCAAAQgAAEIQAACiDKUAQhAAAIQgAAE IAABCEAAAhCAAAQg0AMCiDI9gE6UEIAABCAAAQhAAAIQgAAEIAABCEAAUaa7DNQiJgWi48XVat1f muVwtZ306gl+zvOvXdk7k5QmLqe99gLgMwmU7jIxaQ5rpZxMenaSEDkEAQhAAAIQgAAEIACBDzGB yi7ofk5utcozcSdf3ec7R6dpT8/kU4nvTJ7YO3k69VXJ32ltpbOf7xPy27ZLzn5c0xGiqZ6MbDtv XXlqH5uOxExjmCfL4zRGef4FnSuJKqn+RZzYWESrnipwp9JVedBxuzbESSqaz9XqfcmfdrRthsMp V3YXnFp/pHPZc48+W0pvt/B0umRUeW61dKH+5zyOv+iC4jM+a+lbynt1/MTSU496KSfmg4MABCAA AQhAAAIQgMCFTsDPv7IT2s/JSRBpWwU59z4mGyKZSNPBQ/Enu6baWhMq6fHxVqsyZJJl1knbxOf5 zpnOXkluLSVez/u2IUtw5WTXtl4fSLbSCfZkl58z3c15y6ntpCzvle8pvyVdaasz3p5Pf4VdSVMX COdu3P3oEmDa3ipby9/L/W2f+5DslPv1IUnudCQzI6jFgDSFhm56f1tk6VQaCyluMOrJz8RUlIKi ql1Vxg5Wn2s1G7q2T2W/pXAi+lTgGkkpzuEW383RWhT95lSVemL8H/R7twjjBqUU5pKuU4Y/UWhQ vkp45foPO59T5r8qLbW6bqobkhNcs92QNNWImEnye4I/DkAAAhCAAAQgAAEIQOBCISALYJydUCyD Kn9+LpYx3arL9ijGwtnOuuKX9aVH9GSFyUbppCHbdg3F6GNOwMREZL/lrO3CVmssp7AtDOhsev7X OeWjrvjyVZU32wdyto1qLcclO1C25tlyyWYTQ3Nspz6lTfZHSWPirBirrS3SdF98b3r4lzpDlPhN rex7K5vc6Z3oamIcLfNTuUn3I3me1O/Ea8/372evVJzvOT1p+iQiSGyptUajpa4qfbWWCrF6tliE ccWtWomajrkyWbRxhSyqaLsCp/ItUUXXNXzeNbKodjpXkzBj87zep0qj8lRXJS1NRDMJPq6sjq66 JdPWOo0H4UaiqbTVLRopHa2UdzcgalycZ21P5VKDVinNrihOdhF1mg6mqiu5/n/4+Jwq7/lc5tNs ZIZNlZHCMjWGajhyefF9baps6D43MxQ3Jt0/DqePCx8QgAAEIAABCEAAAhA43wkUaSK/rLWt0a8X 4I0Yka2kHiM2uGXzNOtj0df08VFlKD8rZ3uiXP/+8mn7ptgjtkX84t2GvEP1k7t7yMj807ZfNpuN FxtrsoO0WwQU+0vhJHvGz/eyFxVCU4acX+Y7D60Yi7ry0erztdqm0D3CQnvKszKoUHL8rWRX6tAk YkPy9AE+Wn0SixR/d76T6OG0SwZqioc5pLz7I+152xtn+8f3p9MBwqzLyJSWUjyYUmgb3RxtkTZq 6uTQEOOa8urble5mTn9NPhRa+tLNoDe5e3+xIsqIm1XNpgSZumrimCplX00CjW50t9HcUmORKpMq XzKk833vUNd3a5SpAqv+dRRLq5djKfwZEjkuX74oFs6bEQvmzQ6LMUcOHY99R4bj7d3vyo8rrhol iTnnqkBlUcV5HVOeVaDdgFSuu6KUYxO3ruMWmXLlqs4qH2bpli33DdHxDymfifk92XcLMWbprRuP xMNc9GNjRrXmqLbyk34AFIoa5O7G5GThchwCEIAABCAAAQhAAAIfLgK2iGwfZHHEz8UWXizItAYk ZjT0HGwxREJCoyahRsKMBRo/KLcqIeOD5LctyFSB9OkZvJFePluc8It3ixiSLfTcPmfmzFi9Ykks WzQ/Fs6doe+zYsH8OTF/zmAsmDWoEJpx6NhoHDhyLA4dHo6hoWPx3tBw7Nl/KLbueE/nDsmLXuhL NEj2n8K2meg827Lz6Ij+Kn4npzDx/tlwDi+LFaMxZ3BOLF48K2YPzIjBGQPR36/8yr4bcLY9VEPO /nvtsv3ZEc5Kmsp9GxvL9vbIqGS8kZE4OjIWB947GkeGh8TaxpT+fA+LzVyJbs5XCaPXeTzT+GsL bnhgorxwpmFcOP6TKDIWt61fEzdftyKJuO1CowK9+a3t8cizr6cKlpuaKutWPF04Ktct5vjQkkWX xGduWR03rV8Zc2e454QqT9VI5UsacXCoEc9ufD0efupNiTRH5MeNlc52hZv9nv3PNVctj0/dep01 SMWp9DVVyKfoLOT4urJ9bed78fCTL8WYGzp3/bH7kPPJmZj6p+9tFmay4m+5zg16GrakHjXplp6D +zr1FOMTAhCAAAQgAAEIQAACZ5tAPY1C8LPxonlzoy6NwxNFNKQLqHNJjOqvMdKQ4HFUtoOtq/zM fNZSYf3B5oi26SW8dyWQXLV8cay/5tK48SOXx+VL5upoNf+n9uySSKCe7e5AU1w6pi95CJNHGGhf QsyOdw/Hi1t2xsY39sTWXXvlo7ISK/unT3kf0wvb8gK3hHdWtlUcg/115WlpLFo8RwS7xQ7bnfnF u+21Tj47L+HPSjrOciBm3bbBk82k9KoDxb59B2ObOjKMjMmuqvx0oq7srROOd3ycz3uIMl13Z74U xa/d/7G4ec0VOiql1gW9ci7ID7+0Lb794BOp14t7gZzg5L/TQ0aNjrpc3XfHunjgzuu0r14SXRXb Fcad3rLrNEBDoyPxnR8/H0++9OYJwU/Xgftuuza+eu+GKilKZNUI5cbm1LEm3UVCTrSGlZuBeP7V N+Mb331SF5W8dV3/IeXTlYPT7rrhtUTl/zMGBuLm9VfE7euujEULF8TuvYfjmz96KvYdODJJQ3La oPEAAQhAAAIQgAAEIACBDwcB2z16HraVs3DBnJg9OCPqMhwmWgh+WT00PBrvHdZLaf0r4skHyWR+ uW1rS8a9nsz79K+/vz/uuHFV3Hfr2lg8f/aE4DuCxansn2z3VIJBeuLviDkWCd7VM/5PnnotnpId NzIi2yi9Ye+SmioRZULk7+trsR7nzZkV11x1aQwMuJeRegFV89g40NQZSR7zaA5fcf67E8WW8Wke HW3Ga2/tjqPHjhf5q+OhKnOdAx+ePYYv6V755l+nwvybX7ozFswerBqLLLqUiumeIP2qr2k4zgmC TKkWLvLZ+chvffHOuO26K5IYUxqg0qvEXdmSkpmEGskz2nrOmtkDg/HbEoaWL5oT3334pSq06dzU Y+Gc2VX8ajvVpU/tV3K5ISk5mjwNSWiSAmvltaY8pTlpKoKdKz7MfDq5ONVe6R3lrpGL9MPz8Zuu jrv1N0tCX3GXzJ0Vf/+zt8XvffMnYvzhaBhL2tlCAAIQgAAEIAABCEBgygSS8ePn3bEYHBzUo696 bLSyiNG2nT1PiF7qDnokwaFsLZ3a8pha7B46ZHOkJUNusK8/7t6wJj59+/pk59XU4yL3dukOqyOu SDmyQZROlhfqSYzRkWz3VOlUDw6ZkOlYsul0zVK9hP0Hn9kQX7hrffzkyY3x2HOvx7BEhNStxiGe rZ7yEneaCmverJmx/urLUlr9YUFm34GhOHzoqHqTaMabxlg0NFRsRGlraEjQ+T60x/P21Ps0o4zu X5+GW/Vr3FWf7t/82bNi6eIFymEjiU9r1cPplTd2xmEJM3lKiDyNxAkmaJvM+b9z4Ysy7Vrvm1HE gc6NGezviy/fe2N84pZr2vWlc7aqfNWBUjG7z+f9qvlwHU3xNeOrMr5vW39lKvypAqiSJIHHE0NJ ukkqYDsgVWUJGm4k7Oz/M2o4Dmv84n/95SttX2mnyk+an8SzeI/Lnyujr1d6plrpVannpPGS4/Oa Iz2zZtF8nK9E2UqwXUpH2df3c80nJeLkHyeWiJP7PeFMUbudb+V69eVL4xM3XxMbrr1CDUjx7fl6 PMeMMx6xbMkCdeOUeJfb8+KJLQQgAAEIQAACEIAABM5jAvmpOdkwlWiRE5uP+7Ol5928zHSxIfL8 kmlKg0qQ8TXtx+B0zDZQ+0gO8gw/y8vR7svcO2bDuqviy5+8QUOn9AJaL5Gd9rQKkqJr23UNfZEA kL53PaCnZ3flM209L2R6Cd2JIR3X15rEj5YWcsm50jO/gvNL/l+7b0Pcd9va+Bu9ZH9m0zaddm+c iS6zS/aRBAcFJA/21zYkJl6QvtvU86Ixa1Ytb/eOcQ+SLVvfjUNDRye95owPJptt/FU5tVWax586 K988ibL//Lo/2bPaarBJ7H3vcPpbs3JJ9PcNys5qxZqrlsVzr24Xb49uydFPVg7OSsLOQSAXvihT 1fF8kypZpipky5fOj3/6pbvjUm19Q7MrjYi/nVmhy3PFtOL6q6+MT2xYLe1FEalmppWbVMBcYHa9 +168+PrO2PTmO+pG1xfXr14aN1xzZSxR7wqLMWV2Fsf+lU/eGBvf3Bnv7DtcVWRXUDdcmiRLFTul rsqfJ866bOmsmDd3Xuw9eEAFd4oVUtfPVUPV7ZyOUY3Vs0uCUvfJCfsVytSWNNQ4jA5rUuN0YeHZ uaAnfDrRT7rXfbdTsi2OOent8iDBTP0ovWKS/abeQFZxxS33Coq45ZoV8Ynbr43Vy5ekOLL45l0r 6L5BpmTXiH37DyucfPx0bPM1fEIAAhCAAAQgAAEIQODcE7D95JeJWWzxM7JFF78U1sNyZYN45VqP AMhjAPz06/1z44oR7lV6Snocsyft/a0v3JYm8E0psdgiYcVvRdPqsNqmvPgRvZoANy/CVJ7ZbXHJ j07n53V9KwJNCrB8iEV6Eys25iE/RSCwaONe8v/ogY/FJ25aHX/yg6fS5MA2M9p80mS1MsetsnjU gUUtx1qxLbFM3Hp+moVz5saghizZacrK2LRlRxwb9SpWJ3PjYj6Zp85xpyEBcLZsf+rOphfSHS/T uZd6OymChEbbQ5pgefPre2Kd7C4LGO5dNX/2bB0fai+ykq85w3xOZybOIOwLX5RJMGwEZyquiHXN 2nzv7dfElz9+g+qReq40R2SDe9opG961NMvzDA0j6qoyp0aaeoXoetXmumbf/tp9N8i/55Bxxagm glKF36iC9B/+8mFNbpVXWHIBf3XrrvjBw5vid3/rE5qgSeqfGz5VaDtXTA93+Xd//lOlLPewsVhg 6cbO1ddhLJYQ84+/cmesunyx0qDjOvHkS2/Fnz34tHxmv+mCyT7EY6G6vnWrso73f/l3f6Vub6e5 tgovNSBuqJSWlhNgl3grIRY3esgnJ+Z0n7ny+kekpUYuLw3uHx01rFLFXV7M2s7ZsSAzR7Oa337L 1eoZc3VW39PqSsq0Gnk3xi2xe2LjW/H2ngPx65+9RVc6hL54avNb1X4CpH0cBCAAAQhAAAIQgAAE zi8CtjH87GpxQg/EKXGes8SyS8dp0t7kz7ZW9ezcOTmte3n1ppyWNHdM9VbUz+a/8skNEiw6vU08 IW/NvVBk7zVaWgXKqxIpK06z89enh/eGHvCViySueIGfuhY+aUrISWKLfFmcauiL/SYmKXfdcTgt OqOgU1JsR2i/LgnBqzv9T//oC/Gdnz6tRWO2pLCSbZFeAlvwcE8cvZrXNV6zqdgdJwPoF91z59tW zW6/epK0BRnFuUirR3kahRtWXxZLFs7VkB8LPrZrdDK509l4fXpB34q9Bw5qEuNd8csX34w9h47o yu57XwU1zRunOdu3jRjSPD1733svlmvkgZnNXzAzDh4d0n5JV74H05ykaQn+IhFlqqLtcqgKeL0m 8v21T95UVShXHo1ztKCgivhLiRnffeT5+N9+9ytTB15VKHe3ul0NweLFC1Un8zwrDsQTBm/buS/+ 8K8fTQKFx05aWEmqrlIx1Dwef/Dtx+N//K1PaSyiZwCXS13p+mLNlYvi2lWXxitv7k6HXdTcgJTJ ZK2U/trnb4pVV+ReGlZKrRrcfsOqeOfg0fjR4y+n6072YYFhgZZ/y+Mr3dBGDB/T8mOqiLnina5Z cMOjSu4LlZa6VK+OilpVkB7ycbJO76ztuxnVp390JK6V5fjSTOk67ubX+Vy6eFF8XGLMXdevjMF+ 91hyA6d7XZ8pH2MxpCFnP3v+1Xj82TfSOMff+sLHUsi+Z8ePj8Tzm99OySnC2+nThg8IQAACEIAA BCAAAQicOwLpuTgZutk2yM/Jkmhsg+jZ199T7xlt/YybepTruPfP1TNuTcqJU5fjbOjF9oz4jS/d Grdfd1USQ5It5clvvfy2RY9kB47Jn57fx/SCXC/Mx2T/9UuseefgoXhrx8F4c/fuOHxkKA4eacSR Y0MxdGgovbCdreWx582eGQtmDkoImBWrLrssVq1YEMsWzE3Dh9JLW1kCjiMJMo5LAlbdL9stCCmt /f1NzTdzm65bFn/xg19qrplRpUs2hs0Prc5U3OktL/tsakVf2a8V7wNHPLeKWUiQ0fwrv/XA3bFm xSXyZ9HML85lrzQUUeoV5Bg6c146tMncgNK7fOnCuGzJwlh9xbL4s+/9PPYeUjzn2HnEgm1sL5rj zgZHjorVEnFTfszAWSrCoOWsqfE7x5mYQnQXvigjQaSsiGQBwj1lLJLknjGuAFIOJaAc1hroriDP v7Yjre0+BXbZi8LLLYLiUYX/uJbTzpV/QBXDBrsrQsQf/t2TcdwNQGrGknKS4vVkuq5QRzT+71s/ eib+1d//dDLyU+XWhZriSI3LynhNoowLWUq/Km5RBD0R0o2rtHy3RRw5tTNaXy43nTddveK0oowb 1DmqvFbDU2MlFu9JcXRlz2nV5lROLNXWpfSkRrgvK9HtBrnHfE6VdJ/LpPIPS90Kte6hG06LMBZp aklkasQ6Kc33arb29asvrX5sVO11HzyEtBUzYufe/fHI069J1NuuhmE0LX23YM6cuFUrL9mZx8+k jA8Pu9F0rDgIQAACEIAABCAAAQicfwTGG7bZ1LWtMF89ML5w90fjOr0wzqKAjH49Dw+NjMbmt96J Hzz2Yrx36Ng5yVCxVJp6xp7ZPyP+6a/dFdetvDy9HE7TUmiZaL8k9+Sx6QVqJUo0lY+6zu3RSknP vbw9nt6sXiDqaZKnlrEFIGcbTDtpqgJNljt82KtDeWoI9dqQyfXoc29otxmXXbIgbpII9LHrV8Xi hXOSzefRB6lXTiWYJPHI639bRNI1H9M8N/Nke31DoyeGxU7JSbZg23aaEr26Jk+uXg5L/Dl+fNgG SRIv7tI8qWtWzK9CGZVoIUFKaZLJK1d69tgmPZ3zy3YziFirl/+33XJtPPjTF0530Vk6r3uXhnbl KSOasp0yn3ocO+77sCSaEo3MwKKTF1q37ZoW0pF4c2Ysz1KSP2AwF74oI3VD5Sm5lkuWKoSdhRh3 YXMl3bxjb/zJ3z4qVXQknZM8kW6mxZLTOpeDVGvrccmC2XHV5e5O1Z+MclcBh7F93wHNJXJQ/oRb futSTpoa7lKWSXPBseb82lvvxlGNi5utiXeL8un4b9TEsd986Jks6ii+JMhUcdY0L40lQl/vil4b VlgqpFZnPQnS6dwlGosnFUd/EpFSq9CvsXmZgwv3aZ34WqEsPtW2KH1d8faYz+nS3063Ep64pl4v rsz1mKmhbbepkf34LR+Jy9KM31lcyWFa3e6LjbpnP31qc2x6a5dOOjQ3GlnNvXvD2rwUuo6NSbn6 xXNb0vAn3SwcBCAAAQhAAAIQgAAEzmsCSY4pNocM48/fc7PmUlweMwZtI2UDf0B2jYcKbdBcH3Z/ 9uCTaXvuPupx60dXS5BZnmyQNJRJlol7n2R7Kqe1lez2lpatPhAPPv5KPK9pBrQekZKZn92z/ZZH OuR8y2ZMQ4rc0ybbj/KZetc4b17kY5fmitz12Mvxo8c2xk3rV8X9d62NZZdYEMn+k4WUegXYJpSd oJe97jlz3cqlccdNa+PhZzc6KIVqA8o75bp0+OQfEiwGLDrJeW6ckVHbrrIxJUh8VCsTpZfMylqZ /9LTa4xfVbeIM5NHYRbJVlXYdha+blt1eTwY50aUsX1uvskWT6KL85IA5bxq12LXzDTBsvYtoim/ Fm/80rzcr8lzd34evfBFmTZ3V85S0C1gqAOUKsbfPPx8/OzJ11QVdPMl0iTDWhUiVZy2mtgOZPKd qgKt+8hynfd4wKSTJL8WXJ7ZuD1XBIsm+tdoDFeFxekpsoALUjOe1yzSd2kMYJJrPXmTxJWBwb5Y feUSTQ4sw7+4Ks5RdX17S0Oj0nwyrusSZIo6+6oEg9O5WXM9HtEVs5OOQ+q2dyYuX+kGTWq0JrvK 4027Qughn65UnHxXFdvtpf7LaeKs2XO1GtdH4s4NV8fcAanQuT1qX+8xlk9t3haPPPVK7NQkzB7r WISYMTUEbhD71Ejce/OqdK3FsudffTv2HZGKXSm57cDYgQAEIAABCEAAAhCAwHlIwD30k1BgQUHP 8+tWLo4ZaeRLNuptCPvVsl9UamRP6kFzLrPhXu22Yd6VODKm5/P+tmVbbDmnxi+f++Lw0HA8+MhL 8diLb6Rnd6c8OQkcFgDcM8MjFBxeHqBVnU6r42Zrx59paoNKKMg+vOh3K57e+GY8u3lr3C6B6Mt3 r4+5c2bpdEMiQb/4KDYbFP6v4VJeT2Xnvv3l8sS282UKe7oXtjUsWni0xJh66VuIsN25SIvH6IxS pFykBFsIcl6VryrdSew4RTTJpnNidX2xgxZe4hf558YVUSXZWMpjXTamTGI5veiW+JTKnTpY1CRM OS9FiJkhu83Dwj6Mrl10P4yJn3qaXWFLZXNXr0bs3ns0/ujvfhFvv3tAtUMFW/Kpu7OlQuqGZ6qC jHym+WgUxhUad5fH6Pn6jnvulW3pSxJKVUFKQXNJd8qK7yTgvLozizKp+0luLFzwLl92SdUbQxco fVq1PVUsX/vHDz4R/93X7k3z0SRBRse2qPfPgz/fpL1Tu/kaH2nnCpcqsCrrEfXWmarL6c+fzpfH lOZUd0LoJZ9OKk6xpwRbPfaS1veqa96GtZdnFmLSyUtDvZjG4mF1V/z5s6+l+WJSmUo+8j31vfA8 QW5Abl6/MvV4cqzm+rNnytLm5W6fIj2cggAEIAABCEAAAhCAQI8I2B5KBryM//SUr62PzdEcHl7F yOeSHz/7S/Tw87L30vlzmmY/V9fTwil/+L1fxD/78seUriyslGTUNNfM489viW8/8pzmzaxGAySr vrLClLfktO1X3paqp8u8ebNi7uwZMV9zydgdOjoi+2hYk8oe0+iHQ6nnSPcTvV/O2g7y3Ce/eP71 eGHT9vjKfTfFnTeu1vGONeGwLPn8Z9mgW7Z15gs902E3yV5NtqBEH4VX5cTBq9eSRz9keywJKpUQ 43P5OvXKmYKdm8WYjt8BLUV97p0oC1+2mEv6dcgKjW3lCm2xre/R3K4vbdmZVrk692n9YDFeFKJM mdvFCq+7h21/52D8H//fQ12rC2n+EN1Xu6Ig5m9T+EzlIVfmK5ZZlOlUUdfBo2NjsU9jFu06Z9LX E48prJ27s2qaum2pUUltho5fvkQTAFcFL+dDlc3d1BTKnv1H4t/+5x+mCYEXatLePe8dj1fe2mGF oBPRSfY8n0xpK5rasVJ8sD18KWLWwMy4/NIFseLS+XHl0kVaYm6uZuI+Gjv2HtDy3gdj6479aSZs C0VO1wl57DEfZzuJReXHpYuDGybPGXPTdVfEp25bEysvy5Ml20tB7X3n8ydPb4nnNr+Vy0ybq36E 1GKVxr9Tdprx6Vuv8aVy9dSTaeuuffmreIwLPB/lEwIQgAAEIAABCEAAAueIQLcZPyFKPavWPGwn WRkd+6X0RrDvbNx7z5JA7jVjI74Yxz4z/a7kIVsfL772dvzR9/vjd754Wzt9wyNjenn9eLz46lal 1C9Os3him6XkbJ5WoV2rIT83XrNMPYFWjFu1Kdth2W+xyUZGG7Fp6+544bVd8cobO9OL2on5HtJc pX/+w19qmoPd8Q+/eHs7TNt3/+V7z8QLGhlRnFPv6zt2RDlz8m32a8FE12qI0Xj763ST3eb7dfLQ u890+x0fS7evc7VfGDnPxZ4qx5yGgb7+uHntVfGsOkTskXjW7ZLdJ4Gq97noTlVn/6IQZbpvlm/I oSNHqmamA+J971XWu8Nd7lWXupwbpyNdQ4HspzstXV6rXa3ENDyc/NTr1eRNCsPusiWL8k716UbF riiH7qr14pZt7UmNpa7krl6nyem8uV41SJmwQJHy0kxqsMO+6doVakjuTIpr6frndZ+8rNvHmqtS 7Ee1otCfPvS0GheJQFUxT/mUv9Tg9ZiPEpWcuZtZmrm7UowH1O3vX/zGJ+Oay5e0G2+LKJbuRtUV 8NXte+LZV7fF69vfTfdk/rzZ2qqrnMQyh3fk6HDuIpcEqSoiDYtbt+qKNFN5vtej8V81zMnu9Pe/ CoMNBCAAAQhAAAIQgAAEpolAfp6tesHYVtDQHT+3J/lBz+6em6MYvX5+zc5nz4/nWS+HXZlCOWn6 dN+QZzWEyOn9h/d/LI5LGPm9bz0cfjHq4VVacilv0xVNLRs9Lz5/x7Vpxdq6hjPkl6xVcDL6k12k rHsgkKcfaIWmn9DQI/dEuWnNlfpboSkpIp54+c340ZOb2i/hqxCSVfSChKL/W6vh/qt/cG/M6h+M P3no+Xhm0+vy0i12lCvYni0CN1x9Zfz88Kt6ma6BZbLZig2WzFIX58o+PVvxnY1wLgpRxqCKMlpU 3rOpkvlGe4m4AVXSIkw4Tlfm41peurhspJdveVvSlSaUqnqaHDveCIm2qQAV37NnOeyOy4psajo7 B7t7qijuIth0PJy4tygth63S2VU4Dx85Gl+850ZNVrW+usCqci4qLTVGLU1SXL7PVkL/2Zfvllq8 PU1GfESzf+d85obbAfSWj1Pg9LsG9qdZuX3E7vprroxrVyzVXl51KYlIElh8x+oSbNatWpYm4irz CzmMppS2un4F8o9VI37wi03x/Z9rkq6qp1Bd8xbdd9t1FYOG5pEZkWC1zdGlY+V+pwN8QAACEIAA BCAAAQhA4BwTKD078vOsen6neU9KL4JsX/i518/0E+2Xid/PcdJTdF6Qo9u10yrx5ZcvbYnde/Zr Dhmtrns0j1bIPX+ynTZ7cFA2znVxz23XeACQbAStMiTppZHfTucVh06YjsHzQnqeyTxfiXsR1cXH c9jc9dFVcfv1q+PRpzfFg0+8EseG8xCpbNv1x7Z39se//cYPY9asvti11703EGS679107A/0t2Ll ikXxqlYEs7NgZ5dKdpfNmw6eJx8XjSjjSZmKIGP2pfKejfvgxmnmzH7daI+pdEXzuEvf/lYcONZZ Fs5xujDkpbuqglENhfEybDqd3IGjRzUfyYL8pfqcoQl0cxPZddhCgHVYNUwTjf2p5m/eLE/apOtT WDns3/7C7bFAS96lsJWwVr9FG23VC8Rz2bgxsSiTlpSTQOF8blh7ZSy8ZE78n3/4UEqLeXs8o1PY Uz5VxXMaPJdQ+RFyTj1Jcupq2RqQ0KJG1hx1PCvjOqeJnwuWPNGUGm7nVjhSR0E14l+4c1385InX Yrih6/WWYZnmFVp31aVp0mav9PXI05v1Q6c7p4DS/StDn3yvz9NGwWxwEIAABCAAAQhAAAIXJgFP Bvv5u66P61ddFjNnyIaRRahROTE8PKaFRXbGQ794ST0/jum5ORsn+Tm6vNL268seCwvdz9B6xi4i TXnW95yh7k2TUq8P9ZXXc3dTExEvj9/84h2xcM4M5UH2msKxtZLtAe3LXgiNVvDIgE4evYiLjskO 8tbOdoCmFc4vqmMw+vtG49471sVN138k/uz7vwgvD57i1Kfde8cOx/6jtgf0l9JeWKbTfJxlAr43 ly6YH69GFmXKi3dPReOhTycsSnOW438/wdlOvKBdd2NSDPKpChZTBWOIg5p7pSmjPsfXqWhDGuLS 7TxCs7iOLxWQYqzr5DENCZrovEx2t/903kFVSrEvr5d9NaCpUZkYyCTf582bkRqkmmYs9wzdbpzm L/Bs4foiQebt947GI7/cHN/56XPxvYc3x3OaiHjomLuCqQuf/KRGTPF5YquVS+fHZ+5Yn9obfW2n t6d8uvJsoSgVeCstaqA3btkRjz7lrm3q3aMfl2ZdworHZdZ9lyQqKf/m4a6Kmr83z2CeQ9D9srJu kacZc2YPpt4z6isVn9mgXjJaijwp7pqv5onntyk8d5fUPal+2FIZ6RSDrhSyCwEIQAACEIAABCAA gekl8Dk9r9967RUxZ1Z/zOjvi4H6DA2v6Yt5esl8y7Wr4nN33pQSkMWY/NDasVV6LMiMQ6MeK+rl M95ZUNHze0MvkP3cnuyjsfjUx9bG7/76fXGJJvD1c3qrNaJncws6fnGb/+ppwQ7ZbnqGT0tCa8jT mIbAeBoH7aatFzCxaFPz6j/qWR+14zrudEQsmjtHcXxKc1Wu1xEdcEyyLerNLOa0dE3HQtIubloI 2EYdtPBmmy8537NKYLQycx66iaX4PEziB0vSZOKEj50tYcY9VNz1r5bGIrpi5xvuVKcKnlSAnIfJ 0pL9eXhN5VGFpzFpYVFlV6PiZbPbzlFV5UrJaJ9La92rEZiKWzBnZozVRqSQW0HOqrC7+I1In/jG d38emzWBlduylta3r/dJrFCvj5nq9vdrn7k57rhhpZualM8sRvXFF+++Li3rvfe9wyn684WPE5Pu R9rJbDy587f+63Pxlz99MeYMuipkoD7bdMtqp/y6o0v66g99Wb1yUfzzX/lEOm3Bpl8CjcOaO7Me t95wZRJzXAwee/n1PAmy1NpmGsea4z1ZOUgB8gEBCEAAAhCAAAQgAIFpJLD+6ss17YJ7vus5Xk/z ube/h+Oo14xeUl6nXt8nd+lJ+eSnz+mZzmItnWglgMhealZLYevhPW6+7iPxq/daaMovlPPiJpUZ LNHE9lTHNtSgJl1fr2wzM0n2nXrDeAiTJzpIIwdsNshm8+pOXoFqVAZTPU3xUItfve8GrdQ0pPlj 3pLtJG/9jdA7WtlUeeWqTlrZmy4CfR6GontiW7RP97LpXlDnsbvgRZlJ2asSdQ9lmtTPFA8WMWVE 3f1aqqhW5uxseFttnT2YldESXKfClyNuBLKxno6o8MxRr5hu594aw2OjbdGlfS6VrdwwtsNwA2EV ZYpu7qwZ0a/lwFPfjjSBrZqwxlj8wV89Hq+8tVNikxpnFWZpDwrXH7U0cdaffv8JjdM8Fp+7/bpx MQ3K/wN3f1Qziz+mRqgjNvWOz7jkOfnKR3VM20RPItTR42popXa74ZzoMmHfU+VH9/T1tzxhWBaj LL40qjA/ccsN0adhZjppz+ph9EYKykp51uz9tdyvfP3EuPgOAQhAAAIQgAAEIACB6SQwWy8j/WLV hmpd86Q01NvEKwz7e19tQLaIH27Pc+cX1cnmKU/qJb0+7v3So8eik/34Ed350vHc7SUfk1/bWrJ2 dL4ZwyOt2HvwiIZvHY39B4eSTbd44ZxYrAU/liyaFzPSi9x8je0AT5rs/i99DiQZGjke97JPPWX6 lZ4RsdYLfNsHuHND4Kh6GPgWWAg73wUZE7loRBlXwm4hpi7j+WyOJ/PqR1ZJSwNQjPa5Mz0UqOOm 0kvCw2FcyVPd1qXeH9KSbpM5G/yq6h1X6nq7oeqcmmzvrV3vhUbbZGEhedA8KM++Eq9u26GGSUVZ QkQKv917p0QQ8dDjm7Ts2JWxRONS7ZxOuyuXz9cXN0i5AfSxXvFx3OOFGKepQyz1PFKD7rR6yJXd xB5Jxbf9WGjyxF6d+5jzOKgun5+4aVW63uc2vbVLS5O/l76X69OXKu7O9fkonxCAAAQgAAEIQAAC EDgXBNIzrW0N/UtD9jUvovoTpKizONF5hvfB7qfnPG9L9dB/LhJ7sjjaL6G7nrSdrMpUSS9TK1vk 6c1bYsXSufGZ9DL5RJuqJX8vb3k7fvzLV+ONHXv0nN95sVxsOtsTtgPWXHlZfFqTBN+w5vJ2yvpl BBU7yAd/9MSmeOblt7INMiqinrSnJMwecNNOYJeWxHbJqGZ0nfb4PmgEF40oYyO4LRKosp5to3hk rKFl0frUUyLfkhSf4pkzuxpD2FW5XamzaNEx7kuF9ypOc2fObgsy5QYfP+ZVjXIDUfz6XJqnZILq mvxVinC5fuI2haFEfP1bP82nukQcn7PynMUJs9KYSY+x7Or54ou8zNijz72q7oA3J57uyueGetkl C7X0tDpCqsdNYd4rPilzVeOcM9rVcPtA1aB3Hx03RCxf1P4s+WkfqESWG9df1b7XPvezp7d0vGjv xOvGneYLBCAAAQhAAAIQgAAEzphAFkw6skmxEzpHOkHaRvAciye6yY51fHU/Jyc7oXPq/NrreuYf 9+yt5/3vPvKcJuStx323XNsloNTjTb2g/s5PnkpLZ5fMjLvWB9u2m3rMv/1O+lt52eL42qdvipWX LSmXpXAf1nyV3334hXzMNmcShroJtr2fpZ08Z2ZLcym03BtHLq+S64mJO0BKuZhKpNlv6v+jMCTd qafAubzvp0prpbN1slHujSfw1b57gI1ohMmOnfuSH9umvn8pzHYng87l58veRSPKTBfw7kKz78CR WLZ4bjsqF4z5mrMl9WbpKkGuL66a3RWl7A/2D6jB8LlcAdSHRT77Yp/WuHcQFkZSw1CJLuU6Rzp3 xoyYM28wDhw8ruFOmqSqrSD7bFUYq8rZfV2aBKnym4QYpc7Lw5VBN67Y7WWgc1Dp02Hs2T/UPuIK 68S58C8Rh93vHsoVoIqzF3zaiZvmnc/eul75tgjVH3v2HYnNb+2e5hgJHgIQgAAEIAABCEDgYiaw aP68+Pzd67Sq0KVaCVarAMk+sPAyNNyIzVt3xQ8ee0lDcI62EVlsGGcDtM9c2DvZXqvHtzWXZH// oHq3r9F6JqPx0GMvx/f15xey6aW2xxx1dIwEpcPLMpftKU0KLPts66598X/96U/j83deHw/ctS6d e/TZLSmO9GUaP2yvdVwjvyKuBBkft03SkC3pIWnFdfJRjpx8m3pLVT2nstWqgCpBI4/S6I7/5OG8 3zPdaU33pcuOVvFOLk/1qf5dml5DXSNkI+cbZxv6pS070ygN27i500CeyPn9pudcXIco8wEpp0JT 9TLZvudAXLpk3rjGbtbMgZg5a1YcG5J4oa5rHkLlsW3yNGnMS7SstLUNSRuu9W1vO7S0m0WWfqmA ZUntEsBszQvz65++NW5dd0W6dkyF9YdPvh4P/vzp4iVtSwFvF27Vr9RtUeH6mJ0ntU1RS1hJKazy 5rNFgLKXqj7E3n2H9C2f8wpMaSIlrUq0dOH8eEfnUgXpMZ+UwGn8WHPVsrhs8ZykzGrmn/jxM1tS GSi8pjFqgoYABCAAAQhAAAIQuEgJfOGedVpF6co0aW9B4DkuF/S3tIrSFTrUij/9/pPl1MW5lb2T F0HxhL2t+PMf/jJ27D0Uh44cjRdf2y5byFaNpzKQWVws/klJZesnL7+dRQmH98PHng/baQvmDGgK iC0KZ3oFi5Q0m5ISTbwKVKNRrLKc6JbsMFmMHr+Qeo7YrkzzB+n7VJ2vcThe0KRtz9iek+te6nuq 4b1ff47bqe92tlkbDc8FOqBeXzPSYisla2bx/KtbNR9Q1WnANq5PVrZodzjn2z6izNm4I5VauXP/ flX2K9oGuYP2hFEfXb0inty8VfVcleRks27Ln9uBG9WAuptbUmGTcJNn6X773cOpUljUSV1mSrpV Yb6m4UO3Xr9Ciyep2Em0sSr6xbuu1qzf78Uvnn8zpSd5Vxx5SFIu3FmQyQXVZT6NWqrqdbt6p7zl b2nmcRVsf3OFcF5mqCdQ6c3j3jUNLS8XtcE4eEgTY5VAesmncJrG7S1rV6bQLcg0Rhrx1MY30/ci gk1j1AQNAQhAAAIQgAAEIHCRErjmikujPuCXq5o5Q6sDtTRhr0UGz2Ey0D8Wa1Ys03O5Hsi1qEdN XQvaz+YXPC8zGcsvi2XqZMPeIwFs79Ti8Wc3dwh47gn1svBKuuZzrXodXb1iaVy57JJYuXyxXljX YvvOvbFTPeE3bns73ty6V4HocjH3s76Df1nijiyjPDTMPWmKDdSJ5azu+UV4nsu0rqkzbDfKqlNa HO2oTLHBAaVB6Usv+S3c6P57ioyGEpaFjtMnp66VdxWEnO3GkRgdE6fkpjlzVSzeTGZL9cv+dG8n rxbccmY1UbU7LlgLe/SZ19LiOGlFYd/sygZtb1OYZjBe6OmKsme7iDJnA73ueV1dTF7Zuj++co+K vxpCNwTZDcRNayXKvPyaCosm8K3GtbkGd3qsqBqrEW31acm2NSt0mc17q58uMLnyvPX2u6lg1ib0 sumPmbFBgkxN89m4MXElVUlLUd+5bk08/twbORn+VIVspCE2uSDeIGX9s7dcp6So0dL17iXz3tDh +E9//ZiCyEWjIw7pek0CVrqAuTA7qsvVI6YlMaamQu+81esz1RAdj3f25yWxU+Q95JPin+aPNSuW iKE0aTV0D4l3U5M+5659ZnjuGq5pzibBQwACEIAABCAAAQicBwRsWPtF7YL5GrJky9mP9g2t3qpd 96jv98tePcsvmKfjyTDNgoyvm8zQPQ+ydJaTUPXed6hJlMq2j0E1m7JnNEzJkoXgRLOhHiGya5bN XxBf/dzNsVY94POUDLbVkqIT11+9ItZ/pKFVZ9fGpm0745s/eC72HdIoBl3nGV082UTNkyX73Xmy oab3+d/2YKM5oIVjHbMX6tY8KjYu5TxcbfmS+eklfU6F5jxVVi3jTFWQcTgdQUZ2jey7ffvzHC0+ dy7dZGW2qR4xtfqA0qgctpR7LePuVYJH1IMmTxNiIhbMxMR+5CyU+T6fj4KM01dKqPdx75eA7rfH Im7fuSf2aAm1jiDjG9+Itasu0zjPWRIuVGDkis7oQpFugMQSX7904dxYttStp0UO+8yF6DUJMgeP 5vGgpXHwWbvBQXUikyjiQulzqeC6jZHTFDMT3Hhl8MjhY7Fqxbz4yBWLY+XKRbH6ykWxYe1VsXTR gqoA5zBzIEqp0tkdvxusa1Yubac1V5qxeFdz2oxKmGi7HvJpp2EadwbU0tXFQpOrx5PPvJK60bW0 nGC5f9MYNUFDAAIQgAAEIAABCFxkBPIzvwQG9V7wMBO/KG25x4Be7Hpp5ty73YaoXhBWRqkR5euK JXJhQ8tWlDPtmXays43mnv7JcLeCYptd9tjqy5fGv/4nn4p1q5ZJ6GhfmeyquueZsaQhQct23bqr lsf//E8+F6uXL03HLYs4PIsCyeCXODPdzi/CR0aO66W+Y9LIhYHyMr0WL76xM0UvKy5tLa54P3UM SEeykJN2T/vhCGTTSMh68fVdp/U9HR66bU+HP2NAYlQS1BpavtxSlOeTcecA59Fbp7nLhrUoqTLg e+N7eL66UkbP1/R9KNLVfYOf2bSt64a7QNQ0cW8jvnj3ehUPFQYVFCuVdr4uV3tPUlSPr3xyQ/Iv C7+db1ekX258u/194s7QcCt27j2o1qBc4ziyrzd35iWZ/a07jSWMbbv2qiuaC29WzVNDrWs/e4cm q6rC6BSQXMDLtd5+ZMXyuE2rDk10O/fkJcjK8e64zzWfkobp2pq175HZPf/q27Hv6DF9EdO0PPp0 xUq4EIAABCAAAQhAAAIXO4FWXb0+JAZYFaipx0B69Vv1djeb1OPDRmnaz2JMxzhPhy/sjyRIjaZh O5mBXzBn+ysJKFXuL9Vy2V5sxc/zTZ3vtl18rDhf62f/gcE+vUjXS+xk8FsCsC1Q2WISAKbdKQ1N vQ1Oc4FKlBicrV5Scu4Z8tjzr8ebOzTEqnJOr/OT8+SycGainF/8v7HjvRRuCfOcb7uExVnKazXz aYyMehRH5p7zJ0HMo0pO4rrv5Um89Oxwx+buWRI+/BGXG2yYjz77hlQ7N5Dd+eqL+25bqz8vwdbp bZInncr+fvWzN3XWu69mj/bkTfsPDsVzG7d1BaZYqoKZC18z/uwHT8WxYxpT1+X27BuKv/tZtRyb jjuNWTnMnjy8xt0b39z5rg6UYpC3d92wKj556zUpniwaVQF3KYxLLpkXv3n/huqENx3V9clqTpVy srd8SiqmZ1vaX4f+iHrJZDHLstvJG4TpSQmhQgACEIAABCAAAQhcLAT81F6XEONn0fySUC+DbZ+2 p1AYT6KIMeWpf/zZC/Obn8f7ZHsVAaYzmiHnt7B45uVtWq3KNlF27lli17Hnik+9eBXjV956N57d uDV7bn8Wq6ls2yemZefwcGcF3LmzZqc4LFDsP3gs/sv3noiHntwcu949qNELkjC6hKWpJMY25oiu 26VFW370xGvxX77/2LhVvKYSxnT5mT17hoYrZZFp6Lh6ylR5S9v0YtwTHX/43DmQ8j4kUCx0WO3s Ejy6b3IWQJwX3+bJK5uPepjRg7/YFF/+5A1dFTmLIl+9d0PMmTkjXnp9p4Y6HVJIY7HyimWpt8nd N6524OOcZ9X+20deystby7f9p5grxbukb+vuffFv/uODccv6K+OSuTNj5/4j8dxLb8Ww+zJ2udIg +ZB77dj96IlX4porNQRJQ6B8tMy0/bVP3RwfvWZ5fO/hzbFt5/40vMqiziXz52sy4uXxwCduihnt ddY6Rf8pCUgvbdmRwp740Ss+E9Nxpt997826ve3qlVTKwtZd78WbWhqv+Cn35kzjwj8EIAABCEAA AhCAAARORSBbI8UmsRKTXRER1G/eT/Xl8LjteOugnPLL1dO/UGx2okrihOPpPPM6PZ2XtCVkb+t6 lj5Jcrq9pX2PKvCiJ2fDOW3dKcq2UCZQ6DmeUc1R8o2/ejT++a9/PK7VJL+FY8fuy9e418iW7e/G H8ivV/op84OW5/+zkeaphnHo0GhctlTihBZ6WbJobuzRilLHRo/r8lYSUP724RdkRz6X7dupBnoe +kv3qbJ9Zw0MxqULF8reygk9dHg47eRJjH1Q90l+TyzjJx4537KKKJPEiXwDkyCjG+kK7L+sOrs6 eqqg4nxTu6uxj3e+u3I+8vQrcYsm973y0kVdDZWKibx5LfvP37kujg6NauboWgzOyLcgzSDdUEz9 OX6H+tKbu+K5TW+MC9/HJzqrooeGjsVPn3o1nXLD4Bm4S34m+u/+/srWXfG3j22MX7n7+tS4pi6Q qfkaiGslGK397cs1TrWpyayGYp6W3p4x6Fnd3WnMBb/kOw3MigNHjse3Hnqu3UDlCmJyxZ/qSQ/4 dOf3/eznvLpDoJXXehw5PhzDagBnaGJm//h4/OKPn3olCVsetmQ/k5WS9xM310AAAhCAAAQgAAEI QKCbgJ8z82IceVKEZprq1XPKeAiTp0qo7Bg9d493+Zk8iQka9mR/dQkNTQ25yZPBeukKCy2WMqrn 9+rFte0LjZmRdpOHythOaip8+7eNk8SUE+LLsTdll9ifrYeOTZXP2eZK87zoq1N7tgSZHPrJPztk bHs1Y1jzYf7Hbz4W//Lv3xWrvWqVV7XVilYeFmbWZrV1x774D9+yIDOma8T4LIlHJ0/lyc8cUEeA 4WMaujTTC2BHrFuzNLZoZSjbhL53tkaalZhx8lB6eyaVw5MwLEKXS5jzMnf2nFijOVD7tNy7rxtR UTQDO4/+0F2Ur47N2ducnXnsTvlF7bxiUW50tFHBTcvFWdRww5N6RKhRqnpGuKtUak10y8e7PPmT j3nGbU9y+++/9VjseS8vY+3jqTuhl1vTBFEOe466Xg0OeL5uCyhuoDRlkWqUK7jdtt0H4o+0ClLT ByuXC1r51tmWa9IRN6yauCqlcIoV8UePvxzPvrEjpcNhuGpbCbZAkxucWixZMCcJMv6uKbIyH8Xi vPjv+NhI/PFDT0qhPaqhfBOV9t7y6ZA68z3/wKTpun2peLZcLuSeeGFL2nrlqS0at/ni5rfFXa2D /JTSUbbJIx8QgAAEIAABCEAAAhA4SwT8TO7pC2x45+WRc693Lz7hZ3OLCEeH3XMiOx/LskfEkKZa SMKNjrUk5Hhy2/K9oYVJjg57WIiXlNY1tidkF6T4RmwQa5qGFJZXXfWzsWwHiTg+f/SYxYr8BDze yPQ3rVIkvylt2kGoF0YAAEAASURBVDaLMa65XJoeYpPCrBI77ZtO6mz7+ZvTdXxsOP79tx+PrZp3 0y/Kbdc1KzbbNDLh6998RH609Hhlr5VkTvxejk/39pXtnnw3L109oAlw1625THN+Losll8yKeXPm 6IX6rJg1YzBNjpvvmbyL/fniJopaLk/9ysfswcGYO3OmRoBoEZxFs2O1ln6//iOXhvPo7gEtLdf9 2tad+T4oPy5zudR9eK2vjsV/vtydc5yOVpq/JQshLqyepTzd7LF8U1tubHSjLRKPqVeENV73meh2 blNqFlx0MBUJLdF1aOhofP0vfhL/8Et3x0cuX6bl0odVqb2muvtbVAte6zpX4lThtYx0K83anXvI /PHfPKFK7wbOS7o53E7j0R23j3rNeSvMNfUp1EwxOnLmte1P/voXsevudfG529aFtCKF4FQ6Y8qx Zty2YlQqc5/EKSVNnLImuWnb7vj2j7Q0XBKh5E8sTMiqpV0v+aQEfICPotabs38sUqOrwvCXP3la S6DviRni/uKW3cqj7qN/tORSDyHfh+p7OsgHBCAAAQhAAAIQgAAEziKBjdveiVuvWamJZ/3MbZtC vV+029DSwJ7FYLPmPinOL22TESwzYaOmUrjtuiujT0aGtAc947qHzViMjemv0afr3k5+G3qedZhl VZtN6sV/y7VXaBGTEV2bJ8Z1j5JRhdHU9JYbJRIUQ7vbPB4+rlWhZgwka6al1Yn6/AJY9kt6rpZR MSxbo1fChs2VRM98ZPcdGx6W+PJo/Pe/8alYsXS+7JqIrfsPyK57RC+fLVblnJV8mm+yISu7p/Ce 7q15DR0bjo2vbY9rVi2XYKF86KYvW7IwlrY0CXGyCU9MRbZ9Tzx+Lo+kjg5VhF5BKk9YnA84fT5v sS91XKi2mXpT9yBiyxu74oiEw+R082wHp4FqH2Lbq2/msmv+15yji/czGdxV9mV3R62vHl/QaklW Q9IYSPdWkVCxY9eBeOmN7e3Gpk3MlVk11l3zNJ2UCoW6uqkBswr95Atb45CWLFtx6RKpfhJOFIHD zJXXIWRluV7v1xChIzL2X4i/e+R5rzymcNy4WgRSouSyQOPvHZcKrBNn3y65lpTs3S3IFMUZ519N YbyuMZK/2PhGzJs7Jy5dfIlUc8Xllt2Cj/y40W2JiYda9anROqxG688fejb+5mfPxxF1lSvpFECl 1Y14TrcT3Cs+TvbZcCbrWdXr7i2lDPk+uyfUrv1eaUpSWPqh8zn1lHHe08/O2YiZMCAAAQhAAAIQ gAAEINAhYJvAvQp2vnsg5syZEbM1tKNfz6gNGeX+O3q8Ec+pF/xDj78gkaH0bNFzavVovksrt86e PTMW6pk/G8ASRvScPyS/L76+PX74+EZdJ+u3XKC9Et/MOerBMGduWuSmqRfCDVkRx44149k3344f PfZydV0nrd5raKxJrU82imwsP0XbStEr77Q9rjgPygbKT9iKsdgP44M4y9/8ZO+ndj/V+4W2hsiI p20Wu9FGI16U2LFKUznsP3Y0/uNfPBpHNV+LX6TbxuqT3dYtIvl+nJt05/R1bNd6jKjnzp4Dh2NQ w8rm6J62kk0im802nP53pyvtuxiIca//Uk5UZj1PUbK3c9ZyulQWtZOOaPBYKif+snf/ULyizgDH 0+TF2UuHRfZfBfOh29QW3PBAVfw+dGk/qwn2DU2FoqLRsNqhSpoqX4op91Vxbwn3drHfUnHTaX2k MLR1Ie9UVB/VMVWMVauWxHqtbX/J/JmxQI2gl1w7dPio5mI5Fi9oTfltO97Vtdl/uuj9fEySrlMH k1M9Pu2NWLRgXlx2yfxYvHhuLF3ormPzNNZSs3BrFu+de4/EO/v3x35trWznNKuLn7ozlp4lk8U5 Po5S7HJ+zxmfyRJ2umNJ4HIXRskvared39z45rSn5fEkiJU5dNL9t9imX5wPfD9PlzbOQwACEIAA BCAAAQhcdASyMKOhPxo+7x4eyenxOj2j+msaduSt/vws2+5FYBHCL3TlbHdouFJLc8qk5bPTQV9s 2aQ4z6nYl3rmdz/X5mdh95vXUKgUTvHfsYnaR7rskyQG2JbSyfE2U/bd/Yzdvv6s71R57EqXo/BR 572pl9yZgZ/5/ZI82y2d83kvee/RR86BPtXzqK57a9t07syBWLxwvoYsDaRhS33uBqVceUhb9Yq9 R6k9MVr3jnEvGbvSU8bloakJlG0jJ/7qpHBYnRuOqyPAvn3H4siIVpyqynF3OZmsHKWAP0QfiDLV zfLNTE6bdreudMilRaUm1cVqv+uajvgiL0kldeEvjYwCUEUpjaIrg0z1Kiz5azeQCleNmfvAtLsW pmahKqlVfLmpOPFYHtuZ4x3vx8cm+m8H1rXT8XdiHpRec8htkXaqiaPS1Upz3flzz5iqV0/XtiuC tHti2OeCz8RUvI/v7fvk26S8Vr1i0r0fx6bQ7/B8H7FxCQQgAAEIQAACEIAABE5BoDxrlm3ldcJz aSeAfCL1itGL4vJMnq/WZ2WvTAitskY6R8dfNyHOrrgnN5I74ZR0Obw09ET2g10Jv5w/F9sTU1Vi rc505SufsW3lc712ufNA6SzgaVKL1dedp8nvRa/Tfur422kW+5yvbHN6mpGSy7afKqiJ308dw/l3 9nwoUb2nIqPbvR3siiCTwLh9sBrXJUgkP8Vv1YD4mN149bi6SMpzcqWitMNStUn7VXc3NUq5x0V1 SywEVC4XMn/vHCuNgQWZ8a7yk67v9j/eV/mWJrLtCtcNY3FtwalkxQ2n/KaJuBIu7UvaLP7aDM1H 8Tvd3a4XfLrjf7/7tfbbBJcPd5XxrStQcqjOaxrHm75m7lSu90uc6yAAAQhAAAIQgAAETk4gP2tm O8A2RHnmL1s9q7aP+YVqfm61neOe3WUkQPatz6r3Qfre9fhezpdn+u5n+ZK2eunmIBuh+Cu2QXoB bY9dYZbrvO1Lvc/zi11/T+GfxK/Pny2XxKAqsJxHfylP7sUWq2ysik052/HXSU3Jd+fIOdjz/EGy S1L6lcZOPsZbjO17cQ6S9EGjyPZU14gTFVtbn2mlsVTOci59/0q+8n3p2KMfNA29up6eMr0iT7wQ gAAEIAABCEAAAhCAAAQgAAEIXNQEOqLfRY2BzEMAAhCAAAQgAAEIQAACEIAABCAAgXNLAFHm3PIm NghAAAIQgAAEIAABCEAAAhCAAAQgkAggylAQIAABCEAAAhCAAAQgAAEIQAACEIBADwggyvQAOlFC AAIQgAAEIAABCEAAAhCAAAQgAAFEGcoABCAAAQhAAAIQgAAEIAABCEAAAhDoAQFEmR5AJ0oIQAAC EIAABCAAAQhAAAIQgAAEIIAoQxmAAAQgAAEIQAACEIAABCAAAQhAAAI9IIAo0wPoRAkBCEAAAhCA AAQgAAEIQAACEIAABBBlKAMQgAAEIAABCEAAAhCAAAQgAAEIQKAHBBBlegCdKCEAAQhAAAIQgAAE IAABCEAAAhCAAKIMZQACEIAABCAAAQhAAAIQgAAEIAABCPSAAKJMD6ATJQQgAAEIQAACEIAABCAA AQhAAAIQQJShDEAAAhCAAAQgAAEIQAACEIAABCAAgR4QQJTpAXSihAAEIAABCEAAAhCAAAQgAAEI QAACiDKUAQhAAAIQgAAEIAABCEAAAhCAAAQg0AMCiDI9gE6UEIAABCAAAQhAAAIQgAAEIAABCEAA UYYyAAEIQAACEIAABCAAAQhAAAIQgAAEekAAUaYH0IkSAhCAAAQgAAEIQAACEIAABCAAAQggylAG IAABCEAAAhCAAAQgAAEIQAACEIBADwggyvQAOlFCAAIQgAAEIAABCEAAAhCAAAQgAAFEGcoABCAA AQhAAAIQgAAEIAABCEAAAhDoAQFEmR5AJ0oIQAACEIAABCAAAQhAAAIQgAAEIIAoQxmAAAQgAAEI QAACEIAABCAAAQhAAAI9IIAo0wPoRAkBCEAAAhCAAAQgAAEIQAACEIAABBBlKAMQgAAEIAABCEAA AhCAAAQgAAEIQKAHBBBlegCdKCEAAQhAAAIQgAAEIAABCEAAAhCAAKIMZQACEIAABCAAAQhAAAIQ gAAEIAABCPSAAKJMD6ATJQQgAAEIQAACEIAABCAAAQhAAAIQQJShDEAAAhCAAAQgAAEIQAACEIAA BCAAgR4QQJTpAXSihAAEIAABCEAAAhCAAAQgAAEIQAACiDKUAQhAAAIQgAAEIAABCEAAAhCAAAQg 0AMCiDI9gE6UEIAABCAAAQhAAAIQgAAEIAABCEAAUYYyAAEIQAACEIAABCAAAQhAAAIQgAAEekAA UaYH0IkSAhCAAAQgAAEIQAACEIAABCAAAQggylAGIAABCEAAAhCAAAQgAAEIQAACEIBADwggyvQA OlFCAAIQgAAEIAABCEAAAhCAAAQgAAFEGcoABCAAAQhAAAIQgAAEIAABCEAAAhDoAQFEmR5AJ0oI QAACEIAABCAAAQhAAAIQgAAEIIAoQxmAAAQgAAEIQAACEIAABCAAAQhAAAI9IIAo0wPoRAkBCEAA AhCAAAQgAAEIQAACEIAABBBlKAMQgAAEIAABCEAAAhCAAAQgAAEIQKAHBBBlegCdKCEAAQhAAAIQ gAAEIAABCEAAAhCAAKIMZQACEIAABCAAAQhAAAIQgAAEIAABCPSAAKJMD6ATJQQgAAEIQAACEIAA BCAAAQhAAAIQQJShDEAAAhCAAAQgAAEIQAACEIAABCAAgR4QQJTpAXSihAAEIAABCEAAAhCAAAQg AAEIQAACiDKUAQhAAAIQgAAEIAABCEAAAhCAAAQg0AMCiDI9gE6UEIAABCAAAQhAAAIQgAAEIAAB CEAAUYYyAAEIQAACEIAABCAAAQhAAAIQgAAEekAAUaYH0IkSAhCAAAQgAAEIQAACEIAABCAAAQgg ylAGIAABCEAAAhCAAAQgAAEIQAACEIBADwggyvQAOlFCAAIQgAAEIAABCEAAAhCAAAQgAAFEGcoA BCAAAQhAAAIQgAAEIAABCEAAAhDoAQFEmR5AJ0oIQAACEIAABCAAAQhAAAIQgAAEIIAoQxmAAAQg AAEIQAACEIAABCAAAQhAAAI9IIAo0wPoRAkBCEAAAhCAAAQgAAEIQAACEIAABBBlKAMQgAAEIAAB CEAAAhCAAAQgAAEIQKAHBBBlegCdKCEAAQhAAAIQgAAEIAABCEAAAhCAAKIMZQACEIAABCAAAQhA AAIQgAAEIAABCPSAAKJMD6ATJQQgAAEIQAACEIAABCAAAQhAAAIQQJShDEAAAhCAAAQgAAEIQAAC EIAABCAAgR4QQJTpAXSihAAEIAABCEAAAhCAAAQgAAEIQAACiDKUAQhAAAIQgAAEIAABCEAAAhCA AAQg0AMCiDI9gE6UEIAABCAAAQhAAAIQgAAEIAABCEAAUYYyAAEIQAACEIAABCAAAQhAAAIQgAAE ekAAUaYH0IkSAhCAAAQgAAEIQAACEIAABCAAAQggylAGIAABCEAAAhCAAAQgAAEIQAACEIBADwgg yvQAOlFCAAIQgAAEIAABCEAAAhCAAAQgAAFEGcoABCAAAQhAAAIQgAAEIAABCEAAAhDoAQFEmR5A J0oIQAACEIAABCAAAQhAAAIQgAAEIIAoQxmAAAQgAAEIQAACEIAABCAAAQhAAAI9IIAo0wPoRAkB CEAAAhCAAAQgAAEIQAACEIAABBBlKAMQgAAEIAABCEAAAhCAAAQgAAEIQKAHBBBlegCdKCEAAQhA AAIQgAAEIAABCEAAAhCAAKIMZQACEIAABCAAAQhAAAIQgAAEIAABCPSAAKJMD6ATJQQgAAEIQAAC EIAABCAAAQhAAAIQQJShDEAAAhCAAAQgAAEIQAACEIAABCAAgR4QQJTpAXSihAAEIAABCEAAAhCA AAQgAAEIQAACiDKUAQhAAAIQgAAEIAABCEAAAhCAAAQg0AMCiDI9gE6UEIAABCAAAQhAAAIQgAAE IAABCEAAUYYyAAEIQAACEIAABCAAAQhAAAIQgAAEekAAUaYH0IkSAhCAAAQgAAEIQAACEIAABCAA AQggylAGIAABCEAAAhCAAAQgAAEIQAACEIBADwggyvQAOlFCAAIQgAAEIAABCEAAAhCAAAQgAAFE GcoABCAAAQhAAAIQgAAEIAABCEAAAhDoAQFEmR5AJ0oIQAACEIAABCAAAQhAAAIQgAAEIIAoQxmA AAQgAAEIQAACEIAABCAAAQhAAAI9IIAo0wPoRAkBCEAAAhCAAAQgAAEIQAACEIAABBBlKAMQgAAE IAABCEAAAhCAAAQgAAEIQKAHBBBlegCdKCEAAQhAAAIQgAAEIAABCEAAAhCAAKIMZQACEIAABCAA AQhAAAIQgAAEIAABCPSAAKJMD6ATJQQgAAEIQAACEIAABCAAAQhAAAIQQJShDEAAAhCAAAQgAAEI QAACEIAABCAAgR4QQJTpAXSihAAEIAABCEAAAhCAAAQgAAEIQAACiDKUAQhAAAIQgAAEIAABCEAA AhCAAAQg0AMCiDLTDL3VarZjqNVqab9sfa6cL8fK1h7LuXYA7EAAAhCAAAQgAAEIQAACEIAABCBw wRBAlJnmW1mr1dviSqvVCgNvtYo4Uw+ft/OxfK5VfW+2z6UDfEAAAhCAAAQgAAEIQAACEIAABCBw QRFAlJnu21kbL640Us8Z956px2fv2ZD+vB/RjHwuJyiJNboWBwEIQAACEIAABCAAAQhAAAIQgMCF SaD/wszW+ZOreqsuuaXjsthSj/vvWR9fvPPadKK/NhYP/nxj5P4zHb8Tr+2cYQ8CEIAABCAAAQhA AAIQgAAEIACBDzsBespM8x20ION5Yjw8qU//7L5w9/Vx/x3rwoOZ/Od9H7OzH/v1Nd1iTjrJBwQg AAEIQAACEIAABCAAAQhAAAIXDAF6ypyDW5nmkqnXohGjcf/dt8YDd16jEUsWarLsUqvX40t3rlNP mf548LGndcrCTJ5b5hwkjyggAAEIQAACEIAABCAAAQhAAAIQ6AEBespMM/S0mpLGJVlkGS/IjLVj brW0L5HGYo39JEFG13SvxNT2zA4EIAABCEAAAhCAAAQgAAEIQAACFwQBRJlpvo1JYFGnly/c89H4 4l1ro1p4SbHmoUw5+rzvc/ZjvxrXRG+Zab43BA8BCEAAAhCAAAQgAAEIQAACEOglAUSZD0i/DEFy MKVnS9mWcxZZHrhrnXx4JSbPFdOKWjU6qWw7w5Wa8bmPXReLF876gCnj8guHQKeaeq+Uq1Pnzz47 153a7ynOVrNPT4yzT+W425Uy7+1Ev/ZXq0+YIWn85d1BndF+iXf8RV5qPi8xP/54RUTL0E9+Xcd3 N7m+ydKqY+PCmOgnrbo28WAnfPYgAAEIQAACEIAABCAAAQiYAHPKfMBy4NWUbITmraftlfSSusNI eNG51EPmbgkylQhj8aXuXjA26rS1QFPXl7TV3DKjo834/e88GvsOHPuAKePyC4KA7fpq7iHnp5S1 su9tKYNlv5bmJGok0aCl1b9cyia6Ipz0qQlopqXXu/1p38dcZqty6zjsI11X79Py7dUJByy/jsci RVOX2W9aSqzLS6vpq+28rcJOeUsHT/pRhI+2aDnhmvbxKoTMx+nUAQsz2unOfSsda4475ktragk9 inCwPhgzZ/bFrNn9MXtwZgyNHI9jQ2NxfGQkRsYaKZYUh/LRquA4jSkdJW1p2zmfLuIDAhCAAAQg AAEIQAACEIDAJAQQZSaBckaH/EY8GZr5qkYSaLxfj8/ec6N6yGjZ67Zxmg3SVs0Gc38y6upJ1BnT lDL9MTIyFl//q0diy9Y9ObBkGBdjNh/i8+IicN+GtbFqxVIJfVlaqCQNlRdZ/jrUtABQFTCfc/kb lTJy+MhIHDp6WH8jsXvPgdj93sHoU1lzKCmMulUIiRNVGfO8RkXccdAthdH5nstgSoEFFwuLCufj G65V2pYkUTEpjFYaU+ARx0dH4ps/eirFN1E40aUKuxIy/OUUztdeMndufOW+m1K8ujDl29c3Kmnl r3/2jPI5LEFI9UrCpnG4J4+Fo3bVS3E4cS0d1+pmUkadRzO5ad2quHrFJfER5WX5ovnR15eHEyZB qJlDcNbePXBEdfOdePXtfbFpy844pjw6w81mZpciE0+Wsj/FDeUUBCAAAQhAAAIQgAAEIDCOAKLM OBxn/mWiAZZ7CWiZ63vWxxfvlCAjlwSYZPTKEEw2Xl5dyYZeTUafTdyR0Vb8ewkyr721O/plWDbs L/VySEHwcZESsOhx83WXV3MRSXRQuWipJ4xd3vexak4ilbF6fSD32qjOu4OK/e07eCxefPPt2Cwx YZOEhZrFGHdnkZCRtBT1frEAYpEiC4sWMORD33Pvk37LD/rn43kY3sqrLolb1l7Wjj9dIKmkpO/d Q0fjx09sTFd0wlS8inaiXJKvneRTfufMGhSD5TlcCSAhQcl5kgSVjv3giRfjoMSnuvKQhJmUh+Rh QoBVj576WPS1BmLD9VdpYu0bYumCeVHr07mGegMlDs6f66rCcFr15/iWLpwfSy6ZG3fddE0MSZB5 7Lk34uGnXotDx4Yk8LhXjslkShMi5isEIAABCEAAAhCAAAQgAIFJCSDKTIpl6geTaau38h620W9j UP++cPf1cf8d1yWxJQ1Mag0rwBOXufY0Gzaax0Yj/uA7P43Xtr6bjOBGGXIiYzC9fZ96cvB5gRFo ShiwIJBFiD6VD5Wo6pizWpO40EoCi/Zrg0lAKQiS2OIypkK0aP7M+JTEBPe82bF7X/zNzzfFxje2 pZ4lSUywACGXy3MWZEo4SWjUmdTDxD1BKn8xJiGimQWh4teCTJ8itqDxwF3Xx/Ovbo29B46qblRD ns60TCtZSRxR/XF9aalHWU2VxqKJ+rmkYylu+3ONUy+XVkvDjKrhVPla+bC4okpa1ypn1199ZXzl nhti2dIF8qteLhJkYlSCTL9IjUmQUavo+px6yujSNB2Oerepj432B8SsEbP6B+Kzmvvpkxuujm// +IV4/KXXcq8l3wvE1FIc2EIAAhCAAAQgAAEIQAACpyEw3vo6jWdOT07Ahp9HTTRqo+ohc3N86c51 +i7DMZm4Npw7hms2rqu5KWQoNtRD5ve+9Wi8kgQZv52XUafr0jbbyZNHytGLgoDnQLG4Uv4ssJR9 b5vjJtB12cl+23CsuEiIcHlsSTSsSVy44tJL4l9+7Y74H377s7FkwcJUSosA4W0ugzmEctzfXMY9 f4yHPLUUeepFk9KQ47TA6DQ1XMgVZ99ALb76mVt1UMcs+jgfUjtOmPQ3R3XSz5IGh29nEcpxFA75 aO694x4rijn7q4Sm/CVixsBA/POv3BP/7a99PAkySlUSXmoN5bl/THmS6OVRXSlvSmzlUjwOszYj 8facUbWal7RvxozB/vjNL94S/+LvfSJm9kskqsSgci1bCEAAAhCAAAQgAAEIQAACpyJQmTmn8sK5 UxFIBqONTRmA9999azxw5zXJIPUb+OJs1BWX97PRODqmIUua1HfL9h0y8mS0yuXhT9W2XMT2oiVQ FQvlXz01qjJluS+7PJzJ5+xKr5B8Ta7aFhhSD5NU8CymqOxJMHHPrWsuXxL/+nc+FWtWLku9QLIg kyeoTgFWYZZGIoXvXiCpJ4i7kuR4iy7keL3vbRIqtX/DyuVxi+ZsSc66jIdDVepKEVvyyZN/NnI0 VW+h7K+m3jAdNvmY4zSjwqGEaJHJQwL/6Vc+GTesuVy9YCrxquVhUOpZIxzucaTuMolPQlVdXPad 1pqGTpVeQBHqMVPl0/F9dN3y+J2/d4/yp8A8t439ex8HAQhAAAIQgAAEIAABCEDgFASKvXUKL5w6 FYFkAMo4S6ss3bU2GXjZfxZeuq/tNtIsyHz924/Eq1t3JUPVPRCSre2twsuO21NIXKzbvkr48LxE /rPriA6ljOVtLl+VglH10upwsxDh8qRtNXmtz82aMRC/+9X74o6Pqux29yzxycr5ykldVw+wLPS4 N45jyWKE0+Pvv/qpj2oloxkKvxOS908W38S46u7tUzmLTNmVvJczeZuHWk081p+GFK5fvTSdKPUw zRuj4LK447RZaGnG8eOjsePdA/Hy67tipyZJHhm1IJZ75uS5cdybyPPZlGt9T2rx0WuuiF/99AYB yEMVO2kdnx6+QQACEIAABCAAAQhAAAIQKASYU6aQOMnWxmMx9JKRKeOsbMs5CzIP3KVlr2Xw+pyH mNiObBtt6pmQjLrK6C2CzOvb3+nE2p6HoluI6RixHY/sXUwE8vxCOccuQ0VQ8JG39w7Fg488l8qZ v+dy6SE1gzFv9kDMnT0z1l61PK5avtCn5XJ5ausa+WD099Xjt+6/JY4cHZIQsSMddVg1xTeVEujw Wo3ss5T/HFsWUxbMHoxfuXdD/NlDT7TrTq1a/alKwpQ3pUfZlC+QxyuXLYjPaY6n4jKnLqFH6T86 NBw/fHJTPPnCdi2DPX45etfIeXPmxEfVy+ZLH78+ZmviYYdhN55lIz5589p4ZuO2eHPXPp2dCr0U DB8QgAAEIAABCEAAAj0hUL20dNx+vOs8IvYkNWcr0pp7xtse1fN8yuFJ8jbxufhsxX+ycIr9fLLz F+txRJnT3Pk03KISZtqFOllieZhH6iFztwSZqgInP64AKvjpDXwlyKShDjpmQeb31UNmy7bdp4mZ 0xAYT6AIAT7qcjY0NBQvvv72eE/+lnpbef6YWvxt64VYIEHhLi1f/dmPrQlN86KOHF5RKff8yOVS M01rwt5//KU74t9+40ex98ihfP7EkE844oWptWaTOspUgk81n0vHo3vu9MXtN10VT258M97YoeXe NYRJY5g6XqZ5777b1rZFFEflvHdcPZ7b9Hb86Q8ej+NjpZdR56z3nNKDR4/Goy+8Es9s2paW577z xlU+1Xa5SXC4tfh19Zb53//4x+1z7EAAAhCAAAQgAAEInEcEqmdlP+VlSaYSZtovyc/dc+rpqBTR pGxP57+cb7lnvJ659dSv+SA9fYBWafWCGF095icLc7JjJcwPunXYuef+Bw3pwrveJRB3KgKqtKWn jL15+EI20+rx2Xs2pB4yefiDz2acLQ05SQVa5S6JMy6AEmdGNQzi69/5Wby6TYYpDgJnQGC8kKA2 tuqpcUIQ5UdG23LNgSOH48GfPxv/5hsPxrZ397cnyfW1SUyohJTBgb74na9+LM2/MtWGwYJMCkfb sj++Mc/nNYVu/Defu0WrMHnuFs3NUl2XLp7Gj1kzZsRN116pGIrgUraOtBG79x6IP/nhE12CTFWH Uz0vFHSN2wFV/aPDx+LPf/BUbNt9IKW61P0iuqqWxxWXLY2rLiu9k5I3PiAAAQhAAAIQgAAEekBg 0mfmtvhSr2QZvaBMrth5PUjoSaJML1L1XNrUnIVn7HydL9LW9mxTEzW6p0pxk4VZ7Ifi52xuJ4vv bIb/YQ6rWB0f5jxMa9q9mkq3SwKNCvX9H18fX77r2nSqzPXRGVpRzSkhLabWkEopRXJEdf3rf6Ue MlvdU6AzCXB32OxD4FQE/KNywg+LBef0p3Lq8pZEDx3TJLbF9UXe33/4cPw/f/5wvLH9XZ0a37C7 AfYKTauWLY5bb1iluXwdWAlhalv3mrFzWEmYsTbfFcbyJQvj05p3yWnzSmUn5GVq0ZyRr1XLL9FS 176kEo/G1ee++O7PX4rh0fJD7N5F7u3iret9+dHK1/pYXfPF1DQ28Y++94to6IfNbx68ZFMSX13V PS+NhJnrP7LakeIgAAEIQAACEIAABHpIYKLIkJ4//aZNf316tq7rZWGtNnjWU5iH6fhB2M+UuQd7 tyByqgizP1/nZ3uvoqpe6fr7oC6Ho2fV6uVu+l4971qesvO5D/rncMbntTBwzx3cZATgMhmVrmMu ni6YnrSzvN3/wt3Xx/13rFPPgIyv1RpOV0ys9F6JxgvNjGn7+3/103jtLRvDcjIMS2XIB/iEwOkJ uHwVwaP49txFNSnnda06lOYxankFIf8A5IbV/pr1LDr4/KgEiP/w7Z/HwaHcm6uEU8q4v39eZbvm ro36fyau9JQp9cKzK5WeJPnHqBGfv31dLF44I9WBifXlTOKaqt958+ao3jodua521zun7e1de3NQ STzKvYvKj9K4OHS9BRjPs+MBW3v3H4o3du0Xc3EW+/ZqUK2R1GNo3VX0lBnHjy8QgAAEIAABCECg hwSKSJCfP/XGTi8Jx/QM3dILzWZzNAk0ZzN5fpnnuPxc6b/8DD810zsLML5Gf3rybDROXF30VGnt ft618ORwfCyHo5eKzreOeZsHcNlyKMKRhjv5+Af4c9jjRaRil0z6lH2qrFw056ZWMi4aHJNnNFUo kfLb/fvvuTm+dOc6FTQVXBVfOy+rW1w2QqseAzL0GqOt+H//8ufx6lvvqDIUc1UFXwUdB4GpEMg/ Hh2f3d9dAls1yw79Eg38xas0WU3pqtpe7lnn7NfD74ZGRuIvfvjL6sfBE/rqRHK5PC9ZMCc2rF9d Dk55W34ASr3oXKiyLkXIYpF7rfzG5+9KPwSd89O3N3/eTAXu+pnz1s1uaKShuWKO58grBqbW9NuT E5zrezXxsfy6M+juvQe7egKV3jTmX4s5mscHBwEIQAACEIAABCDQewKWAnIv6Oplu+ZX8dNcFk70 crM+oGfk9gPxWU2wnyone7I8VSTleTWlWS8G+/pyr/dTXdN9Ll+v6/RMauGpT3aAj/W7x7eO5R4z 3u+yFxRAd7w+90H+SlhOl0WaTEHM3RsfdwKB8XfihNMcSIZmVZDvv/vWeODOa2RgWnHsDEFKHRMq VHk/G2ie1Pf30qS+O9smcqqUCm9iJYA0BE5GoIgdE8+7USvqu7tetpqlwbPPonvnfc/pkhphTfBl 95KWe962e5/KscpyV9voBtTyw2duW5P8TfXDYTe7Aho/Z67irCYVG1Do1161JO68/szCn2o6Jvo7 PqSeK66/+mvow+ksPxKzZvTFsvmz0iX5x6L60ewa+tUJr/Si8RE3m/V4bfveNLeM55fx39Z3qu2u 9+LI0PgVnDrhsAcBCEAAAhCAAAQgMJ0E/FxX/hxPU0PNi8vPgZ7wVr1F/Jf8ns8vy3OPm076pyrx NJPQZAHGs2nY+UrnPzGoOghMS9+VCS84u+3e7omGU6L4SAQ6JRQgkxIoBlxaZUnzYfhdebZhs3Hb fVG3wVeWvS6rLI2rPtMjxHYnhf2LgIAbtSK9uOy5J4edf1zc+HWXuY767yt0Tn6eeHGblsteOo5U ElcUzpWXLoq5miT3yHAemjfOU9eXsvpSricddefNXe8mAWTNimWVb6dG3S/Vq8c9c371Uzem5bdP F35XVO9r98DRY+2eQH2K2OJMXR+lCl69+orY89xr+Y2BjnoJcvc08suS1GtGsXpeqWZdIqy3KRX5 h/75V7bF86++ldOlc3bdbUA+wScEIAABCEAAAhCAwLkk0C0CON5mQ8P7NQSoOaaXddqf2Ks7vZKU cNM3MCPqgzaPT7TzzjT9zZHhGBs5qofD6olcz4r9g3MUvobxn8a1xo7H6PGhcb5q6m7eP3OOeppM JW16LtUcpp58I09r0BejQ+9VL3CrYP1MXh+MgVn5BaWfcoePHtLzr57X/cD8AV3/jFnRPzArPTsX 24Tn5JNDzZbEyc9f8GdcSIpzQbEr23LOgswDd2nZaxUrn/PovjLkw9uO/2zqFUHm9e3vpPD4gMB0 EyjioeOZ+EPUHbcb51Lif7l5mxrqyd8MOLyrVxZBpVPGLVWUelH3WNmuH63uH7iWxlL98Q+ei7GG YysxZkHG6Zk9a2Z85VM3dSctiSDdB85G47Rtp36ArLBUzvU1/87k0L96741xlQQo+8lya+4RY+8l 1Wk4UyW6tMPx5f6R9fGuc55zJrUHakpKu1CuYQsBCEAAAhCAAAQgcJYJ+HmsCB8TgvYza2NkKBoS JJrDh6M+OtwWZPw8mCeWsDHnZ7oR+T0cI0eOhAWV5CptIgsbOtIVT3ke7o6y+5gFGT8b+9kz9VjX fmP0xJ7U458X/XJQkWo4lXvx9HkIka7zvhIVTc0N6UfQ/BSbY7Z//3XHnZ5i9Xzq59K8r5eLGrKV 0uM0OczGiIZF5ZB8fepNo5EgTT/LSpgpfv1Ss+yn65SW7u8n2++8zPQzcY4nP5N3p76b3sW9f9FT cSEphdgFxUBKxfO51EPmbgsy2SU/rrc2ulzO01CmjkhjQeb305Cl3cnQK9exhcD5RMBlfli9YHbv P9xOVvoRaH+LuG5VR5TJjajrhkWH3Gy4t023m3j9/v3746EnXu72kupW9teM27XK07UrL2v/sKTQ qh8/tfb6ufjg7vCxodi8NU+wneqrgsx5cOWN8DLg/+of3BvrVl+WjnvMbcpeOx1ZiO3++XP7YHGr W4xJgemjlX4UFbb/px/CcoYtBCAAAQhAAAIQgMBZJzDhBVkJ34swjA7tl5bR1ePED3pyzbSgRSV4 6JmuVcb36FyfV8kdORajRw+0e5a4F7WfX9PzXwqhIzRUX9Om/Yw8lgWQ7nNp34tDaIx/9zPzxOfF 9F1x9fcPSiDJ02XUZW86zc2Get7IeY7I4sr1Je5y3Nu2L4lRxaWXkwovPe/250EzDsPXe5Ga7MqD sBas0QtWW8iOP9m/FcPic7Jt4tslYNmPbY9ic092zcV+7KIXZax4dhfiXMhdIuvx2Xs2pB4yxZgr hlmrliuTC2YqnKo4FmdGRxvx9e/8LF7dpmWvcRA4DwlMbLi3v/NeO5XlXCnnKy9b3D5XdqyWn8x1 ru/4+Mnjm2LP/8/ee0ZbdtRnn3Vu6CC1ckIBqYWVWlkIDJIQiIyECTL2zJiFMZhkcMBey2vsmVnz rpl3xu8H2x/Gg1+wCTYeRzI2RigQFFsCSUhISK2cUEJIanVON8z/qTrPOXV2n9v3dve9fa76/qr7 3Nq7wr9q/84+e9d+doXn1ndEzDwJcZ6RuKT59TedlUZzN8y4FMXNQLe77KYupmt8BluaUPv7N99b TLZNa5Juz3GjiKWLR9PHf+016Xf/h4vSMS85pLwEaZeve16+UbVvirqZDA2XGenNqa5GPwZ1PNsQ gAAEIAABCEAAAnNJQI+3E2ksXsyp2Tqk57S2Uy8Q9VqJZRniX1EgYsaVaIuqbVjadzHLTIRo2Hos 67D5hchZlnFWG69fOy+LGy4g/Pxyf9vmnkVdVK7dtvFNPXEK74o0pU56NpUoU9ddc8Oo/DEJPj2F qoNB177LkV+EED2jamELcYmylDQEluGhJXn4fg7c7k9Jq+4zQyMxYXAQEaJoAueP+srv8BPPxVp8 pHaqc/l0v486fqFvt4kvXAyaL6J2+SSPk+Ztrzk1veO8k3JUqz05VH6gzCHlR5EFGSmrcWJvjVWH /+ab16UHHg1BRgorDgLziEA/ZVo3gF8813170NVbyg1h332Wti/f3QMpMd19belG0L2Z9MZtjRva v111a1be9XvJN4S8ElPc2ML6EQcfkF4fS8wXcbQszdexMAvX7KHolnnfoz9PN93+cNRTEyPrTUOU 0/7ZlzrFTzgO7MSXHpb++H1vSJ987xvTeWefmPbfd3Hn5jEZ43iVRdeCVmQuy/yZhv328Sld72Wl c0hsQAACEIAABCAAAQjMJoFmoyvaeZuiZ8hk6R0iQWSk3ctDqyylJfun4f0PS6P7HZ5Glx2WhvaN nuERloaXplYsiNHpNRPLZE9EL5HxLRvbK3OWcppt3kk3KtuHNBwv78diaFAuK8Lc1vQRt0JUGQ5Z qHYepeEwze8yGXOyZDEnnjWLDbU3Q0yJejVdK+aH6bo2j2hH67l2MgSZVrS9o7XbEXnUCm8tKnPJ KJ+PqXsopW07GTxGhmNF0UUHp+H4pCUHlY+2d/AZWnRQzM/T/V50PNrT84h6MOG2J9B7Rmwfv9eH 6JTTiaiHspE4cWNqo/TWeEh826tOyQ+NUlEn84+6CDE1EHXx0smrVdU++82r0/2PaHLTSKExfLEx lWpZ22AbAnuCQBYbo6D6vNT5uXbz+lx8PlfzyatLZrkQ76ebQVU55dXY1DpM0bXNKnln86Enn0k3 3v1IetVpL4sLctxIJoazOCJL6t74lleeku6867H0eAx38luA6Wx2jE+3ETdTjYv9+nU/TS85fFk6 PiYeVunl1hQ/1ngrMh7eaNx0slgTEccdeXBaftQhafz156R7H3s63Xb3z9KqB59I62Ip8dZk3KDV syc42OlG2P2tx+RxIdwws7zp4EMAAhCAAAQgAIG5JNDbMm1FO3N8fH28EIwW33Bpr0ULLnrD7JOG YlJbLRMtcSN/YjO3R0dGiyAT7eLxmFsmu+GYkFdzrGxbHxP0xvyD7eE43TZfSeZ2s/fGtpZVnbz0 80goKup9YzcebclWDCcaWhQCUduVdq/3othoWw5FW3O4tTiNjcQ8OO3srcnhtDUEn0WtZdH2tLih 9nQ98qPNI+eJOLVdxyZCXAlppN1+1TAszSeTk8RxTUavlvZefpGan2+jja7eMRJmolN55BW3mbvx qGteWiPsT7R7zQh977c1c3t7e0o9gS14px+XTrrx1rb0tgvOSW9/9YrYz+/UMxv9AOzKj6L8CHRu jm+bTJ/+2g3pvkd+Hg9jevdfnIZN4CAw3wg0byRbt5arfBFcVNvupVLDdJaOdm8YytuN7R6Z8jZd 56IvIScu6t/+/k/SxlgmWp1GNfyvKPHqcRKfkIZ//W0vj+2Y1CzfLOK2EH4/u81yptuf1BuC1mja tmVT+tRXrk8PP/FM3Gzj5qSbVxyNytAtY3w8hiT6hpePJ7pqxs/+1OOPSu/7lV9O/+X3350+9p7X pnNiKe/oTNpTrDq5dp0Emu15dOPZggAEIAABCEAAAhCYKwITKSawVVttKNpn0ctEU1NoTpahpfvE m0S9gFfLLfx4ia7PRITJtfTstyTEDjfj8tD1djs5hBa7Zvs0D22vW8gxPEnl2Y21xRzvD4dYFN1v vJtblV2BpQTnNrdMjC5qt09LHYfUiyBWjwqlqJNfG3752hOYLccxjW3pEWT0tNoKu5N6+JXLo0ZC OCl7nd7kOoYsRMVzsPr2qD2t/i7iFRLPjj+RpiX+cmFfOfSM0a/nfk7Dn/xtLWgM+YcVJ71O/red f2665NUnxo9YvVy6Q5A6P84gVbaLSKNJfT+TJ/V9sgMyn9Bhr/+PY0Gj5uAHTKB5E1F1tmjcXdvF pTJvFWFEA41aaWkewtO9sTht7VtAkd/J2xZqtK8L+NotW9PXrr6jHR8ySC6qLY7E9vFHH5Redeby ttlyW7Ctuqyd3S5DlsqNRjPW/z//enX6+tV3pm3xxsBOdcm9XXoO03XQ+OKJpMULTz3+Jem3Lnll +t8+8fZ08QWnp/1jeFd2+WYmXr7ZdG27DHwIQAACEIAABCAAgT1AQEJMtGknQkjQS0CtYJSiF7N6 guSeG7kNGjJDNADzC3W1A6VPtP2hmMulOAWWxuG2obHIr1219bKBkkRBWaTIsdFTeixe9HWfIZVo ZCh65wzbZkgTMdRifHxzTltajx1TvRuqT7wcHcrTaJS2pXuwjEeb1s718n7Hj+k0JmKolF6UxtzC HaeXkkPDMZ9M5zDCQiUcdSf7jWClyXF6SnCZqssMPu32sQp2y5jnY9Ho78oZ1D9uQYTmH1accHmV pfNO7qqj8UNuuvqh1stePxDDG/Qr9smW83RO8qYF9iEwOALNm4hqMlFNuithQud4nghXcXFea4Ix 56vP/+ZRKI3i+6XRDU9vAG69++F0/xOxKllH/IjfWOdNwmh692vPLEJHxPez0yxzJvsqO/82w6Z8 1fPaW+9P/+1zl6Xb73symyi9dsovWOWW+pVLo49JYbox6XNgdH1923mnpv/1Q29Lb3zVqWnRSHCL 49D0UvXNhrcBM/mGSAMBCEAAAhCAAAR2jUBvW6uICxYPhqLRlqeaiLafBBi3A3NJMZxmPMLlcrj+ RFtPc40OtZaqBRwfPeHJV2+Tbq+PUqYfobtqh9qME2Ma+lTalJ1JejUMKuarqV1uX+dVmEod6jht +7jyktjqUl653INlLCbuzWJJux6VAKKkClVf8IkQf/J+W4EpqyKFQBWrLpVaKja2Ir/LnMg9aOJV Y/R0l8vDsGS/XUa9AlVO0O9PY5JfJ5mt9r3t7U2+z6i96Zg4FghAoE2g98bRD0v3ZqKLskSLrgjT vVw7Z30x7dxsHDmFXwSbcqn50hW3p7EY8ientxgWOlS2VkF6d8zjortgqUdv+SrbdZuiqKmDG/e8 1TGU6u//4/r0N1+5Nt2vybnDlTI1b472Stn18XbFJMXH0K6o77tee0b6nz/w1nT0IQf0CDK6gWmS YRwEIAABCEAAAhCAwNwQqF+G5ZeAar7FMBs59RApL96i1RbDfSbbU0uobdzqrKrpBqJEh9L601wv i5Yd3Pksie2RGPo00e5NUsosQ+BDbcll6Y/akeNbiwiifZWvtqPsabhQ7XLvla0betq1davRx6Xe 5mlU/bXtilgykY9HZUZPGEdFWXYKy+3avOqSQ6PXTrRNh0d7BSLHusxCIUr2i9OYn7F207fFdSS9 eZx/+rxOufD8+vtfeEcfR5wfuuIkvuKGO9N3bry3/UAmFPXDakFTn0ijI630O796YTrh2JfISlYk S6q829lkAwKDJOAbh+rQT6DZb98YX9vHFTFiOG3Z7K6K7Yt73GDsdEPZKRfdO59dvS5d+aO78u9M c7nI1WLHuSuOSSuOPzKHd28O8QuLovLvzzeInGL3/6wKQea/f/na9F8//630nyvvTs+sfqG6BrTL dDHt2e+LaFNuwqrT4QcsS3/0vrekc1YsL4zjsDTRb9zzcRCAAAQgAAEIQAACc0jAPTzUJlPbsdXz Uix6gOTmZiw1sXFNFmbyohJ5vFL7OVBPcVo5V6KLP1Ff21VzLosjnd4o5fG5lBfG22LNxFi3zVwO V/MmFjFGglFrdEnufdJ5qRn5NLzILwAn4+WjnMstNkL8iaFP6q1jZ7FkMoYw5eOVyKS87WZ5x55W omk4td2HGz1vGkm223W9ckT7WFWGy1G490sYDeDtIM4goPsNzyDx3pgkP+jFSayT6PKVt6bLbrpf 0mbsd7uKlYewcvRluwg2EmY+noWZozp6YAaaHyA5IffG8+XFdky9F0ydnb3n5cH79xdl8nGGALJx c1fx391j1zhb1eeam+5Nj7+wNrqNlpuP7Fab6X9848vzkKC6vE68fptZMJ2tS1e51T67enO6auWd 6c++cGX6i3/9Xrr2jgfTCxvbs+/nisRvfrjcgHxzd/21HyOY8nwzZ5x4bOemWNefbQhAAAIQgAAE IACB2SdQv8ST9SxUhABS5kYZj74seqaLBR2iDTy2cXWa2KweKhIyvHpmtAWz4BLpYthNa7y8eKuf BXtr3W1Ll+dItUnjEysqqYyui7KHY6ntthtWnSKZR0LpmVLDi8riMBo+VFQVH4/b8BJ0RkKYyUOx qoVkytLSEp26eVVUthNhZShV1KxdJZUzrEU11GidoYtXjDllZxELDUvK5dW911W+9uuwGRZAsg6B 2Xqy6Rh8MW7opNdk1sOTo+nyG25L375pVeznGTXy4Wi1GLvyQNb+scZ5OjzaSp94zwXppOVH5JPR P0WpsDgIDJqAL/CqR7kBFSFEP3ztH3bgvrmK+cJf9UJRvi2btuY0OcGu/glFPS89GMXmpaLj4r4l bgpfu/zHeXyvJhPWb2pIy/rl8ofSgQful95y/pll0rUoV3Xr3pgife4qqncW5Vh2tWrKV+zGm4xY MrH8ZifSE08+l7525a3pv37m39P/+2/XpJV3PJy2bCurM+m6UNy2XP/2Tqd+H3j7q9KhB3dvwI7H hwAEIAABCEAAAhCYewJq2w0v2i+N5x4zsXJQXukoRjVYnNiyMY1teD5/cm+T3LVZz3rqWRLPf7H6 aH5Ajt4zvb1WFOpP8zi25cl7HarJeSdi7FRr1O3GaHeHOKQ2rDWR3P6VkFO9/Xd7V3bchs+dehYv i6FY0V6NtrLnehnLQ5M09UC3DJev7toT7aFUHsI1MhzlxwS/M3EqQx/NaZPnpYm5cia2bkmTWsq7 7WvfYQqf2BqrrKr3TvT+we08gXzO7Xy2vSeHAOik1w9ivD1k6YqVd6XLf7iqo3a2Yo14ufqHon2d 5PqBj4T/0XdflE5cfpiCI2GZm6Ps8BcC84OAlHed67p4a1ysRIgDD9innNdx4U3bPD621Hft5q15 8tq69voNNH8HdXxzW5OBaSK1yBW3sbAf/3RDezCWpl4ZvVHinUX+DWWhJZcfN8Ko3xvOPTEdcchB 2Vypc1HqFVCE0XzbzPG786fc8PR79XVA9S0cVO8HH/95+vJ3b07/5b9/O33zxjvyqk0qP9al6nDQ vbRcQ1ppdHQ4XRoTFuvtCw4CEIAABCAAAQhAYPYJ1G3RZtu0tMkm05KlB4YIElOyDJXnOIkaasNN xKS38sfjJeG2rWvS1o1r04ReREYH6dzbI5as1qu/aA52XhAWMUbihz+9xzSxVeFdNzG5LS1aHEOX OkOe4kV+9LgejdWUPPw/tJ9oBUs8KTa7z6RqK5fnTrXZVY/h6CCgiYvlPHxJdZEo0uwIIDvqFaMn W7kyXUC0wqNdO7JIvYaUYsdOZbSivhNqE4fIsnXj8zFfzrq0ddMLaVN8tm5am7Zt1md93h7bsibv j21ZFyt2N4dx7bgsYguB6b+VvZyUJ23yYWa1MU7Ay6+/O33rxvtysJfH7nTdUhc4PZzqYSxOWL3h jzmc0u+8O+aYOe7wCNQJj4PA/CSQu0XGTUKdPg6NXilZ9ND1X+dy5Z55dm2c572XiJxWCsZOuFaI P1p9Sbec0tVSWyl955qfpvUb3EMm4kLdnJyMtFGN4dA03vuWV/S5bZQbTH0zzsZ2549680R+Hanq afHKR66b4ebx8fT9lfel//vzl6cf3/VY3OjibUCbg+pbuzNOOCIdc+SBdRDbEIAABCAAAQhAAAKz RMBtMJmrt2vzEmEWLTskTYxqRSU9m4XAkJuwwzE6QnP/Ra8O7cdkuePj69PYFvWeeS7Umk3RFtQL +2gJxjNd6YlS2q5d+24llpDxbRtKh+9OgmgcjsYUAdHGdJs1CyXVKkzRDycNxyqok2MbowneHfjk 500dl+qg/JMx7CiNlt7tKsLz0qhdXR9/fvEa8ZNjW7JtpdXALQk6WpZ7ImmOm+axKNX2TmyGonwJ TCPt7j0Sa2KAVwhB6mFu388FshvH26f1vr11QpoEes+oZuxC2I+H0/JjKweb17LPJ9NE+u4Nt6fL blzVeTPvk7ilB0f9UOIc1Cf/GKKngd6S/86lr0snHRvCDA4C84BAfW7n6sTNwW5JiDAH7NOdDV7n cX1hv++xX/T8Nops4dwz87PNUOvjCp3dRDVX09otW9JXv//jLA4psgwNKvXT7+q4Iw9KF5x9UsnY +Rt6f772z05vtHwBjGuAlrPukimF5X0LLlJmIsWaDRvS/3fZTenWVU+1a6TrR7kWKEB1m4heMme+ 7Kicvp0IDwIQgAAEIAABCEBgjgjU7deeIqKHyciSZWlo6X4hfJQeM0PRFs7SgV4adgQE93COPtyb N0bPEC38UNp+zZ4oxX631ZhXddIqSFWvGK3AOaypLELUyXPGZHFmKMSNaDe2y9RKSBp1MRZDg8bG 6yE/XdsqK3cOiLpoGWspPxJk3NtmbNvG3Fa38OOXqRNjm9K4JrAJJ0Emz4MYgtCQhni4bZtjp/6T exVFGzdniKa8hjMNRYU9HMo5PZzKnKr1oJwEfwYEFrwoo4dWn8A6ofUz8Ng+xeXEQngZAABAAElE QVRVmVau6qDMaYKaHr7yG/I4QbOC2T7BNfnvR9urMvkH0snMBgT2MAGf2xZnQtgOV372J59wdD53 XaXm+frAY093fhs5Tfscty3nm87Pdn2jyje4bo7b7n0srXrkqSJsxO/PLv+2Qil5x2vPSgcu6x3/ mn97ze4pzriTfr7tdYvdPrd+57nO8ZYlx5a/X77qlvTcmk05xL//LECFLd3vTlkuYbak3d4oIRCA AAQgAAEIQAACc05A7c/4qNf20L77pUX7xtD4kWXxIFdGNZQnP7XXcoswVyeLKOPb0pYYsqPhQS29 fKvaqM06T45rYYheGynmbikW28+ZuR0cgkakG15U2rUWVtTjZKIa8qN2Z295RTBqxapJIeuEINPb cJ2M3tzuXaO6ZTFJz6euQRZWIjyW5c7iVX4WaB7F9vv5RWP05BmKXjrKOxIrSbVGR3KPG/W68Wc0 luxWvPezeLS9OUKmIbDgx9n4oVWcrLLad5yEGblLzjstP6BJoZzUmRou/y58sis8tr1c9t98/bqk B1scBHaZQGNI0czsNG4MUufjMq4LfFHxy23ivDOO386cxcYNG7elx3/xQm98W1Dx76I3cuo9/56m SvGVq25L/8sH3xJDAP2Wop0yjn1xBF362jNyQBY/4vel35xt2u+xrd5A8WbiI+9+TTr68Lj5ema3 KtFPH3giffW7P86/Z3XEzDfjyKdDLLPt1zdE8fTturDbvHVruu9nT6fzDigMVacyX065JhyyP5P9 Zmj8gQAEIAABCEAAAnNKINppue0XhWS/tNu6RXbbxZPRm3k4GpfDi5dEmy9mE922Ka9S1H6sy1kk kkhkkbiheVRa0UNFoo5dsVb+SgwZ2xqrOakXSc5XUg2NLA4Lbjs6pyQZNVEXh9izUVvxUVkxxCh6 vIwsWZrbt2pnR2s3hzf/tEZC0Ik6yXV6zMQkuyls2o1tk0jUdfm5VYJKfZDd6B1uaZhSa9G+pZfO DlLquHC7RwCG0/DLSmX8XnKPmRvvzT1kSpYyt0WdvX5AtDBzwrEviSSN0XXl91dnZRsC/QloXE3b 1edXN6yIBHlfN6Lsit9R2ttzHEn5b8UNQ+FHHn5gOvnY9sTU7Vy6Vocskc/xW1Y93A6da28oPb92 Xbps5U9LQXG8Weisij3s8IPzno9fv8n6UyUtm/ltRHQ/ja6kB+2/OB20bGnnc/C+S9OB+y1NK44/ MtJKqKougcGp7Ac/CTQSgNqCq8vQOw6X/fSzazoCUbnPdcf17rtPvFWIeuIgAAEIQAACEIAABGaX QNV6C8PRbnNzud0jJTfvoi2ndltTGnFNJLSMxKpGo/scEi8GDyjtzyysyFhpSyvt2KYQZqLHiJza 0CWm/Xdsc243a+iO2q8SQNwLRxMJS/ipPwrLdrI8Ey9L23aHoyGpCXI7zVIfT07d/SOByC4s582x 6KlTesKrZRv1y6tNOVUIPlHnoeGuaNONYWs+Eeg9p+dTzeZJXfJDWZzzesC6fOWt6bKb7o/fqbqx dX8UtfDohzNVX8LMx/NQpqM6P+0MPOzpR42DwM4Q2P4hP+ZXiat3J1zdMztCQBEcdP5aGdcNoxXn 7kj4v3HxudHNsFu6zluNEdWqQWMx8dkPbr23GzmHW67btbfcl574xWpNkR83t6bgWfda0W+n3IS2 q1ZHlCq/rzVry42ymy7ePOheGdkP23/ftP/imDQtOwkw8XtsL30o4Uo9bXqdb8Fxu9MNVuJVsG7p 5t/uiaO3L1H7nG0sDmHKevYaZg8CEIAABCAAAQhAYCcJdNu8JWP9bDUpsSPacnq3mdtr0War4+ui 1BadjDbh6D5HxIpDEi/UQK4ekeMln4QPudyLpfMMF2k6vVLixafa0mqjKv3G1Z3PxPrVSZ86zEOL 1BNFLueLJa4nxttt0hzqP926SEjSMCFNXKzy5GRrbDJ6y8QzwfhYpI2hV70uxKcRt3l7Y9ibPwS6 3/L8qdO8q4l+zFqpZnhyNF1+w23p2zetin31KSj4JmMSKbvylr887erHMjzaSp94zwXppOVHxMXA P8H4qcePCgeB6QmUh/xy42n+XDVrfCjiEgnyDaJMOptthsCgG4py6NzVtpbGm4xz+R1vOCsdd9hh kdfnYAgNkVDagoSEH616Iq1eGxf3PeAsXGg5+q9edXuajJtbLXiqCvlm2RFitDpSf8FEN1/fcHXT fPTnq/PqaL5pt1K5SWnCNA3oWv6yuPkGD7FR+uxrucQsCpW3K5oNXzrLkMQXbWp1JqUJqMcfoXlj wlKbY+Ync+E2bCjzzZQ9/kIAAhCAAAQgAAEIzBYBtWfVhszNt7ZRteXUmtMLyKH8QFaGC0UTM79M 6ym73V5zu1HtvFY8zw0v2i8MyEq0/XIbMTak7MQKRHZqB6rNGIpMhEuskTpSDJY8JX8EZqc2tj61 65dufDxeJsbDY2mT1qnLi8FOyPC+IeJ0JwZW+3MihjBp2uLJie3b70Mx30ttoVGVjlk2BkuA72Ua /gKUf/TxI9GDo9wVK+9Kl/9wVfz8yineas/m7Ye/nCj++EE3JtpOH333RenE5e3hIu2hEU6HD4Gp CRQZvIgX9SVVOUL1zop5TPwVvnudZFu5p0fpYlkmX48b08Ti9OuvOzu9/hytaLQtVgnyz19x5Xwd C4X+yhvvivhmWdnqrP9xDSSoPPTkL9K1dz4ean+M4c03uLjF5ZtuqUthoJXPujeiUiFbCZGqEmzu uu/xtCVWeCr5dMtsi6WRRrPP/0+vPycddIBuvrEoYdy8de/NLywkwEjEionNxkLwaoUAMzHULlOT rMVXsv+yfdNJx/Uue10E2UgftX9q9fpZZ4VBCEAAAhCAAAQgAAE9mxURpHRaabcD4/lq25bNMUHv c2nzxmfStvXPp83rVqetm9ZE26z0Lu+wa+soEkDyS/OW2pCRKoSZIc3bEu1gT8QbgalVr46Um+YR vzV6qMSjYXn5WSxPjKnNOn0bWu1tiShdV7Zl084vDosA5NDYWxQ9s6v27ng0bydiGNV4vDgci942 zfSjMelw7bol1KFsD5qAn2YGXY95W/5ENSRClcyKalwBLr/+7vStG+/L9fZDoi8QIanmH7Z6ykxq otYYDrEonp9/590XphOOi7fr+YF53h4yFZtHBDoq/RR1kuAwHjeK0lume3FvWUSIfDovf+mYI9Mf f+D16YJXnFjGzMatQEvk2enepqE3//ydG9PzazY4eM79zo0h9+xJ6bJrb0/rY9jRSFswshCjijRF z2blur+/ErN5bFu65e6fxY7efpR5aMq2etS00r77LI7JgM9LS0aXRLzmj4keQ53fe/SEkyCjm3W7 LhJjJM3qxv6hd56Xli7dN9supam3knjqFjucfvrAIyWYvxCAAAQgAAEIQAACs0yg04LML9ey8WjH DcXLM7XfhvN79BBYcjfmrdFO7vZ06VSk3QxuDakNFz1voo2nvjUayt90auPV7VBtj2/bEPZjWoBY 2tquXw8YhTXb88qTJwcOcSUvNR1tzTy/zHj0tG63RUuZqmT3WF2SVmKyU3M+P3Nui+POvcK76TW/ zWQ1D43z4M8/At1vdP7VbX7UKH7gEmLclWxYP5r4weoH8t0bbo+TfzxdfP6K/GPwj0bDGfKcE/od xSf/qMIfjdVlfufS16XPxqpM97Eq0/z4fud5LToqfa6n7jDdG8VQe+4VnZvSDcrbgpAd4pzdJ5an O/jAfdMpv3RUOj0mtV3+koPaYky5cMtcERF085Eg0UrX/PjedNu9j+eSJF74fG4HzImnUibjhtmK bmUa/rt563j6yg9uSx9+1/lVeb3HXUX0bIpBB0I75oqV96RzTnppWrqkTLyrZQ1zd9M2x6MOPSD9 7x+6JH3v9vvTzbfek9Zt1SWx/Qs3VL2M0XUg6nnCMUeld5x/alp+9KHZTl6aMLb0vcQ9N7tYmTDd fs9TZYe/EIAABCAAAQhAAAJzRyDaaB0XL8PzEtM5YDi/tFSP8ckQLFqLShtPUXnZ6Ohlruc1vSxv SQhRE1F+Y6JcCSqTMRFjaTdnw9GU1NClMlXAWMzh4mkpRvY7uJJQ2mnbXlXL0vaOYVZbY66ZkeHR PBxJ9RyPuWuGt8WLQQ2zCFdeOKqBWYSW/DfqmFdhiuFOdpoOcduWdUXo0U7bDY8ujbLKUC+H4c9P Aogy03wvtSCjk1oPyeUhVj+Uibwqk0xcct6KbCmniYfcLMzGb0LjGvOKN/mXXib//WhM/qvlsh/8 2c97f+DT1IXohUdAPVi6rggymstoKJTw5cccmv7bJy7tRseWzs3FS0ezIq9JaDU/is7Jcvp1xQ1f oPNNKW5Cdz36VPr3792ebZVzvsfsnO3km0v80XFGX5ao5kT0Mnki/SQ+Z52glcu6IpQr4bqX/e4t TqKUDtVOMWs2bEj/fMXN0SPmgvIWQQJWvumWVNpeFoLNuy44Lb3tlSenux/6eXph3Yb0XKwItXpd jM+NNxkH7780HbJsn3TcUUekY4/cv4hbshF108xScmG1s31lDG1ct6l7o8wJ+AMBCEAAAhCAAAQg MKsE/JxmfziElomhmKx3bEv4EyF4aFB5iB1bYwjTyEHxTNZuS+fhP2qAqjq5NZpfR47H/DGa20VC jF+Myh9uT1Xhyk+oR0ukndBwp7bNVnvuFr/Id9r+vl6oxkvAyKMlrMty2np+jHJDmOmuslTq1tP2 lYg0Gi3QmM4mt2l1BHEcaonmxSqqAodHy6N+5hMNY/X2lusRmKr0bA6OAKLMNOzrH5ZPYPuO03LZ cpecd1oWarKi2v6V5Ifq/HZeD4xFqfRy2RJmHnCPmdxVTY+RukD4QbO9n63zZ6ET0HwpGio3FOqD VvoZievqSCy9XDuddvn+0r7J6Jzruq7A4XNY5+c1t96XvnH1TyJfzhQX9DjvymY3a9+t2na5MUik 6C2zb8ZuoEzE+T4cvcs0Z1M+4+P38o3v/zidcuyvpCWL9ZvRMZabUjdj2SqT8pZt/x6dxjkk8lx2 46q2cCp2zhsHKT4aYhhuScy8f/aKozs3uJKq+9e/XzH2tmN13HLP/GJN+u5Nd5XjcCQ+BCAAAQhA AAIQgMCsE3Dbz77afsP77Je2xFD4/MJMbbYI0xChsY1rYj6WJTGZ7z4K6WnrqkfKtm2bQrzZmNP3 VjTaqTHaQS9FS3t0NG0L0Wcynt0syKhtOdxSr5T2Ihu9BvrslVbqsOZ76ayWFLJKFDE+tjEtWrxP pzRldru9GGrnHVkWE/yu78wL2SxkKMQpPS9E5lwvNVXd1te4j9IvvJmr7FuUysc1rnpJ2pKThRCF stRVQvr9VatYbWV/LybXLy1hhQCizG6eCfnhLE5PCTOtOEkvefWJ5defT9buQ7CKqX9QFmY++43r 072PPBF5dbrKha+rR37GKz+6HMyfBUlgOJ8H7UOfiG6ScW5YVFBo3UMjCzIRb9/xPu90w1FPGjmF aXKyr3z/5vTDOx7JYZ0hS1kU9LnXvYxqK892n0/QEIdUl3yh1/C+EIzSWMTEMB4VEUJHU7hoF9Lj aRUjaSLlUl9uEUqweu2mdNl1t6dL33hO7HUh5PK0G3nkVIZukC5LviZc83HmREFJv0/1gHnvm8+O yHLZK3nGovzoNhplyHYsJhhbRQSyzWKjfaw5vnRhLelDNIoq6Jgff2FN+tyXr4/JgcNaCGe+ETk/ PgQgAAEIQAACEIDA3BNYtPSQmOD3uXYPlGinRWNzQuPLQ3SZiE8WG6L9l120/7SaUR7lEK1A9TZR 7xgJOXKLlu4X6dWzJcK0ZPV4CDeKigUh8nwwmnQwnHrKqM06vhNtwNZo1CF6vKgFmueYCVvq6T4x Fm3+aeaCGYpeMBMhmGgmnNzbPLdHw46GN0WVRkYWhd3+zmJNiS1t/dzOz/WItnBeJSSsxrFs3vJC Go3RWmohi1FzJan+JYjHkjSyeFluo+deR1GvMJcdbeTtqYk/bjcI6MFMZ7we4C5feWu67Kb742yV ItnVu/IPt11G2S6PoBJmPnbpa9IJLz06HuLKU6Ye5mQv+7tRL7LuHQR07dK5lV3cJHwuOUxigp2W Zs9CQju5whWfl2xX3vZkuhJjrv/Jg+n/+txlHUGmnG9RWlwwy5wrxaonsdaetJpyvuscLZeOoXzR 9jCetggptSa6dOa0xcyUf3VRtlI/7INTWfE7uOb2B9KjT/2iJ6/G/LZ/Kp1wTcjmsuSrSnlYVqQQ Dws0P/rJA+lTX/lheip6s5RwjTseTeOdcruCTL716LctG13E0U21e4wqp/AfSnfH8K9P/9PVafXm dSVPHBcOAhCAAAQgAAEIQGDPE2iNDoWYclAUXBpx8cowaZqWLKKouRvBmvxXC2XEmkVluFLEq20X skb+qD/IyJJY1CG6puepKPx8Nx4T/EaakG5SFFPSDpVFIyIw2pgROANX2qLRC2d4UbwgjFeC7Tex Q/Fyr2e1p4YttXGVd1iT/UZP82ENedLkxmoDK2/2oyXbI+qUHjw25XZz2VfbX23aqLta5dGOV/91 feRGQomJJUViK0SpmR1a5iwOqqfKKs+32ten+4ycC+BPJjC85PAT/w9Y7B4BnXB6Oz8S/+7/2ZNx wg6lE44+JM5sXQLiVx8Py/rJZpcfmMu2LgitEGbOPeXY/PD57AuhvIYtpc1eTluy8XdhEtAktS85 SMs2xzkUari6p+QLqUSP2JWGYl8XuTFNEDYctxHdgxQvXzPoxv9nX9icbln1SPrH//hhuvXen6Wt sXxePt8iTRZXsjGdm+UiKuLlfFSIbl7lJqBwubNPfGk68pCYY0U3pqheFn80VjXeIjy3bmu6+a6H SsId/pVl/RDibxZ6VOHYjTcFQ3Fgj/98TXrV6cvzdu6a02ZQjivSxv/rQmzZuCkmWcuW2vYkDGUX +5FYobrTPr/2hbTy9ofynC9HH3JgWqwbrUSdEKxa0UPGAk7cIl2tvIKa3l6IRX4ZooONFxiy+tza Delfr7wlffv6nwRP8dGNphxDLp4/EIAABCAAAQhAAAJ7mEC0/NSWHF4WDdgQX2KOxWieloE30cRz K1FtNokvesmmpqMWqtbGeLQ3h6KHzOiipSF+qBdLtP2iHahh8+ObNxSJQotUqMkXQsPQ0n0iOvKG a7dE8/ZM/sjGeAxhUv3UZp2I9vBkTBgzlFcH7dZUjf5ooUebVfWIxOGr7aplsFvR9tfqTaWHS6Ra tDiNRN27tVFrPY62LejkuXXaLx/rOo7HBMZq805EG1yffDATIRqFMNOaUHtZnIJY+GoXT/WRsDMZ c+0Mj8T8PuHUro+/Zbs6pBzAn0wAqWo3TwT98NQlK87L0BPjBxvuipV35ZP14lefmvdbMTmUehzo xK2VSamN6gamuUE+culF6W+/eXW6/5Gns5Ibz9w822V6C/tPvj7nGdjjZIkL7mTcWFox+axEeF3T QiCPi2ScLKNxbkXc0PDitH7DprR205a0YfPWGLKzOT389NPpvoeeTc8+/0LcRHTGlmtsa2Kk6DyR fTyfnyVOtySJjHJW+3M99PpA52XbSR/RjUvD9rT24FDM/ZJ76yhd+7fgtFP5uqiXe4KGMcVNsG1f Gr1ukI89szpd++MH0xt+OZbylmgzGr2B4iaR9RsNkYr0+g1lFT4X0q54p0BFxv9INJnl/ajryGS6 PoSZ6257OJ20/ND0ytOOSycffVQ6YH/ZKTdUvRMYD8j5Rhx3Sf125TSmdsP68bTqsSfSj0J0evCR 50LzUhlhN4QdLacYMMKO8phnzsofCEAAAhCAAAQgAIE9QSDaZEN66RbttuHR/dKQGpibN6VtIa60 tGpR9CJR21HtyG3Rfh6NNvZ4NC7Vdls0sjRNxKIZZcVdVVa9UtS2izarVl3KIdH6HY52X4TFdMLx 7Kah8Dkingu1MZ1TG7G0WUdDQGlti57W0ZbObd3oMaNnS5UlcaW4EH7CrnLUbUy1o3OHGC3sEe1i 9ZZR+7yl+WTUAM4fWSht0nZzNtrEwSXSud2tFHLDIQbJTnmqDQFmPMSeoa3x0jfYqH7RzJ1oLrud c/b+0bOK+IlPdmont4+3E9abZcHvtQ44/ZIZnToLntRUADq9C0qC7g9lKL3pgjPTO847qcrpH6CG mbQvBlmokWAzkrZuHUt/882Y/PfRZ0qehu3KEJsLhoAmv40OhFKr44G/POjrIqdl+CSalPNIcTH1 b/wt51L3wld6bzh95wYjc3L69dfnmcKnuCL47FU2O5/vZfhdESS69XSq6f1sJ3fDLDeoOocGOI2H WOJeLEorp2NvBQeN8+24nmMJCSpusErdr+6dPO3Yg/ZZmo6Jpa6X7bsk7b90cVq2WG8dUtoQ43rX bdyS1q3fmJ58ck16fuP6fENUfn0fqs9I3KzH843HJdnvlsIWBCAAAQhAAAIQgMAeIKC2YW4vqj0W Tu3DaO9psQxtqRmtl5nq+TIU7c9JCRp6+elGcLSF/TK9vDQsjePSXpVtGZWLF4Sxq/lqhkKIaDdR S9Q0f1Wz8rJUbXq93Iuate3mctTOlWoUAorbuiVPJI2CHKa0Q7Fkd+7Mo+4+4dTbZSRUHIkuxVbk 3EEbP2eq/7T5qUeNBBy/nBTDzsqudfo+2xpS1XlBWbfP+6QlKL4eRJndPw06J3uY6v7A9JNP6a0X nJEuPn9FVmJzQPzR70vP2Pl3Fr++0B7jRxl+9DDYFmvT/21M/ntfzFGBg4AI+KZQbigK0UW/6onR vtBpab3J6P2Sx9bkM1Fpe10eEyvxIP7ns9V542SUci0Jw71pesSaSJ3Pc53guZuKxqaWG5ss2akO 6r6Te4zkdI6Z3u8cZ06qm0f5DZW6dvM7XfYVmY/F8eUXuN2Np30j6v5W2+na2fJeLi+2ZDJucJ0b idLk/BGn3jBRrVZDQMqTKKubbLsu7Zq7UvgQgAAEIAABCEAAAnuKQLtN594lKtbtR1fBbb3SflZL MHqKtLuS5B4w7TZykU7KS76cqN2mVIgmzM3zuYSIsfNtP5UZvWFCfImZfYs4FG3xbCfK1otFOQ1X 0ktCv5zMgf4T6XLvcgsgnTqXBM1jzqHt+ttE7Su9nOal8fEoLAsseRhXo31cZ552W8djq9MmXnAJ mFNmN79y/6BlJp/42S9GFffgz36RlcwTX3pYDswndpzvukiUoXoxFCP2/SPQGLxzTj423XrPw2nT 5tIboljj74IlUK6PcfhS4+OCFudOPtekjOf9kiDPeyJRZCpBRt04pSiEq1diygZzqLbKOmDSFnpE ibwfY0Pjwpx1h5hXRWntyu8g9nOPHoV245xmJr6Pq31P6PwuOvanNaLaTa3i599Zrlo+irb40j6m qs7+Pao43UIkV5UbSXwHYqBuoq5kxHhTVjXrfT5++7GHgwAEIAABCEAAAhDYUwTa7bWe5mi7fZjf oJX4XJtO21XtvdKOi9jSzs1tucjXbg3Wtc8rCkW63C5sR9Rtwzptc7u0p0ubNceFqJPL7iQsbVNV X+FuZ3aiY0MtU3XTkYDUKVdv/Kdozyp5dj1MHNjry0rXxYtY9cCJwFJOaRl34/tvbd92b1tVL5x8 VP3zLdRQRJnd/OY7P4I+dhz34M+eiQe1oXTiS4+IVPGz1kOd07d/GE6rn9gVP1yV7rz/CafAh0CX QOfE8YWxG1XOoR1dabuZ+13cbambyiH2O506I6C3nO7567S77vez1S9s6hKqm9PUiXLMTOwWHr1U dpzPbOxPUwmiIQABCEAAAhCAAATmmIDbh9O1z6rntE57t7cdqIruuC2440PZ3lr/9DtK1z9uumPr X86OQ5slNff7556az8zy97e694ZmkW3vPbzBH1k+IeP3ccUNd6bv3HhvNYypTApcali2JW4qjdLq GjD1yTz446IGEIAABCAAAQhAAAIQgAAEIAABCOweAUSZ3eM3be48w3SILRJYLl95a7rspvtjFISU Ws39UVwZSziZ45QmizGRJ+d1InwIQAACEIAABCAAAQhAAAIQgAAE9ioCXWVgrzqs+XUwElk0QdNI azRdfsNtMXRpLF386lNCqSnL72pW6+/cdE/uITOs9ebzXCHRdS7GCOIgAAEIQAACEIAABCAAAQhA AAIQ2DsJ0FNmjr/XPJVRnoBJ69GUYUpXrLwrXR7zxmjNJX20rTA5pdHs2hJk+HLm+MvBPAQgAAEI QAACEIAABCAAAQhAYIAE6Ckzx/AnGkuT5Zmoo8zLr787esQU/N+94e4IiWXVoodMveJNM+8cVxXz EIAABCAAAQhAAAIQgAAEIAABCOxBAq0DTr+EMTJzDLwWW9T7JRYyzn97i43lxiKmLFis+WR6BZre tOxBAAIQgAAEIAABCEAAAhCAAAQg8GInwAiZOf4Ga3Elzy0T5Wl4kpzi9JFTmLbyJL/Z17rzlmiU AgcBCEAAAhCAAAQgAAEIQAACEIDA3kSA4Utz/G3Ww5E8ca/9HcWpWnX8HFcT8xCAAAQgAAEIQAAC EIAABCAAAQjsYQL0lNnDwCkOAhCAAAQgAAEIQAACEIAABCAAAQiIAKIM5wEEIAABCEAAAhCAAAQg AAEIQAACEBgAAUSZAUCnSAhAAAIQgAAEIAABCEAAAhCAAAQggCjDOQABCEAAAhCAAAQgAAEIQAAC EIAABAZAAFFmANApEgIQgAAEIAABCEAAAhCAAAQgAAEIIMpwDkAAAhCAAAQgAAEIQAACEIAABCAA gQEQQJQZAHSKhAAEIAABCEAAAhCAAAQgAAEIQAACiDKcAxCAAAQgAAEIQAACEIAABCAAAQhAYAAE EGUGAJ0iIQABCEAAAhCAAAQgAAEIQAACEIAAogznAAQgAAEIQAACEIAABCAAAQhAAAIQGAABRJkB QKdICEAAAhCAAAQgAAEIQAACEIAABCCAKMM5AAEIQAACEIAABCAAAQhAAAIQgAAEBkAAUWYA0CkS AhCAAAQgAAEIQAACEIAABCAAAQggynAOQAACEIAABCAAAQhAAAIQgAAEIACBARBAlBkAdIqEAAQg AAEIQAACEIAABCAAAQhAAAKIMpwDEIAABCAAAQhAAAIQgAAEIAABCEBgAAQQZQYAnSIhAAEIQAAC EIAABCAAAQhAAAIQgACiDOcABCAAAQhAAAIQgAAEIAABCEAAAhAYAAFEmQFAp0gIQAACEIAABCAA AQhAAAIQgAAEIIAowzkAAQhAAAIQgAAEIAABCEAAAhCAAAQGQABRZgDQKRICEIAABCAAAQhAAAIQ gAAEIAABCCDKcA5AAAIQgAAEIAABCEAAAhCAAAQgAIEBEECUGQB0ioQABCAAAQhAAAIQgAAEIAAB CEAAAogynAMQgAAEIAABCEAAAhCAAAQgAAEIQGAABBBlBgCdIiEAAQhAAAIQgAAEIAABCEAAAhCA AKIM5wAEIAABCEAAAhCAAAQgAAEIQAACEBgAAUSZAUCnSAhAAAIQgAAEIAABCEAAAhCAAAQggCjD OQABCEAAAhCAAAQgAAEIQAACEIAABAZAAFFmANApEgIQgAAEIAABCEAAAhCAAAQgAAEIIMpwDkAA AhCAAAQgAAEIQAACEIAABCAAgQEQQJQZAHSKhAAEIAABCEAAAhCAAAQgAAEIQAACiDKcAxCAAAQg AAEIQAACEIAABCAAAQhAYAAEEGUGAJ0iIQABCEAAAhCAAAQgAAEIQAACEIAAogznAAQgAAEIQAAC EIAABCAAAQhAAAIQGAABRJkBQKdICEAAAhCAAAQgAAEIQAACEIAABCCAKMM5AAEIQAACEIAABCAA AQhAAAIQgAAEBkAAUWYA0CkSAhCAAAQgAAEIQAACEIAABCAAAQggynAOQAACEIAABCAAAQhAAAIQ gAAEIACBARBAlBkAdIqEAAQgAAEIQAACEIAABCAAAQhAAAKIMpwDEIAABCAAAQhAAAIQgAAEIAAB CEBgAAQQZQYAnSIhAAEIQAACEIAABCAAAQhAAAIQgACiDOcABCAAAQhAAAIQgAAEIAABCEAAAhAY AAFEmQFAp0gIQAACEIAABCAAAQhAAAIQgAAEIIAowzkAAQhAAAIQgAAEIAABCEAAAhCAAAQGQABR ZgDQKRICEIAABCAAAQhAAAIQgAAEIAABCCDKcA5AAAIQgAAEIAABCEAAAhCAAAQgAIEBEECUGQB0 ioQABCAAAQhAAAIQgAAEIAABCEAAAlmUabVamcTk5AREIAABCEAAAhCAAAQgAAEIQAACEIAABGaZ QD/NJYsyk5OTuahWa/Y6zvQrbJaPB3MQgAAEIAABCEAAAhCAAAQgAAEIQGCPEdgdraOf5tKjwtTG 3XvGR1bHOUx+M53jhoaGvZmc134ngg0IQAACEIAABCAAAQhAAAIQgAAEIDAPCVjDsK8q1lpHXeWp tJE6b53e2z3Dl2xcxtx7RgllxIpO2S7DnRQ3MTEuL7s6rg6XXdm0X6f3Nj4EIAABCEAAAhCAAAQg AAEIQAACEBgUgVpAqTUMayWql7WOopt0p4BxuNLUcdJSaruOtz/yf374LWl8fDwEk6HsK2JiQiJM K+9LnNG2wuptp6vzOZ18OQs79mVDTnlwEIAABCAAAQhAAAIQgAAEIAABCEBgPhJo6hfWOexL55C2 Yb1jeHg46ybWOxyn9PW20jmvjntECRxYG1Eih1u0UZgzO15xSienSrsCdTqV4YrIV1zT9QtrpmEf AhCAAAQgAAEIQAACEIAABCAAAQjMJgHpFE1nPaTWMLwt33lqPcTbjpM+4jyOs5ZiP4syLlyBymRF yOHOrH3FKZ0Nj4yMdEQWp1P8VE75XcE6Tb+wOp5tCEAAAhCAAAQgAAEIQAACEIAABCCwpwhY4+hX XlPDkDYi53D57rTicIU53rZH+okw/cJkpCnayJgFGsXL9dsvMeWvC67D2IYABCAAAQhAAAIQgAAE IAABCEAAAvOZgAUV13FH+xZknEa+t+u4IuWERUfauMQTCSzu2VILMo5z2rpnjeworV3TrsPt12kd hg8BCEAAAhCAAAQgAAEIQAACEIAABPYkgen0i7ouzbQWWpTGcQqT5lHvO95hefiSM9fiigtTnMIl xFigsRH5KsC9X6YTWPrZd0VcHj4EIAABCEAAAhCAAAQgAAEIQAACEJgPBKyXTFWXWtOot53eWors KN5p7HfmlFGAxZexsbGehE7syiidxRrFWYzxttMr3HGqkMUbVw4fAhCAAAQgAAEIQAACEIAABCAA AQjMVwK1piGto9Y7vK26e9taifUThUsLcbx82VSY/I4oIyMWTTRBjVZVcmL5+rinizOrEKdRejkX LOOK074+yuuDcZ6cgT8QgAAEIAABCEAAAhCAAAQgAAEIQGCeEKg1i6k0jTqNRRdrHtZWdDjK73Dl kasnBc5zyjgix8Yf95hxRosxMiancAst2lf+0dHRHO48CrdTfudVmO17W34dr30cBCAAAQhAAAIQ gAAEIAABCEAAAhCYawJNzaPWLFR2U9NwfaSF6GMdRNvSNrSvbTuHa9/prYHk1ZcUUfeMqY1YgFEa V7Q24sIVr3B9aqd4q0SuWL9ltOs8bEMAAhCAAAQgAAEIQAACEIAABCAAgT1BwJqFy7JmYQ3D8U29 w+kdLt95HGfxRfuOlz0LPXn4koUTBTpRbVSZlUYVawozinOYtpvOdhwuO3LNcMc345y+jmcbAhCA AAQgAAEIQAACEIAABCAAAQjsDIFah5hOa1DaWlCZrhynVT7brju8OL/jnb4zfEmZHGiRxYaU2ZXv Z1QqT53WheFDAAIQgAAEIAABCEAAAhCAAAQgAIG9mYD1Eh2jt5u+46y7mEenp4wzKKJOZIHGGSS+ OK19xWkbYcaU8CEAAQhAAAIQgAAEIAABCEAAAhDY2wnUuoiP1WH2HW6tpQ7v9JRRIosq7g2jfW07 g/abIo3iHaZ0tuFC8SEAAQhAAAIQgAAEIAABCEAAAhCAwN5GwFqJjqvWRnycTT2lTu80nSWxJaY4 gba9b5FFEwHLoD5yFmLsuwKesMYF4EMAAhCAAAQgAAEIQAACEIAABCAAgb2JgDUQ+9ZGdIzWTbQt LcUTBWvfzvpL7iljAUaR3q6NKMzraFuk8TwyNqRwhVm8cUH4EIAABCAAAQhAAAIQgAAEIAABCEBg byIgEca6iEUX6yk+Tukl1lbkO966itJtN3ypFlnqhDZa+0rrNN720lF1OrYhAAEIQAACEIAABCAA AQhAAAIQgMDeQsCrU1sL0XFZT/ExWi/RvrflK53TjkjRkcLjCGeuE2m7NlCn8bbz177j8CEAAQhA AAIQgAAEIAABCEAAAhCAwN5AwBpJ3QvGx2XtRPsWXpzeaWp/xOOenFiRtRHvO8xdbrTvT53X8XVY XSDbEIAABCAAAQhAAAIQgAAEIAABCEDgxUzA2oeOoamNSA/Rx3pLv+O0ZpKHLzUTONLhKsBh2pbz vn2nrePqMLYhAAEIQAACEIAABCAAAQhAAAIQgMDeQqDWQ+ptHV+to2i/Ga8wuRF3t5mJglOylL8W Z+owtiEAAQhAAAIQgAAEIAABCEAAAhCAwEImMJUA049Jp6fMTMSZ2sDOFFLnYxsCEIAABCAAAQhA AAIQgAAEIAABCCxkAtJg1DmmI8oYhsUZ7+NDAAIQgAAEIAABCEAAAhCAAAQgAAEIzC4B6S/biTLN IprDmhi21CTEPgQgAAEIQAACEIAABCAAAQhAAAIQ6CXQHGHUrxNMjyijDE3RRUtm4yAAAQhAAAIQ gAAEIAABCEAAAhCAAAR2nUBTb5GlHlGmX4J+YbteBXJCAAIQgAAEIAABCEAAAhCAAAQgAAEIiMBQ szsNWCAAAQhAAAIQgAAEIAABCEAAAhCAAARml4D1F/uyPqQ/CqgDFYaDAAQgAAEIQAACEIAABCAA AQhAAAIQmB0CHolkX1Z7hi/NRJipM89OtbACAQhAAAIQgAAEIAABCEAAAhCAAAT2LgIz0VhyT5md OeyZGN0Ze6SFAAQgAAEIQAACEIAABCAAAQhAAAJ7E4GZaic9PWVmCmCmxmdqj3QQgAAEIAABCEAA AhCAAAQgAAEIQGChEdjpnjILDRDHCwEIQAACEIAABCAAAQhAAAIQgAAE5oIAosxcUMUmBCAAAQhA AAIQgAAEIAABCEAAAhCYhgCizDSAiIYABCAAAQhAAAIQgAAEIAABCEAAAnNBAFFmLqhiEwIQgAAE IAABCEAAAhCAAAQgAAEITEMAUWYaQERDAAIQgAAEIAABCEAAAhCAAAQgAIG5IIAoMxdUsQkBCEAA AhCAAAQgAAEIQAACEIAABKYhgCgzDSCiIQABCEAAAhCAAAQgAAEIQAACEIDAXBBAlJkLqtiEAAQg AAEIQAACEIAABCAAAQhAAALTEECUmQYQ0RCAAAQgAAEIQAACEIAABCAAAQhAYC4IIMrMBVVsQgAC EIAABCAAAQhAAAIQgAAEIACBaQggykwDiGgIQAACEIAABCAAAQhAAAIQgAAEIDAXBBBl5oIqNiEA AQhAAAIQgAAEIAABCEAAAhCAwDQEEGWmAUQ0BCAAAQhAAAIQgAAEIAABCEAAAhCYCwKIMnNBFZsQ gAAEIAABCEAAAhCAAAQgAAEIQGAaAogy0wAiGgIQgAAEIAABCEAAAhCAAAQgAAEIzAUBRJm5oIpN CEAAAhCAAAQgAAEIQAACEIAABCAwDQFEmWkAEQ0BCEAAAhCAAAQgAAEIQAACEIAABOaCAKLMXFDF JgQgAAEIQAACEIAABCAAAQhAAAIQmIYAosw0gIiGAAQgAAEIQAACEIAABCAAAQhAAAJzQQBRZi6o YhMCEIAABCAAAQhAAAIQgAAEIAABCExDAFFmGkBEQwACEIAABCAAAQhAAAIQgAAEIACBuSCAKDMX VLEJAQjMCoHJyclZsYMRCEAAAhCAAAQgAAEIQAAC85EAosx8/FaoEwQWIIFWq7XdUddhEmjq/e0S EwCB3STA+bWbAMkOAQhAAAIQgAAEILDTBBBldhoZGSAAgdkmoIdhiy7a7vdwXKeZ7fKxt3cT6Hc+ NY/Y51cznH0IQAACEIAABCAAAQjMJQFEmbmki20IQGBGBOphStpu7tsID84mgb8zBCz4OY/3LdbU 51V97jk9PgQgAAEIQAACEIAABOaKAKLMXJHFLgQgsFME9DDc74F4aKh7mfLD9E4ZJvGCJWDRRQDq c0vn1MTERCfMcZxfC/ZU4cAhAAEIQAACEIDAwAh0n3YGVgUKhgAEFjIBPzjbb7LwA7PC6x4NzXTs Q6BJoHnuKF7n0LZt29I999yTLr/88vTEE0/0ZJvqPOxJxA4EIAABCEAAAhCAAARmicDILNnBDAQg AIFdIlA/OMvAddddl2666aZsyyLMRRddlF75yld2ejbsUkFkWtAE1DPG59Nf//Vfp6eeeirz+MEP fpAuuOCC9M53vrMTv6BBcfAQgAAEIAABCEAAAnuUAD1l9ihuCoMABPoRqIUZCTLPPvts/vziF79I +qxcubJfNsIgMGMC7gHz6KOPpqeffron3y233JK2bNnSE+b0PYHsQAACEIAABCAAAQhAYJYJ0FNm loFiDgIQ2DkCEmT8APzwww9nMaa2oLgnn3wyDzM5+uij66ieng1KV4s7dUKXsaM0dXpvO5/3a19x 69atS+ppYSf7++23X3r961/fqdtUZfazPVVa25c/VZqmvX7pFOYeI7XNpt1+eZvp++0366A0/cKc 1+XYd3jtT5VfedasWTMt/9qWtjV0STZru2KiT+0Uvyuu37HUZfWL35VyyAMBCEAAAhCAAAQgsHcQ QJTZO75HjgICewUB9ViYyt16662pKcrUD85TiQ2ypwdhOT8c1/kclhM0/jhfIzjvKm7Dhg3b9eJR HSXKuIzat72pynTaZnl1eqepw5Tetp3X6bwvv5mnGef9fnkdtyNfE+g28/YLU12Vzt9ZM4+PxfEu 0/nkK24m/J3X/gknnJAOPfTQ3APLYWeddVZaunSpd3fIqZNoio3msSiZj0fb/eIVjoMABCAAAQhA AAIQWJgEEGUW5vfOUUNg3hDwA+vWrVvTXXfdNWW9br/99nTxxRen0dHRnjT1g3pPRHtHD8FOM5VA 4Hhlcfp+thzW78HaNoaHh51sSl9pm875Fe54l+N690tT22nWvblfp21u17abcTvab9axmdbx8n0c DnOZPl7nreMdVqd1vOPkO346/kr3yU9+Mp9rjz32WDr11FPTy172stpUh78CXW8LRC6nJ0PsTBXe TMc+BCAAAQhAAAIQgAAEagLMKVPTYBsCEBgYgTvuuCNt2rSpp/z64Vu9IlatWrVdTwOnka8H46Zz mHw9WPdztqG4On0zreJcjtNpX5+pbNuG03tfvsu1DYW5DMcpzLbtK6yfk+gh57wus+k7jcPrfYfZ huKaro5TmcqjMOdtpte+BRnH2YbzKtxh2m7asn0zqI9VcQ5X3n6utr1o0aJ0zjnnpHe/+93pxBNP TBZyXKZ92XH96jCFy55tOo3Cm85pFF7bqLebediHAAQgAAEIQAACEFg4BBBlFs53zZFCYF4TaA5d 0nASPTzL+QH2xz/+cX6473cgO3owVno9HNuO9uttPzg7TPsOU1o7Pfg302jfH6WzONDM73y2pX0L C3V+5fO+81g0cHrbaPoquy7X+V1v1035FOe0Lk/7TlOXZTsur953+tqe09W+y7Jf2/e2fdfDaW1H +y5b295XmMNdH+d1uGw383i/tq/tZrjCZKcOl71mmNI1nctXuPLLOV/e4Q8EIAABCEAAAhCAwIIm wPClBf31c/AQmB8EtNrSI488kiujB1c9tJ5xxhlp48aN6ac//WnnYfbee+9NL7zwQjrggAP6Vtx5 FalJYNW7xk42999//7Rs2bLOw7UfjuXLaQiVVnuSc9jIyEg67LDDOmGK12Sxcqp308mGJia27cWL F6dDDjkkix226Tjn1co/99xzT1q9enWePFgP/Jow+PDDD0+aA0WiTDOP89pX/Pr169PatWsdlPOo bNXBgoDq/8QTT+Q6qpwDDzwwnXLKKZmp9u0kbsimjkd1Uz7x3HfffdMRRxyR66b6KY9sO73zT+Ur 3fPPP5/tiZ++T9VB9dRHtlXuVO6ZZ55JY2NjOXpn+KuOqqu+O9monb5jHUvNWNv1vs8t+Tq37r// /sxaTHReqd4veclL8rGYSV2G8ytM2zgIQAACEIAABCAAAQiIAKIM5wEEIDBwArfddluuQ/3gqslX N2/enO68887OQ7oe6JX2oosu6lvn+mH+2muvTddff31POg1XOe+88/JDcf3A7UQSRf7qr/7Ku7nc I488Ms9B4sB//Md/TD//+c+9u52vB/7axsknn5x++7d/u3MMyuCHcg3X+s///M+k+XIsNDQNSlB5 xStekS655JIk8WAqJ5vqSfTtb3+7k0THqLJPOumkdN1116WrrrqqZ+lnxYupRATNrfKe97wn7bPP PrmuClN6cfRy0ebr+p955pnpXe96Vxa6HKfC6+/RlRkfH08333xz+v73v59FDYfLV17b1ETJb3nL W7JQVMe5rv/0T/80Y/7Ko2MXAzmVoRWz6u9H4RLd/viP/7hTB4XJuU5lL6WnnnoqfeMb30haVnsq J2HpHe94R1qxYkVPEh+jfBwEIAABCEAAAhCAAARMYOoWvlPgQwACEJhDAnrw1dAl+X5gVU+YX/ql X0p6kJdI4LlmFK+0EmX8kLszVfNDdt2ToS63acvpVdZMe4I0bdT7dZ01yey//Mu/5F4jCp/KSRC5 4YYbkpYLf+9739vptdNMX9vwMcl/7rnn0j/8wz+ku+++u8Osroe3NcmyetD8wR/8QVqyZEn62te+ lrTiVe3Mw2GaB+iBBx5IH//4x3NPE4c36/Kzn/0sffnLX+70QlI619Hbzqs6/P3f/30Wid7//vc7 uCe989TldBJWG836VlE7vSkx8Otf/3oWqHZUrnh/8YtfTKeddlr61V/91SxYubAd5XMafAhAAAIQ gAAEIACBhUWg21d9YR03RwsBCOxBAv0eRv3A/OCDD+YhLHV1NHRJedQzRA+3ckqvj4bRqKeC8zsu J5rhnzpvv7o1zSj9TNI18zX3Xe7KlSvTZz7zmTxcaaZ2NSTqU5/6VJIQ0s/ZtuJqm//xH/+RBRmF 18dRp1GcnIYSSYyRqNAUZEqKXtsK0xCzyy67zNE934sCNdRHopC+t9r1K1/xDpeIdMUVV+QsCnO4 j9P7tc3ptvvl6RfWtKPeMf/2b/+2Q0HG9XJeiVxf+tKXvIsPAQhAAAIQgAAEFiSBZhtpRxCa7TLt N8Nkb2ds7qi8+RJHT5n58k1QDwjsxQT6XTh9gW1O8CsMWhnHTsOYlMbpFa794447zkl64jqBs7jh +qsOr371qztz1WgOl5tuuqlTkuI1F8wv//Ivd8IOPfTQzrY2NA+Khhip503ttNS3jmn58uV5HhfN sfP444930qkO6jWj3hpawllz48zEqbeR6qXeQUcddVS2r3zqvSJxS3E+PoVLTNC+wuXUY0lDuCSQ aXiX4ptDrbQqluZY0UpGzqe8Svd3f/d3ea4b7dtpXhoNIzvmmGNyrxwJNhKqNDyorsvVV1+dbaoO crKtfJ4raGf5y3aTe12e61f7mtPI33F9bOrBtTy+K31nGhL10EMP9cwlJBv33XdfPq7zzz+/Nsk2 BCAAAQhAAAIQ2GsIqH3ktmO/dlXdQ90HrXR6safe8Jq/UB+1GxWuj4fXK6/aoFr8Qx/15tZiIF4E Q/aUvm6j1WXUdXP4fPQRZebjt0KdILBACEhk0ENv7SRi6GHdTg/kEiD0AG6neWbe+c53JgkZe8LV F/oLLrggX/xVrkQEP7BrXzcFTVr75je/ebsbhGzoBqNeJZpstrapeUg+9KEP5YluZcdOQ5zUa8Ui hMJ18/re976X53Jxuh35Kmd5iAcf+MAH8k1MaVVPOfW60RCqplMe3QQ/+MEPbie0SJj59Kc/nSe5 rW+CEmYkytROws/TTz+dbblMTYr7e7/3e3lyXN+kjz/++HTuuefmYUsaDqW0Ti8RyKKM+EngcJxs 74i/6lJz1r7KtFOcbdXbjlfclVdemdPUdjRfzG/91m/12Fbaa665Jn+/dVp932effXYehie7itNx 1GlcHj4EIAABCEAAAhCY7wTUhnH7SXW1gFKHKdzpHC7RRT2o1aZXe9bh8pXW6eXLKb3abWo3S8Cp 23ASZvR8oCkP9DxgG8qnbX3czmzaVZr55rqt0/lWM+oDAQjs1QR0sfzJT37SWclIB6uLph5g7bQv JVy9ZWqnCYCbYo4v4HW6udjWjUduqvLUM8XxSuN0Ol4N1ZLI4DCl0w3lYx/7WKp71Cit3LHHHps+ 8pGP5JtNnUdCRHM4kNLXabQvp1WFJCCoZ4edblJKK641b8Xbxute97qOIKMw1Um+RCdNOlyn1baG PtnZhgQW53WcRC3dQH2jdLi+54svvjiXozDb0Bwz3rYt1995a7/Jv7albX9/2vYxeVu+ncrSxMkW lRx+fAhI73vf+zp1crjSXxRzHamXl78/+WpISFyzc5z38SEAAQhAAAIQgMCLiUDdflK93T5rHoPb XHq5qN7fahdqQQzPFek2kduEtivfQo982XcZziObagvLpl4Cal9pXaZsOq/qpf357OgpM5+/HeoG gb2IgC+0PiRdHOuhS7rY6uJZCzC+8GqVHw1vkfOFWnOevPzlL+88ACvOF2xtz6ar7foi37Tv43N3 Stfd6WRDq0HVthSn4TgSKer0SmOnoUN60P/Rj37koJxWk/9qNana+UZUh2lOHg0Xqm9M3lY56oWi 1Z/sFHfQQQelN7zhDbmuClfdfNzytUJS0/Vbnlrfj3qV+HhkR72C5FSObNXHrSWlXY7ta6Urp7Vf 53E6hamcqfgrndLUZSq989mO08mX+OU0jr/wwgun7KGl+knMkthY25Uoo2XH5czC9vAhAAEIQAAC EIDAi42A2jn9XN1u0ktUizB1em3rozaZnNpPbh8pXNv6uN1Xxztcvm2q542GkusFpF5GqheN8ziN /X51ng9hiDLz4VugDhBYAATqh2Edrh62NW+KLqpyuljqYf+II47oXEgdvjyG36iHhobOyCmPlHHt K1yuebFt7udEu/intuUbhMJUD98UfByKl/O+i1R63Zh8k1C4mNTzz9iW4rytfK961au2E2X0dsD1 clmy53yy4Xj5TqNtfxfaPvjgg3vyKE7CiZbidn7bsm0LKwqXUzp9F453vjqdwlyu8jittu0kqGis sLqo2mlbvU3UNVV5zE/b/si2tuVq/gpznPMpjdNqW871LXvd+GZvJN3ktcR5M71tyK5ENM354x47 inOdvN0sX+E4CEAAAhCAAAQg8GIj4HaW6619DTtSm1e9qNX2cxvM7Se1g5ptQudXnNPVeR2vuDqv wm1fbUY9W+hlp8QZtStfLG0uRBl/w/gQgMCcEvAF1oWop0vzYqteMr6wOp0vporTxK92sqeeNm96 05tyUH0RV4DzOf2u+iqntu0bgcL9sW3tK76fk7Dw/PPPd6KUVqKF5lixU5idt1W25tjR5GaaBM1O N7v6GJXeH6ep4+swpfMxeRyu412ufYU7rdO4N4r3dcyenM1hTd82xEHLRq9duzbfrDW2WG9S7BRf O+eTL7cz/H0MOqecr7bd3HZZCvd4Z22bl27wmmyun3P95H/0ox/NSWzP9VCg0/WzQRgEIAABCEAA AhB4MRNQ+0krhnqhCbehdEx1G6huG9XHW4c7r32lq+Odr9nG87w1WuBipgtj2Nag/P6ty0HVhnIh AIEFQUAX1Ntuu63zsOuD1jAdX7DrC7DiNfdJWM97xgAAQABJREFUU5TRnB8WZfpdpG13d3w/WDdt uJ51uMIkANTO+d2zxTcOhbuXT53e283jl+rvnhuKk6ihMbnqvSEne/rM1DV5uZ61DdehmbZZhtM1 w+t99aTR8K2bb745ryJVx3l7JnZ2VBfVvclfts3c5dj3MXu/ti3hyM5MpruxT2XP+W0PHwIQgAAE IAABCOwNBNzGkQijtlPdfpqt43MZsldv78i+6qO5ZjQkX8Pj57tDlJkn31D9MKKTrX44mCdVpBoQ mDUC9957b559vTYoNVu9Laa6mKuniHqWKN6/F21r8twTTjghm2r+bvxbmuoC7vi6HtNtN8uYaXr1 bJGr89e9ZJp2mnWuRRnbkUjz0pe+tCM61Lab9qbbd177St+sw3Q2por/93//9zw/Sz/BpM4zW+XV NrVdH1Mzzvsu22nrXk1OU0+WrDCldT7vy1eY7Wjfbqpwx+NDAAIQgAAEIACB+U6g2Z6RAKKFGerh 53vyGPq1uVy+Xgrq+ULDy+ue3s1jcPpB+YgygyLfKDdmgsj/JlIZguATZTJefCsuTUR4S6u6DOec Cm91Rzo0rLELgflJwOe1hi7VTuG6mP/5n/95HTzldt3zQba8ZHKdoU7TvFj7Ybr267y7uq3j6OcU 3m/57qZI4Xrajusnm46zfaXRUBr5zTin2VN+v/Jd96uuuipP0ux9+xLZ3K10v/32y8ehY9GExs0h TE1OUx2XuU0V3wxv1rve1/nTdHW84lyevwMfWzOf9pt5+6UhDAIQgAAEIAABCMx3AnWbxj1S6hWV 3D4a5HG4baY6aBJgCTN6kVkLM65fndZhe9pHlNnTxKcobyLa/xOTEyG5lIc6n+wSXkKOida/MhZB BjFmCogEz3sCeriWir5q1aqeuipcF0RfFOXbdX4LbfFBcU6vNHfeeWd617velSemdR75Uz3I17aV zvadx3XQ/s64Op9sat9h2j/ssMO2M6chSLVT+tp5X/mbS04rrp/NOv+e2PaxNstS/e64444kUUbb PhbdDLX09Stf+co89ErhtqHvTCtBNUWZfgJJv/JkR872mml2tO+8TlNPUuywqd4AOa+FQO87n3wf fx3GNgQgAAEIQAACEJjPBNSmcfumrqfaNRI6NERI7SO3c+zXaQex3WyLSTRSXSXM6KVmHa9tfQZZ 9+1fBQ6C2gIuUwKLRZaR6P6iHjByrZbegMenPGPEHAya/HI8jeeuM70PbjkDfyDwIiCgi7qWC/ZD ty+Iughq20KKL47e16E5rfz6orlly5b88D/Tw7edZnrZ7HfTaaZr7tue6up62Xec8miVo6Z9TUTW dMpb51O8wuq0itdwpqkmnW3anMt9H6uOrXYK/+lPf5qPuQ6/9NJL02tf+9q8ypLCfazy+x17nbff tvP3498vfb8wlevjcHw/UUaT1zVdXef6fHU6168+vmZZTosPAQhAAAIQgAAEBk2gbqc0266umwQZ 9XLXYg1KX+dxmvngu/2luqiuTz31VOd5w/WbD/XvbUW7Zvh7jIA0Fn0kvnT8/HC6LR5WxpJ60Lyw cWv61Pe/k666e1UaHYoBTpFQJ5jS4yDwYiKg81bDjeTL1RdwXfTr/eYF0nH2fdzKp0mD5WxX21rS 2c7hXr2oaUPplKZfuG30821Xccpb7zfTS0DRg35dhuYtefbZZ3vy9quH5s1R91CXIxtaOrwphDTL 3JP7TUFCx/Hoo4/2cNUQrpe//OW5Wq67uZmL/bruTduOq3nbjuN2xped2pbyav6Yfffdt8eMbuQS Aes6Kp/3fUzqIaSPBEj5Dz/8cE5j4ahZVk8h7EAAAhCAAAQgAIEBEnA7Rf5UbTDNa7hhw4ZOO895 Bljt7YpW+0wfH4N8DWXywhnbZRhgAMOXBgjfRUtcCa2lI7K4ga/4NRu2ps9fc3ksz7om3bDqJ2ks estcfOrpcYLFUKZ2LxrbwYfAfCSg89kXaj3UPv744x0xQeF6UP/TP/3TvnOuOG/t62L6F3/xFx2b svHAAw/kCYDVG8Wu7ung35QnEfbDsdPal2gje07v8Kl8pWum9YO5wn3czq85VHwjUJzqoTlUNJxH +aaq10033ZRt1fYkytT7LkN+v7Lr+D2xra6sHnLlekrkaM6D42Nu+s6juppps947y7+Zv95vMlP5 mhRO55adenip98+5557roOwrrfLrGHSO/fM//3MnXnEXXnhhWr58+Q6/404GNiAAAQhAAAIQgMA8 IKD2V90ec5U0/F4vFh3fL43TDtJ3vVxPtdXk9EJ0yZIlaUcLbuzpetNTZk8T71Ne7iUzrJNkKCSX rtLyQox9+9y1l6X1oUJqtpmJifF04913pMtX3dXHCkEQmJ8E9KBqpyWs5XSR9IXy5JNPTproVRdH 9W7RR9vel69JYRUu/9BDD+1M7OuLqy62WmrZ+ypD6ZpOPU7U3bJO5zQaa/rVr361b5zTNH3Vx7bs SzSS8/HZV9jrX//67dJLlHn66aenFGQkCtx9993K3smrcvWg7zLrOG3XZWp/Lp3q0K881bE5vEpD sPSp0/sY5H/ve9/Ly3zX8XXd63Clnwn/Ov9U27Jb21Y62X/d616XfddR4VdfffV2qws4Xv4NN9yg ZB2nc/PEE0/sNFy0j4MABCAAAQhAAALzmYDaNM22keqrdrTarVPFz8djah6H6q5j0LHI1c8qg6o/ rcNBka/K1Ymh1ZXkRlrlK1mzcVP6/NVXpXXr14UgEyeMVl6KdEORbOVdP4mhTHf0/aFUZtmEwMAJ 6NzO53fURBdEizJ1xc4666wcV18wtV1/6vQKP/vss3OQ88jXECbvK9I9ZVy+wtSL4Vvf+lZnThuF 6YKsYTZf/OIX05NPPqmg7GpbDmv66pmjiWtVhtOrd8gjjzzSSVqXr54XmuC2dhKD/vZv/zYv7V2H a1tDX1Qv3zRsS2KB1H2V6TCXb79pa672XYem2CBBRj2Daqe0X/rSl6LnX+/cLNrXstlXXnllTu5j 0o7yaAywXB2u/ZnwV7rpXNOu0qvck046Kb3sZS/rfLcK19LmX/jCF1I9SbPyqxeN6r9y5Uoly042 JBxpdTBty9nPO/yBAAQgAAEIQAAC85DAVO0VtYM8pH4eVrtvldROax6P2tY6Frm6HVhv9zU2R4EM X5ojsDarXjBa5lpOS1v3mweme5JovpgYshSCzOeuuSKt3VDeuA+FUKNeMnHGhBWtwNSdW0J2cRCY rwS653bKvT2aD+Pq/bJixYpc/X4XTB+X7NQXydNPPz1985vfzA/CDpcYcv/99+cHaeVbtmxZOvXU Uzu9TBSmtBoKpJ4nEkj0sK9Jyix6KI2d7Xq/n680EgY8JElpVFeJLJrdXUOz9PngBz/YuRm89a1v zXONaG4Sp5cw87nPfS7Xefny5flmJ6FIQ4DqY9f2gQcemHtw5Mzt8rwtX3Wq89RxM9meyXH3s9Pv LYP4P/bYY53ksq3eSn/5l3+Z+aiHlL43pfHkz0qs+tspjzhoYuPa+Rhnwv8DH/hAzrorx6bv69Of /nSnaNnQELw/+7M/y72xjjvuuFw/zeiv89v1Ugal/bVf+7V8DmjbcfXxdQyzAQEIQAACEIAABOYx AbXH6oUnZruqfiawXbebmqu2On6mvu3U6dUu07GoXa15BO0G1Uajp4y/gTnyJcLoS88NcmkqPU74 e78CCTKfvfrKLMhIjBlSHg3/UINes/5GV5kLTz0nvfnUM3sssQOB+UhA572dJvhtOj20S7SQqy+C dT7F+TekbbmlS5cmDXvKv6vqAf6WW24pCdp/f+VXfqVnCI3LUC+H++67L4sBtSDj4TZO12MsdhTe rJt7+tRplU6iioYeacxtbU9i0W/8xm90JpGt7emhXkt8SzTS5GlydbyEid/8zd/sMKvj6vKnCq/T 9NtWPeu61ml2xaZWWVq+fHnHjG3rpi7+Oick0tSCjBM7rfY9JMxxtT8df88jpDwSjnb2OCS6aMn1 ei4c25AYp2NQY8GCo+NUno7/zDPLtdrHY1/xOAhAAAIQgAAEIDDfCajtoo96ltTtnN2pt+00/dqm 4+qw2d52b5nZtruz9noVgZ3NTfoZEIj+Me2XvnUvGZ1kk63oGRMfx6/dtCV9/gdXxsPY2hBjonfM 5ES8MQ8/nms1bGl4eCKdf8oZ6S2nnTaDckkCgcET8AOoHsLvvffezoXcF1mvxNOsqfPV4QpzPoV7 CFMdJjFDvU7kFK4hTLUwY7uK07b3lV5pP/axj3V6NSisdsrjfA5X/osuuij3mFCcXW23Xw8SvQn4 gz/4g87cOM4nX8OA9LE9+6fF7/6P/uiP0jHHHJOTN+vidIqsy8+Jp/njvPb7Jd9Zm7IhIUMC1NFH H91jcqpyLrjggiSRRa5Oox5Q/dxM+Nf1ls163zYdXvuKU1qFnX/++ekTn/hEfpvicPmKq/fzTvxR D7BLLrkkfxwm3+nrMLYhAAEIQAACEIDAfCag9ova1x5OPht1dXvMfr/28myUM50NHZOeUwbdRkOU me6b2u14CS8yEkOOJspkQjY5FD1f8iS/EZ/nkPnBFWnNprVZhJEgIychRk7CzAUrzklvPf2MeFAo DwKlG02O5g8E5jUB9SZQbwhfeOVrJR7NtTGdqy+S9QVbwoYefut4lXH77bdnky7rvPPOS3/4h3+Y li9fnsUORTpO25qb5RWveEX6/d///XTsscfmXjgKb7o6j+NUtoSHj3/843mpZ4kpSqdw18u9b5zH vrpLfuQjH0lvf/vb0+GHH97Jo/z+KK2GWb3nPe9J73//+3PdbLtZH5erPC5b2zNxTVszydNM08+G wnScv/u7v5suvfTSPDzL+Vxf1VW9UT784Q+nd77znZ3hZ06n+HvuuafnmFyW4nbEX+nquW6cz7bt uy7uSePzTPadR8LSJz/5yaTzSb2daud06v6qOYP+5E/+pGeImdPKlu05DB8CEIAABCAAAQjMRwJq 39i55/dst2PchpJfl+dy59pXm2/16tVzXcy09lsxiWR38P60yUmwKwTyEKag3GqNRIO8K8xMxuS9 rcnhWF1pU/rMNVemdRvXxIwxw5EmhJiQyzT3r4YstWK97NeuOCu9MYZ6TKTRmAx4LGap0dwyOAjM fwK+2DZr6nD7zXjv6+LvNBY9HCffcc1tp3G8fA0J0jJ4GtKiB2tNRCtxaLacxqZqSIvmSdGwLAkS KsNDtOpyfFwK07ZudvpoGIzqqvppBamDDjqoZ9hNna+2pzwWFfqlMYc6j7d3FOc0U/n9yqrTNm1r 6Ji6ioqR2Et0EqcdOduwP1XaneFf22jabe7XabWtY9by7joWfV8aVqYlyuUrzm4qO9Mxc358CEAA AhCAAAQgMGgCGur/0EMPzfkEv805ZXzcuzunjO3089VWkzvhhBM6i3f0SzfXYYgyc024sq+GePOh 0nPIrNsYQ5ZCoJkIocZDl5z1NSvOjCFL7S79edHsMgdHyDZOgg+BFwWB6R5G+/1GfGC6aFp0UFi/ B95mfqdx3ubvb7r6uOxd8V32rubd0bE2bTf3d7bMueRg2/3qWIc53UzrXuftl8fx9vulqcOUrmZe x023PZO6O43KkdM+DgIQgAAEIAABCMx3AnqZqRdqbsvMVn2b9jTXZB3mbU1PMJvOdmub6rXulVvr 8D21zepLe4p0dH0Ziolhuo3+oRiytCGvsqQ5ZOIJsyPIRKIs3mgI04WnntWZ1Df3rEmLozXf7W2z x6pPQRCYBQJ+IO1nyhfI2q/TdX87JVTpmq75AO408puCjPI26+Oym3Znul/n17b3XS/7TXtKV9ev 336dpx+LqWzX+ababnKYKt2uhNfH1cxfH4frMNPjEKOmM2+Fe7tfuma+On2/uOnCVOep6u1w+S5n OnvEQwACEIAABCAAgUESULvF7bR+ixnsTt2abSPb6ie+uD3nNLPhu00mW66LjnGQogxzyszGNzuN jfxla1Lf9oOX5pFZHUOWOste5yWWipHJ6Amj+WMkyGjIUr3K0lAqw588D800xRINgRcFAV8Y/fCu 34kfpB2nA6m3pzqwfml8Mbc/lS3ldX77dTn9wur42q7TyvfxeLuZx/ma9dP+VM72HT+V7WY6p99d f2fs+rjq43F++6pPve36NcPq/Xq7md5x/cp02t3xbb+2UZflcKXrF+54fAhAAAIQgAAEIDAfCaj9 4naMF9GYzTZNv7ZUPw4zTdcv70zCJDzJ6Rhn8/hmUnadZgGKMjERZ35hGRPvzoLzykn1l+h5eGU+ CygRUKd7ftPG9IVrv5OXvS5ViK+h/QDWmiidl9RD5k2n9S577TI8R80sVB8TEBg4gc553b741xdf x820kv3S+4YiG463X9utw+ptp+kX5rimX6f18dRhzfTedxr7Dp/Onyr9VOHT2ZsufmftNtM391We w+zXYa7PjuKcpl++qcLqPDuzXddjR/lmmm5HNoiDAAQgAAEIQAACgyKglYncnnGbdnfrInu2ubu2 djW/y9cx+VlBc08Oyi0IUUaCSH0SFYFEE+Xu/uFnAWa8DD2w8GJf9idjaevJya4AtDpO7C/EpL5r N6zL33nuJCOFTm9UY1JfrX194ann9PSQGdTJQbkQgAAEIAABCEAAAhCAAAQgsDAJeBlsixizTaF+ Rp9t2zuyZyFGaXxsW7Zs2VGWOY3bfVViTqs3O8YlnAh2EUtKF6UCfzYmyo3VkUaGYsrdUPyGm13V ZX+iIwgVQea7HUFGRzc+HnmjfqHF5OWvzz/ljJjU97TZOXCsQAACEIAABCAAAQhAAAIQgAAEdoGA RZm5Ek8siDR9VdVhu1DtGWVpHtPWrVtnlG8uEi2YiX4lyOReLaIYPVtaIaDMjtNcMdHRJeaCCV0m JuvUvC8egyeRpvSSeWHThvT5q78XS/JqUt9SsoSYNDyRl76WMHPhinOyIDPpiqobjdbFxkEAAhCA AAQgAAEIQAACEIAABPYgAS2HvSecBRL7KtPzTe6J8lXGIHvKLAhRRl9u9GPpjBdLsybIdE+RyUmt rjSaxia3pZEQVVReSmMh/oykFzZoyNL308YtG6JXjIZNtZe9Vv+a6CnTGiqT+r5xxSlpLIYwjbTG InekQ5DpAmYLAhCAAAQgAAEIQAACEIAABPYYgT0lyuiAVqxY0XNc7uiwatWqnvC52tmTx9o8hr1e lMk9ZLJAooFEIcy0CWShRl1cZskVe2MhpYQg0y6k1RpJz6/fUOaQWV+WvXZxWl1JToLMa1ac2ZnU dySEnMk02k42G8Or2qbwIAABCEAAAhCAAAQgAAEIQAACMyQwPt6dG3WGWXY5mXvJeNiS93fZ4DQZ m3qAy50m25xE7/VzymSBpL3kdHcC3vYcM9GDZjZcOWE0SW+x5/3nYwbnzqS+7bLykKUo1L5WWXrL aWflaky24qRvLY7tMhfNbNQNGxCAAAQgAAEIQAACEIAABCAAgZkSsCDiJaNnmm8m6WxbaS2EyPdn JjZmI43Lli3VaU8KUM367/WiTD7gPAwohglFzxW559ZvSp+99sq0esPuz7DcFXpCSGkPN9IXvHrD po4gkwWYdq+cPKlvrMiU55AJQebNp3aXvY6BS3EyxpCn6MDj3ja5wvyBAAQgAAEIQAACEIAABCAA AQjMMQEJFE3BYjaL7Ge7Fmpms6yZ2qrrNNM8s5luQYgyRTiRaDKWnlu7PsSSK9Ljz/w8feHa7+T5 XnYEtCu6lFT5JG10sGl+iXmVpbDtZa9jsplOEUOTw6HdTMSy172CjBLYjgSZZrkdA2xAAAIQgAAE IAABCEAAAhCAAATmmMDw8HDnGXWOixqYeT+D61gH5bpqwaBqsAfKlcgxmYbSs+vWpM9d9920ftO6 XOqamOfl89FjRhPxTuliSJIEEokx8vWlWTCpBRqrexJkPn/1FR1BJo9omghBSIpjTOKrcUsXnnpO Tw+ZKcsmAgIQgAAEIAABCEAAAhCAAAQgsIcIWKRQcfl5tz3iYw8Vv8eL8XO8/T1egShwrxdlBFef Z9e+kD57w7Vp88YQZHRitU+utVmY+W5avXF9X/75pAxlRZMES1OpXT3GTtu5h8w1303rNhTRR2nH Y3WlPGQpihyO5a/PP+WMvOx1bYdtCEAAAhCAAAQgAAEIQAACEIDAfCGg5+CRkZH8LD1f6jSX9dCx Dso1ZIZBVWPuytXJpM/dTz+Ztqx/IYsr6rWSPyo2tteuWx29W76XXti0KacttemiUf7cW6bdY0b7 0rNaeXnrknrN5s1h46q0fv2ajm3NJSMhRk7CzAUrzklvPf2MKCN25NoTA5cd/kIAAhCAAAQgAAEI QAACEIAABAZPQB0bFi/WIjR7n3OvGPs6wkWLFg3sQLvKw8CqMNcF6xCH0utOOiW95vRzYnqX4dBC eg+7NbwobdgUQ5lCVFm7aXMWS1ppW66Yv6gszMSJqR4zIcdEnMSW+ISwoh4yn/vBlWFjfZpszx+j MiTEqKeM3GtXnJXetOKUNBbdbWJu5xzmiYHLDn8hAAEIQAACEIAABCAAAQhAAALzg8Do6Oj8qMgs 16J0sihTk8i0nvkRZWYZcm2uFV1cWjGxrtybVqyI3ipn5Il26zSTE9vSxMRw7uXy2WuvSC+s2xDi Sumq5S9MX5SGKElScUcX2Vi9rvSQWbdxbbY7OVkEF03mK9camkivWXFmetNpZ8aXPZJGWmMh6+jk 7hWGcmL+QAACEIAABCAAAQhAAAIQgAAE5gGBpUuXzoNa7JkqDPJY93plwD1cirgyHPO5nJVee9o5 vd9sCC5y6tmyYd26PPnvc+ui10seplSUM8W3hkazMKNtuTyp7zWXJwkydkNtxSb64+QgrbKkMuUm WyHYtNQFrN3LJofyBwIQgAAEIAABCEAAAhCAAAQgMHgCfn5WTfbZZ5/ci0TbfjbW9t7gPCLGx6Jj HZTb60UZgdWQI0PXyfTmU07PS1L3QJdgIhfDj7SU9d9fe1UWXbzikqImJ8Y7dsoqS1fFpL4bYkGl WD6rLeB4+evxKLW57PVQGolkY2UVp6IDySwOAhCAAAQgAAEIQAACEIAABCAwcAJ6brYAo233IPHz 9MArOIsV8DHpGL09i+ZnbGpBiDJewtpU1JnlzaeemS487dQcVM8xMxHCi5yEGc0x8/ym7nLZ+qJk qwgyV+Q5ZJLEHM3oa6fuNuGagozCfHKr/GadFI+DwN5MYEcXOv82dPzbtm1La9euTZti4u2ZOuff URkztTVVupnanmm6ZjkzzTfTdE37e3rf34nKHRsby9/pxph/qw6fqk4zSTNV3jq8H6up6jJbZU5X fh2vuqxfvz7NlIuPx35ta2e36+OdislUNuu8U6UhHAIQgAAEIACBFy+Buq2xbNmygRzIXLc3ZN9l DOoYDXZw6z65BgP037zi3FBKRtMNq+7s1iKEl6H4gibC17AkCTMfvujN/z97Zxor2VHe72PGG2Ab 22OPd3vG9niZwQteiFhD2NfEJCQSBCUoShQpibJ9y4dE+RDlQ0QWFEVEgr8wCSRBgoQlCWJLAgRi vILB69h43/GGjTe8/Ps59q9575nTfftufXumn5J6qk7VW2+99ZyeunXerqrTHNQuZ+K11w83H/7q YIXMc6/Qbl+gNDhrZuBaG6ykGfi4NjzTvGrwlqU3bHvxT3SaksAcE2BQr4NeF8Xjjz/e3HzzzcOH Ux4QU+d5g5VrLCV84Qtf2GzcuLE59NBDu9Xba+RTp1dghZnRTUzgfKlRbWZwX0qTa61/KbYsV5Z+ hw86Hnjggfa+/miwmhBHWwIy/Bpx0EEHNccdd1zTd4Bc1ZN6S43rfbj//vubm266qXX0PfHEEwtU 8f0aZ8sC4SVeVBtSFVv4vuOIwZb0FVlsOfDAA5vNmzf3com+xNE5SUydtIX8et+fSWxWRgISkIAE JCCB9SFQ5xovetGLmnvuuWfowFgNi5iTZG6SuKu3zlu6Zat5TTv0cT3DhvPOO+9P19OAqbSdlSnP Pk8taPKEQw9pHhvciFvuuXOQ/6zA4I3s7VIWFsA8/uTjzRW33dZsO+rY5rEfP9586KtfaR5+5KGh jqdxxAwEkX3ewCHz8lNOH7z2GodMT2PDWiYkIAEe1Hk4veqqq9pVFDhncHYQMghzjRwPsPwxePDB B5sDDjhg+MAauUqTvFGDe5WbNF3/KKVObXelba21/ti81nGYsMLpmmuuaW688caGe4qTDedaDVmZ cccdd7Rl+++///CeV7mVpLGn2oID5KmnntumOlCc+8b366HBWWLYsmHDhmYtbKEf1Ra4xBbsbA+R HzCCS2yBWdeW2Jx4KXxm7f4sxXZlJSABCUhAAhJYPwLMj5iL1x/ZVtsa5jajfnz9wQ9+sKrN0Vad mzLf4ge69Qzz4ZSB8HM+knbb0CCdeOBKaU7atGnwAuw9m5tbx8wgZ+BhYUNS3rL05BOPN1cOHDOX 3HRD88iPHhwc+LthUI4jZnCc7wZOrHlW9pXbXtI6ZJ5JRZbRUGiQgAQWPHQzqF922WXNvffeO9br ngfJ4HvssccWPDyPejjt1kv95cRdXbcNxoK77767YcXDfffd1xxyyCGtWmxJ6NZJfl/clV1t/X1t rlVe7iuOBULuD/G+++47vNdhhTMCjlyv9h9DbLn00kvbFVjo5wNr4n324cD1Z+1LPrbwfSSwWqV7 X9qCZfyDfpwtfN/7uPD6RSYGtJ9QuVRbYlPiyE8az9L9mdRm5SQgAQlIQAISWF8CzGWYr/Dj6GqH zM2INw2eyfvCajtlaCvtMgc7/PDDhz/49rU/jby52r7E66yffu4wl/hNgPzjwWqXN2w7deCoebr5 2lXfaZ4arLQfvL2aGTs/2bdvZXrw0R8+t61pUPD0k+29eXpwnswzTw20Dl57/epTz2hed+opzZMD Xc++9npw+O/TP3lIayv4jwTmmAADeh6Ar7jiinblQK4ZGI844ojWwcHDOx8eZPHKs/3l1ltvbXDI RMf111/friLggZW8aQYcMpx5k3DCCSe0Azt9WI2w1vpXw8ZROq677rp2dQzl3BecH2xR4o8sv7IQ uKc33HDD0AFC3i233NIcfPDBy146mj+s6Mp3aseOHe32IPIoZ5vUli1b2u8YaeS6tiDH6i1sWa3v Fn/sKxfsgcvmzZuHtrBqhu935YJ9sWW1ltRWO6Z5f+izQQISkIAEJCCBXZMA8yO2WLP9PPPx1epJ 5m3oIz2NkHaYo/HMwTEJyZtG+31tLFxT3iexG+U9u6ZlMEHv3O+9WNCyx4bm9dtPb1556unNhr0G neZLMfgCEtia1IY9BgXP4LEZ5PMZrJTBIUMd6u4x8OQ865BBwVyhfQ6QkQR2JlAfmEnz4BlPO9c8 oJ577rnN1q1b2wfhnH7OgzMPo0ceeWRz1llnNcccc8wC5Wx76p4PUgfUml5QcRUvaIM+9IVR+X2y o/LWWv+odpeTz4qXu+66q62K3fyicvbZZ7f3D4cMPPjwh+/Fgy2eOGsI5CHP/UzgepIQxpUTeax4 YbtbyvkunXPOOa3jb889n/0tgjJs2b59+9CWtIktk9qQOqNift3B0ZaALXyfcULGFvgw2QmX2vaV V1457Ed0LCdej/uzHDutIwEJSEACEpDA+hPIHApLMi/hR7akV8PCrq60SVzTq9FW1RH9rEw+7LDD VrVPtZ2lpOdqpUzA1FUy5D01WCEzuPVt8ZtefGb7Jfj6ld+JeLtSBgfM4B0igw8Ol6daRw0rZepb lp4ZXA8eMQff3GdX0gwVmJDAHBNgwM3ACoY8uCfv1FNPHb5qL9s4UhZsPLxuGaxyYNUMW4bQmQOC WamSUOvVdMpXK0Y3NmBv7V83vdz21lr/cu0aVY9+c19iN/Hxxx/fOmaow3U34JTBYcE9pZz7ybkr OCcmDbSbEPbEWcmU8nG20Ha1BX2xBQfhSgMH6hJiH9/jbJ+ibT4pQy628FYmAo5HVvRUW6p8K7TI P8ivx/1ZxCyLJSABCUhAAhKYUQLMHRKYqxCYi/CDaX5cTflS4+7cJ/X5Iaobljrn6dYfdY1eVkXX +dUo2Wnk7/bLORZ8oX7y3foJ26cWPjCy5ah9Xfa2M559m1IkBw6X9m3Xg5hAujpkyBtsXBpMrgdv jhm003X8UG6QwDwTYADmAZMHXgL/N/O2Ga4px2OdgT95xATkTzrppDZ+NufZN8gkvVZxHUPSRvIS J7/a3i2LTDfuk0te4tRZjv7UXcsYu3AiYG9sHHVYW+xAjl9ciNNPHDRJR24pcerGKZO6sSW2JZ+Y PD6RiY44RarsctLRk7a7+6XTXnQjFy7Jg0sN0VXzxqWRn4X7M85GyyQgAQlIQAISmC0CzFHqnCNz lNWwsuodp29SuXE6+spYpdydk/XJTStvt18pU29kr6Nkw2BCXpwokcEx0+zx4+brV+Cxw5vDq7Kf dcZwc7oOGfIyuUZHd4sU5QYJzDMB/n/gWc//E/5v7rfffsPrvoE/siljSwyfbFviYZXzOHJeSR/f 1GW1AQ/r1GHlTbZHVRtqfeyjLqs3ON8mq3jy1pzIdh+Y2RJD3Tr2RLYvXi396SdtYCMrNNAdJxir M7CtHhzbZ89S8sKIOnBIn/nVAV6LBezB7tiO4wDnCNdLDdFBvXpPsIXvR1dnbE8+3wNC+oCOOGra gmX+02fLYqrgUgNccqB0zV8snT4it973ZzFbLZeABCQgAQlIYLYI1HlELGMOzdECt99+e7KG87hh xiKJzL0WEVvTYg73zTbyNW1oQuW7vVNmQg69Ym849ezBapk9m/+96vK2/OmGLUxPNS8brKJpnTa9 tcyUgARGEWDwY4DPIB/nSp98BmxkE0jzcMpDKmmcDzgd8nAfOWLqI8MhsnxwrHQD5azWYQtV90GY +nxYSlkfrLs6LrnkkgVZL33pSydeCrka+tGRQPqmm25q+0u6lkWGe3D00UcvOEcFOVgsNaSNWpd0 fZMQOsnrsyXtZRsY1+PkIt8XVxtqObakf4kp77az2HXVOWm6q7PaspiOMOvqWKxeLacun8qG9Hrc n2qXaQlIQAISkIAEdl0CbGFi/p23VjK3yLxlFnvVtW3jxo3NAQccMFM265QZfHOysiWrZOqX6Y3b X9w8PXgF9gWcMTPYuvTyU85o3rz9tIGz5tl6Vda0BCQwnsD+++/fCvBQyIM4rwjmNb2sWkmoA2dN U84DJgcCJz9xHlxzjSwOHw5szb7X7sNp9OFw4dXJJ5988k6HfaGvhqq/L5/y7gNvleumV0N/dPDH EQdSd+sObdL3OD5wTt14440tF5xRsE/ZqP517a7XaR/nVlZCYQsOM3TTdu5PrUealTyElC/lPJm2 4oh/WB3D94oQW+IQJK/2M2neJlDDauwxRne1he8kXPp+mYkd2ACXMCGfNwMsN1CfMEv3Z7l9sZ4E JCABCUhAArNBgNXEzJ34oXTWQ+ZU2MmPsKuxEnq1+7z4+vLVbnFG9cUhk21HiXkr09sHW5lecepp g89Lmje/+LTmqcFrr5+VF9+M3k7NmlECPKTnwRvnBQ4CHAkMlnl4jFOD65qmS5HJ4NotJ58PfyAu vvjiBQ4K2j7ooIOao446qo25TuBBGQcOq0wIaYc021r4RYBtP3jVaz3K0Ul+yvseuJEbFVZDP2/W YcVO1yGDQ4D9sizRrHbTPw5+veiii4aOFOwL1256lO1VDkaVG28cyv1BrpalnRz6nHIYLiVUnaSj N3pyXd9+hH7yIx8ZbIk+Yl6LvRqB70cCPLAl7SefmLJqC3nYwYdfdGqInTVvVDo61+P+jLLJfAlI QAISkIAEdm0C/KDHNiacHHVeknnHLPSuO9/iGYTngNhbbe3KTtt+V8oU4s8bnBvz9HPemJ84aZ5q fjz4ofEN27a3kj8eOGQ27ME2CLYyDZbLGCQggYkJMODxJpzvfe97wzo4FHCgbBm8lYatSQzyBGSz goMH1gygKeO6r5z8HTt2tCsSMtjimGCFTddhcuuttzbXX3/9UDfbnHhVcXVgnHLKKW15BmtszSoM bDnttNOGdsTGtEv5YmGl+mnruuuuW2ATjh5er5wVFvCDFauCsh2La5xi1OUVzV3bc72Y/chhA1ui 4Jm+8+pznAmcZUMeH2TzYbUOzrPk4zjivKDlBvTk+xBb8r2ptkR/lccZBxvyCCu1JW0Q88ef71W1 BUdNdyVObI8t1KUOEx6+j+FEfuwkvViYlfuzmJ2WS0ACEpCABCSw6xBgLsL8hHkO87+s8mXeMSsh cytsYk7MnIpnAWzPXCr2Zr60XrZvOO+88/50vRqftXZzMkPrl3nu+7THM3lA5GFi4JDB6EFskIAE lkeAh1EGvrwqmAETJ8c999zT4KDBUcCDfB5EaSUDZlocd33HHXcsOHyMPxa8tanvMGBWuNAWe2LR mS03rCqogYGbcmJWOrAlJoFXGKecvK5tkRsXp/5y9N92222tTdHPAz+Ooq6DA930FQcVK2pYckoe 7JHN1jLux1IDfYYvv0DAh2scChwCxx8/7iVtwJctazjNuE8EZPmVha1Uy2m72hqOsYXvFCG2kD/O FmRjS9/3hfKlBvTwnef13wRsoe/hgj1w4Z7gILvzzjuHEwWca+FSv1c1PYk9yIfJet6fSWxVRgIS kIAEJCCBXYcA8wvmkMwr64+Ws9CDzAuZn/KDHXNR8gjMjfhEZr3tdaVMzx3IKhmKko6nrb3mNdp7 DrYwPXdTe1SYJQEJjCDAAIgjA+cLDoX6/4gzSXg4ZfUKjhEcCIcddlj7sJ7/g1VtBtPkcWYHqyIS cEJsGazAQW5UYGUMdrBSAjm8/Thy6kN56hPzAN0N1bban67cqOvl6uePHysrqE+7POhv27atjWkr +dFfZS644IKhOTcOVq3AmT4vx37q0AZ7dDmbB+cCzgc+pGMLcVc/jgecSF3eXblWSeef9C/Z6SfX 2IIzrtry/e9/v/1ucb+wrRtiS35F6ZYv5xqb+B7zvaF9vvfhQhmfxWzptjsJm1pnve5PtcG0BCQg AQlIQAK7F4HMR5jDHXPMMQ1bwfnRNfnr3VvmWGxpZwU06RoyN+rmV5lpppf+k+g0rZtCW/VLk3Nk us0iE7k2HrxG+5mBd2ZWbmLXXq8lMKsE6v+ZE044od02w2oVAv+3Uk6Mg4YVFd/4xjfaLTdZ9VD7 Vv9vks9qhOqlxys+iaMBx0wC9XEMxZbkLyWm7krqL9ZW9LPigof8jE84VnAoJCQ/14n5pQBHQQJ9 7p7vkrJJ4tpXWLIdCsdHDTgeqj3UwV5ksSc6iKtc1dFNV2dG6leZri3R27WFOtWWqmOl6bSJLS95 yUt6udQ2Khecin2hr699csmr8l0mkekyqXYs9/5Et7EEJCABCUhAArsXAeYJdX5BGucH84xZCMz/ +ZEVe2Inc7LYnTxsren1sv0ns/f1smCd2603IatiuiZVmZ+kecDoSnotAQmMI5AH1MiwMoEHVRwu bKtgGxEykcv/N5wtlLE8kpUYLEOsA2vSbH9Kmro5ZDV6aJd09Fc7kibO1p6al3TX2UB+V1/3OnUn iZei/5FHHmlVpj3++EwacFhVR0x0UT/6JtGFLEzDlXvFipDqMEFPvQdcUy/t46BjG0/y28QE/1Sd sTl2UB1bslKmqw65KostsN8yWFkVW1Infcz1cuI+LrG56guXUbYg21ev6qjp2J6+9tmBPOU1xA7y lnt/qj7TEpCABCQgAQnsPgRGzUVY6c5WcOb1eQPqcnqdecukdat8VtvXHyrRM8rmUfmTtr0acnPv lFkNiOqQgAQmI5AHv+7gx1YTPmw/4qExA3nkErOChYN22f507LHHDhuNXsoT8JDzYFvPf0lZN0aW kAF9kjpdHdO+hkleKY3d9LV7eOw4m/iDWQPbt5YTwh57WLlz7bXXDtVQxoocVkPhSGNFDu3ghMuB cDhDOPD3jDPOaJ0h6InOoaJlJDjPBodMvjvjbMnWNeznO1RtoemV2oNeVn3FFnSyMmccl64t1FlO iO2zdn+W0xfrSEACEpCABCQw+wRwhnCoLs4R5vX1h7+u9aPmfeTzYX5LPC4w10GGuSbzzlHz4cyJ xularzKdMutF3nYlMGcEMqAm7hsY2SbBIM4HxwgP73loBxd1qce5McTVMUN53brEtp4LL7ywlUub yIwLkWOlzCwG+hwbSdc/cqP+AI3qB3/k2B4TB1Ri5Gs7o+p381mldM0117R1KeMPI6uautvTcL7h VOMcm5tvvrlVg1Pk8ssvH257Sh+7bSx2HbtZVRWHDHmwqbZEjj/c1RbycRDFFq4TUifXk8ZwiUMG HdjC4b2sEquhawtllUu1pdabND0L92dSW5WTgAQkIAEJSGDXJ8APgMwH+SEO5wzzmm4Y5XRhLkgZ K68zB+ubC5HHnOrggw9u2+rq31WuF27631Ws1k4JSGCXIsCAycBa49qB7iDLQIzDgC02nDmyffv2 9mE2AzcxD/U8QKcuDhnq5ToP9onTXvc6+dRLXVbszGKotmNj+oytvOqv9qHaX+sln7y8Mps8/mDm EGPKwiLyi8U4QXKPqcuBwzhkYlP0RfeWwTYhVouknHtZ3zy0WHspj16u088c9pyy2IIMedla1bWF a/oQW5BPiO5cTxpzaHWtiy1MHtLvlGXSES7kI9Nny6RtV7n1uj/VBtMSkIAEJCABCcwHgczBiHHM 8CPY1q1b25UsOGtYpU5Z5jtdKnXOTxnXhMijgzNsTjzxxPZ5gTZGhdgyqnwW8nXKzMJd0AYJ7OYE GEB56ORDmk8N9Zp0HTwZhA855JDm3HPPHa66iB4eeEkTah2uM3iTrqErRxltRmeVnfU0fUx/Yn9l uZj9qYsc6cpsUj3UY2VKtiNRj5VO2R4Vu5DrtsEfUv4op61bbrll2J/FbE956uaaFSGsICI/ttRV KeRhByExaWzhLBnsJZ+3cNVyZJYa4FJ/Fepyoa0wT0wbTFqwJX2DC2E59lBnPe9Pa7j/SEACEpCA BCQwNwSYe2QOk05zzbYmVrSw0p25Dj++slKYMyNZSUw5n8x3mAsxT6SMH/pYbZ26vO2JsyORr4F2 atvd6yo7S+mFvZgly7RFAhLYrQhkgE1cO1cHbx5OM5gmRhYZVhl861vfassp654hw8DMtiUCAzyH CPcF6qbN2NO9rm336ViPvNhI22z14g9V+sv2o1pe7Us+cQ04DMKirrRZSt+RZTVHHAxcs4c4euNs SHliyrlfOG9yEByOHVYAdQ/arTaPStM3dPOdIE5fsaVehwV6sCEBW/iVJauPcOyQ7v6xj/wk8UMP PTTkgDy2JMS+2Eac7z73FVvy/YYLtlQu4Rt9o2LkZuH+jLLPfAlIQAISkIAEdi8CmV/VOVfSxJkD MVfP6uHUGUciOhaTqeWpU+NaPitpV8rMyp3QDgnspgQy8PJgeNVVV7Wvtya+7bbbhj3OQIwsD6cJ XKc+eTgiGLwjQ8wDK4EH2rp0kfZGhehMjFxsIE56VP31yq92ka4rQLpvjKqy2Fv7yjXOHB70kx92 3XrILhZwYKAnddEVveTxicOhyqGXP8iEyGfFTZu5hH9oAx2xJVVx+kQ3ebEx5TWuPMlH10oCfalt Z/VQ1Zny8EkZXCiLvfmepzz1cj0uDpPoWo/7M84+yyQgAQlIQAIS2P0IZN5Bz/rSyUtcCfTNc5Dr k631+tLMsQiJ+2TWO0+nzHrfAduXwG5MIA+VDKCkeatSPtUpEwSRyzVxBt/EnDUTvZTngFrKWd6Y UB02yeuL+wZ95Ebl9+lYjzzso7+xk/7WrTLJH2VblUWmsgvrUXW7+d3VJKlfbUhety6OIULK+YNZ 63XlF7vGluhCNg68Wq+rP9dZdRRZVqwkIBO55C0WY0ut09WfMuytNpOPbM2rtizWbrd8lu5P1zav JSABCUhAAhKYHwJ1btPtdeZF5I+SqzLd+lyPKx+ls0/PtPN0ykybuO1JYM4IMAAyQNZf57nml//u gbrjBtKUdZ0JdfUBbdQBF8cP1zWv4kfnqLJR+dRPGfVjF/k1zfVyw6T6WdkRWdrK2SNpt5YlLzZy ZkoNeUtSt09VZlS6u8Ikq5T62q86KK8rQHAe1PtZZZMepTP9wpb6S8gktkRnbOEaHXWVDXmRiy2L xax2qXW6K2+iM7ajjzT5sYVrbOG7vdwwzfuzXButJwEJSEACEpDA7k+gznm6va1zpm7ZpNd9Ovry JtU3LTmdMtMibTsSmEMCDIIZfHmw5HAvQgZH3ghTA/kpq/lJ81CbB1v0smqGLU0E6vE2n7qi4Pbb b28fbmND9CSuqyhw9vD2n8UCuvLQT5t5YxH542xfTG/Kl6Kf/qb/1OcV4nF0YUvXJvLoMwx5NWEC q2Q4TJmQPiSOzLg4W5Aiw2qobog9NR/HA+euJFTHXfLoQw3d65TF3q4t6Sf3LDKJqRu7YBJbaCOO jCqbtohH2VHz0VGv+7jku1TlYgt5fLKVqbbftWGUnch1mfTZEQ61jUnuT5U3LQEJSEACEpCABCSw dAI6ZZbOzBoSkMAyCPDQd8IJJyx4SMWJgGOmPlDmIbXbBNtcvve97y3IPvDAA1t9eXjlsFpeuUdA Jx/Or8mqg1TOA3DiBx54oPn2t7/dXHPNNc3VV189dLREvsa0Ue3lLBdCHDwpi+5ad5L0UvTjgNoy eLV0AjZcfvnlrWMmTojYgV2ksTccU3b88ccvuC/oS1l0j4tZUVIPoeUNSNXBRdvYE0boIo97E17k cT/HBRxgWSmVel07saVu1+HNQ3fccceCdmob1Mcu7n10Ei9mC9uLcJ50248O2qi2INflgkzkE6M3 XMjj03WqUI9AGUz67HhW4tl/p3V/apumJSABCUhAAhKQgAQmI7DhvPPO+9PJRJWSgAQksDwCPDzy UJpX2/FwmsAbZu666672wRiHRB6o87DLyg+25fDQnPNjqMvqju3bt7cP+9FPzBtuWB2Rs0qoj350 541FaZsHYFbT4IiJwwAHDq/cqytQYgv1eADGiZNAO/WVfFU2MovFtc5S9bMaA55hQ39xdsEn5+/g EKGv9913X3PFFVcMZbEL5wNOmRrCs+aNS2M/dmQFBvVxhtAm+bmncbjxtqXvfve7Lcu0hdzJJ588 vJ+RDRscKziT+C7QP+5RXRUV+2IL95yAfvrNfWKLVupEb2zJNifq4ASJLVwnpE5sufnmm0fakn6h q9oCl2oLOvPBFvqI4yn1caiceuqpQ5nYQowdcGQrGkxY7VSdY5FF/1rdn7RhLAEJSEACEpCABCSw PAJ7nH/++T95J+jydFhLAhKQwJII4AjZsWNHWycPujyEJuBQwEmCg6Hm50GVh/wzzzxzeP4IOlJG PbahXHnllTvVRw7nDB8ejPPwm3YpP+WUU5pNmzYlq42jnwucSJdeemmbj+OAdnkQJk3bPMxv3Lix LZ/0n5Xqx5GDs4X+xKa0jSMiqykqS8p5UOeBnwf/WoY99IV4KeGGG25ocFQk5J7g4GJrEsxxemFP +kzcvZ+pX+MLL7xwuBUNvZs3bx6uikIuNqf/sSXtRBeOKu4/DqNqS8qpf/bZZ489w2UxW6KLGFtv uummlkt4hC228F2vXFIXO3Ag1e95ytKnCy64oHWwcU1glRgf2gmH1CEOk+TFntW4P9FpLAEJSEAC EpCABCSwNAJ7Lk1caQlIQAIrJ3DkkUe2D71sXWKFQh4qoznbjcjPA2geIFnZwTaoOBLqw2ceRnFE nHPOOa3jJ6s30E05uqv+tMmD6bZt29qVNslLnLaJ0X344Ye3q0K4JvBQHTuzEiN1J4mXqz/1cHic ddZZzfXXX9+u/Kk8WX1Rr2MP94AVMtibfqQsenO9WJy+4yjhfrByA6dH2sW5xidyuWdcw3Pr1q1D B9u4trBrlG3d/D5bkMGOrCqi/dhIu9jCd2vSQ3XRR0i/qq624LmybKnj4GkcUuk/dsSW6Ek9Vthg C46z9C3tJY5srtN+7El5rvuYILNa9yftGUtAAhKQgAQkIAEJTE7A7UuTs1JSAhJYBoE8KHarsloB xwDOFQIPhqwgyANolechltUnrGLhATdbi6I7D5152KUuaba4oB8HAQ/DeXilPHV4AD/66KNb3aSj E5mEyKYMxxA6czAscuimTQ7fpW9LCcvVT73YFEb0gXNj4EkgvwYcDyeeeGJzzDHHDLfypDy6cj1p nHtGfdgcccQR7b3EDu4pgbLKn/uCMwbHA/czOhJ328Z5xCol9NGH6lDq2h0dXVv4DnQDdWMLXFi9 QoiOrjz5rOzps6VrR63LFje4UB+nIHFfiC1wiS3opd/deznKjq7e9AU9XSardX+6bXotAQlIQAIS kIAEJDAZAbcvTcZJKQlIYA0I8JCYh1NituFkJQMP4TkXJQ/tXRPysEl+1dWVSxm6caTwcJ5tLHnw 7dbpu46elLHKAZuJeUDGXh6qu3KRXyzu1luufvTgEIltPMzDEIcNW60oX8tQ70u25mBP7imcsCH9 TVxtqjqSTx73EKcX6b5APv1N/SpXbUEGHrGlTxd50dMtJx9b+P6MkunWqdejbEFm0vuDHE6V2FH1 j0tXe6sdK70/49q0TAISkIAEJCABCUign4BOmX4u5kpAAhKQgAQkIAEJSEACEpCABCQggTUlsHBd +5o2pXIJSEACEpCABCQgAQlIQAISkIAEJCCBENApExLGEpCABCQgAQlIQAISkIAEJCABCUhgigR0 ykwRtk1JQAISkIAEJCABCUhAAhKQgAQkIIEQ0CkTEsYSkIAEJCABCUhAAhKQgAQkIAEJSGCKBHTK TBG2TUlAAhKQgAQkIAEJSEACEpCABCQggRDQKRMSxhKQgAQkIAEJSEACEpCABCQgAQlIYIoEdMpM EbZNSUACEpCABCQgAQlIQAISkIAEJCCBENApExLGEpCABCQgAQlIQAISkIAEJCABCUhgigR0ykwR tk1JQAISkIAEJCABCUhAAhKQgAQkIIEQ0CkTEsYSkIAEJCABCUhAAhKQgAQkIAEJSGCKBHTKTBG2 TUlAAhKQgAQkIAEJSEACEpCABCQggRDQKRMSxhKQgAQkIAEJSEACEpCABCQgAQlIYIoEdMpMEbZN SUACEpCABCQgAQlIQAISkIAEJCCBENApExLGEpCABCQgAQlIQAISkIAEJCABCUhgigR0ykwRtk1J QAISkIAEJCABCUhAAhKQgAQkIIEQ0CkTEsYSkIAEJCABCUhAAhKQgAQkIAEJSGCKBHTKTBG2TUlA AhKQgAQkIAEJSEACEpCABCQggRDQKRMSxhKQgAQkIAEJSEACEpCABCQgAQlIYIoEdMpMEbZNSUAC EpCABCQgAQlIQAISkIAEJCCBENApExLGEpCABCQgAQlIQAISkIAEJCABCUhgigR0ykwRtk1JQAIS kIAEJCABCUhAAhKQgAQkIIEQ0CkTEsYSkIAEJCABCUhAAhKQgAQkIAEJSGCKBHTKTBG2TUlAAhKQ gAQkIAEJSEACEpCABCQggRDQKRMSxhKQgAQkIAEJSEACEpCABCQgAQlIYIoEdMpMEbZNSUACEpCA BCQgAQlIQAISkIAEJCCBENApExLGEpCABCQgAQlIQAISkIAEJCABCUhgigR0ykwRtk1JQAISkIAE JCABCUhAAhKQgAQkIIEQ0CkTEsYSkIAEJCABCUhAAhKQgAQkIAEJSGCKBHTKTBG2TUlAAhKQgAQk IAEJSEACEpCABCQggRDQKRMSxhKQgAQkIAEJSEACEpCABCQgAQlIYIoEdMpMEbZNSUACEpCABCQg AQlIQAISkIAEJCCBENApExLGEpCABCQgAQlIQAISkIAEJCABCUhgigR0ykwRtk1JQAISkIAEJCAB CUhAAhKQgHn1JIAAAEAASURBVAQkIIEQ0CkTEsYSkIAEJCABCUhAAhKQgAQkIAEJSGCKBHTKTBG2 TUlAAhKQgAQkIAEJSEACEpCABCQggRDQKRMSxhKQgAQkIAEJSEACEpCABCQgAQlIYIoEdMpMEbZN SUACEpCABCQgAQlIQAISkIAEJCCBENApExLGEpCABCQgAQlIQAISkIAEJCABCUhgigR0ykwRtk1J QAISkIAEJCABCUhAAhKQgAQkIIEQ0CkTEsYSkIAEJCABCUhAAhKQgAQkIAEJSGCKBHTKTBG2TUlA AhKQgAQkIAEJSEACEpCABCQggRDQKRMSxhKQgAQkIAEJSEACEpCABCQgAQlIYIoEdMpMEbZNSUAC EpCABCQgAQlIQAISkIAEJCCBENApExLGEpCABCQgAQlIQAISkIAEJCABCUhgigR0ykwRtk1JQAIS kIAEJCABCUhAAhKQgAQkIIEQ0CkTEsYSkIAEJCABCUhAAhKQgAQkIAEJSGCKBHTKTBG2TUlAAhKQ gAQkIAEJSEACEpCABCQggRDQKRMSxhKQgAQkIAEJSEACEpCABCQgAQlIYIoEdMpMEbZNSUACEpCA BCQgAQlIQAISkIAEJCCBENApExLGEpCABCQgAQlIQAISkIAEJCABCUhgigR0ykwRtk1JQAISkIAE JCABCUhAAhKQgAQkIIEQ0CkTEsYSkIAEJCABCUhAAhKQgAQkIAEJSGCKBHTKTBG2TUlAAhKQgAQk IAEJSEACEpCABCQggRDQKRMSxhKQgAQkIAEJSEACEpCABCQgAQlIYIoEdMpMEbZNSUACEpCABCQg AQlIQAISkIAEJCCBENApExLGEpCABCQgAQlIQAISkIAEJCABCUhgigR0ykwRtk1JQAISkIAEJCAB CUhAAhKQgAQkIIEQ0CkTEsYSkIAEJCABCUhAAhKQgAQkIAEJSGCKBHTKTBG2TUlAAhKQgAQkIAEJ SEACEpCABCQggRDQKRMSxhKQgAQkIAEJSEACEpCABCQgAQlIYIoEdMpMEbZNSUACEpCABCQgAQlI QAISkIAEJCCBENApExLGEpCABCQgAQlIQAISkIAEJCABCUhgigR0ykwRtk1JQAISkIAEJCABCUhA AhKQgAQkIIEQ0CkTEsYSkIAEJCABCUhAAhKQgAQkIAEJSGCKBHTKTBG2TUlAAhKQgAQkIAEJSEAC EpCABCQggRDQKRMSxhKQgAQkIAEJSEACEpCABCQgAQlIYIoEdMpMEbZNSUACEpCABCQgAQlIQAIS kIAEJCCBENApExLGEpCABCQgAQlIQAISkIAEJCABCUhgigR0ykwRtk1JQAISkIAEJCABCUhAAhKQ gAQkIIEQ0CkTEsYSkIAEJCABCUhAAhKQgAQkIAEJSGCKBHTKTBG2TUlAAhKQgAQkIAEJSEACEpCA BCQggRDQKRMSxhKQgAQkIAEJSEACEpCABCQgAQlIYIoEdMpMEbZNSUACEpCABCQgAQlIQAISkIAE JCCBENApExLGEpCABCQgAQlIQAISkIAEJCABCUhgigR0ykwRtk1JQAISkIAEJCABCUhAAhKQgAQk IIEQ0CkTEsYSkIAEJCABCUhAAhKQgAQkIAEJSGCKBHTKTBG2TUlAAhKQgAQkIAEJSEACEpCABCQg gRDQKRMSxhKQgAQkIAEJSEACEpCABCQgAQlIYIoEdMpMEbZNSUACEpCABCQgAQlIQAISkIAEJCCB ENApExLGEpCABCQgAQlIQAISkIAEJCABCUhgigR0ykwRtk1JQAISkIAEJCABCUhAAhKQgAQkIIEQ 0CkTEsYSkIAEJCABCUhAAhKQgAQkIAEJSGCKBHTKTBG2TUlAAhKQgAQkIAEJSEACEpCABCQggRDQ KRMSxhKQgAQkIAEJSEACEpCABCQgAQlIYIoEdMpMEbZNSUACEpCABCQgAQlIQAISkIAEJCCBENAp ExLGEpCABCQgAQlIQAISkIAEJCABCUhgigR0ykwRtk1JQAISkIAEJCABCUhAAhKQgAQkIIEQ0CkT EsYSkIAEJCABCUhAAhKQgAQkIAEJSGCKBHTKTBG2TUlAAhKQgAQkIAEJSEACEpCABCQggRDQKRMS xhKQgAQkIAEJSEACEpCABCQgAQlIYIoEdMpMEbZNSUACEpCABCQgAQlIQAISkIAEJCCBENApExLG EpCABCQgAQlIQAISkIAEJCABCUhgigR0ykwRtk1JQAISkIAEJCABCUhAAhKQgAQkIIEQ0CkTEsYS kIAEJCABCUhAAhKQgAQkIAEJSGCKBHTKTBG2TUlAAhKQgAQkIAEJSEACEpCABCQggRDQKRMSxhKQ gAQkIAEJSEACEpCABCQgAQlIYIoEdMpMEbZNSUACEpCABCQgAQlIQAISkIAEJCCBENApExLGEpCA BCQgAQlIQAISkIAEJCABCUhgigR0ykwRtk1JQAISkIAEJCABCUhAAhKQgAQkIIEQ0CkTEsYSkIAE JCABCUhAAhKQgAQkIAEJSGCKBHTKTBG2TUlAAhKQgAQkIAEJSEACEpCABCQggRDQKRMSxhKQgAQk IAEJSEACEpCABCQgAQlIYIoEdMpMEbZNSUACEpCABCQgAQlIQAISkIAEJCCBENApExLGEpCABCQg AQlIQAISkIAEJCABCUhgigR0ykwRtk1JQAISkIAEJCABCUhAAhKQgAQkIIEQ0CkTEsYSkIAEJCAB CUhAAhKQgAQkIAEJSGCKBHTKTBG2TUlAAhKQgAQkIAEJSEACEpCABCQggRDQKRMSxhKQgAQkIAEJ SEACEpCABCQgAQlIYIoEdMpMEbZNSUACEpCABCQgAQlIQAISkIAEJCCBENApExLGEpCABCQgAQlI QAISkIAEJCABCUhgigR0ykwRtk1JQAISkIAEJCABCUhAAhKQgAQkIIEQ0CkTEsYSkMDUCDzzzDNj 29pjjz2G5YvJDgUHiVqv5tc0+qpcTVe5SdOj6i/F7knbWgu5UfbTVi2r6dW0Y7X0oqerq3s9id27 yn2bpC/KSEACEpCABCQgAQnMPgGdMrN/j7RQArsVgb6H524H64NxHqxr3ij5UTLRQT3SVa6mq1y3 je51ZGv9yJBHeWSSP4txtb9rb/qB3ZHrykzap9TvypOfdkbJpE63PLYQR09kiat8ZGp5N41MdHbL vJaABCQgAQlIQAISkMBaENhzLZSqUwISkEAlUB+I64NyZGp58oiRfd7zntc8/fTTbZy6xPXhOenE kYuO6Oy2k+voS71cp15f3JWtbWMz5ZGh/j333NN8+9vfHqraunVrs3nz5uH1eiQm6T/s07fIj7J1 XHl09NWlrLaDTJ+ucI2O8E2c/L4YmW79rtxieigf14+uPq8lIAEJSEACEpCABCSwGAGdMosRslwC ElgxgUkfdrty9WG9lpHP57HHHmvuvffe1r5DDz202XvvvXeytT5EVx0I5rrr+Kl1dlLYyYhsdSpE b0SRufvuu5svf/nLyWr23HPPZvM6O2Vi57j+p38YHvl0grKaV9ORqXFXvpbFhlEyo/Krjr506hGP c+49/vjj7XeJPmzatKnZa6+9dlKHjYTF+rlTRTMkIAEJSEACEpCABCQwgoBOmRFgzJaABNaGwGc/ +9nmmmuuaR9seVAmvPzlL29e8YpXLGgwD9P1Yf3hhx9uvv71rzc33nhjc9999zU//OEPWz15WD7w wAPbB+qjjz66edWrXtU8//nPb3XyEB19aTONcf3+97+/1dN92K51KOODM2Xjxo3NIYcc0rZFfOyx x7b5qZ96aaM6bJI3K/G4/lcb99lnn2a//fZrDjjggGbzwJl0yimntNdVJukuB9ogkP+Xf/mXO7Hm 3r/sZS8beY+o23WoXHbZZc1XvvKVVhflhC1btjTvete7nr147t/YQly/Sz/60Y+ar33tawu+S6mI vX3fpehCrnuPU9dYAhKQgAQkIAEJSEACSyGgU2YptJSVgARWTADHyg9+8IMFenhA7oY8APMwzooY nDH/+7//27CioYb6cHz//fc3fK6++urmggsuaN74xjc2P/VTPzXcthLnQK1PO9T58Y9/XLPbh/0+ eYTuuuuuVpa6yBx00EHNW9/61ub0008f5qeMjGpj0hs2bGhl1/ufpfQ/tl900UVtn44//vjmTW96 U3Pcccft1Mf0izo1PPDAA80TTzxRs5rPf/7zzfbt21uHT1c+gmk78aOPPtpuCUs58cEHH1wvh+nc i/pd4vvUtSNyYVK/S294wxsWOI6QMUhAAhKQgAQkIAEJSGClBDzod6UErS8BCYwlkIfsPEyPFS6F yPPBYfM3f/M37aqIrkMm4t0H5NT7t3/7t+Zv//ZvmwcffDCiO8XIEvp07CTcyUhdHt4//vGPNx/6 0IeaO++8s5VKWafKsJ0XvOAF3aJ1uY6dk/S/ypC+/vrrmw9+8INt33Gc1RC9NY80jpFuwDnCvUqd xLTRbZPrlHf1jLrOSqpHHnmk+eu//uv2u1QdMmmjTy91+Q5++tOfbj7wgQ80Dz300KhmzJeABCQg AQlIQAISkMCSCeiUWTIyK0hAAkshkAfeUQ/TKe/qJJ/VKx/96EcbVlckRD4P0Gyr2XfffVO8U3zb bbc1n/zkJ4f5qZ+MXEdf8pcaU/+6665rPvKRjzQ8/C8WsrVqMbm1Ll9p/6l/+eWXN3/3d3/XrjiK vaP0juJ81VVXtXqoX+tW+aRTnrZqHJmah/yTTz7ZfpfY8tYNqcM94fvEddogTvkdd9zRfOITn+hW 91oCEpCABCQgAQlIQALLJuD2pWWjs6IEJLAaBPLA26frM5/5THPzzTe3RXlQJj7hhBOa173udc2R Rx45PDeG1QzIfvGLX2xuv/32Bequvfba5n/+53+a17zmNcMH7AUCPRdvfvObGw4PTrus8GDLESss 2H7Fwb2cjZPVO3mIx4HEqo/3vve9rdbkp4k85PetlElbkV3POP2PDawGYhUQjgn63t3uRRkOqd/9 3d9tz9dJvW7/k98Xf+5zn2t4KxVOtrAgXkroa488vks33XTTTqr4Lr32ta9tjjrqqPa7RHushrnl lluG36XcM2K+S1/96lebn/7pn95JlxkSkIAEJCABCUhAAosTyNyqTzJzwL6y3TVPp8zuemftlwR2 cQKsbKivkGbwJnAg7HnnnbdT7174whc227Ztaw+g/dSnPtVw7kkCdb/0pS8155xzToPcJA/6nJfC WSmjAjrZFsUqnB07drQrK6KXlSMXX3xx217qpyzXWd1T/yilj5HpxlW2lo3KrzJLTdP/zZs3D1eM 1Po4nv75n/+5PSQ3+fQPxwwOCxxmhMXs6paziuULX/jC8P6ydSgyxMsNONTqdyl68l3C9uhHlgON Tz311PbD/eW7lHLq4vg7++yzRx50HP3GEpCABCQgAQlIQAL9BDL/ylwvUnXOlTzizKVHlVfZXS3t 9qVd7Y5prwTmhAAP+PXcD7qNQ+Xtb3/7kEAdlBmoeaAmfsc73tG+PWcoOEjg5GGlRM4XqWXLSdMO b+h53/veN1xRU/VccsklC85P6dqalTLoqWVVR00jx6eG1O3L7+bVepOmY1fi1HvRi17U/MZv/Ea7 8ih5xLT53//938PXlI+yIfmJq/5vfetb7X0ij/tJXMtre5OmWd0z7rtU9XdtGvVdunHwBjCDBCQg AQlIQAISkMDSCTAfZ55HyNxrMS2rMSdcrI31Ktcps17kbVcCEhhL4IYbbtipnFdd80rqhDqIM7DH 4cK5IKx0qA/b1GFLSjcvuoirvknzsYc3L6V+9OMIqPqSJkamnilDXsrRwxuq6D9vkPrP//zPdpXP pZde2m7Pqtul4oRqGx/8Ex3ojx0pmyRO/cjmOlxzTUy/2eIEZ65ThvOLrUKjAnJd21KXOvSJ7V+5 n7VslM7F8vu+S2xXqt8ldNS20ud8l2ob2M93ySABCUhAAhKQgAQksHQCzKXqvKtqGJWPzLiyqmNX S//k6WZXs1x7JSCBuSHAwM1Dcne1QwBkYK9OimOOOaZdwRIZBnGcHQlLGdTRT0g7pKmf9jiXhBA7 iTns99577202btzYliGbsNdeezV77713q6PqZlsQ26xYZZP81CGmTRwJvOabc1BYOZR85POZtG+L yVWbaSf9bRsd/EN9XhXNIb20zT0i5qwdzl456aSTIjrsD+XdEDsoI41Di9efv/rVr26vR8l380dd 97XZPROHdqtc7SvfJbaoxU7a6XuN+6j2zZeABCQgAQlIQAIS6CeQOVidh/VLPjvXHlW2K+frlNmV 7562S2A3JrBly5b2IZmBOoM1qxNwXBx00EELHqDzsBynAFg484MPIQ/70ZO8tvC5f7p/CKKzytS8 qpPzYQ444ID2gNiq55577hk6ZU455ZTmT/7kTxY82FfZb37zm+2qmK6zIO3EZlai4LDAccPWGvpY HQjVxmp7X7q2X9PIoie6YkOuo4t8VpywWgbHDHbkHlx55ZULnDLdumkDHS9/+cubb3zjG63atIVz 6sUvfvGQH/UpIxAn3WYs8s/mwdk43dD9LlWGyFZ763eJMtpOP7k2SEACEpCABCQgAQksj0DmdXXu Ved9y9O6a9Vy+9Kudb+0VgJzQ+Dwww9vV5PUDuOQ+PCHP9y+ejkP5Rm0E1f5pCmbpDzyxNFf82oa fQTksIuVMd06nL2SwJubWNnCWTI5TwZ5Pjg0PvvZzw7faBTd1K1prnEeEB599NHmX//1X9stTch0 5VqhCf/pq1/7ggOiLyT/tNNOa4vRk3qsLOkLKacs6TPOOKM5+eSTW/HogOmnP/3poQpkI0/mUvqL 44jVSTWg/0Mf+tDwNd7j9NUybIiNVZ9pCUhAAhKQgAQkIIHlEejOrTLfXZ62Xa+WK2V2vXumxRKY CwJs02GFAueq1MDqk/e///3t6gpeS8ybcupDc5Wt6fpA383vK1tMZ63DNiUe8usDO04AXqmd0KeP PLZUfeITn1jgcEDPiSee2G5TQsdjjz3WnmHCa72r84c2P/axjzV/8Ad/sOCMmrQ5SUxbtS+pU+3t K48c8cEHH7zAUUFdXhuOrTiguEYHcfQmL3re+c53Nn/1V3813KKGPFugeGvSmWee2YqlbupMGuMQ QwdvxKorYrCxfpeyHQy91b7afxxRVcekNignAQlIQAISkIAEJPAsgaeeeqqd3/IjI8cTcGYieXHG EDPnYg7Hh3k1K9P51Pna7sJTp8zucifthwR2QwI/+7M/254vwptu6gM5W3xwULDlZevWrQ0rLbZv 377Typr6YA2eOAYqqqq35tcH8dRLXOVIs9WGgK7o27Rp004HybZCnX+uu+66dtVLzcaB8O53v7tm NVsG27nI/8AHPrDgbBxeyw2fHGyc9hdUHnMxSr72f1T1yPAWqqSRTZpzV3DKcJ1P2otMdLMl7fWv f327hSt5xJ/73OfaVTTRU8uWkuY16jj0YEWIHeO+S8h07eQ6dVtF/iMBCUhAAhKQgAQksCgBfkxk 3soPkjhjunOsrgKcNHwIyP/whz9s08zDeGEGP8yyKp0fctGFEyc6u9dtxRn+p39N+gwbrGkSkMD8 EMAz/iu/8ivNIYcc0nY6D8nEfBjc2frzL//yL82f//mfN5/85CfbtxbVAbnSynabmjdJmrYIiZOm /S9+8YvN5Zdf3pbzT9rGiTJJiJOgynLGSl/gD8+rXvWqnYryJqBq305Ca5jBeTqw7bbfPViZ8vDB nK78K1/5yubII49cYCk6eANVrbdAYMIL/mDzXcL5Q0BfdGI7zpl8l/7sz/6s/S59//vfn1C7YhKQ gAQkIAEJSEACEGB+V+d4rJy+9dZbG36IvPvuuxes+g6xKp+8UTHzN3TyYxs6b7vttuEPnJnboS/p UXpmKd+VMrN0N7RFAhJYQIABdf/9929+//d/v12N8vWvf70d5Ov2EQZc5PCgX3jhhe2HVSove9nL 2i1OGeS7A3MG65QvaHhwwQBfD91FjnbRc99997VvVuIwW7bAdANOpDe96U3d7N5rlmymDxGo7ZIX G5Hj8NtuX+o2qehI/3K9ljHOM1ayVCcM7XFPakg/ktftB44TVrR88IMfXNDHiy66qDnrrLPa1UJd VtE1SYyNf/iHf9h84QtfaDhYuS6RjW3oZwktbfJ9gu0rXvGKdisZ/TRIQAISkIAEJCCBeSbQNxer 86jM75gH4jhh5XRfncowdWreqHR0ZYsTK2j4MM/jGYBVNITMhROTl7qkZynolJmlu6EtEpDAAgIZ oHl99Nve9rb2jBlWTXDWSMrqUkUGXT78AeDgXFawvOtd72ofrMmvIYNy9NQy0tSvZVU+7dRy6nDN ntf3vOc97Z7Xbjky3bBlsKKGNykR0sa///u/N7/6q7/antVCXpxQtIvD52d+5me6aoZ1UzBJ25Fd SYxN2FcdFuSlL1X3Yjah57jjjmudabxhintLHoFDjX/v935voi1htU3SsRF93B+2xZ1zzjnN5z// +fa71JXPNfVwun3mM59pvvOd77TfJfjX71xkjSUgAQlIQAISkMA8EGB+VEPmfZn7sZKcFTFsVUrI 3CkyyY+uxeaIkSdOe9GZa5xArEBnZTnOGeamKUv9tJfrWYndvjQrd0I7JCCBnQhk4Ex82GGHNb/2 a7/W/NEf/VHzlre8peE6g3gG3VyjjIGZM1guu+yynXSTEdnozzVlcQakjIGfkOuUt5nP/cPeVpxA vO2n6qoy3fTxxx8/fDNQdN9xxx3NX/zFXzQf/ehH29UavAacgE4+yEU2+rrXyV/LmDZjz0MPPTRs Kn3HmVZDn90pr2VvfvObG86pgXG442jjHKHoTr1JYurkD3di3u7V911Kn7p6b7jhhva7xMHD6XNX xmsJSEACEpCABCQwbwQyJ2aOxYoVtn/jkGFORahzq+RVRtTP/C5xLe9LV51pP3VjA3PTvvb69K13 nitl1vsO2L4EJDCSQB7KM8jmAR0P+Gte85qGty+xzQinC6tiGIS7ga1AnDVz9NFHL3gbUpWL/jpw J50y4voHIOXowfnAWS/Ys88++yyQq+30pTdu3Nj84i/+YnsuDoeZRS99v+KKK9oPbbONhkONTznl lPbNTGz1qSG2xc5atlbpsLn//vsXOLGSz9azGshPWc0nXfPhyWoW3iyVOsQ4ZTjUuW+7Vldfva66 ScMqvPJd4vvEfudR3yXk+S596lOfap1uOAQNEpCABCQgAQlIYN4JMD9n3nrnnXc2zAkz1yIv861R jCJLeU2Pkk9+laWNGihjtQ7PCGyd4oe4/ChX5WYpvXBWP0uWaYsEJDD3BLoDOYNsQgZgnC183v72 t7cHtbK9iVUVdbBmYP6nf/qn5rd/+7eHSxmjJ3GVJ499qTg+4hgijzR5HBaLM4VXQRPjLKmv56t2 Um+xwFuVeODHdv541EA/+fDabbbS/N///V+7LJMtTC996UvbPzL1D024VB1rnc7yVNqufYfhJCHs a8zZObxRinN7wgBGbCX69V//9UnUDmUqHzKrjUOhQWLUd6nKYAMHS//Wb/3WsrZSVV2mJSABCUhA AhKQwK5OoDpA6Evmot3512L9TL3F5GobfbKZT1LGanPmbqxiZw4/ag7Yp2eaeTplpknbtiQggWUT yAN/4u6gSv62bdva1yfj3OBMkgRkb7/99uaaa67pPSgXOepHN9ec6bJ582aSaxrSJmec8FpvDjO+ 4IILhs6Zbj+5xgmCc4LDan/zN3+zfSXgmhq5iHIcRoRqK29kYjtXDbW85ocBeVXm537u59q3abFH OPk7duxoD+Gt9RdL55eayNX2kteN8136j//4j/a7RJ2EfJe4XwYJSEACEpCABCQwjwSYG+HwYKUx c7Xu/Cpzt2mxqXO12iY/ePKmUn586640r3LrmfZMmfWkb9sSmHMCowZPBnG87vkw4JMm9A3wVQ9e eVbNcGBsQsp5mO6rH7laljopW6sYh0ECp8W/8Y1vbP74j/+4XdXzhje8oe0HfUrALj7U4xC1f/iH fxiyWS2b00bahMs4NldffXUrWmVOOOGEVB/GS7WPFUmve93r2vq1Lk637pueho10EtjEtjC+P/ke kY6+xLVa8jgg7h3veMeC7xJy6OS7ZJCABCQgAQlIQALzQiDzI/pLmvlUHDLkMT+qc0HyphnSfmyo 9uI0wlbmhONCrTNObrXLXCmz2kTVJwEJTEwgg2a3AitAPve5zw0HduRYdsjbd2ogvw6eNX3SSSc1 N910UxVv97ouyJiRC+wOi/Th2GOPbfi8/vWvb3994I1TrP65+eabW9nI0Ude38wrwKNjpd3q6uku Pw13Yg4l/u53v7vgPtD+ySefvFIz2v688pWvbDhcl184YscjjzzSrhKapAG2e7GqqIb6XUpf06cq R5o2OccH7jXQb4MEJCABCUhAAhLYHQn0zYsyZ6K//DjImS1ZzZx5aeJJmfS1M2ndUXKxodpLHrZi 8zHHHLNg3kpZZBOP0r1W+T/5+XWtWlCvBCQggQkJZGDmrJa65YQHYx6Cn3jiieGgicruoJuBlLie 8ZLmJ11dEflpxPlDENvrypm0zwoaDrjlHJNXvOIVyR6ywDETPcPCCROj6sWOxcq/9KUvtXbk3tEs h+eedtppE1owXoz2f+EXfqE9Cyg2UYM/rJME3uJEQE9iVrk8/vjj7TX/xPbIJC8x/LsBx5BBAhKQ gAQkIAEJ7I4E6pyI/nWv77rrruGq5W7ZUnikbuKl1F2KbObZbGXi7Mm0R5yypehbbVlXyqw2UfVJ QAJLJtAdGLunpGewZLUIB8Am9A2k0dXdXoIO9pLOUmAFCIfGxmZsfO1rX9tuYSKdlSHYnOvXvOY1 zTe+8Y22G6nHafeU53opfcTRQTvdkDzKo7fbxte+9rX2cGXqIkM5H1a3rOae3SOPPLLVyXk76F9K oG5so176wJYrHEeU1f5Fd83HIch1WKCDX1kMEpCABCQgAQlIYHcnwByIuU/mULzt9L777hvOn1bS /+is+leir1s3tiefa16cwdtS+RGRdmch7DwTnwWrtEECEpgrAt39nayUYctIAgMogVdbc45KQncg 5ZoHZxwyl156acTaGCdDzpnp1lsgOMWLzZs3t38MsJkPduV8Fuwlj0A+DLjmXJQaKONQ3YSwyvW4 GFna6eORtqu+pFklwlk2HIIbucRsDXr5y18+rtkllcU2ztdh1UtsmFQJ59KwlS16qEea7xK/lIwL yOWV66TjqMIGnTLjyFkmAQlIQAISkMCuTKA7b6IvzIM4R4YfAzMnWmkfq56lzvEWa7v2IbKZz7HS p54xmPL1inXKrBd525WABIYE6oBMJg/4b37zm5tsG8mgypaVv//7v2+++MUvDpdMDpUMEjh3eHPR Rz7ykXagTRmDPIe2bh44QQirPei3SpfxD04GXqldAw6lz372s639lUtsrtuFqEf+8ccfP1QRVomH BT0JZEbJ8SsITgt+TSDm1dRf/vKXm3/8x39s3v/+97fXVSV2cL/e+973NnvttVctWlE6DPbee+/m vPPOGzqBJlVK/97ylre0rzivddi+9MEPfrD3u0Qd/lDnu8S2OfoXxxOrgOLgqzpNS0ACEpCABCQg gV2dAPOgzL9qX8jnx1Hm26QzN60yS0lTHz0JfemaF7lJY/qQuRt1oos8+sD8lvRK+zGpPePk3L40 jo5lEpDAuhBgcGQLE6+l/n//7/+1D8gMpHzYC/qVr3yl+a//+q922SGODR7YH3jggfaTc2fqAMuA y7kkrCjp/gFYlw6WRn/+53+++fCHPzz8Q0Ef2Z7EipkzzzyzYdUQNrNM9Dvf+U77B6T2DQcIr2/u hirTLZvk+uMf//hOYn3ssJd82OKQOeSQQ4Z92UnBMjLQn8DqKc7Wufzyy5O1aIxtRxxxxPC7VFca seJnse8SDaTfxAScQyx5NUhAAhKQgAQkIIHdjUDmPd1+MW968MEHh9l1jjbMXEIic8joyXy2tk+a HwaXE6I/dTOPS8yzA/O5F7zgBREZzvmGGVNK6JSZEmibkYAEdiZQB92dS5tmy5Ytzbvf/e7mYx/7 WPugn0EUWQba+++/v3XEdOtWOcp++qd/ujn33HNbsQz83TrrdX3iiSe2r31mBUzsJr733ntbxxN2 jbP5l37pl5pDDz10gfnUH1dngfAiF1VXn07KeUvUL//yL7fbi/pkFmliZHFtO0K8onrHjh0TH/Qb e+p3qf5qgl5k+MPMRCPyaa8bv/rVrx5+l7plXktAAhKQgAQkIIHdjUDmY6wsSbr2kbkT+csJffOu mlfTk+rvs3FUXfrEPDb2L6e9UbqXku/2paXQUlYCElgxgQx6KGLgq9dVeQbF7du3N7/zO7/TnH76 6TstpRxVN3rwfr/97W9v3vrWtyZr5mL6wHkp73rXu5r99ttvwR87GIRD13C2Cr3zne/cicu4Ol0d k1yPap+6OIPe8573tPcnbzmaROekMn1tsyLnTW9601BFn0wKU5bvSf0uJS+yxJGveUnnu/S2t70t WcYSkIAEJCABCUhgtySQeRIx8yNWyfDpmytFdlZA9NlYbcPe2EyfJn2jZ9Wx2mlXyqw2UfVJQAJL IjBq4MxgiTLeoMNKDM43+epXv9pu7eHMk77AeR+c08Jhs+ecc86ibwGq7fTpW+u89P+lL31puzWH 7TRXXHFFu1ImZdUGnBL0jQ8nxxOQ41P/yNQ6k6Sp29cedSljaSevGad9zrBhKxGH+hJG1WsLJ/wn 9o8Tj40ve9nLmssuu6zJq8BTp2sH8gTyox+bcSTlu3TNNdc0Dz300II+pJ3udyln5XTbSfvGEpCA BCQgAQlIYHcgkLlOYrbRr1bIPAt9mZ+lndVqY5yeblv0rW5hGld3rcr2OP/883+yYX+tWlGvBCQw 9wQy6AKiDsY1PQ5S5BJzNghbfBhIObQVZwHOGFY0ILPUEL2Jl1p/OfK1LfhwIBkxnxxAlrdNcVYL nzhiltPeYnXCrd4r0jVEZrGD0aqO1E9e7XfKxsVdea4Xa7+rr+ognYBNfJfYCscS1scee6w9x4e3 Ni33uxTdxhKQgAQkIAEJSGBXJ8CclK3j3TnhavcrZ8p027nqqqtWu6lWX+aGxBwnwI9x6xXWr+X1 6rHtSkACUyOQh3AazIMwcX2g7g68yNZ6XBNSJ/IMnBwGzCGukSdOeR1ok/espv5/I5O4X2p1c2tb ccjQArbztij6Rh+5DrdYQN2+PpK3khDOiWknJ/CTTn7aSVz7QvvJr7YkL7LE5PGJ3iqfdOTrdXQl b7E4OhIjn/ZZAbNp06bmsMMOG+bV8lpnsXYsl4AEJCABCUhAArsTAc7dm8ZcqNtG5mlrzZJ2OFew +0bUtW636tcpU2mYloAEVpVA34MzA191QNQGU0ZeHYijJ+U15mG+hiobPbV8VtP0qYYwSlx5IJd+ Jq55Vc9iaepHd+Looizl0RN7ch27q1zVE7m+OLomlY+OKl/bTTlxtSv55KVN8lI3efku1bpJI0+a OgYJSEACEpCABCSwuxLI/Ij+Mfd5+OGHpzIH6q6IqXasFevM7ejjejplPOh3re6weiUggSGBDHjE hG4cwfrAW9PIVx2U5QGaNA/V40LVNU4udo2TWcuytI+96W/6Sbspjw31utvHWhb5vjhyxElHruZF f2RyHdkajyuLXJ/uSepRv8rFnuhNjExXjuuuPHlhTJrvUj7RlTjOm1wbS0ACEpCABCQggd2NAHOl zKGIOQg312vV18zPEtNO5mdr1SZ68wxBH2vba9lmn+7xTzJ9NcyTgAQksEQCDOQMrBn4Ur1vgB81 IFZZZLrX0dkXdwf12kZNV519etYijzZjQ9rPNe0lr6ZTXsu6to0r68rmelwdGKacODakbvc6+aPi 6KI896fqqOkqG319eSnri/vkk5eYerSbT1cP+VW2W+61BCQgAQlIQAIS2B0IZB72ox/9aDjnW4s5 UHR2Yxgmb6141vkead7EtF5Bp8x6kbddCcwRgTzMZoBfbtcXq983eJPXlx8bxpVFZi3jsFlKG2tp c3Qnjl11lchybI6evrjbFjI1r+++d/OqfF8bNS91E9eyml6KzlrPtAQkIAEJSEACEthVCdT5T31d 9GLzpuX0dy10LscO6vCyh/UKOmXWi7ztSmCOCNTBfSXdXkxP38Del7eYnpXYuJp1+2xfTf19utJm 4sgsdh259Yq79o2zY9L7vxSd49qzTAISkIAEJCABCewqBOr854knnlh1s5mHTToXW/XGBwrpX+1j bOFtrusVdMqsF3nblYAEJCABCUhAAhKQgAQkIAEJzCiBH//4x2tiWXWKjGtgUrlxOrplXadQ2lgL B1S37VHXvn1pFBnzJSABCUhAAhKQgAQkIAEJSEACc0pgLZwycYIQZ5UKeLdt29auYEleyq+88sqp 0H/yySen0k5fIzpl+qiYJwEJSEACEpCABCQgAQlIQAISmGMCcaCsBYI4X6I7bSUmv6Yjt1bxNNvq 9sHtS10iXktAAhKQgAQkIAEJSEACEpCABOacwFNPPbWmBHDMxBnSddKsZcN9ba11X8f1R6fMODqW SUACEpCABCQgAQlIQAISkIAE5pBAHCZr1XX0xzGz1m3VPkyzrdruqLROmVFkzJeABCQgAQlIQAIS kIAEJCABCcwpge6KktVyZkRv4uc9b7puiW4/uN6wYcO63WXPlFk39DYsAQlIYNcm8L73vW+PXbsH Wi8BCcwagfPPP/+ZWbNJeyQgAQnMK4E999yzqYf9xomyUh5xinTjqpey1Wqv6iXd1cv1tB1D1abp uqRqy6YlIAEJLIFAd/BcQlVFJSABCUhAAhKQgAQkIIEJCWTejVNmvUJsmFb7rJSZdpvpm06ZkDCW gASmTiDe8UkaXorsJPqUkYAEJCABCUhAAhKQgAR2JpB59957771z4W6UU50w9DX9nnYXdcpMm7jt SUACQwJ1ICQz14mHgiYkIAEJSEACEpCABCQggakSiFNmvZwVa93Z2q/0da3b7NOvU6aPinkSkMDU CcQRw+BYB8hRhkR+VLn5EpCABCQgAQlIQAISkMDyCbzgBS9oK+/O8+48dzz/+c9fPqgV1tQps0KA VpeABFaHAAPi008/PVwt09Xa/WOQAbQr57UEJCABCUhAAhKQgAQksHIC++yzz7q+lWjlPRivgecJ njH4xAE1vsbalOqUWRuuapWABJZBoOt4qSp0wlQapiUgAQlIQAISkIAEJLC2BHgjEY6Z3S3wzBGH DH3bd999R/4wPI2+65SZBmXbkIAEegn0OWF47d4Pf/jD5tFHH+2tY6YEJCABCUhAAhKQgAQksPYE mKvvt99+bUN98/a1t2BtWohDJn160YteNNHxCWtjTdOs3zuu1qpH6pWABHYZAgyIjz/+eHPzzTc3 P/rRj9rPk08+ObQf7zx/CNjjuXHjxubQQw8dlpmQgAQkIAEJSEACEpCABNaWAA6Le+65Z+wxA2tr wdppj3Nm//33X9eVMjpl1u4eq1kCEhhDgBUxOGNuv/32dpBHlIERRwwxgTNmWDXD56677moOPPDA ZuvWrRPt+cTzHT3o6l6TV9tLeWLK+8Ji5ehEZrlhqfr75Cexoa/ecm22ngQkIAEJSEACEpDA7klg r732an8kfeihh9oOZp7JXHLceZC7Cg1+AN6wYUPvs8K0+qBTZlqkbUcCEhgOdjhkLrnkknaVTLB0 HSTkk1fDAw880Fx88cXN8ccf3xx99NG1aJjOH4paNw6I+sejKxf5xEOFncStt966YGvViSeeOOwX +lcalqq/2w/ar/0dZc9i/RxVz3wJSEACEpCABCQggd2XQOazmSsSH3zwwc3DDz/czs1redJLoZF5 KnX65rFL0bVSWWw56KCDhnPnlepbbn2dMsslZz0JSGDJBBh4+VxxxRULHDIMiEceeWQ74HPy+d57 79163h955JF2S1N1VFD/+uuvbz32rJzJYJ4Bnrgb4sVPnDqR614nnzj6kCHcfffdDb8UpM4JJ5zQ 5vMP+lnpQ4h8ezHmn9XQH1vSfq4Tx560NcYciyQgAQlIQAISkIAE5phA5ssgYO7IfJL5OccJMDdP 3nIRoS8hc1PipGt55NYqpk8vfOEL10r9xHo96HdiVApKQAIrIZDB9sYbb2wefPDBoSpOdD/33HPb bUmHHHJIO+CzhBDHDHtYjzrqqObss89ujj322OFgTeWrr7664fwZ9GbwTjxUPkiQF5nE6CdwTahb ptqMwT+1XvKQ58MfK0K3veU4ZKqOlejvszf2YGu3j7Vdyg0SkIAEJCABCUhAAhLI/BgSdb6Ysx1r HjJVnuvlBvRW3TW9XJ3j6qF/06ZNC9ocJ7+WZa6UWUu66paABIYEMrByNkwNp556aut9j6ODMmQj zzVOlC1btrQrVO6//36y2pU2N9xwQ+vM4Y8B8vmjkGvkko5TguunnnpqgZMC586ee+65YF9s6hHn FwPi1EU3gTx0R468OENqH8jvhti8WvqjL+1EL9c1zTX2GiQgAQlIQAISkIAEJDAJAVaVHHDAAe1Z j1W+O8esZUtJX3XVVQvEMxdfkLmKF6y4r6/Cztx4sfn7KpowVOVKmSEKExKQwFoT4E1LfBJYLphX 0MWRQVkGxcSRP/nkk9tknA8cAFxDBtHEKesO6rmOHE6f6EydxOTHNuqRJo8/QHy4Jj+flEd39IyK V0s/etIvYkKuk24zn/tnUvtqHdMSkIAEJCABCUhAAvNFIHNG5pWHHXZY+2NpJUB+5p41fynptJGY usyz1yLQBnN/VslUu8mv7a9F26N0ulJmFBnzJSCBVSeAE4XBLwMe3vYE8lJWB0jKU8aWJj5PPPFE m8drtFm50t2OFJ01Zg8s7VMHxwnbpvCQs0d2XKBe/aNAe4TYiL4acDSlrOaPSq+W/sqOlT8civzo o48OnWD0l9PlcYIhuxQbR9luvgQkIAEJSEACEpDA7kcg80p6VueMrCw//PDDm9tuu23Y6czrhxlL SKSdtJEYFTW9BJWLiqKXPtCXWQmzY8msENEOCUhgzQjwSr06cD/22GNtWwyO5KcscfIzKBNz7gyn vyew8macY4UzbHjtNm986gs4UdhCRUy7aSuyV155ZevIyXXi2MZbpGrgfJxx9lRZ0qutny1dHIxc HUm1Tf4A8eaq4447rmabloAEJCABCUhAAhKQQDsXzlw8OOocmR9VmcPfe++9w3lz5sWRnzTutjNp vZXI8bal+sNw5v7rYUv6oVMmJIwlIIE1J8BKjRp4ixHOEpw1hO6A3jc4bt26taoYmcZZw97Ueqhw Vz+VWely6aWXNqecckqTA8xGKi0F1TbSqz2gT6o/fWL1EG+16m7pKia3SVbR4KhiJQ3OKFYeGSQg AQlIQAISkIAEJACBOgcNkcxzuSbNnBnHTFaMp07mpalX85O30ri2gf7YNklb/HDKKpkaUq/mTTut U2baxG1PAnNIIAMmqzQYDNmyQ8BBgCPhjDPOGEkldROPFCwFrKT5zne+0+onm8GaLU77779/2z5/ RHBeZPUMq0qw48QTT2xXkWSwJ2a7T5xG6EI3difU7UDYuJSlkKuhnzZxsGB/7Ir9HMjGFi22XCGD 4yaBa1b5bN++fcGvBSk3loAEJCABCUhAAhKQQJcA82bmmrwh9eabb26dM5HJfJ2YkLMWU74acXSj K3NeYj7jAvNiVovPYtApM4t3RZsksJsRyEDJILpl8BYlHAgErlnJcvHFF7f5Gzdu3GnwzgBb4zoY BxV5Gfivu+66oYOCcrz5rLDpOkzYD4ssgbps/eEAszhh0Ek94rR/2WWXLViNcuaZZ7b1l/PPSvVj E38Y83rw2IDzCWcLq2AqF5xhsCemLk6pa6+9tn3lePoXHcYSkIAEJCABCUhAAhIYRYAfPI855ph2 2zznGCYw90yIAyfXdU6dvJXGk8xhcchga86hXGmbq13fty+tNlH1SUACvQQYhPlwJszmzZtbp0AG 0TgLWN3CeSj1DU2R6VVaMiN3xx13tKtCuKY9POJs02EQTl6qpYxr/mggz/kz3RDdiWs5q1D68qvM YunUT1zlx+nHXhxLdQUM+2RPP/30BQ4Z+kZglRJOJFbPUJd8lp3CrIY+O2q5aQlIQAISkIAEJCCB +SRQ54n84Imzgx8Ek58YOvzoWUMtq/mrkY5u5rg1cG7kLDtksHUhpWq9aQlIQAIrJJDBMWoyMB97 7LHNkUceORy8U86WGlauXHDBBe32o+4BvQyyGWi7utGBc4LVLpQhhxMCBxCBtuOtT11kWEWDXMpp M29YaiuWf+LcSBb1cfYQp82ULSdeqn62K910003D9vnDuG3btuGvANiEznDHTlYB4aQiL/mcMZOt T9iNnEECEpCABCQgAQlIQAJdAplHJ5/55BFHHNH+6Ede5sWku3Nb8lYjdG1AZ+avmd9yzY+VbLMi r6/OatiyGjp0yqwGRXVIQAK9BDI4Upg0AyKfE044oTnrrLOG55mQVwdMHDQ7duxovvnNb7Zbbn7w gx8MHR/IRh+6uSYgk3NiuMbxE6cJ8pHr1uUPScpx7NA2IXmpl0G+LRz8U+2IbMomiVNnufqrA4k/ en2v98Pmbjtsa8IZRT4BZnffffckJisjAQlIQAISkIAEJDDHBDJ/rPNLfhhkHooDhHScMZnjriYu 2o0NfXppGxtYEY9NPAt05/B99dYzzzNl1pO+bUtgDghkwI5zIF3mmrcxveQlL2nuueee1inAq/Ui n8GWGGcLH15fd9JJJ7Wvr44e4sjed999CxwleMcJ9Q9CHClph3KWXNaQ7UCRTVna4brWT/lS45Xq Z9tXbEIXTqhuGGUnf6juuuuuVpy6OT2/W99rCUhAAhKQgAQkIAEJdAlkHpu5KOXM1VmBzo99vFSj lnXrL/eadscFtulv2rRpeJZktSE2j6u/HmU6ZdaDum1KYI4IZOCMcyADY2JQsGqDDys24qDJq6xT DzkGd94YdNxxx7Uf8mrgFdvRi4ccxw8Hj8U7PmogxoNeQ/dMG3RWO5BNv2q95aRj03L010PV6COH mPWFMKltsL+2tl119ekwTwISkIAEJCABCUhAApVAnVsmnzk4K2ZwjjCvzwsmMh+N3GrG6GZum2MJ qu7M2RPXsllJ65SZlTuhHRKYAwKLDcacd8JqDz44RhjIWc3BKg6WIuJ4QAdnoDCwcjZNDVnhQh5n pFx44YVtMXWWMhDzyuyE2LyU+qk7SbwS/fyRSxjlkEk5ce0DabYxxQFV+1zrmJaABCQgAQlIQAIS kEAfgTq3rOXMb3O2I/N4VrM//PDDC37kzByYeqRH6ap6k0Y2dVh5z+p4nDLjQm1vnNx6lOmUWQ/q tikBCYwkkAF2n332afeCss2GrUvf//7321UvDMI4aHDMHHzwwe0WKOqQN2qwjTOnDuBVtptfnTsj DZ1CAXYlxMZcY2M9nHffffdN0UQx/ceRg1MG3Th4OOAYVrXdiZQpJAEJSEACEpCABCQggQ4B5ps4 Z/iwIp5V7zhnskI789vMPXONmuSRRk/KiJnDslWKIwhYmbOrh12/B7v6HdB+CUhgSCAD7jDjuQSv 0d64cWNz+eWXDw/hxQnDm5p4xTODM9ejAnoJ3TjyNT/plK1nXG2paWzKHyryk46tXJNfy5JXZWCW /ByC1nVgRd5YAhKQgAQkIAEJSEACixHI3LIrxwpt5vN8CKygwTmDs4YfCYkJ9UdCdOF04cdaVtTz I2RWxFC2uwSdMrvLnbQfEphBAtUpgHmjBumYPm5wpYxXOV900UXDFSI5QwZHAgM1cZwzeM85RBgb uo6GakfajIMiZYlj26zF/IHiw2oZ+li3MvVxT//SD2T4AxhZ/tjR58iRb5CABCQgAQlIQAISkMBS CIyaQ2aOiS5k2HYUB0v0j5t/pyxz1+jJPD86dsVYp8yueNe0WQK7CAEGzwSWKt5yyy25bJccsjVp 1MA9FCwJPOwsf2TpI4HBHQ87eXjVGdxThpMC3XWgTlvEfDK4oyu2Roa8WQ7Yyx8yDkQmnbNhYnP3 D1/6Rzlp+pk6pPNHscpFl7EEJCABCUhAAhKQgASWQyBz7jonJ81clVDnnnX+2m0LPXwm0dOtO+vX z5t1A7VPAhLY9Qkw2PLh9Xj53HbbbUPHCD1kkO0LGagTd89OyfkvrBqph92ygoTDa/OHAN3RUdPk 8YlcZEbZ02fjeuRhH86oBJxS9bXW6UfKa0xdnFfpN2WslDFIQAISkIAEJCABCUhgNQlkTpq5Nrrj fElZ2qvXpOs1MlzHmcN1dHblKNuVgk6ZXeluaasEdlECDJisxMiAyTUOExwqpAkp63Yxg20Gb1bc 1BDHBOUc9lUDjp86eGcQR2faTRq5pKuO9U6P4kI+K4NSTsxKpPRrnN3I3nrrra0svzYQ2O5lkIAE JCABCUhAAhKQwFoTyPx1XDuZl3dlx113y8bpn6UynTKzdDe0RQK7MQEGyRzsRZqBloN6a+g6FDKw kk+alSDZlkQ9VnewpYlAOQcCx8lAndtvv72tEz3E0ZW8tvLgH3TfeeeduZyZmBUwNVS7jzjiiPYs nZSzCimHpCWvL4Yhb7QiwIMVRoceemib7pM3TwISkIAEJCABCUhAAislkB9Il6KHueq4UMtrelyd WSvTKTNrd0R7JLAbEcCBEEcIg+SWLVuG13TznnvuaR0zGUCrw4Hy5BPjbPje975HdquDmFdi14CT 5rjjjmuz0u6VV1654BDcbhsIP/DAA823v/3t5pprrmmuvfba9nyaqjdp7KhbpMivB+xGbrlxn35W FNUQJuTRF5gmUMYbqrKlq+anHmfwfPe7301RGx9//PGtrrpHd4GAFxKQgAQkIAEJSEACElghgb55 +ApV7hbVdcrsFrfRTkhgNgngCOCTAZitRjhNco3VbDH61re+1cY4DGpAjsNob7rppvatS7Uc50h1 SETnMcccs+CsFVbAXHLJJa0DiHNmamAVCtt4cFKkjNUyXUdI6tBGtkuR5oNtcXhEbrnxUvXT7uGH H95uY0qb9PfSSy9t7r333mGf0EtfWR2D8wmOsf/AAw9sVxhRv96r1epT7DKWgAQkIAEJSEACEpCA BHYm4NuXdmZijgQksIoEePivD/ibN29uNmzY0Fx//fXDVnC87NixY7j1KFuSsuIjzoLEHOr74he/ eMHWnZShlFdns6oGvbTPUklWzBBYTcNZLDhe6lYo6rNSZNu2bcM3EbUVyj/I4MQgkCaw2uf+++9v bWE1z/bt25uDDjpoWN4KTfjPUvXHsUJ/6R8OGfLo9xVXXNG2ihOJvJzFQxtcE8PhpJNOauWSF1O5 NkhAAhKQgAQkIAEJSEACa0vAlTJry1ftEph7AnFeBAQOElaznHHGGa1TIE6CbJ3hGqcCH9LZe0qM MweHB3XjbIjeGnOo8DnnnNNs2rRpWJ9yHA04elhFgkMmuinDWYNezqVJiGMiDgts5DDhww47rLUt 5ayyYfVJVtt0+xx93Tj1V6KftmDxkpe8pOGMmZxBE3Y4auKQof1wPvLII5uzzjqr3Y6F7KQ2d/vg tQQkIAEJSEACEpCABCSwfAKulFk+O2tKQALLIIBTAGcIK07OPvvsdqVJVpvgUOg6B5BnZQzyRx11 VBvHmUIcxwam5Jo8HDisIOEAWw78xTFRD8GlHXTzim0cFGwDop0aYgtxHCfEJ554YivL1qc4OWq9 SdOroR976Df93bp1a+u0wq76yuswRxaHFVvI+pxP2J1+TtoH5SQgAQlIQAISkIAEJCCB5RNY+ASy fD3WlIAEJLATgb4H/DhD4pDAaZI3/7B6hW1FOE9wkLCNCacJca2HXkLXIZJnvDbiAABAAElEQVR8 ZJPmjU84IMhD70MPPdSuJmFlDLqJlxqwDccMK36wmVU9OEVYsYLTY6VhKfrT18T0FZ6s3AlL7IEh tu21116teX33hoLoSboV9h8JSEACEpCABCQgAQlIYE0I6JRZE6wqlYAEIMADfkJ1AtT8lBNzxgmf OAay8oWyrgOGvOiJfOIqmzQxjom8lpv6CdSLHHbWdiPTF+PQWY5Tp09XX95S9McJlRgHUfdNUbWN sKt5SY8ri4yxBCQgAQlIQAISkIAEJLByAp4ps3KGapCABCYgsNiDfpw2yOUTBwPqx9WPXOLIRuck 9VOHOHrSrVwnTv5qxdGbeDX0pj/L1bXS+stt13oSkIAEJCABCUhAAhKYJwI6ZebpbttXCewiBFbL ObFajoXoSbzaGKM38WrrX46+1boHy2nbOhKQgAQkIAEJSEACEpgXAjpl5uVO208JSEACEpCABCQg AQlIQAISkIAEZoqATpmZuh0aIwEJSEACEpCABCQgAQlIQAISkMC8ENApMy932n5KQAISkIAEJCAB CUhAAhKQgAQkMFMEdMrM1O3QGAlIQAISkIAEJCABCUhAAhKQgATmhYBOmXm50/ZTAhKQgAQkIAEJ SEACEpCABCQggZkioFNmpm6HxkhAAhKQgAQkIAEJSEACEpCABCQwLwR0yszLnbafEpCABCQgAQlI QAISkIAEJCABCcwUAZ0yM3U7NEYCEpCABCQgAQlIQAISkIAEJCCBeSGgU2Ze7rT9lIAEJCABCUhA AhKQgAQkIAEJSGCmCOiUmanboTESkIAEJCABCUhAAhKQgAQkIAEJzAsBnTLzcqftpwQkIAEJSEAC EpCABCQgAQlIQAIzRUCnzEzdDo2RgAQkIAEJSEACEpCABCQgAQlIYF4I6JSZlzttPyUgAQlIQAIS kIAEJCABCUhAAhKYKQJ7nH/++c/MlEUaIwEJSEACEpCABCQgAQlIQAISkIAE5oCAK2Xm4CbbRQlI QAISkIAEJCABCUhAAhKQgARmj4BOmdm7J1okAQlIQAISkIAEJCABCUhAAhKQwBwQ0CkzBzfZLkpA AhKQgAQkIAEJSEACEpCABCQwewR0yszePdEiCUhAAhKQgAQkIAEJSEACEpCABOaAgE6ZObjJdlEC EpCABCQgAQlIQAISkIAEJCCB2SOgU2b27okWSUACEpCABCQgAQlIQAISkIAEJDAHBHTKzMFNtosS kIAEJCABCUhAAhKQgAQkIAEJzB4BnTKzd0+0SAISkIAEJCABCUhAAhKQgAQkIIE5IKBTZg5usl2U gAQkIAEJSEACEpCABCQgAQlIYPYI6JSZvXuiRRKQgAQkIAEJSEACEpCABCQgAQnMAQGdMnNwk+2i BCQgAQlIQAISkIAEJCABCUhAArNHQKfM7N0TLZKABCQgAQlIQAISkIAEJCABCUhgDgjolJmDm2wX JSABCUhAAhKQgAQkIAEJSEACEpg9AjplZu+eaJEEJCABCUhAAhKQgAQkIAEJSEACc0BAp8wc3GS7 KAEJSEACEpCABCQgAQlIQAISkMDsEdApM3v3RIskIAEJSEACEpCABCQgAQlIQAISmAMCOmXm4Cbb RQlIQAISkIAEJCABCUhAAhKQgARmj4BOmdm7J1okAQlIQAISkIAEJCABCUhAAhKQwBwQ0CkzBzfZ LkpAAhKQgAQkIAEJSEACEpCABCQwewR0yszePdEiCUhAAhKQgAQkIAEJSEACEpCABOaAgE6ZObjJ dlECEpCABCQgAQlIQAISkIAEJCCB2SOgU2b27okWSUACEpCABCQgAQlIQAISkIAEJDAHBHTKzMFN tosSkIAEJCABCUhAAhKQgAQkIAEJzB4BnTKzd0+0SAISkIAEJCABCUhAAhKQgAQkIIE5IKBTZg5u sl2UgAQkIAEJSEACEpCABCQgAQlIYPYI6JSZvXuiRRKQgAQkIAEJSEACEpCABCQgAQnMAQGdMnNw k+2iBCQgAQlIQAISkIAEJCABCUhAArNHQKfM7N0TLZKABCQgAQlIQAISkIAEJCABCUhgDgjolJmD m2wXJSABCUhAAhKQgAQkIAEJSEACEpg9AjplZu+eaJEEJCABCUhAAhKQgAQkIAEJSEACc0BAp8wc 3GS7KAEJSEACEpCABCQgAQlIQAISkMDsEdApM3v3RIskIAEJSEACEpCABCQgAQlIQAISmAMCOmXm 4CbbRQlIQAISkIAEJCABCUhAAhKQgARmj4BOmdm7J1okAQlIQAISkIAEJCABCUhAAhKQwBwQ0Ckz BzfZLkpAAhKQgAQkIAEJSEACEpCABCQwewR0yszePdEiCUhAAhKQgAQkIAEJSEACEpCABOaAgE6Z ObjJdlECEpCABCQgAQlIQAISkIAEJCCB2SOgU2b27okWSUACEpCABCQgAQlIQAISkIAEJDAHBHTK zMFNtosSkIAEJCABCUhAAhKQgAQkIAEJzB4BnTKzd0+0SAISkIAEJCABCUhAAhKQgAQkIIE5IKBT Zg5usl2UgAQkIAEJSEACEpCABCQgAQlIYPYI6JSZvXuiRRKQgAQkIAEJSEACEpCABCQgAQnMAQGd MnNwk+2iBCQgAQlIQAISkIAEJCABCUhAArNHQKfM7N0TLZKABCQgAQlIQAISkIAEJCABCUhgDgjo lJmDm2wXJSABCUhAAhKQgAQkIAEJSEACEpg9AjplZu+eaJEEJCABCUhAAhKQgAQkIAEJSEACc0BA p8wc3GS7KAEJSEACEpCABCQgAQlIQAISkMDsEdApM3v3RIskIAEJSEACEpCABCQgAQlIQAISmAMC OmXm4CbbRQlIQAISkIAEJCABCUhAAhKQgARmj4BOmdm7J1okAQlIQAISkIAEJCABCUhAAhKQwBwQ 0CkzBzfZLkpAAhKQgAQkIAEJSEACEpCABCQwewR0yszePdEiCUhAAhKQgAQkIAEJSEACEpCABOaA gE6ZObjJdlECEpCABCQgAQlIQAISkIAEJCCB2SOgU2b27okWSUACEpCABCQgAQlIQAISkIAEJDAH BHTKzMFNtosSkIAEJCABCUhAAhKQgAQkIAEJzB4BnTKzd0+0SAISkIAEJCABCUhAAhKQgAQkIIE5 IKBTZg5usl2UgAQkIAEJSEACEpCABCQgAQlIYPYI6JSZvXuiRRKQgAQkIAEJSEACEpCABCQgAQnM AQGdMnNwk+2iBCQgAQlIQAISkIAEJCCB/8/euf9cc1V1fKAPvZfer1LacqlYhVZBAnjBW1CqogZC lGgkmoCGRIk/+Tf4C/oTGjWpdwU1sUUkERIUkQZBgRSsXEqrvQDF0koLbd+3YL/z9nve9exnz+2c mXP2nPlMct59W2vttT97Zp691ztnDgQgAIHyCBCUKW9O8AgCEIAABCAAAQhAAAIQgAAEIACBBRAg KLOASWaIEIAABCAAAQhAAAIQgAAEIAABCJRHgKBMeXOCRxCAAAQgAAEIQAACEIAABCAAAQgsgABB mQVMMkOEAAQgAAEIQAACEIAABCAAAQhAoDwCBGXKmxM8ggAEIAABCEAAAhCAAAQgAAEIQGABBAjK LGCSGSIEIAABCEAAAhCAAAQgAAEIQAAC5REgKFPenOARBCAAAQhAAAIQgAAEIAABCEAAAgsgQFBm AZPMECEAAQhAAAIQgAAEIAABCEAAAhAojwBBmfLmBI8gAAEIQAACEIAABCAAAQhAAAIQWAABgjIL mGSGCAEIQAACEIAABCAAAQhAAAIQgEB5BAjKlDcneAQBCEAAAhCAAAQgAAEIQAACEIDAAggQlFnA JDNECEAAAhCAAAQgAAEIQAACEIAABMojQFCmvDnBIwhAAAIQgAAEIAABCEAAAhCAAAQWQICgzAIm mSFCAAIQgAAEIAABCEAAAhCAAAQgUB4BgjLlzQkeQQACEIAABCAAAQhAAAIQgAAEILAAAgRlFjDJ DBECEIAABCAAAQhAAAIQgAAEIACB8ggQlClvTvAIAhCAAAQgAAEIQAACEIAABCAAgQUQICizgElm iBCAAAQgAAEIQAACEIAABCAAAQiUR4CgTHlzgkcQgAAEIAABCEAAAhCAAAQgAAEILIAAQZkFTDJD hAAEIAABCEAAAhCAAAQgAAEIQKA8AgRlypsTPIIABCAAAQhAAAIQgAAEIAABCEBgAQQIyixgkhki BCAAAQhAAAIQgAAEIAABCEAAAuURIChT3pzgEQQgAAEIQAACEIAABCAAAQhAAAILIEBQZgGTzBAh AAEIQAACEIAABCAAAQhAAAIQKI8AQZny5gSPIAABCEAAAhCAAAQgAAEIQAACEFgAAYIyC5hkhggB CEAAAhCAAAQgAAEIQAACEIBAeQQIypQ3J3gEAQhAAAIQgAAEIAABCEAAAhCAwAIIEJRZwCQzRAhA AAIQgAAEIAABCEAAAhCAAATKI0BQprw5wSMIQAACEIAABCAAAQhAAAIQgAAEFkCAoMwCJpkhQgAC EIAABCAAAQhAAAIQgAAEIFAeAYIy5c0JHkEAAhCAAAQgAAEIQAACEIAABBZB4GlPe1o9TqeLGHQY JEGZAIMsBCAAAQhAAAIQgAAEIAABCEAAAusT+OY3v9mpHAMwlncq5dhuY7HddfuQEpTZh1lkDBCA AAQgAAEIQAACEIAABCAAgQIIPP3pJ8IMTUEUBVzUFgMvaf4b3/jGaiS2E2VWjU9mmuqjTMl5gjIl zw6+QQACEIAABCAAAQhAAAIQgAAEZkTAARcHZ1LXFXBRIMXBFqXWkazapet2B12sE2Ulbznl53gQ lJnjrOEzBCAAAQhAAAIQgAAEIAABCECgQAIKkviTc88BlxhskZyDLWp3YCbqq92BHuV12EaUm1ue oMzcZgx/IQABCEAAAhCAAAQgAAEIQAAChRJQoCQXLHFdfFLGdRqK8g7mKC85HQ7WOK806qmsw4Ga E6X5/HswH1fxFAIQgAAEIAABCEAAAhCAAAQgAIHSCeQCJLHuq1/9avXoo49Wjz/+eP05fvz4Kgjj p2T0VMzBwUF16qmn1p8zzjijOuuss1bBGzGINnOBmtI5yT+CMnOYJXyEAAQgAAEIQAACEIAABCAA AQjMlICCLg899FD18MMPV4899lj1xBNPHBqJgisxqKJ2faT39a9/fSUrGQVnzj777Orcc8+tnvGM Z9RtMTizEp5JhqDMTCYKNyEAAQhAAAIQgAAEIAABCEAAArskoKBIDICk5dS3r33ta9UDDzxQB2Oi XioXAzKxLdVRWTYVqLn//vvr4MwFF1xQnXnmmVFtle/ybyW4wwxBmR3Cp2sIQAACEIAABCAAAQhA AAIQgMBcCOSCJNF3tSsQosCJgiZKXRflNsnHQIuevNFXoRSUufjii1fBGffp99ds0t/UugRlpiaM fQhAAAIQgAAEIAABCEAAAhCAwAII6CtHCsY8+OCDq9E2PQWzEhiQaQoKKfhz11131V9puuSSS+qv NTkwM8D8TkQJyuwEO51CAAIQgAAEIAABCEAAAhCAAATmR8BPqij1LyQp/3//93/VvffeW9dFGY9w jCCJ7OYO1ysYJD+uuOKK6pnPfGZOtLg6fhK7uCnBIQhAAAIQgAAEIAABCEAAAhCAQJkE/LSKfyVJ AZEvfOEL1T333FM7rF9NkozSeDhwEuvWyefsqL/Yp3yRT3M4eFJmDrOEjxCAAAQgAAEIQAACEIAA BCAAgQIIKCiiAIjSY8eO1U/HPPLII3WdAyMKyEz1Phf1kR72SW327Stf+Ur9c9tXXnnloV92SnV3 XT4cutq1N/QPAQhAAAIQgAAEIAABCEAAAhCAQLEEHBRRQEZPpOh9LjoUGPFTMg6MbGsQ9sl+uF8F i/SuGf20dqkHQZlSZwa/IAABCEAAAhCAAAQgAAEIQAACBRLQC30dkIkBkZjfhdsKDKWHfj777rvv ruRziQdBmRJnBZ8gsDACuZvnwhAwXAhAAAIQgAAEIAABCMyCgAIvCsgo2FHaId/0SfcX8lU+7zpo lONFUCZHhToIQGCrBNpujk031q06SGcQgAAEIAABCEAAAhBYGIE0sOHhf/GLX6z0taAxjrZ9wLr2 5XfOrnyW7/GIck3jjfJT5AnKTEEVmxCAwMYEfIPU91L9orBo1O2xjjwEIAABCEAAAhCAAAQgMA6B 3HpbPzf9wAMPHOlAAY11ghrr6BzpvKUita+X/2oMPtyusebGa7kpU4IyU9LFNgQg0IuAboa+IcZU eb213W9u940yyvfqACEIQAACEIAABCAAAQhAYBABr8utpJfl+mem1aa1eZTxWt3yQ1LbUZp+htjJ ydq22uTjvffeW/9qlOpVTseRszFlHUGZKeliGwIQ6EVAQRcf8Wauej8po3bfUKOM9UghAAEIQAAC EIAABCAAgXEIaL3t/xi1xfvvv79+Wa6fYndQQ+2brs/Vl2zkPu5/ndT2rGufv/zlL6+CMd5jWGbb 6cG2O6Q/CEAAAikB3xxVrxunvu+pxwr1M3sXXnhhdfbZZ6cqlCEAAQhAAAIQgAAEIACBiQg4UKG1 uQ797PWDDz5Y51Xn9rpihH+uu+662qb7s/1PfvKTo/Ulmw40aSznnntudeaZZ042pr5YCMr0JYUc BCAwGQH9PN1//ud/Vrfddlt1++23H3qTu27M55xzTnXxxRdXl156aXXDDTdU11xzzWS+YBgCEIAA BCAAAQhAAAIQOExAT8lMdShY4mCM+3DZwRnXb5I6IGMbGtNVV111KBjktm2mBGW2SZu+IACBIwTu vPPO6uabb65/ou5I45MVuhE//PDD9efzn/98deutt1YveclLqh//8R9fRbZzetRBAAIQgAAEIAAB CEAAAsMIKBii9XcMlOgpGX10uH2Y1W7pMYMvTb2lfXhcelombWuyMUU9QZkpqGITAhDIEkhv4v/6 r/9aB2QcCc8qZSo/8pGPVJ/61Keqn/7pn66uv/76lURq3w2uj39c3NaWRnnbaJJvam+qz9mRrL62 9f73v//QH0I9WvkDP/ADtUrOXvRTQjmZWnnAP6lNq7reaVrvstJUJrbl8mP4nbNLHQQgAAEIQAAC EIBAPwJav+nQusxH/LUlt7tt7qnG5q8w7WosBGV2RZ5+IbBAAvEm/oEPfKB617ve1Urh4OCg0lve c4ci2+985zvrrzRddtlltUi0H3Vc701//CPjuijvfHzE0TbclqZq1yfalkzUS9tzZY1LwSofsnfl lVeugjJ6sVraRywrH/uMdobWWzf6GZm4XWn0IVeOsk15+xf7a5KlHgIQgAAEIAABCEBgGgJei2l9 p9cM6Kn1qY+mNezU/Wpseo/lM57xjKm7arRPUKYRDQ0QgMCmBHxDj3Z0w33ooYeq97znPfVGPsqc csop1ctf/vLq6quvrp797GdX559/fv1CMb0d/T/+4z+qf/u3f6tN+aatG+g73vGO6i1veUslXR+y 6eCBZZXmAhqSjT5YPtpSXZ8jlYt2pW+fXB/lY79ul47yOqJsXRH+SXXVlOpp7DqibMzXjQ3/uG/L p+WoZhn3rzblNfbIX3W2E/OSd73yHBCAAAQgAAEIQAAC2yXgtZjWaF/96lcnX5vF9WPsW6N221QE ZF+BmQsuuGDycTaNgaBMExnqIQCBjQn4phoN6eaugIyegNEm3YGK0047rfr5n//56tprr10FSaR/ 3nnnVc985jOr5z73ufVLfv/oj/6ojmZ7k3/33XdX73vf+6pXvepVh/TUj46Yuq/oj/LRzyiftqV6 Lks/jsV6qk/tqRz7sw3LWdf1th3b3eY016ax6nBbHHtsiz7aXkyln/qrulx97C/aUD7HxzI5+2md ZUkhAAEIQAACEIAABLZDQOsxfbXeR9P6z+2bpHo1gQ71EY+0HNs2ycex6D+M9Z/BuzpO/Nfprnqn XwhAYDEEvMm+5557qo9//OP1uB0o0NeU3vzmN1fPf/7z63rLqqC8b8bPe97z6q/xWE+pnpD50Ic+ VMtFvdpQ+CfaUbVtKm8916nsOrU3HZZJAw6SV51v9krlq+1ar8mu6qXjj3Tjofq2Q/bVvz46VJaO +41tfWy5rygrn2THNi0TU/fpsdsfy9ieU9e32bQMKQQgAAEIQAACEIDAtAS0Rvv617++6mTKNZrW ieov91k5MGImrq8fffTR1jXtiN1mTfGkTBYLlRCAwNgEdIPVjfwf/uEf6gCF7KtOxwtf+MLqWc96 1upmaNm68al/XPfKV76yfueKHjNUnb7nqvew3HfffdW3fMu3rJ68UcT7kUceWZmQrJ64Ofvss+t+ 5IttKtXx+OOPV/65P7fp+6X6Oe7cIRnLyYcvfOEL1f/+7/9W+rqV9C666KJa98ILL6zOOOOMlQn3 Z90vfelLq3fnSFdH/KMnvzQ++3zqqafWj1jazsrwkxnXyZ/PfOYzlV5epsdO9YdOPy1+ySWXVApu KZilOv1Bsk6047wYimU8NC75YB/FTME2+ShberrpW7/1W+v/cVAflvMfPz0lpZ9AFyv55p88l2/6 2XOP03qxb/IQgAAEIAABCEAAAtMT0JrOX13y2mzKXr3uczplX7Lt9a/600dr57POOmvqbrP2Ccpk sVAJAQhMQUABh89+9rP1TdA3QN0Q9R6ZeAOOefvhOj1Vc/XVV1e33XbbavMumc997nPVFVdcsbrB /vM//3P1L//yL1avU/1ak/tSv7Zpoa985SvV7/zO77hYp7L51re+9YisGqX/4IMPVu9973sr/SKU yvrIdrSvAI36/YEnf0Ep3uwVpFDQ4k//9E8rBWase8iBJwtqe9vb3rYamwIev/RLv7QSi30piPL3 f//31cc+9rFVoGcl+GRGsqeffnr1Xd/1XdWNN95YiWc87INtalzvfve7axHX/fIv/3L9NTMx1tgf e+yxlQnLKL3uuuuq1772tasxq05fNdNLnuP/uqyUn8y86EUvqn7qp36qDp7FevIQgAAEIAABCEAA AtsjoDWh13haw011eO05lf0uuxqbPlqbxnV6l96Y7YdX42NaxhYEIACBhMCdd95ZBx5crRvg5Zdf Xl111VWHghiq9w1aqfPSU5teAqygjPI+7rjjjur7vu/7XMymsqMjPr0RbWeVkkr7pmr9SpKe/NEL h3VEW+5L9WpXAEMvKlZg6IYbblD1oTFbPqZxfDFfK4d/rPPf//3f1Z//+Z9XCi6lh/2WrP7ofPCD H6w+//nPV294wxvqp3lULxn3Y5suy55l9ISL3u3j7/7Gvqyn9JOf/GT9BM2v/dqv1YGgv/mbv6k+ +tGPRvEj+U984hN14O5Xf/VX66d6jghQAQEIQAACEIAABCAwOQGtAR2UmbKzuNacsp8m2+pf61Y9 mb6rg6DMrsjTLwQWSOCuu+46Mmp9XUWHN/Mx77p4s1advsKkz7qH7Uo/2m6y5ydapOfP7bffXt1y yy2H/O6ypWCIfsZbb3dXYMmHgkQ6pO+vE3XZsq5TBYjkj78i5Hqnccyuu/fee+sng17/+tdX119/ /ZGxpDrySXU333zzkX5Un/qssp4k+tu//dv6D92nP/1pd12nOR016PFRPZ3zxje+sZbL/WNfcm3U QQACEIAABCAAAQhsRkDrtCkCFbk1XNOacLMR9NNW3zqmGGs/D6qKoExfUshBAAJrEdCN14GG3BMc esdL6YefrPEfEX1F6K/+6q8OBTE0Br2rRV9T0jtk9MKw//mf/6ne//73H3q3jd6n8id/8ifVb/zG b6zeM/PSl750JaM33H/4wx8+hESMXvayl9V18kH246F3uugrS2lARl+bUvDnmmuuqf/Q6Ekl/VpV lJM/Cpro1630yKb/KDr1mM1A/Vpfdfp613Oe85z63T6yrcCbdfxHTk/MOC99cbrsssvqr07pnTd6 4kZPE0nPh945o3fi+OXPrldq+7GOPAQgAAEIQAACEIDAuAS0Thz7iGtC29ba7tu+7dtcXKWqzz2Z vRIYMaP3VO7qICizK/L0C4GFEPDmXsPVExA+XK+XwpZ++I+HU70XJ30nir6SpK8CWUZ/RBQMUb3e U+MXE6tdL01TgMR/fF7xilesgiF6eiUNyujJmh/5kR9ZBSNk24fs6amS+EdT7dLRu1+URnkFTv7w D/+wngvp6qOx6N0wr3nNaw7Jul36ysdDXznTkyxnnnlmrK709SO9Iyf26aCc3l8jHQVldEhGHwVm 3v72t9cvFHZfShWYiUEZt6W+HHKAAgQgAAEIQAACEIDAKAT8H3GjGGswonWd1ni5Y5trvm2MNTdG 1Z14Zr6plXoIQAACIxKIgQzffM8999wRe5jGlH11qqdB0j8SDqzYA7frF5++//u/v672Hx3d9PUU jQ/Vx68wuV6p+lTk3u1K7Yfa9YJjBS98yJZ+zehXfuVX6l9/sp7br7zyyupNb3pT/etQsmNbt956 6+qXpyzblOpXkhRcyb0MTb+k9Z3f+Z2HVN3P93zP99RBljgG+avA3Ktf/eraF5V1iFH6ZJXa3H6o AwoQgAAEIAABCEAAAqMT2EagwmtVr0k1COedjj2wnF2elBmbMvYgAIEiCeRudvqKjTbauZtjKYPQ HyT5Zz/10jOV7bPa/bJf+2x5lb/927999ZUft/tntmVTf4zch9udql0/X+12PRGjsu3rF6Yk40P1 +qqTgkGuV6p6fWRHXznSEzx68bAP1eu9NHoRcdeh8egJGfskefXhP6r6KpR+/Ske8kdP++iwP07l l37OXGUfqtMLhdND9RwQgAAEIAABCEAAAvtBwOu/uK503m0aqdaAsbwfoz8xCr6+tE+zyVggMCMC uqn65lr6Rjv6J7+vvvrq+leE/IdB7e9617uqX/zFX6yf+lDZf0w0JRdddFH1gz/4g/XseNyeKsmq TgGNtM0ysuV2BWR0WFY/l63DdvQVoZe85CV1neudRjt6900MykhG76ZpOqKPklF/8XD/ktNXpnS4 TnkxOPXUU5WtD8npcGqduvKpf3JPyqT9RnnyEIAABCAAAQhAAALjEdD6M/efqpv2oPWf14le2zmV 7ZiPspv2a32vP11W6jV2rNtWnqDMtkjTDwQgcOgG65utAgVzO/QkiAIM8S3t9913X/Vbv/Vb9Xti XvCCF9Qvzk1fyKtxetxxzKrzHwenrrO866Oe+tf7WHQ4CHT++edX8SthDsTEVDb1tMxpp5126KcO HeCJfTjvoJDL8kcf++d6lfX0k47UZ7WlddZTMCk94nty1Jb6kMpThgAEIAABCEAAAhAYj8BUQRmv H522edxHpk2/b5vGuqvj6Cp4V57QLwQgsPcE9JUX/URyvLnqpbfpkdvspzK7LCvY8rrXva76i7/4 i1UwRP4o8KFfGtJHY5TctddeW3/0wloFHnJjywUqXBfTyE396ckWt7stfXGy6iXjgIbllOorRfHp GP3yk977c/rppx+aI/UlG7alsg7bOlE6/G8qKzb29bDkiVJqKy1LKuqn9nM2qYMABCAAAQhAAAIQ WJ+A1q7pV/TXt3ZS0+tK1cQ1nepjcMRycQ140sq4OZ6UGZcn1iAAgUIJ5Db7uaBMuiH3jTitbxum bui+yTfpub3NTq5Netdff339R0o/RR1/Vcry8vnLX/5y/dG7WvT0ir7CpJ+/7nPT9x8h2fNYbNtp DKi4ToEWHenYzNBySuWTbERZlfUz2rkjZyMnp7pUNv6Bzemk8irLr6YjlW+Sox4CEIAABCAAAQhA YDgBrcP0ZHj8oY7hVvIacY0X13RxTWrN2O66MVP3Gb9mP6b9PrZ294xOH++QgQAEZk0g3nA1EAUM 0rpcUCYdtHR8w1Sbb85KnbeO7ccnM1I56yi1vPVzqeXd5vKLX/zi6jd/8zerH/7hH67OPvtsN69S y6nioYceqv7u7/6u+u3f/u3657FXQplM6pfGkh7y218Tim1RNvYfZZz3d4SjXO5rRJYnhQAEIAAB CEAAAhBYBgGtD/VV930/vO7eZVCGry/t+1nG+CCwQwJxsy83rrrqqvpXeWIgxL+wo7pUPnXdevoJ 6A996EOHmvXrPT/2Yz/W24aVY58KaOT8cJ2e9rC8UtXrj9WrXvWqOjBzzz33VP/1X/9VfeYzn6l/ 8jq1Jx29t+WP//iP65+lVgDEtqM/qus6ZEsvz00PfQXJ+k7tq2Xdp2XVro/Gl7NpPVIIQAACEIAA BCAAgWUQ0HrRQZl0LblPBLwOPuOMM3Y2LIIyO0NPxxBYHoErr7xy9W4Tj/6OO+6o9Cs7eoomvnNF N8j08B+E2267rfr0pz9dBx8c+JDteDR9XSZnV3r6wxODLrZlebc5oKHUepLRV5Lkg776o59+1kt4 b7/99ko/WX3XXXetAiWSVfnDH/5w9YpXvKIOhqhO9jWW2I99aEr1i0XWk4zs6IkcpTrsq2R0uL4u PPmPuLtOspoDP31jXcuSQgACEIAABCAAAQgsh4DWiHoS3GvefRu5xqex+aN3X+7q4OtLuyJPvxBY IAE9zaJAQry564aon2ZWQEZBCR0OFKR5BxcUyHGbbT3nOc+p6/yPgwuWU+pfS7KOZS2Tq1ed/LFP Tq3rNqX2T6kegdR7Z97ylrdU3/u932vxWkY277777lWd+1DqINOq8clM2qfbxEwvE5aeDqV68kjv stFhPdl03n197nOfO1Qn+UsvvXQ1BsurngMCEIAABCAAAQhAYHkEtB6MT5B4zbkPJLxu11hy773c 5hh5UmabtOkLAgsmoJu6nibRV4z+7M/+7BAJBWX01EjuvSzx5i8bH/nIR+onPGTAAQYFYK655ppD NuPPUduGvyqVC3xIWUEb9WF5G4zlj33sY9Vf/uVf1k3u/4d+6IfqrzDZrmzoRq9Uh9r1xIzlVeeg jOuUWl/t8VBb03H55ZevgjCSUZ/6atdP/MRPrMaR6+PWW29d+Wc/L7nkklVdU3/UQwACEIAABCAA AQgsg4DWkHqS2j9q4TXjPow+jkU/fuH18i7GxpMyu6BOnxBYCIF4s3Ng4YUvfOGRX/fRy37f/va3 V3rHiY6oF1EpqKJfO/LhIMZ3fMd3HPlFo4svvthiq1RPhxw/fnwVrFg1PJnRm+X/+q//+kib/bas 3osj//RR/0r1NSUdUTaO4bHHHjvUJlk9MaRDcv4joFRP2EQ7knn44YeVHDkkp4CPjtifglz33Xff Sl5t/t8A6eidN/oKWOxH/erXoaKdlQEyEIAABCAAAQhAAAKLIeA1otaF55xzzqE1475B0Fj1H8O7 XAMTlNm3s4rxQKAgAr6hR5dUp6dl4qGboL5y87u/+7v1kzAPPPDA6uavNgVr3vve91Zve9vbVpF6 6cuWovevec1rork676BH9EFBnVtuuaX+KWsrKEijd7zcdNNN1b333uvq1Y1Z/Ucb5513XnX++eev 5JTRC35vvvnmWifKqk36//iP/6jsoePqq6+uy2rXx4f89k9m25beE3PnnXdaZJVKT0/KfPd3f/eh J3MUBPr93//96rOf/WwtKzvu4xOf+ET9omEHlNzHK1/5yr3+3vAKGhkIQAACEIAABCAAgVYCXjdq naivy+eeZm81MKNGjS2+9mAXrvP1pV1Qp08ILIhADAg4/9znPrd+38rHP/7xQyQUNHnnO99Z1ynY ctZZZ9XvSPG7YCysPxSypc/rX//6Kn0xl9p1g73uuuuqT33qU1ar5fW1HdUpmPHoo4/WARUFZtJD tn34D5PKqn/d615X/cEf/MEq0KH6D37wg/UTMzfccMPqKRi9SFdj9DteJKdDN375piP247ICM/qV Jver9Pd+7/fqFwlLV583vvGNEq+PH/3RH637UTBGh+T1mKkCM+Kg9+1ojArs+PHTWvApWQWaFJSJ h/xy/7G+lHzp/pXCCT8gAAEIQAACEIDAEAJa/2mdFddaWpvqyXYdbh9is0tWfe3q8H/k7qp/9UtQ Zpf06RsCCyAQN/Yx/3M/93P1zV7vaNERb/wq6+kYfXI3fskqaq+fon7e854n8UOHb+x6r4p+pclB F/cvu/EPi5VlU7KxT+tYRqn61C8spU/AKKj0vve9L4oeynuMCiTp/S1Nh14QnNrWky16okdHqqvA yxve8IbqHe94R/XII4/ULG1bX33S0zEek8fjd94oIPMLv/ALR/6HwF8Ns50SUvMrwRd8gAAEIAAB CEAAAvtIwOtorxk1Rv0HqD76zz23jz12r1XHthvtpX14XBrTLte+fH0pzhJ5CEBgawQUFPjZn/3Z 6sYbb6xOO+20OmiQ69wb8fgH4PnPf37167/+60ee7kj19bJfBWYUbNHhPy626bLaJPvmN7+5Dk7E vmJecjpUp6DMa1/72vpJlGhHbamOy3qz+8/8zM/UTwmdsJT/V0+t6J040W6UzNW/4AUvqJnoKaR4 uO/4ThkHZPQunre+9a2VfhUrPaznevWZ1rktpn1konyfvMfrVDox38cGMhCAAAQgAAEIQAAC6xPI va9xfWuHNb3OjOtI5fUZc83nNbB795jG7MO2h6Q8KTOEFrIQgMBoBHzzVQDixS9+cfWBD3yg/lrR /ffff+jmKzndQPVWdD0hovenvOhFLzrkh20dqnyq8PKXv7x+skUv8dWTJpLVx4e+JnXttdfWwRv9 5J8+x44dc3M2tY2XvvSldYBFT8foxbn6utITTzxR/wGJf0T0gjT9upQ+bQEod6avJ73pTW+q3vOe 91T//u//XvvrP1KK4jvIZHmnYiS9f/qnf6o++tGPVl/84hdXY41jvuKKK6qXvexllfxXffoHyvac SsbjsR9uS9PYT9qmsu3k2prquvps0qMeAhCAAAQgAAEIQGA9Al7TeZ2op0r0hPWDDz5Yr+fGfrLE rxxI131peb3RnNDymlYljUVj8jFmP7bZN33aTTfddHJ30lcLOQhAAAJrEtANzzd5m3BZbfoKkIIb +tqNygrEXHTRRfWvElku6qU3UN9s3U9M9dUevd9FfegrPwpO6L01Qw7bjzquUzBHthUMUb96+kbf U9UNP/U96jtvX1W2TX3VSu+X0R9ABWv0kmG9D0f59LCO7cgXvTRZNvTyYI1ZLPVHyIdk9UfVh8rp YXtp/Tpl+zhEdx2dIfaRhQAEIAABCEAAAhA4SiBdA+pr/nfccUf9dX8Fa7SGdNAmlT1qrb3G+krT Q2vBdQ/bsw2l8llPl+vXR70Otty6/WyiR1BmE3roQgACvQnEjbVvulZ22TdJ3zRdL7mYT/VcTlPr KI1/NCwXfXJdTNP2tGz71knLrndqfaeuV9qlG2Vz+Tb9tracra666H+X7dge9br6oB0CEIAABCAA AQhAoDwC+s++u+++u167Ru+05tOh9V5JR1yL2i99dV9Py8djl+tU3ikTZ4I8BCAwKgHdBH2DdqoO HJGOnflG6Bt5egN1faqjsmVjH6q3jlJH8VXvo0k+1y7ZnHysUz85uWivqd2+RnvSc33MpzKxTfl4 SD/yTnVz9qN+Lp/aaJKRXLTfRy9nizoIQAACEIAABCAAge0TyK3dFMzI/WKR1nxx3dfX23V0+tqW XGpfT53HgIzbNdbceIf0ta4sQZl1yaEHAQh0EtBNzje6KJze8CSTq4s6bXnpO+iSs6O62EcqI9uq c73Ttj7dlo5PZdc5tazSXF1be86vNhup71G/q3/JttmOfjrfJK96fVJ/rLdOOqatdfpHBwIQgAAE IAABCCyJQNM679JLLx38CoAmblOs75rWoHptgXyPR+y/abxRfoo8QZkpqGITAhDYOgHfRJ3aAd1o XZemllHqtjRvmdjuuq403uS7ZNvah/Q9RFZ9pj6m5Ta/+rQN9afN5pi22vqhDQIQgAAEIAABCECg mYDWi/oKkH4go7RDvumTrhvlq3wee607xvgJyoxBERsQgAAEIAABCEAAAhCAAAQgAIGFENCPSCjI oR+0iIGOmN8FijQYIx8UkHnWs55V//DFLnzq6pOgTBch2iEAAQhAAAIQgAAEIAABCEAAAhCoCTjw ol8DdWBGDQqI6F2GatcnFyCZCqF9sh/uR19Zuuqqq6qDgwNXFZcSlCluSnAIAhCAAAQgAAEIQAAC EIAABCBQJgEHW5QqMPPsZz+70gt0FRjRex51+JdPpxhBDMDYvn2KPsgn+ZaTt14JKUGZEmYBHyAA AQhAAAIQgAAEIAABCEAAAjMg4CCHAjAKviggctlll9VPzch9Py2jNB4OnMS6dfI5O/JJH/epJ3jk 0xyOcp/hmQM9fIQABCAAAQhAAAIQgAAEIAABCCyIgIMiSh2g0fD1U9N6x8z9999fPfjgg4fa1B5l VV7nSPu0Dft03nnnVZdcckn9BI/rLFNqSlCm1JnBLwhAAAIQgAAEIAABCEAAAhCAwIwI6AXAl19+ eXXuuefWwZmvfe1r9ZM0YwRkhEF29HHAxXkFgy6++OI6KCQ5P63TFMSRTCkHQZlSZgI/IAABCEAA AhCAAAQgAAEIQAACBRNwEMQu5spqU5BEL9hVUOaBBx6oHn744VUgxbrrpjHQcvbZZ1cXXHDBKhhj m/JLh75i5QCO20pLCcqUNiP4AwEIQAACEIAABCAAAQhAAAIQKJBAGuBIy6nLCs7oc/z48eqhhx6q gzOPPfZY9cQTT6Si2bKDPjE9/fTT6ydxzjnnnM6vKXX5l+10y5UEZbYMnO4gAAEIQAACEIAABCAA AQhAAAJLIqCfpL7wwgvrjwIljzzySPXoo49Wjz/+eP1R0Eb1Ctbo6RYFYZTqoyDMqaeeWp122mmV fuJabQ7SzCHo0jXPBGW6CNEOAQhAAAIQgAAEIAABCEAAAhCAQG8CDppEBdXpUCBFT7noq0c5OetI TkEZvR9GqcoOwji17JxTfhJ7zrOH7xCAAAQgAAEIQAACEIAABCAAgYIIxOBJdMv1DrT0CchIJwZk lN+3Y/9GtG8zxHggAAEIQAACEIAABCAAAQhAAAIzIaBgiz85l+OTL7l21Tlwo7zkdcS6umJP/iEo sycTyTAgAAEIQAACEIAABCAAAQhAAAK7JuAnYBxMSf3xky+Sazr8hIzaLSd7zke9XF1sLz1PUKb0 GcI/CEAAAhCAAAQgAAEIQAACEIDATAg4GNMULFHARUdT6mGqvcmGZaKdWDenPEGZOc0WvkIAAhCA AAQgAAEIQAACEIAABAom0CeQEt23vNPY5sCN6nLtlm1rs0ypKUGZUmcGvyAAAQhAAAIQgAAEIAAB CEAAAhDoJBCDN53ChQkQlClsQnAHAhCAAAQgAAEIQAACEIAABCAAgWUQICizjHlmlBCAAAQgAAEI QAACEIAABCAAAQgURoCgTGETgjsQgAAEIAABCEAAAhCAAAQgAAEILIMAQZllzDOjhAAEIAABCEAA AhCAAAQgAAEIQKAwAgRlCpsQ3IEABCAAAQhAAAIQgAAEIAABCEBgGQQIyixjnhklBCAAAQhAAAIQ gAAEIAABCEAAAoURIChT2ITgDgQgAAEIQAACEIAABCAAAQhAAALLIEBQZhnzzCghAAEIQAACEIAA BCAAAQhAAAIQKIwAQZnCJgR3IAABCEAAAhCAAAQgAAEIQAACEFgGAYIyy5hnRgkBCEAAAhCAAAQg AAEIQAACEIBAYQQIyhQ2IbgDAQhAAAIQgAAEIAABCEAAAhCAwDIIEJRZxjwzSghAAAIQgAAEIAAB CEAAAhCAAAQKI0BQprAJwR0IQAACEIAABCAAAQhAAAIQgAAElkGAoMwy5plRQgACEIAABCAAAQhA AAIQgAAEIFAYAYIyhU0I7kAAAhCAAAQgAAEIQAACEIAABCCwDAIEZZYxz4wSAhCAAAQgAAEIQAAC EIAABCAAgcIIEJQpbEJwBwIQgAAEIAABCEAAAhCAAAQgAIFlECAos4x5ZpQQgAAEIAABCEAAAhCA AAQgAAEIFEaAoExhE4I7EIAABCAAAQhAAAIQgAAEIAABCCyDAEGZZcwzo4QABCAAAQhAAAIQgAAE IAABCECgMAIEZQqbENyBAAQgAAEIQAACEIAABCAAAQhAYBkECMosY54ZJQQgAAEIQAACEIAABCAA AQhAAAKFESAoU9iE4A4EIAABCEAAAhCAAAQgAAEIQAACyyBAUGYZ88woIQABCEAAAhCAAAQgAAEI QAACECiMAEGZwiYEdyAAAQhAAAIQgAAEIAABCEAAAhBYBgGCMsuYZ0YJAQhAAAIQgAAEIAABCEAA AhCAQGEECMoUNiG4AwEIQAACEIAABCAAAQhAAAIQgMAyCBCUWcY8M0oIQAACEIAABCAAAQhAAAIQ gAAECiNAUKawCcEdCEAAAhCAAAQgAAEIQAACEIAABJZBgKDMMuaZUUIAAhCAAAQgAAEIQAACEIAA BCBQGAGCMoVNCO5AAAIQgAAEIAABCEAAAhCAAAQgsAwCBGWWMc+MEgIQgAAEIAABCEAAAhCAAAQg AIHCCBCUKWxCcAcCEIAABCAAAQhAAAIQgAAEIACBZRAgKLOMeWaUEIAABCAAAQhAAAIQgAAEIAAB CBRGgKBMYROCOxCAAAQgAAEIQAACEIAABCAAAQgsgwBBmWXMM6OEAAQgAAEIQAACEIAABCAAAQhA oDACBGUKmxDcgQAEIAABCEAAAhCAAAQgAAEIQGAZBAjKLGOeGSUEIAABCEAAAhCAAAQgAAEIQAAC hREgKFPYhOAOBCAAAQhAAAIQgAAEIAABCEAAAssgQFBmGfPMKCEAAQhAAAIQgAAEIAABCEAAAhAo jABBmcImBHcgAAEIQAACEIAABCAAAQhAAAIQWAYBgjLLmGdGCQEIQAACEIAABCAAAQhAAAIQgEBh BAjKFDYhuAMBCEAAAhCAAAQgAAEIQAACEIDAMggQlFnGPDNKCEAAAhCAAAQgAAEIQAACEIAABAoj QFCmsAnBHQhAAAIQgAAEIAABCEAAAhCAAASWQYCgzDLmmVFCAAIQgAAEIAABCEAAAhCAAAQgUBgB gjKFTQjuQAACEIAABCAAAQhAAAIQgAAEILAMAgRlljHPjBICEIAABCAAAQhAAAIQgAAEIACBwggQ lClsQnAHAhCAAAQgAAEIQAACEIAABCAAgWUQICizjHlmlBCAAAQgAAEIQAACEIAABCAAAQgURoCg TGETgjsQgAAEIAABCEAAAhCAAAQgAAEILIMAQZllzDOjhAAEIAABCEAAAhCAAAQgAAEIQKAwAgRl CpsQ3IEABCAAAQhAAAIQgAAEIAABCEBgGQQIyixjnhklBCAAAQhAAAIQgAAEIAABCEAAAoURIChT 2ITgDgQgAAEIQAACEIAABCAAAQhAAALLIEBQZhnzzCghAAEIQAACEIAABCAAAQhAAAIQKIwAQZnC JgR3IAABCEAAAhCAAAQgAAEIQAACEFgGAYIyy5hnRgkBCEAAAhCAAAQgAAEIQAACEIBAYQQIyhQ2 IbgDAQhAAAIQgAAEIAABCEAAAhCAwDIIEJRZxjwzSghAAAIQgAAEIAABCEAAAhCAAAQKI0BQprAJ wR0IQAACEIAABCAAAQhAAAIQgAAElkGAoMwy5plRQgACEIAABCAAAQhAAAIQgAAEIFAYAYIyhU0I 7kAAAhCAAAQgAAEIQAACEIAABCCwDAIEZZYxz4wSAhCAAAQgAAEIQAACEIAABCAAgcIIEJQpbEJw BwIQgAAEIAABCEAAAhCAAAQgAIFlECAos4x5ZpQQgAAEIAABCEAAAhCAAAQgAAEIFEaAoExhE4I7 EIAABCAAAQhAAAIQgAAEIAABCCyDAEGZZcwzo4QABCAAAQhAAAIQgAAEIAABCECgMAIEZQqbENyB AAQgAAEIQAACEIAABCAAAQhAYBkECMosY54ZJQQgAAEIQAACEIAABCAAAQhAAAKFESAoU9iE4A4E IAABCEAAAhCAAAQgAAEIQAACyyBAUGYZ88woIQABCEAAAhCAAAQgAAEIQAACECiMAEGZwiYEdyAA AQhAAAIQgAAEIAABCEAAAhBYBgGCMsuYZ0YJAQhAAAIQgAAEIAABCEAAAhCAQGEECMoUNiG4AwEI QAACEIAABCAAAQhAAAIQgMAyCBCUWcY8M0oIQAACEIAABCAAAQhAAAIQgAAECiNAUKawCcEdCEAA AhCAAAQgAAEIQAACEIAABJZBgKDMMuaZUUIAAhCAAAQgAAEIQAACEIAABCBQGAGCMoVNCO5AAAIQ gAAEIAABCEAAAhCAAAQgsAwCBGWWMc+MEgIQgAAEIAABCEAAAhCAAAQgAIHCCBCUKWxCcAcCEIAA BCAAAQhAAAIQgAAEIACBZRAgKLOMeWaUEIAABCAAAQhAAAIQgAAEIAABCBRGgKBMYROCOxCAAAQg AAEIQAACEIAABCAAAQgsgwBBmWXMM6OEAAQgAAEIQAACEIAABCAAAQhAoDACBGUKmxDcgQAEIAAB CEAAAhCAAAQgAAEIQGAZBAjKLGOeGSUEIAABCEAAAhCAAAQgAAEIQAAChREgKFPYhOAOBCAAAQhA AAIQgAAEIAABCEAAAssgQFBmGfPMKCEAAQhAAAIQgAAEIAABCEAAAhAojABBmcImBHcgAAEIQAAC EIAABCAAgfkSeNrTnla086X7VzQ8nIPABAQOJrCJSQhAYE0C3/zmN6uS/lDKHw4IQAACEIAABCAA gf4EmtZPpazxvvGNbxS13uxPFkkI7CcBgjL7Oa+MaiIC+mMaAydNf3SHdB//QMf8EBvIQgACEIAA BCAAAQiUS6CkNZ7Xs6YV17auI4UABLZHgKDM9ljT0x4QcBDG6RhD0v9WNB1tbU061EMAAhCAAAQg AAEIlEng6U9/ejX1+k59tB1pgEjyY61t04BPmx+0QQACJwgQlOFMgMAOCcQ/gPEPpOpVPuWUU3bo XTXaH+idDoLOIQABCEAAAhCAQAEEvNbb9fouRTHm15ni2jbthzIEIJAnQFAmz4VaCPQiMOYfHtny /5yM+T8WvQaCEAQgAAEIQAACEIDApATGXDeO7eg6vjnINLYv2IPA0ggQlFnajDPejQis8wdrSIdd j5sOsYUsBCAAAQhAAAIQgAAEpiIQ18UEaKaijN0lECAos4RZZoyHCMQ/IIcaKEAAAhCAAAQgAAEI QAACgwlssr4moDMYNwp7RqD9LVB7NliGUy4B34yd9vG0Sza26w+FP31sIwMBCEAAAhCAAAQgAAEI TE/Aa3SnaY9xTa+2tJzKx3IfWfXLAYFdEuBJmV3Sp+8VAb9gzKlujvEmmrtZ5upsULp+P4vrSCEA AQhAAAIQgAAEIACBsgnENb7X9Epd7zQdhfcOare885Z1vctKrRfryENgmwQIymyTNn2tbpC++TkI 47LfqeKykancdAO2TEyHyEY98hCAAAQgAAEIQAACEIBAGQRiUCXdHzR5aDnvK6Ice4RIg3wpBAjK lDITC/HDN0Kn6a8MHT9+vEpvoOs88ZLaWAhehgkBCEAAAhCAAAQgAIFZEvCaP13HP/HEE/X+wO19 Bicb0tMR7Tlg08cGMhDYFgGCMtsiTT9ZAg7OqFH5U045pU79ZIxS12UNPFnpm6v0Y75JnnoIQAAC EIAABCAAAQhAoCwCMXgSPfNeoKndsuk+QHrpEfcLaRtlCOyKAEGZXZGn35pADMqowpFw1zttwxVl Yj6no5t1l0xOjzoIQAACEIAABCAAAQhAYPsEvD/o6jld46dl67veQRzXk0JgVwQIyuyK/EL79U2w afhdEfAmvb71Xf33tYMcBCAAAQhAAAIQgAAEIDA9gan2B3FfQIBm+nmkh2YCBGWa2dAyAoF4sxvB HCYgAAEIQAACEIAABCAAAQiMSiDuWQjQjIoWYz0IPL2HDCILIRBvRh5y102prT1nz3ZJIQABCEAA AhCAAAQgAAEIlEZAe5jcPqZt31PaGPBn5otNKQAAQABJREFUXgR4UmZe8zWpt7kbTbwhxbwdcZ10 lXfqdlIIQAACEIAABCAAAQhAAAJzIxD3OfJdv/7kvU5u3zS38eFvOQQIypQzF0V7ohtPevNxEEaO K6/ve+Z+0rrogeEcBCAAAQhAAAIQgAAEIACBpwg48GIgaXAm7oliPpV3mRQCXQQIynQRor0moMhw 7tDb0HUoIKO8f7IuvZnldKmDAAQgAAEIQAACEIAABCBQEoGmX3vyvif1NX0RcS5Qk+pQhkAkQFAm 0iCfJRCfiIkCqncQRvUx74hylCcPAQhAAAIQgAAEIAABCECgZAIKsug/pNNgS9zrEHgpeQbn5xtB mfnN2VY8ToMqadlOxPqYdzspBCAAAQhAAAIQgAAEIACBORFIAzLyPe51Yr5rXARwugjRTlCGc2BF YMjNZaVEBgIQgAAEIAABCEAAAhCAAASyBOIeiwBNFtHiKwnKLPwUiDeJhaNg+BCAAAQgAAEIQAAC EIAABCYjEPdeBGgmwzw7w0+fncc4PAoB3RDiTWEUoxiBAAQgAAEIQAACEIAABCAAgUYCDsZ4L+bU Cm5XOebdTrp/BAjK7N+cHhmRL/Q0PSJIBQQgAAEIQAACEIAABCAAAQhMRsB7MnXgvFLn9ZLhmCcw M9lUFGOYoEwxUzG+I7qA9fGLqpTqp9y4sMdnjUUIQAACEIAABCAAAQhAAALrEvAeTXu2mFeQxuV1 baNXNgHeKVP2/GzknS5gfXQ4IBN/ym0j4yhDAAIQgAAEIAABCEAAAhCAwCgE9J/nOvwf6srriRmV /eSM6jj2jwBBmT2aU12sMYqqvIIwOtRGQGaPJpuhQAACEIAABCAAAQhAAAJ7Q8B7Ne/nvLfjSZm9 meLGgRCUaUQzv4Z4Aee8TyOskk/rcnrUQQACEIAABCAAAQhAAAIQgMB4BNK9mPdlemLGX2FyYGa8 XrFUIgHeKVPirGzgky/mPiaGyPaxhwwEIAABCEAAAhCAAAQgAAEIdBNo2ov560tuV+p8t1Uk5kiA J2XmOGvBZy7QAIMsBCAAAQhAAAIQgAAEIACBPSTgfZ+/HbGHQ1zskHhSZkZTzwU4o8nCVQhAAAIQ gAAEIAABCEAAAiMTiE/OKO89otKYV7cuj+wC5kYmQFBmZKBTmHNU1L+kFC/EKfrDJgQgAAEIQAAC EIAABCAAAQiUS8ABGe8Rleqj+lhHYKbcObRnBGVMorDUkU6nci/9OTT/bFphruMOBCAAAQhAAAIQ gAAEIAABCExMQPtB7RcdoFFee0a/l8b7R9VzlEuAd8oUNje+qGJ0Uy7qgvKbuO2yfzbNZVIIQAAC EIAABCAAAQhAAAIQWAYB7Qe9R4z/Ye+gjII1Dswsg8g8R0lQprB504Wjw9FMXUQO1DgI47JlCxsC 7kAAAhCAAAQgAAEIQAACEIDAxAQckFE33je6Sz89o//s997SbaRlEeDrS2XNR/3omS4gf+Segy+O fjotzHXcgQAEIAABCEAAAhCAAAQgAIEtEVAgxt+wUJfeQ3q/6NT7yS25RTcDCRCUGQhsKnFfQG32 ddHpcNomSxsEIAABCEAAAhCAAAQgAAEI7DeB3N7QdU5FgMBMuecBQZkdzE18fKxPMGYHLtIlBCAA AQhAAAIQgAAEIAABCOwRAfaeZU4mQZkdzAtRyh1Ap0sIQAACEIAABCAAAQhAAAIQOPLUTHxoADzb J0BQZkvM44nuoIzTLblANxCAAAQgAAEIQAACEIAABCAAgdX7Z4SCfeluTwiCMlvirxPdgRl9t48T f0vg6QYCEIAABCAAAQhAAAIQgAAEsgS8R3WaFaJyUgIEZSbFe9K4TnK9GVvBmOPHj9cNnPgn+ZCD AAQgAAEIQAACEIAABCAAge0S0N5Ue9T4K07b9YDeCMps6RyIvw/vt2DztMyW4NMNBCAAAQhAAAIQ gAAEIAABCBwhoL2pHhbggYEjaLZWQVBmC6gdfHG6hS7pAgIQgAAEIAABCEAAAhCAAAQg0EngiSee qJ+WYb/aiWoSgYNJrGIUAhDYCwI8xrgX08ggIAABCEAAAhDYIgE/Fb/FLukKAhsR4JzdCN/GygRl NkbYboBoYzsfWjcjQNBkM35oQwACEIAABCAAgbEJbGt9xkZ67JnDngh4/8rXmbZ3PhCUmZC1T+gJ u8D0SAR009F8OR1q1jetoXO+rT/aQ8eDPAQgAAEIQAACEIBA2QTWXUf2DeZ4XezUNNKy60n3i4D3 Rvs1qjJHQ1BmgnkZujGfwAVMDiSg71HqD5TTvur6Y2g96aR/5Nb9Y9m3f+QgAAEIQAACEIAABCAw hEDX+tTrWa+LnfbV8/rY8rY3xEdkyyDgfa3/A7oMr/bPC4IyI8ypo8VpOoJpTExMwH80/MfilFNO GdSj9ZxGZf8hinXkIQABCEAAAhCAAAQgUDIBBWG8CfdaWf7m1rseh+VV9nraqWWUepMf68iXTUBz 6/ll/qaZK4IyI3DVzUonqn7jXTerePMawTwmNiCgeWm7eeiPRWzXH6F4xLZY3yfvm1cfWWQgAAEI QAACEIAABCDQl4D3HH3lh8hpfRz/czFdH7fZ6lr/tgV22uzStjsCflJKHmj+Ntkf7W4UZfdMUGaE +fHG3zeZdKM/QheYWJNA103Df2T8hy2mfbqMf7Cs20cPGQhAAAIQgAAEIAABCKxLIK5B17XRpGfb XtumQZomPcnriPppWW2Wq4X5p3gCmi8H27r2VsUPplAHCcpMMDGcrBNAHdmk/1jYrIIzutk4Tdst 15auo9NmjzYIQAACEIAABCAAAQhMTUB7F2+6Y19e23p9HNtyecvbnv/z07bd7tQ2CNKYRHmp5krz E/e3ns/yvJ2vRwRlNpy7eIJuaAr1iQmkfwBid765OI1t5CEAAQhAAAIQgAAEILCvBLrWv13tKRfL O03b03K6RidIkxLaXZm52A57gjJrciYYsya4idUczU1v7hN3i3kIQAACEIAABCAAAQhAYAQCXet4 AgUjQN7AhPfBfYNuG3S1GNUTX/xbzHDHGahPxHGsYUUE+lzUORndtONHtrpu5JLhgAAEIAABCEAA AhCAAATmR8Br/+i59wlO3ZaWXU+6OQHviZ1ubnG5FgjKDJh7nXCcdAOADRD1d07TgEq86UaZWD+g G0QhAAEIQAACEIAABCAAgT0gEPcD2qOp7FTDU9n7hz0YbpFD8N5YqT+powTGUiJHy3x96SiTIzU6 kXSSOT0iQMVGBHTD9GOIBwcHhwJfrlcHykuWAwIQgAAEIAABCEAAAhCAgAh4f+B9Q0zTgICDCJAb n4BZe8/sFObdrAnKdDNaXeg9RBFZg4BvnFI9duxYNvjli9oXu7vxRZ7Wu50UAhCAAAQgAAEIQAAC ENgfAv7P8nRETU/FxH1C3Hek+pQ3IyD+4uv5ifs05zfrYX+1+fpSj7nVhRwv5h4qiKxBQFHuU045 pdZUau5m77Zo2jKxjjwEIAABCEAAAhCAAAQgsJ8EtP7PbfK1V4h7CJcjBT9VE+vIj0PAAS/v3Ww1 N1duIz1BgCdlOs6E9CTShewTrkOV5p4E4s3ReafRhKKv6UUe28lDAAIQgAAEIAABCEAAAvtPILcn SPcPadlUXM+ezkQ2T8VUPJ3KoudIabqn3rzH/bLAkzID55OLdyCwDnHfFHNi6cXrCzsnSx0EIAAB CEAAAhCAAAQgAIG+BNr2IX1tIHeCgPfITlXrvZxTWDUT4EmZZjarE6lFhKaBBIbc/AjCDISLOAQg AAEIQAACEIAABCDQm0BubxIDC70NIZgloIAMe7osmkOVPClzCMfJAhG9kyz65touON3wcje9vraR gwAEIAABCEAAAhCAAAQgsG0CbXucbftCf/tJgKBMMq8KxhCQSaD0KCrgknvjOcGYHvAQgQAEIAAB CEAAAhCAAASKIRD3MN7j8B/M600P++tubgRlnmTk6KdSfbjguk8cS5gZbzc3EVIIQAACEIAABCAA gSUT0Ndf/BUYp0vmMbexOwgjv7Uv1D5Hh+bSex+lHP0JmFt/jWVJ8k6ZJ+db0TudKI6I6oJTnpto 98UQb1rm6CeNuFl180MCAhCAAAQgAAEIQGC/CMT/4I35/Rrl/o5GQZg4b8ePH6/3iukex0Ea1+8v kc1Hpj2jeW1ubf8s8KTMU3PqgIIDMU73b8rHHZE5KXUUmUjouIyxBgEIQAACEIAABCAAAQhsh4AD Mt7neI+jVPsc1buNgEy/OREv/sO+mRVPyjzFhguq+SSJLbpJ6aLyzcptKjuw5TpSCEAAAhCAAAQg AAEIQAACcySgpzsUSHDq/Y9Tj8kBGpdJ8wS83yY4c5QPQZknmfgEOYqHmpRALiBjmdwF1iZvPdJy CXBtlDs3eAYBCEAAAhCAwDwI5NbI8/B82V563pw20XCQhuBMEyHquwgsJijT9BQHm86uU+Rwu286 h2ubS23yTXPSbI2WvgQ4r/uSQg4CEIAABCAAAQhMS2DTdVlXUGBa77Hel4D3PQRn2on5euC8Pslp MUGZ3KT7hDiJY7k58eni4RvNWJRyczKW7bna6ZqDuY4LvyEAAQhAAAIQgAAE1iMw1vqQtfdh/rkn +nN1h7W6S9ozNQVm+uy5unvYDwmd15yTJ+ZyUUEZ39A4AY5eyH4jdnoTGTsQc7TnkzWeF8/TyRZy EIAABCAAAQhAAAIQgMAmBFhjV4eCALl9Tq5uHebpnso2mAOTOJGax9KDM4sIyjgiGVMHIQ6fFsst OZp7cHBQPzHjC2RqIu5X/fjmFW+G2/Jj6nFiHwIQgAAEIAABCEAAAhDYHoG40Y97DnsQ9xxqz+1F LLtuGn2QDfY2R0mKkTktlc8igjLpBeby0VOCmmPHjtUXhS8IXyBTkVFwzIf69Md1U/fvfvYtFTfP 4b6NjfFAAAIQgAAEIACBJRLw2o71cb/Zj0EX5yO7mHe70349tEt5nxP7yQWH2q3sf2t8WEJ8fJ7v /8hPjnARQRldCJpcp/qN+SVO9slpz+d0ExIbpfHmkZcepzbtJy2P08vyrHB+L2/OGTEEIAABCEAA AvtNgHXysPkVr10yi30TjGmeO7Exq6XuYRYRlPEp4El26vqlpzEiHPNTcmmag6b6KX3BNgQgAAEI QAACEIAABCCwHwS0n+i7ybfc1CPP7bEI1Jx8fUXcA25rTqae8yH2FxGUiZM8BM4SZHM3iCnHzVxM SRfbEIAABCAAAQhAAAIQWDaBIZv6uDcZojcGYe3Dlh6YWfr4fR7NPiijiydeTB6Y07Y2yywxnSoY I97xhgb/JZ5d2xsz59f2WNMTBCAAAQhAoDQC3gfEtWdpPuLPfAh4XbnN88l7MoITJ8+TdD95smV/ c7MPyvjiiVPkG3SsI3+CgC/8qXiMfRPzRel0Kr+Xbjd3HS2dCeOHAAQgAAEIQKBsAl6/OC3b25Pe jb1ePmn5RI69UEpkWNnn09TzZK8UkEmfmvEcOrXsklLNg9h4PvZ57LMPyuQmRxO3hMnLjT1XN3Ug RqzjTcvlMebAdp3mxue6tN8+OtYtNR3CUOO1fMyXOjb8ggAEIAABCEAAAksk4PXaVGNvsu+1sdqd n8qHfbBrTmk69ti8V3NgxmUFJPTLREv8kRqfw2KxhHN1L4MynjhP5tgXzhzsRQaOvvqGMrb/7kt2 Y19j99NmTz7YD6dt8vvWprmN53vM79tYGQ8EIAABCEAAAhBYMoF11rpRJ+bnyHGb61wFBQ4ODuon WRQc8eHAicryZyymsut+ZNcBGdnf5rg9zl2nGvcSxr6XQZl4kez6RNp2/z5pFVX14RuFLuop2PgG odSfbT9qNsW4zG/K1Ow27UPzzgEBCEAAAhCAAASWTMDrqn1fF22y7t0HNtsag84n7WmOHTtWp8eP H18FX6IPY++xYj+6nh2YWeK1vau95bZZ72VQRheJb8rbBrrr/jxu3UB06KbtG8UmN/C2ccWbkvP2 o01vrDb15X7HsrktO11+b5PjtsZMPxCAAAQgAAEIQGAKAl3rqin63IXNdcdpvTmvnbfJW7zEykER 769SH8beY6k/HbKrPvWf7U19p77sY9nzsI9j85j2Liiz9E1s7qaQq/MJsGma8lZfvuFvajvVT/uK 7W1tUW7f8+Yw1RzsOz/GBwEIQAACEIAABPaVgNeJGl/M79t4N10Hp0EAs1KqT7Qf82Nx1H7K/Sgg oz5Ut8TATBz3FKzHmrNN7exVUMYXzKZQ5qivE7aEY+yLZclzus58js1/HR/QgQAEIAABCEAAAhCA wFwJtO0/0rW2gydjj9X9OJX9GKAYu79S7cVA1FSsSxj7XgVlSgC67z603aTGGvuQPvb54hyLJ3Yg AAEIQAACEIAABCCwFALpXiIGNqZg4P769rPJ/mWJgZk4Z5uwi3ZKy+9NUMYXQ2mAS/dH0cc+T9ms w1c3pqF6Q+X73vxy87COfzk71G2PwNDzY3ue0RMEIAABCEAAArsmsMm6cNe+0/9JArk1eq7upEZ7 zuvHpvNjE9ux565+LNvkh9u70qUHZrr4zLF9L4IyvgDmOAFDfNYF7Bc9OZDSN6jS1I/tqF0cx7op 2V5Tv01ztk7/OR2Pxf3n+svVWZ50OIE4DzE/3BIaEIAABCAAAQhAYDgB1nbDmZWu4TX9GHNrG1qn xkP7obTO/Ua5vutb67q/1EYsr5v3Hs5f71HZ+XVtzkXPfOfibx8/9yIoEy+QmO8DYC4yHpff/u3U F+Sm48hdxLKdu5n07Uu6Obupfuwj5lO5pnLUUV6s0n5VpyPKNtmjfjgBcY1sY364NTQgAAEIQAAC EIBAuQS8rizXw3l7Zr5aT2pNrz2J68YYmezanlLno23VpetZ66X1Uc95y6Z7ErWPvX+Tr94buv99 TtP5Mus5j3kvgjLxwoj5OU+MffdJ5ydk/Lv1HqfbLb9uKvs+xrIt35puOu5DfW4yBtmJ+rrxqS7X b+zTYyUdh0Ccg3EsYgUCEIAABCAAAQiUSSC3zizT03l6pXWl1/hi7YCD68cYlefQNnNr2VzdkP2E ZLV30xFtxfwmY/H+zfZyAaBN7Jeq63PD/nn8Ls8x3YugjCZiyAUyp4nyuBwl1k1JN5GxT75oz3n3 vQkv2+prI73IuvRS+/ZZ9dFWzHfZpB0CEIAABCAAAQhAAAJNBNL1Z5Mc9esREF+v5b0Hcnk9i0e1 4hw6mOH9QkylGWWPWmqukd66us1WT7Z4X6gaj+Fk6/7mpmS6K2qzD8roolnS4ajuWGOegt8mNnVD WVc/p5erG4sddo4SMO99vFkeHS01EIAABCAAAQhAAAJjE4j/Ae21pdMp1piyrY9su5+cD0P7tq0m PkPtpXbivtD5JQRnzHVTfinPXZZnH5TZJbxt9u0LbZt9qq94c2rr2xdHm0yftnXsrKPTxxdkhhPY p5vj8NGjAQEIQAACEIAABCCwKYG29aTW/W3tXX037W1Sm2lZdtM9R06mq//Ybnub2ok2tWdcQmAm jnkf8rMOyvhE3oeJaBrD2MGYocxy8rm6Jv/Hrt9l37mxlOZPzkfqIAABCEAAAhCAAAQgMDaBMYMJ Q3xrWn/38adJd0j/lo22+vRtvTS1nT42FHDp2h+2BWbUh/tL/ZhbWePow2wO45plUGafTqZ4kowx rnihxvyQiy/64bxP+nXtxHGm+SE2U92hZY+jr559MwenffWRgwAEIAABCEAAAhCAwD4S8DrZY9M6 eZPD9oba8frc63zb6fJlaD9t9mKf69q1jagf93Mx3+aL2poCM+6jS39O7Z7/Ofmc+jrLoExXdDAd 5FzKvkjWHZ8uVL2F2yem83H8vsjdV2xTXvX62IbzbrN8rE/boozysU/btczQVP2mh+2n9WlZumJk 33O2Uh2XxdJ84w1R+bYjncsu+TZbU7XFm3bMT9UfdiEAAQhAAAIQgMCSCOzb+qppfeu1dd+1ufcF TrVOto0h54f9kR3npd/lR+zLPlgvttkX23ObdVxvObe7HNNUVm2us55TtcX9XByb2voc0ilx/9HH 9z4yYqWPGfbRKVFmlkEZQ48nbIlw1/FJY/OFM+TCk44uWr+F23Zkw5xU15SXr2qLN0PLWyeOxz66 zrIuxzTqyx/JDjmi7eifbUT7rsulsqOfpTMryaTjSPV8I7Oc+OpwmsqnZeu5fujYrTdVKnYei/OR 55BzcCofsQsBCEAAAhCAAATmSEDrQK2ltNbS+qq0deC6TL2+zY1H44xrybY+4n96itGQdWfs2/6o L9f39cH+RXnlbSe16XqlkpPfHke0EfXSvMpRVuO2XbXpcNljG8JG+tLz3tD2Yp+q24fDnOY+llkG ZfbxhPKJpIvH4xtykvmGL30ftmU7squ8UvchWV/ksc42JG8d10Ud5XN6Udb9q843li4d60vOsvbT bU5t0+WmVDwsq1R+RV45PcnFfu1LTnaOdbm51TjinM1xXPgMAQhAAAIQgAAEdk1A60xt2vWfgk1r rl37uE7/XifGdbHr0rVztC95y6ne6/IY2Ijybfl0DW9bWrcrH/tps9PUFtf/lpFNjcHjVtn/4Sv5 tM8mG7IXZZ2PfKxru5axL22pxi8+0nEqeXG27236c2rT+MaY712PeZZBGZ1g+3ZC+UTQSeWL0HV9 U1908YJOdW3bF3bkqLoc2yhje9ZXOacT5aJ+zFsmpm3t8YKTnH1o04m2fSMyg2gjysW8ZV0nG7FO Ps350Fg0pvSIY0zbKEMAAhCAAAQgAAEIdBPQWtVrLafdWuVLeJ3oNaTL8jzmcyOJ6+8oO3RNHeXj nsD1uf2B5XJ+xbroo+qt53qVbV/9uT7asJ51Y5t1XedylE3tNvVhG2lqW05tL5Wbe1nj8hjnPJZZ BmV0Uuoi1iTs0xFvTOuMSyekL1ilzkdbXSetfIgy0YbzSvseUdb6Od0ol2t3XZSLebe3pQpaxSOO M9Y35XW+OfBlmSFz5vE7tY1dp0PGsGtf6R8CEIAABCAAAQjMjYDXWk7n5n+Tv0PH07b2tq119nd+ WqLJT9d779Dmh2TTdvnmOtmIa/mYj/1EedfHNOpZNm1XWXI+oo7rcqlZxjbXrcM32ikx35dLib7b p1kGZeT8vp1QvlA8MUPT9IKVfu4Ct90o77qcjjhH2ZiPen3y0Z9N7MS+NuUWbXXl1VccQ5d8bPd4 0zTKkIcABCAAAQhAAAIQgMCuCay73h3D775r+7gXjHn57vV2kz9pe9d40/a0bHuud9rUv+tTPdfH VLYsp3rl+9o3l8hUedfHfsjvlsCsgjI6CTmRjp4w8UI92nq0xvJ9Luooe9RS/xrbadOIN4w2uTm0 9RnvHMaBjxCAAAQgAAEIQAACyyKQrmP7BgG2SWmTfUMMSnhsccyuGzoe2xiqL70mHduMvrTJR7lN GEU7c8hHTprfWJ6D/7MKyghovIjmAHhqH4eccKls08UvnyUb25V3XWonN8ZU1vqSHXKD0HwPkc/5 0lbnscSxtsmnbdZP60sqR/Yl+YUvEIAABCAAAQhAAAJlE8itI9ddN0810qH7hdzeIu4x9XUovy/H e5ohvsf9QROrlKt1muTT/tfxyzY0/jhe1+9LapZzGs8sgjJzBJs7CeLF55vB0JuI7LbxiH3Yh6Hy 0os3hKhvv91PTN2f9aXni97f9bR+lG3LR3nZc39NOmm7yjriGHK6Xe05nbY6+9oms622OLZN/NpE d92xRt/XtYEeBCAAAQhAAALLIuD13zZGrb60XnWf66yX1tEZY2xeZ9n3nM04Nrdbz+UxUvnQ127q r/YZOtL6IX7FPYf2Z967KJ/6lZZz/ciX6I900nJOL9qWvMo5H6Rr2Wg3Z7OpTmP2XlRBKNtrkp9L vcexLpddjLP4oIxhGu4uII3Vp6OuGotP/HgD6NuPdKUnO75YrWtOkZsvNsvENMpHe7JvG1E+1jlv +yrbnnRUlq++qa0zVvetPtLDDGJ96nf0J8o15T0Gj61L3/KpvZy/qYzKXfZzOuvU2c+Dg4O1njyS n9Ldt590XIclOhCAAAQgAAEIlE1gm+uruL7XestryDZC8i/KOb9Nv9VX03rVa3uNwWt5+Tilf0Ns S9bM7GPkvemeQ/pioD609vW+zX06jX3GvNrlo/1QWfbsd9dYPS+S0/pb55htxn7ULll97LP7jHK5 vOXV5vEpn+tH9XM6NIa5jaP4oIxOmHjSzOmEiL5qDL6p6cLRBe4LKcr1yevClG7byab+3O58m23J 6LCsbwYqu61NX/LRJ/ftm4jTNhttbdL3oX50uA+lPuyHy0NT23bapW9eqVwfZtKJvqc2xizbz2PH jq24DbEvPx977LH6HLatIfrIQgACEIAABCAAgX0joDWR1p5e5w5Z/1k2t56den3oda59SOfF9fLD /yGnuqn9Sv1oK+d8tPwmfqZzGQMW4uZ+3VdTqvNCfugjPdtVvss/73skp7W7bJm/7dmO6pWXn319 s8/qJ+5PVS9bcz80LvOPYzG7WFdKvvigjODFi6EUcEP98A07vaiG2pG8mHQdllGqjy4wX7xtutaL F7V89uF224qpZFTW4ZuJbxBO68Y1/nG/UnVefck396m2mFe57yE92V1Hv03Hvjb50abbpLNuvebU vOKc9rEnPxWpV9o1pj72kIEABCAAAQhAAAJzJ+C14zrrq7iesh3z2Nb6MPrgvmPqdV9MY/u6+a5+ +9iNNryutZ999Jtkol3JOHDhOXFfTfqxXjrWt12nUS7Nuw/p+9yynv1wWak+ce+W2kvLsiEd78/c Xyo317LGYz5xDGYX60rJFx+UKRne0EnUCTLkgsnZ78PDMkrjCRnztm1Zl5Var6nNsm5P5b35Vxrz 1mtKUztNcrFe9nPjsoxtupymHoPqLRvTVL5vOdrtqzO1nDjZL6dD+lxHZ4h9ZCEAAQhAAAIQgMAc CXiN5LTPGCzbto7tY2cTGfmgT1wjpnmvte3vJv1Zt8nWuizso+w32XbfSmM/XfsztfvJi2ijb94P F7jP6J/rUltRRvkmOetZvkvO8pYTNx1KNc59OpqY9OG5Cw7FB2UMRSeP4bpuaWmf8UcZX3A5TlFO 7V3lnI1Y5ydjXOeLW6kveLelfbleaVtblHO+bYyS6Wq3Hafu36nrm1LbT+Vd36Tn+lTP9aQQgAAE IAABCEAAAvMi4PXvEK93sRaM61Tnncr3pvyQcQ2Rjf0N0bPsUP3I3HuYJhvexzhVn0MCGO5LadqH 29J6j8vpELkuW7aZpuucu6mNUsti0pfhrsZQdFDG8AQn5ncFaw79xpMu9beJYVN9n4sz3qDS/nyT S+uHlJt8G2JjStkh/g2RndJnbEMAAhCAAAQgAAEIjE9gyGZ9/N77W+xak667se/vwWHJLn8OS3eX 1vE/+tClH/c/febce6qmPlzf1m9bm4mkMrKb1ll2San5ljzmYoMyc4A3dGLjBdxHVxe5dXxRtXFp a2vqr02n6SZjn3I22+zl5GOddHXj2MRGtDd1fiw/faNex9+2uVjHHjoQgAAEIAABCEAAAvMm0LSG 7zuqrjWuN/px7R7X8G7v21+bnPtok0nb+vqf6rncpJ+Oy3u1Lt5uj4xy48rVyaeop3ws22el9lvt OpzWBf4pmkCRQRmfkD6xiibY0zlvvJs20b5YY7vykYHK6UWYllN3or7autiqD99gbCuW7afbYpr2 Fdua8qlOLNvXJt1cvfW7uOR0m+p8Q4v+uJ8mHdebp8s5v9qYSp8DAhCAAAQgAAEIQAACYxHwejSu cYfYjutgr4+dyk5sH2LXsvZL5dRXy2yS2r/YTx97qZ6/FZCu1713iqnsSz637rfd6EP0LW132all VTYv23Kby11punfpki+9PWVUqr/FBGV8EglUejKVCm+IX3rJky/cnF56MVsmslA+vbBc9gkX9Zx3 m1LdCMza9ZZT6huFU/fvsv10uW1M0e6QvPv02NbRtV/2c4iNVNa2XD/Epl/u5RucbEk/5eiy+yCF AAQgAAEIQAACEIDAOgS61pVey2ov4DXqkH68Rveewutbr5ltf4jNKGt7qpN/Wk+vc9hP6+b2Ph6D ZCyfk7MNpdaxX5G3xi473gM4lV7KxXYkr0/ab84f68ie25XXIfu2oTb3F/07IXny32jPNk62zjtn pimnEkdVTFAmwooXYonQ1vHJY2q7KHThxHZdJPFCUT62Rz8iP9VLTvI63Cb7x48fXwUFfKHqZiEZ yb/61a+urrjiilqPfyAAAQhAAAIQgAAEIAABCEBgMwL33Xdf9e53v3tlxAEs7++0L/OeTULay7kc U8uvDD2V8V7OspJTHy6n8i7Hdu8zvUe0zFxTMdAhDg6glTqWp910000nvC3EQ8HTyeEgRiFubeSG TnCd3D7RhxjzyRR10jrxSuskn6vL1eskveSSS6qf/MmfjN2QhwAEIAABCEAAAhCAAAQgAIGRCNxy yy3Vl770pex/oOe6iEETt3vv5zbv+VyWXMxbr0+6LwGZdKzr8kjtTFUu8gfJ9ykgo4lbJyCji8sX mCc/V6e2PnLWTWVtm4CMSZBCAAIQgAAEIAABCEAAAhAYn4D3XHFPprz2v66LqfIu2xuXlcb/9I+y MW+9Pqn82MfDzEodW5FBmX2N0G1yEvQ9kfrKRV9uvPHGWCQPAQhAAAIQgAAEIAABCEAAAhMQyO29 4v7XT3U4lQtNe7wok3O1SS8nq7oue016JdbHgFWJ/kWfigzKRAfnnh/jxB56MaXMuvQvv/zyVIUy BCAAAQhAAAIQgAAEIAABCIxMwHuv3D5R+7auvVuXO236MfjTZGdfnpbpM9YmBtuuLyoo03YCbRvM WP3ppI5ROp0cXSfIuhxyerm6scaGHQhAAAIQgAAEIAABCEAAAhAYRkABmbZ9mtti4MZ1fXqybNpP 3Jc22ZFOTi760qRben2pYygmKKMTp1RI65xcOpFzJ7OCNI4+asy+YNJUfcb2oT506Tb5N7Qf5CEA AQhAAAIQgAAEIAABCECgPwHvB6XRtAfWfs77Sct07fGiB1FW+aGH+5ae+l/HxtA+x5Y3N9mNPMbu Z1N7xfwktp4eiRO/6cB2re+nYdIx+ee4VK+82533Ce8TqO/Jb7kuffUn39SfdXbNiv4hAAEIQAAC EIAABCAAAQgshYD3ikqPHz9+5JsU3guah/ZtqvNezvVNqeRlO9pxn006sV5BI+9bVT/XfWPqt/fK cawl5IsJyugEKxXSOhPlYIt0fTIo9ThVrwvQY44yqpOc6pTvOqwrOeeV2od4ATrv6Kzlu/qgHQIQ gAAEIAABCEAAAhCAAAQ2J+B9mlLtz5zasvdyavN+UHXeO8bUOjG1TclZP+49o2yat472i8p7/5jK zaEs/+N+V5zNoyT/iwjKxBOsJDib+OILQTZ8Mij1SeAxu2wZ6bmtb//WTeXbLiD75/5TXcoQgAAE IAABCEAAAhCAAAQgMD4B78W8X8t9iyE+qRI98P7NaWxz3vvJKKO8P5ZrS6NuGjRq0yupTRziEccU 63edLyIoIzgpsF2D2aR/nbQ6fDHEscW8ZZQ6aud2l9XWdFg2bXd908Vj/1I9yhCAAAQgAAEIQAAC EIAABCAwLQHvx5w6OBN71Z7O+7kYTPBez3Vte2nJWk62rRv7yeVtU6l9cJqTn0tdyqMUv4t50W8p QMbwwxeVT+Y2m74w0oslltv00zbbU739sMy6Nq1PCgEIQAACEIAABCAAAQhAAALbIeD9XNzjuWfX OXV9mna1p/IqSyd9Use+5OSp24wAQZnN+B3RVgRRHx19LoCmQEkf3SOdd1TIpn2z6BT92DYpBCAA AQhAAAIQgAAEIAABCBwmkO7J0vJh6c1LQ/d8kvc7SNX71P5tPsJ5W9h5UKYpKDEnrB6DTlaf8E6H jsN6ttmkb7nYHuty+vIvRjgln5OLNslDAAIQgAAEIAABCEAAAhCAwHgEcnswBz6c9u0ttZWWZSdX 12Y/Jz/Urzb7u2yLe2b5kRvrtv3b+TtlUijbBjBGfxqDT1JPqtIhYxsq22U/RjbjGOVn7Cvmoxx5 CEAAAhCAAAQgAAEIQAACEJiGgPZh3ju6B+8pnbpe/7HufVtOJ9ZZzrpKY12UjTK5fOqj/Ir/yS8d 2Yv2c3ZKqrO/5lCC7zt/UkYTVAKITU4UTahPTqXxoulrVzo+MawTuTivNLWf6tkf+2J7TuP3A1Nd y5BCAAIQgAAEIAABCEAAAhCAwPgEvAdzkMN7PffkfZzSdO9mXcl6b2i92OY6p2pra7dcmsoHH8rb htPUd8uWnMYxleDnScI78iadRE/ujtxZq1s9leInU3RhOT/EmPT0iUdk4RNHdan9tE/74zTaVF6/ Ue8j7dP1pBCAAAQgAAEIQAACEIAABCAwPgHvwbTH095Me7y4L/Y+zqk9UNm6qpNeLNtG3EdaV3Ju d12fVH3qkG70x7ZyffWxuysZ+R33w/ZD49jVWHb+9SUN3BMqIDFvQKWnupjixZCOqY//XSeAuSh1 f9ZR6qCN+3Jd9MttkrU923AbKQQgAAEIQAACEIAABCAAAQhMR8B7MO3VvDdznXqN+bjPUz62WT/1 1Hu9WB/txPquvPtTmrOR66vL5q7b49NH9mWX4yjuSRlDmUuqC8GBD5+kQydU8n11dDFI1heH8o5e pszsV6x3XzGN7eQhAAEIQAACEIAABCAAAQhAYDoC3otpTxf3bKpPj9iuNusqn+qrrumIek0ysT7u N1Wvva588ceylnN5DmnkHPO78n3nQZldDXyKfnWCbmtSYz8OBmlM6UWbjtMXjdO0nTIEIAABCEAA AhCAAAQgAAEITEcg7uXivizmY++5PZ5s6COdaC/qbZKPNpVPfXA5ym3S3650m5hv05+dBmXmMIFt k+QTcZMJG8ogysd8Hx+ifMz30UUGAhCAAAQgAAEIQAACEIAABDYn4P9Uj3sy7y3dtnkveQvqM/ab l9r/2pIY7CQo0xboKG36mybLF80Qf5ts9bUhfbNzOkRXspv60Lc/5CAAAQhAAAIQgAAEIAABCEDg KIG4r3Or93dD9pnS8f7Oqe1tI42+yhePYRt971MfWwvKxAmKkzc3mJv4Hhlo3H0vHMnpI33173LK rq9vsd+YT+1RhgAEIAABCEAAAhCAAAQgAIFxCcT9XNyPxXyfHiWvPaJT6SjvT5sNyWx6+D0zshN/ mWlTu1Pqxz35GAzG8HVrQRkPWKkmz+UxBrENG548+a4Tbp3HytIx22aT/2m72TXJ5+oja9lLbabl nA3qIAABCEAAAhCAAAQgAAEIQGAcAum+LC3n9ppN/wGvPaL0lXq/qXLOhr2POtZ125DU+2L5pv5y v2o0xN42ZM3IfWn8uz62FpTxYJU2nVC7htHUv3zWCSe/lbrcdqLnbJmB27pOCPWXsjp27JjVe6Xx N9jtvxU1ltQHt5FCAAIQgAAEIAABCEAAAhCAwPgEvLe05VjW/izu4SzjvWe6P1R7uqfL7SNtR6ls SUapdG07yvTJKwgj33Wke80++iXI5Hhu26+tBWV8oiidW2AmnqgOrDgdc8LMyDbVR+xH7QcHB0cC NZbPpb7AzD3am0MkMzcm6iAAAQhAAAIQgAAEIAABCMyVgPZocV/mfZ/2bN63pWNzoMX7u9gufeuq 3vaiTMxLVnaU6nAaZdJ8TkYBGe8pZS/nW2qntHKch135trWgjAeoQWvy5jRhvgA8BqebRtVyJ7Zs q96fWHa+LzvbcD/212WlrpNtDghAAAIQgAAEIAABCEAAAhCYnoD3ZO6pq2y5mGov5/11GlyQPX+i jvNpf64fkiog4/2kUj/x47ohtnYlOwaHTX3felBGDvcNKmw6uDH00xNKvo/lf3rhNPnbVy6nH08y 21Hq+rHGkuubOghAAAIQgAAEIAABCEAAAhDIE/CeLG11vdO03WXt5STj1PXbStO9sveb6j9t25ZP c+xn60GZrhOrFIg6iXInUlO9/B4ytibZpvocF/uX+iQbfe3YRs4+dRCAAAQgAAEIQAACEIAABCCw HQIxqOEem/Z1OVnr9E2bbEf9TfqZy16zD4fIZOz81oMyYw9gLHvxZJvLycNTLmPNPnYgAAEIQAAC EIAABCAAAQhsj4D3nw4IuNzlQdNetU3ffaS223Qs26Tr9q60yd8uvSW1H2xzsJtO6JS+yrcpTxid 8B6/077jsbxs+H08Tb5K1n3FvPuyLZdJIQABCEAAAhCAAAQgAAEIQGC7BLwv896trXfv6yyT7gXj 15dSWevkUvugNvkx1WF/S36oYAi3sTlt9UmZKSd6XTD2SanfHL2urSY92fYkO22SbatP324tf+OJ 7Xy8uGJeflhG/XjsbX3SBgEIQAACEIAABCAAAQhAAALjEVCQwnsx7w9ddi8OZLisfZz3cs6n+0HL DknVb9r3EP2+svJ1G/309SeV26Vvi39SxkELBTx8QaQTtGnZdn1hxYuwj22dILKhE9lPyij14RNI v2fvvNti6v5dF224jhQCEIAABCAAAQhAAAIQgAAEpiXgfZ160V7Pe0b3qsBLrJO894VxH6c6B2us OySNe9O2veQQmznZON5c+67rIutt+7LVJ2W2Pbgh/elEVtAjHpqYsY5NTnb7oRNZPtqWLpp44aTl nO9RPtdOHQQgAAEIQAACEIAABCAAAQhMR8D7u9iD92luU+o6yTmv1B/tDTcJyKR2oz9j5+1n+qDA 2P2sa09MzX5dG+vqbS0os6sB9gGjE8Of6KdP/D42+uhFmT42UxmdyNGG87HedU5lQ3mXnWq8zqf9 UIYABCAAAQhAAAIQgAAEIACBaQh4n6k9mfLem6X7s1iOeXvlPazLMc3Jx3blLaM0flI5ly3v8pC0 zdchdqaS3WRsm/q0taDMpo5Opa+TIx6+QGJdn3zU29aEus90DE3+9pVr0qceAhCAAAQgAAEIQAAC EIAABMYjoL2jnyKJVr3Xi3V995mSk35OPta5D6exrzHz6fjYlx6mu5WgTJz4w93vrqQTYcyToWmM qm9q6xp9m256Ykdb7s+p26zjcTddqJYnhQAEIAABCEAAAhCAAAQgAIHpCHhvlvbgvZzTtL2rLL1c sCVXl9pat8/UjstNY3R7SenYY+8ztq0EZfo4sk2Zkk6KpklvqrfvTsUtysZ8ylQXYNRL2ylDAAIQ gAAEIAABCEAAAhCAwLQE0j1b1x4tyufyTfpRdtoRDbcun5v8Hm5t3hqLCspMPfFp1LHPRRB1JO9P n9Mqysa+bFNprPdbuqNen36QgQAEIAABCEAAAhCAAAQgAIFxCcS9WgxQxHr3GPdwznvfZ5mmNGev SVb16T6yTXbTNu/R4/g3tTk3/cUEZXRi+es7Y0+S7PrCiLb7XiR9dXSixjHobdvuwz74AnJ9tC15 +Wm9JZ/4kQt5CEAAAhCAAAQgAAEIQAAC2ySgfVncs2k/F8s5X9yu/Zw+cW+Yynuvp368V0xlmsqp jspTHbbdNpap+i7F7mKCMnpKxE+KjA1fJ7wvkGjbF0Ksa8vLhk/KnJwuvGhT43HZY7O+U9uR3LFj x2o/jx8/XuvlfLY8KQQgAAEIQAACEIAABCAAAQhMR0B7NO3b9MntV9P9mmW1n4t7wZyH2jvqkA3J p7ZyOq6TrOwrVZ9TBkzsZ9d47Ns+posJyuhE8oRvayKHnPjySSd825G2y74vEKdRP5U/ODiomyU7 1LdolzwEIAABCEAAAhCAAAQgAAEIbEbAezKl6V5Ve7l0Pyc5ffrs56QrWaWyndpq81yy6iPaaJPf pM0PGXj8Lm9ic266ex+U0aTGz5QTpJPeh07goSe+5eVvtNV0YsY+rOv+lcpG1FX00RdXTj7qkocA BCAAAQhAAAIQgAAEIACB7RDwvs1p3A/aA+/h4j7Qbbk0yqvd5ZxsWjdENtVdp+xxr6M7d529D8pM PUEKcvhIT9zchWRZp9JJ9WRTARQfsQ/XpTqud2q70vUJHoM0yvfxz/ZIIQABCEAAAhCAAAQgAAEI QGA8Am17urQtt3dLZdo8GyLbZmcbbd6/bqOvEvo4GVGYyJtdTv6Yk9k0DgVPYpsulljOYVW7P7E9 XmhpIEZj6TOe2H+0p35yNrt8jf6RhwAEIAABCEAAAhCAAAQgAIHNCHgvmO7XUquWU33Xvq3vftE2 naZ9dpXX1euym7b32fumOmOVu1iP1Y/tTB6UcUfbTseexNwFM/ZkNdlbdyxN9rY9F/QHAQhAAAIQ gAAEIAABCEAAAsMI9NkHxj2f8n10ohdRP9Y739TeVG+9MdKhYxmjz13Y2NugTPpUyKZwo722E7Ct rcuHNPCjkzA9EWU/9hHL0o9tsT/Vp0/1xHbyEIAABCAAAQhAAAIQgAAEILB9At7Txb2c9oFxD2qv okxaF/eT6T7SskPTrj1mzp+hfXTJayxxbF3yc2vfy6CMJm2sk1ATqotB9nxR6IQY07768IWovA/3 57LSeDIq74/acheE/dTbrP1Ga8lyQAACEIAABCAAAQhAAAIQgEAZBLSv835NezjlvZeL+zzv/5Tq cDmOQv8ZH/Vlx/JRrk9efef2pdaVXbW3yVh2ndRjiQzWsVOyzuyDMunJ5RN3TOg6EXSS+UmTtpN6 3ZMlHYf8z40l2le7yjm5VF++6/fpOSAAAQhAAAIQgAAEIAABCECgLALa02nPpkN7T+3dHOiIe0Xv /7wH9J4wjkYBmaivctxHRtmuvPp2XzlZ++09c05mnTqNXT7Ld3NZx84cdGYflElPLp+4Y8L3ieiL oa0Pywzt3xdX1GvrR3Lqy5+ol8tLrsteTo86CEAAAhCAAAQgAAEIQAACEJiWgPZq3ksq0BGfdEn3 vHEP6HyU6dIfMhLZVR/RftR3/0rbgjdRp09etmxTbMa03af/bcrMPiiTwppysnwiOk37VrmtLScf 69KgSToW2Y7203Jb/5Z1GvslDwEIQAACEIAABCAAAQhAAAK7I5Du07QXTPeH9i6VVTk9Uv2mwIrq uw7Zz8m5X/vjcpe9oe3pWIbqly6/d0GZKYD7JJvCdrSZBmFim/O5i8FtfVLpb2qjTz/IQAACEIAA BCAAAQhAAAIQgMD6BLw/HGP/pj1tzs4mgZScvfVH265pFu1S82zdq6DMFBPV5yT1ydgmK5nchaC6 Nr2+p1W0IQ76xMhq9HGsPvv6hhwEIAABCEAAAhCAAAQgAAEIHCbgfVncyx2WOPGe0bb2VL6t3Ke/ Jv2+PriPJjtzqdc4vIee2udJgzJ9J26MQW4LWM7XPhNmmcgk5mXXQZTcWFLZJj+inRiYcf9RL9dP bCcPAQhAAAIQgAAEIAABCEAAAuMS8D7MqazHfOzNe8S++0HLRxu5fB97qV6Tj6mcyuvYz9lZQt1k QZltToJOjjHf9izf/elzEqh/BUC6TtK+NiUnez5UbjvUHvu2rurFxfqpj6p3W5t92iAAAQhAAAIQ gAAEIAABCEBgHALal2kf5n2brHpf5j2ay1EmyqV5lXWk8idqT/4b943uw+lJqRO5KKuaJrlUz2XJ D9Wxbi7tGltOZ5O6MX1v82OyoEw6gW1ObNomWIoIepI2hac3XQ/xX/1J3v061bhiPkYtu+zLBx3S ibLuR3aj7ZivFZ/8R7JR9+Dg4JCO5GK79UghAAEIQAACEIAABCAAAQhAYBoC3qfFvViaVznd46Xl nHdde85oI91rpvaibNrWp6wxeF/bRz6VSfuPY0tl51yeLCiTApwaUnxSJp7Q6/Qbny7pq++AkORj /zEvGXPR78ansnXFU//IBx3SiXrSt02nT6nUifWirtvVp3Vkxx+3k0IAAhCAAAQgAAEIQAACEIDA tAS0D4t7Tu3R4n7Se0Dv3eIer8uzKBvzUc923U/TvtBy1pXckMPjHKITZdP+m8YTdcbMDx3vun1P FpRJAa7rYB89nUxtv+Pex0aUke9D/Ndk9YnaRbuOGOYmWuOJ9tIIZk7H/ke/Y3/SUVm2dbgtytsG KQQgAAEIQAACEIAABCAAAQhMQ0B7sLjH817NvXmvFsvOd6Vxfxf3lFHP+0n349T1lk3L0bZl2lLb bZMZ0ja0/yG2c7Lb6m+yoEw6gblBjlkXo2abwJPf/vT1T/052NGkk9rs4hPtdcm6z6jjuqirdrOx P5GbdUghAAEIQAACEIAABCAAAQhAYBoC3oPFvZr3Z7Fund7jnlD5WE7txb5i3nLeO7qck3FbLpX8 UJ2cHdeNacs229Jt9TdZUKZtcFO0pSfMFH002dRkDem/bXLTiyaVTcvyqa1vtVknFynN1TWNk3oI QAACEIAABP6fvTPt2qWm8n49/YAgyAwywznMyHiYRMYDCA2HsUFYgKIsFZth8QH6Ta9n9Zv+AN0g DUoDIgfEg0yCgAzCAZlnBZlkBkFAZFCGF8/5Ff6LfeekqlJ1VV3TvbPWfSeV7Ozs/LOTVPaVpBwB R8ARcAQcAUdgMAS0Bqtax6kE0YbrRKVrradnu/5TXFle0sP8ylOXZunqwlVl1OW16Sl4WfpJCfdi lOkK9EkBsU7OVDzoLFW0sc4EPX+xtDq5PN0RcAQcAUfAEXAEHAFHwBFwBBwBR2A0CFSt/SSRXefZ sNLxtSa0cWG4LG9IVydTXXrIr+vn1Hp0Ve4w6tuLUaYrAIbNpy3gXVrsxEsWUSuT0lJwsflErzj5 inffEXAEHAFHwBFwBBwBR8ARcAQcAUdgOAhgWNDarmptVpXWRtJUg0bX5baRtUme1Ho14TlM2ok3 yoxDA0hp1bFoQOIUn9KgYT14Jn/IU7wsf5u3rsww3eYVb/cdAUfAEXAEHAFHwBFwBBwBR8ARcAT6 Q4B7ZexaL1YS6XbdB43WieG6Lsxfl27pY7Q2rk5Oy6ssbPmV0aTGh2tYbWhIzT9udBNvlAkboMvG btpYKIcUFrnUier4KE8VHfWydDYsDKDhq06W1tKF/KvSQlp/dgQcAUfAEXAEHAFHwBFwBBwBR8AR 6AYBu24L17Bapylez5SstV+KFMofo5VhAx+eIa3KxCdNzzFew45rgsGwZWtT3sQbZXRztSo/KmVB UVEOKTdyWSON5AuVnfhYnOjlh/Wy9VaYjv3pp5/OMAZJnlg5yqcy3HcEHAFHwBFwBBwBR8ARcAQc AUfAEegfAa3F5Ns1YbiGs8+iR0IbjkkcriEtDWtHnNaQoaGDMpFJZVv5LJ9RhCXTKMruo8yJN8pU KVofgJXxRA6UAx+FRan560p5Qz620wgDOmVYptKQ24Z5DmmJc+cIOAKOgCPgCDgCjoAj4Ag4Ao6A I9AfAlovUoLWdXatFobDZ0lGXpum+BRf60t87dqx+WJyKV159Zzqt80X8pdsYfykPk+8Uaarhm3L x+ajQ+gZX+E2ypGa31oJbfmUWcfD5m0jo+dxBBwBR8ARcAQcAUfAEXAEHAFHwBFohgDrtqpdLlrH pRhc7JrThpEofC6TMkanOPlleRWfIqtoB/WrsBuU9yjyT7xRps/GT1XALhouZu3rum62Pm6Q6aLV nIcj4Ag4Ao6AI+AIOAKOgCPgCDgCzRBgXcZaz67J7FpNYfkhd5uPtDK6rtaT8C8rI5RtGM9d1WsY sqaUMdFGmVAZUyqcSoPSNW3sQRS1qi5N+JbR2vim9UrFzOkcAUfAEXAEHAFHwBFwBBwBR8ARcATa IaA1W5P1GrSiV36VHj4rvq1fxa8qzZaXSmfzxMJV6+cY/TjHTbRRpk9gpdipZXSlXJRnd8004Qtt TG7Lg3SeVUaMPrXOTucIOAKOgCPgCDgCjoAj4Ag4Ao6AIzAYAnZNlrKms6VZ44TWenb9J1qt//Q8 6f401ceNMgNoo5Rdfh2rkI4OpD+bV2fkRK9Oqmf5Ng9xNt6GQzrKpIwwj6XzsCPgCDgCjoAj4Ag4 Ao6AI1FZKq8AAEAASURBVOAIOAKOQH8IaM2m9R8lybBCWOs10SkO3xpjREd86JQmeq0/9Sx6W4bi qnzotU6tousrLZS/r3KGwdeNMktQTlXAkG4QJSQv1j1r4YM/z/o8mRRA5doOSprtvDyTHpOJOJRW 6ZQRo4OHO0fAEXAEHAFHwBFwBBwBR8ARcAQcgf4QYC3GGk/rPrs+09pPpZPGH460snVcGC8+xKuc kGeYR+lVPnz5QybJo7Kq8nlaOQJulCnHZqmUUGlTlS/MB2MMKvpTJ6OzKA4a8tkybFjp+NZKSFgG GNJw5KMMeH/66ad5uvKEPD/L4f8dAUfAEXAEHAFHwBFwBBwBR8ARcAT6QEBrMa3N7BowLI800ZOm sNaQeoZOzq7xSLdpWhcSb+lia1bxC31o4an1qmQJ6fw5DQE3yqThFKVKVVyr7GKE4pKfP3Uk+eJL PoWVz/ria2kI86c0S09YVlJ1HJs3pPVnR8ARcAQcAUfAEXAEHAFHwBFwBByBbhHQGkxrMq3RYqVo 3ag05dXaUTzkQycahe0z+Xi29NCVrR9JiznyS4ameWP8ZnOcG2Vatj6K10T5QlopsC1eNGGa7USi V2fSs/wwr3iG6cTrT2nuOwKOgCPgCDgCjoAj4Ag4Ao6AI+AI9IuA1mjyq9Zw0ITpki5cE4qf0uUT H6aRt4yv8lX5Ib8qWk+rRsCNMtX49JZapcShEaaKNhTQ5m2SL+Tjz46AI+AIOAKOgCPgCDgCjoAj 4Ag4At0jEFunhXE8a20nPyaJzVdGZ2lCHjLMkLeKLsznz90h0LlRZtIaso28bfKoyWSRDDvMIDzF 2/ohP3U2aJQWymDze9gRcAQcAUfAEXAEHAFHwBFwBBwBR6BfBOzaLFyf2TXcIFKIr8oKeVFOWVpI a5/J0zaf5TPu4TZ1bFKnzo0yTQp32pkIqLMQm9rworN5Z3L97Ck8M1hHH+PhcY6AI+AIOAKOgCPg CDgCjoAj4Ag4AoMhEK7FWNOxXtParoy78lXRiQYels7Gl/FvGg9PW0bT/ONM35VBLKWOnRplprVB LJBt6piaR3TyKVdh+cTJkhmLIz3mpFTKEz7H8nicI+AIOAKOgCPgCDgCjoAj4Ag4Ao5A9wiwLtPa DO76QpLWaWGJ0No05Q3j7DM8VI7oQ77hcyqdjDzTapgJNzWk4hLimfLcqVFGDZNS8GyiScUFulCp UQbF49PJFCcMiQ/jlBbzUSiVg+/OEXAEHAFHwBFwBBwBR8ARcAQcAUdgOAiEazGtz7TWs1JovYbP n/1SE2tA/uRIt+tCGRJsnGjLfJVXlq548eZZ8ittGv1UXNrUfZk2mcry2IYpo5nkeClbk3o2oaUT 2jJoeFk65dMJ+Z696MBTaYoLy8TqqnzqqMTROZV3kttl2mR/7bXX8irRVuuss860Vc/r4wg4AlOC AGPV66+/nr300kvZe++9l335y1/O1lxzzWzOnDnZaqutNiW19Go4Ao6AI+AIOALdI8AaTGsxGUwU xzptmWWWydd7lEy81oX4rAXxcQrLUKPdNuIpOq359JxnLvln15RV9KRp3UlY68sSthMfLVz6qEin Rpk+BBwnnlbxmsiVmg860eLj5NOxcCi74vKIJf9iz+og0JCuTk68FEq++Lg/HghcccUVhSC77757 tvPOOxfPHnAEHAFHYNQI/P73v89uu+22GXMJMv3lL3/Jnnrqqeyuu+7KRVx33XWzo48+etTievmO gCPgCDgCjsDYIcD6zK7FCGu9F1vbUQHiY2k2Tjygt/wtDWlVTrTyy2jhb10dvaWdxHCf9XOjTKJG hEqXmC0nS80b0oXPZWVaOhsO6WNpsbgwnz9n2aJFi3rbVXTssccODeK33norrwtW9R133DHbY489 hla2F+QIzEYEXnjhhezee+8tqt60v9900025sQMGO+20U7bpppsWvOoCTz75ZPbYY48Vhvnjjjtu RpZ33nknu/zyy7NPPvkkmzdvXtJ4sHDhwuztt9/O+fByUjWH2BfDGQXP0gcff2dpw3u1HQFHwBGI IMD8aRf5mlMVZ+dXhUnTrhnRibV+gOfZhpVueSiuzA9pJVsZvY0nbyibTZ/kMJsjtCOp63q4USYR 0SbKmMiyMRkdLOamWflj9R1FHFv0h+lig2kX5V9zzTX5AgxeDz30UNIirItynYcjMFsR4EjPG2+8 kb+gMFYzljQ5lsjOE7k777yzkVHmvvvuy/7617/m2WMGkl/84heNxgN2yMggI5nmLDmqtOGGG2Zr rLFGXtabb76ZH2di18wmm2wiMveXIODjr6uBI+AIOAKOQBUCZcYM1gUyBpTRwFfrh9icX1VuWZrW mPihU1oYP83PXeEaw8iNMjFUgriYIoqkLM3G1xl0LK34VvkohM4LQlfVOcXHlkGHTcmjvO4PFwHa Rp3etlsXUiy33HLZBx980AUr5xEg8P7772csSOXmzp2roPuzGIEvfvGLxUsSMPzhD39INsrIoCL4 uLelibP5Y/qIbH/7298Kg1Ed71tvvbUgWXbZZbMf/OAHxTOB9ddfP9t6661nxPnD5wiMy/hrxyrm mzlLDGuT4NBnjIKaF2M6PQn1cBkdAUfAEQgRYFxjPNb4Fq7TWBeIJsyb8mx5Qx/jpbVHCj/RxPiI P35YD+WL+ZTPGrWpkyGqab5xo3ejTGKLhEqHkpUpDrTWKW8YD00szua1YSlrWbmWVp0vpKU8dTrJ ZfN5OI7AGWecURjC1GbhQPP4449nixcvLhhwF8yuu+5aPKcGxB/6sIxUHmV0J5xwQn58iZfy/fff v4zM41sgwD0aTz/9dJETnXHnCIDASiutVBhD0ZF99903CZiHH364oNNLx5///Of8Mt0iISFA3pix pMl4wM4X64444gj76OEEBJrgncCuNYkdq9CNM888szWvYWa8++67fYwdJuBeliPgCAwVAbsu05pP aza9A7QVyK4txMOWR1xZGSGd8tf5TdcwlD+b3dQbZaTUYSPHlDNGI4WSL5qY4pTxTKEty6vy8OFj 6WyYdPtMWOUq3voKk89dGgLaNlhGvcUWW8wwyvDrY12eMl59xh9zzDF9snfejoAjECDwla98Jbv/ /vvzMfqjjz4KUssfOS4kpxezRx99NMmgao89kXfjjTcWqxl+6njAF5asa3IEy+ab7eFUvIeFk/Rq WOV5OY6AI+AIOAKfI6D1GOtM/njG14ddtJbTWG3py8Kfc4+HVAapNmypKVdlig4/XA8rLRZfl1aW TrmqNzSzxX3+UfMJq3FqY5XRxRbLUm5Boc5hn2NhxaFEMaWkLKvY0BMXoxWvMt/mgafKJD4sQzxs njAuliYa99shIExjOtaOo+eaBATKxppJkN1l7BcBDLbML9IRjgylONFbWi7vTXGpdCm8oHn55ZcL 0rK5piDwwEQggH7FdGxchWdunSR5xxVHl8sRcATGAwGtF+TbdShxmmtZT2jsUzy+wqoNz01duEal HPjYNYz44itsy4nFkU59qIOtl82nsOqpZ9VVz7PFn1ijTJsGskph72QRr1CpLD009tmGlR8lCuOJ o6ywPJ7bKJ3NI96USZgv6siFdKFckke+8rnfHgHpj7CW355jVgzIg/DwvMNBIJxUhlOqlzIJCKy6 6qq5mNIRuwOmTP5nnnmmmE822mijjDtcmrhXXnmlIOci3kHdhx9+mM8zjHP2ZW1Qvp5/NAioHaWT o5GiWanMqa57zTBzakfAERhfBLQGi60XWMdpLccXEhn7eNb6kTx6Vg1Fr+cUn7Wj5BC94sRP8qlM 0clXup7lM8/AW+sj+UqXr/LL+Ihu2v2pP75kG9AqA+G6xq+iiaWJv+VrX3ik3JKJNEur+CpfZUAT hm1ZlofobFmilW/pPdwOAYsvHIR7O26f5Qp1hti///3v+WWHH3/8cX5h6PLLLz9IEY3yUkd+MWeB OIrjC32Xz+eLqdtqq62WcQlqE0e74GizQfsVE9Srr76aLbPMMtm6667bRIyxpOU+Ev7oE2C78sor j6WcZULx9STaF+NIW8clrzq6xNEi7pyqcvY+ma222iojP/fRoBv4m2++eVX24mUOzDk+NahjvOGl MBznBuXbdX7aip1IfA3qS1/6Umfs0d9333035zdqHUYX+Zw5+rTeeutlX/jCFxrVk/xdteMwx6ou 5Z70MamuwftuF+ZK9A6Dc9O5sk72YadPui50MT8NG3Mv7zMEqt4VbRrvgvRpxWl9IV948tx0bCdP jI/KEm/5Ia3irY8MkgU+9tnSKSye8hU/2/xZZZSxjVuntDZdiqX8Nk1x+GXx4cJadPItD4XDNHgQ x18ojy07liaeoR/KFab7czMEwsEkbMNm3Jam5nO4dqFmKVZfffWMSyTr3HXXXZf98Y9/LMhSLqPl E758ypUX4tggjVHoyCOPbHz5aCFETaDP8vla0tVXX53XLSYGOwzKLjQFkxdffDHPRl/SL7jC6Kyz zprBsg7r1157Lbv22mujOMN/hRVW6AxnK9sGG2yQ850hbMnDT37yk/yzx8hDPavqBDY33nhjxmI+ 1hd4kQfbNddcs6S0mdFW5oMOOqjWKEFu7kGhfevkjfGW3iG/HJdjxy7MVXqVzxGmxx57LCfhst46 96c//akgwQDDAghjDLg/8sgjlfXnJV0O7DfbbDM9zvB/+ctfZs8//3wRF7anxaUgWhLgV7sw7dhj j834/Lfc5Zdfnn8KHOwZI0455RQltfYpE3640047LTdaEr7kkktyIwXh0M1ZcrfXoYceGkYnPaM/ N9xwQ2FMkx4pMzp8+OGHZ2uttZaiKv3U8ddie9xxxxX8b7/99owL5dWfrDxVc0DYzhJS+c8+++wZ L/yhHohevsYq+obagzSNfU37tviGPnI/99xzBV+lS27pA+Uy/55++ukiifoak2Qchci+MzVtz2gh kUjbnk3HLrGraxPowjHLtg3pg8whzJXMeTp6qTaAL65qrvyMIv2/xcvnp2zGWCv9CdsadAeZn9Jb xym7REB9VGOn5c04r90xYX8jza45wuc6elsO4TA/cSEP4nAx2jA+lC3PWPEPnjibr4J8apNm1fEl taIaX891fkgfU5qQRjzV4fTcxrc86soukyMWHxsE2sjneT5DIIZxG2xseyv/woUL84WYnkOfz4Ty IsNEneJiehTLd9FFF+Vfa2IRVuYw1lx22WUZMnbt+iz/5ptvzi699NJSgwx1YVfQeeedV1ktTVy2 /VPxFWPqecUVV+QGjFi/JK5LnO0OAntXiOQp8/WJZeSp2qmBMYYXeBY/FhfLl5d79OY3v/mNje4l HMM0VhDtxrZdFp2LFi3K28PSNW1Xm9cac+rk4aiQnMq0F/Vag43orM9nt3HKa9NsWOnocGzcsbR1 YfEK6erqGtLXPcOPPz4PjvEJgwK7RkIneTA6XXjhhWFy7TM6jEHPLuDDuqDDP/vZzzKMJU2cZKvL Ax39Hsf4ilGPX0vlrDxgUDUHxNpX+emjCtfJhmFWYxVykE9/kkt9e9A5IZRZsklWlY9fNs5IJjsm KS7M17Y9Lb9RhTVXyogMVmoX+egSbdK0XTRXgo/aBJ5qD+qMAbNurkzFxuenOFLg3df8FC/RY4eB gB3PVJ7GM/U3xeMrTjQ2zYZFZ+OqwjF+MR7oYYy2indVmsYR+VW00542kTtlYkrSZUNVKVtVWihD TM6U/GU0KR0hRhPyC59Duf15tAjYAZpfxh944IH8l2mk4pfo9ddfPz9iw8KReyOsnv3iF7/If0Gu q0GKDvDrMwsfHPQrrrhixjEKZGChwq+O/Ioph2EII8fxxx+vqIH8Pss///zz81/8wBr8qNumm26a Y8uCF9w/+OCDvN685LLYOemkk2Ycu2H3Afn0cvrss88WvyKCF4tw25ZlYNh6QsOvtX3jvOeee+Y7 ACQTv4LW/dqvXUHKs/feeys4w7/gggtyvbF1hzd48EL5xBNPzFhE88s/vMF31I52u+eee5aSvwu5 QnyrjiBpRxzjuTV+sVtGiy4WSOhKzMEbR31SjhmqH4S8ttlmmyKKI1e0HzyRyx6Jog+F9Ssy9hTA aCaDCfLPWbIjhrHprbfeyuiLdlzEmHjOOedkp556apI06DD93zrqBx7gH+owxhIWpd/85jdtltIw GKY46NCFX/3qV0W7057sHmA7O3MA5eLULhiSfvCDH8xgv8kmm+Rjld4PwEfGHuIYb2x/nZHZPDBW yTBLdDhWcaSFnZhgD79B5wTGWD4nL4fc1tBrx1jqUebK2rNsTKI9MeZ9+9vfLmM5VvGpcwgYNW0X O1dS6bK5krSyuZK0Js7npzha9PG+5qd4iR47LAQ0NuMrrHmCZ+tSxmrolV95NUeUPStPWJ7Gc5sv pLUyh/ltvlia5AzlU75UP5QzNd840U2kUWacAEQWKVRbuary2xfLMjqriNBU5Snj0VZ2z9cvAiww cCw2OB4Qc1deeWVunCGN9sWIU3dfRYyPjbv33ntnLJxZgG+//faWJF+gEMGvpiwOcMg77uXziykL Wrl99tkn22GHHfSYH/XgpZDFx8UXX5xjSp/iF/Hvf//7BR0v9PzJsVjQYpg4thLXufvuuy/HmYmK X8BDWcivhXGXOLPY4ViGJtLf/va3pce0VAdkxWlSjRkEwIjFrF4aMHQdfPDBYpH78+bNy330lgUl tGB91VVXJR+jmsGwoweNo5KfxeAhhxzSqbGBump85utI1uBiq4GhCkd/Fl48b7vtttmDDz5IMN85 t/vuu+fh8J/Vb2s8Censs9rMxs2fP7945MiVduhw75JNK4iGGJBxaq+99prRf60I/HIPHXWjf6Xo mHRYfKp02PZJ7qXAIFJ23FH8mvr0EfQAY0zZ57SpFzveoGNXI59f32WXXYqiwrEKTDRWkSdlrBrF nFAlN5VLkZv2tDvPMFDRr61TH7NzKT9IpOiL5TOKsG0XxpZ99903ea5+6KGHZowvofzhXBn2NeYR zZXsoNJ8Es6VId+6Z5+flkZoGPPT0qV6zLAQYBzGyQ/L1btDbJ4OafVMf5TeKA5f/dTGDStcV7bq OSx52pZTV4+2fDs7vlSmSG0F6ytfnZx16cOUSy/vlFklV6yThvShAsGbv5Cur/o53/YI8MtUmUEG rkcddVSxUKY9f/e737Uv7B85H3300Vw/0Bt25oQGGVvA0Ucfnd8ZAS0Oo8ygrq/y+aXfHu1YsGBB 6YKOy2j5xVmTGkaXquNh0AkD+XU4cDcIjnbjEllrHArzCmfi4T8ozizy1P/1a3tYpn2m7pRLnu22 284m5WEWpVq0E4HOhAYZmwm95Rd6ORaV+vVeccPyqZfGUcL0OX4l73r3B/fKoCe4KsztcUF7547V j7J+rrwqxxoOY3iKLpYWi2tKH+PRRRx6yH0uFpOQL/fYWONhuNsrpEeH2TUmV6fD9Mktt9xS5Hmb ylhURA4YoJ7oY5lBBvbc6YXe8odL+bpXTrjkn/LoucxnTMZBnzoniH7QsSovuMU/tafGuR133HEp g4xly5hEe0rHGZO6bk9bXhdhzSHw4l6XlLkaWtqRXRdlrulcyS40Ha3DKGzvtSoroyre56fP0aGt hjE/fV6ih4aFAGMT443GnNh4DI36FnLFaMrkjRk5VFZZnjbxGmPJa8OWF3JTdpn8xFNP6brNO+pw KHNZHQeVsxOjDMLZhu+jwQetqPKHwCpefl266Lr2pYS2oRVHWVYuhfEVljzCXpeOKt7yJU68w/yi d388EKCdTj755FphtJuC9tSRo9pMFQT6dRm9iS3Aw6y77bZbMRDzMjeo66t8tnlL97kYc+7cuZWi ckTAfk6YizrLHHzVz+SX0SqeeqoPsguizu266645CROXFt91ecrSw+NHdjEa5tGOLeqFvHvssUdI ku+YErZc7BryXyrDkogDDzywuCCZdC6HHYUL2yulz7WREwOJxuawTPGzR2/4gpB1XNQpfSkzYLED B6e2sPlj4VQ65W1Kr3xd+xgxU76G9a1vfavADNlvuummUlHY+SKXqsNf//rX8zZVu3CEs0sH3xR9 ZA6QTukrUXVywFt56mgxSos+ZaxiTsAxVnUxJ1j59J5j42JhjrjJ8fUydnXUOdqTnWB9tWdd+U3T mQcka8pcrd11tEsVjj/96U+LMYSvjdXNlYxr6o+Er7/++qZVmUEfzh8+P30OT8p48Dm1h8YZAb0P aF5lPA7HZPq3+njYZxVPHW1Y/KBXGBp4W37Ede2sHPBWfVS2nlWunpUe1lF0o/QlY98ydHJ8iQZn 0kW5EFx+38K34U9jhwpj+VSlh40CnzDO8koNw8PyEV9kIZ5nKxdhnM2jsmgL0plwlVdp1ieddsJ3 N74IaBFeJyGfReWXTNq/Sr/r+Cjd6tb777+v6FKfl8GUF8JSBkFCH+Xz650WK+DEr8spDsPBBUvu mMCF90zkkcE/9d8gOvpIPemvyJPCm19Bq34JjRZSEsmROBzyMg5UHWHSL93Q8qcXCbHmF2lrJDjg gAOUVOvz8n3LLbfkPDnGxCKDRdEwnW0ze+yjaxnopxp7aXt2H/GLsHX88q05NLYLZO21184/l47O cGww/GS6doLBMzTq2HJsWDpo46rCtn9W0fWZBpYpjnt4MLDoSBfHdujToQt1mMV5qkOHb7vttpwc o3iXOizjRp0s4KFjb2H/DPNWvUOEtPZZ7W6PA9l0G+56TrC8U8JcfKwxifq2bU/mDIzn6NE4OrUJ sqX8IIPxTj/ilNWHvsK8r3GBHUQpDoyZK5Ep5b2hiqfPT5+jM6z56fMSPTQsBFg70756L4iVq/Ga OR9n+zxp5MfZMPwUb3mrLHgpPc/c4T/ks7wVxteYYourS7e0owojo8U9rGNXcnW2U0YvkQhmBe9K 0LZ8QlnU+OJXly46/Lq8lrZJGL6Wt2Syncam27BoJZ86b8gzlIf2sh04TPfn8UDAtnWVRKuuumph Dbc6UZWnKs1+/YBPcQ/b9VE+F2bSp9Sv7LGGqvpxdABHW5C37lffJvhTT3jiRoEz92UgLzJwSWeZ s/dPxO4r4igOEz+OcWXOnDl5OOUfCwTKRw4wrjtiksKzKY1ts7oFbVPeIT27r1SedrVYGgwtwjJ2 9GinnXbK8QJnXQhs83OETPNAk/tklMfyioXr5pZYnlHH2Z1dwj6USXe3aMy1X7sKacPncJHbpQ5L nrDM8JndDDjoy+qoPBpzeE5td8YqyTKKsUqy41v5bbwN26/KQd90TLK8qo4aWrpRhNUutCOG9S6c xhXh3HSuRAZ0ReNYW5l8fvoMOduf+56f2raV52uHAP1Ef3CIjcekqy+GpZAmlxJGl9AhS6v8Xfkh b+kvPvXQs8rTc1m66EbpS0bJENZR8YP6nRhlECIUeFDBuspvgYvJWJdu5Qjz27yWrk045A2PWOck PkYbxotGPumWn8I2HRp3k4kAC70unb1AER3hs7P6JbjLcsp49VG+DAvoPr+cN3HkUV+p2kYtnupf ei7zbT3Jw1eehonz/PnzC9GYLGN141di62K/3PMVMPK3wRbeGkvBGF6jdGrnvmSwi32OKlknrMGy 7OV7rjlyx5duYk55Y0adGD1xylOWTjzt1Dc+VeW3TdOxiqr8Vu/a7IoAG+nxq6++WlVUL2lqv6bt g66lOMYqLbIpY9hzAjIK3xR57ZcJ27Yn4xn4WN1IKXuYNOxOoT00/nbRLporqUeqQcbWGdyQadB7 Zeb7/GRhzcNN+/dSDDxirBEIx3G1N30q5pROWlk4zMc4bmnD9EGfQ9523I7Voy59UHm6yG9lhF9Y xy7KgEe3K7mupJoQPmoUGkvhQUTXC0AqjyZlQpv68pVavtONFwJd6SG14h4Vfl2+66678kqiP1we yeWilMNFj/xib+9b6RKNPsrX8SD6AduzMYDI0feYDMv6lO07fIUmPDIiPvItveJiflhPaMBYl7jy 6ds+ccY4hazs/sGPHWHSV5eQrewFXYsWeGjbOfSpjvt9uLcG3RrFgtbKiQx9OnavyJii4xUqT19W 4jncfSEafI53xe4U0g4N6XHXx8DE18oyCWHu4rGOoy3aWaJ46TB1HFSH9TU68W7rx15g2/Iqy5eq 74xVfH2HOUF6MMyxCvlVrsbrsjoRr/YkPEh7kn/UYxIylDnm4nCupl34rDfjcZs5RHMlZTJG2bkS fVE7xMJWnzDy182VZfUi3uenpdGx+C6d6jGTjoD6lurBM21e1e6iIY8Niwe+XV8yLozKVdUDmerS RyV32C59yeFGmX8gOwjgsbx1L1MoHvn0hxi2o5QpZqwsKQfWz7J80KjMOtnEz/3JQqBKN9rUhM+E sjDkssS33367eBGjHLaGa3s426f5FbVrA03X5VfpPX2vCj/1HXBkQdelo57saPjFL36R42x5Dwtn 3RkT26bPy71c7OgSada4YL8WpHx1Pl85wihDG+hS4ao8VeOczWfH1Kr2t3n6Ds8JjnZxP4eMBroT BBmq7rZBX7hDCrxoH93n9NRTTxXi8/WwJq5K/5vwmQRaDKuhUaZLHYZ/F87qbxf8YjyatHs4Jlt+ GAQxhMCvrzlB5dWN19DRnsJvkDGJcSNlTJJsVX7quFXFI5YWaxfVvc0cYsdK6YfmQD1DozKQifdP PcvnnqZBHXXz+WlQFD3/JCAQ9ilkVr+zY0dIZ9PK6qk+GabTn1Pyh2WGfJo+p5bblO+k04/OXDZk 5MoUUmKkKKVou/A1scErLJtnm67ybJwNKz3ko3hoxZOOhQMPxYvOfUcgRIBt3yeccELG5y45tsL9 KuiQ/eNCv6uvvjq78MILa+9bCfnXPXdZPn1A+k+5POuP/kAYX2Gl4Vv6/CHyD96WNkJSGsUvghbn cEcKvC3OOkZQyrBBgr7GQRbKCY8wqSzqFrt4VkUJW9ErPsVXXmiFYVW+2PgXo7d8addxcVYuezEv X7iRC3VA8fgsVISTNZo988wzBVnqfTJFhgkJqN6pOhCrVpUu0DaD6LBt21jZkx4XjsnoKXUGU+HW 11jVFjvJ1SS/2lHzQZO8MVrxi6XF4prqd1m72HJtu9TdjWZlUp/D1x87S4UNcTyLzsZbPm3CPj+1 Qc3zTAoC9JmUvq6+Rb3oX3I2XnExfqKz44Ho8ZVu4zw8fARmxU4ZFJhJGaWLKStxw1DIWNmxJoeu rONYetUHWnVSW0ZZGB7kUX7L08OOQAwBXrj4EpS+BsX2/Iceeih7/vnniz7FC9///M//ZGeccUaM xUBxXZTPS6sWvZtsskl2yCGHDCRTmJk+SJ8bpF+V1ZPjLuLLF4rOOeecTnFmYcWRLupgjzDxJSA5 XXisZ+uTpi3voVHH0pWF7d0DbY4alPEd13juldGuJIwyGFm4aFljed2Wf3YiaHy3O7fsvNHkPplx xSkml/oY/aGtY2dW6MCUMQzXVoeRiT40G3Q4NlZxQexzzz1XjFXg2fVYFbZb2bNtTzu+lNGH8TZP TF9C+rpnzQ91dEpvq9+xdmGutnNI3VzN58M1H/QxV6qOqb7PT6lIOd2kIaB5XHJrDme8sE5rNuL0 niBfdFVjBmtgeIqvpQ1l0Bwrvn35VeVUpfUlzzjwndnq4yBRDzJImaV48lVU08lS+Zr4lGE7AXlD OYiDhj/bedSJSLdO+ZmE1TnJS3xYls1HGBrlD9P82RGoQ4BF44IFC7LTTz8923HHHWeQ/+hHP5rx 3MdDm/I5ey+no1d67tLvsl+pnhi62KWisQF5u8TZ/hopYwFlaNs448vXvvY1oqJO2CJfm63+2uZO OeIVK6huXIvlGcc4DCaqi/DiHgiN9WXHxGxd7EIRg1g4putIlM0zLeGmfUwGQ+qPjsWOdnH3Bo75 tI1RBh3mxbdOh/NCxuif9HBQkRirMHQzVuk4nXh3NVaBbarjE+Eqn+O3TZ3GJPJJN5rysPTILnls fN/hcA6x5f34xz+2j0WYMVhjUZ9zZVFgTcDnpxqAPHliEdCYoDnNrv2IUzrx9pnxRH1UlRcPPcsX T/EiHtoyeksnHn34VeVUpfUhy7jwnBVGGcC2E2LY2Datr4bRy5r4284gefCJh9bS6zv2ymvpidMl ndSD/KQTxtly4Bk6mx6m+bMjkILAnnvuOcMwo90oKXm7oEktnxdr9R17f0QXMgyDB/XEMKO+zS+Z XTmOuggbeOpODJXBpL7FFluUFqdFC2NMk23xIUMWxCymypzGK8lVRjfu8Ztvvnmxe1Oy2k+S2y80 KT30t99++yKKu2S404M25K9qV1ORacID0oWUativXIUvssovvYOv+pjSUn141+lwKq9h0TXBMVWm vffeO58TGA/Qx67mhLK2i8nFmKS6xS7FjuWxcRoP8aUbNr1JGH1CduQZ5dgVzpVl86DGc+peRtOk /oPS+vw0KIKef1wRCOcanu1aTWMY8fRHnjUOWjrqp3jlkS+eIb3GOPKKljD09pm4PlxVGVVpfcgy Ljw7McqMO3jIpwkR4EN5peh9NgplqMOE5Uge+dDZzhLKJzr5pNOJrLP5lWbjRBuLU5r7sxOBX/3q V9lVV12V3xNz5513JoHAy551g3x9pK/yuYhYfYY+pi/gWLmHGb7++utznMH6jjvuSCoanLUzDn8Q nMMC7cWn99xzT6b7SRgjbFqYj+c5Sy6vhU7jLF/qSnX6uhP5eWmoMkhovPrTn/6Uyr6gU94iYsQB 2k/6+MQTTxTGrNTPtW+11VbFuM8RKHQBfvxtueWWI65d/8U3ac+77767wKpsHkaHcfAFQ30BLY+s +XfvvfcWFHU6XBBOUEBjFXeHNR2rwBJMuxyrUqCjPa2ONGnP+++/v+ibyF81JqXIojEbeV5//fWU LEk0ahfmkC7nal3aT93pL9aomSRYD0R2DvL5qQeAneXYIGDHLQmlOPyyNR39FSda5VWcnftCw4vN A519tny6DFOGZA75DqP8sMxxeO7EKDMOFamTQUoMnW1sFEJKYePr+DVNt+WoPPEIn601M0xTnjpf +aiTOqJ85SVNdIpz3xHgM7psWeYYC3cEtHErrbRSm2x5nr7KX3XVVTPulVE/x/jTxNX1lbB/1fFG FnBmhwNf0kl1yEFZ+IPgHJbH527luCvo9ttvzx8pJzS6iU4+Z/7BFwe+yqv0Kl9GGWjYal/m+Gy2 2iD1E7V2Aam8ZfyHHW+/CMNnhqU/VZcphzJy9wOOI1DWEDatl/zaeTz1WAV3MLFTgoUxjs8Hxxw6 zMIPPUGHre7E6G2cjvkRN+iuCsu3r7CwSOWvsYo5oelYRRm803QxVjWROxyTmrSnNbKtvfbaqTCV 0qFXyI5upRqnUuRVuzCHdDlXa65UhW688UYFk/w+xlqfn5Kgd6IpRUB9Sn5qNUWPb+dPvW+Ij+h4 JmyfRdO1X1bGbF6bzhqjjBZiVUpVpiBVebpOs52mC3ksD8sbuW1a1/VwfpOLgD2mgs7YBUdZrfhl Ead+xiWLbV2f5R977LGF3lO3a665JknM888/Pzv77LNnLHzDjLy8h30spLHP7HTAaXJsgrP4DIKz eMjXr6Oqg91mn/JL8YknnpizYlyBB7/e1rmf//znxVZd8n3jG98ozWIXR1xUqUtZyzJQvr0Et4xu VPF8bl5ORwTALeU+GeWzO2LsvSmrrLKKSKbKV1+hUhhlnn766dr6XXbZZTmN5rsqo5fVYQwJqTqs PsP4d8wxx9TKNGqCphcR2zEZ2ZuOVbRbF2NVU7nbtqd0hbpWjUmkpzjGLvHscuxSu6hfNG0XZC9r F+ZKOfS7y7lSfJv4Pj81QctpJw0BvTuHcmvcCOObPMND/DVXxfJ3UVaMr8elIzBrjDLpkAxOGSq9 VXQbpqTwmTh1HvlldMRbp4lZcTHeSnPfEShDgJcfdiXg0Cm2/vNFnjLHJ3nZToxD55S3jL4uvs/y +QWQSwzVt/iFEYNLmXv33Xfzr4ew4CVP1RZxdnnYPlj3gowcdkt2Hc78Qi2ckXdQnGN1nrNky7+t AzTrrLNOjDQax5c6cOgBi+ZLL700SkfkT37yk4xjSCqv7mtB+++//wxeCxcuLL2f4brrrsvLtxnU 5jZulOHYbhawaCJnzMCg3TNd162JXF2XXcaPX/DpNzGHoeuHP/xh9vHHHxfJfOWqzkmHoUvVYfGM tanSxslnrLLtydd5qpwdk6Eb1VgV7qSrG2ORtU17Cpu6MQn+Kc6OXbwfpo5dkqOsDLULdPx12S6a KykbmVPmynPPPbcYk6vmyrL61MX7/FSHkKdPKgK8M5Wt2criY3UVrfwYjY2rogvTwrWt5TNIWOVo vNOz/EF495m3D/mm+pPYvOBaJaLBLYg2nNJwyi+fPKESlfGhLGht3pDWyhqm2eeY3HV1Vf5YXqW5 3w0CtKMWmm04Dpq/TZlhnhNOOCFf0EgnH3zwwYw/vvjCsQvqxxdK+LM6xXZq8g7q+iz/qKOOyl+K +SIH9cPgctZZZ+UiY4Cgjnx5gyMypKt+9N1TTjmltGrgYtuOIylsKeflFuPOd7/73aXy8ksuO3BU hsV5jTXWyLe894lzKBAXdHJ0ybq6o0uWlq+vXHnllfnRN3SEYzVgC3Zzlhh82H3AEQjVV3k32mij zC5cFB/6/DL85JNP5vrHYhuDGscCaDMW4eCME3/SdBxUcSHP8HmQvhvyqnoGk9DZBWSYFntGt3DS O3z9eh6jHyQuFb9BymiSl3aivizMOQJH32UnBTqnIyLCBb70p7KjS7Zc6fArr7ySR8OPPoqr0+H5 8+fndF38s7I35UfeKsdYZdtz8eLFOY4YicvGqtiYjDEHXsOYE6gP5ViHEaJujFV7Mu5o3qoak/SO RlunjElWnqpw1djFRcj62pPaxY5dVXxpFz47zjhHu9s5RHihw23mas2VXPwOb3ZPaq5k9w/9TXOl LlMG47q5sqo+VWk+P2W5Dldh5GmTh4DGHCSn/+vdIJwDLF2sljZvLF1xTfkqX8xPLTOWN4zT2BfG a64P46fx+Z+msVKqE4pnG9mGRZPqk1f5rW/LIFzm1MmU19KRFnYS0kUr3+ZRWGXKD+Ptc8gnfBat ++0RoC0ZQAZxvIzhpDOpvFLpoUuhPe2005a644MXOxbF3F/xxhtvFDqKjNwZUGW0SK2H6PosnxdZ zqjTVnqJpFwuYWTnDy/wvOSqj7ArBXnq3L777luQ0I68bGPcsUeBCoJ/BPisePgLsMWZsHVd42x5 86ngUH+b7JSBFy/yBxxwQK5jVs+4WDlmkDnooIOyww8/3IpRGj7wwAPzhZnlSzux44bFAe2lNoMv Rq8UfRc/fBlxSoXoMMHulIJtk6NLEgPdlA6jc01+3U/BRuUIIz2n+m3z1fHfdddds+985zu5UY76 Mx49/vjjhUGG/NLluXPnZscff3wdyyIdHd5vv/2KcVJ6hQ6zYwAn7PCb6LDyFYVFAtBI9khyZVRq Xha4chqrGP+qxqpwTAYXxicuquYiXdrAuj7GKis3ZWGMrZNbYxL0whXZ7ZgEbjjiac9DDz00f+7q H2OXPmOvsjR26ZglZeMo/1vf+lZy0aeeemq+A1TvDmTUHMIl4IO0C3MlmIu3ZGfMtXMluPKHoZg5 rQ/n89Nw56c+2tB5Lo0A/V59n1TCrOnU55RD6zxLS5ziRRfzNe4pzeaxYaXLt2XBI0ZraWL5FNfW t+9kYT1CnjH5Qppxfp76nTK2MQdpCCaiUPHCODqQLQ/lsc9h+coP3zJlt3mg04RIPGHlk2/pbVjp qgN5+Zt0BbZ1HIew8EUW21ZNZENnaC/LKyV/Cj0ypdCpvKOPPjrjosybbropf/Elv9Vp5GRhyQts H/dY9Fk+Rz/441JaPkdMPUPHL4G8TGtHQpgePvOZYi6YBC+1IxjVOerJXQM33HDDjK9z2LbqE2cr H/eUsMjCzVnya3EbxzEO/vg6yHPPPVfonDCBJ5+FZvHR1LFI4MtQYMz4xZ9eXrgkms+5LliwoGAL htBUtYNwRr62/bYosEEAjOw2/6Z3ZlAUOnzrrbcW+qaFX6oYKfjAK5UuLFfYhvFtnm070k7ch8GC 9JZbbsn1jN1TVk70gQVlE0OV5Ap12JatMZC+0kSHU8dfWwfJk+rbPlaVJzZW2TqW5bVjsr6CJjzI ozmBPpg6bpaVFYtHbr5Q9utf/7rQ+RhdGGfbk/FD44Gwhp57vhjv+3IYBjV2qV/IRx52DNqxS3LQ LnUOw5Odq6GHt20bdou1aZcdd9wx/8Q5lw8znuv+KslOWYxd9IU+3gPgL+fz09I7LIWN+5OLAP1f /Yl5wj5TK/rxMst8tmRXumpbNq/AT2nhGKLxDx62LOVRPqXji4dNs+mSnzhounDw1NoanpLB8pbM +GCUOgdaHuMS/j8XXHDBZ6b5ASSyDTEAm6SssQZRRhTLptfJVZcuvvjwDZUszI8ioDySIUyHj41T GL5SIuW1tNBBI3r50IZpyicannHwFy3PhPX8b//2b0S5cwQcgY4R0JjQMdte2V1yySX5BbmMLyed dFIvC6teK+DMpxYBe9Rv9913b7WzaGrBGbBikzhWUeVJlXvA5pq12X1+mrVNP5UV/8///M9iLaY1 ptZm+rGJimsNKAMKz4pTPtIUFlh6tmtT0ijD8hdf0pSHsFwYB711YTr8QxpLH4bD/GXp8LTrZOgU h898gGGG8ofh6uRuKsNMVJvmHgF9VSOHDdUlWLFyQ/6h0ofpoZIoXcobym/hhSbMj0zqVOJl8xAW T+hsHaC3z2E+f3YEHIHBEVD/HJzT8Dhw/wCO8aGPX7qHVxMvadoQCOfAaavfKOsziWMVeE2q3KNs 60ku2+enSW49lz2GAO9adg3HM+Oa1m/kwdigNZul11pOaTH+xFlePNvyCFfNrSpDNGFZlhe8cSHN Z7HN/1OmlS+sBxwVhw9ukrN5aaPPMXFGGYGfAl1Vw1SlxXhDH+bh2cpjw/AI6UPFtelh3pgMYX7y KJ94yVe8OgbPSpNs9jlWnsc5Ao7A7EKAizO1yLGfW55dKHhtHQFHwBFwBMYNAZ+fxq1FXJ5BEWAd pj/x4pk1m9ZvxBMWnXzFY7AZxMGvykkerUG1vlSeWP5YnOhjfhk9ZVKeyo7ltXGhbDZtEsITZ5QZ JagxpdACJpQLBQuVTM8xPmF++2zpxcMqnuJsHtuZRWv5WFoPOwKOgCMAAnzJRuPJ/PnzHRRHYGwR sHPc2ArpgjkCjkBnCPj81BmUzmgCENDaLSYq72n8QcParoo2lr9pnN4Ly/LVpZflS4mfTWvXiTLK NFG6PhUEJRJ/+THZQkXSM3kUTlFIlQFtk3whb8uHNJ7DuDCPPzsCjsDsQGDRokVFRblAVZfKFZEe cATGCIHYnDtG4rkojoAj0CECPj91CKazGlsEWJOlrPO6omkLxLDn3yZr1WHL1hbDWL6p/vpSrMJd xDVRjrLyxAPlif3ip/Qwf1l8SJfyTKfukl9KmU7jCDgC44EAfZ+vaPCZ6sWLF2d8uUbuuOOOU9B9 R2BsENB8OckvXWMDpgviCIwxAj4/jXHjuGidIyAji9Zleg4LKosXHf0GmpAP8eE9NcoziK85OcZD ssTSPC6OwFQaZVCEKleXbvOGtOoQYbzN0yQcGmR4tucDY+XYF9JYelUc8tv8TWR1WkfAEZgeBP77 v/87ahCeN29e/lnv6amp12RaEGB+ZA4L581pqZ/XwxFwBD5DwOcn14TZhIDWbVpjUvdwnovRWIys gUS0+PDkj7XlIIYZ8bJlhjLaNMKxPCGNnuto69LFZ5L9iTq+VAU0jYVyqNHwrbPxKGeYbmlt2HYQ 4skX5g2NHGG65VcWVh542TIVtun2Hhuliy/PYSfRM2nwsb7yue8IOAKzCwHGBcYbjV/4e++9d7bH HnvMLiC8thODADrKHCadnRjBXVBHwBFohIDPT43gcuIpQIC1GX+42DynNFtV+onWh+ozNl15tPYr mztFR14btrzCcMhLcli6VF7kqaOtS7flTmp4anbKyPqH/+mnnxYGGjWMFBdfnxaLKZDo5Yc0KEUY J9o6vyqf5IcHii7lUx7kpl6qn9ItLXmhV/14ho58OPFSnrBD5UT+zxFwBGYFAptsskn2xhtvZKuv vnq22WabZVtvvfWsqLdXcnIROOqoo/K5nblrww03nNyKuOSOgCNQiYDPT5XweOIUIcDajLWa1mZa 34VV1E4XG6848iosHzriWT+G4TziH/8oT+tD0ZXJYPOlhFW3Lmib8EopbxxppsYog+LhpIBWwYjX M74MNMTXuVBZxacuXyw95GVpJD9xyMez7RRWbhtv6wINaRhuJKfiYs9V8ljZPOwIOALTh8Ahhxwy fZXyGk01Am6Imerm9co5AgUCPj8VUHhgliDAmkzrMvzQybiidR3p0Gn9yNoPJzobJo+NJ82ul215 NgzdIK5LXoPIMSl5p+b4kgVcBggbZ8N16W1pbb5Y2JZrw6JVHD6KjK840Vg/lh7GqbOSL+QVPlve HnYEHAFHwBFwBBwBR8ARcAQcAUfAEegeAa3DrG8NGXYNFyuddOWN0ZLGHzxj6eIpHjxX0Yk+1bd8 U/PMZrqpNMr02aB9KBgdAAumDDHIbztlk/rE8vUhcxOZnNYRcAQcAUfAEXAEHAFHwBFwBBwBR6Ac Aa3Z5FvKcI0XPltawpYHtDyHO2bCPHU8Q3p/7g6BiTDKjEpBrDIPCnkdr9AyKfqw7qJTuuTSs3zi RSuamG/pY+ke5wg4Ao6AI+AIOAKOgCPgCDgCjoAjMFwE7FpOazb5kkTPlpa0cA1JXEhDXOjEL4yv e1Y+W67i6vJ6+pKjZ5MAAg1qG7gvmYdVRlcKGpO3K959Yex8HQFHwBFwBBwBR8ARcAQcAUfAEXAE xgMBu35kfRlbY6ZKanml5kmhq9vlIx6DyC4eo/AnwigDuNwmndIYgyiCzWvDXTZMaKG0z1VlxtIU J79LOZ2XI+AIOAKOgCPgCDgCjoAj4Ag4Ao7A+CIQGiGq1oVlafBQGr7CqnVYhuJDP8wXprd9rrIF hPaBvmRoK3tqvokwygAugMuAUQV2qtLUARTjU1VuFT/xIr9uxw7pqZ/owjRbf+hS5BBWIS9/dgQc AUfAEXAEHAFHwBFwBBwBR8ARGH8EtKaz6z+F8RVWTcrWk6TbNPha3lVrzLAMldW3r3LxkV3y2nJj cTZ9UsITYZQBTHbKyFmFUpz8rhpGSiC+g/iSCWW39bA8iRddWD+eP/3009ygA02ZYcfy87Aj4Ag4 Ao6AI+AIOAKOgCPgCDgCjsB0IsAaMVw3lq01QYD1rV3j2jUla0zxszTkC8sgLtWFvFLzQady8bVO DvOzvraujM7SjGN4mXEUKpRJhogYyDS0Gox8NhzyafIMH6tENtyED7TiBQ8UJ1YPaCxdWAadRjLE 8of0/uwIdIXA+++/n/GHW2eddbpi63wcAUfAEcgR+Pjjj7O//OUv+dzIXLfWWmsNDRkf34YG9dQX 9NJLL2WvvPJK9vrrr2effPJJ9uUvfznbc889s2WWmYhX7alvH6+gIzCtCLA+ZA0pZw0tipNv6YjD gCOjhtahxId0YRnQpLqQV2o+6FQuPnLq2fII18Wqj6WZhPBEzBSAi9LEGtXG0VBdORrY8h6Er5XL Ko4NWxqVRfmKl6+0QXzxkj8IL887/Qhcf/312RtvvJFX9Iwzzpj+CnsNHQFHYKgI3HzzzdkzzzxT vBgOc5zx8W2oTT2VhWGMufbaa2f84Mb7HfPm+uuvn2222WZTWW+vlCPgCAyOAGsxrfesPwhn8Yzx 0Novtsa1+WwYPjH6GH/iwrzhc1m+WLwtt2xtjp3ArqkJT6JhZiKMMmWNEGu8ruKsEnTFM+QTKlGY jhI3dcgdyxeLa8rb6T9D4PLLLy+g2GGHHbItttiieK4LPP3009mzzz6b/5L2wQcfFOTLLrtstuGG G+YvcNtvv30RXxfg1+WbbrqpkkyDIWXwy916662X/33hC1+ozGcTy/TK0owinFL/FVZYIVt55ZWz VVddNdt6660H+tWS8m688cZictp2221znm3qTvtfd911RdZjjz22CKcE0CUWsq+99lr2t7/9rchC O2+wwQb5XxNdKhjM4sDDDz+c8Wf7JnDQV9glBq7z5s2bxQj1U3XGqFG+QI3j+Pbuu+/mY00V4hrb VllllewrX/nKQGNbWN5sHNveeuutbNGiRfkuF/r5HnvsUQV/nvboo49md9xxx1J00ucvfelLS6V5 hCPgCDgCk4aA1hKjlLtsbW4NMqOUb9CyBzbK9L3YHwXQKXUqs8Kl5KXRmtSrimeYFj6HClKXHtL7 89IIaNcIKW+//fbSBJGYF154Ibvhhhvyl70wmUHmo48+yp577rn8jxc8Xoj33XffkHSp5/fee6/Y xbJUYhBBOWytfuihh4oUFprHHHNM8RwLsEttXPWmSf2p2+23355XcZtttsnmz5+fh5v8o7w333yz yHLLLbe0NsqEsv/973/Pll9++YJ3WUC6xD1TuLBt2Db/xz/+Mf9roktl5c2GeIxjYFbmOF7z4osv 5n933XVXbphJWbCV8fP48UFgXMe3v/71r0lju95FZBhoO7aF5Y1ybGMMiznGvD7HNna7qGzmyZQ+ Du5qA2TG8L/zzjtnGMoYm8sWEbH6eZwj4AjMTgQ0VoR+HRqij9FVpYX0dgwL0+xzE542H+FB8oa8 Up61zpaBPCXPqGlm3owzamkmqPxRNLIUrA4m+xJAJ4g5xVvaGJ3HDY7AwoUL863NetkLMVdbUBJt zN/jjz+enXPOORkvym2d1RfCsSOAnH0/66yzor/0qdyqs6miGUff1l/yKe53v/tdXm92RQziaMtL LrlkEBaN8lpdQm+s7iCL6meZdqFLlt+0hc8+++yoQUZYhv2V+rNgo39a/KcNl9lSn0kZ32J6SBvx LoKuSl+7GtvgPcyx7dJLL50xT1J+6OhvqidpXY9tTXaPUj67Jq077LDDsv333z83yBBf1mY2j4cd AUdgdiOQMk4w9qXQgaQdI5Vnkt5VUmQdxRp8GFo68E6ZYQiZUkZKI8InlS6lzBSatuWV5UMRWVzj Qho916VbuZXHxnk4HYG6gYG7EuxuGujnL9mhwa9poWOnxNVXX539+c9/ztuWdrz44ouz008/PSQt fd57770zfimlHAZmyUeYP3bK8McRKnZq4Bi02YJN+QceeOBSvCdJR2L1B8/nn38+3+XALic7YfEr J3gceuihS9U7JQJs3nnnneyJJ56ItmkKj1SamC7tt99+2VZbbbUUC+kSu3po3za6tBTTKYzAIIlD J1iccxzkq1/9an4HBMfArOOYGL+ks2sGR54f/ehH2SmnnGLJPDxhCIz7+IaeMY5zYSzHEe34xdzC 2MadJhjYbV3uvPPO7NVXX80WLFjQukUY237/+9/nR6NaM0nIOC5j2wknnJBdccUV+dzI2FrnwB1H +6y++urZxhtvXJfF0x0BR8ARmIGAHbdJ4Dk0pug9jrHGplv6MJ405gvx4rmpi/FM5RHLG4uz/MrS qQNpcnYeVNw0+FOxU4aG4oVaDSY/1kBtlLOKX6yMruMkM53RdjDFh+VBh9MvgJK/jD7M78/pCFQN DBx3+MMf/lAwW2ONNbLTTjutdPHO0ZXjjjsu49c2OdqOXxBTHO3LAp12JyxfYRaZc+bMyV/uv/3t b+cv66RRBvV46qmncoNQWVnSp7L0UceX1Z8vuey66675MS3wP+igg4qFDX2FdmJRMIhjq3+fjpf/ J598siiCOlGXmEEGIunS4YcfnhtkaN8mulQUNMUB26/QbRZVJ598ct4/Q4MMMKy77rq5AQajJw48 MdCwiHM3+QiM6/im+Ry901iOrPxpbDv66KNz4z1jm3UYbFLHNvQZ/uE1bH+LAABAAElEQVScduut t1qWnYc1T1I+TvNkytimPPi2Pw8iJFh+5zvfyTbaaKNaNhi/5TbffHMF3XcEHAFHoDUCjMM4jW+a mzQXhIwVr3w2PYwTT0vTVzhWNrKGMugZP5aOfKLpS9a2fLuWayqMMigsZ42lmPIBOaYUVeB3DXBV WSlpyMOv3NQDn7rh48pkVbrunFA59mWLMDxtnOjc7waBu+++O28jcObv+OOPT2LMy6C9TJTLB6vu uxBT9KFJe86dOzd/kSePBv2f/exnYlf40qcvfvGLRdw4BlLrz8vzmWeema200kp5Negn1njWpG62 D3W1KIiVv3jx4qJtKRPjXYpDl7jfQO2bqkspvCeZhktN7d1A9IXU/jl/yU43LszG0RbsoLG8JhmX 2Sj7pIxv4XweayvGNr5cpctlqZs15sbyKA5dZgy1709Ki80LShvU544mtQEypPZDxrYdd9yxKJ6x DSPUMB3yyq255poKuu8IOAKOQBICsXd2re00vmjsZ5xUnGUuHvKVHxqNraKP5Vda177koEzNLcgT zjFhekzGME68u5Z51PymwiiDItLIaiT5gGvDKWCHDZ+Sp08a5FHdCMcUmvJtPbUAiym+ZBXPkEbp 7qchUIWfjo7QNnxZqYmzFwzS7hyPSXFV8pTl58VW+oNvv+RDHvWJFVdcsYzF2MQ3qT+7hdgRQX+h 3j/5yU8a14N8KpOjBHwRqQ8Hb5XTRpfUvsiWqkt91GNceHJMUHgyfxxyyCGNRNOXsoTrfffd1yi/ E48PApMyvklfU5Bjpwfjmt4FUsY26bLlr5d8joDypbc+HMYU5KSspmMbR7pwkpOjVsN0FjNhPczy vSxHwBGYbASqxnWNL8xRhBljFGdrrTlMvPQMjeIs/bDDyKw6IE9ZHYgvkzfMY+s47Pr0Wd5UGGUA KGwwgda04cr4iN8wfCuDDVN2XX14OZFlNMwbk10vM7E0jxscAbVBm7PmfMIZBw++uFPmBm1D7mGx ehX+2ij+TXbKoIMcuWEXQd9O8rUph+3+aiMuVW5qVNltt92KYqlz3efJC+IWAdWzjS6tttpqRYlV ulQQtQxwBwX6Qxnvv/9+Sy7V2bgXiCMPbR0LTHuBNp+1b+PWXnvtIlvKTraCOAjwmfU+MeuTP+1N 3S2eQfWG+giO3KMSGparhFC/Sh3fNLZxh8s4u3/+53+eMbZxPLXKyTAiGsY2vSBT5/BSW9F14TMG U36bsY15UnL2ObaF9dTF/Yoflz4gedx3BByB8UdA80+dpLyjMw5Dz5/eW8mnsHzLy/KPpVvasnDb fDF+dbzK0u0aBb5ldLEyJyluai76LQN92hqO+vAXKij1Vxz+tNW7rH1HHW8HvCpZOC7R1HHhKJ/J rnK0s15IoZMOVOWpS2NhYy8iPvHEE+uy5OnhRahhJu45OfLII7Mut3kPWv85S+7YQS7dDYBRpcnd ANzzwKdPyUc7IA93jHAvQddO7dxGl7hTh8Uz+sHE3qVjIUT9uV8lNu6w2D3iiCOS212X7yIjRjPa gwXwNddcU1yyS9oBBxxQeqcO6WXu/vvvL5LAY5999imemwT22muvrO1dQhiVbrjhhhn1sWU3xczm Jdw3/4suuqi4KNyWDZ70iX333TeP/uUvf5kbnHhgR552Ntg8g4TZjYheyAhD+VYH2XmB7lW5lPHN jm2M+eqL4ssYctRRR+X3oShu1P7cJUfy7Nj261//Ottiiy1KxQrrNcyxjbIxyrQZ2zAeDWIUtYBc d911M3hxFMw6xrky49Ztt92W8WddmN+medgRcAQcgVQEmNeY33Dh/GN5WLo6Wptv3MN2Xh93WQeR b+qNMoOAk5K3alE+qBKV5Q9fPEUnv0zuMF8Zncd3jwAvcuxIaeI222yz/CswVXk0SIumTgdEF/o2 X5sXYy3Swhd7Ww6Gj8suuyy/UJWvXHThuqg/C3+Os+DAAeNCk0+jstB58MEHM7bh41jAsShOuSgy z9DgH/i20SUMG02MTakisUhhd5HVnzAvC2bafbvttmtsAOEsNQaZRYsWFS8kIf+mz+y0keNrS23d Ouusk6Us6EP+VQs79Z8PPvigNWZ98mfXDZ9JLmtvDH58ppjdKvRxfeEtxKCLZy6w1X0pGgdCudit d9555w30hSyNbZI59kLM2MadUlwW3dXYpvIG8Uc5tkmXU+QHU9qOu72azpN9jW0pcluaJvW1+Tzs CDgCjkAbBBgz7dyncMjL0oVpgz77uDcogjPzT83xpZnVGv1TWecYlWTjJs+ocBhmueuvv35eHIMW L+0slvp0XbQxsjY9188ijcUXeXH8ys9FxWyfnz9/frbJJpvMqDb3o/R5Ke6MwhIewvr+7ne/S8j1 GYkWgeHllOwQqHPKW0dHOl/+wbF4GYYu5YXV/Dv//PNzA5Gd8LkAl50n3InEAhWdkF488sgjje/t ueeee3KDDKI0watKdBkK6C/IOEx3wQUXFIYElcsXdIRZuIvssccea4RZn/y5U+SnP/3pUu3A8RF2 YmF048s5OPr4Oeeck38uXvXs0kf3ZJCBLztC2NnBmMOOHF10SxrHTP7rv/6r1RErjW3wQY8ndWzT 3NDmzhWNberHfBY+xcWMV7F8GttI++ijj3qfJ2MypMYxl6Fn/IVGd/qx0uSn8nU6R8ARcARiCGjs jqVNQlxX722TUNcuZPSdMgbFQZXH5rdhU0RtsG2+Msbih2/D0Oslqyyvxw+GANvZOYqhy7nY4cCC sI+jLUiq9m0qtW52Jx+yhkaKKn733ntvxq/nOF7C+ZVz++23n5GFF1Qcx3p0xwy7Sh544IH8y0Az iMfg4dlnn53x9asqkeyEiQGK7evE0bc4VsEnqcuczVtGo3h0xh7rQZe4w+CYY44RyVB9vsZij4xw VCK8LFdfELvyyiuzV155JdcPdOWqq67Kj7GlCMyOEdzKK6+cHXzwwfkngFPypdDQX1hIDcuB2Ycf flhsPd50003zOtnyhRl9hR1CyEg7s5Or7hhO3/w5boXOapypOo4U7i6xdRw0zN0m0j14cSQKWeTY YUgcuF188cW5vIxN4PP9739fZLU+lzdrbKPeHMmaxLGNsUgGEsY2i1UtCP8gYGz7zW9+k2NJ+9eN bal8odPYBsbstGLnXZ/zZBPZQlr6LH9ydkxG55rMneLhviPgCMxuBOwYzfiqeRafNPyunPin8pMs TfOJf0z2trzEc5r9f5rmyjWtW0x5mvAYND9ldcHDyix+Zb6l9XD3CPzLv/xL/iIr/DFK8CJ3/fXX t/rltnsJPzOWiC+DZfgLoNJiPrsfdEcJv3iGixabh5dvftEWFhz5GRcnmZBHhoCmsmF8YteA8ODo hI40NeUVo5cxD1mZqFm0j0KXON6mT0Ajy7bbbruUQcbKj3FSR6cw+nG0K7wk09KHYb76ddJJJ3Vq QFF7cx/QMByLezCjf9F29BOMTGWOthZm0KBLVZj1zf/hhx8uXhSRh8+sV90Pw5fNMKR17ehb9itA CxYsKDUyUP4PfvCDQgR2Ydija0VCScCObRxVqxvblltuuRwjdAuD87g4+pzcIGMbu4/QXVzXY5vm Sf2AoXmSO176ujBcmAziaxwZhIfndQQcAUeAsYT3AxnQNbbIHwQhGXbEHz/VidbKobhUHiGd5RWm zfZnN8oYDRhU0Wx+GzZFRIOW1oajxA0jxU8LRb1U6bkhOydviMB6662XHXbYYflgq6y0ARcT8plS ttVzrIl7TNo6tWmb/Cy2/vSnPxXWeH3xKZUXC0W99OtX/qq8u+++e2G0GKTOVWW0SbOf+x7kKxrf /OY3Czzoe/w635XD6HXooYfm7DRx88Bl0OgSBhou8+wb15///OdFlTCypVyUy90WWnAhO8dCUhyT 98knn5xCmkSjtqVt4D2snTLsfJHjHpuUezMOPPDAHDO9UFVh1jf/u+66S+LnR3jox3UOQ5rGJvl1 eerStfOFtuOoFDu0qtwyyyyT6RgpdCzyUx1GHHQW2VPGNi5mR6/4I++4OMY28OKvzX1hqgeGNo31 1PHyyy9X0sB+OE8iK4558sILL8znyWGMbU0ronGkaT6ndwQcAUfAIqA1mXauM7bg5FvapmH77kU5 9v0xlVcXcqisrt4HxG+afD++1FNr8lLRRonb5qurhl5yxJ9O6R2jDrVu0vnMJ19hYNs9W7PB3uoG R1H4W3bZZfNffe1nllMkgJ/aNYUeGrb/s7hmkaoBmsEao0ITp3pQvha8VfnH9aw9OyaEhfCoqkdV GvdrcKwLRx/D6MYCO3RtypkzZ052+umnZ7/61a8yjiLIUQ78uCgTXSK80047ZU11SfzKfBZ1dsG5 3377lZEuFY8hQl8n4dfvlAuVqUOXjvt45NBdFu19O3ax2HL333//5CKFGbKyyyGGWd/8+YQ45UvH 9GWllEpIx+Wn5CmjYcxCbzTWVR0NtDzoe9y1g2u6U4R6I3vK2MadOvyNm2NsAzfaT0aVtjIynnDP E475omxsA7emLpwnbX7agLGNP+rATi3G2XFwbeo6DnK7DI6AIzA+CGiO1BjNPIeTP4ikjFGaNymn zZjVhRyqQ5e8xHNa/P7fSKcFqYb14AWojeK16SwpotlOCT3yuRsuAuwW4O/uu+/OHnrooWKRgxS0 B4td7jHgL3bfRJW0tC882DGBcSeme7xEa1ECrSYBlc+OnqaOLe3wpHx+Td9hhx2ashgbeuExaN9g scBlwcIaI8nXvva1GZePUulBytHRl9/+9rcZu53k1K7sYGLxhC5xDAa968Jx9MiOUXU7FWyZGORk lEFOjkDY+xksrcLoch+O/qExsY4/u50sva2/zUubxI7sUE+bpylmfHabFzX6L3fzhPn75q8jP+of dW1mMVE4Nh4pLdXnOBFOWNrdbVU8Qjp+iUwxxjG26ejMpI9t4NP2Zdxiu8suu+Rf19LYxmXLsbGN 9tZYZPOnhGPzpPqfxkyM3vx1ObalyOY0joAj4Aj0gYDGS+Z55nu9n8jvqsy2/KrySfZUGat4pfKY Vjo/vtRTy3bxEtqlaOMmT5d1mzRebP0/7bTTsu9+97sZn1PG8cKsRQ8DHLsg+HqJFkQpdSQ/v8iz kOCX3fBPL9IqTzz5Ys6ZZ5651GJP6VU+v/ozwOJY7HCERgvvqnzjlqYv8iCX2mEQGU8OjtwsXLhw KXZdlMOCyOoSPDVBKszurKa6tJSw/4jAKCDX5LPhymPHIctL6X37wkQ6m3LUi50i9EPuhJFPmGN/ +Pqz/cvWw9azDWZ6QUN2DDCh65s/9cPZtgtlqHvu4iUMPZbjK0hNneRXferyM7bhyEefmoaxTRjU 1b0q3Y5t6GRsbCM/aYM4O0/qfiXLkzZBJ84999y8Dw5Slud1BBwBR2AcELBj3DjIkyJDU5m7mIdS 5JpEmqnYKaMX7GE3AC8Fw3KDlGXxgY/tQDZtWHXxcj5DgIUFW+v54wjC7bffni+61D5YzDlidOKJ J+YXyKbipjZl4FNYedX+/KLP5ZV77bVXfkeE0pv6fG2Cl2d2/0hudonwKV+eN9hgg/wYzbh/lQID lrDhnpQuHPdQsCMKx+IfY9X8+fPzZ/4N0qcLJv8IhLp0xx135Bfqqk3QJe6A4Hha03uDbFnWAIAx r6njE9Rcfoxcr776atPsA9Oz+0GYwAzDSl091IfC/mT5VAnWFWboSwyzvvmDkRz4tXXCsW1+7Voh P0eZMJJUubC9VD5GGfsZ5jIejFl82t3ep8PYxh9uksY21ZHLiLtwfMGJnUtgGhvbUvtGiix2bHvn nXeyxYsXzxjb2BXIbrZBx7YUWZzGEXAEHIFJQEDvs1WyMn53YSBJKatKjrZpXcnftvw+8k2FUaYP YJry5CWEhU9bR8dIWaSFL5q2vLrOpZdSm8fD44EAC2V98pbFs90hwy+R7IaIubBN2fqtXxVj9H3E cb6fL5NgQHr77bcL4wZlvfzyy/kfYRZ0/Po8rgYaLSRiR1CQv6ljQffEE08U94lgqOKLNX0dyZF8 6JLu22iiS8pf5etuFMaaNddcs4o0msbFuhhlGOu6/DJVtLBIJAY3+wJh+1mEPI/iPqiY+/3vf5/d euutsaQZccKMyLaYYUhAP2O7PPrmz04hHGMNRrVRuar50bYp8ulZvmTmuclltxhWOXa3aNGifGyz vCdpbNN7Q1dfG2Mc434XfZocQ5Ud28BZZQr7LvzVVlutt7GtC/mchyPgCDgCgyIgY4P8pvx4V2AM LnNt+fYxppfJ2Da+bd3altd1vsH2l3YtTQt+NMA4OGuQKZMpFq84+XV1qaKTDFU0WnjWlePpo0Pg 2GOPLY410ZYMrlyoGHMMknKEuSxxFA5DwwknnJCdeuqp+c4ZHS+w8vFL99VXX51dsOTSTenqKGSt K9N+raWOti6dL9DIcQyFO3+G6dClLbfcspigOWJWpktN5WrThnpRYByyutG07EHo7Rhod4E05bnZ Zps1zdJK78FZMtfdhdKmTer4q2wqWzW3NAajRQbpjBb9PPMHLtIpPctXPL6OgjUpmiNnGtv4wpK+ ZmR5jPvYpnbrcmz71re+lUOgNgjHNpVpceoyrHlSY0qXY1uXcjovR8ARcATKEGgyTopWY14Zzybv AeJpecXiSLfxNmzzDjscysF8NMlu4nfK0AC2UQiPolGsHDZslSMWH8ZVyc9LJS8e5MGFtLxw0hlD nlYGD08GAhxpeuGFF4ov3fBp0DrXZCCu49U2HR3kolt9GeO1117Lj/BIfiaTDz/8ML/jpGwHQtuy 2+bTkRD1G34Z78qxoNt6663zHTP0V3Y1cDkvd8HwPAz39a9/PXv++edzXaJ9uK8I/WrjdPkpuqYd FE342J0ew/ocdSgfBkQu1WY85dhg306Yofu2/qnlkoe8yBvbadM3f4530Y9xbdo8tZ51dPQl+g84 YBA75JBD6rJ0mk7f4aJb/nCMG1yybcc27hXi/qbZMrZttdVWGZf9op/smuEYa8rn0rtqGDtPohdq i674Ox9HwBFwBEaNgNZ6WvsxF1W9P4ouRe4YbSwu5JVCE+bp43lc5OiqbhO/U4aXAetG1UC2g9iw lS0WH8rPi0WZk8FF6WFdMdjgYuUoj/vDQYCXde4T4S/lc6oxqeyvmpybr3MM1OPmuLthwYIF+SKF ewjQbxmPfvSjH42FuHxemn6oftPVFn9VjiNbuuCVMh588ME8KbW90CH06YEHHii+BiPeqT66xHgB 9uGYk8oDOu7RwNGObRbo3AmBHPyJV85wiP9Y0At78LDHf/oQQ9hTZhujDEcCNS/Ejv71zZ+7p+R0 XEXPw/TRF7UbR4dG7dZbb71ibOOYE22kvjVOYxs46d2hq6OZwv6AAw7IxzbpJ197a+I0RzK2tZ0n aQe5lHlStO47Ao6AIzAJCGitx/sjf3qHRnal2XroXdbGlYVjtJa/zWdpbdjSDDs8LnJ0Ve9yC0BX JfTMJ6aQPRcZZV8lR5XShPlitHrRC2lDQfTCWkcX5vPn9gjE2gtud955Z35BJLsibrzxxlYF2AtI q9oU/SC9bCBtVXgPmbhzAMOM9JTdCqN27EZioalFhXb4dC0Xxx+su/DCC5N3aXDRKPrEJ66vv/56 yyY5jC6hH2A/iJ6wAJIutlkAkZc+w59dTCVXpANCdjqo34LHlVde2QHXchYYTVTnNthLN8HOGkhU Yt/87TikuUhlD9PfaKONinZL+WrWMGXj/qhxG9v4fL0MjujQTjvt1AskdmyjHMa2VAMLYxtzJDts 2s6Ta6+9djEm9VJBZ+oIOAKOwJggwHuA3gkQSe8yVjy9o9m4snCM1vK3+SytDVuaYYfHRY6u6j3x RpmYQnYFThM+VXKESmNfbJVPflWZdTTiW0dXVYanNUMgbFvl1qBGW7S9twKDgVxVm1IW6TJ2KE/f PgaCq666Kv/DaJDiMMzYuuhYRErePmhuuOGGgi27WXbbbbfiucsAR0zsBczcQXHzzTcnFWF1KeVi 2hhTdAk+GAXEL0ZXFzdnzpwZ7acv0dTlI/3++++fYRAqu/9I41gKzzY07BbQnUfoIhcOa/Hahl9d HjCzjgufU53deYCsIS/4hHFd88foI4fuPProo3ocqq8dQSq0z6Mqg4xt0t9Rj23sAERnmKMY2/o6 VmTHNupuxzZhoTYLfY1JxA8yT2pOqSsvLN+fHQFHwBGYNATsOBdbg6SMh6KRDwbiKz/ExcbbcEg3 zOdxkaOrOk+8USamkF2B0xUfq/Qhz5j8TelDnv48egT4IpF1bNNu6uxLfcr9G21+hW8qk6XnRV9f IOHzqG3cSiut1CZbJ3m4mNLu9uDiyD4dX8ayhrPUyQRdsrSD6BLlp+hSGQ4YM/gCihyf3k519957 b2EQ4tftMsdCzda3jG6Q+IMPPnhGdr5S1ZcLMUs1YCKPNcqUYTYM/pShuYpdDSmu669r8VUx++Uy jA5NXNW8GvLR2Mbnxjk62MTJ6DkuYxvzwrDGNtVd/VfPZdgztomGPBxjauqYJ1VeWR9pytPpHQFH wBEYFgJl42NK+YPkLeOvMTlM1zsA8TYc0g3zeVzk6KrOE2+U6QqIpoqtl4CU8psqTRV9UzlT5HOa 7hFgx4Ud2BYvXpw988wzyQWFi0Qui61ztrw62i7St9hiixlsUl6o2S1hHb+yDtuxa+Sss86ascWe +ypY9KW4qv5Zl/+YY44pJSnr2+iS/eoOW/65rDfVSZeQmzJSdKmK94knnlgks+Bjt1Sd43PplK1x 8xvf+EZlFumy/EriFokcnbL3s3Dc4rzzzmvEqYlRYBDMJFQVZn3z51Jd6SeGzJRjdOjdIH1F9ba+ NS6gS9dcc41NLg2ff/752dlnn53xGfMUp7FNhu5RjG1tdD82tnHsK3VsS8GmjKZqbCvLY+dJ6ssR zaZjG3ogrAYd28rkrIvvWs/ryvN0R8ARmB4ExnH80HyfirLe7VLpm/JP5TvpdGNtlBmmovZdVpcK 2AWvLnhMuvIPKn/dIHT88ccXRfDSyELm0ksvnWEMKAj+EXj99dfzT0bbYyrc6bDddtuFpCN/ZlGr XRPoE7+gcz9AmePYAy/dcquvvrqCnfmxLfAsIp966qns17/+dfbjH/84u/baa2eUhxxHHnnkjLiq B9t3mo4b7FJhkdTUWV0iLwaBprqE3F3p0iabbFJUgd1SyFLm2JGkdqEfjGrhFMp3xBFHFMeY6Msc YcJYV7dw59jMueeem7300ksFS3ZWcKl1lQMzjRnc95GCmehTMOuTP3Vbfvnl8+oh03PPPVdqjKNu P/zhD/OjaravVGFDmvqS/Bg9xgWLM2VhcClz7777bv41JF1QnLpLibGNcUGL/dSxTe3VxdgmXqqb +pCe8blb5+mnn86PQtqxTRiuscYajcY2y7tp2I5toexVvMKx7brrrms0tqmNuhrbJKsw1HOV30TP q/h4miPgCDgCXSKQMo61Hb809nYp72znNdafxG6rKG0adZCybF4bbiOH8pTxUQdTuny9BOkZPjYs vvjQio+N93AzBBiQyjCGEwaL73znO/nFhzxDz5Z+Fqk4tuJDAw/i1YakEYaeYwP212HSrKsq39L1 FeYXehZgyMEfXxbijxd0Pt9LHfhKD0YmfnXmGd2j7vaCyC7kg+/VV19dygpM7fEhCPlFvO3noclv 24znFHf44YfnmIV5q/pkqEuUU6ZLfK0HQxRYW1enS5a2LszOCS7I5XgHDlkwaFCHOUvuUKGtMVqg E9Jl6DBI8TWqVBdilJovle673/1utnDhwgzM5Ljr59Zbb80fuX9mhRVWyN57772Mzx3jbH14ZrcX /bzOWczQwxTMaMNUzPrm/73vfS83cKieGOPYfUIbc2wEfPjjGUcdtdNEeap85ZNfRnv00Udnl1xy SX5RNrQYXNA9HBchM/bwlS8+WS39wWe32SmnnFLGdql4xifGNvGwYxvGDurH17T4Qw7oiOtjbEM4 jW30MWGkMGWrvyvcdGwjv+og/kuBUhOhsa2GbEayxraLLroor5f6huZJ5GIuQZf4hH2oU2Cw3HLL Vc6TMwqseICXMG2LQQV7T3IEHAFHoBQBjd0hAWMR4xJOYdHq2ablhP/4p3HM0tl0wuKtOUBzSUjH s+XDWKy8MdpxiRNW4yJPlRwz39qrKEeQNgmNDSySE2W1yqz4MujUWWLpyitfNORJyQe9zUsenqWc VTxUlvv1CFiMY9Qs2M4444xs7ty5xcu96Fg466WedrG80KNtt902Y9FY5XiBtQ4+w3annXZaviiz 5WKIeeKJJzIuguUXXvRNsoJJk8WR5VsWpt7SacIxHFQ+aVwaSru0MchY3rbNymSLxbNLI3SWb5jG s9WlMP3TTz8tdImJkrpa2dhpVadLIc+656OOOirbb7/9ZpRD2ewkYQeDFk/CnTt1WLSlujo8UvnU 0bH45us5OMrUiwnPHGtCfzE2gKfSScPxxZ0Ug8xn1FkGZvPnzy90VfHCTDqseQT9bIJZ3/xPPfXU bMUVV8zFBgvJC0Zc8Moz8ZtuumkGrXVWH208YfEJ48ueMQZ/7Wtfm5EMf3YactExBiPkkGPnCuNU U0ceuzOHMhizn3zyyXxsw9gs2WmzvsY25FZ91K+QRWWrv0PTdmwjL3UQ/6ZYiT42timtzAe3008/ PZ8nVSfRIhc4Y8REtlCPttlmmwyDYReOsigDv4lrSt+Et9M6Ao7A7EBA835Y23DMC9OrnpVXvqVV nMZcxjHmkrLxDDpkFL3yW57jGFadJkHesdopA2BqbBp20JeDYSmHZNYLjZRW8VaOMmW3NISpu/iF aXoO8SJe/EkjLCUULcrJAk7x4uV+OwRibRzjtGDBgjyaS1r503Z6tTPtQZgFD0cVwgVHjCdxtr2R BZ0ZheM+ARZlfNaUhRF1QdcsPhw9OPTQQ7NVVlmlMxHF39absPSbdC7cZMcDv8h+5StfGeiiW/iF 9WpTGRZOLPZ0mTPy2jpU8YzpEnKhC6p7G12qKrMsDTz542geR1osNqrPZpttlmGQaergNSw3b968 jD+OLnF/iD7pq36JLOqr7MTYZ599op+nTpGXRSR/YIYxRjps82LUCC8jtulV4b75n3zyyRkXPD/+ +OPFHKM6sIMEA1fsiJ70ISY7OPMnPjGaME5tdvvtt2fPP/98vpsJGsuHHTwYtgYZc9iZw9jGl9ow Pqmf2bIY2w477LCBygnrJ/7CTX1b/QKsNLZRPkZ8dpQM6lReWz6MbfxpF10TPrGxjfwW8z7HNnTH jmGpsrfJk8rb6RwBR2B2IGDHOVtjG8+4zziV6vTeEssXzreM/awP2VVq0yhPMsgnPeRp595U+fqm C+s0jjJaDP7PBRdc8NleYxvbIGwbrkG2ZFIUoMo1Lb+MviyesmNpVi6l45c1uGjgp7w2zobDMi19 GZ2lIb8c9MojnzRL/+///u8id98RcAQcAUfAEUhGgHmFeS/mdKyINHb8xIw1sXwe5wg4Ao6AI+AI TDsC//Ef/zFj/pRRXHNq6IOH4kJamxbS2DTCONHYsHjaOMJysTxKs3kVZ+kVJ78srSxe+UK/jj4m V8hjkOe68pvwHs3P6okSynCQSD5yMhrGGj4kkI1LrZPo5ItHXeNbOoUlh3zx1LP7joAj4Ag4Ao5A GwTK5iR+cbPOfu3KxnvYEXAEHAFHwBFwBLpHoOl6r46edaXm/LI1Zve1aM8Rg0xdndpz7z7nWBtl uq/uaDhKgQcpPcajKm4SOssgeHheR8ARcAQcgfFFgGOa1sXmK5vuYUfAEXAEHAFHwBGoR6Bu90ef a8AY7zp56mvkFCAwtkaZSbJs9aFKZQpuO0NTjPyluI+Wcp6OgCPgCEw/Avfee2+2aNGi5IpCL8ed Tu4cAUfAEXAEHAFHII5A2bovRl23/utivWfXmzEZbFydPJZ2mGHJJX+YZbcpa2yNMm0qM0l5mnS+ unqlKhsdrIuOWiePpzsCjoAj4AhMDwIvvPBCdt999+WXePM56irHxYJL7qorSJhzTjrppOLZA46A I+AIOAKOgCPwOQKsCWNruao1m+it8cSGP+fuoUlBYKy+viTQpGh6nka/7zqGHVPPvDDLKU7P7jsC joAj4Ag4AiECG2+8cR7FC+I777yTcYEvXw/bZZdd8i/+MJfwtZ2nn346/xKS8kO/55576tF9R8AR cAQcAUfAEQgQYE0owww+cyrzJ/FVhpmAjT9OOAJjY5RB8fTZUfxp+mxzzPhBp7MGkmHokcV4GOV5 GY6AI+AIOALTgcAZZ5yRnXfeednHH3+cV4jPuV9zzTX5C6Od4zTPELfTTjtlO+yww3QA4LVwBBwB R8ARcAQ6RoA50xpkLHsZZJhPRaM4S+fh6UBgbIwyGGJQOhlk8FHUaXXDMsiAoTowHVpfxFDctOLr 9XIEHAFHwBHoFoFTTjkle/LJJ7Nbbrml+NIgcxlzixzhtdZaKzv22GMV5b4j4Ag4Ao6AI+AIRBCw 6zHmU9a/cqyLlW7DSg/9FJowD89hPsokbpKdjFiqg4xfeh5Hf2yMMmp8/Gk3yKAIw1J4dWYpH9gO yyCkMt13BBwBR8ARmA4Ettpqq4w/3Isvvpi99dZb2UcffZStt956GZ+9Duec6ai118IRcAQcAUfA EegXgXD+DJ/rSm9KL35hPq3JlT6Jfrixw/54NK71GRujjAUoBNKmTUs4VHg6RBjXpK7kDTtVLD8G mRS6WF6PcwQcAUfAEXAEhMBGG22U8efOEXAEHAFHwBFwBLpFIHVtN2ipYTmDrkkHlaeL/JO4U+bz PcddIOA8WiMwiEGGQlMNLal0rSviGR0BR8ARcAQcAUfAEXAEHAFHwBFwBCYOgUHXpONQ4Unc4OFG mRLNqVLIvhtaZfddDlVXWSUweLQj4Ag4Ao6AI+AIOAKOgCPgCDgCjkBPCPR1vEZryb7XeyonFZ6+ 5UmVY5zo3ChT0hq+o6QEGI92BBwBR8ARcAQcAUfAEXAEHAFHwBFojYAME+FRmxhD0cbSPG46EHCj zHS0Y2Ut1JGtFVNxlRk90RFwBBwBR8ARcAQcAUfAEXAEHAFHoBcE7AdYtFYL12m+WaAX6MeKqRtl ljRHqPhj1UIdCKOOrK1x1FdxHbB3Fo6AI+AIOAKOgCPgCDgCjoAj4Ag4Ag0R4Mu4WotqrebrtIYg TgG5G2WmoBHrqqCOLusrHV3hurye7gg4Ao6AI+AIOAKOgCPgCDgCjoAj0B0C+pH8008/LX4s164Z rd26K805jTsCbpQZ9xbqQL7Q2kpHlyW2A/bOwhFwBBwBR8ARcAQcAUfAEXAEHAFHIBEB1mdak8kI ozWbfMXjK5zI3skmDIFlJkxeF7cFAmEn1iDQgpVncQRyBF566aXstddey15++eUMC//aa6+d7bnn ntkyy/iQ4iriCAwLgddff70oap111inCHnAEHAFHwBFwBByByUCAdRpHmOwpBuJkmKEWNlxVqzBf Fa2njRcCvoIar/ZwaRyBsUYAY8y11147Y+JA4DfffDPbYIMNsk033XSs5XfhHIFpQmDRokV5dXhZ ++pXv5rtvPPO01Q9r4sj4Ag4Ao6AIzD1CDCHW4NMWYXd4FKGzHTEu1FmgtqRzihnw4oL/RSaMI8/ OwJlCDzyyCPZ4sWLy5KzlVZaqTTNExyBSULgrbfeyjB4fPLJJ9m8efOyPfbYY6zF97F+rJvHhXME HAFHwBFwBEoRYA5P2QlTRpOav1QATxgLBNwoM+Jm8I404gbw4pMRCA0yW221Vf7L/Kqrrpqfcy2b LJILcEJHYEwQuOaaa/JjeYjz8MMPj71RBjn9njBQcOcIOAKOgCPgCDgCMQR4T/cfcWLIjEecG2VG 3A6+kB1xA3jxSQjcdNNNOR3bK1n8HX744dlGG21U5HU9LqDwwBQgsNxyy2UffPBBXpNJeYHRFxsm BX7w5U4cxhPGldSjj++//35+XFL1nDt3roLuOwKOgCPgCDgCjkAJApPyPlMi/tRHu1Fm6pvYK+gI DI7Aiy++mDNhAbXaaqvNMMgMzt05OALjhcAJJ5yQXXnlldm7776b7b///uMlXIk0k2YYvfPOO7On n346rw1GmTPPPLOkZjOj2bH37LPPNs43k4s/OQKOgCPgCDgCswMB3g/44YaPcTDfTtr7wuxopSxz o8yYtbRbMcesQVycHIG///3vBRJbbrllEfaAIzCtCBx11FETVbVJmzvsSyFfnUh10JKX+vqRrVTU nM4RcAQcAUdgNiLAPMl8qa876Xk2YjHudf6ncRdwtslnX1RnW929vpOBwJprrjkZgrqUjsCUI8B8 oV+9Jm3usEYkG65rMmib0Nfx83RHwBFwBBwBR2BaEeAdAce8qR80prWuk14vN8qMWQv6y+aYNYiL kyNgF3z+67QrhSMwHggwX/ivXuPRFi6FI+AIOAKOgCMwzgj4GnOcW8ePL41367h0E4kAl1d+9NFH 2RprrJF96Utf6qwOzz//fPaFL3whv9Pli1/8Ymd833jjjYzjSfbiXsv8448/nvHL9F//+leb3Dj8 l7/8JeMPQw9fblpllVUa86jLUFenuvx8EpkLRZvI9+abb2Zgw06iruqkS025xwdZuna0+9tvv53R xuuss062/PLLd1LEn//85/w+ltVXXz3X106Y/oNJX/2gSxk5u/3qq6/m57fXXXfdLlk35kVf+Nvf /pa3w8orr9w4f1WGQdpCRyKb/nJHPn7568o4zEvqCy+8MJKxtQpbT3MEHAFHwBFwBByB2YPARN8p MwkWv5iMsbjZo3KTXdOzzjqrqMC//uu/5osuIi655JLsnXfeKdJsYM6cOdmhhx5qo5LCLPL5NC8L qtjCZcMNN8yOOOKIWl5W5oMOOijbfPPN86+ewJvFuNwBBxyQ8ZlrHF9beuqpp5Q0w7/tttsy/qw7 44wz7ONSYS4KvvHGG3NjVawuGJn4otNaa621VN5YRFWdWLRpwWbrJD5nn312YWQ68cQTC6PBFVdc kb322ms5WSgjRhFoQ/fII49kv/3tb/ML1MI0nvfaa69shx12iCWVxtEuulg5RsRXag4++OBY0lJx FqfjjjuuwPeOO+7IHn300aheYUjhotum7q677srAQ8dpwnFu/fXXz9rc00I/+OUvf1l8DQm5aB8c ZaT2gzxD4r/rrrsu++Mf/1hQ1+k3hOjOtddeO6NPFQyWBDB4HXnkkbnRzsYPEi4zTlx++eUZxpiY 22CDDXI5Yml1cXZMEq3tK1VtUafXVlfhLcxj+dS/oSvLR1qZs/UIMeR54403HmhsRQ8wzMvFxiGl ue8IOAKOgCPgCIwaAd6n9G4lWWJxShsXfxJkTMVqoo4v2Rex1Apaupiy2XQPOwJNEHjvvffyhQ+L fGuQ4aUeh88fv8JeeOGFTVhnt9xyS/azn/0sN8jAg0FH/MTopZdeys477zw91vro/6effpovHlm0 WYNMbeYBCDDG2EUKdcFRHzkMT8j0m9/8RlHJvuq0aNGipDqpfArAgMMXdn74wx/mhirJJLwlBO3L 4s/uEsJQcPvtt+cGGTu2iAd5+VLMBRdcIDaVPoYSypBBxvJRGJ8vz0BXZjQrK0Q7Ey699NLcIAMd OzrgqT/i2DkDf3Z8pbqf/vSn2UMPPVS0qcUYHvB/5ZVXcr6PPfZYKtvs5ptvzvsBn0+Ghxxyq42a 9gPxSPVt25blueiiizKMeupTFk/y8Az+l112WbZw4cIyNo3jwzmRMs4555xSgwwFvPzyy9mPf/zj xmWpLeir1tm2hnfZmCRZQ2xsfsu3r7CtB7JILsrTcxudQicxzDEOWYNMX/Vwvo6AI+AIOAKOwLQh kPLONW11Vn3+75JfLv+fHsbFL3tJs/E23Fbutg0/SNlN8oa04bPqXRavdPlldPPnzxeJ+zUI3Hff fQUFi2J2G+DQpblz5+Y7TVZcccXcSEMcL/y8rH/yySfZww8/nO28885F/rLA+eefny9gpZ8rrLBC znennXbKOH6AMQhDBA7eyMQXkcqOnliZ+fUcme1CRHJssskmxa/46Ar81l577dzHcCHHTgpoSfvy l7+c776Ys2Q3UMxhjNLiXvUhDzjwiz3Hc2QsID+/YIPr9ttvH2NXxMXqpETqRln80SbhxcQ273PP PZcbE6gvR8PYRcRuIY6esUD78MMPc7aS/Yknnshlx2DG8RTKWnbZZTPqv/XWW+fHlliQ8Ud+8tH2 /JUdD6MAjFHWWEG+7bbbLqPN582bl9cBnCQPvNnJsdtuu6naUd/WlcU0RiQwx9F+1BW5uJUfw4cd I2iHXXbZJcpXkRghzj333Nx4qDgwYccEsnEkCl2FtxxGSvQ4bBely8dwAMbC3vYD+hj1sP3gnnvu ydtgueWWE4vWPp9q5oidXBXO7JKz/YNdX+jvjjvumOMAHpYX7YhhbdtttxX71r7aF4zo2w888ECO Cc8cm9piiy1ynJGPsUJYghu0u+66a1LZYVtQR3QH/eSIpsYk9IdyYm1BPO2mcUN5JAD9R2mMEXP+ Maag67Q9aeyko93hJbfNNtvk4xB5bD6lW5+xVeMR8cjO2Kl6wJu+iqMM8KWeZTol/KHX2EpYDrz5 Y3cbY4o7R8ARcAQcAUdACPDup3lZPmkKW9+GlV9xNk8YDp+VR754iS6Mr3quShM/yz8Mh/nD9NTn VD6pdKnlQtclz4k9vgQIdgHRBEDRkr9LMMXX/elFwOqdfg2NHVE58MADcxBYsOLQNRZCV155ZeUR DnaVsHhmIYcLeW+22WbZnnvume/YuPjii3O+yPTzn/88+973vpfnKfsHnRbHLI4WLFhQHGcJ81AO f3LsnJDbZ599Mo6i1DkMF+wsoS6UjSEnPHaDwQEHLuykACcWsFdffXXS8QHysrijDBZYHBOrW+zH 2pD2YgEbc+yCoAwcba7jT/ChPI46hI42/N///d9ijHrwwQfzdgvpeOZejscff7xIwpBE21jHYpOF Pne1sNtC+sFiua7d4YOs2oHD4vYb3/iGZV+Er7rqqnwnBREsTlm4VxkS2QVEm7FwRqbDDjtsKTzU xhZHdiuw2C1z9AOMF6pn2A9Y5O69995FP2ABjWEJnfv+979fxrbzeBbl7KJS/ZEpNChiNMDpeByy cmfR/fffX2v0ShWYNhBeGDe+/vWvz8hKn8WBD4ZPHOMRMh199NH5c9k/HTusagvGJAw/7JhCFmjZ +WZ1E7n4k8Ogh/FLbv/991dwhh/mk1FL/Xh+4o8KHMkkr/LFdEr1YGylTdGpsB5WOLU7vnZzYXCs Glttfg87Ao6AI+AIOAKOwOcIaI7+PGb2hD5b+U1gfXnxS3U0MC7Mo/hUPk7nCIQ69P/Ze/dgW7K6 zjPPvbcooCiKAgqwwLKkQEWal6hBA9MNUsD4Ch4KIWqAysBgzzjT0eMf0xPTbdsdHdMx0RHT0xrK IL4VsRUaNERbpERtEARFoEsoKFB5lFAv6gUlVffeM/nd53zP+Z3fWfnaO3O/zmdV7LtWrvV7rU9m 7sr1O5m59R6UtneGvPrVrz64g0W6Sjw0FS2Cr7vuutliQDK6sG+yrQt/vdPGX15aEHix1WRfi0HJ K3nxile8ojEh06Tvfi1AuooSK5///Odnixr51F0BOSETbehdI/qLtYvuptACqk/RAtBz6krIyF7c h5qL7oJoSshI/uUvf/mMm9ryJY4q3//9338sATEbqP/RnQTxPULS090RpaK7V1y8oPN2rjW/pz/9 6bNjRFx950yWy9ueszg1JWSko3eeyK4XmzFZlG3qriEds7Kt+b3oRS9q5CFdcdQi18dP02M8Pg/s r895ILuKQ0mzpnep2N6Ytd6hoyL/SlTmhEz0peSH7j4zAyXqxiyyq7urckIm+tB7hZSUU5G836EU ZWJbiRslTnzMt+0Lvdxa30kuOjan2Bc61lR8TNtfW615fPSjH52JSE/nZtN3q+chPpJtm4djca3z d5Hv1rY5MAYBCEAAAhDYdgK+RhwyzyHXA0PsLlt2Y5MyWjj0Ld5ZQ3T62kbu5BHwF4Ye0Wh7JMVk 4gtidQzqL7aloscgdHGvj2511x0TbUWLhssvv3wmcubMmdnLUJvk5dcLBy0a5imad99zSH+BV3xa zOnWf/+lvs2vFpPSkQ/V+gt1nyL5IXPyHDQf8evzCIcetXIRR+13LcDaiu6gkS/7a1qgKvmkR6D0 +FTX40LypztPxEffa6q7FtaOUbJ9OOnODs1RfPyok23EOr7/R3eu+FiMMrn9rd/6rQfHod5dUypK 1vhYHXoeiLVe0rus4rvldJwrIdJVlADUftP8lHwasyjh0+c8c1LO/19s46U7X1QUb9994bvodLzp XVJ9is+RPrLzyGgePmf0CNSV+49GNdnS96mOZ8UlvTZGtiHZPueX5akhAAEIQAACEDhKYJ7rgXl0 jnpdj62NTcp4YdwHo3eWL0L76CADgSYCXjB68dEk534tlvRR0TFYekGrHneJC+A+v6oke89//vNV zZIfbXdN+NjXuxPmLZq37bTZ0GMMmo9kpaNfHulb9PiHFrjS1aNPfnFq1o/n/9A5yba+ExSbkgl9 ihJwsfRJnkheyRYza0qe6G4qfV71qlcdebwj+stt21Stx5/6lLbHkKK+f8JZi9GmokehYlKh6dGT rJ8f9fI8LKfjxo+Kqa/veaBfFVORPT+iN+tY0j86luL52+RWiRv9qpA/TXLz9LfdpZPt6XE4l/gr U+5Tnb+TdBdVn+JHN7UvZKNP8Z04fWQlE8//Lh3Pwz7iHWxtujqmNIc+x5S+T/yYXptNxiAAAQhA AAIQaCag/+cOLfPoDPWxDPmNTco40dIHUtxZQ/T62EbmZBEYshiIZJRsaCt6CXC0rRdb9il6TEbF CRMvPJp0lSSYpww5b/zuEvu5suOv0pZT7bs03KdfQSkVzddlnjn5O6HvvOIiVn6duHAMTbVeiuwS f6HLfWPUfZIBOrb01/8+RTGLixmVdPySY41pX+gun75FdxP8wA/8wOyugszfjwPZVt/zwHI+h/S4 yjKKHgdzede73uXmSurMsi2Iru8j6eZ94e+aNrsa0/uqYumzL+L5HHWb2kPkPQ/r5PiafPiY8njb PHSuDDkHbJMaAhCAAAQgAAEIiMDhyuaE8GhbaPRB4Iv+PrLIbB8BX9gPnVnXXTXXX3/9bHEru30X PzEGH5dNj8hE2XnaQ84bvzdHi8R5FipxcWlb88Q8ps68+z3ebeJ9NDQusdfdR/7Mk9xR/H39+zGP tjjjL9hceumlbaLHxpTI0MI4JjQspPeXOE7fXeaxPrX3U9f7lfrY6iMT7xDSftILsfVz9ute9KtY LuJdSubGl/AO/U7yPpSPZe0LzyfXi8wj2lr1PGIstCEAAQhAAALrRiD+v3/dYtuEePr96XQTZkKM EFhjAvGvs/rS0otwH/SgBx1ErLsdlIzQwk6328dfOzoQamnExWjfuzhazC00FBMp+Q6TPoa1yPf7 RnRHxkkrevGvfh7bx0Np/jqGvM9L41P3xeTfmD/1q/PACSS9a0e/dKWEQZxrnHuprT4toJdxHuix Nr14+d3vfvcB8muvvbbSS5BVNK7HWvLjbwfCa9BQEk68YqJGYcU7sPRImL6TzNt1W/iWadoXMfna ZmfRsTgPf7fKd9/jSv6XeUwtOl/0IQABCEDgZBPwddSqKbRdx646tnX0T1KmY6/kOwRWdaDnODrC ZngNCfjLSYsgLWpjUkb7Vx/LKPzY7pqOZZXsWXXRYtoLsj6/hpTjVSLHSZmT9Ndp/Sy4klA+DvKi 0ZzM1turqOP7ZEp3vMwbk+am4u9Z1fFuI7FRn4vHzErngcoyzwMlXfTY3Zve9KbZcev4FIsev/Mj eOL07Gc/u9fLwT2/ZdRiWkrKeF8oBu8P8fY+8HdOriXv/SLZpn2hsWWUkh/PIfr3flOf5+lxbTfN wzLUEIAABCAAgXUgEP//vcp4FIevy1YZx6b4JinTsad8wWmxVR3ouij0M+2li0zHR72+BLTfdDxp AZnfg+JFpfdtPu6aZuUvO9tuklt2vxc4mtfQEnW8uMs2dB7aRx7bxG39Okxc9On4eMYznjH7Ba7S rzwNvZNqU5jE/ar9m8+DuB2PfS+idR6s4rjQY3ove9nLZgmL973vfdVf/dVfzV44rBh9buuODf0a ke6aiz+zvui+iUyG2Ip6pfMs7gvZ1TuJ1Ge9+J3jPtX6SM5F26ss5u/5ONZSTB7z3HJd0qEPAhCA AAQgAIHjBFb9///jEa13D0mZjv2ji7JYdMEfLzjj2FRt+dSFpQ5uX1guO4ap5nbS7HqBEF8AKwZ6 qaR+PUmLI/0Utn46eFPLxRdffPALOvPc6XLzzTfPpq5jvOkRlFUsvKfaH29961uPJGS+4zu+o8q/ UjSV73nt6n0v+jlofT/O846bJr86D3Snlb7rNvE8UNz62Wt9VPSLW3qJ9yc/+cnZts5//arYT/7k T1Y/8iM/Mutb9B//P2roOWE9+S89Zqh94X386Ec/emO/k3xMbcN366LHCvoQgAAEILB9BHTtEYv+ /5774viy2jkOxRSvPZYVx6b4ObwPfFMiXnKc+aBeRTJEPn0gu14yBtwtSMA/0+uF0yWXXHLEopIP GtOX1Wc+85kjY5u2cfnllx+EfMsttxy0+za0yNcxLx6PetSjGtXyudkouOYD3t+as36Gd90TMsKp 94/4f6zxDp9FUfvYke34bqJF7a5KX+e1Eqz6CewnP/nJs2Nax7U+r3/960cNa8j/m3zXpQMoPWao feF97GPU8ptU+5hSQmwbjqlNYk+sEIAABCAwPQH/v9qe1uX6OMeR43S81HsESMp0HAn5ANLFtEts u2+KWn5yHFP4weZ0BPyX8iYP8UWg99xzT5PYRvTHX5qK7x4ZEryOeS0ym+6Uka1tOCd8l4mTUI99 7GN7Ycr/o+ulNKJQfCnsmEmZK6644iBK3aWxTUWPoykxo6L9Pfb8hpwPfs9NG1/vC8W6yd9JTuzq TplNnkfbvmIMAhCAAAROLoF8TTjkemBKajkOxZljndL/ptk+zDBsWuQrilcXqC6x7T5qCJQI/Omf /ulBd+n9DTEpI8G//uu/PpDftMaVV155JGT9Gk3fovdxqOhLW4mZTbhrpO/cSnL+uV7Ndcj/qPQ/ uiHyJd+L9HnBLhuKRT/X3bfoF5X0Thx99ChPLDGhp/51Pg9+93d/t9KjZ/q8613vitNobCsxo6L9 rTLmr4vlu19mDhr++aM/+qPZSNsx5H3hWNd5XzRMc9btY1XHqT6f+MQn2sQZgwAEIAABCGwUAf2/ bROK/z+8CbGuIkaSMqugPtBn3+SPT0rXA90gPpBA31v6tWCNC6anPe1pxzzpl5j0slCX3/u933Oz V61b86csbYu37Pd+97tfpZ+1VtGx+yd/8idZpHHbSRkdww9/+MMb5bZlQO9mcel73voRjL7ytj9m fdlll1UXXnjhgcl3vOMdB+22hh5ni3Hnlxgveh5E221xjDGm81XfAfrovTHzlDz/eWxY5wMf+ICb nbUfpxSvb/qmbyrKx32h83jod1LXvlBy2t8rff8fp0D1wuEhRY+Kxu/W3//93x+ifuR4HaSIMAQg AAEIQGAkAv5/quuRzGJmjQiQlFmjnUEom0VAizHf6dAW+a//+q8fubD3IwxZ56UvfemsSwsUfX77 t387ixS3f+7nfq567WtfW3XdkTJk4ZMdxf8J+C/nWSZuf+/3fu9sU7JKGOlugq6inxSOfr77u7+7 S+XARy/BBYQUlxeQC5g5pqrHlbxfVF9zzTXHZGKHHnfKLNseEZsiZsfz7d/+7W7OXmjbJymgfayi uZZeLquxl7zkJapmRXJDzgPdhaNfmRhaSgAAQABJREFUPlpGyY+a/fmf/3mn2/e///1HZMb+OfHf +I3fOGK/tOF32fi480uJS7LaF5LTeTxkX/zsz/5s1bUvtP99vpfuHizFoz4lBF08B2831Yt8t7bN Y8rzq2ku9EMAAhCAAAQgsH0ESMps3z5lRkskoL8ev+c97yl61K/I/PRP//SRd0c85SlPKcqqU3/R 1SMDTnr8zd/8TaWES1PRHThKxsiPyrvf/e4m0Vm/7bYKNQzGxUffhZB+sUVFukpgvfGNb2ywXlW/ /Mu/XH3uc587GH/c4x530G5rKJa+8djOUHnpOblkG/PUkaH1dVeRfv5aY/LxkY98pDEx8/a3v736 tV/7tYOFrG3kR4Dcr9qLXrUX2f/Sz0Xv+4lJBR1/TeeC3jujY1kJJM1VdzvE5Eu0rTs0dB6Y19Dz oO+jRNFnU7vtWNFjMQ95yENmqopVc287Bz/0oQ9V733vew9c+W6yg44RGjfeeOPsXLr77ruPWdOv u/3Mz/zMwfeREiGPf/zjj8nFDu2L+Ghl333h9+W07Yv4vigdp32SWoot6umY7qOn71a9W8bJn099 6lOd362ve93rDr5bm+Yx5PzS+2x0DvzET/xE9Za3vCVipg0BCEAAAhCAwAknMOw+4BMOi+lDIBLw IleLAn30l1999JPOSjBooaaLdsvpZ7Cf/vSnRxPH2i984QtnC+9bb711pqfFld69oaKXq+qvxLpb Qj+160eWtHDUIvdVr3rVMXuxw4vc2Ne3rXlY3/Pp0tWvzrz5zW+exSpZPbqiucjOlfV7ZxS/Xjga FzYa0yLwW77lW7rMz8b7xhKNeWEW+7raYixfii/G26UneX1UmvS+53u+p/rVX/3VmYz8KDGjj/T0 c75+1GQmUP+jR560wHPCoC0pE+O1vO001Y436jbJvuIVr6h+8Rd/sbrrrrtmInr8TOeCEk1XXXXV 7Gfedaxqke59JQ4/+IM/2GRy1u/zQMe69HweKCY91qbzQIkevZNFx5H3j2S7zoNWx/uDilG+vM+b dLTvlHg1Wz3GpPkrRt8JpJ+F90/DO049TuO7yZps9+mP+0hJIiU/77zzzoOEgxI/4qNjxLKOQYmK Zz3rWZ1utC/e8IY3zL534r6QYv5OUtJNMvLR9Z2kX3xSTCriraSW+CkRpITzD/3QD83G8j/xl6Lk R4ku3aWlubbpveAFL5h9t+qYkj8fU7Kf5xG/W3UsNx1TZiobiqWt6A43ncvio+NW/5+Ic2nTZQwC EIAABCAAge0mcGq7p8fsIDAugXjhrXcxaFHqhZv+Sq1HiHzHhxd20vnqr/7q6mUve1mvYCTnF4JG Bdn98Ic/PPtZVy8aNK6/1v/wD/9wFD3SdsyKZ5Ein7Jhe31svfjFL66e/exnHxPVS0P112rZlD0v zq6++urqO7/zO4/Jt3WI/5DieUSGXfqOb4iObIqXP00+tAh1EiomjKQXEzKKQcmIV77ylZV+5tf7 oe3xJdlw6cvJOn3nqnPAj2E5fsWkx4iUdPNCXXHozppXv/rVle4Q6io6D5zENH/F5vNAth2j5qZF edt50OUvjsueObiO47Etn7p7QzEqHjFQEkbfBfroe0E2PHbxxRc3LvKj3T7tGNszn/nM2fzF2LyU gIgJGfVrbldeeWX1fd/3fX1czGSUQNJ3ko85Kyq5oO8kJYM05mOs6zvJ+opZc1Bc0lfyTvu3dKeP dVRLT0Wspa8kpfR81+BssPBPPKbisHQ/+MEPHny3Kh59NI/XvOY1UfRIO/L33I8IpA2fH1EvibAJ AQhAAAIQgMAJJMCdMidwpzPl+QnkC28tgLQoe+c731ldf/31s0VFXJzor6xKSvR9HMeR6b0z+vzx H/9xpUcGdCeCL+Rd66+7z3nOc2Z/WbZeqc4xl2T69MmOFipDy9d//ddX+rztbW+bzcXxy45je8xj HlM973nPG2p6Jp8Xil1GPA/VMZYuPY1bt4+sZcRMftp86fjQR7/oE38+3byVuNFx5Ec3vvZrv3a2 ELYPJQHiuzbcH+u+nOzT+ybaaGpr3z3xiU+s/vAP/7DSXV4qka8SEVrU6+6ZISWfB7oLJBbNSUye +9znzh7/i2OLtCMr82izp+SjzlG9RFYLfBXpKRFjjlrgf9u3fVvn+drmJ4/Jh48rP0r28pe/vNId S3rfle5Oc+JCsrpDR4kunY9DS2lfeG7ipbbuEBqyL3TM6M4vvSg6Hi9dsT3pSU+a3UWmR/pUzMB1 m36eh79bxcn7S3c5KUGs865vicdMSUfHyK/8yq/MEq1K0nOXTIkSfRCAAAQgAIGTSWDnF37hFw7/ lDoHgz4XQUPNdl3cyN48fpt0mvpLfkqxRf3YbtLPMlEujkVf6o9jsW059zXVlsv+fuzHfkxdlB4E /CiRRPUrSk996lN7aCECgZNHQN9DfRIaJ48MM24i4LuJmsab+vXrdkN/lanJFv0QgAAEIACBZRD4 8R//8YPrpHi95D94uK+ptpxitYzbcbskF8c9V/VFWdvyeN4u2ejSb7LVpz/K5HYpliyTY8vj82z3 8dvX7rD7/vtaRQ4CJ4DAFCf3CcDGFE8IgTH/R3VCkJ34afrxnqEgSMgMJYY8BCAAAQhAAALrRODE J2V8V8k67RRi2QwC8c6jzYiYKCEAAQhAAAIQgAAEIAABCKyWAGvwo/xPfFLmKA62IAABCEAAAhCA AAQgAAEIQAACEIDAcgiQlFkOZ7xsCQE/kuF6S6bFNCAAAQhAAAIQgAAEIAABCEBgBQRIyqwAOi43 l4BvtdMLKSkQgAAEIAABCEAAAhCAAAQgAIFFCJCUWYQeuieOgO+QmfeFlCcOGBOGAAQgAAEIQAAC EIAABCAAgUYCJGUa0TAAgeMEfIeM6+MS9EAAAhCAAAQgAAEIQAACEIAABPoRONNPDCkIQEAEXvjC F85A6DGmK664AigQgAAEIAABCEAAAhCAAAQgAIG5CZCUmRsdiieRwFd+5VeexGkzZwhAAAIQgAAE IAABCEAAAhCYgACPL00AFZMQgAAEIAABCEAAAhCAAAQgAAEIQKCLAEmZLkKMQwACEIAABCAAAQhA AAIQgAAEIACBCQiQlJkAKiYhAAEIQAACEIAABCAAAQhAAAIQgEAXAZIyXYQYhwAEIAABCEAAAhCA AAQgAAEIQAACExAgKTMBVExCAAIQgAAEIAABCEAAAhCAAAQgAIEuAiRluggxDgEIQAACEIAABCAA AQhAAAIQgAAEJiBAUmYCqJiEAAQgAAEIQAACEIAABCAAAQhAAAJdBEjKdBFiHAIQgAAEIAABCEAA AhCAAAQgAAEITECApMwEUDEJAQhAAAIQgAAEIAABCEAAAhCAAAS6CJCU6SLEOAQgAAEIQAACEIAA BCAAAQhAAAIQmIAASZkJoGISAhCAAAQgAAEIQAACEIAABCAAAQh0ESAp00WIcQhAAAIQgAAEIAAB CEAAAhCAAAQgMAEBkjITQMUkBCAAAQhAAAIQgAAEIAABCEAAAhDoIkBSposQ4xCAAAQgAAEIQAAC EIAABCAAAQhAYAICJGUmgIpJCEAAAhCAAAQgAAEIQAACEIAABCDQRYCkTBchxiEAAQhAAAIQgAAE IAABCEAAAhCAwAQESMpMABWTEIAABCAAAQhAAAIQgAAEIAABCECgiwBJmS5CjEMAAhCAAAQgAAEI QAACEIAABCAAgQkIkJSZAComIQABCEAAAhCAAAQgAAEIQAACEIBAFwGSMl2EGIcABCAAAQhAAAIQ gAAEIAABCEAAAhMQICkzAVRMQgACEIAABCAAAQhAAAIQgAAEIACBLgIkZboIMQ4BCEAAAhCAAAQg AAEIQAACEIAABCYgQFJmAqiYhAAEIAABCEAAAhCAAAQgAAEIQAACXQRIynQRYhwCEIAABCAAAQhA AAIQgAAEIAABCExAgKTMBFAxCQEIQAACEIAABCAAAQhAAAIQgAAEugiQlOkixDgEIAABCEAAAhCA AAQgAAEIQAACEJiAAEmZCaBiEgIQgAAEIAABCEAAAhCAAAQgAAEIdBEgKdNFiHEIQAACEIAABCAA AQhAAAIQgAAEIDABAZIyE0DFJAQgAAEIQAACEIAABCAAAQhAAAIQ6CJAUqaLEOMQgAAEIAABCEAA AhCAAAQgAAEIQGACAiRlJoCKSQhAAAIQgAAEIAABCEAAAhCAAAQg0EWApEwXIcYhAAEIQAACEIAA BCAAAQhAAAIQgMAEBEjKTAC1y+TOzk6XCOMQgAAEIAABCEAAAhCAAAQgAIFJCbA2nRRvL+MkZXph QggCEIAABCAAAQhAAAIQgAAEIAABCIxLgKTMuDyxBgEIQAACEIAABCAAAQhAAAIQgAAEehEgKdML E0IQgAAEIAABCEAAAhCAAAQgAAEIQGBcAiRlxuWJNQhAAAIQgAAEIAABCEAAAhCAAAQg0IsASZle mBCCAAQgAAEIQAACEIAABCAAAQhAAALjEiApMy5PrEEAAhCAAAQgAAEIQAACEIAABCAAgV4ESMr0 woQQBCAAAQhAAAIQgAAEIAABCEAAAhAYlwBJmXF5Yg0CEIAABCAAAQhAAAIQgAAEIAABCPQiQFKm FyaEIAABCEAAAhCAAAQgAAEIQAACEIDAuARIyozLE2sQgAAEIAABCEAAAhCAAAQgAAEIQKAXAZIy vTAhBAEIQAACEIAABCAAAQhAAAIQgAAExiVAUmZcnliDAAQgAAEIQAACEIAABCAAAQhAAAK9CJCU 6YUJIQhAAAIQgAAEIAABCEAAAhCAAAQgMC4BkjLj8sQaBCAAAQhAAAIQgAAEIAABCEAAAhDoRYCk TC9MCEEAAhCAAAQgAAEIQAACEIAABCAAgXEJkJQZlyfWIAABCEAAAhCAAAQgAAEIQAACEIBALwIk ZXphQggCEIAABCAAAQhAAAIQgAAEILCeBHZ3d9czMKLqJEBSphMRAhCAAAQgAAEIQAACEIAABCAA gfUlsLOzs77BEVkrAZIyrXgYhAAEIAABCEAAAhCAAAQgAAEIrDcB7pRZ7/3TFh1JmTY6azaWs5/n z59fswgJBwIQgAAEIAABCEAAAhCAAASWTeDUKZb2y2Y+lj/23Fgkl2AnZz858ZYAHRcQgAAEIAAB CEAAAhCAAATWnEBeK655uIQXCJCUCTDWvcmdMuu+h4gPAhCAAAQgAAEIQAACEIDAtARKT0zkteK0 EWB9TAIkZcakuWRb3CmzZOC4gwAEIAABCEAAAhCAAAQgsGICrANXvANGdk9SZmSgmIMABCAAAQhA AAIQgAAEIAABCEAAAn0IkJTpQwkZCEAAAhCAAAQgAAEIQAACEIAABCAwMgGSMiMDxRwEIAABCEAA AhCAAAQgAAEIQAACEOhDgKRMH0rIQAACEIAABCAAAQhAAAIQgAAEIACBkQmQlBkZKOYgAAEIQAAC EIAABCAAAQhAAAIQgEAfAiRl+lBCBgIQgAAEIAABCEAAAhCAAAQgAAEIjEyApMzIQDEHAQhAAAIQ gAAEIAABCEAAAhCAAAT6ECAp04cSMhCAAAQgAAEIQAACEIAABCAAAQhAYGQCJGVGBoo5CEAAAhCA AAQgAAEIQAACEIAABCDQhwBJmT6UkIEABCAAAQhAAAIQgAAEIAABCEAAAiMTICkzMlDMQQACEIAA BCAAAQhAAAIQgAAEIACBPgRIyvShhAwEIAABCEAAAhCAAAQgAAEIQAACEBiZAEmZkYFiDgIQgAAE IAABCEAAAhCAAAQgAAEI9CFAUqYPJWQgAAEIQAACEIAABCAAAQhAAAIQgMDIBEjKjAwUcxCAAAQg AAEIQAACEIAABCAAAQhAoA8BkjJ9KCEDAQhAAAIQgAAEIAABCEAAAhCAAARGJrBwUmZnZ2fkkDbb HDw2e/8RPQQgAAEIQAACEIAABCAAAQgcEmCNe8hCrbF5LJyUORoeW30J7O7u9hVFDgIQgAAEIAAB CEAAAhCAAAQgsBICrF2nxU5SZlq+jdbHzq41OmIAAhCAAAQgAAEIQAACEIAABCAwJwHWrnOC66lG UqYnKMQgAAEIQAACEIAABCAAAQhAAAIQgMCYBEjKjElzgC2yjQNgIQoBCEAAAhCAAAQgAAEIQAAC oxLIa9Lz58+Pah9j/QiQlOnHaXQpnssbHSkGIQABCEAAAhCAAAQgAAEIQKAngbwmPXWK9EBPdKOK QX1UnM3GctYxZyWbNRmBAAQgAAEIQAACEIAABCAAAQiMSyCvSfOadVxvWGsiQFKmiczI/WQdRwaK OQhAAAIQgAAEIAABCEAAAhAYjQBr1tFQDjJEUmYQLoQhAAEIQAACEIAABCAAAQhAAAIQgMA4BEjK jMMRKxCAAAQgAAEIQAACEIAABCAAAQhAYBABkjKDcCEMAQhAAAIQgAAEIAABCEAAAhCAAATGIUBS ZhyOWIEABCAAAQhAAAIQgAAEIAABCEAAAoMIkJQZhAthCEAAAhCAAAQgAAEIQAACEIAABCAwDgGS MuNwxAoEIAABCEAAAhCAAAQgAAEIQAACEBhEgKTMIFwIQwACEIAABCAAAQhAAAIQgAAEIACBcQiQ lBmHI1YgAAEIQAACEIAABCAAAQhAAAIQgMAgAiRlBuFCGAIQgAAEIAABCEAAAhCAAAQgAAEIjEOA pMw4HLECAQhAAAIQgAAEIAABCEAAAhCAAAQGESApMwgXwhCAAAQgAAEIQAACEIAABCAAAQhAYBwC JGXG4YgVCEAAAhCAAAQgAAEIQAACEIAABCAwiABJmUG4EIYABCAAAQhAAAIQgAAEIAABCEAAAuMQ ICkzDkesQAACEIAABCAAAQhAAAIQgAAEIACBQQRIygzChTAEIAABCEAAAhCAAAQgAAEIQAACEBiH AEmZcThiBQIQgAAEIAABCEAAAhCAAAQgAAEIDCJAUmYQLoQhAAEIQAACEIAABCAAAQhAAAIQgMA4 BEjKjMMRKxCAAAQgAAEIQAACEIAABCAAAQhAYBCBUZIyOzs7g5wiDAEIQAACEIAABCAAAQhAAAIQ gAAENonAFLmPUZIyu7u7m8SRWCEAAQhAAAIQgAAEIAABCEAAAhCAwCACOfcxRpJmlKTMGIEMIoEw BCAAAQhAAAIQgAAEIAABCEAAAhBYIoGc+8hJmnlCGSUpM0Yg8wSPDgQgAAEIQAACEIAABCAAAQhA AAIQWAaBKXIfoyRlTp0axcwyGOIDAhCAAAQgAAEIQAACEIAABCAAAQgMJpDvlBlsoKAwSjZlimxR IVa6IAABCEAAAhCAAAQgAAEIQAACEIDA1hAYJSmzNTQ2aCJTZOg2aPqECgEIQAACEIAABCAAAQhA 4EQTYE24HbufpMx27EdmAQEIQAACEIAABCAAAQhAAAIQgMCGESAps2E7jHAhAAEIQAACEIAABCAA AQhAAAIQ2A4CJGW2Yz8yCwhAAAIQgAAEIAABCEAAAhCAAAQ2jABJmQ3bYYQLAQhAAAIQgAAEIAAB CEAAAhCAwHYQICmzHfuRWUAAAhCAAAQgAAEIQGDtCfz9kiO8c3fJDnEHAQhAYCCBMwPlG8X15md+ GrsRDwMQgAAEIAABCEAAAhA4UQQ+urtb/c4N11cfuP7a6u/vPledOn2YITl9+kz18Ic+vHrUpQ+p nvPIx1ZPObWzMJs7avO/edvfVf/1umuru+68bc/ezvmq2j1V7ezsVhc94JLqH33dP6i+65LLq4t7 uPsf3/fOw5h2ztV2Th9uL9h6/pO+sXrxfR4wyMob7ri5+uOPXXuw5tqpzlXf+9RnVf/o1NG4jsQ9 yMNx4V1xOn++5rf3t/znP+Gbqxff9/7HBemBAATmJjBaUoaEzNz7AEUIQAACEIAABCAAAQhsDYHP 1cmRf/UX11S33lInRpQUqYvzBrM/5J6v0wnnzlZ/d+MN1Q2f/2z1Zx/5b9Xlj/iK6t884R/2SpaU QP2bT3youvaTH6/O7e75O/ip4Dohs1dO1YmaO6q3ve/d1dvqjid8zeOqf/FVjy+ZOuj7wm03z9pa 5xzYOxhdrHHrHbdX1UOHJWVurhNNt37hpllSxvHcfvaLVXWfBx4JxnEf6VxgI87/ljtvqSqSMgvQ RBUCxwn4W+r4yMAefzEMVEN8RALsgxFhYgoCEIAABCAAAQhAYDCB3z93d/W/vv03q1tvvbXaqfYT JIc3yOzd5bGfqDlf34ExK/X2DZ//dPXKP/jN6mdu+ttBPm+pbb/smrdUH/7kx2pve8mTeE1c3yAz u1PGf0B2/eGPfWSmd3OIrclxtHdM5pwM7M8j1efPHd6Oozt1Fi320hrPok729eXDrNS2T98xM5Ib zAwg4H0wQAXRkQlMtQ9GS8qMPN+1MTcV+LWZIIFAAAIQgAAEIAABCEBgBAK/fc8d1euv+Z1q9shL bU9JEi3sva3HiC64z30OFvvR5c6ubuA/X739L99Xvfd8vwTGZ2rb/9M1b57ddRNtqe2Ewq4eu9k5 OxtWX7y2P3v23up/rvVlp2+ZzWdfXu1Tp7WccrrES6u92o9rSc75J/vZ3b+jx9vz1/1jjz6cIzIP be/unj3kVsesMc9XNQUCEJiGwGiPL00T3uqt8gW0+n1ABBCAAAQgAAEIQAAC601A73P55T/6/f0g 95IUe3dVnK+e/w3PqJ714K+orqoX+bH8zt1frH7p3f+lqs7V8qf0zpa9ZMb/c81vVW+8+gVRtNj+ 3//obXWyQ+87ObyrQ4JXfeVV1dWP/brqG0/dr7qkdnl7Hduf7d5dvfO6j1Yf/8zHawm9Y2YvlnPn zlX//A9/r/rlb/nWYz7+/dXfVd/ts5dyUWRKS2jbdd2s/o/3vL2654t3HsShO2Je9sznVU+98IFH 5CQrPZcrEgv3D61P1Y+C5aK424o0/uV7/qD60hdvq+Pej6qO5/v/8bdVT7ng4prOYZpJduL2WHHL LmV7CJw6tXfubs+MljsTkjIdvPOXfIc4wxCAAAQgAAEIQAACEDhxBH70/X9Qz3k/GVMnV3x3zL96 zkuqr294ie+33++i6tuf8+LqlX/2zuquW+t3rJz+cm3jVHV+98vVP/3Qn1b/4Yn/sJHjj3/8L6t7 9D4VyYfEzEuffnX1kgdcekRPiZnn7tyveu7jnlL9pyuurP7Tn1xT7ZzaS+acqk5XXz5/Z/Wvr/9w 9S8f84Qjen0SEA+4z0XVLXfdcZDkUTzffOEl1eXHcyVHbI+1cf5UTPXsWe0T933vc2H1xbv0WFKd LNq/C+YbL3hg9cglxT3W/LGzegJKyCi5eebMmYNjafVRbVYEpLQ69pe/pCxGFtAkqCEAAQhAAAIQ gAAEIFBV19WL+ttuq1/qWz+CtLNzei8hUydmfurq725MyERu/+83P6tW3UvI7N0tc6r67Oc+E0WO tPUz19f+zfXVqdmvIdXJlTqxoj+k/sjVLz6WkDmiWG+89KJLq3/6vBdVp3YuqGaP7NTvs5Gd//bX 11Xz/Fz3+fP3HnVR33mi/5ZR9h5Bmi+LslvVj3Tt363ju4bms7SMmeJjHQloneyEzOnTp2eJmXWM cxNiIikzcC8dvJBsoB7iEIAABCAAAQhAAAIQ2EYCv/TxD+5Nq05w+A+aV11xRfXQnqt8/QbRk32X yuz9L3t3sfyFH61J0P6/z3ykTqjUd8jMkh/1o0h166EPedixn4ZOagebz6z/sv/gyx5S53/qhMxM u35/Sp1Hee0NHzuQ6dtwQsPyukOovv/Em5PWe3cjzZkAUkJrdodMzXpOE5NODuNrT0DHvu9SU83N C/PvMpIyA9lxsA0EhjgEIAABCEAAAhCAwFYT+Njf6D0tR8sPfu1Tj3Z0bD3viq+rkwRamux9lHS5 5rPH7crMe+uf0N6tE0B+B42SE//Dk57Z4eHo8Kue+Mxqt34fy15ipzZV23j3X334qFCPLSehouhy UjL2OJ83x607m8zAFqkhMJQAa+ShxI7K806ZozzYggAEIAABCEAAAhCAAAR6EtAvF2lBdrDIr++6 uPCiS6qv2X80pqeZ+qW8O9VPPffFs3tfdOOG3k5zcSHfcEM9eHB3yn5i5r4X3b96SsN7a5r8f0Mt f98LL6r+/stfnNnTC3p148it9efBBb9NdhyL77hpkhuzXz7N+5R+XWqOMotbSbD6V6D0+Nfubv2i ZQoEILASAvOdxSsJ9ahTfwEe7V3e1jKygfP6WDWb5e0FPEEAAhCAAAQgAAEIrJLAn/397QcJAsWh O06ueNhD5wpJjztdVn8eVn8eUX8uKlj507u/MLtDxte7utflay9/ZEGyu+urH3n5wSMXu3vPAlXv OXdXt2JBIt5toqTSlMUJGfk4v8hPa+txs5pzVdfmOWXc2J6PwLz7Zt615HxRrkZrXjaribbZ68Ym ZZqnxAgEIAABCEAAAhCAAAQgsAwCn/7CLcfcXHbxg471jdVx3Y03zJIIfs+jkgqPuPTBc5l/1AMf vJ9Q2vvVKBn5yOf/bi5bKEHgpBDYlkTIOu0vkjJz7A1lHf0/gi51DtouQoxDAAIQgAAEIAABCGwq gdvu+dKx0B958QOP9Y3VcfuX7q5N7d/ZMXsHTVV95cXzJWUeWiePfIeM4tMLb2/70nx3yow1P+xA YB0ItK1h451aivUk3JEz9T4hKdOTsA9M1foddg6+nuAQgwAEIAABCEAAAhDYWgJ3fOmLR+ama+VH 3O/SI31jbtxe+9NLgGN51M5942bv9hUXXlxf0+sumT17uuvm9rvTT1z3toYgBE4GAa+LPdu+NytY nvo4AV70e5xJsUcZQSdkzpw5w++wFynRCQEIQAACEIAABCBwkgjcc8/RF8Rqgfbgjp+E/tTsp5ib Kek1J2frz/1rOw/XRihf/vK9e+9BUZ9e9FuXhw18qfBMaaan99zWPw29b0f9X77nTg9TQwACBQJe F3uImxVMYv6apMwAdjoAddDpThkKBCAAAQhAAAIQgAAETjqB/KJZ/RGz7UW3Hzi/W/1f73hTKzb9 kpGuuy+86AHVLz3jvz8ie3Z2Z8uRrrk3lO85/FHsPTO751kezQ0Uxa0gkO+E2YpJrfkkjt77t+bB rkt4ZAPXZU8QBwQgAAEIQAACEIDAKglceJ8Lj7mvf4/pWJ87NKKES9tHv2S092tG9V0sqdz/zH1S T/0z1i3+jgmHjpvqYGa/PjR7HGrvrpv7XnhBkKAJAQhAYHoCJGWmZ4wHCEAAAhCAAAQgAAEIbCWB S+570SzBUu2/50XJlk996fgvMnnys7tT6rtp9Nf4ps+ebP0Ox/PH705/wP0vrqpzR5M+n93Vw07D y43n919SPHt8aW9ZdPH97j/cEBoQgAAEFiAw6v15s9sV6y/iTSrzxqy7Zfq+1KivD/1PrK9sH8Zj 2urjDxkIQAACEIAABCAAgZNF4EH3u+/s+lW/iKSi/MZnvnB7VT3gsiKIq+pkzLOe/M31q3Ulv/+C 3foa+NYv3lF98PrrDnR2ds5U508dv1PmkovuU336dJ3Q8V0utcanb6+TQJc+4kC3b+Ozt99+aEdJ pTr4S0nK9MWH3JoS8Joyhqd1YVMZsq7NNuZ9gqQtnuxjXbanjHnUpMy6ANvUOEiibOqeI24IQAAC EIAABCBwMgk86kF7P0e9U2dJZj8vXSdMPnvbzfXvVD+mCOSB9drwn1x2xbGxO+skyytDUuaYwH7H lZdcVl2787H6gSX9StLeUuaG22+bKylz4x1fqPNCdYKntrQ7e7XwqeqKB8/389pN8dIPgWUTKCUP SomaZce16f6mXKuP/vhS6SDY9B0wRvx9ufSVGyMmbEAAAhCAAAQgAAEIQGARAk+b/fx1/QaY+leM Tu2/2+WmW28cbNL32mvxeFiOP770zAc9fHa3+s7O4btfrr/pM4cqA1rX3/S5+gaf+v019S9G7d21 c756+v0fMsACohDYDAJta8z49Eeb3GbMdJooxeXod9O4fkZPykwZ7LhTX54170Qf5PPe5rW8iPEE AQhAAAIQgAAEIACBbgKPrG8z2d2tHzM6tXvwqpd77723em+d7BhSLth/usLXy026j95/F83ubn2n zP57bO645QvVXx9J5jRpH/brZ7nvuu2W2sSeY/k9VZ2uHtXymMehNi0ITE+g61wYI4K8LmUtf0hV /JWwUi0uU+6P0ZMyUwZ7iGizWtqZOuD1U9qqYzZys2ZCtBCAAAQgAAEIQAACEDhK4AmPrh9VOl8n NerrXL3r5Vz93t3XvfcdR4U6ts7WetJV8QJotyGx89hHXVXL3qfaObV3J83OmVPVT33kL/eUe/77 uus+WN/Xc6Z+jcz+Yquur/qqK3tqIwaB7SCQ16Ws5Q/3q76HlrWGHz0pczgNWibg7BoJGROhhgAE IAABCEAAAhDYFgI/fNWTZi/J1SJGPzF96vRudeddt1X/dfZYUL9ZxhtUfO28s38XS7bwmq97cv2a 4HN18ka/4FTfoVMngf72s5+oPlP771PuqoU+9unr63fJ1I9d7ewlkhT3P3nsU/uoIwOBrSWgc5hy lIDX8FMmrEjKHGU+2VbXTuwanywwDEMAAhCAAAQgAAEIQGABApfVCY3LH/4Vxyz8x3e8uXrr3fVL eHuUj9Z3qtQpkh6S9TuE6wzOIx7+yNnjBMr7nK7f96vF5I9e86bqLxrurrHhT9Ryr7rmLbNNJWKq +gW/qh922VdUehSLAoF1ILCqtaESEJTjBKbeH1A/znySnq6sY9f4JEFhFAIQgAAEIAABCEAAAiMQ +A9PfEZ9h8zeryHZnK5vf+VPfq/6d5/6SHVrQ75FDyC99qZPVf/3O950/J0N5xqUap2feNLTZ/Ja LMmP6vPnT1X/rrbzMzd9urohqd5cb7/xrpuqf/4Hb6rOnj18H41e8KuF6E8++RkOmxoCW0VgSEKB Nelqdv3Rb87VxDC3V38Jz21gX3EsO4vGYf1SPKU+y7fV8+q12WQMAhCAAAQgAAEIQAACmcD/+awX VP+6Too4SaLrUP1s9Z9/9IPVa667dtb/4Esvqx588SXVHXffVd1e/yT1Pffck80cbH/HU5920C41 fvTZL6qTOf+5Hqpvl9mpP/uJmLf/5Xurt1fvnalcdN8HVF/8ez2wlIrk98v/8uwXurlAXd/no8ep 6pcFb1rx/tq0uLc13r3zZr7ZLaI7n8fhWmPFOJad4TMYX4M7ZcZnunYW8wHLbWlrt4sICAIQgAAE IAABCGw8gX9QvwPm3179XdXp03ViYpaQ2ZvSzk79Qt397S/cdnN1/aeur266+fMhIXOYIDGE73nm 1dVLL7rUm8X6G2t//+I5L9qzrYTM/q8xReFSQqZ+i8wsQaRkxD97zndVT1/okQ0vp2qrmmNI9sQ4 xm77jga9E2eesvfo1p6m9808dtAZl0B+8e641pdjjeNpOOf5zuLhftZeY5sPnpz93oaTfe0PKAKE AAQgAAEIQAACJ5DAY+vExBue8+LqsY98dP3rSPVjRXWyRNei+vgPg0evu5WQ0ZJkLzGjd8X82nO/ u3rx/R7Ui94T6sTMz9eJoEc87FGzX2M6avvQhH/ZST1KSDz0IQ+vXvfcl1RPa3iZ8KFme2t3d+8X oBx/u/Rio164aY4HLM/N9yKcQx57P/mr+Ou9tFiAaC9MYJbQXNjKag04YViKoun8LMmepL6Nfnxp rB2lg8M/V+0ERtvBNJbfZdnR/Pw/QiVk9CWu+VIgAAEIQAACEIAABCAwNgElD/7t455SffbrnlK9 8YaPV+//+Eerc/d+eXY9Gn3Nrk937ls94JKLquc//huql9R3xsyTYrh/bfQ/1u+YubZ+ye9v/O2H q4988vra39k6SaNEz+nZHSzn6p/s1oL3a678quqFVz25euqCyRjP49TB40r1rPfv1JkqtXG2hrO3 RjlV1+f27szZ/1lwxzO43tVbkqVV3800F/3BHlEIBHKSQvs39wXxjWt6HerAt21+nteiNUmZmqAS FfqSVqJCB462t+lk0EGi+TgRw50yi5426EMAAhCAAAQgAAEIdBHQrxn9b498bFXpU5db6sX/5+pF 5wV1/yPqBMAD58nAtDh9fJ1oefxXP7Gq6k/9K9n1y353q9trn5fKX30tPMXC56e/6b9riWjcoX92 +WPqn7mqPyOU137jPx7BCiYWJZCTFNu2Bt1LIh5S2rb5Hc5ssdYU302LRbQCbR0cMRGzjQeLTgjd IUNCZgUHGC4hAAEIQAACEIAABKqH1MmRh9TX3csoWuRcIV/LcbeMKeFjCwnkdWdO0mzblLd9fvPu Lz+aOK/+1ujlE2JrJrY/ESeetm1ezAcCEIAABCAAAQhAAAIQgMAmEoh3kugP6Ktak/odRVMzXNX8 pp7XovZJyixKcIP0l3WybRASQoUABCAAAQhAAAIQgAAEIHCiCfA0xWp3/8YnZcbMts1ra4jeoomR Ib5Kh9ai/ks26YMABCAAAQhAAAIQgAAEIACB+QgsukZb5hpxXl/z6pWIjmmrZH/ZfRuflFk2sHX1 t+iJvK7zIi4IQAACEIAABCAAAQhAAAIQgMC2EpgsKbPM7NUyfa3DgVCab77lrCSj2CVHAmcd9iIx QAACEIAABCAAAQhAAAInnUDb2qxpTReZ9ZGJ8pveXvZ8o7/4DqAxOU6SlFHg/vnlMYNtsjUVnCZ/ q+j3ySq2fd5a3cREdpSYiQfXKuaDTwhAAAIQgAAEIAABCEAAAiedQP7jeuTRtKYbKhPlN72dmXid PMW88r6Zag09SlImgxGQ06dPT8GlaHOZvooBLKHTiRTVTqy0uW06YKQvXqV91maPMQhAAAIQgAAE IAABCEAAAhAYl0BbUqFpTRcj6CMT5Te9neebEydjzm9ZeYZRkjIZjEAsc9HvhIV3QCkej21yLaaa W55vaU5N/HXS6y6mbWVUYkEfBCAAAQhAAAIQgAAEIACBdSPAmmz4Hmla5w631K2xLF+jJGVK01nm AaZEQwQW26XYNr2vD9u2jOuyMn6bzpn4IQABCEAAAhCAAAQgAAEIrAuB0jq3z9pwXeIfI45lzndZ viZLyowBvK+NPneO9LW1LXKlE9ZzaxuzDDUEIAABCEAAAhCAAAQgAAEIrA+BUpKAtd367J95I9mK pMy8k1+1XumkGhLTqvWHxIosBCAAAQhAAAIQgAAEIAABCOwRWPVablH/q9iPmxhzH04kZfpQmlhG B5cznK7HcDmmrTHiwQYEIAABCEAAAhCAAAQgAIGTTmCRddoiuied+7rOf6uSMpuYOXNCxu+AGToH yVs3H2R9bPWRyXbZhgAEIAABCEAAAhCAAAQgAIH5CDSt3/pY0/qt7xou/zKR9Vz38bcuMpsYc192 W5WU2cSsoU8U1313nOU0Z/2aksvQg3UTmXmu1BCAAAQgAAEIQAACEIAABDaNwKJrsL76OfljvdLa c+g6ckrmpVgc+5R+V2V7q5Iym/irQj5R5o1d+lHXB6vrrgPL/rvkGIcABCAAAQhAAAIQgAAEIACB xQmUkg59rWr91rSGy/05+SK/+mQ5+e67fuwb5yJypVjimncR2+uou1VJmdJBt47QY0w+4HLsUaat Lf2Sbt8T3f7bfDAGAQhAAAIQgAAEIAABCEAAAuMQyGuwvms3edfar7T+81iMMCdf7Nd1lF3ntvg0 zXmd4+4b21YlZTTpeEBvwsGmeBWnT5gYf++duJ8tnWe+8/jrGxdyEIAABCAAAQhAAAIQgAAEIHCU gNd+7h2yjpNu1redXOdEhteecQ3Y11a2zfZ4BLYuKTMemuVZ8skhj0NOyBxhPLnyWNP2Iv6abNIP AQhAAAIQgAAEIAABCEAAAmUCi67B+uqXEi5xzajxnLgpR0zvlARIykxA1wd635PF8hOEgkkIQAAC EIAABCAAAQhAAAIQ2AICpSTLItPqk5BhrboI4X66JGX6cZpLatEDuI9+H5m5gkcJAhCAAAQgAAEI QAACEIAABDaSQF4n9r1hYCMnu+FBk5SZaAfmk6CPm6zT58TJMtmG/Jb6+sSDDAQgAAEIQAACEIAA BCAAAQgsj0Bp7Vbq64oorxPnuctmHr9dcTF+nABJmeNMBvU0Hdz5JOhjNOv0OQmyTLYhv6W+PvEg AwEIQAACEIAABCAAAQhAAALLI1Bau/V5zKgrwpLdJh2vMYfoNNmiv5sASZluRq0SOkFKB2tTsqbN mA9+y5Tsesx1lsk2JFfqsz41BCAAAQhAAAIQgAAEIAABCKwHgdI68syZM3MFF9eBsd1lTGtMyWed vPbsssN4PwIkZfpxapXKB6uEx8hmtjodMOiTpxTnADOIQgACEIAABCAAAQhAAAIQgMCEBErryHPn zs3l0etAKcd2H2OSzzqsJ/uQGy5DUmY4s0aNeJDGdqPCkgZK2dYlucYNBCAAAQhAAAIQgAAEIAAB CPQkUFpHlvr6mIt6sd1HVzLWcd1XD7lhBEjKDOPVKq1MYjxgY7tVceLBnOGc2B3mIQABCEAAAhCA AAQgAAEIQGDFBBZZB8a17CJ2VoxgI9yTlEm7KR58GtJ27ksqRzbX6YAdEveRSbABAQhAAAIQgAAE IAABCEAAAksjkNdueXtpgSzoSHHn2PP2gi62Tp2kzIbt0nmSPvPobBgWwoUABCAAAQhAAAIQgAAE ILBRBMZcp2VbpXfTbBScExQsSZkeO1sH+LKze00ZxnniiDpu856ZHjseEQhAAAIQgAAEIAABCEAA AhMROH369Myy12iLuMk2tN7LfYvYL+nmxM/U/koxbEMfSZkee1EH17ITM/LnbKcTKN52yEMOesva Rj6BbJMaAhCAAAQgAAEIQAACEIAABKYn4F9V8hptHo9e52VdrfcWsZvtlba9TvXY1P7sZ9tqkjI9 96gTMz3FFxaLmU0nUPIJN+Sgt6xtOCu7cKAYgAAEIAABCEAAAhCAAAQgAIHBBLwmy8mNPoa0votr VK/zrCvb89i1fp/a61TJyn+OoY8NZKqKpEyPo8AH+zIPsrEzmzl2J2l6TB8RCEAAAhCAAAQgAAEI QAACEBiZgJMaroeY9xrVOnl9p+157NpenzonfXIMfWwgQ1Km1zGggysfcL0UFxCSv5hIyf7jWJeb fMJ2yTMOAQhAAAIQgAAEIAABCEAAAtMS8J0yQ9Z2OSLr2pbH1Z/XkB4bq85JH8cylv2TYoc7ZXru 6WVn/bK/fMD3DHsmZluu1bmMk3RIjMhCAAIQgAAEIAABCEAAAhA4KQSUMInrs3nmrTWdbZTWix6b x3YfnamTPn1i2AYZkjJrvheHHuhN8jphnbmMJ6/71hwD4UEAAhCAAAQgAAEIQAACENgKAk1rMPcP SaZkWa0Hm9aEJXhDZEv69C1OgKTM4gx7W9BJVspg9jWQT7iSXpt967su6dMHAQhAAAIQgAAEIAAB CEAAAqsj4ORMnwiGyJbsef24qJ2Sbfr6ESAp04/TaFLzvAXb2ct8onjbteVisB5TX2m81Bf1aUMA AhCAAAQgAAEIQAACEIDANAS8XnMtL7mtP6p73RbHHFGpz2Ndtewuot9ln/FuAiRluhktLBHvTFHb v0c/j+Foq0k/nlRR3u047sxoky36IQABCEAAAhCAAAQgAAEIQGBaAl6ryUteo2n9FtdwkvG26iyv 8b5Fa9Pou68ecuMRICkzHstGSz5hJKBMpN+M7Wxno2JhYKhO9O12POmG2iuERBcEIAABCEAAAhCA AAQgAAEI9CRQWoN5rSYTXi/anNZvXsNFOY2rv2TPuqU6ys/zJEfJJn3zEyApMz+7uTSVxXQm03Uf Qz5xfDL20ZFMlHc7nshDYujrEzkIQAACEIAABCAAAQhAAAIQKBMorcG8VpNGbGvb6zfVpbHcJ522 Ev2rHbfb9KYc8xyn9LGutk9UUmYddrRicIJlnoMizqGpHe1GmZLfUl/Upw0BCEAAAhCAAAQgAAEI QAAC4xEorcFKffLY1K8xrfWUkPGdNW2yki8V6cY1Y0mGvmkJnKikzLQo+1l3FnOeE0Yeop5tNXnO 43m7SY9+CEAAAhCAAAQgAAEIQAACEFgegaa1mu5i0Rqw7W6WtrG2Gchuk982vUXHVuFz0Zin1D9x SZkxs4AxQdLXbpSL+n13cj7hor3cjtt97SMHAQhAAAIQgAAEIAABCEAAAqsloLWcPkpgaA3ou2EU ldd5iyQ35lmL2q9imEdfeirRTml7JnSC/jlxSRnt20UO3iHHxjx+hur0kc8H/ZA5IAsBCEAAAhCA AAQgAAEIQAACyyHgtZvXed62d/d7u6vO+l3yjC+fwIlLyuggHjOrJ1tN9uY5AbKOt32HjOJ3nw6X 2NZ2Wzwap0AAAhCAAAQgAAEIQAACEIDAZhDI67u8/ittxz6vH4cmc5ro5HgkF/016TX1L6LbZHPT +k9MUsY7W7UPzHl2Vj6YlSzRb7u7RD/uW6S2Pyd+SvFbxn6cwPE2NQQgAAEIQAACEIAABCAAAQis PwGvJx1pXtvFtZ9km8ajHcnEbduep5atbE8xzWs/zmeeeLZB58QkZbyzVSvB4e2hOzEfbHq2Lz7f Z7uuu+x3ydmfDnzHLX9Rzwkb+4rxuI8aAhCAAAQgAAEIQAACEIAABNabQFznKdK8totrP60Rz5w5 c2RCXj9GO9nGEYWBG/Ive74xwQma6G+IScc7RGfbZE9MUsY7TjvdB477Fql18MnevKXvQaiD33H7 BLDPfAJ4u69t26GGAAQgAAEIQAACEIAABCAAgfUh4LWdI4rbWu91rQ2l53XkGOtD2ZJPJ4dUx5gc Z1MdY4jtJvmT0L+VSZmunesDaKwdLHuL2nTMrttiy5nOqBPbbTYYgwAEIAABCEAAAhCAAAQgAIH1 I6A1XVzXNbUVeV4b5tkoYSL9IYmTbCNuy1/2GeOLsqX20DiG2C7524S+rUzKdO3orvFV7bi+B1zb nTl959bX16pY4BcCEIAABCAAAQhAAAIQgAAE2n89uG1tKHZe97lelKfWm33XnIv6Oin6W5mU6XvA 9ZXrezCMZa+PnT4yittyrvvOBTkIQAACEIAABCAAAQhAAAIQmI5AftoirtnyWCmKKF8aV18fmSbd 2C87fWKKOrT7EdjKpIymPm/2bqyDth/+o1I6yIfGneUVf1u2NM6vTe5oZGxBAAIQgAAEIAABCEAA AhCAwJgEvJaLazTbj++KKY1bzrVtebupHpJYkd++dpv8lfpls8+cSrrb2Le1SZm+B1s+GMY46KLN 2PYBVOrTmJIkHnNtHdWlOWU5xS85f6RnmVyX7EmeAgEIQAACEIAABCAAAQhAAALTEchrs9K212t9 1qjW74o4/2G+pKc+fby27LI5dDz7bJpflhvqZ1PktzYp07Rj847JcvPueOupjsmVbF/+Y9Yzx+Pt kl6fE8j6ks1+bNN2HLN1qCEAAQhAAAIQgAAEIAABCEBgWgJxHaY1mj/Rq/q8bov9UTf2e60X+3I7 /uHeYyU9+VW/17Z6sW9JzjYWrReZ06K+10F/a5MyTTs2Q89y8x5s/lkw6eu34m0n25f//FvyjsmZ UG2X9OK4ZOzDtfpc8luxJSN92c1vy7YONQQgAAEIQAACEIAABCAAAQhMSyCu37RG0/osr/Xyes4R RV33qS6t8bymdK1kS070eCzacizypbWrdEpyUWdIu6+tvnJDfK+j7NYmZZoO1rwTsty8O14Hrg9W JWhsJ9uX/3wiOKbYX9KznGv7cO1+1dKP9iRjm44zytOGAAQgAAEIQAACEIAABCAAgekJxPWb121e q9m71my5z2O59lo092d9J1uyXN62nuL0zQdZZpFt21/ExjbpblVSJh5k8UBv22FZbowDRDZtJ9tX LKU+x+gx1+53HedoHx7LtWVdy6Z0mmxnfbYhAAEIQAACEIAABCAAAQhAYBoCXpe5jl5Kd77E8dz2 mi/2Z7vxj/ZRLretp7Wj4uirl+00bdt+0/hJ69+qpMzYB8sqDoauREtXTPEAd9tcSMh00WMcAhCA AAQgAAEIQAACEIDAtAT6rPmijNd100ZVtu61ZHmU3jEIbFVSZgwgy7aRM5rxhIvteeKKJ3JJX/YX 9VGySx8EIAABCEAAAhCAAAQgAAEIlAloDaZ14JRrsWw7rjtjuxwhvcskQFJmmbTn8OXEypAMZT4B 7da2vK26STbK0IYABCAAAQhAAAIQgAAEIACBcQh4Deb1mWq3swfL5v4m+SzH9voTICmzpH3UdDLJ fVumUnr6RBm19Yk2LefpxDH1xfE8dsMNN1iNGgIQgAAEIAABCEAAAhCAAAQmIuC1l5IqXpd5rebt Jtdx3OtD19Jps+M/8kf57Mf6uZ/taQmQlJmW78y6Dm6dBPEkim59gsS+trbk/ZGcM6vqc8bUtU86 y0g+x/G2t71N3RQIQAACEIAABCAAAQhAAAIQmJCA115eI5bWa+qLa0Sv5bzGU3gaL8lpLMppO5Zo N/ar3aaXZdkejwBJmfFYNlrSwa23VqvOCREptb1Z2yep6yjvPtlU2x9t249POvmwfIzDcm9961sb 42cAAhCAAAQgAAEIQAACEIAABBYj8Fu/9VszA1qDeY3o9ZrWal6zOeHitVoccwTqk1xcS3q959qy sW4bs78oT3t6AiRlpmc8S5DohPHJl13G337XyRmLT9KYSLGMa8mrnT/q90knO1neeqpvuumm6vWv f33l2+nUR4EABCAAAQhAAAIQgAAEIACBxQhojaW11o033jgz5HWZ1mher2lA217/RY+SL63npGtb ca3pvmjD7ZJ9j7XpWYZ6fAJnxjeJxRKBtqxjPBHjySQ7edt9ruOJYx/qK+kpi6oEUNb1l4P6f/7n f342XjpZ7Utj2b7lLeN6Zmz/n9hneY/HMfepVn/TWJaL29l+HIvtLttd49FWqT1UX3HreOiKX3a9 v0t+6YMABCAAAQhAAAIQgEAkENccsb+tHa838/V/k16UczvasV7ua7oGznFnPdtT7WtkyVjO1+Ox T7L2Z/uW15hLqS/emaJx2bcN6WUdjcW+3HZ89qk62tN21NG2iuLQmkG1bUhObdd7kkf/jfJHR8p+ FEvX2iTbYXsYAe6UGcZrcmmfUG2OokzpBG3S1clUko99bucvAvtsOsktb33V/pTikbx1NG69kmyT HcfUpV+yua59ZpL55HjbeGVZtiEAAQhAAAIQgAAETg4BX0fmelEC8dq7zZblfL3qOutIzrIaG2Ph X1o3lPzHa27H5Xhsw3px233WUW1b7ovbse3xbCNvW66rNq/I0G3X2YbiaRorxaE++8m22B6PwFre KaODZZU7Xwdf08Hahj7GHW3EdtbPY9pWif6zjMbtK8qpX8U21Na4ZbXdViQbdSXrPsdQGpfcvPvL sdmPbKloOxf79pi3LRe3ZTeWpvisY5vSUZ+3PR5txbblYl9sd+lH2VI7z6MkM0ZfE58xbGMDAhCA AAQgAAEIQOCQwNTXd4tef+r6ts1G29jhLJtbXfqRT5esvUiuKW6N9bFjGdvJ2/bl2uPeVq2+ruvq vH6wP9uJ87dNj8l+lM+ylhu7jj6H2s6c8vZQe0Pll8VoaFxRfi2TMjHARQ6AaKet7YM7ysS+eWOI NqLt2JbtXOwv1lnG200+sl0djPkLIuqqnUtJJ8uUtm1LMZTicL/i8UkSdUpt+5FuHHd/rLNPjek2 PT+6FWXVts1Yq19+SrY05tIVi+XmrW1f+l2xzOtDet4PaufjRH3rUErH45RM1mHOxAABCEAAAhCA wHEC+foobh+XpmcogS6evv7qkpNfyVje26V4fC1qea8TpNvkJ/fbRsm++qIt24824niUd0xRtuQj j5fisYx8lcajXcvGPunl4mt32ZNO1Mtzyrpt29FObLfp5LF59bKdIdviEJkM0V2V7NomZeJBaqjL hlum1yQAAEAASURBVOSDSHU8AfJ2W1xNsrYd7cqOTxz3u7aPqBcPuDY/thHloz2Py0Yb6+g7t6Pt 3JZ9fdxvXW2ruJZvJU9UmuKwruy5PVPY/6et336kJzn5cJ8SNupXn+1KRh/JqHaxfpTz2JS1/clH jGdsn2Yytt1F7fn40Nwji0Xtog8BCEAAAhCAwGYR8LWAa/9ohq8f1/VaZirKbddFGjMn+Ve7q9he k6zGo13LZT3L2K+vqS2nfvVlOW17TSCZKK9tFeu43us9/DfO2b3RpvqyXcdn+VhH3egz27COj8Eo qzHH1TQe+20r1tmexqQT47APjcV+bccy71i00dRus92kM1b/Jn4PrFVSRjvPJ7V2ioGOtYPa7GTf llU8+uhg9wE+JC7rqI4lb3tMcch+PpAdn+/28AkrPes4RtvKtXT1hXL27NkD+zkO+3W/bDphIXt5 7pL3/wg1nuU95vhtX3Yk69rjkm8qjsm1bUnefa7jmMbtK8o6VvVZ/syZM8fmmPeHGURf1petWCwb +4a0m+w29Q+xvUmyYu19o7mb/SbNgVghAAEIQAACEBiHgK+vfC2n61tdG8SF8zieNtuKmPiayXWf GVlW11z5mtM2LeNacr5mVp/2jYr2ifpd+zou2rUNyUvP26qjXY2r2Iba9ql2LLZvWxrTOsPHSDyG omxsS8e+orzXN7ZtmawrfcvYlmoV9ZuR2raxN3r4r226R3FYz7X7LOvaOk21YyvJO6aoa3+xr9Ru s1uSH7vP/s1lbPtT2FurpIwBeqJxx/tEKB0gll+kzr5tSwepPvKv2v59MlquqbZOHtfcZKvk12NR x3L+IvG2ZNTWgjUmW9SffVtG9j0ftyXvIj3ryra/RCWroj6Nq8iOxh2DtuXHX3q2I1n133vvvTNd 6ZT8SC4W2XGxz8hHflUiF/W5X2PS83zVn2OSjPenavuxrmy7X/rmoHGV6Guv5/DfLHs40q/VZruf hXapyKJdcrWj3ofe94tyXe1s8A4BCEAAAhCAwCIEfB2g6yRdX6r29VtsL+Jjk3V9fWdOi87F9mTH nF3bduSufaJrb5VYx3iiTduwvG1LXna91rC+bUreYyV7Xh9E+25rzH7kQ8X+3La/LBePOfu1jHTt V33ul4/IyL407rb1ZENFY1FHfY5JbRfPxfNwv2vH4G3X6rcP97mWzcjZ/aU62y/FWNKbqk/xRJZN XKbyP4/dtUnKeGdmaDoY4o613DyTnUfH8US/6osxzWvXtqO+7MYEQBxTu6Sj2JxUiOOxLd1o1/PJ Mk0+1K99YXnVbmtMxSeuY/H23mg1SxppftbLNrK89XJtffdrLlFX4+qznGr79bytqzHpaly1v2Sj PXOTTrRrG221Y2iTaRtzvIvaafIxld0mf4v0R/aKWx/zWcQuuhCAAAQgAAEIbC4BXbPF64HY3txZ LR55vG6K1pr6SzJmma8XS/3ukx1fO8drNV9ru5ac2irS1cd+bMv63sfx+lx60reOZdTvoj6Ne4Gu bfu0nmVV577oz3qSs50o75g1HotkPaZaH+lFXclbpq2tMelFWfeV+jWm0jSm/qaxOPc9K83/Zhva VonzbdaeZsTr0Wmsj291bZIy3nlxitqR8QSIY2O35asUg0/2OBZlY3tITNKLRfblyydu9BflrKdx tzUe21HeY7avbZ9kTT6ijtuqVeQn+s5tyXgeasfiGG1DY7EtPW87RuvYTinm3Gcb1vG2a/e7drz6 wrYt96lWcTxqlzLH1tN4LDn+ODakHe00+Rpib5Nkm/ZbZLJJ8yFWCEAAAhCAAATGIxCvB5quGcbz tr6WIgdHqb7IxO2SrHVct8noWlTj+pSula3rZIht+lo76rgdr29z2/Zsx3VcN1nGtWXitn1pzP2u Le9asrLv2v1RPrazXElefZ6bdB2/+h1btOlx9cV+ycfSNia50nipL9oc0s624raPFc97iN1FZM1z ERvL1F2bpExp0svceU2+mvpL8aqv6YTM8tGu2/HE18Hs/qzr7a5xy6nuY69NLs4r2ort6M8ngr9M NOb55bijjTwW/eYxx6s6j8lmLNGH+r1tOd8h437JeA65rXnkYju5P8eVx+fZbvI1j61N0TmJc96U fUOcEIAABCAAgXUiwDXD0b0Rr0Vj+6hU81YXT18Xx+tmX/OXrEZ7StJoO8YVx6N+lMsy3nYd9XI7 y8h37HM7ziHOLdvTtnQiB217TqpL+tlvk133W1627MtjbbXn0yYz9ZhjV72MUuK9DL+L+Ni7DWAR C0vQ1cG0TnDjARXbQtF2kmTZjG7oSRb1u2xL1idlH5bRntvSczv6tl33xW3p2F+TfoxNbX8JWq9k 132L1DHOOK/YX7LvObkuybivy5blqCEAAQhAAAIQgAAEILAuBHQN23Yd6+tgJVbyNXve1pyabMVr 8CFymVO2H+Nrsxvt2IZ141hc41kujqvtecc5SVbbsa9JL9vN29JzHPalvjbbGneJOu5bVt03xkXj WeUcF4l9I5Iyy9qJi4Dso1s6saznsXggqa9t7taRDcu6z7Xtl2rJ+FMaL/XZrmvJOEbb8naTvuVK 4+qLDJygsU3rus790tVYLpKzTmk8yw/ZjvGW9Ib6HSpf8kkfBCAAAQhAAAIQgMD2E9B1o6+H+85W 8lknXn+qHUuWjde+fn9MlM/tbK80bv/25Vqy1reM9b3tcffH+GRH49medS0bbTjxYXuqfVdP7FM7 6sV2l5z9Z7m47djVZ9ueh2J0n2r3u4460WapHXVK4/RNT2CtH1/K0/dJo/7SyZLlp9r2CSD7fQ7i eKI0xWQ7TkJ4fvalunTytTGxrm3Lt+1bL/uRbIzXNqRrO9J1LFlecm06GnexnG243360bV/6InSs lvO49VVbN9qWnLetm7ejjZK8+tpkzNP2Yx3jzn6jXKndJO95lnS2qa9p/ts0R+YCAQhAAAIQgMBy CWzTdZTm0nYdWiLbdX1le7qGdbtkR326Rm+7Rs568m3+jkO11xYeV+1x2XA7jtuvfcRYLacxy9mv ty1j21FfenHcbfWrWEdt6Sl+23Wd5azjOvuTvItlvG2b4q0S/Wnb8k02m/qjrtoqtrW31fxvX7lm C+ONtM1vPC/TWdqopIx2vLKxPiinw9JuWf6nKjqgcsZZ8/YXlfxqO8ZQOimzvLd9wEYfPqGiTbfz mPplS3ai3xyT5RRvaU76QlEMHtdPZfu9LrYt+yqWjXZk3/2S8fzUdvEcXKvf81Hb/arVbxvelkws jkt9js19qjMDyajfX572F21KpuTPdqNsbHsejiOObVO7xGyb5sdcIAABCEAAAhCAwFACvg6UXmwP taPrzVxsT9dgeVxj6vf1p8Z1Pa/a17OWsV1tS979vrZzv66Tresx60ovx2DfkpGNWDwW41LfBRdc MItB/dGm/Mm/+6J+bMtHjs0xa8xrGss5LsnoE+fgMclmH+pzifbVZ702HcllPfVNVbzvHdtUfrrs as7iEjl36azb+EYlZQTcJ64PyFUAzQee4hqraF6aow5y+5F9f4nIT/aXmVjecqpty3EqAaLiLxHL etw23W//6lcxf9mxDfnQxyeFdKSvjxMu1pOObGlbH31ZSs768mFf6nc8noflLCN5x6G2SjwxZUPF tdp5XLZkI8Ztf5L3vGTD/GxHY9G2+h2z44r+NK4S+2xf/bHtbdW5xDjyGNsQgAAEIAABCEAAAttN QNeMscRry9jft126btX1sK5zfa3r609fE7tfPqKcr9d9be3rdsu73/Y9bjsej7Hbt/ry3K0v+27L hq/vpaN+jcunxxyndSSvtvo9plpFte3bv2KyTY9LVvbjtvosp7b9qS+X0tyjTpxT1C3pqU8lry+i 3jxtMyrFP4+9vjqRoXRWFUffePvIbVRSRhPSTvAJ0GeCU8n44PMJaj866IfGF09W60e7astmlLM/ 1aWT0vFFudgu6WjcPqQfbcS2T2jVnqtjtI8m/Tg/68Y+6Ws76zfFKxsxNvtXbfuKzcXz03bWk484 bj33xTizbcuU/LR94Vpetey72Jf7VEcf9q+YN7mY8SbPgdghAAEIQAACENgsAvkacLOiP7xrwnH7 etHbQ2tdV9qG63jdGXm5X31qS9d9qlVcqy17UTaOZ93oR23rScclXq9HPxq3vvut723JxLmqret0 1SrWd8zWnw3u/2MZ61jWdqOO2t6OMUhH8hqzXhyPsahfci6+9peNUpG9bMtyTToeb6tLunF+bbpj j+X5ac4qpRjH9j2VvY1Lyhi44U8FpstuPhi65DXukzKeWNbzCaltHVCen09E15Z3rX7J94kn2vBB a19xzLZUOw77U21d91k36nmukinN17qurZu3bdtzdG2bis+6nottNNWWtw3LSb8Ut+WiL9twbT3L upbt2LavPrXiiSXa8Vhp/0Qd2hCAAAQgAAEIQAACRwn4+u1o72Zt+VpwjKhLtuJ1Z8mHGUpXst7O snHMMqrd776s537XpfFS3FGuNJ77fC0d+7PPrm35tL5lXWvMbdf2GfXMQ30uks/99mMZ15bVuHVc W2bM2nOx3zFtD7XVxGSonVXKb2RSRsAEPx7Qq4TYx3fXAdvnYCrZ0Mmm4rotFp+YUTYydKZY41Gm zabHfGKW9GLcasuP5KLvKBNtRntuu7ac62hPfSWbli2NZ7vSjyVva6xLJ+qX2lm/JNPW1+e4adNf 9VjeZ6uOB/8QgAAEIAABCGw/gU2/flp0D5Wuaee1qWvZofZ8/VvSU1/b+JA4u2IbehyU4o3xyJ5j z767dEvjTbaiT7ftzzru71uX/PfRnddfH9ttMp7v0H3YZnOVYxublBE07YS2RZ0Orr4HSpds23jT WIzPB06s23Z81I323XZdsqExFc89y8bt6McsY4xRNrZLfmOfZFUcg9pN+o6hTac0JpvWVbtUPJfS mPqa7DbJuz/Oy33z1PZvXcc7ln3ZlY8p7DrmRWrtPwoEIAABCEAAAhCAwLQE8jVnmzdfN7bJeGyI XeuobtLrew2cryGzvbxd8qm1T5udko04B+lKxjG7jnqxnXW9nWW6tq0X66jjtuo8P+l43Pp52/1N dZt825jsdY1Hn22yGivNLepvUnujkzKbBFqx6uDxyRpjd7/rOOa2xvTFoVpFdrK8DkwnVqxXqqMN 21Lt/ljbj+WiT38R6dlGy7nO8tZTLXnpOl7HLN1Ssa7GpCM5y2pMfSqWsz31eUxtFevtbe39qz7p 5hJ557GSfJQp+YnjTW3bdZ3l1F+yXeqzrnl7nrG2DDUEIAABCEAAAhCAwOoJ6PozX782RdV0vdgk 37e/yW5Tf5vdLh2Nx2vTknwXD437WrikX+rLMWeZvC15x6m2Y4p96o96sa0xlTb5PF7SnxnZ/6c0 XuqLOrk9VD7rT7mdWWVfQ86VrLtu2yRlJtojOohickBu4oHlE0B97lfdVvyFI90uWdmJcm67juN+ EW2ON8q4rTrG6zhsN8boPumoaFvFX2KxLd9Zfia8/4/HLGdbGvaY45J9zyW2Ne5HtKRn+azvMc9F 2yrRp3X3RvZsqc/FNr3tOtpwX6xt17Ys723PXzqWVdtyaufix8Uck+ssxzYEIAABCEAAAhCAwGoJ +Lp8rChK14i+ruzjo6QvPffH61Hb9ViT/Tge9WO/dX0t7+tZ91tW+vbrMdeS8bjlNSabKvG6WtuW j7KxLZlSkY+2dUO00bV/HZv8yG7UVZ9iloz6PW4Z15JrKlEm2rB8HHffququWCKrVcU4ll+SMmOR 3Lfjg1snnBMDGvJBpZPHxW2NnT179uBdK7ZhOdc+CaXnk9BjrnVwRr+WU5/sula/7anWtorjtD3X 0Y58KN58InjOjt86spHt23e0r7ZtqC0dfeTHthxftOcx68TaflTLtu4aifFFO7Ytfcu4tk3Le9uy rqO82vLbVhx7rCUf/UR9s1Cf7Pctls21eFAgAAEIQAACEIAABJZHIF5D+9psbO/xWtJt+/J2m0/J Wj7KSVf9tqHafZJzf9SN8pLR9bH7VItH6ZpZtnStqp+c9p3f1pMdFW3n2jHFfrVjnNqW32jXcamO 19ySjWsUbbtIVvFZV/2Oye1oT20VHwOKKc/fc7TMTCHoaNtzsb5q91m+VFsm+nCfaspqCJCUGYm7 Tzad2HHxH83nA90noPp9MkveXw4et40LLriguvfee2cnusayPcn5RLeO5fxF4m2diOqTDdUqakvf J6ltqFafdRSf4lWJMXjusmGbjke6LrYVdWXP/i3nmKOcx2RD/fq4rTEzi/YUl0qMTzq2Pxus/8l+ JKOSa8u533FI1vzUVjGHva3j/9qW4m4qlol+mmS7+hWz7Dh278cuPcYhAAEIQAACEIAABMYl4Gu8 aNXXarFvnna8tnQ7XgP2sdkUn68jZUPtuG27UTdfH+v6032+dndtPV1D27ZkfW1vn55L9m192ZMN bXstYJuWkW7sU9tFMo7TscXacVjGutLTx3E5dtX2JV3LSE5t2bbNuD3rLPxj+7Jplm4XxA+6rGcf 1tV2U3FsTeP0L06ApMziDGcWfLD6ZC2dFD7p7FIngUs8IWwrjktOXyg+kayXbbrftU4wyUT7cUxt yWRf6rdt1z5ZPUf1q3g7ztmxWkdyuW27GpO8561tlVJMeyOH/0Ybanue/vK1TfU7Tms7Rm831Tlu yUW/cVv9sfSZg+XlJ+t7THUcizFFma629XLdpcc4BCAAAQhAAAIQgMC4BOK1nS37Gs3bQ+qSPen7 elTjvlZus+sYJK9P3M56Govjauc44rbajke2dD0e1xBqu/h63uPRjmWaasWhO/ulYz379fpAuo5d 7czGawXXGreubUo/x+cx2ZR8nKP1NRZ9u61a+q4lpxL19nr21gaOSfKen8elY1vui3bzfC2Ta/vI /WyPR4CkzHgsDyyVThoN6iSIJZ4kbruOcm7Lrr+c1GdZ1SqyL5l4QlpG/T4JHYfHpKsvE/Vb1zY1 Fot14rja9uvafaV4ZS/qa9t6ql38BeCY3B/jd59qy2vc8/F4tG97/gK1jGKybfepjrHGtmWko36P RRvus2xbvahs9NvmJ44N8Rn1aEMAAhCAAAQgAAEIrIbA0Ou3KB/bTdFHGV9fxr6ol/u1rY/12mQ1 Fq/HS+sA23dte1FWfXm8TS7GJjvezjYcm2v7lJx0LB/bccxt66u2L8dsXdty3Hnb/dZTLd0Yv9pe 52jcayO1HUu0G9uSKRXPuTRG33gESMqMx/KYpXxiHBModMQTNevHk8yqPsG0Hdsedx3tui/WHldd OkFt23JR1+140kpO8VrPMm3bUd/yfWrHW7Id9f1F2ObHtqKe201zl7041mUjx2n7i9Ztfhe1jT4E IAABCEAAAhCAwMkgMO81ZdSL7SZqviZ3LTnr6bo9F4/lfm3rWrxt3Dq+Zpes2xrLutr22svJDdcl eduPY5qXdGwn+rN89ut+67p2v+VdR5vxjhzJR65Rzra6auvL1zz6XfYZPyRweFvCYd9GtXywNAXt A7ZpfEh/m62msRhfSSb2qR23h8Qm2Xyy5O2Svewvb0edOKZ23ras5hy/SKOcZNp0o6zs+EvMtseu 5cOfLtsxtijbh7PlbcO1+6khAAEIQAACEIAABCCwbAK6Js2feWIYcm3bdO09xEaM0fHHPrXlRyWv J+wn1zPh+h/3azvGqnYcU9s+JKvtOJ79SsYlyrkv1tZ1Hcea2rLZJh99xrbsaTv2xXnFtU6UaYpj qv4YU2xP5W+Zdjc+KbNMWGP50oHd54CWTDwJ5L+PXukgzXairWjTupaPY7HdxsJfBrYVfWU921Qt efu1nPpsJ45Zz3KuLevtWEu/SU9y9mUbrqMNJZtko81OlI/trCP7tpXrqEcbAhCAAAQgAAEIQAAC Qwn42jPWi1xzWjfHYfu5P15bx7bWClknb9uW+1XHtUAcz/32ZRltq8iGP3nM29GP9eKY266j76ir totkoq04Jpm8bT3VnkubjOTmHZee4ovzkD3KcglsxeNLOlidCFguvm5vpbh88Hdp6+RQEiDa6Dph bNsnvr/0fKJK3zJNtjLPKO92jN19qlUUc7TdZE+yUS7GZltx3H25jnZsw32WVb/jcJ9lVOdifq7z uLajndJ47JP/OBeN5e0oP8R21JunrTiW6W+eGNGBAAQgAAEIQAACEBhOwNd4rvtYiLK+fo56cVz9 lildN2stEvul67VCttPkQ/r5ejXq5vVStKN2lNW210dq2268Lpe85yTbuWR7GlefbUV523FfSddj ri1jXdUq7ndt+VJtHeuVYtOY+/vYLPlZZp/XxHFuy/Q/pa+tSMp4B00Jal7bPpna9H0yWEYnhfpU 8tz0xRBfnmudbCPr2k7TCadxH+CWtW1vR13H6NrPMEpHsUR7GpOcZTWmdmQjnbjtOapPsqVieenG +duPa+s6Jsm6ZJm43dS2X9mIbdss1bbluiSzqr51jGlVLPALAQhAAAIQgAAEpiaga68pr79kW8XX x/HaN/bPhPb/sU7sU9vrgNiv61+PeW2iOvuRTO7XNb70m/zFmCWjT7Tr8VkA+//EGG1bcl6DSMw/ qR31Jatt63teknefxlUcb96eDYZ/pOe41R1j8LaYqMhW9Bltq1+2LBs5qD/qObaZ0f1/5Ne66rKM ascY5bPNONa3bR995dvk2mzlWCVrdm0213lsK5IyPmjXGbRjKx00it8HUh7Pc9NBmEs+aG1DJ6JO SBWfuKWTMH8h+ASWrvQcg2P0tuPQtn3al7dlS3qOO9pWv+VU+wRTv+XU9pdKtCM/6peeZT1Xybko NhX12ZfH1Jdjj7pNbenbbm57ntGH/KrYf64tG2v7tm4cm6Id5zOFfWxCAAIQgAAEIAABCOwR0HWe r/WmYBJtx7Z9+foyXpN6rFTrOtHX6XHc1/mqvW7QuGVdq8++JOu2+nPxtbn6zUm1dTTueGK/1wPW U33BBRccxGJZ9bs4PumqrZL9y699e3wmGP6Rjux73PFpO85XdvJ2jEt6LopHshq3PemrRDltRxva VnESam/r8F/bO+zZa2WbeXydtnOsmtOml61Iyvgk2oSdUTpoYp/bPvnz3HxSWk5zjm3r5X7L+GQ2 K297XP35S7VkK/uRvvvUtj3VmoNPHrUta7uOwXNzv2qNqd/21KcSZc3I/vck9v6Vnv3FWqNRPtuP Noa0PU/rODZve6727drjri3n7anrzEn+lh3D1HPEPgQgAAEIQAACEFhHAr4e9LXXWNelTXO1H43H dkne17auo4zjVO0EgsYt61p9kvE8tV0qcdzyknOMtuc/zLpfvn3NbRmNqS/W0Wa0a3vWlZx043Yp XtuQvIvatuc+r62inMdi7XHFLN/S89w8V8lLLm5bPjKwT8uptv2sX7IZ41q3dtw36xbbvPFsRVJG B6sOvHUtOql8kvjE8EmhmONJou14ovjLwAef7UjOxfqu3a/avu1Xfbav2nFEXfuUrEuJcbRpOdce k33p2o/GPea2x1Q7jiaZGJvnlmvZtU37UG256MNyGnNbsk2lj0zUlV2XvA89R9eSc4zW6aqHxtNm z3G4bpNlDAIQgAAEIAABCEBgfgK63tJ1nGtZ6ntdN8W1Wrxm9ax07eq1R2ncco7dc2mLL481bbvf dfTlvhhTbFvWcrnWuPu8D7K+ti2jOu8bj9mX61J/tJ3Hve3adlRLT35de6wk6/1kmehTfTH+rJ+3 bWNd6zy3dY1zSFxbkZSJB9mQya+rbNOJkU+2HH8TBx24JV35adKRbeu5Lsln/SyTt20rxp5l4pjb TTLRXpyj5FUcn/Xdn2vL2V9Tbb2+8tGOYlVxHcccu+s41tZ2PG0ybWPzzKPNHmMQgAAEIAABCEAA At0EdA2m6zjX3RrjSZSuRUvW+8rF69HYLtl0Xx+5PjK257pJJ/Y3tW0j16V9VOqLdmWji5/kS3a6 9GJ8fXzKh2yqziXr53G2l0NgK5IyY6HyiTGWvTY7PgFKJ0dJzydn30V7nIva0i/pZrlSPCW9HGPJ jvqkG8f62pL9UizZr7ab5qYx++6yZTnpuEhH/aXi/i67Jd1Sn/dvaUx9fbg16bb1ex5tMoxBAAIQ gAAEIAABCExDIF+LtV3X9o2g67qyr50uuRz7mPJttofMr82O4+2y18eGbbXVtiN/XkO4z3o5Fo1b 1jKxjuuVrKv1g55YaLKRfdtutuP+trrJVtTpIxPlT1L78NmKkzTrBeY6z8HUV6fphGtbkFunzYdl PG3Lut/bGo9ty7fVls8xql/2Pe5aJ3n82La+MFxiXNZT3fYF4THXtqVaurYT+3M7y+RtyTs269p2 SdYysc6c4lhb2/OKtdttenHM8q7jGG0IQAACEIAABCAAgdUQiNdmQ64Vrac6fobMYog/2/X1r7fz 9bH756llO64LPEfbytvuV52vx7WdY4syZpZtSMZyrqNM9iUfTXJZT7JtMWX5vN3Xj/TaWGW782zH WPKc5rF3knVOxJ0yPmCmPljkp+RDfTopur70JBP1bS+eULbjObUdvNa3jHW1rTHbiD49FnXUVuxR Xzq2b1slO7HP8rat2nOTfccTx9WOepaxf8tq2/HZpsfMPdqxXcuU7HnMtfRL/j3HbN96qj3m9+vY TpTpavt/UK4ln+faZcOMuuQYhwAEIAABCEAAAhBYDgFfZ8/jLV9b5mvaJpuWs36TnPvbrl19PWqb vjZu0vV1scZzW32+drdd1xpTcSzRj/tc70nuXSs7rtjntuusp/6mPvvVuNqOT3WO3TK2ZVlv23+p bpNpG7Mty7h2f1vt+Eoy2Y45SDaPlfS7+pps5P3XZWcTx09EUiYeMKvYSTrA/Abs+BbtGItkHKcP vFhLVjJnz56d1TrhraO6VGwvjtmm+vJ4HvP/IPwSZceuGHJxPI7J9uN21vG2v7y8Xao9R8fcZLf0 P5b4BRnt2Jb9eQ7ajnIez/La1seyUc86ri3n4yDbslyuu9i0fXFmW96eR8e61BCAAAQgAAEIQAAC 60GgdJ2o67y+15kluXhd2zZLX9tKJtpxu2THY9Gu5lC6NlWfbGQdzznq2JfrbF/9kreu1zRRTn6y vuTV537VMV6PW1d2LSvblnWf56Jtt7V2kZy21Y7FMm36kvd41I1t2bGtyE0ykYu2HbPayy7mKb9x TrG97JiW5e9EJGXijvQBuSzA8uMTPyZUSv51Uig+xas6nySyo9+cd20b2laxnvuzvg50n+xuq7Yv 1fqoSNf68umiOWhbeipRPuprTPoe17aKbe5t7f2rmDwH9fjLST7ivtNYnKNsuciPxhyX+y0vWfmw PXOwnOsYh/okbx3LxDrOL7Yt47jM4oILLjjGxLKlOvvO23m+JRv0QQACEIAABCAAAQhsHwFdz+Zr w0VnWbqeLdn0dXiT/5Id6egjHY3rOtZrG/X7uta2ow37iesSjatfetbJsao/2ta4bGTbjinqe70g +x6Pfrwmsn3LW9b7x74k5zHV1pNPyeZ52FfUd3zW13bWs4xryeoTi7elG4t9xr5ltVfpe1lzbPJz uNpuktiifh/Qy56SDrCYEIj+dUI4rnxS5G3bkb7HpBtt2LZtelu1D3Trxpgsb1velp7b0tO4Exdq l+Slo2K9va29f0t9sqfYclyyXSr2aXnLOT7ryFf0Zzn1WdeyqtWvL0TPz2PRhtq243HXsd867nNs kbn12mrbaZKx/abx2N9lK8rShgAEIAABCEAAAhBYPoEh13aKzteYarddp2o8F18b9vHZJCMbXXas K7l4na3++Edrr1VinNZ1n/25X/PX9btjsFys43W/fJRkc5/sm619yabktO1x9fn6XvLRfrQpeW1b X3WMy7qy5xL13Rdr+419pXa047moz4mgqFOKQ+PWi7Jjt0txZh+lYyTLbOL24a0Gmxj9gJi1A3Uw TX1ANdlvO4Csk2N0f5xmtlOSkXypP/d527X9xO3Ylu8co0+e2B91NB63S7F5Tq4tn2vH59o+vW35 vO0vvGxfcu5T2wmZbEdjLm1jkjEPyUVZt6M/22yrbcd1m2zXmGOwLW936TEOAQhAAAIQgAAEIDAd gUWuzeL1XGz3idZ+m2Q93mXXciU7UddyriUfx0v6vraOY1FH19b/f3vnth25kSvR8zD9/z/shzNb mm2H0UjeilUqqZFrScgEAgFkFFlO0u22Z30xxrWev7Xitmw+w8DjT3I4r3XgxdfF5THHHsS63rJy 8+xyZFgza+CrusF1lPNI3TMYe8R+VQ9n+r0b+8f8SZnuortbzKt8ftloj/BwUx3ZExe2Xypn+M/2 ULmzLlyu5d1bg3OPlZtYzcfXDXDc2HL4ZaR2WnKZg2dozftwHvhlnlDX8DA/yyfPXdZ+5Ktr/WNH gVFgFBgFRoFRYBQYBf5MBfbOh55rV+rs5dc8z+f6z+R3vVQfZ/xaY1Wr1q7r5M7niI4fbI5cJ09i nNe6+rVZW98dNnu8g+8IB3tNPZ61tyO9fBXmqS9lvJhe8eFyIxz9AO0L0bM3/enzg8kLRd+W9eJK zJkezbvC0+Xknrb6SJw9YNG2ftns6V31rH1l3LrWgFt+cfQhjvnKT2xvWCdx1ktf1sCf9V1XTOY7 F6M11/jYUWAUGAVGgVFgFBgFRoE/UwHOh5wxta9UIc+mR+tu5WzFuvN31tzK7XBqRmwrd1W35uyt s4crc/h9lshaq/6skVh9uXfyeY7BWsMcLXnWlqParg/5KvbsOvvIXP3ajP1J86e+lPlqIb1Aj/ax daHmhcKcCz99R2uscNSm39qDNaq/8oADI941uJzXvFxnvn7r1j9tki8wzEtrPrarL7bG5V19du7P vrT64dPnnFjG8TPA+QXGuvsiwm9PzCtPrq2LTT9zY3A4EqPvDtvVOspbez+aN7hRYBQYBUaBUWAU GAVGgd8VWJ2tPB9qyeTMmWvnPiOwfqdhP6tzu2dr95G9ewaXI2OeZc3Ddjh92uRwnj3gW30exsSb n3ZVJ3MqhrU13Ze1KtZa6c85cddafGrJ3FrMc6z8ienm2TM1c93hz/hyD2fynolNLe3v7n13/b/k pYwbuvND7DbDDYGQjpzrq7YTufN1edXn+ki+WOxKn+SpmLpXeVLjzHEODoxfHl542KwnTl5sHfbA Cxu1zvrMrSt3Xcup377wy68VixWfPufWYi2ffdWe/G8W9YuTKzmYu8+MO7enrE8sOcWkz/y7rDWO 8NmHPaMXvjMcR+oMZhQYBUaBUWAUGAVGgT9JAc9TnrHq3o2n9dya5zDn2spzx3rVo9y1tn3mc4Q+ ciofe6x+z+AfgfJLLvKYm19gu+dVechT57oXe8XWWNZLnH74fTYwbgwrX7X2ZW5iu/z0OXc/clUO 41p7qDj5tqy5cHXDODHrJS7j+jufsZXNva4wj/qpUXtb7fvRWpn/kpcyr9gIm8oLmzWiVh/+HPaG +M61iatzMPmBmY/lbxHPP1lSc4+s4aH3rEFNfOwr/7Zt91n7JldcxuRQGzD0S99wia09sDZmD+zF GuLxMednNeTJODwMuBnkZ53KB4c8NcaamHs0nvujRtZkTlx9iOeAw97AWBuM/OLr2j7MyTi+XMvx Cmtde6BPfPb5ih6mxigwCowCo8AoMAqMAj9Rge485dnL/brW6n+FpT/Pvnn+87y76sHzMzmcHetz T7dvuMyDH0y3Z/wZYy7efoxr8TvHMupLH8/i2at7tg85PgjKL/JTF7Dsxzo11z6gqfz2QgzOyl37 Alf5qUueuVpryWHPruE6O6zdcRiTE0zFVQzY9OVcns66xy52l88a7MFR96P/TvuSlzJuCsGfObyo rYGoe4MLmhsqe6s83YUCJnPEUNP/Z/1e7b14rYGOfpFQwy8291l1pic4GBmTQ0sMLjj939LZm/nu lbX1yHfoq3jj2Mxlnpoxpz7WWlrrWENO/PrEGmNtL/iMg1cL/NRkEGdOXF0+AvELjeS0J8Pk24u+ 3K91jPnZsc5+jL/K0jf1/Tx+/fr12z5e1cvUGQVGgVFgFBgFRoFR4Kcr4NmLfTrH1mGs+u9ce/7L MzD89Uxba3qutcc8I1dsrskzB3+3b8/amUc/9oqfuTh79TzNGZ15coNJP7ni4RObNfDnsB4+51mn 5opJDvHqR4zaudZnvjlYfhzu2+eW3F9ywF97k2Nl1du4ddVJP9Y+01dxXX36dQ/yJ0c372p1uDO+ utfUkb7YS93PGf6j2Je8lHnFRo5uuOL4ElFwY14grrsLpdsTPrA1X54tW3sAW2vITywf6lkzKj59 mStOK5dfqPoznzlDHqz75Abhx3Xm5766XDjVl3zmmUPckTXwdZ+d2I5DfjHY7NV4+hLrl17NE5Nf FHDx41Bj+8J2IzXq4nf77MO915dyd9cbvlFgFBgFRoFRYBQYBf4UBTxTet5y3/pZ59w4tuZk7Owc Ls+YNZeYZ+o8ryYuz7j4s2dyajxzmbsX87BdPxXnGn5z4WPe9WoftSfO8OZ9TP77K8/p1OEna4BL X/ZLbteT3NjEp19OOcQmJue1J2PUhyPjObdOteZXq3b4c15xdd3t05pisy99fEbg6nBf1c86Nevi V3x1r9mr87qfK3X2cl7yUkbB3dheU6+M21vW1LfV79YFc/WDo561tdmDPnrNC4gLlGFdLT77NFeb vJUr8zs8vIzM+/R8+vySxGed5MQvr5hcGzeXdTfM0YLZyqHfrbg82sq3lZv91S8M1smZc2vo862x //Dws03+1fxof12+9fc06nLHNwqMAqPAKDAKjAKjwCjwuwKer36PPOY5wsuZzjOpD8CcFbtcfdru jL/qOP+lZWLkwnZnVOPm5LrOzU+/eZ3N/muOa23m67OeFowxuV2DcS6u8xEzN+fmYs3LuvrMyWeD 5CPOkMf5h/O/v+S0nv7Oet0YS0592o7PWmC6eOeTL/enT7u61ozfYbvecj931Og4XvJSpiv83X13 fTjcTF58eRGc4a8cmcscXn3aTn/7IGYv5os3PzmJefNifbEglnjOay79W6fiam7ulVgd2XeNsTZu LOvpSyt+D5c59Jijro2ptzXw69OKPWKT5wg+MZ3+GZ/5KDAKjAKjwCgwCowCo8A9CjxyZjvagS9i OFNaT5scq3NqYrbm3Rk563Rx+RKnLy1xz6jpr/O6hxXvnr/rNXOyjtiMO6/WfvkskgO/+5PPtTly +XyFv3KIxcqTvrPzyn8H59keOvy79NH19qjvpS9luKieLSYX0ZUH2rNC7u1jtdfaX/ba5Rz1efPI 1+XlHrt47U187rXLA2d95tkDa0ZysE6eGiOeA6wDrLWsY+yZtvZwRy33scX1qj26P+1WTxMbBUaB UWAUGAVGgVFgFHhvBTzTHTlv3rUTax7hO4LdekYgVjnqOvtYxc76k5O5fVSeugbbfRYdLnmZM7ae CTqOo75P9t9/U49+O57f0c/3dNrdXfUr9/rSlzJ3C3cnnx/C1s2f9cAfxZrnxc3aG9jYEVtrJh/5 3qwV13Ef7b3jwkctrEM+bhj7MNZZ8TUm51bcWP0jbFl3j8e64OTTt2flTlzHcYU7OZk/8gWkHqvP ZOWvPcx6FBgFRoFRYBQYBUaBUeA+BVZnsHru4ywnVksXFXdfZ8eZPA973tXK4FqrH4tvNThTm1P3 mRrwHJCj45Sni2VunXd52ctZvsp/dK0WWS/7qDziq//KequOfNkXPnWzD9dw6TN37L8VmJcyoQcX S4680GoMnPEuZjxjeXGbm/W6nPQlF/n1pYT8fIETB1+t9Vb+5BCbljz59WcdfMmR88Tjdz9a4vA7 9Hc+MMbF11qs6TVxzJOPXNb8iNPKa8y8Gk8OtQHDHxu1J7m0crrWWsP1nqVOl4M/a+dcTnqdMQqM AqPAKDAKjAKjwCjwWgX8T4s8q9Yzvd14fjNeX0SIu2o9R2K7wVnRHrrzJjnJIQafnJ6NjdU65usH xw979ayqTmDsR7xWHnKtrQ+M9Y1Zp+a7Jt7VkidxcqbPufYIF1j7qnWIVY6Kca0lx9H5jCWvnznW 6474kT2KSTxzrwHiW33Yz59o//iXMl4o3YfvhbV1AYnZyq8xavplXGMdn/UzxtybRg7WDuLisdwA 2LxJ9JmDhUM8a3vVl5Y4Y3VzrbS1rlzme8NqE0cd8R2vWHDEGeohP77EsWbA60isfvvRiq2WOLXJ w9pncpJDnM+/G/ZuzD24rhZ85aocNcf13f9gl3fsKDAKjAKjwCgwCowCo8C+ApwJOY9xlsvzm2dH 4syN1zPffoV/I6zh+dJzpA/f1iWL2vm/sM5zsDj7MyYv+WKowRxsDnPFZQ5zuchnbu/JZW76so7x zmcNMP7gY9jb52r7N72pn7lYa5ude9C3smDJtw/nyZHzWsu85E98+lMb/OqMlSetufLZW1pijPSZ N7ZX4I9/KeNF08lTL8aK8QaoF7M4L0TXabl5u9pdDn1ULLj8AoDbNVj5zaVHfHyZZw3j9saauF/6 yZU3JDjWuffKZU9Y+axDL/rtx/7tnTixtNSjJ/0fwf/90mdP7sU1sJpbe06sfGAcGdeHxZ/6UodB bs2Bl3/IHRlZu8PD3XHVmplrDGufGZ/5KDAKjAKjwCgwCowCo8DzFeCcxxmZs1w9o1Lds6gvR7oz X9elZz3zK8bzJbit2vaEXZ1p4fAMn7z4rS+Pa/rJ8755tU/XGU9e4/aX/OAc1HJkvn7yc+CHKzmI dxr8+vXr//7666+/9wqGHzitxbryZa/Wll8O/XDVnuSsvNQEW3v3c5ZTqwau09oPvspHLP3Gs757 pH/nH0nz6zcFjj0Z/pb2Mx3dRe0Fxo734lWVzK2xevPXeK7hqbWJy28sX3wwx59fCMy9uYiZl7WY Jw9rOZjbCz7yGfLoq31ZF+twbi7+zE8/MTmZuwfme4O9+KUBp1888qmTPGAcYuxVv70lljm4rAVe DnO11V/X4rKGvmrVDT88ezkZV4/KOetRYBQYBUaBUWAUGAVGgecrwFksz3JdReNYRp7lOrznSm2H kUfuDlPPtV1dfHJQz5qJlSdrkNP5E5Pz5Es/c3m6+tmfeeD069PCpc7OseDdm1h8+UIGPxjzidtb PpOYX6382PqM0ukFjh/qOJiDTR+xyie+4yVWeVjbH/FaFx/DvM/V5280yNyMzfxTgXkpE1dCd7Hk ReTFl7h6gQbdx0WZWGPkwOsNq/+stbY1vOnrjSiu1jTPuPWTR19iyGPN0OZcrPz8w4Z5rf9B8D+O 5Ey/c7lcZ43sgbhra5pTOfD7UqL7LKxB3zXXGnJjj/gqj/nWsKb+Izbr5vxI7mBGgVFgFBgFRoFR YBQYBb5Wgb3zm3HtXrd7OOOelbH4PKca36tD3FyxeabVh83nAObd6F4QrHqxbo3n2nla86zf9WV/ 5PmsIF6bnPqw+tPHXE7mHSZ9zrveyHeIW631YyvWWPalD4tOxLCuPyb/+wVf1dJ41mJen03Fjf1H gf6O+Cf+R83qBcTmvRCZe/Exf2Qk5yM85GbPcnU3l713ePO0FSNf9YvvbGJzv3LVnMRnjNzMzxg5 Kz5wxP3JvG4OT8dlX/JU23Ft+Wq+a3KYp/1YzK9RYBQYBUaBUWAUGAVGgVHgQQU8c3rehM55WudH yoHl/Iz1J3mTwxcu3XlbXI1t9WJdc6vtcnmmSD8c+S9m68uD1TNIrcXa/dc9dNijPnvrOHMf8p3p 15yVhX+Pr/ZQ13DDYf9dfFX/T/P/yD8pU2+wKx/q6iL0Yqpx1sayHr6KNb7qc5Wz8st31FKXnrKv 5NZvf34hwJ8464l3fdV23PgYWzW6vKs9sOccuff0O7c/19Vu9V2xud7jFXuV3/yxo8AoMAqMAqPA KDAKjALfW4Gj58azu7yLt56vt/o4UnMPs4pXv+f87O/I2brysB/y8MuJL3lZM8wVn74PwAO/5K4U K3/XX809ul7VIP+Iplt17uxzq85Xxn7kS5lnCZo3T1djFeciPfLfEcrphbviE5eWLwAuWGqRxzy/ FMAak9918mzNs5/kgIehT46z/OZ1lv3A7481xbquPbAmZi+dLnKooWsseIaxqulHcOOXfW1AftNt C1tjR/hrTq6rXhmb+SgwCowCo8AoMAqMAqPAcxTwDOcZVfucav9mtfa/veuV5+k14jPiOdu/ukC8 52jX1W71k7U73F7cWl2usZXNHOukL/NW/sTkHHzmwO9zR+I6X8aZ21v1P2tt39i9z/ZZPfw03h/7 UsYvhbMfGBcXF3Y3vACJJY65sS4XX/1ykr/rUy4w9SYzlnXwyZ/+jtu62uRjbj15kkMsVqw82JWP WPLC6fAlh3WskTnOsV3trOtcC2/dCzE5xWHV8CNYftmztoTbpV9S7rEF/ddpP6t49buf6j+7Plv3 LP/gR4FRYBQYBUaBUWAUGAXWCngOBeH5Ln3rzH9Hnn2m44zMyLOtZ/d6NmbtXuzSM7Z9EncuZmXl W+Hhpi/jHbexWqP2brzD24cYLdi6X2KVu+OUo8NnrM4rV60lvuL0Y6/kVL5O66yR85qbsa35qs+t nCsx+juznys1tnL+eTreQn3D2N6D8GpL9abiA+ouospPXvVZ48qHDF93YejH5uBP4tRBPxUHRg7m 9pY4uMjlh7g3Q1rxWrgc1ee6/q3fqVf+SSLqkMOPfcAtD9bPRIy1se6JOXHz4HIPHU4Nsya4rSG2 s+TJucVxNsb+Hvmxnrq4HjsKjAKjwCgwCowCo8Ao8BoFPK9iGZ7tOJ85P2qf3THnWc66jLR5ribm XpgzxPJ/KGLA49l4dQ7F7w85cPhswJqRcfioK5/zxHxmff5OP9zg7RPLj1yZJ1afPPrNwaqLfMkp LrWSS25s8qQfrhzgkj950585zCuPcT8f12krn3tJTM7tRY3VJTF781Wfe3ln4vTHXuz3TO5d2Jf/ SRk3fdcGVjx86Fc+xNrf6mLzja8foHkdXkwXW334vvWtOfVLyf13/+95e0wdqGev5MIvJzjm/Bj7 mPz3Fz5uUji1xMjJHuEGmzVZg6FHvpTlh4thvrzkGiPOmp/kkV/95ADPsAZ+MVjyXCfOOXhrV04w dYitftdw2Ku+O6373OPMHtw/uenf45j4KDAKjAKjwCgwCowCo8A9Cnjm5CzGeRJ75lz3zHNc7cOz Y7fzPC/nHCz7wvfr168P67lZvoonh9oZT23Ei2HN8wXPEPgyLlc968IHP1gtuX4OWRsOBr7kx8da 2z3DyAcmOcmz7gfBf3/hk89+s09xWPbrPlnD5Q/+jMkrJ3iH9Vxr/YzURz82Y8bdW+KcU5c41s9p C29e2lWfiXl0zl6ok9o9ynk2/+UvZc42eBXPh4+43UV4lTPzvMjw+QFqE8fcPrgIK4a18czj5u7G aj/pt07HUetTQ595rrM+/NyI7htu8Yljnr2wlk8O11pz4APT6YEPPJhuX3DksE9rkMeQR6xxrTji zPWLr3Yrrg7UXA0xq/ie/5F8P8O9GhMfBUaBUWAUGAVGgVFgFLhPAc+GnsW0Z851Z7C1c+tX/2rt 2ds8a7uueZ6nOSczB68PLH5jmStG/sytZ245+Be+4DLuXJ6sgc++2ZdznnPMS7zzbg/UrZ+d/PDC t+pNXuKMrtfaT+WSA5y19GHx2V/6mdtn9ctjX8StmxpkvHK4FoNd9SG2s342XexOH/3l3u7kPsr1 8pcyfjh84M8cz/gQ6d2+c+4+Vnsjh366m83caldcR/z2qAZZt+bnmjm5+uzJ/l1j8wWN9Yybv/Jb Rzw2e81+U7cuT46sab9pxa0s+R2/vJlX95WxnLun9NX5EUzmpDbpvzLv9naFZ3JGgVFgFBgFRoFR YBQYBY4r4HnOs1ieQfUdZ/sdefZ8+TvDvz2Vr65Bd33rA1/Pz8a63IwRN7f6K2+Nk5uj9u3avGqp q29Vy2ci6sjH3Dzmjs5njFyvC31Hbe2NPGt1vNlnrUEeP2pOPHVwje2w+LthP13sqK/2dTRvD1f3 t4d/RvzlL2XYdH7Iz9jUszhr32cujJpbe+xuGDCrGmf8Hbf5W32J0dIPXKx52+nIuD7syp+YOq+9 1i8nOBmrvoln3Q4nR+XpsB/Fyq9VfoE9ZYk+j4yq5yNckzsKjAKjwCgwCowCo8AocI8CPNx/l+FZ O8/EW72vzthH8rcw8m5h7OvMGbrj1Qdf1vNsnfwZt/6elQdccpm34sSfvYnXJq8+LP5axxqVT7/5 rmvtuhZ/l6193cXrfu7iu8Lz8pcyNJkbf5a4isHFtroYxVT7yAVFrvl1b/prPddXejX3iu36SV/2 X/3exHvaZp49woufkTWM36HDFr91sEdxmZNz89PnvNubsa+yfm5fVX/qjgKjwCgwCowCo8AoMAp8 LwW6827nO7qro7lHcXt1V+ffLf4uVn0db8XYW+evvq1noHx+kvOKtWcs9VfPK8Zqj1s1t7i28r4q dmZvz+7xS17KPHtTr+T3grVm3jA1JqZ7M0ls9YKj47FOd/En3vnWTW5fe1auxMlLzFF7Mk/b5RiD I/XZ0gRsraUuxBi1L+ts4T4zP39X/ozV+VFO8s7w1jqzHgVGgVFgFBgFRoFRYBQYBe5QIM/KK756 xk3cVgzcEf7ku4Jf9cAzRx1H+DtM9Z3hrrm1J9f5DKRP23F0PvArv1zafB6pOStNyd2Kyf2IfTb/ I709K/ePeCnjS4AzInJh5oW6lZvYnJPjBS4X69VfJOXN3b2IWPFWfvvs/B1/4rwBai05V7bymp/c 6bMOfIlxLR9r5vkFVbUxHyy84NUan3XrvOJqnDXDfO2n95++WbufihHbWbBnhjVyb2fyxdYez/Yh z9hRYBQYBUaBUWAUGAVGgWsK1HNdPZ9dY/0n667znX15bnYtP/uoMbow/k9HnzP9uf/k3DvnZn7W 8e91oZf63FCfu6xde3NtjeQ3hqVGNzKvi6evw57h7fLhX/nZsxplH6v5ikf8qlfjafe4EuucXv+0 8Ue8lKkP8kc+5L0vheRIbM7FVF+uuVBzveoVDD/1wt7y55eSvfh3wSRP5TBmL67hYA6+cou1jjjX 5mLJz7Vz/PRXv1BdE6+83rT+jd70kRhzPgr+95cxe9ASF6vNHObkOjIPH+vMy7k5j1hra89y2U/q e5Zj8KPAKDAKjAKjwCgwCowCjyvA2dYzuWz4rp7z5Ljbeq7Wcp5keO6nX+b07llzqwfzwIg3H1/d v/X0m+MLBtf+H5h8HoBLXmI+L8hD3JE13Ie82sTKq6+u9Ztba2Y9sVh6t0/9cDPq/wYbP7yVe+UH B3/lyTrUBkd/9m682r144s9gzVtpavwn2j/ipQw3mBf10Q/Ri3IP783ABbca1gfDnCFea65Y11pv 0u4LHI6Op9uDN2PqATdrObS1V3uBlxxx+F3LI4aYPuYMsZmPP3PE4GewZmQOvPwwiDNnf1i4HJmD jxg/+Ose9dUcubTkgck6xMyTX7w44/pfZe33169ff+v0qtpTZxQYBUaBUWAUGAVGgVHgHwU4D3Jm rcOz5VedF2s/nh89l3ueFUefYrTGOguGIU/m17MzOPDmcL5njuWH4fmf863a4ZeXuc8+5IrBOvBb 22cInyesJ9bPLPPpwXxxWHK7gb/ysoaD57zM2+Je1azc9EC/6tD1VPcFR+6x5lD76DiDlTM10PfT 7e/fBj9wx964Z7bGhdhd7JUD3NZFC964fK6J6WOeo95Q7CHzxK72tvLDUWOuay9dPevWmOvsmy8W ObEM67s2Lq9Wvm5tv8aw+KidNfHDnzXgzbVc+qqFw2Eua/urlnxHztNnjr5XWGuqT+77FfWnxigw CowCo8AoMAqMAqPAPwp4FtPjudEzm/5XWetnPXrBT69Ye9N2sczAxlpzAAAxC0lEQVR3LnflIy63 Fp9441iG51ifN8jx/I+1r0/05+9acwtjXXgZ1mPuiynmdWxxdlj5jblmDzk6XuL4+bFfc/Blz/rp Hf9qD9aRz7X51Xa1K4a1fF1sy+fnuoX5abE/4qWMN+6ZD+/MRSR26wIGYzzx+rK3Vb+ZJ77zEVv5 ia34ieUAZ39a4nIzx8864/KL09Zc/MbMl6/6yXXA78gvMeZ82WDNF8da7vQ5x7pfc7XEai6+HGCt kf5unrxdfOWzB+zVYW3tVZ7JGwVGgVFgFBgFRoFRYBS4roDnzusM68y7znny1F7100GN4cs4a4d+ LX7z9WnNSWssz//EVy8bxINxrsW3N3yu2OKHL8/myb8Vy9powADPy5NcJ06+rFHjuc65OqevztmH OGtVDOtV/Q6bPrj97NJf5+6/+n/y+o94KfPTPsDuJul87HvlX90Uia9fMK61V/hrjlzUNYatftcf oPhVb9qtG90a8lfOuo4yv335dNjOlxyPzu1f+ygf+c/u+Y4eh2MUGAVGgVFgFBgFRoGfpgBnsDvP dM/UZ+u8eMc+zuhQz/7su/Yn5mhvq/o8V8BV+alpTsb0EWdsxT4Rny+lnIO398olX+cntvLLvbI1 z561mQe28ydma771nLaV9yfE/piXMlzgVy6EMxffHrbG6zovuK1+vRlqPmuGcfkqTv9WDTFpVzwr v18qne6rHP1a67Nm1L0Zx27VSxxz+ZhvcRLvhv0lj7grfOa+2nb9v7qHqTcKjAKjwCgwCowCo8Ao 8HUKeK5ddfCM8+JZTs/5qx7xy3nmLG5O5d2qt8qpHK5X+FWNFf6sn/rUIK/TpPLVtf1r4djDiD2K E69daWL8p9o/5qVM9wHyoXcvDDrss3xcsN1N0tWzX3O6vM7Xca18ebN1XNau+Ss/OPtmLr9WH5bB 5wEXQ5t9dL4PcPzKm/nI5ytnUBz6TDLP/WjlApP96+98xsaOAqPAKDAKjAKjwCgwCowCr1Kgnl9r 3a04Mc7eW2fbPDN33P5nQjWWZ/oay7X8ee7Wl7icb8Wty3OEc3O38sSk3cLLr828O+fdZ7PV16r2 kZyta2XFO/7//oXUf5II3FT5kJ7zLR24ALuLucvZw3oxJ5851folYJ9a6oqtPXT8Yrqcqon5Nafm 1jX4zM39EbOOX7qJTa70J6c3ePKCzf/uEnwdVcMaX63tI+tVrH1jnVvPPG2XW32r9RbHKrbi2vK7 ByzjTu6tuhMbBUaBUWAUGAVGgVFgFLhPAc9yjzJ6NuR8y7mw8uLzjF9jdb3qxWeDjHueTh98nPsZ GcfPD710PYI3nhZ/HclLzL9LZiuPWDc6v1pt1TnKBc6+upxaQzwWnXJ0vWacubX2sMT3MJXbddez sZ9u/6iXMvlSgw/WG2PvQ966yWuuF7kXbhfvvjCyl3zRQM8dvvLm2n3mDZH8xOtFn33LlXsgx7Vc 5rC2R6z+ro69ia+19KcFY22svGDyf+/G2ljm4ONLVV3twdor6z67uLXsx/7wM1jfNba4tmJH6tsv WHSBT32YZ/wI32BGgVFgFBgFRoFRYBQYBbYVqOfwbfT90e6Mx5mvnivzbJhnRDoSS96Z/dQ6njvl 6HrDxzme87wj63te1ScGS8w464rJGL3YB1ifHcDgTyxzuMjx5Q05iam14DPHOqyzTs2Rr/rl4VnI vtWSnOxLPzXJq1zEOz/7YRBzv5+e9e+uX+rawzrzn/+b7hbmp8b+qJcy9YI4cnHwwXOjgfUiy4uh XqBe5B2WPHogVuOsiTHg8Ob0y4d1Hd4g1e8XgzXEuX/j5uVaTcgljxg+5lj7t1dw1hEnRl5y6Z+1 gxxr6cs4MXmNZ//WAuP+sPmSxjx4rQ9eHuNa92RfWuNpqQUvGC0+h713PjHvYO1Pmz2pVfpmPgqM AqPAKDAKjAKjwCjwmAKeEx9juZ7d1e/Ogp7pffCvZ3U7gK/LN54WnGdxz94ZzzM7fvDw1zO+zwLE xSSPc2rUOuTaA3si35HauN+OX0555GBtrD5LZC32CY56Wcd92Q+Yrj44NIGHeNaSz724lge//VJn VcMewNurPm3HBTb7ybl5nSXvTx1/1EuZqx8yF5IXdeXIC5rYCmfe6qL0JpHDixK+VY6c1Va8N0va zOl6dl9y1VxztPCZoy9zVjdy9mEtfJkrRh84a6Vu5mmJiePLyL6Iqy/zrMv66PBLEMvIXqybXOnL XhLzVXP6qT3R71VtvmofU3cUGAVGgVFgFBgFRoF3VyDPhF/RK2c+e9Cu+iBez7xiicHFOfvImTHP 3zmXDwtX7Yk1/Pk8kfn1DCufPPbmvsnVJ685acWDkcv4KoYfvHHx2KxV+3ePXZ3kcA7Oz0WfljoM a9gLlnG0xgf4f3h7lyNjzrHErZ/+I3NrHMH+NMy8lDn4iXLx1oswU41rM5Zzbg55tDVHjHFvKC/U vNBrLrXwOeTQGndtvpZayS9PxykXFj450prf2VUtsH65W9d+ieljzsi1uPR9ov6N0wdeffXVtXq4 R3HWwLoX+xazsuau4vprTf1Y95q+R+ZdT53vkRqTOwqMAqPAKDAKjAKjwChwjwKc07bOiqsqZ893 nm8zL8++3cuBep4+00t3xoWv26saJH/22fl9pjKWeGvjkzvj5OTaubbjxEf/YJIfP+utvYHpRq2X mNR+C0cO8ewreZxnj/pWFi7q+/y0wnV+rjP16eI/2TcvZW76dPMC2rqwE2fp6qtrcXmD6cNu1Utc N7eWFsyVGyl7SC758FW/MSwjb96cE4Of0XF8BP73S9wRLJjE/4/itxrqnnsUa5/VGn/Udv3JuRUT M3YUGAVGgVFgFBgFRoFR4Ocq8IrzoOfcVFEflofprfFIj5mbc+tRX7/WmJbnB2Ke6fVr8/kiOdIv NuP69qx1k885fM73eIzbg7xo4FzMnfZsj14bZ3s4q8NZ/nfG/3EvZbhgr14oZy/IvQ8++XJuXucj 5k13ZB8rDvyM1cVfdarrj+Tya1XLGqu4NEf2tde3XFixzO2B+d7IvD2sPa9wRz6jVe6dfvav/mf2 d2cPwzUKjAKjwCgwCowCo8Ao8H0U2Dvnrnby6FnzTD7YLbxn4FWv6d/iAbeKr/zJ3c238rZicvmc sfqcOg58PhcZdy3vVSvflfzVHq5wfcecP+6lDB/SmZvzVR/qozeDNwE87k/OvPncj5guJoabw5td ax4Y+cVjs4/0O9+KU4Oa3pTWNFe76gFucqwhHpu+rm8xqxhxYvSWmJxTI9fkuBfm3ah7ND/77fLO +uTzj5+ezR/8KDAKjAKjwCgwCowCo8D3UMDzZ3fO9EzITsR5hjXGeTR9nk9z92LFZSzncqUv5+bL lzHmR/Izp+LrXxCcWOer2kfiW7nqK0/azKs9E0sfcwb+zMNHDT7nrVrgHHK53rO13h5+4tcU+PKX Mn7QZy+Qa9v9/E9kHnkwpd8jvbov+tzC7+GMdxx5E/qlC54f8MTNk0fdxLA2JjZvbGtknvMu15ic ruV2bTz9+d8RZg/O3WN+fvLAKw5O/c6zjjFy0t/lg2GAU4vMJ5brOrdncN2AM4f5Xd+JOzqv9bv/ 5vco1+BGgVFgFBgFRoFRYBQYBe5VwDNfx1rPiR1my0c+Z8us4Rzr6OaJ83wqPm3mpt+69JBcFcNa TI2RZ0w+MLUfMJ7jieecsy9xhnn2nJxn43J9EP/vl32wtKbxDl9jiWHOjxqIxVbuuk6ezGO+FUvs UZw5Z/HmYWv/GXvG/JFen9EPnF/+Usab4lkblBfxvai9UesDq9gtu9WvNcwHy4/+1QUgjrwOQ9ye 5U6bD9pgGXJWvs4PRi3g8qVHvUHITT7mWY+6GTdmP1txYn/99dfftemBAQd92B/r3O8H6H+/8n8L B44f95Z9ZU76mZPDsB5zMcToRUzGEoOfYf3P1efvmptrEOyNUet8OC/+ys/RPdrvRcpJGwVGgVFg FBgFRoFRYBR4QIE8J9bz4AO0v6VytvRc6fOEtbUm7a3FbVn3IletuZVrjNytfPaTZ3WfDfTl2Zdn CjXIcza1WBOnVnJ6Ts7eM26f4lzLX/3WwsJT49RnVL/7+QhGXH/uUwxW7dLnfFXLuPYIjn6tpTX/ jFXnMzmPYI/s7RH+K7lf/lLGi09xrmziSI78fOjenEfyKsaLr/pZW8MYWPG5T+cdTl9a8H5hpJ+5 fvZFfdYMb1Zs1uPmBZd+1vp9sZE3uTWS96PIf39Zz1hqkBzEia3i+H/9+vXRV9Yjj2Ed893fZ/Tz t1+sxMS7T/MSX+dg1KHrHfyKx35S68rPusbrGv0Z1CG2qvcBOvDLP7IpHxqxN/+hcYBiIKPAKDAK jAKjwCgwCowCNyrgOdPzmGtL1POh/ivWsyCc1MmzZa3TxT1Dmldz7El/5XCtFZ/W87o+sA7O9J7t PW9rwdCX5357sFfiPh+IS4za2Jt1wYBPv2s4xWUf+Okj+eUxhsVHnjh88CUWH8M6Wuut8OTA03ER Y3Rx9oY/hzh8xLtBP/RCnL2jdeXp8qrP/VX/s9bubbWvZ9Xd4v3ylzI090pB+NC5YLBe2FsCdTE+ yNqzF2D117W45K2YjDlfYdIPt1/u5nmjuHbP7sF+8Ovjpkpe5+bKhe18xs1zXW2NZw9g7Yd5YsF1 nx94vwzAZI77rFysHXJat+azrnqSiz/55Vv5jXdWDYhl/Q57xCeHffsPH//hdYRjMKPAKDAKjAKj wCgwCowC9yvgQ7znNSt4FnV91cLLT+XTV3lrH4nrzrqdL8+y8LvW1pqs5dEmxrO9NmPM0RBuzro+ BzF3EMfv2Rcsg1rur1p7rX7XclhDax+uwTvM1eq3D9fa1KLWq3XMwcJfa9R4rplnLWN7POZZa/X5 yJeWz6fuKePPnh/Z27N7qPxf/lImLwIEesXgpjxT68iF0/Ed3Zu4jgM9VnH85tij2NSx4sypmKyV Mf1+wdWbKP1ZSw57om4Xr7jEZ8y+racFY0/m4vNLmnmOxMhJHI6MwZ89s64Y8swRi4+R/k/P5++K y5g56btjbt/aOziHYxQYBUaBUWAUGAVGgVHgMQXyLCpT5zN2xq7OlZ5x5apnU/LwiXPd8XW58mKT I/3OO05jWM/zHQ5uMfb74Yhf+P2XkrjtR0j2T41ap8bJ5zxdh71UP+vKWTHZ0xGs+WDpL8de/l4c riOYrHk2J/Xb0q3WuGt9ZX931V7xfPlLGS8k7arRO/1na+WFc6aPrMOHn+uOZ4UxzwvItVau1ZcE 8S63+uQRn/w59+ZBl65m8jLPXLmx1Y8vhzz49rD2ZD69Hfncskbt1ZppE28t7SpW/XVtfmet3cXO +KypPZM72FFgFBgFRoFRYBQYBUaB1ynA+e/RM9tefsZz7i71VWtcazzXeX59dC8+b8jf2axHvPaU 8ZzvYbt4fb6ozyDk5LAXbNbWD1Z/+vB3z1n4Hea5rvn6tXtxcImBP9fyjL1fgS9/KeOW/MDrxWX8 GTYv9JwfqfUV/dJX6tN9Se3tg76P3mBiV3ocrbXKP6PhGSz16I1Rvzg/nBu/rLOCpP4rzJ3+vX4e rfXq/Tza7+SPAqPAKDAKjAKjwCjw3RXYO9/txd95/0efM7b24Dl+C1NjZzU7gt/D7PWZ+XnmTr/7 6Hz5HHOmlpyP2q6n5NyLJ7ab7+2py3nU92jPj9Zf5b/NS5lVg6/y50X/rJpcBNTBrr6wjK16yPjq Qsa/tZ/ksI/8oqA26+SvcfsTY73kow4/8pmT68SkP7HO5V7h6MF+zKlr+yROLNfy2rMcaf0jlOmr 804rOO1fS16HrXzPXG/t9Zl1h3sUGAVGgVFgFBgFRoFR4HsqcPf50TN5PbcfVedoPytcns2pucLZ z16fq3z83dl/hX+0nvnYrRr2tIVJLvXSZmxvfiVnj/No/Oj+jvLdiXu7lzKI5YVx50ZXXHlT1Qf0 VU76/XCP9pz1kifnW5zdhdzVts5qT9awbtW9W4O1Vo1Tj1q+tFjxm2d/8mUfzo1lDjVYJz841tSu OebKaV3X2tp/xVEX35G/xCp7kx9rL9qMXZmv6lzhmpxRYBQYBUaBUWAUGAVGgfdUwPOt3XkG9Azs +dj4FSunZ+IrHOSYX8/SxOjTUeN1Dc6ezMGqRRfDl3H1yXzmmQuG2plX8a67HuVb1TJXe7QW+FU9 uXIf+qo9gtmr03Ee4a15rHleY+S18OF48i/6PfoZPbmVlv7tXsrkDeG87fxGJxeFtc5eYOTxU/P8 4GubK/xRXOWl99WN5L58UdLVSB/c3iB1P+Do3TjrrKvfv/WcOEMeNcIy1IG5GOYOcazhBvPXX3/9 fSOLwxKreOPZo760xqnB3JcuuQ/7w7fSMjlznvz45dIm9uw8NTybO/hRYBQYBUaBUWAUGAVGgfdU oJ4T85xLx67BMecvsvUM++iOPNNf5bEPbfJ4Lk6fe0hfnsvx17yqjxzZO7rgl8s1fMxdYx31nG/M enKJx88+GfQIXisGK0/nkztj5tR6HQZf5aAePqw91dxc21/lSUydW6P699Z+RvmZ2ute7tW4/Gf2 d7XW1bwvfylTP1DF8uK4urEzeV4UXiRncunXDzrzVv17o67icqx4iRtzvuLii4VYty/8xBl+mTBX i46TmP2DTYy1qhbW9kvOf2hYh3jyMIfDOHUY+P2b02sN4olf9QhuNew/ayTWHt1PxrbmakvPdw8/ v7t5h28UGAVGgVFgFBgFRoFR4P0V4FzKuZfzpmftM12Te/Zsu8fv+bQ7+3rO91wNF73nOR6fa7g6 HjDJ4dw8c/Dns4c44mKw5lUt3Av1xMthDxWTcTAM+Gs+Pn5qzc+Mzz9RQk7HB4ZY5TRXv3VXHOLB MfZw4uV3vWXhFG+dij9at+YdXcNP7WfXOdpPh/vylzJ+SDb3FWKtbgZ72rJn+92rhR5w7vHCI3bV HxyreuQaqzxdbTFdjPr4wfjFKjcxbgLWWP60izgsI7m9YcDrF2eN7CF9zuEUY276mNch3v6xDnpi 0BNfvGKNa3PP+rK+vrts9rjifGb9Vc3xjwKjwCgwCowCo8AoMApcV2B11vRcZ5w150HOp905dK+D Kzlwejbu+OEk3p1TPednXnK5P+Pskx/8uWfjaTOXHlzz7NHVlReOlQ76u3zyrCFX1iXOsHcx6UMj OT7A8Quu1CZCf3Omr5tTM+uCsZ/Ed31nvM7hZKx6T3zFpKaJe+acHtTT3p9Z7wr3l7+UsWkvEK3+ V1gveC+SMzXzQqsfcreXvKm38MlLPx0Wv7gaJ8Y4urfsteOU39gn+z99me9LC+uCU1es/9DQykO+ HPiso62+rp/Eps5ZwzlWjvTV/rMnOPnyzL1l7sqfmDpXm+o/ss79HsEPZhQYBUaBUWAUGAVGgVHg /RXIMx7nS86LWrrPOPOr58krZ9c99eTU2m937ja24mRv/JCbe0589Xdra2cs56mt3Nm/vpWVS1tx 6XeuBVv3Z20w9r7FmTFzkl+ftSqedWIy3s2Tu4tv+dzbFubuGBpSd6Xl3fWu8L3NS5kU6cxFcWXT qxw+rKtfatm//Ed94B/d817+kb3xQiLfaucN1+3FvrHGtfgc3nxoq75aMVprdjxisOLSlznM9zTZ 44A7OVm7F+Z3jLv5ak8rnStu1qPAKDAKjAKjwCgwCowC76WA58RqPcPWc+p7df9PN57L//Ecn3V7 dP8dyxG8enJOZl5tx5u+rfriOkznA59+e8N/ZC/gcnRa66t8WbfGkvO7z9nnu+/vbV7KvMuH7Y15 th8v6jMfeF4ge3mJXfW2h/EmXz2o49/juFqbvL36yU0fjD1dtnLO5MpjXdfVXuGsHK9cq/kra06t UWAUGAVGgVFgFBgFRoHnKfDu59G98/RZZa7yrfLyWcg5du/c3PHhq59HxdV1t/+92uQc4Vlhao9d D0d8K/693CP72+P4yfF5KdN8uly0Vy+4hm7TRZ28SbZqV2xHnJjVlws3hV9AKw782Zd6pK/m7mHs x5uy9tDtXc7aj31k3H46nzHzXFfb9ZAYej/CkTnvMkeXvd7fpdfpYxQYBUaBUWAUGAVGgVHgfRTY Ol9vdbl3tu5ya60zHKvcPAMnxueSVR9d7fQlLxzJ7briE0PM/9FI14O+zNFX7RGMOWewj+SY+1X2 yj6/ote3fSmjgPVCf7ZIvCiof9/JmZr2Tc7R3jMna+UNrF/sFrcY/34Uc9P6BeSLEmytB491nGvl shbrihWjzX6sa0ybfuYM+8pa2Yd+ceZ8JJdfYitGPl+6uBYvNz3pK9R/L/fifwMXE3VchC+7+U/T /Awe7fFyE5M4CowCo8AoMAqMAqPAH65AnvU4k3nOTP/dEr3q7Gcd9+T+VvsRv4rjz/M569Sp5lsX HMM4tj7/EM9nD7H4GXJpP73/cLIm5whH5mYfnM23/s7K2pM8WuK1P2PVygX+zDDvTE5i3W/6XjE/ o80r+tmq8VYvZRTOhs9eMOZdsdbmovHGwl4ZV/omh5+86HNuH0e5xbEHH8Tl0Lo/vgio1dVLLHF4 0ci/e8Y6NVcdzcfyt5/Tiz3hM99eWMtNnFG58ZnH3Nz0dzn2D46RGPhYw6UFo585MfaVtfHfPbKv O7nzOmAPqduddYZrFBgFRoFRYBQYBUaBUWBfAc/Uni+fdQbc7+Q+RJ4vPTPnvnK+V9VzeD2fkyeP GK1+MNZnzrC3PBMz96VIPoPwmcAFh5/PJ8vvvMQd9sqa/OxHjHWIgc98MfZqH/q17td818Y7qx5d TxUvnzk+w1XckbU9HsHehWGP7gFO13fx383zVi9l/NDd5CvFszYXjTenfZy1XrRybuW7R29Gb8BV jji4t/jBEaeXDuc+ja3quhc1oV9z6dF8rX2DsVdxv379+ju34uF3EFOXrb7EYysuOcTh069PW/Wi PkNrHvY7DfunZ3p3n/jz8/lOe5peR4FRYBQYBUaBUWAU+AkKcDbzP13hbHb3OdNz4N28W9rX86X7 utKL51Y04qwvR9bAx0sOn1myt3y+MJd46mEuPvAVR62sDQ5M4qyp3/7q84m42lf2UzFwdnH7sha2 w8mHtb89nFhw8Gat1Z6yTp3bY/U/c03vaqd9Zr1Hud/mpQxiMY5cJI9ueiufi4ab04tvC7uKcbEe 3Yc4rPMVL34x2K0LzC8P8ZWT/RHzxvJmcS3edfJl3RV/YpIr/czVuvLoN7da+8Jfc/HBrc24/o9g /HJ/WkO5hkfdjKfNOun/ynn2xN7dD5ax0uMre57ao8AoMAqMAqPAKDAK/CkK5Nns7nNZngPv1HOr T2oaZ+76Si/m8lwgJ/tgzcAHpnshQ9zzrud31j7zEGewhs8XJfDZq/zmg7ePxOB34KcOVqwxeIhl X9aWT2xd69cSty/quLetvK2YvGndv/1qE9PN3Scx5l8x7L1+Bl/Ry5Gab/NSprtIFPPIRu7EcFN2 /Zyp4QVwlEc8NTJnpYF4bebAoV9b42AY3ChgVvFP1D+/K59rEHscYrXg80bFjw+rPz+L1ReBfPRA XsVlXP7aqxjyM5ZrMHCLpV6OlT8xW/Osu4W7GsveH+31ag+TNwqMAqPAKDAKjAKjwCjwjwKeNT2b eVb9B3HfzBr3Mf7OlDWY83PkjJt5lbW+dEks83xpg545sn4XA+ufVmKe3K73PpOsYb4Wjhz5bIOf Nf1nbzU3+ZOLudgtTOJq/tZa7i1MF6vPYh3m2b7VZ7an07P7WvG/zUuZrsEjN3CX96jvK+pmzbxY 0v/IvpKz8mQNvhCO3EjepJnb+WqtXIvHB49c2tpzflmtelz5rWtNrX6ttVfrVZ74R+wzuekr+es+ H+l7ckeBUWAUGAVGgVFgFBgFrinAmSzPaDm/xvheWfXMeWV/e+d7XmysRq0vLvtITM7Bsk6s+dj0 5zwxzn2OSX5yWBurnOZmjr69euJWnBnv5mf4u/yv9n23/t/6pcxXf5hHX1Bs9enNtoXpYl5I3U0o npg4fVt2rxfjfjHsfQFSy/rZZ+db9WXNLic5a749pv9Iv4nv5vZhbKsHMd/R1n1+xz1Mz6PAKDAK jAKjwCgwCowC76fAs8+Z3XPAURXO9tbhO9+q/lav9TnjKO/duNr7Uf6aV9dbe6/Yu9do2+2jan53 3at881LmqnIn8rggHr0A5NBSPi8053t1tnD1j85xIx190VF5641gX+Ccs4ec556qn9jeqDf+0d63 eN3XFoYY/bo3Lf6cs3734T7evc/pbxQYBUaBUWAUGAVGgVHgaxQ4ej4+0t3e2bOe749w8gyQeVv9 elbXwp/42l/GwNY4Pkf2oC+tNbUZW81r/RUOf9db59vi+I6x+vl/hz28/UsZLzwuoK8Y3kyPPuBf 3UfmMacPfVUPbzIt8dQt/ZWDWPffNLr/Wot1p4m82Kxnvv2IyzVzczLecYkzX/60Xe9Xb9Jur9ay F9b2rU2f+DN2a39neI5i1Sz3dDR3cKPAKDAKjAKjwCgwCowCxxR45hkvz6HHurkX5XlyxZrnap4/ jp7P3VfVTr/1qF99xrDEPOvK5VqcGLhqTAy2+0+ntvaTfcmrTV7m9uC8xlfrrFExq9jKX/P31nuf /V7+HfG9z/+OGndzvP1LGS7SrQv7bkE6PuqvbpYO3/m4OPiTKPJoO2z6wImlj3rDsO4wYBmJzzkx 8lJb+uOLBX8dapB++NiXtTKWPeO3ttacXDN3LRdr+7FfY2m3vgCSQ5z15U6ubl77AuMeu1jHccX3 TG77SQ1Wc7FjR4FRYBQYBUaBUWAUGAUeV+AVZ7yjXXqer+fko/kVxzPF3mD/WZezufVXuZ5TPceL 28sTh4WDH+rDg62fRcX4v+ROHrnca3JkP/jtmxzxYIxlbtZwn1s4Y+ZlrRWv2LQrLRJzZG7PqcGR vLsxfsZ38z6L7+1fynAxrV4UPEuUymt9L7Ia31tzUZILD5afozcJufnFUGt544nzS8MbIXuuFycY 84jRH18U5mYtYnWQk/zkuXav9MPwC0gO+dSifqGIw59a2Zv7FlfX8K6w5Fjf/JWV130lzj2mzzl5 2bf+d7RHtXjH3qenUWAUGAVGgVFgFBgFvqMC3dnyq/ZhL9pH+/D8f4THZxfOo5679/Lq2bU7c6+4 8vlgVdP+0QMMzzFZw2eeVR9Zuz5bkSMXOLgSn3u318RnnDk9GmedOZWXdWLBO8jj5+w1kJzWllML 5yom5k672iM1iFVd7qx9levtX8q8g2j0cPYCzQ/EXGxeuIlZzc31AtJWvLx+aZgnjryaSw4/DGOr LydwlVNub+CMO8faG3jrGbeuXNWK159c+DKeXHs3fubJvbL0usdXc+nluww/C/pVl+/U/3fRefoc BUaBUWAUGAVGgVEABep59rupsncu9jy52pdnT3h8aWFOnudrvudTsTV+dE0+telDTnKd4wfD2mer 5LZ/bcaYpz45Jwav/cMPBxh9YBz2YI79GcfWXHnMTWyXbxz8aj9iOls55ch957zjuNNHP2pQe6OO sTtr3sH19i9lUsyvFNGLyQvtqvju5+hexFOPHrovBnuBU7yWGP5aL+PMicNf92cMHjVgnqPmEEsu a2V/mS9v9pjzFVbejHe+FVfmbc3tr8NsxTp89XXaVcwr151+r6w/tUaBUWAUGAVGgVFgFPjpCrzL ecvzetpXaO+fMOGMXv+FsOf2LY22Yl3/iXfOGZx9U09f5urDpj6e3fExiNtz5jO3BnP5nJsjd8bF YB01rl+eVVzcln0kt/KqS/W/Yu0+tK+oeVeNt38p40a9Ybzw9H9Xy8Vydi/gvdDP5Ha1Mt851os4 fXsa25NfUuBzbr7crHNuLXEZr7Fc5zxz6zxrETuaV3mesVa7Z3Af4ew+pyN5gxkFRoFRYBQYBUaB UWAUuKbAV5//smt70WbsWfM8izOvZ/U76q44re1+V7jswfMy1jzj8rlOK5Yauc/MSb+5R3oSiz2L vys3eWb+mALf5qWMF5sX9WPbvp7NzeWNeZ3lM/ORvahH3tRb/RyplZiz/NT2i+esPtaCo+4nY10c 39lROTO/1s/YT5z7mf3Evc2eRoFRYBQYBUaBUWAUGAXeQ4Gt8/ddHe7V2Itv9XHlzJz1cr5V52zs Cu+VnL2+ruizx3km/ow9nan/KPbbvJRho4jt28SveHi2Phfd2RcPqw/KC6jux1qrvC2/GlVMrWVN /ezJubmuxerfst6URzWyX63cXU364af2usJ2fvnTWtv9ZiznR/kyZ+ajwCgwCowCo8AoMAqMAqPA T1Vg7/x8ZN9wHD1nJ3avdo175j/SExifaxLPc0j66zprZq+r2onPOsxrvr5qU7tVHXIeHdbJnlOL R/mv5GcvV/LfIedbvZTxIkA4xU/fswXNWvXi8wUEGHs72w955metLZ5ay/wjOeZaiz3Vlx3y1N7M JW4+8/xSkg+/Q93UCz//Lal1s3/89e/QIc4PPFmXfvhJHufW1tq7tbTGV/YoLvOzx/Q7txfXY0eB UWAUGAVGgVFgFBgFRoFXKLA6p95xPu3OzfDWmtaqfvafHOLUhbU+c3PtXLy28/t8ImbPgpeH2vn3 4uiXI59HiGXc/WnNSZv5qz7dv3lZQx925U/M3py9OuiNnrT6X2XZT937q2rfXedbvZSpwr/6Q6j1 uQAZ3khYXzCc/aB8AUGeN1+tt+JUB/tY4dIv1j1YixtLvsQzJ/bXX399WF6WOPILwi8lb05vVLGZ lz7qV6w6iLNn1l2P1iRmTxXHuu5ZDP78orGulh7Pjr0ca5/lFe9eXI8dBUaBUWAUGAVGgVFgFPjZ CnjOfXSX3Tn10bOpPXXcnluJUQebPnLNI+5zhThjWjDy4Mu5fXQWXA57SF9qLHfGeabx2UWsfYmr a/zWMmbPWnO11gCfueaDY173ZD5Wbm3Gzs7tgTx783M6y/UI3j3Tg/va0uCRWq/I/VYvZRQ6P4S8 MJ4tWK3PBWgv3JistWf6yguaPDmtt7cvL0Zt5slVOcAyvInMsX7Fw0Ps169fH/Y///nP3ze/ueT4 BeWesNTIkXj9cJNLndWABxxDTtdw0hMvjewVXOVj7d7J4cc1tusNnmcNa1/lfzT/at3JGwVGgVFg FBgFRoFRYBT43gp0595nnoc9t3r+xvosUpX0PK/t+qrPA/msUPlybZ6++ryAP7Xx+Qacfjmw5vNc 4rxyWIt9JIY5ed3+yMlY5tIHuVh7skZaMFkvY0fm1gFLfYZ8xNi/+nwEX/SL2vST+ryo9FPKfKuX MvXC27oAn6FWV98evCi4MLk4zgzxWjmPcog3P/OMpY+5fq17Yx/6MgcfGF+cUMucxHmz4nOefPao Xpm7p5255NiH+fZmTdaMrC02feKMdXsy9gybvTyDfzhHgVFgFBgFRoFRYBQYBUaBqgBn0HoOBvOM s2k9X1tX/6qXeq43z73kswG+uhaXtnsGsU7icm7cPrHqRE/Uxdb+ksO5ea7Jhb/6jRuD27rWMceY OWnF4DMv43vzmpMa2xvPcFlnj/OOOH2p+6tr39F/5fhWL2W+WvC9+lyYeaFWsY+ut26sLY68abZ6 Tf7M8cbKGvAkxjnWufitmmLypqVeHfr2dKy14dnzHelvxWOf6nGUy7yxo8AoMAqMAqPAKDAKjAKj wLso0J2br/QGj+dj8+XWrzVerc8g5tX42TV89VnCZwy4cn6WG3zts64rp3GsWmDlcl7zWIsXK0di t/LNS/wjc7RzP9b9qj8pYx+P7Oddcr/VS5l3Ea320d0cFXN27UXmxX4lf5W758/azrv6lSexNWb+ ym9c65dl/UI1fsVmfzX/aF9yaCvP2fXRumd5Bz8KjAKjwCgwCowCo8AoMAp0Ctx1jpW78uX5ljnx 9FU8PJ1P/rPW5wefJ87mJ/7RvjJfDbRZxzn4jGc+mIyZs2Vr/hb2aKz2cIfOR2v/VNy8lLnhk80L 04vSL4Mb6P9FUW/UfwXLwpsw+yuQzeWZWpXo0dryqSfrZ2kKt/0yz3FVu+TYmq/qbuVMbBQYBUaB UWAUGAVGgVFgFHh3BfKcm/Nn9Z3PDVs1eKY4gn205yv5PHtcyev2excP3Ef06noY3zEF5qXMMZ1O oe58ecDNlC8Gcn60qeTwRtfucXgzH6nbcZpvnfzjbfULsa7N0XZfBndqbZ20tf+MXZkf0fEKrzny 3923/GNHgVFgFBgFRoFRYBQYBX6mAs84P3bPB2fU28rvng2S22cLrbGtvKoBa/KrX67O7mHrnuq6 4+x8W3l7PXR86dviTtzM71FgXsrco+O/WPJGv+OlATdV3hjOsUeHHPRGnj0e5TA/rbXl6GJisOD8 O2XAMtfvWi789Qv0A1x+sY/E5bxAf1ve8dn8RrrjYJ93jtQLbvnxO7+z3nCNAqPAKDAKjAKjwCgw CryXAmfPfWfxj+yW8/6Z83lX62q+zx1azsaenZ2nXdXOM/UevuOoPjjkpB+fz8DprzndWqxWjHt0 fcXK6TPjFY5n5tjfM2u8kvvbv5SpNykf0B0X4qMfwt0P/O7LvWHPXoy+wGBv5MuVPNbp9k++/9ej zAdrXn6pVA7ri804vHWAPzIS5/yo/mqwqpParDBf6U8t617q+iv7nNqjwCgwCowCo8AoMAqMAvco UM+nvvg4yl7zj+adxXEW9YyvPcJhfz47+FKF3Dz7rrjEeBamNly1B33wr4a9GOcZA1991sAnlrrO zatWHnskvpdTOVzLJcdVHvm09Aa3z1f638Ee0fgd+jzaw7d/KZM3KZv2pjsqwLNw9lVv2Efq+YUh Z97Ee7zcnOC5qfIiZp48eVNXTmL/+c9/Pm5Ob3ZzsXDv5Vs/b25y4WXIV+cfwRO/1GovJet1WLXu Yu/iO7rXd+l3+hgFRoFRYBQYBUaBUWAUeEyBPKPy/OPZ/DHWe7PrGdXnkTO95rMH5/a9szs7qM+D cJBHP7U2PrUEU+NVEZ9htBm3ty0OYuDMZy1+6zkq6+ScXPcAp3tJzNW5ermvqzzPyFOzZ3B/Bee3 fylTLxIunur7CmHrm9g7euAmu7o38rh4vdlXNyw386oG+X7pi9ESY76VnzGw/HhDdf3IeUU7+9rK 7Wpu4d81lvtITd+13+lrFBgFRoFRYBQYBUaBUeC6AvW853n6OuNzMj2j8gzA8GXJkXO6HV3JyedB tKGP1XNFxo7oaO9a+zySC9Y8bfZ3lMOa8vl8pt4Zf2Qun5/fI1x35qIT+l3R684+7uT69i9l8sPg w/ECv1OkK1zdxeuFfZYPLnN9EyrHmf2ChSutPFj8lY91apxzctynnPQJpvLIn7HkyjlYR+fvuMV1 Mbmqtffqf+baz/FZNdThWfzDOwqMAqPAKDAKjAKjwCjwtQrU54G7unnG2ZizKedz7BX+fMGyt888 B+ecuvZQOcSJqXHWYrpY9YHdex6pfHVdOVfrq3krvvRf+awy/9nzZ+792b13/N/+pUxuig9n7yZI /KvnXNxnH8prztn8ukf10Wa802/rC4rc5GHuDaLNeMVn7TNzuZOv1jnD90rs2S+4Rz/vV+5tao0C o8AoMAqMAqPAKDAKPF+BvfPh2fPmMzv2jK7tnje26pvXYfKZoIvr2+LYwhzllwO7VesKX3Ln/E6u 5GX+TtdP7e2nrn/USxk+JC7QrZvhu32Qe1+6eUPese+q3yOcd/fWfXZZw/gjPcvxLna+FN/lk5g+ RoFRYBQYBUaBUWAUGAUeVeDqOb078z/ayyo/a9Gva+zZ/s2RY1XziP8Ojq067/zc8ey9b+nyitix /73NKzq5oYYflvYGylspeMFSL/Z6Y9f4mQZy3/BW7qNcyXM0p8NlfTj96bBHfPJpVznW6ewqR//e SzBxY0eBUWAUGAVGgVFgFBgFRoFR4F4FuvM7vm7wTEBs79lglVv91k5/1r5SB67kSO53mj/yDPrs fXwH/R7V4Ef9SZm8UfLDS/+jgj2S78WuTS5f2PgXNWXs6Jx9sm+sNerexexxpn4rrNzWXOGq/wg3 OZWfPeHTVt4j663acPPfrX7FcK9fUXtqjgKjwCgwCowCo8AoMAr8OQpsnYePqMC59QrH1bxVT/TA M9ReLzVOH/k8UeOreiv/o/krXvx3c/uMmDXf9V9K37333PO7zX/USxk+uHy4zfm7Ce9LmLwJeCHz yF/cRa4vddi7+88LOudnNJGLHOfqzZq566u8XR7c8vulW+t3eUd92TNfUrXGHk9+fnvYiY8Co8Ao MAqMAqPAKDAKjALfXYF8oXFmL5y77x6e38/y+nxxNg+8zyKr3Dv2aX8+mzzKKR/Pig6fg/hfhuPv XtiIfbVl3/Tz6L5f3ffVej/qpYw3iBeYXxhehMavinVnnn8iA0tfXHj5UuVKrXypgwZexHfsu7tJ 1ZVe3YM18fk5MO8GOR1vxdo/2HwJ4pdUxZ9Zy22vfh65jy2+I/1v5Vt/CzOxUWAUGAVGgVFgFBgF RoFR4C4Fjp5z76onzzPOvT68w73a18rf9QO287sHbD3/V/69/ORaza3hM2M+A61yOr+62CN8zon5 fOUzUMfxFT77vEPLr+j/bM0f9VLGm8gPD5vzs+I8E+/bSG+wvCH0na3PxWuu+64calT9e2u1rPm5 Zp5j1YOYzNWXlnwxWPbmGhya7dVIvq25PHwu1Hj1sP6r6069UWAUGAVGgVFgFBgFRoFR4IwCntG3 cjzbenZ/1vna5wHrbPWUsW4PRzncW/LdPbfGo88mVXefFdGN8ddff338wQDr3b2Pq3z0w0/t/yrf u+f9P8xVJEziDOeWAAAAAElFTkSuQmCC --00000000000099b41b059067e84c-- From nobody Sun Aug 18 10:54:47 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 15257120121 for ; Sun, 18 Aug 2019 10:54:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.979 X-Spam-Level: X-Spam-Status: No, score=-1.979 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, T_SPF_HELO_PERMERROR=0.01, T_SPF_PERMERROR=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nostrum.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZWFsvR3Mj75X for ; Sun, 18 Aug 2019 10:54:44 -0700 (PDT) Received: from nostrum.com (raven-v6.nostrum.com [IPv6:2001:470:d:1130::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 54EA812002E for ; Sun, 18 Aug 2019 10:54:44 -0700 (PDT) Received: from MacBook-Pro.roach.at (99-152-146-228.lightspeed.dllstx.sbcglobal.net [99.152.146.228]) (authenticated bits=0) by nostrum.com (8.15.2/8.15.2) with ESMTPSA id x7IHsdAl080381 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NO); Sun, 18 Aug 2019 12:54:40 -0500 (CDT) (envelope-from adam@nostrum.com) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=nostrum.com; s=default; t=1566150880; bh=jITNxUCd3ra/Rp9o1QCoD8zBAqZ/7z0UCdUAx7bu6ic=; h=Subject:To:References:From:Date:In-Reply-To; b=d8LQU2YnY3xQ4qHTryBeye1pyicl7ds0Wr7xIL2OtlH/jgC9jQpougYvq4iViHVqn 13hYlhvD/H6PiVIyP8KOpj9Fk6UD4FGto//Roe+HuqmC4C77zrA5rY5l7+v3LsA3BG iYOLm/jX9S3l43h4saw0lxbpSfY0C9ZF8LPvZOOk= X-Authentication-Warning: raven.nostrum.com: Host 99-152-146-228.lightspeed.dllstx.sbcglobal.net [99.152.146.228] claimed to be MacBook-Pro.roach.at To: Rob Sayre , ADD Mailing list References: From: Adam Roach Message-ID: <0fc6ad1b-77f2-fdbe-dab9-b9d65760d92d@nostrum.com> Date: Sun, 18 Aug 2019 12:54:33 -0500 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Content-Language: en-US Archived-At: Subject: Re: [Add] Home routers with their own DNS servers X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 18 Aug 2019 17:54:46 -0000 On 8/18/19 12:24 PM, Rob Sayre wrote: > In other browsers, I found that my resolver was run by Google[1]. I > was a little puzzled at first, since Google is not my ISP. But, then I > remembered that my router is a Google Wifi product. I guess it uses > its own DNS servers sometimes. I'm not sure that's the cause. I have no Google products on the network path between my browser and my ISP, and I'm getting a similar result: "Your DNS Resolver is: 74.125.45.14" https://www.whois.com/whois/74.125.45.14 https://www.maxmind.com/en/geoip-demo?js-geoip-demo__addresses=74.125.45.14 Which, If I understand correctly, means that my laptop sent a query to the recursive resolver provided by my ISP (68.94.156.9), and then whatismyresolver.com's authoritative DNS resolver received that query from Google (74.125.45.14). I'm having a hard time coming up with a reasonable story about what happened between those servers. I wonder if my ISP is somehow outsourcing their DNS resolution to Google nowadays -- it's the only explanation that I can come up with to explain this result. In any case, it's clear that my DNS queries are flowing through Google even when they aren't related to any Google properties. I don't recall providing informed consent for this to happen, and I wonder how much PII is being sent to Google when this happens. /a From nobody Sun Aug 18 11:40:30 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E06B812020A for ; Sun, 18 Aug 2019 11:40:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0M34utapPpTq for ; Sun, 18 Aug 2019 11:40:27 -0700 (PDT) Received: from mail-io1-xd2d.google.com (mail-io1-xd2d.google.com [IPv6:2607:f8b0:4864:20::d2d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DFD05120143 for ; Sun, 18 Aug 2019 11:40:26 -0700 (PDT) Received: by mail-io1-xd2d.google.com with SMTP id t6so16163025ios.7 for ; Sun, 18 Aug 2019 11:40:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=SBLK3HeaX/yXBYo62CVqY8TrfGpTIYvQXjBOq9lzJUk=; b=Z6UWOqY/1dH5LGGl0yLYexEupyf/VuuhhDf73+8w2ouF01ItVom/Yri+ZWaZOEbkD6 SAr/VX+WGJ09dqDu4BFHOZu4hN//XQZEfuufYf4bBjYBKoPrXfPb2X3sG78j0NSx8CMT j1aW+L3COxm2u8+CbCstTDhL+sRzJC0CEWcFAO97dZN6c+FHk2rhKx52fF+uyrDhRsIT yf4zBHFov0aQWGGfsQbZYJuhC8qRYkrll2eL463rerVe+W5wietkKPsRlsho2S/WMfOO LfMsDAsG8qrj+dJj8A/laVP1lZo5i/aZd9twOW+u4k6dWNKqd6NS8omnf2yMdRDCNlhE 3KfA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=SBLK3HeaX/yXBYo62CVqY8TrfGpTIYvQXjBOq9lzJUk=; b=nTJ3Wh30ZhKD65LUjZlvOMvfNzwZfWCmILABcQLlhd1fjEKieVytjwwKrFcPItnrmu K5UgcyZouoojxQ6PQSJWh2GrVBBKHYYaWrT2KgnqaQ52MQ9DPiB2AuGja06Tfn22FW9l wCt+bPp/Ia9HxqGM2mHEVzQTymVP23gAmB6yxOM+gVtGdxhJInAOC83ZD5rhVMpzJcWW JUzD4kYOj7Wv2JUpFu0ZlpPVQKXuLhSOdGlIuoFDVYmVinfldrJ1jw+z0Jbra6oLkhj3 +Rv/fujXmW4mga1izFkasz98loCKdlwgMkw/B2e7jEwO+hq3axsZRs4AbFoEUT4sBM7K 6g2w== X-Gm-Message-State: APjAAAX/KWddE8OZhrTz7YiTtxdzT7s6ddfNwqm6U98btftwYZPypP8l OjJc/mb9QsVgSHYzI5ruShLBsa1hJp0/zXuUCZVzUG+B3Tsv4Q== X-Google-Smtp-Source: APXvYqzMEdpfCcAooivN07KxMEn5ctp6gFWB2z21R6gIcQbm54c7dWZ6cMlTPATqiFjlQ1M1YHHezFlS6uF2s7skzlo= X-Received: by 2002:a02:5a02:: with SMTP id v2mr9282721jaa.124.1566153625993; Sun, 18 Aug 2019 11:40:25 -0700 (PDT) MIME-Version: 1.0 References: <0fc6ad1b-77f2-fdbe-dab9-b9d65760d92d@nostrum.com> In-Reply-To: <0fc6ad1b-77f2-fdbe-dab9-b9d65760d92d@nostrum.com> From: Rob Sayre Date: Sun, 18 Aug 2019 11:40:14 -0700 Message-ID: To: Adam Roach Cc: ADD Mailing list Content-Type: multipart/alternative; boundary="0000000000008a89a70590688ecc" Archived-At: Subject: Re: [Add] Home routers with their own DNS servers X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 18 Aug 2019 18:40:29 -0000 --0000000000008a89a70590688ecc Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Sun, Aug 18, 2019 at 10:54 AM Adam Roach wrote: > On 8/18/19 12:24 PM, Rob Sayre wrote: > > In other browsers, I found that my resolver was run by Google[1]. I > > was a little puzzled at first, since Google is not my ISP. But, then I > > remembered that my router is a Google Wifi product. I guess it uses > > its own DNS servers sometimes. > > > I'm not sure that's the cause. > In my case, it is (see my other reply). There are a lot of ISPs that send their DNS traffic to Google, though. That's why Google DNS gets 15% of queries--it's not like 15% of the internet manually set their resolver to 8.8.8.8. This is covered by this report from APNIC: "DNSSEC validation in Africa Let=E2=80=99s first look in a bit more detail into Africa. DNSSEC validatio= n use peaked at 22% of users in mid-2016 and declined to 12% by early 2018 and has shifted back to 18% in early 2019. ISP=E2=80=99s in this region have be= en relatively enthusiastic users of Google=E2=80=99s Public DNS services. Over= the past five years, the use of Google=E2=80=99s Public DNS services has been b= etween 20% to 35% of the entire African user population." If you read more of the report, it sure seems like there are some negotiations going on around this arrangement. Which is fine. I think your point was to highlight the value of DoH in conjunction with TRR, and I think that effort is good. thanks, Rob --0000000000008a89a70590688ecc Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Sun, Aug 18, 2019 at 10:54 AM Adam= Roach <adam@nostrum.com> wro= te:
On 8/18/19 1= 2:24 PM, Rob Sayre wrote:
> In other browsers, I found that my resolver was run by Google[1]. I > was a little puzzled at first, since Google is not my ISP. But, then I=
> remembered that my router is a Google Wifi product. I guess it uses > its own DNS servers sometimes.


I'm not sure that's the cause.

= In my case, it is (see my other reply).

There are = a lot of ISPs that send their DNS traffic to Google, though. That's why= Google DNS gets 15% of queries--it's not like 15% of the internet manu= ally set their resolver to 8.8.8.8.

This is covere= d by this report from APNIC:

"= ;DNSSEC validation in Africa

Let= =E2=80=99s first look in a bit more detail into Africa. DNSSEC validation u= se peaked at 22% of users in mid-2016 and declined to 12% by early 2018 and= has shifted back to 18% in early 2019. ISP=E2=80=99s in this region have b= een relatively enthusiastic users of Google=E2=80=99s Public DNS services. = Over the past five years, the use of Google=E2=80=99s Public DNS services h= as been between 20% to 35% of the entire African user population."

If you re= ad more of the report, it sure seems like there are some negotiations going= on around this arrangement. Which is fine.

I think your point was to highlight t= he value of DoH in conjunction with TRR, and I think that effort is good.

thanks,=
Rob
--0000000000008a89a70590688ecc-- From nobody Sun Aug 18 21:49:08 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 777B4120233 for ; Sun, 18 Aug 2019 21:49:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=swm.pp.se Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ertx_ONqGJO2 for ; Sun, 18 Aug 2019 21:49:04 -0700 (PDT) Received: from uplift.swm.pp.se (ipv6.swm.pp.se [IPv6:2a00:801::f]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A18F112009C for ; Sun, 18 Aug 2019 21:49:04 -0700 (PDT) Received: by uplift.swm.pp.se (Postfix, from userid 501) id 3160DB7; Mon, 19 Aug 2019 06:49:01 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=swm.pp.se; s=mail; t=1566190141; bh=x0C6YukoVazAkd2SpRGMAcliYearnnBkFUaH//Q7g9o=; h=Date:From:To:cc:Subject:In-Reply-To:References:From; b=iC71tVwttZwaedXdW1BRzwFOKipAP8P6FH8hhXATszbX0/9gE6YdDDsfG3epAAQ3O IBjFepLtTzv8qsguS7LMf/AkumeA3QG9qYWrp/HhBFh9S8AdAorTC56wLirDGMCuE4 wZ1dElHAfJzURKguYOiHKatVJY2UjlDT/GXwPc98= Received: from localhost (localhost [127.0.0.1]) by uplift.swm.pp.se (Postfix) with ESMTP id 2F4E7B5; Mon, 19 Aug 2019 06:49:01 +0200 (CEST) Date: Mon, 19 Aug 2019 06:49:01 +0200 (CEST) From: Mikael Abrahamsson To: Adam Roach cc: Rob Sayre , ADD Mailing list In-Reply-To: <0fc6ad1b-77f2-fdbe-dab9-b9d65760d92d@nostrum.com> Message-ID: References: <0fc6ad1b-77f2-fdbe-dab9-b9d65760d92d@nostrum.com> User-Agent: Alpine 2.20 (DEB 67 2015-01-07) Organization: People's Front Against WWW MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII; format=flowed Archived-At: Subject: Re: [Add] Home routers with their own DNS servers X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 19 Aug 2019 04:49:06 -0000 On Sun, 18 Aug 2019, Adam Roach wrote: > Google even when they aren't related to any Google properties. I don't > recall providing informed consent for this to happen, and I wonder how > much PII is being sent to Google when this happens. When I run this test on my home connection I get the IP of my ISP resolver. My ISP is not doing any trickery, and I definitely do not wany my queries to go to any TRR or to Google without my active permission that this will happen. I'm sorry your experience with ISPs are so flawed, but this is not the case across the entire world. -- Mikael Abrahamsson email: swmike@swm.pp.se From nobody Sun Aug 18 23:20:06 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 356C112024E for ; Sun, 18 Aug 2019 23:20:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=swm.pp.se Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yicdK2yFj7FN for ; Sun, 18 Aug 2019 23:20:03 -0700 (PDT) Received: from uplift.swm.pp.se (swm.pp.se [212.247.200.143]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EE81C12006D for ; Sun, 18 Aug 2019 23:20:02 -0700 (PDT) Received: by uplift.swm.pp.se (Postfix, from userid 501) id DD55AB7; Mon, 19 Aug 2019 08:19:58 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=swm.pp.se; s=mail; t=1566195598; bh=ywcY+zeCQIHCQoWdnz5q+/ECVeLXfwhWERdqTTndx6Q=; h=Date:From:To:cc:Subject:In-Reply-To:References:From; b=j8tNk2tA0I0PejJASMhk5CaW7hf0rpk8HsGqNspo6su/M2+7p3wgsMf2SEFfPLFY+ YTBMtFnoEoGdPYPknuuGy+ipOFihLxy5d5YmyfAUW54I9iUcMRHtupLCNus2ZBlfHy ZaYG/1hnStZ+CoD+y4TfnJqRxtuaTASB9yaA2dn8= Received: from localhost (localhost [127.0.0.1]) by uplift.swm.pp.se (Postfix) with ESMTP id DAA73B5; Mon, 19 Aug 2019 08:19:58 +0200 (CEST) Date: Mon, 19 Aug 2019 08:19:58 +0200 (CEST) From: Mikael Abrahamsson To: Rob Sayre cc: Brian Dickson , Melinda Shore , Paul Ebersman , ADD Mailing list , Joe Abley In-Reply-To: Message-ID: References: <09178E42-08B2-4958-A1C8-AF507AEE8834@fugue.com> <0BDD4F7F-7301-476A-80DA-0CC84EE4557D@fugue.com> <6698db4f-89ff-e5be-09a5-eb544f76ebc9@nostrum.com> <20190817170031.6F71C1691138@fafnir.remote.dragon.net> User-Agent: Alpine 2.20 (DEB 67 2015-01-07) Organization: People's Front Against WWW MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII; format=flowed Archived-At: Subject: Re: [Add] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 19 Aug 2019 06:20:05 -0000 On Sat, 17 Aug 2019, Rob Sayre wrote: > On Sat, Aug 17, 2019 at 1:58 PM Brian Dickson > wrote: > >> >> Consider how these attacks would be mitigated if the host performed DNSSEC >> validation and the domain was DNSSEC signed >> > > DNSSEC adoption is directly correlated with use of Google's centralized DNS > service. > > Sometimes, sometimes not. https://stats.labs.apnic.net/dnssec/SE Sweden has had robust DNSSEC validation amongst ISPs for over 10 years now. -- Mikael Abrahamsson email: swmike@swm.pp.se From nobody Mon Aug 19 01:37:21 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 646F11200C5 for ; Mon, 19 Aug 2019 01:37:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=portfast.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cRIosARvStGt for ; Mon, 19 Aug 2019 01:37:17 -0700 (PDT) Received: from mail.portfast.net (mail.portfast.net [IPv6:2a03:9800:20:1::2]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9FD051200C4 for ; Mon, 19 Aug 2019 01:37:17 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=portfast.net; s=dkim; h=Content-Transfer-Encoding:Content-Type:In-Reply-To: MIME-Version:Date:Message-ID:From:References:To:Subject:Sender:Reply-To:Cc: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=f0qQWTMbQrHC5K8lzFFaOAgxzu6uF1NchxTD9KQL20E=; b=a5waKA8SHEJm8fy0z+mWcrOFwx CjAQr2azcYD7Yqaa49kjIHK4fHAUcA/hWvQ9NNDqUOEx4rftOvjJOoye/tQGuw0BqJVZrosi0+yOs nOoXLro4+isqf3E5PwU4PlPMOeszdPcouna8D8nVH+kVm6GzVTVt42OM5sVAwVfBYnh4=; Received: from [88.212.170.135] (port=51627 helo=Rays-MacBook-Pro.local) by mail.portfast.net ([188.246.200.9]:465) with esmtpsa (fixed_plain:ray@bellis.me.uk) (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) id 1hzdAA-0000ZG-Ok (Exim 4.89) for add@ietf.org (return-path ); Mon, 19 Aug 2019 08:37:14 +0000 To: add@ietf.org References: <20190817170031.6F71C1691138@fafnir.remote.dragon.net> <5ED23002-7608-4A76-8181-E344E3FC6469@fugue.com> From: Ray Bellis Message-ID: Date: Mon, 19 Aug 2019 09:37:14 +0100 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: <5ED23002-7608-4A76-8181-E344E3FC6469@fugue.com> Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-GB Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [Add] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 19 Aug 2019 08:37:19 -0000 On 17/08/2019 18:24, Ted Lemon wrote: > Just a reminder: DoH resolvers can (and do) do DNS filtering. Ones that conform to Mozilla's TRR policy can't do it in a way that's completely consistent with the legal requirements for blocking. Specifically, their policy requires that the TRR operator publish the list of any domains that are blocked. For some types of block (e.g. domains with child abuse imagery) publishing such a list is very problematic. The policy as currently written also doesn't appear to be compatible with the feature of RPZ whereby the individual domains blocked can change dynamically based on the target name or IP address of the domain's NS records. This is essential for blocking DGA style botnets, where often the C&C hosts have been identified but the specific domains are not known apriori. Ray From nobody Mon Aug 19 02:46:31 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 24F23120045 for ; Mon, 19 Aug 2019 02:46:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DO4ePGZm1tlV for ; Mon, 19 Aug 2019 02:46:28 -0700 (PDT) Received: from smarthost1.greenhost.nl (smarthost1.greenhost.nl [195.190.28.88]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3549512001B for ; Mon, 19 Aug 2019 02:46:27 -0700 (PDT) Received: from smtp.greenhost.nl ([213.108.110.112]) by smarthost1.greenhost.nl with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.89) (envelope-from ) id 1hzeF7-00055I-Qc for add@ietf.org; Mon, 19 Aug 2019 11:46:25 +0200 To: add@ietf.org References: <0fc6ad1b-77f2-fdbe-dab9-b9d65760d92d@nostrum.com> From: Amelia Andersdotter Openpgp: preference=signencrypt Autocrypt: addr=amelia@article19.org; prefer-encrypt=mutual; keydata= mQINBFjWlnsBEAC+jUN+LJE+mmxEL8lHSrvg47xSBMb9GdtH1Jr8tRSxXiO6R5E+FydsfqkL sjO0dI3x/VnNBi/kgPFFWiAzDEwGTiR/C9b/Muo+xrY+it6e49N56LTPGezrY2dy5yo6VcLl 7UwGz3fIWiNIj7dvuoPMBoO1uacF073E+dqDM5CmNh6o+OrHW8zhUlC9hKgXCq+8XpZJw90H un1zsHF0sRDiurjfYaCcbdAGK9+th9378ed1ZvLVo5uBVQXdydl3eJkNCOELq7VOS7oxSliA uX5/nj9A4LjeeYXgNbwGfKrMjlffP0FcAcgfzg9seqDd1DEk9EVaUMTr32fbWOQHjinXSC7r Lw4xaNfoBebIe1M6z16Xg7+bXXCTdmJYcL9ugmkvT6tGnR12Pfoca1oBwXPvA0VIRi86kCSU D9qvZ3Vl07MKD2hsvFkGZJOQfEaYv5QLpCWv6RCjfDNC05IyMeSW4H18Fr/BoHX8FXHV3+9H LsbJQ/Zrofd/Cm+TKEmXLAtYc7iXvzV+mw3/u0VYqjEy/CRYa62Ah0NNNVIuswfRVIfx3UZo jX4y8j2Kh0jtUV5A4GGf8H3SzQ/cB0I7wTRHU9mCPVCtH6M26nPumL4Zr4D6uGnAmPf9xnlX lokOn2Qxf/mBldsL41PDbEpYhZvvn5kJ/Z9Qh7Fks/hfTbbJowARAQABtEFBbWVsaWEgQW5k ZXJzZG90dGVyIChUZWNobmljYWwgY29uc3VsdGFudCkgPGFtZWxpYUBhcnRpY2xlMTkub3Jn PokCVAQTAQgAPhYhBD1dtsq4UrmIBVpqb/7xwpS06AtVBQJZbJ97AhsjBQkJZgGABQsJCAcC BhUICQoLAgQWAgMBAh4BAheAAAoJEP7xwpS06AtVgrcQAJYg+mhDhui+9xNb9PuRJbelOI7J WlCjSycfaMi+rTJ9FjVKYIE9aug2VV486BZaeqMoOh5wjl61oeRTDHYG6HvhK4w8O/BVPsL0 8MEfYfpFevZmBsInEJypg0r7VJ/SeO9UyaFKUffgvLyiYwk7zJIgx5dHF5Vch0kTtRNc/Wbe 9MGfhl//1Ztl8GjGqzra7MwzaO12ctTDo7LIvXGqrpYm5g7+hRv3+KYVOJvlh4T4deAzNlX1 F/jj4cOYvJJxP2OMPZxoleQZSf63h0hWnKlQWX3UiUZY/M296V6niGDCQHX1q7oz9YWxwUun mNPltaPnTdvE51N98Q+hhrw39XowN0vYhfphaFNrf/crNKTB5Iqx62aAzYwqXQKlh6EtWAri 2rVB9vXxPv+1eL9t/Kga2JyCjmJVtYJxlZWceyW3EKjK+E7qjr1LHDFjV8ZbvN7QRTdjsuzR Ggz3ECba80Ij2/tASE8IXpT/Zb68NeSx3/nDXkIG13inSvGy8yNovzEADXsGO16GSx5Rool/ ECFhTYksMyM73FkvcpvXo6J+neyGEVKDx1Oy213KgTrAOrA+p2hMI2nX9sI5tvWms8XspwQ5 wtmzDribnZNQzpdrb45Chv56LjrKVer9tmraRq8Qe3mL6jXhMPWLim1OeAx6m3qBzKr3QxuG PdADCLHsuQINBFjWlnsBEADFjusaTo9W8VeWluCK/oJqyyyF1wMvou0ldfuoOpUZrOqsY67T M7yBqsv5COPVgAV+xp+axor5oHWxibd283w0Ok4dK6tvtNGwUqyDRlHtQ92DG/u4Tg5eOwrH NUn73/rfeBD9KhKAXcNKKPoccLgR8oQTXpO7eRo+0NI52pXQ6LdZ0wddYeTcHglsNKN1TK+C yYS7xfGolsZXXoBOKcyhfj/ckPFVIHWpGpEtcYWTZWvXgLprzHvpKzkzNyBwejaXE+bqCT2d Rl3omI/e2t3Vq33hFUUSAdxrFF29vMX/YsSnYqsFOIoayna+TRsDFAfZvbvHBOMckeJzvA8y Bdadw7CM08Uw8wqH7n9BA3oq//QpZJekPfrc2E9nM9H0d51T0uStLMbYDWdwxvfPA3p9z8L9 1vobt8bM/Jbhl9h+X2Yq9oBCiTI7b2izYd9FVG4BwBIdeh3bh9R9HExgRjF3XQ6uafT3pcVO PASdv9FRUYH1Va7QWQifoha0B7UXKx1OpX1Z6XR2NQ9KN2MvlwvBKdHtm6tBzUIFzW6D8vUO xiYKBA4fppJt/LJF4jsaCEyI/CVQnkC0yL5DKFOdigxTipwEL9Uc6r7VfR5OAGFd6vzuJFy+ j+/WhzaVT1oVYp6eQXh0bBtqqH2Mq9sAMnIjvaNYIKiQKgMa1Pa3OWQbQQARAQABiQI8BBgB CAAmFiEEPV22yrhSuYgFWmpv/vHClLToC1UFAljWlnsCGwwFCQlmAYAACgkQ/vHClLToC1Xn Rw//W4lzE8FddceKXGRwO/T1u4uzH9EjPCj+3/eHCrLI+h1m7QPyH1DrFAtZBoA6UoaF0+vI AJXM9/HI1FZ09EUdJr5X/+YREErFom4DbE1FK8fpK1/Hw2zI+7Xa8bVkmYrKhMGhi1Gq6Dtk sn/H4USdJL53ZPt10SVNK7H3w93Yp1GC4+0zWjfrsKfsHYZZr2SZyb5/gZlngfgaqiQLhIcP YmiU1GQi9QWkGxWRxk0YQXBwhekewvgltATxlRSCwguAi4uck9fAct9GGdpsshSOgAb9YIAn EV3EqaGnf0PknXp3vNHAZWrfM+RyuNdm2L5TjDU0rIrvyqGP3pR33cREGOAil5Sz2uFArmws Pt8VffbEXlf7qZqRBKaYeKt0qnxKMx1+e1JilVsfb8qtnAWAFDyR0HMlVj/dvGAmq/auPSOA UWRSnDRyT6rv/vXxrbkL4uxWax46qdpDhR15mS5MTng6b5b3Uox7xlveo/Sx71AdNf4goPvB /ntv0DiMuh+fmLGk3zrxs4Xd30Sx+qQwVaXR5xc5rgnF81wvfmuAOb2eP9mpD6DoabkpxC8f Lk17AK7Q1ZTgcZ+8XLRFnavdPrwCa9RU0BF53lJMSTPzyBcMwZ4sqA6Z5IRFVt7rEbSeeD8R Eiawo+FvVt9j0fKdNEBeaJ3WY5hlhNPcUXr4q1U= Organization: ARTICLE19 Message-ID: Date: Mon, 19 Aug 2019 11:46:24 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Content-Language: en-US-large X-Virus-Scanned: by clamav at smarthost1.samage.net X-Scan-Signature: 0ccaee305be983877c9e38c09cbf8ec4 Archived-At: Subject: Re: [Add] Home routers with their own DNS servers X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 19 Aug 2019 09:46:30 -0000 On 2019-08-19 06:49, Mikael Abrahamsson wrote: > On Sun, 18 Aug 2019, Adam Roach wrote: > >> Google even when they aren't related to any Google properties. I >> don't recall providing informed consent for this to happen, and I >> wonder how much PII is being sent to Google when this happens. > > When I run this test on my home connection I get the IP of my ISP > resolver. My ISP is not doing any trickery, and I definitely do not > wany my queries to go to any TRR or to Google without my active > permission that this will happen. > > I'm sorry your experience with ISPs are so flawed, but this is not the > case across the entire world. > If I try to replicate exactly what Adam Roach appears to have done at the ETSI WIFI PUBLIC network at ETSI HQ in France, I also get a Google resolver though: https://www.whois.com/whois/172.253.14.5 Curious. best regards, --=20 Amelia Andersdotter Technical Consultant, Digital Programme Chair, RCM TIG, IEEE 802.11 ARTICLE19 www.article19.org PGP: 3D5D B6CA B852 B988 055A 6A6F FEF1 C294 B4E8 0B55 From nobody Mon Aug 19 05:52:27 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E2D96120020 for ; Mon, 19 Aug 2019 05:52:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id n7YJcG9ltwFN for ; Mon, 19 Aug 2019 05:52:24 -0700 (PDT) Received: from mail-pg1-x52b.google.com (mail-pg1-x52b.google.com [IPv6:2607:f8b0:4864:20::52b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2EEB0120019 for ; Mon, 19 Aug 2019 05:52:24 -0700 (PDT) Received: by mail-pg1-x52b.google.com with SMTP id i18so1167746pgl.11 for ; Mon, 19 Aug 2019 05:52:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:mime-version:subject:date:references:to:in-reply-to:message-id; bh=OAQvR5OBkq+1YqnQk8gavyIv4T+ykncKfgc8xdmo/tU=; b=Cbl/UMgoXbMdvCJcC7YB5NxpgbB7h1ZjgsI4Ulv/ulhhLVIMWccRF7SONJ6H/8wsC1 N6HAUQEsH1N5yHCHI9meAi6LRflzT/FAWY93107FBD8HABZUgtbJyRGYeHby4wIRO+yl MO2BnFzV6IpVmZmiRTdOXBJpPleqaAWH2yCMwgRrNEHD/pmtiTyKu85+yRFjjKzQglNP +2XV9OYETlgm7Fj5XEVdfqRpErQLHbdfxY6LnqoAKoQJCnO0k+1cYLo57/opKZcJtU7U UM3Zj776pGazKf1KHnrh8krQyV7F2bIEvBblQCp7ETh4mNG6URv7EbNUDEB7/5nYXOkd go2Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:mime-version:subject:date:references:to :in-reply-to:message-id; bh=OAQvR5OBkq+1YqnQk8gavyIv4T+ykncKfgc8xdmo/tU=; b=RnulzAiWEeqP+nvmYpCcqcFbUjC+jGAy3rDw78Qe3uxiwlf5ROARyuRgiKUKxv/EvE sdjWypG41u1HaSZOVBk+QOXTnpHAKMz2ICxGvVNgUvp9mkfDwth+Wvec0Mtos6em39EB AVq8y1/87iQhRzTh6qSIAJVpIHmIFinHu2qt7rwPtsjEz3oF5x5n5ny19WJqGwmaBNGG LZ5+K084M6t+v8nwKr+giaJr66S6Lg8f/BUgO8SJSzFCPstMnWMGrAUhoZwflqhdfJHP XdXJ7jB3czUsQQFOmQVI2WolBXUIsBRJphKbPBNKYK5wG6ZeadsgOjPODoKxsK3pKF8c 8W3Q== X-Gm-Message-State: APjAAAUQ5p4FiHgGAdWxzH06MFfiwS5JtENVPcekB+5yetBkptwd4tCk 32XtVaNDoTZJIXkrBtlgUNk= X-Google-Smtp-Source: APXvYqxi8JnelM1H0DQWoAKAuedMkItqlbJ9YJjrmLio996Ng1H6PvHfD+eYaOLpbaHtvPtPa+36+Q== X-Received: by 2002:a17:90a:246f:: with SMTP id h102mr20338144pje.125.1566219143672; Mon, 19 Aug 2019 05:52:23 -0700 (PDT) Received: from [10.128.64.149] ([136.60.227.81]) by smtp.gmail.com with ESMTPSA id c22sm7502483pfi.82.2019.08.19.05.52.22 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 19 Aug 2019 05:52:22 -0700 (PDT) From: Bret Jordan Content-Type: multipart/alternative; boundary="Apple-Mail=_034D216C-B806-4AA7-845B-724DB8ADD01A" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Mon, 19 Aug 2019 06:52:19 -0600 References: <52AC14D8-E2DC-480A-B306-36E7C5987259@lastpresslabel.com> To: Rob Sayre , ADD Mailing list In-Reply-To: Message-Id: <4F877325-71A4-40DE-BDD4-C2969E43B26E@gmail.com> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] Telecom Ad Networks X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 19 Aug 2019 12:52:26 -0000 --Apple-Mail=_034D216C-B806-4AA7-845B-724DB8ADD01A Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 What harms the IETF is when standards are written without fully = understanding the use cases and documenting all of the ramifications = that will come from implementing those standards. We need to encourage more people with different views to join and attend = the IETF to keep us from having myopic views. We also need to not = marginalize them by saying =E2=80=9CITU People=E2=80=9D. It is not us = and them, not ITU people, IEEE people, W3C people, OASIS people, etc.=20 While some here may only work in the IETF, some work across many SDOs. Thanks, Bret PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 "Without cryptography vihv vivc ce xhrnrw, however, the only thing that = can not be unscrambled is an egg." >=20 >=20 > That's true, and the IETF does produce a large amount of useless = documents. This isn't a bad thing--it's good that ideas get documented = and tried. But if someone points out that a proposed work area might = solely produce useless documents, the IETF should consider that it may = harm the reputation of the IETF itself. >=20 > thanks, > Rob --Apple-Mail=_034D216C-B806-4AA7-845B-724DB8ADD01A Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 What = harms the IETF is when standards are written without fully understanding = the use cases and documenting all of the ramifications that will come = from implementing those standards.

We need to encourage more people with = different views to join and attend the IETF to keep us from having = myopic views. We also need to not marginalize them by saying =E2=80=9CITU = People=E2=80=9D.  It is not us and them, not ITU people, IEEE = people, W3C people, OASIS people, etc. 

While some here may only work in the = IETF, some work across many SDOs.


Thanks,
Bret
PGP = Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 = 0050
"Without = cryptography vihv vivc ce xhrnrw, however, the only thing that can not = be unscrambled is an = egg."



That's true, and the = IETF does produce a large amount of useless documents. This isn't a bad = thing--it's good that ideas get documented and tried. But if someone = points out that a proposed work area might solely produce useless = documents, the IETF should consider that it may harm the reputation of = the IETF itself.

thanks,
Rob

= --Apple-Mail=_034D216C-B806-4AA7-845B-724DB8ADD01A-- From nobody Mon Aug 19 06:11:50 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A02D4120058 for ; Mon, 19 Aug 2019 06:11:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.998 X-Spam-Level: X-Spam-Status: No, score=-0.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, FREEMAIL_REPLY=1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HydQDj9oH_z8 for ; Mon, 19 Aug 2019 06:11:46 -0700 (PDT) Received: from mail-pg1-x536.google.com (mail-pg1-x536.google.com [IPv6:2607:f8b0:4864:20::536]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8D4B4120044 for ; Mon, 19 Aug 2019 06:11:46 -0700 (PDT) Received: by mail-pg1-x536.google.com with SMTP id x15so1204456pgg.8 for ; Mon, 19 Aug 2019 06:11:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:mime-version:subject:date:references:to:in-reply-to:message-id; bh=94Q4z1tVwwV5hd4z1k3mmF43fzL4DLDN2++nBhYZigw=; b=t5/xDU88IpkrRbodjrwgi0Naf3bXo24VWsyaEdDtQ4sdi+qc02eZA0Q4Epo1mgHc/N O88lbxVecoft8NdiL7FIT/dRFwwCjMJC9pCuOmBvAKsT1LoXzz8T1Qe1Motj13ui7clE 1VpzQrrDfe+tAy4VWxvyadyecjtLJeXdwunSWBTEr+KyRfRvsyHOjCydJjFg1IJ8k1O9 cDT73PV0G7+aH2JYzbqwCZcuAg+G3Br4+qYTo08lqU7om0NHybP7jqas4jpofavS0wpi NAHKMsUWkTrjZ7/qvBdfQ0Rq8UKW6LcPKhDE546DZNKynW6W67Xfv/dtyrzeFut8o9tu tHbQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:mime-version:subject:date:references:to :in-reply-to:message-id; bh=94Q4z1tVwwV5hd4z1k3mmF43fzL4DLDN2++nBhYZigw=; b=mvLRazR00+2tzDEGJh/1G0VWFZvDYL9VjC4pErmm2a9Z/TRvsYnMawuSgI5ADGnX+Q IPT5D4i/+V2jKk+P7aRo/c9MFmiBV86oPynLGshtJ57jv+H+qzn4UiNVv/GIzvVGNeru fgrOuqVMJW6IWfPxSi1bHG4CDo9tSRRy5q0ADIWfIpRflrC/7ESOyXvJXQBbKrhqAypc PwnF7BAj34t8WXNqVmx4cM2D6rwUqw9I5qCapjfAOpmKc5JUXAspVwqAPWaNAV1IwDz0 wTRIX6XNdIwtyFTpheYSVATkGhc6Z7Ge7egyNWuCqKSgO/sIYqyZZYqOWr6inysihL3u 9VkA== X-Gm-Message-State: APjAAAWk7+ADF9WGTbxG1A05l2pQy1JDBZYVEe1xilc9t9OpJLVMLKKq IiKDNSWfQJNLAbQuxZYZTPQ= X-Google-Smtp-Source: APXvYqyDM0sEs07CMWk6xwfNzhQNl+HXYMAGHLpkLoFe2y2lcCRoKG+FXkb/p1CUFge6kUV5XeE2aA== X-Received: by 2002:a65:4507:: with SMTP id n7mr19085866pgq.86.1566220305998; Mon, 19 Aug 2019 06:11:45 -0700 (PDT) Received: from [10.128.64.149] ([136.60.227.81]) by smtp.gmail.com with ESMTPSA id g2sm28770321pfq.88.2019.08.19.06.11.44 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 19 Aug 2019 06:11:45 -0700 (PDT) From: Bret Jordan Content-Type: multipart/alternative; boundary="Apple-Mail=_09166579-2C28-4A6B-BAEF-936D3F3A1A3A" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Mon, 19 Aug 2019 07:11:41 -0600 References: <52AC14D8-E2DC-480A-B306-36E7C5987259@lastpresslabel.com> To: Eric Rescorla , ADD Mailing list In-Reply-To: Message-Id: X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] Telecom Ad Networks X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 19 Aug 2019 13:11:49 -0000 --Apple-Mail=_09166579-2C28-4A6B-BAEF-936D3F3A1A3A Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 I do not believe that DoH is somehow going to universally stop that. = This reminds me of the oft stated and incorrect view that TLS 1.3 is = going to prevent middle boxes. Two easy options to prevent DoH are: 1) Mine the internet for DoH servers and block them via ACLs at the NAP = routers or at the IPS/Firewalls. This kind of mining is done all of the = time. Just look at Shodan. I would not be surprised if a flag for NMAP = will be made available soon.=20 2) Do a full TLS 1.3 proxy at the edge and rewrite or redirect the DoH = queries. But you say, users will get an error message about broken = certificates. Yes they will, if they do not have a root CA stored in = their client. However, most users will click =E2=80=9Cconnect me = anyways=E2=80=9D. Only the real tech savvy people will notice or care, = and most of them will use VPN or TOR like services anyway.=20 Thanks, Bret PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 "Without cryptography vihv vivc ce xhrnrw, however, the only thing that = can not be unscrambled is an egg." > On Aug 18, 2019, at 7:43 AM, Eric Rescorla wrote: >=20 > It's certainly not the case that DNS modification and surveillance is = limited to the US, although it may not be for the purposes of = advertising. Here's a good place to start to see the extent of = DNS-based tampering: >=20 > = https://www.usenix.org/system/files/conference/usenixsecurity18/sec18-liu_= 0.pdf = >=20 > It's of course possible that some of this is being done by enterprises = and the like, not ISPs, but, for instance, the authors find that China = Mobile, which you site above, intercepts DNS (see S 5.1). >=20 > -Ekr >=20 >=20 > On Sun, Aug 18, 2019 at 7:58 AM Dominique Lazanski = > wrote: >=20 >=20 > On 18 Aug 2019, at 02:11, Rob Sayre > wrote: >=20 >> Hi! >>=20 >> I thought it might be good to point out that self-identified = "operators" may have many lines of business. >>=20 >> For example: >> "AT&T Advertising & Analytics Lays Foundation of a Premium TV and = Video Ad Marketplace Fueled By Data, Technology, Premium Content and = Distribution" >> > >>=20 >> or >>=20 >> "ANY WAY YOUR AUDIENCE WATCHES: CONSIDER THEM FOUND" >> > >>=20 >> I'm sure there are other telephone companies that do similar = things--these are just two examples. I think this is all fine, actually. = It's nevertheless a good data point. >>=20 >> And, of course, any data point along these lines must take this = context into account: >>=20 >> "Ever since Congress voted to repeal the FCC's broadband privacy = protections due to come into force later this year - which would have = prevented internet service providers like AT&T, Comcast, Time Warner, = Sprint and Verizon from selling personal data like web browsing history = without prior consent..." >> = > >>=20 >> I have to say, I don't really like anyone tracking me (including = Google), but I don't see the IETF performing a useful role here. It = often seems like the goal is to write an RFC that weakens encryption so = more companies can have ad networks. >>=20 >=20 > But this is just the two biggest operators in the US and isn=E2=80=99t = true globally. According to the GSMA the top five largest operators = globally aren=E2=80=99t American and don=E2=80=99t run ad networks = though they do have services like mobile money. (China Mobile, Vodafone, = Telefonica...) >=20 > Your point reflects a very American mindset, but we really need to = think globally about this.=20 >=20 > -dml >=20 >> thanks, >> Rob >> --=20 >> Add mailing list >> Add@ietf.org >> https://www.ietf.org/mailman/listinfo/add = > --=20 > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add = > --=20 > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add --Apple-Mail=_09166579-2C28-4A6B-BAEF-936D3F3A1A3A Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 I = do not believe that DoH is somehow going to universally stop that. This = reminds me of the oft stated and incorrect view that TLS 1.3 is going to = prevent middle boxes.

Two easy options to prevent DoH are:

1) Mine the internet for DoH servers = and block them via ACLs at the NAP routers or at the IPS/Firewalls. This = kind of mining is done all of the time.  Just look at Shodan. =  I would not be surprised if a flag for NMAP will be made available = soon. 

2) = Do a full TLS 1.3 proxy at the edge and rewrite or redirect the DoH = queries. But you say, users will get an error message about broken = certificates.  Yes they will, if they do not have a root CA stored = in their client.  However, most users will click =E2=80=9Cconnect = me anyways=E2=80=9D.  Only the real tech savvy people will notice = or care, and most of them will use VPN or TOR like services = anyway. 


Thanks,
Bret
PGP = Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 = 0050
"Without = cryptography vihv vivc ce xhrnrw, however, the only thing that can not = be unscrambled is an = egg."

On Aug 18, 2019, at 7:43 AM, Eric Rescorla <ekr@rtfm.com> = wrote:

It's certainly not the case that = DNS modification and surveillance is limited to the US, although it may = not be for the purposes of advertising.  Here's a good place to = start to see the extent of DNS-based tampering:

https://www.usenix.org/system/files/conference/usenixsecurity18= /sec18-liu_0.pdf

It's of course possible that some of this is being done by = enterprises and the like, not ISPs, but, for instance, the authors find = that China Mobile, which you site above, intercepts DNS (see S 5.1).

-Ekr


On Sun, Aug 18, 2019 at 7:58 AM Dominique Lazanski = <dml@lastpresslabel.com> wrote:


On 18 Aug 2019, at = 02:11, Rob Sayre <sayrer@gmail.com> wrote:

Hi!

I thought it might be good to point out = that self-identified "operators" may have many lines of = business.

For example:
"AT&T Advertising = & Analytics Lays Foundation of a Premium TV and Video Ad Marketplace = Fueled By Data, Technology, Premium Content and Distribution"
<https://about.att.com/story/2018/att_appnexus.html>

or

"ANY WAY YOUR AUDIENCE WATCHES: CONSIDER THEM FOUND"
<https://www.comcastspotlight.com>

I'm sure there are other = telephone companies that do similar things--these are just two examples. = I think this is all fine, actually. It's nevertheless a good data = point.

And, of = course, any data point along these lines must take this context into = account:

"Ever = since Congress voted to repeal the FCC's broadband privacy protections = due to come into force later this year - which would have prevented = internet service providers like AT&T, Comcast, Time Warner, Sprint = and Verizon from selling personal data like web browsing history without = prior consent..."
<https://www.forbes.com/sites/thomasbrewster/2017/03/30/fcc-priv= acy-rules-how-isps-will-actually-sell-your-data/#3402e4c621d1>

I = have to say, I don't really like anyone tracking me (including Google), = but I don't see the IETF performing a useful role here. It often seems = like the goal is to write an RFC that weakens encryption so more = companies can have ad networks.


But this is just the two biggest = operators in the US and isn=E2=80=99t true globally. According to the = GSMA the top five largest operators globally aren=E2=80=99t American and = don=E2=80=99t run ad networks though they do have services like mobile = money. (China Mobile, Vodafone, Telefonica...)

Your point reflects a very American = mindset, but we really need to think globally about = this. 

-dml

thanks,
Rob
--
Add = mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add

= --Apple-Mail=_09166579-2C28-4A6B-BAEF-936D3F3A1A3A-- From nobody Mon Aug 19 06:19:46 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0023E120044 for ; Mon, 19 Aug 2019 06:19:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gnBTdw3BRhuV for ; Mon, 19 Aug 2019 06:19:42 -0700 (PDT) Received: from mail-pg1-x542.google.com (mail-pg1-x542.google.com [IPv6:2607:f8b0:4864:20::542]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 10A6C120020 for ; Mon, 19 Aug 2019 06:19:42 -0700 (PDT) Received: by mail-pg1-x542.google.com with SMTP id l21so1223911pgm.3 for ; Mon, 19 Aug 2019 06:19:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=R7yCQqpodGkkb0NT37TD1HFo4ATm81/OMqfGtoN/MAs=; b=M+CXwzanX68BUbRuzudrjNf8u0b4EBrHpTnaZTrsYdVB2CLiS+xBFNNWOZYrbQwizO IW55CSxRyuLi+4PKXpK1xJ/QjIevP7dexZST8PawR9VijfBC/eI+eqHn0DfSEfQnpCaf oe5yO24XRmL+EBQOzj35URutKE4Z09raBMcA9Yt83+NMrRwmj+NMehbq+h2N9MDLVbUa SnK7U3nslC3geKU17OcVgw2+H5MECgSH1f9Clfxy+DvtMj554l6SotXISHAddjeVsEq3 P7Y7yk2AUj4AFBgH26FLvPY/KK/lJ3wUAljYYgSR7BD4JcUrtqN7As3+6y92PEE3LPwG Uwtw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=R7yCQqpodGkkb0NT37TD1HFo4ATm81/OMqfGtoN/MAs=; b=QdKKuUk/uAySJUOr1sjbXmVxcJB/qbLUd99LZ8FO1VhuuHpIpDKsMncXoL1G2Pbn56 55WqbwCoKLyFxJqU+rapPcqw+AhkQu7zBJ1U7JMCOUMfmytzEsGqRGvxbXrGtFbq3DLT ZvdYJ4ovkGQqklAp9ylX+eKJz0Q1xJqzPohJcp139j8mXjqUUGMP2j434lv7X8inWSqq uuhxwlo8HfakAM7ORD3RG0N6FzUkZktVjabACVcBCq+/qpCqZNOPhaxiUruPSIeaJtAb IAm+MFDYTOYFnkC4JnZMZvneLMW7VOXQflsDjffMSekxOKM9C8tEapK7VDDkR4tRn21+ H8kw== X-Gm-Message-State: APjAAAUXzllvCpsEoWLlBB32KMbkk/FduMFn0tk5KgMpvSZisttY5fDr 6yCKf6v4KYQ439b1jyOtGQU= X-Google-Smtp-Source: APXvYqzBz09RvWFtvvSvcyt0ZHb5rmxJ5jbyPeoHyYGhgW8rnDNZrGo7tsV7laySjkLGwe1mKI7OAA== X-Received: by 2002:a17:90a:3be5:: with SMTP id e92mr21125071pjc.86.1566220781529; Mon, 19 Aug 2019 06:19:41 -0700 (PDT) Received: from [10.128.64.149] ([136.60.227.81]) by smtp.gmail.com with ESMTPSA id d128sm8528734pfa.42.2019.08.19.06.19.40 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 19 Aug 2019 06:19:40 -0700 (PDT) From: Bret Jordan Message-Id: <63AFB748-E541-498E-9CBD-7347060215B6@gmail.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_F5C1820C-3768-4837-B309-2A4AF8DBBAF9" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Mon, 19 Aug 2019 07:19:37 -0600 In-Reply-To: Cc: Adam Roach , ADD Mailing list To: Rob Sayre References: <0fc6ad1b-77f2-fdbe-dab9-b9d65760d92d@nostrum.com> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] Home routers with their own DNS servers X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 19 Aug 2019 13:19:44 -0000 --Apple-Mail=_F5C1820C-3768-4837-B309-2A4AF8DBBAF9 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Thanks for sending this report. I still find it alarming that a small = group of DNS operators have that much visibility in to what is going on.=20= Thanks, Bret PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 "Without cryptography vihv vivc ce xhrnrw, however, the only thing that = can not be unscrambled is an egg." > On Aug 18, 2019, at 12:40 PM, Rob Sayre wrote: >=20 >=20 >=20 > On Sun, Aug 18, 2019 at 10:54 AM Adam Roach > wrote: > On 8/18/19 12:24 PM, Rob Sayre wrote: > > In other browsers, I found that my resolver was run by Google[1]. I=20= > > was a little puzzled at first, since Google is not my ISP. But, then = I=20 > > remembered that my router is a Google Wifi product. I guess it uses=20= > > its own DNS servers sometimes. >=20 >=20 > I'm not sure that's the cause. >=20 > In my case, it is (see my other reply). >=20 > There are a lot of ISPs that send their DNS traffic to Google, though. = That's why Google DNS gets 15% of queries--it's not like 15% of the = internet manually set their resolver to 8.8.8.8. >=20 > This is covered by this report from APNIC: > > >=20 > "DNSSEC validation in Africa >=20 > Let=E2=80=99s first look in a bit more detail into Africa. DNSSEC = validation use peaked at 22% of users in mid-2016 and declined to 12% by = early 2018 and has shifted back to 18% in early 2019. ISP=E2=80=99s in = this region have been relatively enthusiastic users of Google=E2=80=99s = Public DNS services. Over the past five years, the use of Google=E2=80=99s= Public DNS services has been between 20% to 35% of the entire African = user population." >=20 > If you read more of the report, it sure seems like there are some = negotiations going on around this arrangement. Which is fine. >=20 > I think your point was to highlight the value of DoH in conjunction = with TRR, and I think that effort is good. >=20 > thanks, > Rob > --=20 > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add --Apple-Mail=_F5C1820C-3768-4837-B309-2A4AF8DBBAF9 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Thanks for sending this report.  I still find it = alarming that a small group of DNS operators have that much visibility = in to what is going on. 

Thanks,
Bret
PGP = Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 = 0050
"Without = cryptography vihv vivc ce xhrnrw, however, the only thing that can not = be unscrambled is an = egg."

On Aug 18, 2019, at 12:40 PM, Rob Sayre <sayrer@gmail.com> = wrote:



On Sun, Aug 18, 2019 at 10:54 AM Adam = Roach <adam@nostrum.com> wrote:
On 8/18/19 12:24 PM, Rob Sayre = wrote:
> In other browsers, I found that my resolver was run by Google[1]. I =
> was a little puzzled at first, since Google is not my ISP. But, = then I
> remembered that my router is a Google Wifi product. I guess it uses =
> its own DNS servers sometimes.


I'm not sure that's the cause.

In my case, it is (see = my other reply).

There are a lot of ISPs that send their DNS traffic to = Google, though. That's why Google DNS gets 15% of queries--it's not like = 15% of the internet manually set their resolver to 8.8.8.8.

This is covered by this = report from APNIC:
<https://blog.apnic.net/2019/03/14/the-state-of-dnssec-validatio= n/>

"DNSSEC validation in Africa

Let=E2=80=99s first look in a = bit more detail into Africa. DNSSEC validation use peaked at 22% of = users in mid-2016 and declined to 12% by early 2018 and has shifted back = to 18% in early 2019. ISP=E2=80=99s in this region have been relatively = enthusiastic users of Google=E2=80=99s Public DNS services. Over the = past five years, the use of Google=E2=80=99s Public DNS services has = been between 20% to 35% of the entire African user = population."

If you read more of the report, it sure seems like = there are some negotiations going on around this arrangement. Which is = fine.

I think your point was to highlight the value of = DoH in conjunction with TRR, and I think that effort is good.

thanks,
Rob
--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add

= --Apple-Mail=_F5C1820C-3768-4837-B309-2A4AF8DBBAF9-- From nobody Mon Aug 19 06:51:47 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A2C1D1201CE for ; Mon, 19 Aug 2019 06:51:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eqQURZzodFLF for ; Mon, 19 Aug 2019 06:51:38 -0700 (PDT) Received: from giant.haxx.se (www.haxx.se [IPv6:2a00:1a28:1200:9::2]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4C803120128 for ; Mon, 19 Aug 2019 06:51:38 -0700 (PDT) Received: from giant.haxx.se (mail [127.0.0.1]) by giant.haxx.se (8.15.2/8.15.2/Debian-4) with ESMTPS id x7JDpXTm024379 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 19 Aug 2019 15:51:33 +0200 Received: from localhost (dast@localhost) by giant.haxx.se (8.15.2/8.15.2/Submit) with ESMTP id x7JDpV2s024369; Mon, 19 Aug 2019 15:51:31 +0200 X-Authentication-Warning: giant.haxx.se: dast owned process doing -bs Date: Mon, 19 Aug 2019 15:51:31 +0200 (CEST) From: Daniel Stenberg X-X-Sender: dast@giant.haxx.se To: Bret Jordan cc: Eric Rescorla , ADD Mailing list In-Reply-To: Message-ID: References: <52AC14D8-E2DC-480A-B306-36E7C5987259@lastpresslabel.com> User-Agent: Alpine 2.20 (DEB 67 2015-01-07) X-fromdanielhimself: yes MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII; format=flowed Archived-At: Subject: Re: [Add] Telecom Ad Networks X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 19 Aug 2019 13:51:46 -0000 On Mon, 19 Aug 2019, Bret Jordan wrote: > Two easy options to prevent DoH are: > > 1) Mine the internet for DoH servers and block them via ACLs at the NAP > routers or at the IPS/Firewalls. This kind of mining is done all of the > time. Just look at Shodan. I would not be surprised if a flag for NMAP > will be made available soon. You can only "easily map" them like that if you know their correct URLs (since some DoH servers are cohosted with regular web content on the same IPs) or at least names (for SNI etc) and they're not requiring authentication. That will not be universally true. So it takes a little more than just a flag for nmap. -- / daniel.haxx.se From nobody Mon Aug 19 08:20:06 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DA49D12011D for ; Mon, 19 Aug 2019 08:20:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7caMIcL_dwg7 for ; Mon, 19 Aug 2019 08:19:59 -0700 (PDT) Received: from mail-qt1-x831.google.com (mail-qt1-x831.google.com [IPv6:2607:f8b0:4864:20::831]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5E87512010C for ; Mon, 19 Aug 2019 08:19:59 -0700 (PDT) Received: by mail-qt1-x831.google.com with SMTP id x4so2284028qts.5 for ; Mon, 19 Aug 2019 08:19:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=2fmETR/bhy+ImpuOTvFadUgYZADZvlIhynnoV3IinP8=; b=O7O9TUcbtPstw1BIAb+0bXW+5I/x8MLX0nwoX/bSn4U+3wcNQyXz52gOVvRzQS+Ody wDMCZ8g5agxp80sEp4nYCBCDcmmyrzltq2zMJLrzPaTPVIzlVo4XezQjq/rW1LjB+tw5 qduC105XhX/Pa+kdglIcy+4vMQ/scoj0eGWgWM1zuFTrgEWuU9N8/LcOAU11l+P+8wYQ Jva8tAPLlTlAe5Q2DmGqHgTzqrGiMmgefOv+W/sWcmYGPHPW/xc67gnThrVQi6tlBCiq pUqg3zpOblfTFXV1itx6897E8Daqlpm1GfG1/6XGwSO/zLPi9zLonEM9EE4FBjl+uKA9 59WA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=2fmETR/bhy+ImpuOTvFadUgYZADZvlIhynnoV3IinP8=; b=Q8UKaTv1utbyGiwp40rZQ7rC9G5ScPY4sE5tfonWAaw6GaduYtQEeQvEn4Z7zujZX9 dpGssRQJV/Uk8mbWTCOCCT5RcSqZzFJrS2pWfnnFKeQUDuKAUyWp+mUxYe0le/GhG+lL KZ0tO8tJXG+/Hoak9Y7k+C6d6bumYaIFyL58zmIOiOKwmE7xPmditXtkiRNNXQ1cH00S arsnFH6j01OyBii87ncUInXqvTPCAtOJAOOsgXIWKS167KUASDGOCGBR86tS/h4vsJ6B +1D/R4iyJSsE89locJiiMB7stW8aoddf9OVByJSwUq2AHJn310oPrRdyEwRywEwj/VDb EjOg== X-Gm-Message-State: APjAAAXxzto0FjNQRrAXBsZjmKJnfYFUQrJwkeK0n6CZmSDm5PjsS78M kbd5dLu+XSJ/B1/5ZkuSzFfIVWk6gsNZag== X-Google-Smtp-Source: APXvYqzIOs8uVCpdH9Ls9Ve3MAgGuYccqfT5tcdqN4oinwGkMdYtvhNo/Laheti1kA/W9rkgAUQwmw== X-Received: by 2002:ac8:6955:: with SMTP id n21mr21198635qtr.86.1566227998516; Mon, 19 Aug 2019 08:19:58 -0700 (PDT) Received: from ?IPv6:2001:470:c1a2:1:ac7a:4473:9f06:55e4? ([2001:470:c1a2:1:ac7a:4473:9f06:55e4]) by smtp.gmail.com with ESMTPSA id 145sm7562003qkm.1.2019.08.19.08.19.57 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 19 Aug 2019 08:19:58 -0700 (PDT) From: Ted Lemon Message-Id: Content-Type: multipart/alternative; boundary="Apple-Mail=_81F9CED0-AACE-4614-8E63-96AD2860217C" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Mon, 19 Aug 2019 08:19:56 -0700 In-Reply-To: Cc: add@ietf.org To: Ray Bellis References: <20190817170031.6F71C1691138@fafnir.remote.dragon.net> <5ED23002-7608-4A76-8181-E344E3FC6469@fugue.com> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 19 Aug 2019 15:20:04 -0000 --Apple-Mail=_81F9CED0-AACE-4614-8E63-96AD2860217C Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii On Aug 19, 2019, at 1:37 AM, Ray Bellis wrote: > Specifically, their policy requires that the TRR operator publish the = list of any domains that are blocked. For some types of block (e.g. = domains with child abuse imagery) publishing such a list is very = problematic. Is this an issue that the authors of the policy are aware of? Is this = intentional? FWIW, while I understand the desire for transparency, I tend to agree = that this is untenable. --Apple-Mail=_81F9CED0-AACE-4614-8E63-96AD2860217C Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii On = Aug 19, 2019, at 1:37 AM, Ray Bellis <ray@bellis.me.uk> = wrote:
Specifically, = their policy requires that the TRR operator publish the list of any = domains that are blocked.   For some types of block (e.g. = domains with child abuse imagery) publishing such a list is very = problematic.

Is this an issue that the authors of the policy are aware of? =   Is this intentional?

FWIW, while I understand the desire for transparency, I tend = to agree that this is untenable.

= --Apple-Mail=_81F9CED0-AACE-4614-8E63-96AD2860217C-- From nobody Mon Aug 19 08:31:39 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F1F19120106 for ; Mon, 19 Aug 2019 08:31:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=portfast.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0zUSG9pm2ogv for ; Mon, 19 Aug 2019 08:31:34 -0700 (PDT) Received: from mail.portfast.net (mail.portfast.net [IPv6:2a03:9800:20:1::2]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A2C1D1200D7 for ; Mon, 19 Aug 2019 08:31:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=portfast.net; s=dkim; h=Content-Transfer-Encoding:Content-Type:In-Reply-To: MIME-Version:Date:Message-ID:From:References:Cc:To:Subject:Sender:Reply-To: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=c64llHTn6C0mZJkVtspaFT7XaPWJkLDf4EpnqVUKR1Y=; b=JuZB6zicYkqktCZqBw4SHTrM0Y vDCBvFbwuvtnPLpR9Vy1hBMnkzIJDlRxqlLNxpYKmRNmrdh6ituBqWVi7OHk1wC74ZhTZ/DBKzGJo 459hIdtGuSoRCViSnIm8YuOaHe0pS5v4ZZHONmzE9+9FOyO3CAlvrLadRkrUB7keDkYM=; Received: from 88-212-170-135.customer.gigaclear.net ([88.212.170.135]:57722 helo=Rays-MacBook-Pro.local) by mail.portfast.net ([188.246.200.9]:465) with esmtpsa (fixed_plain:ray@bellis.me.uk) (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) id 1hzjd6-0000dk-J6 (Exim 4.89) (return-path ); Mon, 19 Aug 2019 15:31:32 +0000 To: Ted Lemon Cc: add@ietf.org References: <20190817170031.6F71C1691138@fafnir.remote.dragon.net> <5ED23002-7608-4A76-8181-E344E3FC6469@fugue.com> From: Ray Bellis Message-ID: Date: Mon, 19 Aug 2019 16:31:32 +0100 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252; format=flowed Content-Language: en-GB Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [Add] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 19 Aug 2019 15:31:37 -0000 On 19/08/2019 16:19, Ted Lemon wrote: > Is this an issue that the authors of the policy are aware of? I've no idea. Hopefully they're aware now. > Is this intentional? Is what intentional? > FWIW, while I understand the desire for transparency, I tend to agree > that this is untenable. The IWF (who provide the list) have very strict rules about how the list is managed and distributed, that extend right down to controls over which staff within those ISPs that use the blocklist have visibility of it. Even for lesser blocking reasons (e.g. malware protection, etc) the requirement to publish a list is IMHO unreasonable. Ray From nobody Mon Aug 19 09:56:17 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B290B12085D for ; Mon, 19 Aug 2019 09:56:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id on1ljqJQv1Ik for ; Mon, 19 Aug 2019 09:56:14 -0700 (PDT) Received: from mail-lj1-x236.google.com (mail-lj1-x236.google.com [IPv6:2a00:1450:4864:20::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 90CAE120858 for ; Mon, 19 Aug 2019 09:56:13 -0700 (PDT) Received: by mail-lj1-x236.google.com with SMTP id t14so2441069lji.4 for ; Mon, 19 Aug 2019 09:56:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=2My5VcpQDlV0tfQs+cqwHfwLFcTlLuU1sTJfDFlS1SM=; b=tucqDFGMvBgKVhQ3YYhkjHNssMXqVE+KFqVaTihuCkq57fmx/zStkefq7avyKSchTa qdaJVBcKPsD8kAFwYFvZZLRRkXUo9mIsPUSSKt3FUE7ZXqgdOWszvfGf/9pjpgNuDOv3 KTi7DVAZ68ldaLsasCz5TL9/zfKQFGZc9eHiL3WlDfr2lOfNqA5GZr2HmvDo0yJ3azJ7 N4zBAhfe3L070oNb2qL3BFqABOHYwgaaF7XOIPQrVpXAzxiq/DSvx/vrJQFBRlpkPKA9 +bEjwx25bVhBKBEzkLV3MJdTOy21edKuI804OZBmbwnF28cVqYqqvtwSUYx98tYfpWu0 3J2w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=2My5VcpQDlV0tfQs+cqwHfwLFcTlLuU1sTJfDFlS1SM=; b=b7bTeEy96MaHGPqWQ7hWRh1xBbqj2cWITQt88VPWAPxUEqeQYV25LWEy8/tudKL4BN ZPJqlwDJ71Cje5+baVNIZAEyLacJK3W8wr4IEYlCfzZtabBigQz/w0hIEddGfDFx5ZXv z72TDzOdJa6iGGywPf11Uc1LCiSHqAYzR8jRm5wyoKL7oJGHTmyxl6ltdKWBnuI8Nr83 09vfgANgfH+iR362hTOKychEBvH9lmh5OEYGzxJVY9192SKmzn5xGu6Jh7fRLn9PDG3V qVgzBCLTlRteW5zRrmo7Ce9cK9/Ekbv6t31JcbmRL0NmBG0nOGBSPylwrSzYFL+3u72O UwhA== X-Gm-Message-State: APjAAAXwjJ9sGI27srfMn8/Ab1UI+n6q12sc+hbEw+MP1uVitOewXhgh FDkmhsrlmsBNhoCp00/zQecUFF3oQB5i3+AT5hykgQ== X-Google-Smtp-Source: APXvYqxhbdnK6cCPmfB5+NlRmtVldhIm9ssQuX31nIwQWEEaFPf5VSpayu4JnlA/MmGBrhGVyaVxKJZIcfEwkYdCCj8= X-Received: by 2002:a2e:1518:: with SMTP id s24mr4554333ljd.205.1566233771666; Mon, 19 Aug 2019 09:56:11 -0700 (PDT) MIME-Version: 1.0 References: <20190817170031.6F71C1691138@fafnir.remote.dragon.net> <5ED23002-7608-4A76-8181-E344E3FC6469@fugue.com> In-Reply-To: From: Eric Rescorla Date: Mon, 19 Aug 2019 09:55:34 -0700 Message-ID: To: Ted Lemon Cc: Ray Bellis , ADD Mailing list Content-Type: multipart/alternative; boundary="00000000000098822905907b379a" Archived-At: Subject: Re: [Add] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 19 Aug 2019 16:56:16 -0000 --00000000000098822905907b379a Content-Type: text/plain; charset="UTF-8" On Mon, Aug 19, 2019 at 8:20 AM Ted Lemon wrote: > On Aug 19, 2019, at 1:37 AM, Ray Bellis wrote: > > Specifically, their policy requires that the TRR operator publish the list > of any domains that are blocked. For some types of block (e.g. domains > with child abuse imagery) publishing such a list is very problematic. > > > Is this an issue that the authors of the policy are aware of? Is this > intentional? > > FWIW, while I understand the desire for transparency, I tend to agree that > this is untenable. > Unfortunately, there is a fairly long history of over-blocking, including in the UK. See, for instance: https://en.wikipedia.org/wiki/Internet_censorship_in_the_United_Kingdom#Overblocking, so some form of transparency is required here. I don't know enough about the child abuse imagery case to know whether keeping the list secret actually significantly decreases availability of such content, however to take the simpler case of malware protection, it's not clear to me why it needs to be secret. Can you explain why that is necessary? -Ekr --00000000000098822905907b379a Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Mon, Aug 19, 2019 at 8:20 AM Ted L= emon <mellon@fugue= .com> wrote:
On Aug 19, 2019, at 1:37 AM, Ray Bellis <ray@bellis.me.uk> wrote:
Specifically, their policy requires that the TRR operator publish the list= of any domains that are blocked. =C2=A0=C2=A0For some types of block (e.g.= domains with child abuse imagery) publishing such a list is very problemat= ic.

Is this= an issue that the authors of the policy are aware of? =C2=A0 Is this inten= tional?

FWIW, while I understand the desire for tr= ansparency, I tend to agree that this is untenable.

Unfortunately, there is a fairly long history of over-= blocking, including in the UK. See, for instance: https://en.wikipedia.org/wiki/Internet_censorship_in_the_Uni= ted_Kingdom#Overblocking, so some form of transparency is required here= .

I don't know enough about the child abuse im= agery case to know whether keeping the list secret actually significantly d= ecreases availability of such content, however to take the simpler case of = malware protection, it's not clear to me why it needs to be secret. Can= you explain why that is necessary?

-Ekr
=

--00000000000098822905907b379a-- From nobody Mon Aug 19 10:13:52 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8B71D120089 for ; Mon, 19 Aug 2019 10:13:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=portfast.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rnMpMEMpk74s for ; Mon, 19 Aug 2019 10:13:47 -0700 (PDT) Received: from mail.portfast.net (mail.portfast.net [IPv6:2a03:9800:20:1::2]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E061412004C for ; Mon, 19 Aug 2019 10:13:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=portfast.net; s=dkim; h=Content-Transfer-Encoding:Content-Type:In-Reply-To: MIME-Version:Date:Message-ID:From:References:Cc:To:Subject:Sender:Reply-To: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=IvPSwZ2YU+jmeJgwjpcKII1D2/I61i8Tc9q8ngYxI4Q=; b=VerWbKT2+UHeNDK70NfMiqeM6P ZsEUHa4sva9wg7+sf/HH23OrCV57cULzIOyR5FjRIl0fnMn5bAMnacZX9OCK/RQQV5aRJkS0bqAEE 6lBcYbf1nD48GwX9lEeLXp7mx24OPmDkPamfwk+4nW6qSz7gDfwHwMvN+f58Vg5gHGrw=; Received: from 88-212-170-135.customer.gigaclear.net ([88.212.170.135]:59474 helo=Rays-MacBook-Pro.local) by mail.portfast.net ([188.246.200.9]:465) with esmtpsa (fixed_plain:ray@bellis.me.uk) (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) id 1hzlDz-0002AC-VP (Exim 4.89) (return-path ); Mon, 19 Aug 2019 17:13:44 +0000 To: Eric Rescorla Cc: ADD Mailing list References: <20190817170031.6F71C1691138@fafnir.remote.dragon.net> <5ED23002-7608-4A76-8181-E344E3FC6469@fugue.com> From: Ray Bellis Message-ID: <3a0bf623-3aee-4d4d-fff0-4d127a81bbae@bellis.me.uk> Date: Mon, 19 Aug 2019 18:13:43 +0100 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-GB Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [Add] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 19 Aug 2019 17:13:51 -0000 On 19/08/2019 17:55, Eric Rescorla wrote: > Unfortunately, there is a fairly long history of over-blocking, > including in the UK. There's been only a very small handful of reported overblocking cases with that particular list. The most widely reported one was many years ago (2008) when the whole of Wikipedia got blocked because a specific album cover that they were hosting a picture of was deemed unacceptable. (Interesting legal commentary at ) > I don't know enough about the child abuse imagery case to know > whether keeping the list secret actually significantly decreases > availability of such content AIUI, the intent of keeping the list secret is not to decrease availability, but to prevent it falling into the hands of those actively seeking that material. > however to take the simpler case of malware protection, it's not > clear to me why it needs to be secret. Can you explain why that is > necessary? I wouldn't say "necessary" but I do think that any intelligence that a malware operator can glean about which of its domains are blocked would be of use to them. Ray From nobody Mon Aug 19 10:53:36 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C6D7212006A for ; Mon, 19 Aug 2019 10:53:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.98 X-Spam-Level: X-Spam-Status: No, score=-1.98 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, T_SPF_HELO_PERMERROR=0.01, T_SPF_PERMERROR=0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nostrum.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WyEkfsaXK5A6 for ; Mon, 19 Aug 2019 10:53:32 -0700 (PDT) Received: from nostrum.com (raven-v6.nostrum.com [IPv6:2001:470:d:1130::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D794812001E for ; Mon, 19 Aug 2019 10:53:32 -0700 (PDT) Received: from MacBook-Pro.roach.at (99-152-146-228.lightspeed.dllstx.sbcglobal.net [99.152.146.228]) (authenticated bits=0) by nostrum.com (8.15.2/8.15.2) with ESMTPSA id x7JHrQbN028979 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NO); Mon, 19 Aug 2019 12:53:27 -0500 (CDT) (envelope-from adam@nostrum.com) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=nostrum.com; s=default; t=1566237207; bh=4VBdrYYrNtqaX6vaJ/hltLr3eUy3m7zQTmCaiQ+GuZY=; h=Subject:To:Cc:References:From:Date:In-Reply-To; b=GhxdLudasG3ZK+7nNR/s5pwdW7FrNGyAXdGrct/N4L2W+ryz5wIBoWQ/NNzl0zRaV ooe0yqQxl3Qstk6wU/1SLLnQ54kYIJxYCDGFquYyiyZ75Ava0W9ZDsV/BSesQLUhAs 1CmEIdAshjHIidQC4kK2/ftz2w5nkgRE61tdY8IU= X-Authentication-Warning: raven.nostrum.com: Host 99-152-146-228.lightspeed.dllstx.sbcglobal.net [99.152.146.228] claimed to be MacBook-Pro.roach.at To: Ray Bellis , Eric Rescorla Cc: ADD Mailing list References: <20190817170031.6F71C1691138@fafnir.remote.dragon.net> <5ED23002-7608-4A76-8181-E344E3FC6469@fugue.com> <3a0bf623-3aee-4d4d-fff0-4d127a81bbae@bellis.me.uk> From: Adam Roach Message-ID: Date: Mon, 19 Aug 2019 12:53:20 -0500 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: <3a0bf623-3aee-4d4d-fff0-4d127a81bbae@bellis.me.uk> Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Content-Language: en-US Archived-At: Subject: Re: [Add] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 19 Aug 2019 17:53:35 -0000 On 8/19/19 12:13 PM, Ray Bellis wrote: > > > On 19/08/2019 17:55, Eric Rescorla wrote: > >> Unfortunately, there is a fairly long history of over-blocking, >> including in the UK. > > There's been only a very small handful of reported overblocking cases > with that particular list. Is this true? The Open Rights Group reports that the default blocking settings for the UK prevent access to almost 10% of the top 100,000 Alexa-ranked sites today [1]. While this is a vast improvement from the 20% from five years ago [2], it still seems unacceptably high -- especially when considering the nature of the sites that get blocked [3]. >> I don't know enough about the child abuse imagery case to know >> whether keeping the list secret actually significantly decreases >> availability of such content > > AIUI, the intent of keeping the list secret is not to decrease > availability, but to prevent it falling into the hands of those > actively seeking that material. I might be alone, but I can't figure out the distinction you're trying to make. > >> however to take the simpler case of malware protection, it's not >> clear to me why it needs to be secret. Can you explain why that is >> necessary? > > I wouldn't say "necessary" but I do think that any intelligence that a > malware operator can glean about which of its domains are blocked > would be of use to them. For an actor like a malware operator, there will be a very small number of already-known domains of interest, and determining whether they are blocked is trivial: they can try to resolve said domains and see whether they get the expected result. /a ____ [1] https://www.blocked.org.uk/ [2] https://www.independent.co.uk/life-style/gadgets-and-tech/one-in-five-sites-blocked-by-the-uks-over-zealous-pornography-filters-9579838.html [3] https://www.independent.co.uk/life-style/gadgets-and-tech/news/o2-changes-porn-filter-after-charity-sites-blocked-9023209.html From nobody Mon Aug 19 11:38:22 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4947E1201AA for ; Mon, 19 Aug 2019 11:38:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.5 X-Spam-Level: X-Spam-Status: No, score=-17.5 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9BWs9V6a8WZS for ; Mon, 19 Aug 2019 11:38:19 -0700 (PDT) Received: from mail-wm1-x32a.google.com (mail-wm1-x32a.google.com [IPv6:2a00:1450:4864:20::32a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 49B7B120121 for ; Mon, 19 Aug 2019 11:38:19 -0700 (PDT) Received: by mail-wm1-x32a.google.com with SMTP id i63so418871wmg.4 for ; Mon, 19 Aug 2019 11:38:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=9362Pzug+EHMnachXMQyA4IFN0VE2LXMupmlgLdn1Lk=; b=QS2HKjDla075WT0FZc0g/n5TEEiFic6ektjQrmCJi1w2iTydKgCKwSYrQPJf2tT5+5 O2qsrdfujZfjDky7ygM8lWZ4XFR97VMdBorx4yPPfT1Y4Ve76kfAEkLu0zMNMSJmlpze 9+p08nCRvEfHvxDb0M5mBwSSDNyTKYl4cJn7aebL6qDnRlsT8R50FhZ49LVo514U2AvB TLypPw9ThqujRBiTfr+qh/duurrEwQadOHLWPB9fhQFSzj++Wk24y0lhh+40wgbzKQJN Wt+bGE3z1C7HCsoqdskt9f3VkK+HsvqAevnSz2iMioTN5uzstDtiErsecLI7XWPOxyxE IOoA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=9362Pzug+EHMnachXMQyA4IFN0VE2LXMupmlgLdn1Lk=; b=udXEpaj6jqyGFyu/LHAuc7PwCK7p41vakkAdiHtIaSltS3l6nCcQ8R+lMXFpK99She 9agoTZxGOyl0z8Qr0WBlZgE2i5TjW7Gv+RRKDHzbR5O9WJRRxpkr2Knntk8drR7jbqlp JGwpR/3E0EDmIxkA/3dqub06ChEA+1k2xHmREjD8L6ATbv5Zp96+jXHAO/P4nPbbN7pk JFSNMDbSqkYyn1lUzJHiqf6r0DAOSiurT9/reD69wYPZ1OF5wgQXL4KwzBnVnR+v8l66 b4ViYMCOBEqwz4J2jvQ/q+fPHkFT8vHmecQ/hgop5nqhIfpgvqVN3/yh9k26aGv0/v9G 0S+A== X-Gm-Message-State: APjAAAVA+mWZ4FmRiI9cCv2/Zpau/sprSlZ5TXJz+3aclk2Yl98216pi qNiyU08rqGKFpy657eCE7QEKM/mHBbJdjGezH1/UmDSBcZMy9g== X-Google-Smtp-Source: APXvYqxOd5fQdLTfORAxFZHaT/7K4icy6DVmXJTFL6ri0fe0lDf6JGR/zTL6Xk1aa8nDEtXl3DUBU23VTYKUcJEF6n4= X-Received: by 2002:a1c:a101:: with SMTP id k1mr22517095wme.98.1566239897270; Mon, 19 Aug 2019 11:38:17 -0700 (PDT) MIME-Version: 1.0 References: <0fc6ad1b-77f2-fdbe-dab9-b9d65760d92d@nostrum.com> In-Reply-To: From: Erik Kline Date: Mon, 19 Aug 2019 11:38:04 -0700 Message-ID: To: Amelia Andersdotter Cc: add@ietf.org Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="000000000000bed89c05907ca42b" Archived-At: Subject: Re: [Add] Home routers with their own DNS servers X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 19 Aug 2019 18:38:21 -0000 --000000000000bed89c05907ca42b Content-Type: multipart/alternative; boundary="000000000000b62a3405907ca412" --000000000000b62a3405907ca412 Content-Type: text/plain; charset="UTF-8" On Mon, 19 Aug 2019 at 02:46, Amelia Andersdotter wrote: > On 2019-08-19 06:49, Mikael Abrahamsson wrote: > > On Sun, 18 Aug 2019, Adam Roach wrote: > > > >> Google even when they aren't related to any Google properties. I > >> don't recall providing informed consent for this to happen, and I > >> wonder how much PII is being sent to Google when this happens. > > > > When I run this test on my home connection I get the IP of my ISP > > resolver. My ISP is not doing any trickery, and I definitely do not > > wany my queries to go to any TRR or to Google without my active > > permission that this will happen. > > > > I'm sorry your experience with ISPs are so flawed, but this is not the > > case across the entire world. > > > If I try to replicate exactly what Adam Roach appears to have done at > the ETSI WIFI PUBLIC network at ETSI HQ in France, I also get a Google > resolver though: https://www.whois.com/whois/172.253.14.5 Curious. > ISPs forwarding their resolution service to Google Public DNS services is something that is done: https://developers.google.com/speed/public-dns/faq#isp Usually the ISP works the 8dot8 operators to notify them of the ISP's expected query rate so as to avoid surprises on all sides. --000000000000b62a3405907ca412 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Mon, 19 Aug 2019 at 02:46, Amelia Ande= rsdotter <amelia@article19.org> wrote:
On 2019-08-19 06:49, Mikael Abrahamsson wrote:
> On Sun, 18 Aug 2019, Adam Roach wrote:
>
>> Google even when they aren't related to any Google properties.= I
>> don't recall providing informed consent for this to happen, an= d I
>> wonder how much PII is being sent to Google when this happens.
>
> When I run this test on my home connection I get the IP of my ISP
> resolver. My ISP is not doing any trickery, and I definitely do not > wany my queries to go to any TRR or to Google without my active
> permission that this will happen.
>
> I'm sorry your experience with ISPs are so flawed, but this is not= the
> case across the entire world.
>
If I try to replicate exactly what Adam Roach appears to have done at
the ETSI WIFI PUBLIC network at ETSI HQ in France, I also get a Google
resolver though: https://www.whois.com/whois/172.253.14.5<= /a> Curious.

ISPs forwarding their reso= lution service to Google Public DNS services is something that is done:


Usually the ISP works the 8dot8 o= perators to notify them of the ISP's expected query rate so as to avoid= surprises on all sides.
--000000000000b62a3405907ca412-- --000000000000bed89c05907ca42b Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIIS3wYJKoZIhvcNAQcCoIIS0DCCEswCAQExDzANBglghkgBZQMEAgEFADALBgkqhkiG9w0BBwGg ghBFMIIEXDCCA0SgAwIBAgIOSBtqDm4P/739RPqw/wcwDQYJKoZIhvcNAQELBQAwZDELMAkGA1UE BhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVy c29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hBMjU2IC0gRzIwHhcNMTYwNjE1MDAwMDAwWhcNMjEw NjE1MDAwMDAwWjBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xvYmFsU2lnbiBudi1zYTEiMCAG A1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC AQoCggEBALR23lKtjlZW/17kthzYcMHHKFgywfc4vLIjfq42NmMWbXkNUabIgS8KX4PnIFsTlD6F GO2fqnsTygvYPFBSMX4OCFtJXoikP2CQlEvO7WooyE94tqmqD+w0YtyP2IB5j4KvOIeNv1Gbnnes BIUWLFxs1ERvYDhmk+OrvW7Vd8ZfpRJj71Rb+QQsUpkyTySaqALXnyztTDp1L5d1bABJN/bJbEU3 Hf5FLrANmognIu+Npty6GrA6p3yKELzTsilOFmYNWg7L838NS2JbFOndl+ce89gM36CW7vyhszi6 6LqqzJL8MsmkP53GGhf11YMP9EkmawYouMDP/PwQYhIiUO0CAwEAAaOCASIwggEeMA4GA1UdDwEB /wQEAwIBBjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwEgYDVR0TAQH/BAgwBgEB/wIB ADAdBgNVHQ4EFgQUyzgSsMeZwHiSjLMhleb0JmLA4D8wHwYDVR0jBBgwFoAUJiSSix/TRK+xsBtt r+500ox4AAMwSwYDVR0fBEQwQjBAoD6gPIY6aHR0cDovL2NybC5nbG9iYWxzaWduLmNvbS9ncy9n c3BlcnNvbmFsc2lnbnB0bnJzc2hhMmcyLmNybDBMBgNVHSAERTBDMEEGCSsGAQQBoDIBKDA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzANBgkqhkiG 9w0BAQsFAAOCAQEACskdySGYIOi63wgeTmljjA5BHHN9uLuAMHotXgbYeGVrz7+DkFNgWRQ/dNse Qa4e+FeHWq2fu73SamhAQyLigNKZF7ZzHPUkSpSTjQqVzbyDaFHtRBAwuACuymaOWOWPePZXOH9x t4HPwRQuur57RKiEm1F6/YJVQ5UTkzAyPoeND/y1GzXS4kjhVuoOQX3GfXDZdwoN8jMYBZTO0H5h isymlIl6aot0E5KIKqosW6mhupdkS1ZZPp4WXR4frybSkLejjmkTYCTUmh9DuvKEQ1Ge7siwsWgA NS1Ln+uvIuObpbNaeAyMZY0U5R/OyIDaq+m9KXPYvrCZ0TCLbcKuRzCCBB4wggMGoAMCAQICCwQA AAAAATGJxkCyMA0GCSqGSIb3DQEBCwUAMEwxIDAeBgNVBAsTF0dsb2JhbFNpZ24gUm9vdCBDQSAt IFIzMRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWduMB4XDTExMDgwMjEw MDAwMFoXDTI5MDMyOTEwMDAwMFowZDELMAkGA1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24g bnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVyc29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hB MjU2IC0gRzIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCg/hRKosYAGP+P7mIdq5NB Kr3J0tg+8lPATlgp+F6W9CeIvnXRGUvdniO+BQnKxnX6RsC3AnE0hUUKRaM9/RDDWldYw35K+sge C8fWXvIbcYLXxWkXz+Hbxh0GXG61Evqux6i2sKeKvMr4s9BaN09cqJ/wF6KuP9jSyWcyY+IgL6u2 52my5UzYhnbf7D7IcC372bfhwM92n6r5hJx3r++rQEMHXlp/G9J3fftgsD1bzS7J/uHMFpr4MXua eoiMLV5gdmo0sQg23j4pihyFlAkkHHn4usPJ3EePw7ewQT6BUTFyvmEB+KDoi7T4RCAZDstgfpzD rR/TNwrK8/FXoqnFAgMBAAGjgegwgeUwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8C AQEwHQYDVR0OBBYEFCYkkosf00SvsbAbba/udNKMeAADMEcGA1UdIARAMD4wPAYEVR0gADA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzA2BgNVHR8E LzAtMCugKaAnhiVodHRwOi8vY3JsLmdsb2JhbHNpZ24ubmV0L3Jvb3QtcjMuY3JsMB8GA1UdIwQY MBaAFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQACAFVjHihZCV/IqJYt 7Nig/xek+9g0dmv1oQNGYI1WWeqHcMAV1h7cheKNr4EOANNvJWtAkoQz+076Sqnq0Puxwymj0/+e oQJ8GRODG9pxlSn3kysh7f+kotX7pYX5moUa0xq3TCjjYsF3G17E27qvn8SJwDsgEImnhXVT5vb7 qBYKadFizPzKPmwsJQDPKX58XmPxMcZ1tG77xCQEXrtABhYC3NBhu8+c5UoinLpBQC1iBnNpNwXT Lmd4nQdf9HCijG1e8myt78VP+QSwsaDT7LVcLT2oDPVggjhVcwljw3ePDwfGP9kNrR+lc8XrfClk WbrdhC2o4Ui28dtIVHd3MIIDXzCCAkegAwIBAgILBAAAAAABIVhTCKIwDQYJKoZIhvcNAQELBQAw TDEgMB4GA1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjMxEzARBgNVBAoTCkdsb2JhbFNpZ24x EzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMDkwMzE4MTAwMDAwWhcNMjkwMzE4MTAwMDAwWjBMMSAw HgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMzETMBEGA1UEChMKR2xvYmFsU2lnbjETMBEG A1UEAxMKR2xvYmFsU2lnbjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMwldpB5Bngi FvXAg7aEyiie/QV2EcWtiHL8RgJDx7KKnQRfJMsuS+FggkbhUqsMgUdwbN1k0ev1LKMPgj0MK66X 17YUhhB5uzsTgHeMCOFJ0mpiLx9e+pZo34knlTifBtc+ycsmWQ1z3rDI6SYOgxXG71uL0gRgykmm KPZpO/bLyCiR5Z2KYVc3rHQU3HTgOu5yLy6c+9C7v/U9AOEGM+iCK65TpjoWc4zdQQ4gOsC0p6Hp sk+QLjJg6VfLuQSSaGjlOCZgdbKfd/+RFO+uIEn8rUAVSNECMWEZXriX7613t2Saer9fwRPvm2L7 DWzgVGkWqQPabumDk3F2xmmFghcCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQF MAMBAf8wHQYDVR0OBBYEFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQBL QNvAUKr+yAzv95ZURUm7lgAJQayzE4aGKAczymvmdLm6AC2upArT9fHxD4q/c2dKg8dEe3jgr25s bwMpjjM5RcOO5LlXbKr8EpbsU8Yt5CRsuZRj+9xTaGdWPoO4zzUhw8lo/s7awlOqzJCK6fBdRoyV 3XpYKBovHd7NADdBj+1EbddTKJd+82cEHhXXipa0095MJ6RMG3NzdvQXmcIfeg7jLQitChws/zyr VQ4PkX4268NXSb7hLi18YIvDQVETI53O9zJrlAGomecsMx86OyXShkDOOyyGeMlhLxS67ttVb9+E 7gUJTb0o2HLO02JQZR7rkpeDMdmztcpHWD9fMIIEXDCCA0SgAwIBAgIMBMLrMR7h9YjR8U4/MA0G CSqGSIb3DQEBCwUAMEwxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMSIw IAYDVQQDExlHbG9iYWxTaWduIEhWIFMvTUlNRSBDQSAxMB4XDTE5MDUxMTA2MzcyMVoXDTE5MTEw NzA2MzcyMVowHjEcMBoGCSqGSIb3DQEJAQwNZWtAZ29vZ2xlLmNvbTCCASIwDQYJKoZIhvcNAQEB BQADggEPADCCAQoCggEBAIzvCZRYLgadqUeydXNClNcpp0n53ELy/HcLruB13xvxxIBN/ttsev7i GAEdHsf7onTDWUwPFcROr8DiA6mA1/A1w/kImnZ/QAf7HsRvsEj5Y5oaefxk658HhBqqpJEkRdWe u6sxrMYSwss5RhScJmurP/pXIQALbexgl7dvcNtqFR5QM5VpIVCrw4HYbSSFH1Cq+hByCa8a3soW CVDLTedx4jeBdqhbuqXy8KlOU3QHjL0aYbROgRTwRv0j/TWlqMvSxaasFWy6WqU1ULYZ+1eDE6Ig nfqlBvxUpcfy+zgS8NwkCt6Rrf+FNzN2th9Lapizgq+YyuXarLRkM2tqM+kCAwEAAaOCAWowggFm MBgGA1UdEQQRMA+BDWVrQGdvb2dsZS5jb20wUAYIKwYBBQUHAQEERDBCMEAGCCsGAQUFBzAChjRo dHRwOi8vc2VjdXJlLmdsb2JhbHNpZ24uY29tL2NhY2VydC9nc2h2c21pbWVjYTEuY3J0MB0GA1Ud DgQWBBTOji1Lw0P4qSg4yeWN6IYVO0d4RzAfBgNVHSMEGDAWgBTLOBKwx5nAeJKMsyGV5vQmYsDg PzBMBgNVHSAERTBDMEEGCSsGAQQBoDIBKDA0MDIGCCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9i YWxzaWduLmNvbS9yZXBvc2l0b3J5LzA7BgNVHR8ENDAyMDCgLqAshipodHRwOi8vY3JsLmdsb2Jh bHNpZ24uY29tL2dzaHZzbWltZWNhMS5jcmwwDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsG AQUFBwMCBggrBgEFBQcDBDANBgkqhkiG9w0BAQsFAAOCAQEAqgjTZi5G/vTnxGbUTtv2XK2olwbJ ShTu7xlOazHIpyxv13LrAN6E6mQDJru0C3XIfpsATPkCmfzn9g359Xn5dAM/I7J/ZYdLKej2PgSt prFNjlZ2os3ou4P1GmQlnL3qSlMJY9gDaaUhGbWRAxfZ0riXf0jKbczh9sMxTZdT0pBEqrQryQCn l+5qV0XCvZlIFgGDOpYr0w4eaccFRgV9U1QhUx8St+aUoxPPYaAWZc6G7E3h5VwUGbdRHDL3TvU0 D09bY4P7ZOMlozsa7sw2IkYoawbedDp33z0i3GMNxnHvZIQ434AMYEDibrNMT6nYgbODQjlReDEe x0E6TeYoETGCAl4wggJaAgEBMFwwTDELMAkGA1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24g bnYtc2ExIjAgBgNVBAMTGUdsb2JhbFNpZ24gSFYgUy9NSU1FIENBIDECDATC6zEe4fWI0fFOPzAN BglghkgBZQMEAgEFAKCB1DAvBgkqhkiG9w0BCQQxIgQgEzuypC7K1dmR6p0TjyO2KeS0GeEsMViF GMdzSFhHvqswGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMTkwODE5 MTgzODE3WjBpBgkqhkiG9w0BCQ8xXDBaMAsGCWCGSAFlAwQBKjALBglghkgBZQMEARYwCwYJYIZI AWUDBAECMAoGCCqGSIb3DQMHMAsGCSqGSIb3DQEBCjALBgkqhkiG9w0BAQcwCwYJYIZIAWUDBAIB MA0GCSqGSIb3DQEBAQUABIIBAEKenKUOBBsWArYU+pqLB3COyqvhBql0+1cnas0AxZ9PqA8QLfnW 6sgDvBMtHxre6HH3jAosZ8a2qkOigpyay/IfIAzRKohtkjo6zqhXS4Vh6Xhv3GX3FCV/zq+tqJ8r M/C6NeI+E8eeZDZgXfaMI20alAI3JLZHCQpzGpqsOHGcK/DSEII2/kgnEcFxP8KUSbcVtg/q8GHd yFjx0UrAbiZQzOlfobu2GOU9bFiJ21n6HIYfN9LyDeli5NQ2VdtmZYr4+fm2AVOmJMvQ6Zlmw4MD CApcYWj+8j3X4Gi6fnQuQ/uC+CbylbmVaceB9XGx43AioxsskNrpQd1fYH9cTcA= --000000000000bed89c05907ca42b-- From nobody Mon Aug 19 11:39:22 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 53EDF1201AA for ; Mon, 19 Aug 2019 11:39:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=portfast.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kdw7i7CHXBJ9 for ; Mon, 19 Aug 2019 11:39:17 -0700 (PDT) Received: from mail.portfast.net (mail.portfast.net [IPv6:2a03:9800:20:1::2]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 19F6E120121 for ; Mon, 19 Aug 2019 11:39:17 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=portfast.net; s=dkim; h=Content-Transfer-Encoding:Content-Type:In-Reply-To: MIME-Version:Date:Message-ID:From:References:Cc:To:Subject:Sender:Reply-To: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=CHULre3g3gpUeCk6AH++Zqi02p4GYkuolLdRbloH/kE=; b=WvuNI0S4z+LGFycagH7K1LsS/4 jBWquiMJ+Fvdaaw99qfkNhjhp+qt+0Ac8rvlWeRvKJ9OxEwBfq9k9RpbDL95sNV9NmY3wuNe6QT/J sWRaNArLNL2Tvm/tmq8ZtP/lQV1ojdq+A5H+uMsI4zQDKmZpvWuBV7OAaQHOt1j+0sBc=; Received: from [88.212.170.135] (port=60922 helo=Rays-MacBook-Pro.local) by mail.portfast.net ([188.246.200.9]:465) with esmtpsa (fixed_plain:ray@bellis.me.uk) (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) id 1hzmYl-0003L4-Qi (Exim 4.89) (return-path ); Mon, 19 Aug 2019 18:39:15 +0000 To: Adam Roach Cc: ADD Mailing list References: <20190817170031.6F71C1691138@fafnir.remote.dragon.net> <5ED23002-7608-4A76-8181-E344E3FC6469@fugue.com> <3a0bf623-3aee-4d4d-fff0-4d127a81bbae@bellis.me.uk> From: Ray Bellis Message-ID: <828f51ce-d551-dc39-83d2-008f31e9f09a@bellis.me.uk> Date: Mon, 19 Aug 2019 19:39:15 +0100 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-GB Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [Add] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 19 Aug 2019 18:39:19 -0000 On 19/08/2019 18:53, Adam Roach wrote: > Is this true? The Open Rights Group reports that the default blocking > settings for the UK prevent access to almost 10% of the top 100,000 > Alexa-ranked sites today [1]. While this is a vast improvement from the > 20% from five years ago [2], it still seems unacceptably high -- > especially when considering the nature of the sites that get blocked [3]. I was talking specifically about the IWF CAI list, not the wider "adult content" type filters. > I might be alone, but I can't figure out the distinction you're trying > to make. I can't answer for IWF. Someone should ask them. The Pincent Masons article I linked to earler asserts "The blacklist is kept secret for obvious reasons". > For an actor like a malware operator, there will be a very small number > of already-known domains of interest, and determining whether they are > blocked is trivial: they can try to resolve said domains and see whether > they get the expected result. Some malware gets through many 10s of thousands of domain names per day. I wouldn't call that a "very small number". My personal view is that if the blocks are there because: 1. the relevant legal authorities mandated it, and/or 2. the end user opted into it (as permitted by TRR policy) then it's none of Mozilla's business to require that the content of the blocks be published. In both cases, the block is "legal" so what's to be gained by requiring publication of the list? Ray From nobody Mon Aug 19 11:40:33 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C46A912089D for ; Mon, 19 Aug 2019 11:40:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.679 X-Spam-Level: X-Spam-Status: No, score=-1.679 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_INVALID=0.1, DKIM_SIGNED=0.1, HTML_MESSAGE=0.001, T_SPF_HELO_PERMERROR=0.01, T_SPF_PERMERROR=0.01] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=fail (1024-bit key) reason="fail (message has been altered)" header.d=nostrum.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UYMlCWfV0luQ for ; Mon, 19 Aug 2019 11:40:30 -0700 (PDT) Received: from nostrum.com (raven-v6.nostrum.com [IPv6:2001:470:d:1130::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9AABF1201AA for ; Mon, 19 Aug 2019 11:40:30 -0700 (PDT) Received: from MacBook-Pro.roach.at (99-152-146-228.lightspeed.dllstx.sbcglobal.net [99.152.146.228]) (authenticated bits=0) by nostrum.com (8.15.2/8.15.2) with ESMTPSA id x7JIdpAQ086074 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NO); Mon, 19 Aug 2019 13:39:52 -0500 (CDT) (envelope-from adam@nostrum.com) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=nostrum.com; s=default; t=1566239993; bh=CM8JBREd6rgbQqx9D8OP5g2sLtu0aeRaFJggaO0PjY0=; h=Subject:To:Cc:References:From:Date:In-Reply-To; b=B8vTz594rqjYHuEfWjnwhawSgzgc6Cc+yaZn/uY1T6gg5OprtCdZ/TpoXYkQi/Bw2 B98Okvkq6HnqI0oGTVKKLrnitdP6FNd1axXrsm3TKfOVdpGq7o7uEM3CSW2S1YUynk 3F1Lxr7M9GsirSm8rUscUCBIzX9LlGoof26v8S3s= X-Authentication-Warning: raven.nostrum.com: Host 99-152-146-228.lightspeed.dllstx.sbcglobal.net [99.152.146.228] claimed to be MacBook-Pro.roach.at To: Erik Kline , Amelia Andersdotter Cc: add@ietf.org References: <0fc6ad1b-77f2-fdbe-dab9-b9d65760d92d@nostrum.com> From: Adam Roach Message-ID: Date: Mon, 19 Aug 2019 13:39:45 -0500 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/alternative; boundary="------------BEEAFDE069A81508F5B18F25" Content-Language: en-US Archived-At: Subject: Re: [Add] Home routers with their own DNS servers X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 19 Aug 2019 18:40:32 -0000 This is a multi-part message in MIME format. --------------BEEAFDE069A81508F5B18F25 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit On 8/19/19 1:38 PM, Erik Kline wrote: > > ISPs forwarding their resolution service to Google Public DNS services > is something that is done: > > https://developers.google.com/speed/public-dns/faq#isp > > Usually the ISP works the 8dot8 operators to notify them of the ISP's > expected query rate so as to avoid surprises on all sides. Depends on what you define as a "side." I was certainly surprised. /a --------------BEEAFDE069A81508F5B18F25 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 8bit
On 8/19/19 1:38 PM, Erik Kline wrote:

ISPs forwarding their resolution service to Google Public DNS services is something that is done:


Usually the ISP works the 8dot8 operators to notify them of the ISP's expected query rate so as to avoid surprises on all sides.


Depends on what you define as a "side." I was certainly surprised.

/a


--------------BEEAFDE069A81508F5B18F25-- From nobody Mon Aug 19 11:47:05 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 630D312026E for ; Mon, 19 Aug 2019 11:47:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.5 X-Spam-Level: X-Spam-Status: No, score=-17.5 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7vwDT2DdxuWn for ; Mon, 19 Aug 2019 11:47:01 -0700 (PDT) Received: from mail-wr1-x42e.google.com (mail-wr1-x42e.google.com [IPv6:2a00:1450:4864:20::42e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3AD97120168 for ; Mon, 19 Aug 2019 11:47:01 -0700 (PDT) Received: by mail-wr1-x42e.google.com with SMTP id u16so9782901wrr.0 for ; Mon, 19 Aug 2019 11:47:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=XGFzTDBWkXs6ZTPNqzDZrRjpmn8NDGX7qSSn7Pc/1vQ=; b=RzNEqBO5+FjmXzLyNkq0jo8FmekVRQ7Wnnmz6skCHi3hnOc0GQ6t4nT+rCSNp2ef8B bWSd6uYKMd/JF3yASrwnXDhxzXmWBHEuHlpdGxubYxd0rixNmbRv5XziIImre7IzdRmA urGRfJEtpkyEPapnX2hklm/G3mbqGWa2SmbqtyswWwvloJ/hd0QTBt1dbSiOJ3b2rJ9a r/5jJ6Nf9Zih1/E0/6LgqT85uGhWZUL3uuSqWhvirFxeROPPfAzt4jU1YpubGEcLMF+V ePzseWVDM47t/BtpeNBDRo+wzcZIXPiU90szTvCMxdPWxla+9zk41hvdDY1tBaTf86Yd jD9A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=XGFzTDBWkXs6ZTPNqzDZrRjpmn8NDGX7qSSn7Pc/1vQ=; b=RdjevLO+o/vnk4njfuXoFthef4E1ZNfL4AEbhFlyqZtBmG4d6hwNkTWaSM7bbisvg9 fYAhT7Q1tdtNtoTLc7tsH/v7gHSB53NaZRUhxrSLqSBiZ/ffBsQ5xFJAra0nsk5uIPJ+ gcfKW1xo89QvsynCqrccqT/lrzCnQjVp0Wzwe5lI3Jzp5P7q0oQB+N+jjnWzlVl5JnIj a2FIQw0FOV4PzEraV1BuA+EgiD8U9qCV8N88UC+7tSXI8QTRooe6E1OTNAxQ4RYtbez+ KF+cQh34Rsf3Y5sU9yMiPSJxLfSCJxkaJD/TxXZVn89Uzvp5UlQjTIcLbnAr8J2WT5eV fOXQ== X-Gm-Message-State: APjAAAV62NMq5uY4d0JMnRlpYxsgm6ak0JyLslG3R4r8yP6nOz8UqmwC Xxh1wEQdos17pUM2dzpWchuju2/W/4TaE09w/kBIew== X-Google-Smtp-Source: APXvYqxBO4Oskfz/9SLAXL42ky0V2YbN061ei9Kcouv46/Yr9kkyFctnQSzzSGN6UDKlmb2zyLDF0mvPy07MdqVQG+g= X-Received: by 2002:a05:6000:1284:: with SMTP id f4mr30352684wrx.89.1566240419402; Mon, 19 Aug 2019 11:46:59 -0700 (PDT) MIME-Version: 1.0 References: <0fc6ad1b-77f2-fdbe-dab9-b9d65760d92d@nostrum.com> In-Reply-To: From: Erik Kline Date: Mon, 19 Aug 2019 11:46:44 -0700 Message-ID: To: Adam Roach Cc: Amelia Andersdotter , add@ietf.org Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="000000000000dd38db05907cc3be" Archived-At: Subject: Re: [Add] Home routers with their own DNS servers X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 19 Aug 2019 18:47:04 -0000 --000000000000dd38db05907cc3be Content-Type: multipart/alternative; boundary="000000000000d54c0b05907cc389" --000000000000d54c0b05907cc389 Content-Type: text/plain; charset="UTF-8" On Mon, 19 Aug 2019 at 11:40, Adam Roach wrote: > On 8/19/19 1:38 PM, Erik Kline wrote: > > > ISPs forwarding their resolution service to Google Public DNS services is > something that is done: > > https://developers.google.com/speed/public-dns/faq#isp > > Usually the ISP works the 8dot8 operators to notify them of the ISP's > expected query rate so as to avoid surprises on all sides. > > > Depends on what you define as a "side." I was certainly surprised. > > /a > Fair enough (I meant more operational surprises like tripping DoS detection limits, etc). --000000000000d54c0b05907cc389 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Mon, 19 Aug 2019 at 11:40, Adam Roach = <adam@nostrum.com> wrote:
=
=20 =20 =20
On 8/19/19 1:38 PM, Erik Kline wrote:
=20

ISPs forwarding their resolution service to Google Public DNS services is something that is done:


Usually the ISP works the 8dot8 operators to notify them of the ISP's expected query rate so as to avoid surprises o= n all sides.


Depends on what you define as a "side." I was certainly surprised.

/a

Fair enough (I meant more operational = surprises like tripping DoS detection limits, etc).
--000000000000d54c0b05907cc389-- --000000000000dd38db05907cc3be Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIIS3wYJKoZIhvcNAQcCoIIS0DCCEswCAQExDzANBglghkgBZQMEAgEFADALBgkqhkiG9w0BBwGg ghBFMIIEXDCCA0SgAwIBAgIOSBtqDm4P/739RPqw/wcwDQYJKoZIhvcNAQELBQAwZDELMAkGA1UE BhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVy c29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hBMjU2IC0gRzIwHhcNMTYwNjE1MDAwMDAwWhcNMjEw NjE1MDAwMDAwWjBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xvYmFsU2lnbiBudi1zYTEiMCAG A1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC AQoCggEBALR23lKtjlZW/17kthzYcMHHKFgywfc4vLIjfq42NmMWbXkNUabIgS8KX4PnIFsTlD6F GO2fqnsTygvYPFBSMX4OCFtJXoikP2CQlEvO7WooyE94tqmqD+w0YtyP2IB5j4KvOIeNv1Gbnnes BIUWLFxs1ERvYDhmk+OrvW7Vd8ZfpRJj71Rb+QQsUpkyTySaqALXnyztTDp1L5d1bABJN/bJbEU3 Hf5FLrANmognIu+Npty6GrA6p3yKELzTsilOFmYNWg7L838NS2JbFOndl+ce89gM36CW7vyhszi6 6LqqzJL8MsmkP53GGhf11YMP9EkmawYouMDP/PwQYhIiUO0CAwEAAaOCASIwggEeMA4GA1UdDwEB /wQEAwIBBjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwEgYDVR0TAQH/BAgwBgEB/wIB ADAdBgNVHQ4EFgQUyzgSsMeZwHiSjLMhleb0JmLA4D8wHwYDVR0jBBgwFoAUJiSSix/TRK+xsBtt r+500ox4AAMwSwYDVR0fBEQwQjBAoD6gPIY6aHR0cDovL2NybC5nbG9iYWxzaWduLmNvbS9ncy9n c3BlcnNvbmFsc2lnbnB0bnJzc2hhMmcyLmNybDBMBgNVHSAERTBDMEEGCSsGAQQBoDIBKDA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzANBgkqhkiG 9w0BAQsFAAOCAQEACskdySGYIOi63wgeTmljjA5BHHN9uLuAMHotXgbYeGVrz7+DkFNgWRQ/dNse Qa4e+FeHWq2fu73SamhAQyLigNKZF7ZzHPUkSpSTjQqVzbyDaFHtRBAwuACuymaOWOWPePZXOH9x t4HPwRQuur57RKiEm1F6/YJVQ5UTkzAyPoeND/y1GzXS4kjhVuoOQX3GfXDZdwoN8jMYBZTO0H5h isymlIl6aot0E5KIKqosW6mhupdkS1ZZPp4WXR4frybSkLejjmkTYCTUmh9DuvKEQ1Ge7siwsWgA NS1Ln+uvIuObpbNaeAyMZY0U5R/OyIDaq+m9KXPYvrCZ0TCLbcKuRzCCBB4wggMGoAMCAQICCwQA AAAAATGJxkCyMA0GCSqGSIb3DQEBCwUAMEwxIDAeBgNVBAsTF0dsb2JhbFNpZ24gUm9vdCBDQSAt IFIzMRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWduMB4XDTExMDgwMjEw MDAwMFoXDTI5MDMyOTEwMDAwMFowZDELMAkGA1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24g bnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVyc29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hB MjU2IC0gRzIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCg/hRKosYAGP+P7mIdq5NB Kr3J0tg+8lPATlgp+F6W9CeIvnXRGUvdniO+BQnKxnX6RsC3AnE0hUUKRaM9/RDDWldYw35K+sge C8fWXvIbcYLXxWkXz+Hbxh0GXG61Evqux6i2sKeKvMr4s9BaN09cqJ/wF6KuP9jSyWcyY+IgL6u2 52my5UzYhnbf7D7IcC372bfhwM92n6r5hJx3r++rQEMHXlp/G9J3fftgsD1bzS7J/uHMFpr4MXua eoiMLV5gdmo0sQg23j4pihyFlAkkHHn4usPJ3EePw7ewQT6BUTFyvmEB+KDoi7T4RCAZDstgfpzD rR/TNwrK8/FXoqnFAgMBAAGjgegwgeUwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8C AQEwHQYDVR0OBBYEFCYkkosf00SvsbAbba/udNKMeAADMEcGA1UdIARAMD4wPAYEVR0gADA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzA2BgNVHR8E LzAtMCugKaAnhiVodHRwOi8vY3JsLmdsb2JhbHNpZ24ubmV0L3Jvb3QtcjMuY3JsMB8GA1UdIwQY MBaAFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQACAFVjHihZCV/IqJYt 7Nig/xek+9g0dmv1oQNGYI1WWeqHcMAV1h7cheKNr4EOANNvJWtAkoQz+076Sqnq0Puxwymj0/+e oQJ8GRODG9pxlSn3kysh7f+kotX7pYX5moUa0xq3TCjjYsF3G17E27qvn8SJwDsgEImnhXVT5vb7 qBYKadFizPzKPmwsJQDPKX58XmPxMcZ1tG77xCQEXrtABhYC3NBhu8+c5UoinLpBQC1iBnNpNwXT Lmd4nQdf9HCijG1e8myt78VP+QSwsaDT7LVcLT2oDPVggjhVcwljw3ePDwfGP9kNrR+lc8XrfClk WbrdhC2o4Ui28dtIVHd3MIIDXzCCAkegAwIBAgILBAAAAAABIVhTCKIwDQYJKoZIhvcNAQELBQAw TDEgMB4GA1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjMxEzARBgNVBAoTCkdsb2JhbFNpZ24x EzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMDkwMzE4MTAwMDAwWhcNMjkwMzE4MTAwMDAwWjBMMSAw HgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMzETMBEGA1UEChMKR2xvYmFsU2lnbjETMBEG A1UEAxMKR2xvYmFsU2lnbjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMwldpB5Bngi FvXAg7aEyiie/QV2EcWtiHL8RgJDx7KKnQRfJMsuS+FggkbhUqsMgUdwbN1k0ev1LKMPgj0MK66X 17YUhhB5uzsTgHeMCOFJ0mpiLx9e+pZo34knlTifBtc+ycsmWQ1z3rDI6SYOgxXG71uL0gRgykmm KPZpO/bLyCiR5Z2KYVc3rHQU3HTgOu5yLy6c+9C7v/U9AOEGM+iCK65TpjoWc4zdQQ4gOsC0p6Hp sk+QLjJg6VfLuQSSaGjlOCZgdbKfd/+RFO+uIEn8rUAVSNECMWEZXriX7613t2Saer9fwRPvm2L7 DWzgVGkWqQPabumDk3F2xmmFghcCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQF MAMBAf8wHQYDVR0OBBYEFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQBL QNvAUKr+yAzv95ZURUm7lgAJQayzE4aGKAczymvmdLm6AC2upArT9fHxD4q/c2dKg8dEe3jgr25s bwMpjjM5RcOO5LlXbKr8EpbsU8Yt5CRsuZRj+9xTaGdWPoO4zzUhw8lo/s7awlOqzJCK6fBdRoyV 3XpYKBovHd7NADdBj+1EbddTKJd+82cEHhXXipa0095MJ6RMG3NzdvQXmcIfeg7jLQitChws/zyr VQ4PkX4268NXSb7hLi18YIvDQVETI53O9zJrlAGomecsMx86OyXShkDOOyyGeMlhLxS67ttVb9+E 7gUJTb0o2HLO02JQZR7rkpeDMdmztcpHWD9fMIIEXDCCA0SgAwIBAgIMBMLrMR7h9YjR8U4/MA0G CSqGSIb3DQEBCwUAMEwxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMSIw IAYDVQQDExlHbG9iYWxTaWduIEhWIFMvTUlNRSBDQSAxMB4XDTE5MDUxMTA2MzcyMVoXDTE5MTEw NzA2MzcyMVowHjEcMBoGCSqGSIb3DQEJAQwNZWtAZ29vZ2xlLmNvbTCCASIwDQYJKoZIhvcNAQEB BQADggEPADCCAQoCggEBAIzvCZRYLgadqUeydXNClNcpp0n53ELy/HcLruB13xvxxIBN/ttsev7i GAEdHsf7onTDWUwPFcROr8DiA6mA1/A1w/kImnZ/QAf7HsRvsEj5Y5oaefxk658HhBqqpJEkRdWe u6sxrMYSwss5RhScJmurP/pXIQALbexgl7dvcNtqFR5QM5VpIVCrw4HYbSSFH1Cq+hByCa8a3soW CVDLTedx4jeBdqhbuqXy8KlOU3QHjL0aYbROgRTwRv0j/TWlqMvSxaasFWy6WqU1ULYZ+1eDE6Ig nfqlBvxUpcfy+zgS8NwkCt6Rrf+FNzN2th9Lapizgq+YyuXarLRkM2tqM+kCAwEAAaOCAWowggFm MBgGA1UdEQQRMA+BDWVrQGdvb2dsZS5jb20wUAYIKwYBBQUHAQEERDBCMEAGCCsGAQUFBzAChjRo dHRwOi8vc2VjdXJlLmdsb2JhbHNpZ24uY29tL2NhY2VydC9nc2h2c21pbWVjYTEuY3J0MB0GA1Ud DgQWBBTOji1Lw0P4qSg4yeWN6IYVO0d4RzAfBgNVHSMEGDAWgBTLOBKwx5nAeJKMsyGV5vQmYsDg PzBMBgNVHSAERTBDMEEGCSsGAQQBoDIBKDA0MDIGCCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9i YWxzaWduLmNvbS9yZXBvc2l0b3J5LzA7BgNVHR8ENDAyMDCgLqAshipodHRwOi8vY3JsLmdsb2Jh bHNpZ24uY29tL2dzaHZzbWltZWNhMS5jcmwwDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsG AQUFBwMCBggrBgEFBQcDBDANBgkqhkiG9w0BAQsFAAOCAQEAqgjTZi5G/vTnxGbUTtv2XK2olwbJ ShTu7xlOazHIpyxv13LrAN6E6mQDJru0C3XIfpsATPkCmfzn9g359Xn5dAM/I7J/ZYdLKej2PgSt prFNjlZ2os3ou4P1GmQlnL3qSlMJY9gDaaUhGbWRAxfZ0riXf0jKbczh9sMxTZdT0pBEqrQryQCn l+5qV0XCvZlIFgGDOpYr0w4eaccFRgV9U1QhUx8St+aUoxPPYaAWZc6G7E3h5VwUGbdRHDL3TvU0 D09bY4P7ZOMlozsa7sw2IkYoawbedDp33z0i3GMNxnHvZIQ434AMYEDibrNMT6nYgbODQjlReDEe x0E6TeYoETGCAl4wggJaAgEBMFwwTDELMAkGA1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24g bnYtc2ExIjAgBgNVBAMTGUdsb2JhbFNpZ24gSFYgUy9NSU1FIENBIDECDATC6zEe4fWI0fFOPzAN BglghkgBZQMEAgEFAKCB1DAvBgkqhkiG9w0BCQQxIgQgkGd7yUpVQWRRlBUV1XmUIikaKTbvaVXu hr+oc+fPt1YwGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMTkwODE5 MTg0NjU5WjBpBgkqhkiG9w0BCQ8xXDBaMAsGCWCGSAFlAwQBKjALBglghkgBZQMEARYwCwYJYIZI AWUDBAECMAoGCCqGSIb3DQMHMAsGCSqGSIb3DQEBCjALBgkqhkiG9w0BAQcwCwYJYIZIAWUDBAIB MA0GCSqGSIb3DQEBAQUABIIBAD8BJX2rvyFYTVeribEbjpPTCUSwb3Cb5o2P9W5XH1FXrnhxGH1k S3ZituT4RCLuXvU2IVeqQ9HvKx3GeGZbdfGdG3X8+njPd/C1OdTGpLoWveXlwMjdLVI2YxXNs1oJ jV4LiKKSsMED7B7vLF7M+L+YMfmS7EpCG52C2LAXFzFzL/0jfk2FGeu1XCtFjJaRPCos9Voqg6ic 1hCm1z1+5qz+C8Q5R7lyBVcT81NfWn8tMeLfBpp9dgqduk2IqG320RyOmLembwgaekyH5XFVd9n2 FbYWBgLVRwEMiGVPCF3bn3z6Ovjx/C7ne6IQPOsk84JLWFUyvf92hLtSzu+4jhw= --000000000000dd38db05907cc3be-- From nobody Mon Aug 19 11:51:30 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 13B2B120845 for ; Mon, 19 Aug 2019 11:51:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.98 X-Spam-Level: X-Spam-Status: No, score=-1.98 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, T_SPF_HELO_PERMERROR=0.01, T_SPF_PERMERROR=0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nostrum.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id njdRaRPOGm2O for ; Mon, 19 Aug 2019 11:51:27 -0700 (PDT) Received: from nostrum.com (raven-v6.nostrum.com [IPv6:2001:470:d:1130::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6969B12084C for ; Mon, 19 Aug 2019 11:51:27 -0700 (PDT) Received: from MacBook-Pro.roach.at (99-152-146-228.lightspeed.dllstx.sbcglobal.net [99.152.146.228]) (authenticated bits=0) by nostrum.com (8.15.2/8.15.2) with ESMTPSA id x7JIpMv5000513 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NO); Mon, 19 Aug 2019 13:51:23 -0500 (CDT) (envelope-from adam@nostrum.com) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=nostrum.com; s=default; t=1566240684; bh=qa67rL2Ru1YPmsey6odq7ofWghgFV7FJ5k5ZyD51g2w=; h=Subject:To:Cc:References:From:Date:In-Reply-To; b=e+PRRyPTFojRVRTRqTw6p7kobwDdmp0Y3R1YYu/rf/YhKWxWOA6VTLONTANwf3g4o 0JE01i57SetVP/D3XJc0f1OYQd/WGUjkKrRfSrBcAsm+pu4cIb9MS8sTqLrOD0dfI1 ajDbPHwLo69vqrydY1RvuR6tJDvJzfHr/5f7b4XY= X-Authentication-Warning: raven.nostrum.com: Host 99-152-146-228.lightspeed.dllstx.sbcglobal.net [99.152.146.228] claimed to be MacBook-Pro.roach.at To: Ray Bellis Cc: ADD Mailing list References: <20190817170031.6F71C1691138@fafnir.remote.dragon.net> <5ED23002-7608-4A76-8181-E344E3FC6469@fugue.com> <3a0bf623-3aee-4d4d-fff0-4d127a81bbae@bellis.me.uk> <828f51ce-d551-dc39-83d2-008f31e9f09a@bellis.me.uk> From: Adam Roach Message-ID: Date: Mon, 19 Aug 2019 13:51:16 -0500 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: <828f51ce-d551-dc39-83d2-008f31e9f09a@bellis.me.uk> Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Content-Language: en-US Archived-At: Subject: Re: [Add] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 19 Aug 2019 18:51:29 -0000 On 8/19/19 1:39 PM, Ray Bellis wrote: > In both cases, the block is "legal" so what's to be gained by > requiring publication of the list? Transparency. A free society shouldn't have to rely on cobbled-together ad-hoc approaches like https://www.blocked.org.uk/ to find out what is being censored by a government, especially when over-blocking is manifestly a problem. I mean, blocking services without public visibility and accountability can certainly continue to operate, but I don't see why any specific organization should be compelled to endorse them. /a From nobody Mon Aug 19 13:34:06 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 67588120048 for ; Mon, 19 Aug 2019 13:34:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iWfUrY4MOoNR for ; Mon, 19 Aug 2019 13:34:03 -0700 (PDT) Received: from mail-io1-xd32.google.com (mail-io1-xd32.google.com [IPv6:2607:f8b0:4864:20::d32]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1E3C2120045 for ; Mon, 19 Aug 2019 13:34:03 -0700 (PDT) Received: by mail-io1-xd32.google.com with SMTP id t3so7219611ioj.12 for ; Mon, 19 Aug 2019 13:34:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to; bh=TPrvF+bqmCR9+OUFTVlKpKXIh7bCcTsIeUUJOzOMCJs=; b=VPk5rhRaH06yOAFhB8WJ9ySsOpaU2jsSGFZvd/ON4N8pcnUggWSUAKPuL/Vacrheis 0R2xAW+uG4uJtuBLgZdnPKYFAnbdKrrc9LXyYEUS+NvRTBXvHJIvvIs1rfNGXhCFwRj6 rU6FqCXmTj1QTgasIQwJqZpzrVcuPNcgdtBlnbBwE0qqt43SJVmn6JH09Lj/lMPByK4I f5/lupA/E+iNEdBZycw2fTKpz+RbVqIOi34lUebMqRmbbta9uP1VpNjUQF0J4jddiAj0 6ym2DCvchG5GZKuT97VLLzhwOpCBfdfOyQ7wTwTK5q51e/nMN7E58/SUwR/S5O6P+ATi j8mw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to; bh=TPrvF+bqmCR9+OUFTVlKpKXIh7bCcTsIeUUJOzOMCJs=; b=njm3hOrIUj/1mv/HDWWMthpvSaYpimfv7bBv0NZKKSm1NNSY4gJTwUiudcEqFTtJkL 9LUKwQWH97aCJT9pftgmH4BUaMyq+YQ0ws8FWnPou9kRWZYYZIPtxDWzcLbQNqMKD6M0 5BzpRAna/PJsJ9zxDCQP/0F9AxQ0FgDc334vhWMYdHLRQZI9YrfjZ8y5t2zlEo/ylQAN WzRlkAsT4hipaihcPPih7w2+yyyupWilNupicJXduATv7hsK6XEI8gdNf17+/Om8L/Hb 9HSfhnv1m8DHz4lPd1ffB1vU1a6OBo4buNUXTz/nLSjPCJOYD/jVhLCH+yT1MiFOhV9Q n/8g== X-Gm-Message-State: APjAAAVHcy3ONL/EwdGujJW7bs9MZActUDIotjOTrQgyD3blNmiGovlT LgNfSjVFZyoVW7yJrK+7RFMi1saO2e/oBHDenyjbxIzn X-Google-Smtp-Source: APXvYqwcdjTIKtcv0YcBSLhBAzR9khemoV89y77FLSchfALji/qbhNKqOxUjrWaKTDhG/IRaMpDssaXjko8v03GWwII= X-Received: by 2002:a05:6602:98:: with SMTP id h24mr28181609iob.49.1566246841833; Mon, 19 Aug 2019 13:34:01 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Rob Sayre Date: Mon, 19 Aug 2019 13:33:50 -0700 Message-ID: To: ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000a35d6a05907e427b" Archived-At: Subject: Re: [Add] Home routers with their own DNS servers X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 19 Aug 2019 20:34:05 -0000 --000000000000a35d6a05907e427b Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Someone asked which model this is. It=E2=80=99s a TP-Link manufactured OnHu= b device that costs about $50-60. You can see the management app in the product photography. https://on.google.com/hub/ It doesn=E2=80=99t have a configuration web server. You have to authenticat= e an iOS or Android app using sounds from its built in speaker. It=E2=80=99s been on the market for about 3 years, but I don=E2=80=99t know= if it=E2=80=99s always used Google DNS by default. thanks, Rob On Sun, Aug 18, 2019 at 10:53 AM Rob Sayre wrote: > It looks like it uses some local telemetry to decide whether to use the > ISP's DNS servers. > > I've attached a screenshot of its management application. > > thanks, > Rob > > > On Sun, Aug 18, 2019 at 10:24 AM Rob Sayre wrote: > >> Hi, >> >> I was reading the paper ekr recommended: >> >> < >> https://www.usenix.org/system/files/conference/usenixsecurity18/sec18-li= u_0.pdf >> > >> >> and I noticed they provide a service here: >> >> >> >> I ran this in Firefox with DoH. As expected, I got a result that >> indicated my resolver was Cloudflare. >> >> In other browsers, I found that my resolver was run by Google[1]. I was = a >> little puzzled at first, since Google is not my ISP. But, then I remembe= red >> that my router is a Google Wifi product. I guess it uses its own DNS >> servers sometimes. I don't think it always does this, because I do >> occasionally see DNS redirect pages[2] from my ISP for NXDOMAIN response= s, >> although I don't right now. Another possibility is that my ISP sometimes >> intercepts this traffic. >> >> I only bring this up to point out how fluid the terms used on this list >> can be. I guess I'm the network administrator of my house, and it appear= s >> that I've purchased a router that uses Google's DNS servers by default >> (fine with me). I hope my router is using DoH or DoT. If it's not, it mi= ght >> get updated to do so at some point--its software self updates all the ti= me. >> >> thanks, >> Rob >> >> [1] https://www.whois.com/whois/172.253.0.2 >> [2] https://tools.ietf.org/html/draft-livingood-dns-redirect-03 >> > --000000000000a35d6a05907e427b Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Someone asked which model this is. It=E2=80=99s a TP= -Link manufactured OnHub device that costs about $50-60.

You can see the management app in th= e product photography.

It doesn=E2=80=99t have a configuration web= server. You have to authenticate an iOS or Android app using sounds from i= ts built in speaker.

It= =E2=80=99s been on the market for about 3 years, but I don=E2=80=99t know i= f it=E2=80=99s always used Google DNS by default.
thanks,
Rob


On Sun, Aug 18, 2019 at 10:53 AM Rob Sayre <sayrer@gmail.com> wrote:
It looks like it uses some local= telemetry to decide whether to use the ISP's DNS servers.

I've attached a screenshot of its management application.
<= div>
thanks,
Rob


On Sun, Aug 18= , 2019 at 10:24 AM Rob Sayre <sayrer@gmail.com> wrote:
Hi,

I was r= eading the paper ekr recommended:


and I noticed = they provide a service here:


I ran this in Firefox with DoH. As expecte= d, I got a result that indicated my resolver was Cloudflare.

=
In other browsers, I found that my resolver was run by Google[1]= . I was a little puzzled at first, since Google is not my ISP. But, then I = remembered that my router is a Google Wifi product. I guess it uses its own= DNS servers sometimes. I don't think it always does this, because I do= occasionally see DNS redirect pages[2] from my ISP for NXDOMAIN responses,= although I don't right now. Another possibility is that my ISP sometim= es intercepts this traffic.

I only bring this up t= o point out how fluid the terms used on this list can be. I guess I'm t= he network administrator of my house, and it appears that I've purchase= d a router that uses Google's DNS servers by default (fine with me). I = hope my router is using DoH or DoT. If it's not, it might get updated t= o do so at some point--its software self updates all the time.
thanks,
Rob

--000000000000a35d6a05907e427b-- From nobody Mon Aug 19 13:40:14 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D6B3B1208A5 for ; Mon, 19 Aug 2019 13:39:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lI6o4VvIbR3z for ; Mon, 19 Aug 2019 13:39:55 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [209.87.249.19]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F3BA7120879 for ; Mon, 19 Aug 2019 13:39:54 -0700 (PDT) Received: from sandelman.ca (obiwan.sandelman.ca [IPv6:2607:f0b0:f:2::247]) by tuna.sandelman.ca (Postfix) with ESMTP id 1D2F0380BE for ; Mon, 19 Aug 2019 16:38:58 -0400 (EDT) Received: from localhost (localhost [IPv6:::1]) by sandelman.ca (Postfix) with ESMTP id AB203F32 for ; Mon, 19 Aug 2019 16:39:53 -0400 (EDT) From: Michael Richardson To: ADD Mailing list In-Reply-To: <828f51ce-d551-dc39-83d2-008f31e9f09a@bellis.me.uk> References: <20190817170031.6F71C1691138@fafnir.remote.dragon.net> <5ED23002-7608-4A76-8181-E344E3FC6469@fugue.com> <3a0bf623-3aee-4d4d-fff0-4d127a81bbae@bellis.me.uk> <828f51ce-d551-dc39-83d2-008f31e9f09a@bellis.me.uk> X-Mailer: MH-E 8.6; nmh 1.7+dev; GNU Emacs 24.5.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: Re: [Add] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 19 Aug 2019 20:39:59 -0000 --=-=-= Content-Type: text/plain Ray Bellis wrote: > My personal view is that if the blocks are there because: > 1. the relevant legal authorities mandated it, and/or 2. the end user > opted into it (as permitted by TRR policy) > then it's none of Mozilla's business to require that the content of the > blocks be published. In both cases, the block is "legal" so what's to > be gained by requiring publication of the list? When a query is blocked, and one believes it was blocked inappropriately, knowing why it was blocked would tell you what your avenues for recourse are. -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAl1bCRkACgkQgItw+93Q 3WUhswf9Es9acS20gcGYCOiXjSKZc8lRisMjgoHBbnj/1H9RdTNe+lwVlouGzvn7 DO5NIyTtSuLugZgfVTZe0d4GAWqQrMqzllERk8RNnWACQJ3oN0KA7PLEr2KdcJh6 yiKJ9f3WJFd7zDz+b+IorX+OxvOjtMoAw1Y6DvxNBMLHJ/3AAg0wKWiMrr0l6d15 JdMGukE6zuxsOdGnj3CUu595pWHnrhOVuLNnNDP4AZ9tCYXPuWy1IUmlU7S+dP33 3Et+SK4Plh3oKwrpMR9Ynr5WMSN7OSEbgYeozrzDsUWtgh2lhJXSB75LC1KqW3O2 sdyAaA3nJX/AqdYiD1NGoEMXdRs+lw== =QvFS -----END PGP SIGNATURE----- --=-=-=-- From nobody Tue Aug 20 09:12:25 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 71A2C12095B for ; Tue, 20 Aug 2019 09:12:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=netorgft5189650.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qkfnvUAPbOEO for ; Tue, 20 Aug 2019 09:12:20 -0700 (PDT) Received: from GBR01-LO2-obe.outbound.protection.outlook.com (mail-eopbgr100059.outbound.protection.outlook.com [40.107.10.59]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 60D531200EB for ; Tue, 20 Aug 2019 09:12:20 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=gSgMUgi5r2zgZ2IgqvTOVnqZ9PyYIyXYGy8zg7QxKr5QiezZF6EduG2/9aSUb5aqFhnXiw0kUPXXZVGM2nm00RWjHIz/Kdxf+6BBGdBn2SYq1kgi8V+P8rzeE9D2IUtAaFIYE5b7LIV3MegHTLXX/1zpmWxazZ6e5lh4ACmGnUJZcr8HGK1HSIlYxnzQT9pRAOQfVjBNM+7k5hvNhsDW9qDD8kgNHzkdnkTkGPEGCWeLnEnBzHGPERVBTVAaH/qjqsdgrkPMAeo6p1oy+vWQu6bFwbvnd6nCAYtPoQ6RchWGCsVcGZyD1vy7anRs0dq6rnFNIqC3cOqKFmWfLBJ5Fw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=B+Oevfx6wYID6uIxG03xMKUExe+ChocCX0O+yIhIEYU=; b=hiCupLRjXo9p2NCMpL+R49nudOGUCVuofQ/OyzXfPVBaq7BRf7ibZ/e+VY//VDqzW86T18zdWK+q+tMaI60rcmFcN/zBHB5kBjorZ1hSSpEMHmms4J/q2tPu6jQxYxyCJhB7AhPCv8YjSSm8cjfGB6G//rn1QiNdFqyJa6GrwCGVJxjjeTw8+kcdy9qRg3xPJ3d4Vsc3OBQ20uxY2VuCUylIr75OPyaU/muXboLdggJf2tLCTFEwwX7ZBwyJkqU6F5wvSwKhItZdqqYkVcUghhKLU4XPDofLDncnbFNi71VMzePFBlhMTrlVfbqOMiJ34zU5XzHPl9uYApZp9c98Jg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=419.consulting; dmarc=pass action=none header.from=419.consulting; dkim=pass header.d=419.consulting; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=NETORGFT5189650.onmicrosoft.com; s=selector1-NETORGFT5189650-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=B+Oevfx6wYID6uIxG03xMKUExe+ChocCX0O+yIhIEYU=; b=D7/1CEhf82LyxvDnDLRaL0+v0Mz8yyBUj0ELnZ/NOtcNZvc0GJ1XoajpRKsRLA8dVfDcA+vEdEOvBRTKpdFOCA4o0mH/7DsTTgBCixKIUumqiT/5s7fwSY0clnO08Xe+DvQccFu3jSDiJWwp/TrGospBDB6wMwEenTBQMJvsd2Q= Received: from LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM (20.176.138.146) by LO2P265MB0544.GBRP265.PROD.OUTLOOK.COM (10.166.103.15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2178.18; Tue, 20 Aug 2019 16:12:17 +0000 Received: from LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM ([fe80::64e9:9b9e:59fc:26f]) by LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM ([fe80::64e9:9b9e:59fc:26f%5]) with mapi id 15.20.2178.018; Tue, 20 Aug 2019 16:12:17 +0000 From: Andrew Campling To: Adam Roach , Ray Bellis CC: ADD Mailing list Thread-Topic: [Add] Participation Thread-Index: AQHVVsBt6YZNf47BsUqAAI1uhecZoqcEMlbw Date: Tue, 20 Aug 2019 16:12:17 +0000 Message-ID: References: <20190817170031.6F71C1691138@fafnir.remote.dragon.net> <5ED23002-7608-4A76-8181-E344E3FC6469@fugue.com> <3a0bf623-3aee-4d4d-fff0-4d127a81bbae@bellis.me.uk> <828f51ce-d551-dc39-83d2-008f31e9f09a@bellis.me.uk> In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=andrew.campling@419.consulting; x-originating-ip: [2a00:23c4:a499:2e00:75a8:a800:6507:148e] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 37746d0e-fa32-4b8b-e705-08d725892bff x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(7021145)(8989299)(5600148)(711020)(4605104)(1401327)(4534185)(7022145)(4603075)(4627221)(201702281549075)(8990200)(7048125)(7024125)(7027125)(7023125)(2017052603328)(7193020); SRVR:LO2P265MB0544; x-ms-traffictypediagnostic: LO2P265MB0544: x-ms-exchange-purlcount: 1 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-forefront-prvs: 013568035E x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(39830400003)(136003)(396003)(376002)(346002)(366004)(189003)(199004)(81156014)(8936002)(8676002)(74316002)(33656002)(229853002)(81166006)(66446008)(66946007)(66476007)(4326008)(66556008)(64756008)(53936002)(76116006)(6246003)(7736002)(52536014)(5660300002)(71190400001)(71200400001)(76176011)(6116002)(2906002)(7696005)(110136005)(256004)(53546011)(6506007)(14444005)(25786009)(316002)(102836004)(186003)(99286004)(14454004)(55016002)(86362001)(6436002)(486006)(476003)(305945005)(11346002)(446003)(508600001)(9686003)(966005)(44832011)(6306002)(46003)(46492003); DIR:OUT; SFP:1101; SCL:1; SRVR:LO2P265MB0544; H:LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: 419.consulting does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: 6b1i1L8ZNvv1zvuSSQt3VSAitTSLw08+Xc9dqAKvWUuvLaEp2Thoii+oEtEH/frcbFhn5iZirlIKjcNXFCwN2QDo5yyLiUsbpovcRc/AUqsEYos4zHqsQ0PTt6Pod0rFfcH3Ma2/KQ4Gkjk3AJoRsRFuslU5+k2n58xvTCKcS0cq4+RTPaYcIEwaxgOMkJkaWnIYPPmy2GlOr8aMCesRby1R6PyvT/h7drCsjoDMxTlVzfP003ZC4qqX6XHZ5Rxy3Sl2P6cAJDz21rd06wn6LsieHjc5bQvR/efnjbK5t6uQp7olcpcZeyZNWkwsVsHN42v0a/RHb65oaUvordaColEvhfjFxOMmnMAFOK9bby8tIBjNZFyKW429bXkIzXLtGPmMWDBVCVVDV5IW74hVgKY4yKYhZgIVGtEI2R9ULlE= x-ms-exchange-transport-forked: True Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: 419.consulting X-MS-Exchange-CrossTenant-Network-Message-Id: 37746d0e-fa32-4b8b-e705-08d725892bff X-MS-Exchange-CrossTenant-originalarrivaltime: 20 Aug 2019 16:12:17.3893 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 9c2ced3e-7522-4755-87dc-f983abc66ec3 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: kUrSv8vZ0vqs9yA8gW89yGfM6NT4SF624VgTS8Nk4s4FAakL2osMIUPWBfN0Ly4VGIaySkyf+y5zWwdLxUUoGwWeOVGL9F1NhxoZ2Er7QWA= X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO2P265MB0544 Archived-At: Subject: Re: [Add] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 20 Aug 2019 16:12:23 -0000 T24gOC8xOS8xOSAxOTo1MSwgQWRhbSBSb2FjaCA8YWRhbUBub3N0cnVtLmNvbT4gd3JvdGU6DQoN Cj4+IE9uIDgvMTkvMTkgMTozOSBQTSwgUmF5IEJlbGxpcyB3cm90ZToNCj4+IEluIGJvdGggY2Fz ZXMsIHRoZSBibG9jayBpcyAibGVnYWwiIHNvIHdoYXQncyB0byBiZSBnYWluZWQgYnkgDQo+PiBy ZXF1aXJpbmcgcHVibGljYXRpb24gb2YgdGhlIGxpc3Q/DQoNCj4gVHJhbnNwYXJlbmN5LiBBIGZy ZWUgc29jaWV0eSBzaG91bGRuJ3QgaGF2ZSB0byByZWx5IG9uIGNvYmJsZWQtdG9nZXRoZXIgYWQt aG9jIGFwcHJvYWNoZXMgDQo+IGxpa2UgaHR0cHM6Ly93d3cuYmxvY2tlZC5vcmcudWsvIHRvIGZp bmQgb3V0IHdoYXQgaXMgYmVpbmcgY2Vuc29yZWQgYnkgYSBnb3Zlcm5tZW50LCBlc3BlY2lhbGx5 IA0KPiB3aGVuIG92ZXItYmxvY2tpbmcgaXMgbWFuaWZlc3RseSBhIHByb2JsZW0uDQoNCj4gSSBt ZWFuLCBibG9ja2luZyBzZXJ2aWNlcyB3aXRob3V0IHB1YmxpYyB2aXNpYmlsaXR5IGFuZCBhY2Nv dW50YWJpbGl0eSBjYW4gY2VydGFpbmx5IGNvbnRpbnVlIHRvIA0KPiBvcGVyYXRlLCBidXQgSSBk b24ndCBzZWUgd2h5IGFueSBzcGVjaWZpYyBvcmdhbml6YXRpb24gc2hvdWxkIGJlIGNvbXBlbGxl ZCB0byBlbmRvcnNlIHRoZW0uDQoNCkl0J3Mgd29ydGggYmVhcmluZyBpbiBtaW5kIHRoYXQgYmxv Y2tpbmcgaW4gdGhlIFVLIC8gRXVyb3BlIGNhbiBhcmlzZSBiZWNhdXNlIG9mIGxlZ2FsIHJlcXVp cmVtZW50cyBzdWNoIGFzIHRvIGJhciBhY2Nlc3MgdG8gY2hpbGQgYWJ1c2UgbWF0ZXJpYWwsIG90 aGVyIGlsbGVnYWwgY29udGVudCBzdWNoIGFzIHRlcnJvcmlzbS1yZWxhdGVkIG1hdGVyaWFsICh3 aGljaCB3b3VsZCByZXF1aXJlIGEgY291cnQgb3JkZXIsIHJlZ3VsYXRvcnkgaW5zdHJ1Y3Rpb24g b3Igc2ltaWxhciksIGFuZCB0byBiYXIgYWNjZXNzIHRvIGNvcHlyaWdodC1pbmZyaW5naW5nIGNv bnRlbnQuICBUaGUgbGF0dGVyIHdvdWxkIGJlIGRyaXZlbiBieSBhIGNvdXJ0IG9yZGVyIGZyb20g dGhlIHJpZ2h0cyBob2xkZXIgcmF0aGVyIHRoYW4gZ292ZXJubWVudC4gIEluIGFsbCB0aHJlZSBj YXNlcywgbGVnaXNsYXRpb24gYW5kL29yIGNvdXJ0IG9yZGVycyB1bmRlcnBpbiB0aGUgYmxvY2tz IHNvIHRoZXJlIGlzIGEgcHJvY2VzcyB0byBnbyB0aHJvdWdoIC0gSVNQcyBjYW5ub3QgZWxlY3Qg dG8gYmxvY2sgYWNjZXNzIHVuZGVyIHRoZWlyIG93biB2b2xpdGlvbiBvdGhlcndpc2UgdGhleSB3 b3VsZCB0aGVtc2VsdmVzIGJlIG9wZW4gdG8gY2hhbGxlbmdlIGluIHRoZSBjb3VydHMuICBJZiBu b24tSVNQIHJlc29sdmVycyBiZWNvbWUgbW9yZSBwcmV2YWxlbnQgdGhlbiBJIHN1c3BlY3QgdGhl eSB3b3VsZCBhbHNvIGJlIGNvdmVyZWQgYnkgdGhlIHNjb3BlIG9mIGNvdXJ0IG9yZGVycyBibG9j a2luZyBhY2Nlc3MgdG8gc3BlY2lmaWVkIGNvbnRlbnQuICANCg0KQXMgdG8gd2hldGhlciBhbnkg c3BlY2lmaWMgb3JnYW5pc2F0aW9uIHNob3VsZCBiZSBjb21wZWxsZWQgdG8gZW5kb3JzZSBzdWNo IGFuIGFwcHJvYWNoLCBpdCdzIHRoZSBjb3N0IG9mIGRvaW5nIGJ1c2luZXNzIGluIHBhcnRpY3Vs YXIgbWFya2V0cywgaXMgbm8gZGlmZmVyZW50IHRvIGhhdmluZyB0byBjb21wbHkgdG8gR0RQUiBh bmQgZVByaXZhY3kgaWYgb3BlcmF0aW5nIGluIEV1cm9wZS4gIA0KDQoNCkFuZHJldyANCg0K From nobody Tue Aug 20 09:22:00 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D009B12097C for ; Tue, 20 Aug 2019 09:21:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=portfast.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jyOL0OxVi7Y0 for ; Tue, 20 Aug 2019 09:21:57 -0700 (PDT) Received: from mail.portfast.net (mail.portfast.net [IPv6:2a03:9800:20:1::2]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D7AB312082C for ; Tue, 20 Aug 2019 09:21:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=portfast.net; s=dkim; h=Content-Transfer-Encoding:Content-Type:In-Reply-To: MIME-Version:Date:Message-ID:From:References:To:Subject:Sender:Reply-To:Cc: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=qkoDboIIiqVm6Y5QBWqpsIXMBVpY8TGqCwV2Wi3Ro50=; b=mQ16Dlj0TnvjW04zt02CbgPHuH SGZfQIu9IzTGoXm7B+CkCov2obNxME9H1hUqZz/nFz3PhVdRIjmQ1sUSsd+NRzHtGo9ToTG8dJ21P cB7nyDhInVDdk+0cgNrzdSRZTN87N0xIa4L2mgMwI+Vv1wt2ANJomaI3dfo9Zw1CY0OM=; Received: from [88.212.170.135] (port=62467 helo=Rays-MacBook-Pro.local) by mail.portfast.net ([188.246.200.9]:465) with esmtpsa (fixed_plain:ray@bellis.me.uk) (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) id 1i06tP-0005aJ-2s (Exim 4.89) for add@ietf.org (return-path ); Tue, 20 Aug 2019 16:21:55 +0000 To: add@ietf.org References: <20190817170031.6F71C1691138@fafnir.remote.dragon.net> <5ED23002-7608-4A76-8181-E344E3FC6469@fugue.com> <3a0bf623-3aee-4d4d-fff0-4d127a81bbae@bellis.me.uk> <828f51ce-d551-dc39-83d2-008f31e9f09a@bellis.me.uk> <6109.1566247193@localhost> From: Ray Bellis Message-ID: <20e87cd3-b27a-0a2a-e24d-c6c9eb1100bb@bellis.me.uk> Date: Tue, 20 Aug 2019 17:21:54 +0100 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: <6109.1566247193@localhost> Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-GB Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [Add] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 20 Aug 2019 16:21:59 -0000 On 19/08/2019 21:39, Michael Richardson wrote: > When a query is blocked, and one believes it was blocked > inappropriately, knowing why it was blocked would tell you what your > avenues for recourse are. The content was either blocked because the authorities mandated it, or because you opted-in to filtering. In the former case you have no recourse. In the latter case, you can opt-out again, eliminating the second possibility. What I didn't see yet is any discussion as to how an individual DoH user can actually opt-in. Ray From nobody Tue Aug 20 10:22:58 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 01F5912082C for ; Tue, 20 Aug 2019 10:22:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.5 X-Spam-Level: X-Spam-Status: No, score=-17.5 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id okg8QOqQL1CT for ; Tue, 20 Aug 2019 10:22:55 -0700 (PDT) Received: from mail-wm1-x330.google.com (mail-wm1-x330.google.com [IPv6:2a00:1450:4864:20::330]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0C1E7120232 for ; Tue, 20 Aug 2019 10:22:55 -0700 (PDT) Received: by mail-wm1-x330.google.com with SMTP id o4so3321984wmh.2 for ; Tue, 20 Aug 2019 10:22:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=OSK4MxpOH6uNB/lpqEsE1JDZhKSndzXa9jftTVDqZcM=; b=vT0paYKgIsTDOlZYzJxZ4ibNNAbB6AcDevQqIoiqF+qJ2cdkNNOHgAfpAHTHhGI4Yf M6KhLn00qSkNjAfLJVxIbPbJAgP01QSQp3LphUlrDRUf0fEjGEcUGjT0kZJoMdQX6uCF Lljs5SaFcoSbiH/W5kmtX83hOznK/XePbOmJDZ0tIbmL8qGFAjq3wn2Z3TnHAiTZXFFC PNnAPQsHs2zygzhP+y7GJBUI0LrWmG8aQ2ornAcXgu4GGlFp1dxgGPd6s8xLG6Vr0JDp 1rDBYz8ZIsgS2VqK2UZVZHi2i/pt1TL2yZ+oAq2T1Hpd1v4HhNl9kptSW+ybaGJORYwL GC/Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=OSK4MxpOH6uNB/lpqEsE1JDZhKSndzXa9jftTVDqZcM=; b=i5MbCpv6hPQVMZwDeK8GXtYVEerxpIFtwRO+s/K9ZZqkH8Q71V4kCD4dUvHk6WUOLF rcQGRk2MCYoTKLKQe5w/M+LmJvInoLhpXQqNV0bsXAwnncRt5FJ3m3EOEqXUmubM94Y7 KTo06u/WCH9nPtOR/si9tIYlcQU1MOKCRyEwHAAoM6ePN0qaHmSV9Huq5kGBKnXlV7DO qGWjBkv2ulgJmp+eylgXeJvauEkO1IboELWsKVFXqC1P9sevy1W4fDR4+ZawlYI0MIXP ti/qKUIkEOeoBGGgMQONmmjxROS20efpQQdu4qJrngYx6TKsnMJD5pSusaOQ38xS6gc2 Nfpg== X-Gm-Message-State: APjAAAV5Bd/Y+rME9SxmoEcu8UiqLBFq0sUHJJV+1V5Vj5czduQ3zPbb 0G+x8tISQwMfeZ3FhfuoxiuMsrXG9JA9rtpyKSN6qg== X-Google-Smtp-Source: APXvYqwEn9LrL5xs5gdIJnLgD/THZ94pmlvNv+uKT849iJMGsgB0lp3yB7N+wN28tODRRyQdztOSECuAIKnIA3AzylQ= X-Received: by 2002:a1c:ca0c:: with SMTP id a12mr1101823wmg.71.1566321772757; Tue, 20 Aug 2019 10:22:52 -0700 (PDT) MIME-Version: 1.0 References: <20190817170031.6F71C1691138@fafnir.remote.dragon.net> <5ED23002-7608-4A76-8181-E344E3FC6469@fugue.com> <3a0bf623-3aee-4d4d-fff0-4d127a81bbae@bellis.me.uk> <828f51ce-d551-dc39-83d2-008f31e9f09a@bellis.me.uk> <6109.1566247193@localhost> <20e87cd3-b27a-0a2a-e24d-c6c9eb1100bb@bellis.me.uk> In-Reply-To: <20e87cd3-b27a-0a2a-e24d-c6c9eb1100bb@bellis.me.uk> From: Erik Kline Date: Tue, 20 Aug 2019 10:22:37 -0700 Message-ID: To: Ray Bellis Cc: add@ietf.org Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="000000000000eb2f6d05908fb489" Archived-At: Subject: Re: [Add] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 20 Aug 2019 17:22:57 -0000 --000000000000eb2f6d05908fb489 Content-Type: multipart/alternative; boundary="000000000000df32cb05908fb4fa" --000000000000df32cb05908fb4fa Content-Type: text/plain; charset="UTF-8" > > What I didn't see yet is any discussion as to how an individual DoH user > can actually opt-in. > And maybe that's one short doc that should get written (maybe it's already written somewhere?): A statement that applications and operating systems should generally [1] follow the express configuration intent of device owners/users, and [2] if not available, use the network-provisioned service(s). Applications choosing to do their own nameservice resolution to a service other than those above (with exceptions for things like diagnostic and measurement purposes) risk having an IETF kilo-thread devoted to berating them (and maybe a few other consequences too ;-). --000000000000df32cb05908fb4fa Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
What I didn't see yet is any discussion as to how an= individual DoH user
can actually opt-in.

And maybe that'= ;s one short doc that should get written (maybe it's already written so= mewhere?):

=C2=A0 =C2=A0A statement that applicati= ons and operating systems should generally
=C2=A0 =C2=A0 =C2=A0 [= 1] follow the express configuration intent of device owners/users, and
=C2=A0 =C2=A0 =C2=A0 [2] if not available, use the network-provisione= d service(s).

Applications choosing to do their ow= n nameservice resolution to a service other than those above (with exceptio= ns for things like diagnostic and measurement purposes) risk having an IETF= kilo-thread devoted to berating them (and maybe=C2=A0a few other consequen= ces too ;-).
--000000000000df32cb05908fb4fa-- --000000000000eb2f6d05908fb489 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIIS3wYJKoZIhvcNAQcCoIIS0DCCEswCAQExDzANBglghkgBZQMEAgEFADALBgkqhkiG9w0BBwGg ghBFMIIEXDCCA0SgAwIBAgIOSBtqDm4P/739RPqw/wcwDQYJKoZIhvcNAQELBQAwZDELMAkGA1UE BhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVy c29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hBMjU2IC0gRzIwHhcNMTYwNjE1MDAwMDAwWhcNMjEw NjE1MDAwMDAwWjBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xvYmFsU2lnbiBudi1zYTEiMCAG A1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC AQoCggEBALR23lKtjlZW/17kthzYcMHHKFgywfc4vLIjfq42NmMWbXkNUabIgS8KX4PnIFsTlD6F GO2fqnsTygvYPFBSMX4OCFtJXoikP2CQlEvO7WooyE94tqmqD+w0YtyP2IB5j4KvOIeNv1Gbnnes BIUWLFxs1ERvYDhmk+OrvW7Vd8ZfpRJj71Rb+QQsUpkyTySaqALXnyztTDp1L5d1bABJN/bJbEU3 Hf5FLrANmognIu+Npty6GrA6p3yKELzTsilOFmYNWg7L838NS2JbFOndl+ce89gM36CW7vyhszi6 6LqqzJL8MsmkP53GGhf11YMP9EkmawYouMDP/PwQYhIiUO0CAwEAAaOCASIwggEeMA4GA1UdDwEB /wQEAwIBBjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwEgYDVR0TAQH/BAgwBgEB/wIB ADAdBgNVHQ4EFgQUyzgSsMeZwHiSjLMhleb0JmLA4D8wHwYDVR0jBBgwFoAUJiSSix/TRK+xsBtt r+500ox4AAMwSwYDVR0fBEQwQjBAoD6gPIY6aHR0cDovL2NybC5nbG9iYWxzaWduLmNvbS9ncy9n c3BlcnNvbmFsc2lnbnB0bnJzc2hhMmcyLmNybDBMBgNVHSAERTBDMEEGCSsGAQQBoDIBKDA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzANBgkqhkiG 9w0BAQsFAAOCAQEACskdySGYIOi63wgeTmljjA5BHHN9uLuAMHotXgbYeGVrz7+DkFNgWRQ/dNse Qa4e+FeHWq2fu73SamhAQyLigNKZF7ZzHPUkSpSTjQqVzbyDaFHtRBAwuACuymaOWOWPePZXOH9x t4HPwRQuur57RKiEm1F6/YJVQ5UTkzAyPoeND/y1GzXS4kjhVuoOQX3GfXDZdwoN8jMYBZTO0H5h isymlIl6aot0E5KIKqosW6mhupdkS1ZZPp4WXR4frybSkLejjmkTYCTUmh9DuvKEQ1Ge7siwsWgA NS1Ln+uvIuObpbNaeAyMZY0U5R/OyIDaq+m9KXPYvrCZ0TCLbcKuRzCCBB4wggMGoAMCAQICCwQA AAAAATGJxkCyMA0GCSqGSIb3DQEBCwUAMEwxIDAeBgNVBAsTF0dsb2JhbFNpZ24gUm9vdCBDQSAt IFIzMRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWduMB4XDTExMDgwMjEw MDAwMFoXDTI5MDMyOTEwMDAwMFowZDELMAkGA1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24g bnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVyc29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hB MjU2IC0gRzIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCg/hRKosYAGP+P7mIdq5NB Kr3J0tg+8lPATlgp+F6W9CeIvnXRGUvdniO+BQnKxnX6RsC3AnE0hUUKRaM9/RDDWldYw35K+sge C8fWXvIbcYLXxWkXz+Hbxh0GXG61Evqux6i2sKeKvMr4s9BaN09cqJ/wF6KuP9jSyWcyY+IgL6u2 52my5UzYhnbf7D7IcC372bfhwM92n6r5hJx3r++rQEMHXlp/G9J3fftgsD1bzS7J/uHMFpr4MXua eoiMLV5gdmo0sQg23j4pihyFlAkkHHn4usPJ3EePw7ewQT6BUTFyvmEB+KDoi7T4RCAZDstgfpzD rR/TNwrK8/FXoqnFAgMBAAGjgegwgeUwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8C AQEwHQYDVR0OBBYEFCYkkosf00SvsbAbba/udNKMeAADMEcGA1UdIARAMD4wPAYEVR0gADA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzA2BgNVHR8E LzAtMCugKaAnhiVodHRwOi8vY3JsLmdsb2JhbHNpZ24ubmV0L3Jvb3QtcjMuY3JsMB8GA1UdIwQY MBaAFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQACAFVjHihZCV/IqJYt 7Nig/xek+9g0dmv1oQNGYI1WWeqHcMAV1h7cheKNr4EOANNvJWtAkoQz+076Sqnq0Puxwymj0/+e oQJ8GRODG9pxlSn3kysh7f+kotX7pYX5moUa0xq3TCjjYsF3G17E27qvn8SJwDsgEImnhXVT5vb7 qBYKadFizPzKPmwsJQDPKX58XmPxMcZ1tG77xCQEXrtABhYC3NBhu8+c5UoinLpBQC1iBnNpNwXT Lmd4nQdf9HCijG1e8myt78VP+QSwsaDT7LVcLT2oDPVggjhVcwljw3ePDwfGP9kNrR+lc8XrfClk WbrdhC2o4Ui28dtIVHd3MIIDXzCCAkegAwIBAgILBAAAAAABIVhTCKIwDQYJKoZIhvcNAQELBQAw TDEgMB4GA1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjMxEzARBgNVBAoTCkdsb2JhbFNpZ24x EzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMDkwMzE4MTAwMDAwWhcNMjkwMzE4MTAwMDAwWjBMMSAw HgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMzETMBEGA1UEChMKR2xvYmFsU2lnbjETMBEG A1UEAxMKR2xvYmFsU2lnbjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMwldpB5Bngi FvXAg7aEyiie/QV2EcWtiHL8RgJDx7KKnQRfJMsuS+FggkbhUqsMgUdwbN1k0ev1LKMPgj0MK66X 17YUhhB5uzsTgHeMCOFJ0mpiLx9e+pZo34knlTifBtc+ycsmWQ1z3rDI6SYOgxXG71uL0gRgykmm KPZpO/bLyCiR5Z2KYVc3rHQU3HTgOu5yLy6c+9C7v/U9AOEGM+iCK65TpjoWc4zdQQ4gOsC0p6Hp sk+QLjJg6VfLuQSSaGjlOCZgdbKfd/+RFO+uIEn8rUAVSNECMWEZXriX7613t2Saer9fwRPvm2L7 DWzgVGkWqQPabumDk3F2xmmFghcCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQF MAMBAf8wHQYDVR0OBBYEFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQBL QNvAUKr+yAzv95ZURUm7lgAJQayzE4aGKAczymvmdLm6AC2upArT9fHxD4q/c2dKg8dEe3jgr25s bwMpjjM5RcOO5LlXbKr8EpbsU8Yt5CRsuZRj+9xTaGdWPoO4zzUhw8lo/s7awlOqzJCK6fBdRoyV 3XpYKBovHd7NADdBj+1EbddTKJd+82cEHhXXipa0095MJ6RMG3NzdvQXmcIfeg7jLQitChws/zyr VQ4PkX4268NXSb7hLi18YIvDQVETI53O9zJrlAGomecsMx86OyXShkDOOyyGeMlhLxS67ttVb9+E 7gUJTb0o2HLO02JQZR7rkpeDMdmztcpHWD9fMIIEXDCCA0SgAwIBAgIMBMLrMR7h9YjR8U4/MA0G CSqGSIb3DQEBCwUAMEwxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMSIw IAYDVQQDExlHbG9iYWxTaWduIEhWIFMvTUlNRSBDQSAxMB4XDTE5MDUxMTA2MzcyMVoXDTE5MTEw NzA2MzcyMVowHjEcMBoGCSqGSIb3DQEJAQwNZWtAZ29vZ2xlLmNvbTCCASIwDQYJKoZIhvcNAQEB BQADggEPADCCAQoCggEBAIzvCZRYLgadqUeydXNClNcpp0n53ELy/HcLruB13xvxxIBN/ttsev7i GAEdHsf7onTDWUwPFcROr8DiA6mA1/A1w/kImnZ/QAf7HsRvsEj5Y5oaefxk658HhBqqpJEkRdWe u6sxrMYSwss5RhScJmurP/pXIQALbexgl7dvcNtqFR5QM5VpIVCrw4HYbSSFH1Cq+hByCa8a3soW CVDLTedx4jeBdqhbuqXy8KlOU3QHjL0aYbROgRTwRv0j/TWlqMvSxaasFWy6WqU1ULYZ+1eDE6Ig nfqlBvxUpcfy+zgS8NwkCt6Rrf+FNzN2th9Lapizgq+YyuXarLRkM2tqM+kCAwEAAaOCAWowggFm MBgGA1UdEQQRMA+BDWVrQGdvb2dsZS5jb20wUAYIKwYBBQUHAQEERDBCMEAGCCsGAQUFBzAChjRo dHRwOi8vc2VjdXJlLmdsb2JhbHNpZ24uY29tL2NhY2VydC9nc2h2c21pbWVjYTEuY3J0MB0GA1Ud DgQWBBTOji1Lw0P4qSg4yeWN6IYVO0d4RzAfBgNVHSMEGDAWgBTLOBKwx5nAeJKMsyGV5vQmYsDg PzBMBgNVHSAERTBDMEEGCSsGAQQBoDIBKDA0MDIGCCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9i YWxzaWduLmNvbS9yZXBvc2l0b3J5LzA7BgNVHR8ENDAyMDCgLqAshipodHRwOi8vY3JsLmdsb2Jh bHNpZ24uY29tL2dzaHZzbWltZWNhMS5jcmwwDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsG AQUFBwMCBggrBgEFBQcDBDANBgkqhkiG9w0BAQsFAAOCAQEAqgjTZi5G/vTnxGbUTtv2XK2olwbJ ShTu7xlOazHIpyxv13LrAN6E6mQDJru0C3XIfpsATPkCmfzn9g359Xn5dAM/I7J/ZYdLKej2PgSt prFNjlZ2os3ou4P1GmQlnL3qSlMJY9gDaaUhGbWRAxfZ0riXf0jKbczh9sMxTZdT0pBEqrQryQCn l+5qV0XCvZlIFgGDOpYr0w4eaccFRgV9U1QhUx8St+aUoxPPYaAWZc6G7E3h5VwUGbdRHDL3TvU0 D09bY4P7ZOMlozsa7sw2IkYoawbedDp33z0i3GMNxnHvZIQ434AMYEDibrNMT6nYgbODQjlReDEe x0E6TeYoETGCAl4wggJaAgEBMFwwTDELMAkGA1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24g bnYtc2ExIjAgBgNVBAMTGUdsb2JhbFNpZ24gSFYgUy9NSU1FIENBIDECDATC6zEe4fWI0fFOPzAN BglghkgBZQMEAgEFAKCB1DAvBgkqhkiG9w0BCQQxIgQgPMQ2OHifJcJnt2Qp4A2w1wKNzX9NAsC+ ubB1apdzuLQwGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMTkwODIw MTcyMjUzWjBpBgkqhkiG9w0BCQ8xXDBaMAsGCWCGSAFlAwQBKjALBglghkgBZQMEARYwCwYJYIZI AWUDBAECMAoGCCqGSIb3DQMHMAsGCSqGSIb3DQEBCjALBgkqhkiG9w0BAQcwCwYJYIZIAWUDBAIB MA0GCSqGSIb3DQEBAQUABIIBADHKcYB8ElrOwmweQohgRCSeu+Oasg4oOUy6ZhT6Ri6jE7Q87u3z ycqJFcJLnjnnnh7Q3Fq0d/KMvNWrYMEnyVwST3Un0j97+25wa5zyQ1uygv3o+g7jQJCCg9wEwx28 qryT7B1P1avm91ILXxK2akM62KSL6MuViSm/Uee2bIz0s4yZTT4eIOSHE9FIygr6kX8T/Qvko97E jM8fQNK6upQrKr5ukFqVJIchfsG2ZzEoYCJ8ijHJfNI0jIGrWnW5dSgPQrJ+qgzUm7V4mMpZIupY gmeaY0Ui2ZXy8gIrx45n+L9+XD8WKS2RxFG51poMub1MgoFYQNiXBZs7zk3d7O8= --000000000000eb2f6d05908fb489-- From nobody Tue Aug 20 12:51:07 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 00522120821 for ; Tue, 20 Aug 2019 12:51:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.499 X-Spam-Level: X-Spam-Status: No, score=-17.499 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eCYX4hdPZoZe for ; Tue, 20 Aug 2019 12:51:04 -0700 (PDT) Received: from mail-wm1-x334.google.com (mail-wm1-x334.google.com [IPv6:2a00:1450:4864:20::334]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0910312081A for ; Tue, 20 Aug 2019 12:51:04 -0700 (PDT) Received: by mail-wm1-x334.google.com with SMTP id m125so3696323wmm.3 for ; Tue, 20 Aug 2019 12:51:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=NQ0uzT1ArYym9z56vA+6pTQAzc4EOUisMGTAlqY8DXY=; b=p7NlcDDC7fJM6j9L2Ei39wMsYTlsPvPENZaGzC5YQwLpDYzI1CqRzL72mOLC82/7cb K0p91G2PoU45chIlcjD+hA9l/5OJs61M3LU2wOSuEbHIaoPjhcmi+2ElnI6cYd/7x5A8 2iRKEB75px/X1XUYvQ/Ht0QwFFhS57EsW7OB7aYUZX8y6E2C004Kn6/7E4mX6tgJWIZD FOpEjeYFcuwUWWfbUtSOgL8uICzL6n7kwT2oUr1X37xlIIktNaSguiaSBVllitnZQCJe WYRJcaGwNlNXbUXE3q+LdrW67stnIg+UAPPH9fd638q5NShwI+8rqNkPAB+cmEIMIbcW /zNg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=NQ0uzT1ArYym9z56vA+6pTQAzc4EOUisMGTAlqY8DXY=; b=qPaRZPdl3/o7lbMICPN7vUOmp8s6Ptxj77byU1r6yspUtczKb3tcxUiva2+wvgZq0C guoInrHEb2MXzpwtVhWJtzIIm5HQpCtDSjec+JdG88aeyZEb19KObSL5LWXSCbJzudj4 LGK6z9nzPc19W7CDHxbgKInudVrxKvTN+QBMA+DsLPhuY56RQUQ460i7ec6AnX7+/rpS 87N5EQu/7d6vSZanljctcKzTdkJsn120CHWG19+TzpgmraQhOm9/hSMjeRgRrB86F4DQ L09Uz44RbaCTA/3Y0674MFlVnikZpnad6BCnTR1iO95eR9i0Sv7PgIxQA9t4f0Y8x8k8 CVHA== X-Gm-Message-State: APjAAAUd1MTIH9HHrLzpsgQZDkptKX9HKrrhHb9/vdDxWe0eyw3XTdxb dOpCBHD/5fiHQDXvpj6Ib6sIL+BPSr2HoV8qf15wQ2fHFXY= X-Google-Smtp-Source: APXvYqw4wShksCZcsYLlJcFRhidu5fjRLTx2C7OwIkhYee1PTtzs8wg361FJIhcCXNSEC9nvwW2Yfag2urN8KoErVGs= X-Received: by 2002:a1c:d10b:: with SMTP id i11mr1895153wmg.78.1566330662108; Tue, 20 Aug 2019 12:51:02 -0700 (PDT) MIME-Version: 1.0 References: <20190817170031.6F71C1691138@fafnir.remote.dragon.net> <5ED23002-7608-4A76-8181-E344E3FC6469@fugue.com> <3a0bf623-3aee-4d4d-fff0-4d127a81bbae@bellis.me.uk> <828f51ce-d551-dc39-83d2-008f31e9f09a@bellis.me.uk> <6109.1566247193@localhost> <20e87cd3-b27a-0a2a-e24d-c6c9eb1100bb@bellis.me.uk> In-Reply-To: From: Eric Orth Date: Tue, 20 Aug 2019 15:50:50 -0400 Message-ID: To: Erik Kline Cc: Ray Bellis , ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000b7c269059091c6eb" Archived-At: Subject: Re: [Add] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 20 Aug 2019 19:51:06 -0000 --000000000000b7c269059091c6eb Content-Type: text/plain; charset="UTF-8" On Tue, Aug 20, 2019 at 1:23 PM Erik Kline wrote: > A statement that applications and operating systems should generally > [1] follow the express configuration intent of device owners/users, > and > [2] if not available, use the network-provisioned service(s). > [1] is probably so non-controversial to not require publishing a statement. If you have explicit user settings but ignore them, you just have a bad application, and IETF is not going to be able to fix it. The only reason we're having these discussions is because device owners/users usually do not provide an express configuration intent or it's not clear to all applications involved whether or not a configuration comes from such a source with the full options available the application wants to provide. [2] I don't think you're going to get reasonable consensus on as there are lots of obscure cornercases (you recognize diagnostic and measurement) where not doing so starts seeming reasonable to more people (but admittedly not everyone), and there are major relevant stakeholders that clearly disagree with it in the general case. Short of some super new insightful perspective, rather than just rehashing disagreement, I don't think any of these kilo-threads are going to change opinions on the proper default. --000000000000b7c269059091c6eb Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Tue, Aug 20, 2019 at 1:23 PM Erik = Kline <ek=3D40google.com@= dmarc.ietf.org> wrote:
=C2=A0 =C2=A0A = statement that applications and operating systems should generally
=C2=A0 =C2=A0 =C2=A0 [1] follow the express configuration intent of devic= e owners/users, and
=C2=A0 =C2=A0 =C2=A0 [2] if not available, us= e the network-provisioned service(s).
[1] is probably so non-controversial to not require publishing= a statement.=C2=A0 If you have explicit user settings but ignore them, you= just have a bad application, and IETF is not going to be able to fix it.= =C2=A0 The only reason we're having these discussions is because device= owners/users usually do not provide an express configuration intent or it&= #39;s not clear to all applications involved whether or not a configuration= comes from such a source with the full options available the application w= ants to provide.

[2] I don't think you're = going to get reasonable consensus on as there are lots of obscure cornercas= es=C2=A0(you recognize diagnostic and measurement) where not doing so start= s seeming reasonable to more people (but admittedly not everyone), and ther= e are major relevant stakeholders that clearly disagree with it in the gene= ral case.=C2=A0 Short of some super new insightful=C2=A0perspective, rather= than just rehashing disagreement, I don't think any of these kilo-thre= ads are going to change opinions on the proper default.

--000000000000b7c269059091c6eb-- From nobody Tue Aug 20 12:55:23 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AB7B7120896 for ; Tue, 20 Aug 2019 12:55:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JbAkJETNIPas for ; Tue, 20 Aug 2019 12:55:18 -0700 (PDT) Received: from mail-qt1-x834.google.com (mail-qt1-x834.google.com [IPv6:2607:f8b0:4864:20::834]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 268661208BC for ; Tue, 20 Aug 2019 12:55:17 -0700 (PDT) Received: by mail-qt1-x834.google.com with SMTP id i4so100973qtj.8 for ; Tue, 20 Aug 2019 12:55:17 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=XIQz6IKojjYjmG2V0h96IvupYc3wBiHtNtyqZTdTep4=; b=chFSQ09QxLrtQra1Zedv//WrjH1D1auHoNUGpAOmWFvv0aIq5mg/2Jhvr8uP88Lftn jz9L/ALIxiuwJUeUufAIHbP9UPNhUUztGtwKauqxDGnLbz1hGS4b5FaimsEwyvOSC68C zZ9oHQnoNrleJ121wiNu/mD21qlouS4H9O5viEiSOKye5hApBYDzKIIQyhJX+C6Jd+NR M2VfqdWf/y2N7tcfd9pmXDFey6e8X8m1aEU/Oa+qugRaIWoVfeT3k5b9LEZYGKx0wW0n gQTmt44Gjv65MXKgyLVjimjiyj3O/7ZMD8ndT3JfLOttLvsOa+vNzj46pPmgz1OGEyv9 w6Yg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=XIQz6IKojjYjmG2V0h96IvupYc3wBiHtNtyqZTdTep4=; b=W3XIIPYOYea60OgHk0M8+FAymXqtn+mr2ZRPvwgia59JPtvBnfMLVUIjdQsxOCjzNL jgMEc6MIL0DzUntmNI2iIhL8CXMejYjrrVYHyJm9PWkh7FpFO/p7VoVV2UiE5Adcy1MH t9xrh5XDAsS5oUyOUU0BqvRPgMXf+jmAkyXjsmNNcZSqZMCnipp4Ve60592TsTNaJYHk 5RkMtsYrRDJZTEh4EcaCcn6uWo0ZM0m5aRFs/6juKx1FI8kArGCv2WwuvTx5Jac5DwWc b3oMdZwrElq8nrQE+YVeMUf3YbBn0OnmZHDUsbvdk+fmdKvtSmQ/c9Xi6hIiSCVqU0ef yX3Q== X-Gm-Message-State: APjAAAX3LwQ3DAYL+YDPaZfjW6ARvdyzRVJXndCfMCNhxExz6AbiOerv CvLI1HV5gyu4rKwBhNzg1l7+VGs4 X-Google-Smtp-Source: APXvYqy4rLogQhXDhEikzEZx5Owm+5rXU+bEAKXqzv2zot8v0Xa8CY8se8lakm2f2aCSBNbI9PwNFg== X-Received: by 2002:ac8:117:: with SMTP id e23mr27286233qtg.18.1566330916126; Tue, 20 Aug 2019 12:55:16 -0700 (PDT) Received: from ?IPv6:2607:fb90:3b84:eab1:552b:7211:6c55:a991? ([2607:fb90:3b84:eab1:552b:7211:6c55:a991]) by smtp.gmail.com with ESMTPSA id 15sm8733495qka.129.2019.08.20.12.55.15 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 20 Aug 2019 12:55:15 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (1.0) From: Brian Dickson X-Mailer: iPhone Mail (16G77) In-Reply-To: <828f51ce-d551-dc39-83d2-008f31e9f09a@bellis.me.uk> Date: Tue, 20 Aug 2019 15:55:14 -0400 Cc: Adam Roach , ADD Mailing list Content-Transfer-Encoding: quoted-printable Message-Id: <9485DBA8-F2A1-4CBB-92B7-E63273ABCFAE@gmail.com> References: <20190817170031.6F71C1691138@fafnir.remote.dragon.net> <5ED23002-7608-4A76-8181-E344E3FC6469@fugue.com> <3a0bf623-3aee-4d4d-fff0-4d127a81bbae@bellis.me.uk> <828f51ce-d551-dc39-83d2-008f31e9f09a@bellis.me.uk> To: Ray Bellis Archived-At: Subject: Re: [Add] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 20 Aug 2019 19:55:22 -0000 Sent from my iPhone > On Aug 19, 2019, at 2:39 PM, Ray Bellis wrote: >=20 >=20 >=20 >> On 19/08/2019 18:53, Adam Roach wrote: >>=20 >> Is this true? The Open Rights Group reports that the default blocking set= tings for the UK prevent access to almost 10% of the top 100,000 Alexa-ranke= d sites today [1]. While this is a vast improvement from the 20% from five y= ears ago [2], it still seems unacceptably high -- especially when considerin= g the nature of the sites that get blocked [3]. >=20 > I was talking specifically about the IWF CAI list, not the wider "adult co= ntent" type filters. =46rom reading the Wikipedia page on IWF and IFW=E2=80=99s own page, here is= what appears to be the real issue: The actual list is mostly limited to URLs only. Domains are only listed if t= hey are exclusively used for hosting the relevant material. ISPs implement blocking using the URL list however they want, but typically t= he only available mechanism is to MitM domains hosting the relevant URLs, in= order to replace blocked URLs with a placeholder of some kind such as an ex= planation on why the image was blocked (or a generic 404). The problem arises in how they become a MitM selectively (only for domains w= ith such URLs): they redirect traffic to a proxy via DNS. The impacted domains aren=E2=80=99t blocked, only the specific URLs. Unfortunately, the MitM requires SNAT (source NAT) so the end to end connect= ion works correctly, which leads to problems generally shared by NATs. IMHO the Open Rights Group is conflating the underlying NAT problem with act= ual DNS-based blocking of entire domains. I=E2=80=99m not sure whether it would be feasible for browsers to cooperate w= ith ISPs and the IWF to improve the URL blocking. If it were possible (in a w= ay that the ISPs could trust and verify, for example) it might not be necess= ary to use the MitM method and consequently not require the DNS redirection.= That would mostly make the UK case moot, since there would no longer be a re= solver dependency. (I believe there are still some entire domains in the list. It isn=E2=80=99t= clear whether those would require DNS-level blocking.) That is a lot of =E2=80=9Cif=E2=80=99s=E2=80=9D, though. Brian= From nobody Tue Aug 20 12:59:17 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7FDE3120178 for ; Tue, 20 Aug 2019 12:59:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9tnNYycktNs0 for ; Tue, 20 Aug 2019 12:59:15 -0700 (PDT) Received: from mail-qt1-x829.google.com (mail-qt1-x829.google.com [IPv6:2607:f8b0:4864:20::829]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E4D9B120132 for ; Tue, 20 Aug 2019 12:59:14 -0700 (PDT) Received: by mail-qt1-x829.google.com with SMTP id u34so166331qte.2 for ; Tue, 20 Aug 2019 12:59:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=JZisxbeDhZoiHBwmL+p1feXr9oq31ZWIDTn6sR09zBE=; b=VjojpW1wj3ideHu4Z+ejobRoR8q9SRvIfD7k/uCESc9gMbc45Kiz8uUvfwTDpcYFUj Zsh4EQPiOtDicJPHHk+QcOI/BC7A9bZtHR5na1goDLHnRhBoSIVsyBhTakBXkFXu0KYP P16HbW9aN+AvDLfy867T0NcyjV/UJ6UkRvhspMvYIqVKF5yoqieAOA+PYldEkaU3tBZx bSzWeDzOhBOdeWn3OVTubd14HmKmqO2w+J8aiHabPs+vvGjentoh1U3sVd4BxnVs14CB wf6c6k1m6apTvIkNFmtAinDZKLeX5hgvp2ERGUiJvEKOYGS7JfdbMKT/T+8uSWwT0AVZ CO5w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=JZisxbeDhZoiHBwmL+p1feXr9oq31ZWIDTn6sR09zBE=; b=d2sS87M+MzBMl7haMbRIbAJ6/tPLApSQYLOhYJSRmOlbLklHirF11llJut3HGuG5Jg wl8/3QyGkVedZ5GBcW7Ib7X873mtBovGHTRSE8Ad4dhRxEOSJPygFGqVHq4GUSnoJdHu 7sJ8RTj/fSGyxpwvipQOaNPwbaivXaJhuT4tQ6IVqu9T8uKzi6OS1KdPwLzHVDTJY7rB GB0ODJCw795LNru+ix7eHs8c8ulqLFtz3p3m+IJpzVUoCYGHswZPYRY5UKSVbCclwz+t KodDHGvS6meVO9iiUgVpfFdL6ix0yROAzOort3dhd6Zvyn8RWIMu6QtvIVhSA+s8vJJ9 xqPQ== X-Gm-Message-State: APjAAAXoDvbA9xwEvrIykeeTt7Ql7zMEGyp1x5Zoeh6l5O3zoLBzoEuQ QTNoDJZ7b6qRHD9058eZtqTCN+f0 X-Google-Smtp-Source: APXvYqwaTET7+aNtqYOpAFEFDgxfxPv4njTVrcLkAP5XzY+SvrK//PPvfxuUU5pMHg/cdXmsJruHuw== X-Received: by 2002:ac8:5482:: with SMTP id h2mr27369650qtq.64.1566331153889; Tue, 20 Aug 2019 12:59:13 -0700 (PDT) Received: from ?IPv6:2607:fb90:3b84:eab1:552b:7211:6c55:a991? ([2607:fb90:3b84:eab1:552b:7211:6c55:a991]) by smtp.gmail.com with ESMTPSA id d45sm9817449qtk.57.2019.08.20.12.59.13 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 20 Aug 2019 12:59:13 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (1.0) From: Brian Dickson X-Mailer: iPhone Mail (16G77) In-Reply-To: <6109.1566247193@localhost> Date: Tue, 20 Aug 2019 15:59:12 -0400 Cc: ADD Mailing list Content-Transfer-Encoding: quoted-printable Message-Id: <74C4C3E2-B121-4097-903A-587822C30F2F@gmail.com> References: <20190817170031.6F71C1691138@fafnir.remote.dragon.net> <5ED23002-7608-4A76-8181-E344E3FC6469@fugue.com> <3a0bf623-3aee-4d4d-fff0-4d127a81bbae@bellis.me.uk> <828f51ce-d551-dc39-83d2-008f31e9f09a@bellis.me.uk> <6109.1566247193@localhost> To: Michael Richardson Archived-At: Subject: Re: [Add] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 20 Aug 2019 19:59:16 -0000 Sent from my iPhone > On Aug 19, 2019, at 4:39 PM, Michael Richardson wr= ote: >=20 >=20 > Ray Bellis wrote: >> My personal view is that if the blocks are there because: >=20 >> 1. the relevant legal authorities mandated it, and/or 2. the end user >> opted into it (as permitted by TRR policy) >=20 >> then it's none of Mozilla's business to require that the content of the >> blocks be published. In both cases, the block is "legal" so what's to >> be gained by requiring publication of the list? >=20 > When a query is blocked, and one believes it was blocked > inappropriately, knowing why it was blocked would tell you what your avenu= es > for recourse are. I believe how the blocking is done and what message is provided is handled b= y each ISP independently. I=E2=80=99m not sure whether there is a single =E2= =80=9Cright=E2=80=9D solution that UK ISPs could agree on, but I=E2=80=99m s= ure it is for them (or the regulators) to decide. Brian= From nobody Tue Aug 20 13:01:52 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8AFAF120A3E for ; Tue, 20 Aug 2019 13:01:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Zd4xso0nbZY2 for ; Tue, 20 Aug 2019 13:01:48 -0700 (PDT) Received: from p130.piuha.net (p130.piuha.net [193.234.218.130]) by ietfa.amsl.com (Postfix) with ESMTP id 07D4F12082E for ; Tue, 20 Aug 2019 13:01:48 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by p130.piuha.net (Postfix) with ESMTP id 6AD6B66026B for ; Tue, 20 Aug 2019 23:01:46 +0300 (EEST) Received: from p130.piuha.net ([127.0.0.1]) by localhost (p130.piuha.net [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id X2ShrjvoaKhM for ; Tue, 20 Aug 2019 23:01:44 +0300 (EEST) Received: from [127.0.0.1] (p130.piuha.net [IPv6:2001:14b8:1829::130]) by p130.piuha.net (Postfix) with ESMTPS id D305C660118 for ; Tue, 20 Aug 2019 23:01:44 +0300 (EEST) From: Jari Arkko Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\)) Message-Id: Date: Tue, 20 Aug 2019 23:01:42 +0300 To: add@ietf.org X-Mailer: Apple Mail (2.3273) Archived-At: Subject: [Add] What to do in this potential working group X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 20 Aug 2019 20:01:51 -0000 I=E2=80=99ve been on vacation and doing some other things for the last = couple of weeks, and now I=E2=80=99ve been trying to read the mailing = list discussions. Not easy! Let me try another angle into the discussion and see if it=E2=80=99s = helpful. Much of the discussion has been about the conflicts between people=E2=80=99= s different use cases or trustworthiness perceptions for different = entities. =E2=80=9CI trust industry X more than industry Y=E2=80=9D or = =E2=80=9CI need to perform which conflicts what you=E2=80=99re = trying to do prevent =E2=80=9D. And the various details = of performing those . There=E2=80=99s been not so much discussion about concrete things where = IETF can help, or discussion about understanding and agreeing where our = agreements and disagreements lie, or where the factual things end and = opinions begin. So how about looking at this first by understanding what kinds of things = we might actually agree on, and acknowledging what we disagree on? For = instance, I think there are helpful small things that I don=E2=80=99t = think are hugely controversial, better discovery mechanisms for = instance. Similarly, I don=E2=80=99t think we will find an agreement = whether one trusts an ISP more or less than a large Internet company = (because it depends, duh). But we might find agreement on some more = structural things, such as what factors have an effect, and what good = solutions look like. For instance, while we might differ on what = services we consider trustworthy, to me it seems obvious that creating a = single entity that has access to all users=E2=80=99 DNS queries is = potentially very dangerous architecture for the Internet. Too attractive = target for governments to tap, for instance.=20 We might also agree on principles, such as the ones about user = configuration taking precedence over network configuration. We do disagree on how to handle filtering use cases, enterprise = networks, how to deal with CDN localisation and other operational use = cases. Some of these things people care deeply about. And we might = disagree on what the advice is on split DNS. In any case, to start with the parts that we possibly do agree on, there = is at least a beginning of a list of work items. For instance: * Improved mechanisms for discovery and selection of encrypted DNS = transports * Best operational practices for running an encrypted DNS transport = service (possibly subdivided for the type of deployment, e.g., ISP or = global service) * Recommendation for precedence of configuration mechanisms * Recommendation that having devices or apps =E2=80=9Ccall home=E2=80=9D = for every user action to a centralised global service is bad practice = and should be avoided Jari From nobody Tue Aug 20 13:22:04 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8373412003F for ; Tue, 20 Aug 2019 13:22:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.499 X-Spam-Level: X-Spam-Status: No, score=-17.499 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5d6-UqoqUcOO for ; Tue, 20 Aug 2019 13:22:00 -0700 (PDT) Received: from mail-wr1-x435.google.com (mail-wr1-x435.google.com [IPv6:2a00:1450:4864:20::435]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 910B812001E for ; Tue, 20 Aug 2019 13:22:00 -0700 (PDT) Received: by mail-wr1-x435.google.com with SMTP id c3so13706432wrd.7 for ; Tue, 20 Aug 2019 13:22:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=7gDkBSfkLRqICzyJUfV5JhTCVFywdBNc7VliYcviKak=; b=N21JOqLqA+ho3XKsy/1S/nHl7mh9iQWTC0gpxVGV55cJnpxWdDAJk6nnDG/rp3vbie BH+dU+Y2fR7/fSo7ZqT9d/T+VR3Ju20zzHpwR+61ff9AtvnYTH2y/56E7RSY65Zp0Y17 2nqX09dQQSYHUpcwIsWyQxodFqJfJtUnpDN4KJ4XajDRc+ZhuveATxC8r37bHmkeelTq BAwH9Ux0XJe/M3FSgeUbEcpQh3ZZjtOianQn4WDlRetVsuPS/dtxx+IeEx9DA5s0pRnX FzFM7qLmbQehfxQHzcQ6Ayz6ksqh/6K2jQOk4luUI72qCWhTMylPZWgJ6vma5/RBMB+g 0Hbg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=7gDkBSfkLRqICzyJUfV5JhTCVFywdBNc7VliYcviKak=; b=S3ajDgr0rv4HFwcqViqxH7VBEH8uyHGakarCR0r+tfC4prOM3cJyRY3xmOmX9sJ963 erFCzYbn4WzEtjpjFj3cTUVqhXF6UuNbDsYIL+eT1lan8Oz+BjdLIv6aUE8NSGwq7Ffn kOW17NhBwzMBz2lVV3EmAGSWvzJmZVxdzB6c1XUBDWQLlb/Ilg1z+aVVeWAG7wkoJat1 H6YTR9BfFdGTbS3GKZelzo3YRIx3W7VQpV61mqQkvD5nZB5vsu34xGwZZ9yn8VaLbVTV 6H+h/Ln3X0LPZCj91/Yi6SndQWZZUnVYBZGS1PfzKkIQlw0OqIjzdCO+cb3I0CWLsDN6 DwIA== X-Gm-Message-State: APjAAAU2V9NwJRk/xWF4UYaA+g97UxUnCa5ul/bdZ8G/J/T4PZseGFDU 5z9A0k6mOxfyJlm4qq31xlTi44KBT+iYeBBmIWUYgg6O8Eg= X-Google-Smtp-Source: APXvYqxlRFk506K+gPVvEReYYlFbqBw/85fJ8vRiPJ+Kz+MJ8pELrRiAtcId9xmEKtDcB1OtmRuupYE1EG4ofHiPmn4= X-Received: by 2002:adf:e50b:: with SMTP id j11mr36398078wrm.65.1566332518773; Tue, 20 Aug 2019 13:21:58 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Eric Orth Date: Tue, 20 Aug 2019 16:21:46 -0400 Message-ID: To: Jari Arkko Cc: ADD Mailing list Content-Type: multipart/alternative; boundary="0000000000006210d905909235e5" Archived-At: Subject: Re: [Add] What to do in this potential working group X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 20 Aug 2019 20:22:03 -0000 --0000000000006210d905909235e5 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Tue, Aug 20, 2019 at 4:01 PM Jari Arkko wrote: > In any case, to start with the parts that we possibly do agree on, there > is at least a beginning of a list of work items. For instance: > > * Improved mechanisms for discovery and selection of encrypted DNS > transports You might have disagreements over when such mechanisms should be used, but I hope the existence of such mechanisms to provide more options/information to applications is less controversial. > * Best operational practices for running an encrypted DNS transport > service (possibly subdivided for the type of deployment, e.g., ISP or > global service) > * Recommendation for precedence of configuration mechanisms > * Recommendation that having devices or apps =E2=80=9Ccall home=E2=80=9D = for every user > action to a centralised global service is bad practice and should be avoi= ded I think such a recommendation may need to be further scoped and nuanced. For many specialized devices/apps, calling into a specific centralized service may be the entire user-obvious purpose of the device/app. --0000000000006210d905909235e5 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Tue, Aug 20, 2019 at 4:01 PM Jari = Arkko <jari.arkko@piuha.net&= gt; wrote:
In any case, to start with the parts that we possibly do agree on, there is= at least a beginning of a list of work items. For instance:

* Improved mechanisms for discovery and selection of encrypted DNS transpor= ts
You might have disagreements over when such mechanisms = should be used, but I hope the existence of such mechanisms=C2=A0to provide= more options/information to applications is less controversial.
= =C2=A0
* Best operational practices for running an encrypted DNS transport service= (possibly subdivided for the type of deployment, e.g., ISP or global servi= ce)
* Recommendation for precedence of configuration mechanisms
* Recommendation that having devices or apps =E2=80=9Ccall home=E2=80=9D fo= r every user action to a centralised global service is bad practice and sho= uld be avoided
I think such a recommendation may need to b= e further scoped and nuanced.=C2=A0 For many specialized devices/apps, call= ing into a specific centralized service may be the entire user-obvious purp= ose of the device/app.
=C2=A0
--0000000000006210d905909235e5-- From nobody Tue Aug 20 13:26:04 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 90673120086 for ; Tue, 20 Aug 2019 13:26:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gFAdk4RVbKON for ; Tue, 20 Aug 2019 13:26:00 -0700 (PDT) Received: from p130.piuha.net (p130.piuha.net [193.234.218.130]) by ietfa.amsl.com (Postfix) with ESMTP id 31A5512001E for ; Tue, 20 Aug 2019 13:26:00 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by p130.piuha.net (Postfix) with ESMTP id 7C50066026B; Tue, 20 Aug 2019 23:25:58 +0300 (EEST) Received: from p130.piuha.net ([127.0.0.1]) by localhost (p130.piuha.net [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 96Z2t4W0xAWW; Tue, 20 Aug 2019 23:25:57 +0300 (EEST) Received: from [127.0.0.1] (p130.piuha.net [IPv6:2001:14b8:1829::130]) by p130.piuha.net (Postfix) with ESMTPS id 03522660118; Tue, 20 Aug 2019 23:25:56 +0300 (EEST) From: Jari Arkko Message-Id: Content-Type: multipart/alternative; boundary="Apple-Mail=_5A06F248-6B71-42C6-BE50-BACB39D28C52" Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\)) Date: Tue, 20 Aug 2019 23:25:56 +0300 In-Reply-To: Cc: ADD Mailing list To: Eric Orth References: X-Mailer: Apple Mail (2.3273) Archived-At: Subject: Re: [Add] What to do in this potential working group X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 20 Aug 2019 20:26:03 -0000 --Apple-Mail=_5A06F248-6B71-42C6-BE50-BACB39D28C52 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 > * Recommendation that having devices or apps =E2=80=9Ccall home=E2=80=9D= for every user action to a centralised global service is bad practice = and should be avoided > I think such a recommendation may need to be further scoped and = nuanced. For many specialized devices/apps, calling into a specific = centralized service may be the entire user-obvious purpose of the = device/app. Yes, of course. (But for the record, I was thinking of only in terms of = DNS. But even for that there may be cases where a specific centralised = service is used by a specific gadget. I=E2=80=99m just reacting on = general purpose Internet appliances and browser-type apps doing this.) Jari --Apple-Mail=_5A06F248-6B71-42C6-BE50-BACB39D28C52 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8
* Recommendation that having devices or apps =E2=80=9Ccall home=E2=80=9D = for every user action to a centralised global service is bad practice = and should be avoided
I think such a = recommendation may need to be further scoped and nuanced.  For many = specialized devices/apps, calling into a specific centralized service = may be the entire user-obvious purpose of the = device/app.

Yes, = of course. (But for the record, I was thinking of only in terms of DNS. = But even for that there may be cases where a specific centralised = service is used by a specific gadget. I=E2=80=99m just reacting on = general purpose Internet appliances and browser-type apps doing = this.)

Jari

= --Apple-Mail=_5A06F248-6B71-42C6-BE50-BACB39D28C52-- From nobody Tue Aug 20 14:21:32 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4A94D1208F5 for ; Tue, 20 Aug 2019 14:21:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id chAlLMsDc8LH for ; Tue, 20 Aug 2019 14:21:25 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 09A121208B6 for ; Tue, 20 Aug 2019 14:21:25 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 26CE1BE47; Tue, 20 Aug 2019 22:21:23 +0100 (IST) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id l6fUbBe94tet; Tue, 20 Aug 2019 22:21:21 +0100 (IST) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id BD8D5BE39; Tue, 20 Aug 2019 22:21:21 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1566336081; bh=FEu9Fvs/UVIBtgixofH/XVTVq7RT8PcCBbWgQK4niqM=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From; b=LdgzkS1sOSGvZJ3DXTBTek8D6hXALNkvztNk4S+fbi0RoH2EB5UkV/QI5vmSp3ssl NJUynxWLfdS6PL5JjNTHaZwjpuD33nwOtWbcYzl5xm5Mxj7TkHBhKcCUcXUdx910Xj a303nLhjzTp9+HMNeg+4+8iZ1kWssYcznxU5Od58= To: Brian Dickson , Ray Bellis Cc: ADD Mailing list , Adam Roach References: <20190817170031.6F71C1691138@fafnir.remote.dragon.net> <5ED23002-7608-4A76-8181-E344E3FC6469@fugue.com> <3a0bf623-3aee-4d4d-fff0-4d127a81bbae@bellis.me.uk> <828f51ce-d551-dc39-83d2-008f31e9f09a@bellis.me.uk> <9485DBA8-F2A1-4CBB-92B7-E63273ABCFAE@gmail.com> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: Date: Tue, 20 Aug 2019 22:21:20 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: <9485DBA8-F2A1-4CBB-92B7-E63273ABCFAE@gmail.com> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="NTDK64uTWDHvHwAe0DqWIHVD1WwtRawxx" Archived-At: Subject: Re: [Add] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 20 Aug 2019 21:21:31 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --NTDK64uTWDHvHwAe0DqWIHVD1WwtRawxx Content-Type: multipart/mixed; boundary="3RjAIvY4N7TiA8bikG5elGByeZhOZ5d71"; protected-headers="v1" From: Stephen Farrell To: Brian Dickson , Ray Bellis Cc: ADD Mailing list , Adam Roach Message-ID: Subject: Re: [Add] Participation References: <20190817170031.6F71C1691138@fafnir.remote.dragon.net> <5ED23002-7608-4A76-8181-E344E3FC6469@fugue.com> <3a0bf623-3aee-4d4d-fff0-4d127a81bbae@bellis.me.uk> <828f51ce-d551-dc39-83d2-008f31e9f09a@bellis.me.uk> <9485DBA8-F2A1-4CBB-92B7-E63273ABCFAE@gmail.com> In-Reply-To: <9485DBA8-F2A1-4CBB-92B7-E63273ABCFAE@gmail.com> --3RjAIvY4N7TiA8bikG5elGByeZhOZ5d71 Content-Type: multipart/mixed; boundary="------------B77B3A734A962E363F67D702" Content-Language: en-GB This is a multi-part message in MIME format. --------------B77B3A734A962E363F67D702 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On 20/08/2019 20:55, Brian Dickson wrote: > The problem arises in how they become a MitM selectively (only for > domains with such URLs): they redirect traffic to a proxy via DNS. Huh? Where's that described? I've not heard/seen that UK ISPs are MitMing any HTTP/TLS and would be quite surprised were that the case. Cheers, S. --------------B77B3A734A962E363F67D702 Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------B77B3A734A962E363F67D702-- --3RjAIvY4N7TiA8bikG5elGByeZhOZ5d71-- --NTDK64uTWDHvHwAe0DqWIHVD1WwtRawxx Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAl1cZFAACgkQWrL68XsX K+rAaA//Uci6Ce8JBwVz7Q1ZjLzRals1oM32lV9oXpyepFSkJTkJ2PexBzsIT9ac zI7Sp+gByR6xruB/WxC7d+PJuEy5a6j5LQJ5W/O1ycO6kOeSmjM9Za6rIZtZU/cY TVLY6dKEU30gJ1zx5gzJixXMM9wmWQRKr6VjmPGky9gUnFj/x0zDSSikSPrft7zA pUI2+8l4skJSUijdvOeDkH8RK5I/8Q3SatngZoRsvzqjO91Y5hwJ4uD0cwTTaM9W b9AYrNxhRuSAzfxgZlu6xNft7vkq0RD6aK/vjzKm2Hy23FHb1uPSb2XkT6uiAPi5 jKzh7WU2USow7gftNVMIIGJKLe3+8iUFIcx2wGqWOhGgqRkZHy8WhKVFOa1jagXd XOSEEMXaAglmNw+1E4HZu0Gv2jBuaKpMAxqEfkLlEkZujs20ktxmOPZLHSRVkMzU MjApXHPmSeuxr1s9nHqrpc+aNWSFS1+YNrEX+7KcMcCxNjThVR8KZJAY1Ene6Pze S+Jdu61cSUQ3EDEsErPflI/5clV+/PW/8XwXlNyspw0gE05/y2o8k/Wjl3VqFCtb l1G8suY6wmMYh9e2uAOeC7inRsNcJmpYZs1Mbt8nbAt58GVdvFI5Soai0aYvXkyL g9M5QKk1mbpDUrCzfNDiN8uUl9aCUyjPYUw7TWW8/G7Mi+W4Guo= =MuuB -----END PGP SIGNATURE----- --NTDK64uTWDHvHwAe0DqWIHVD1WwtRawxx-- From nobody Tue Aug 20 14:26:07 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0AB84120110 for ; Tue, 20 Aug 2019 14:26:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.68 X-Spam-Level: X-Spam-Status: No, score=-1.68 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_INVALID=0.1, DKIM_SIGNED=0.1, T_SPF_HELO_PERMERROR=0.01, T_SPF_PERMERROR=0.01] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=fail (1024-bit key) reason="fail (message has been altered)" header.d=nostrum.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1SMbpC5nAe3o for ; Tue, 20 Aug 2019 14:26:06 -0700 (PDT) Received: from nostrum.com (raven-v6.nostrum.com [IPv6:2001:470:d:1130::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 678161200A3 for ; Tue, 20 Aug 2019 14:26:06 -0700 (PDT) Received: from MacBook-Pro.roach.at (99-152-146-228.lightspeed.dllstx.sbcglobal.net [99.152.146.228]) (authenticated bits=0) by nostrum.com (8.15.2/8.15.2) with ESMTPSA id x7KLPtsX005896 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NO); Tue, 20 Aug 2019 16:25:57 -0500 (CDT) (envelope-from adam@nostrum.com) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=nostrum.com; s=default; t=1566336357; bh=5VFfNLb5p2Fal7V2rQPqXY5TSOKcyZlus21NiIq4jTI=; h=Subject:To:Cc:References:From:Date:In-Reply-To; b=OOD95bZfr9cPXcSlki3g4wE5L059iZdjc2WAw/Qo1t/k5IsCuh3gzFCJKHdwn5ow3 1X53AfI+nU3SvdhR0WA9OzxedYJ8liS+wUTQsQNEyOL20ZgNGnPzXuw8Eq30+Q8JlN aLeSW22kUK7u7H/AICkrT8HES1nSBztVvDOFtYRc= X-Authentication-Warning: raven.nostrum.com: Host 99-152-146-228.lightspeed.dllstx.sbcglobal.net [99.152.146.228] claimed to be MacBook-Pro.roach.at To: Stephen Farrell , Brian Dickson , Ray Bellis Cc: ADD Mailing list References: <20190817170031.6F71C1691138@fafnir.remote.dragon.net> <5ED23002-7608-4A76-8181-E344E3FC6469@fugue.com> <3a0bf623-3aee-4d4d-fff0-4d127a81bbae@bellis.me.uk> <828f51ce-d551-dc39-83d2-008f31e9f09a@bellis.me.uk> <9485DBA8-F2A1-4CBB-92B7-E63273ABCFAE@gmail.com> From: Adam Roach Message-ID: Date: Tue, 20 Aug 2019 16:25:50 -0500 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Content-Language: en-US Archived-At: Subject: Re: [Add] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 20 Aug 2019 21:26:07 -0000 On 8/20/19 4:21 PM, Stephen Farrell wrote: > > On 20/08/2019 20:55, Brian Dickson wrote: >> The problem arises in how they become a MitM selectively (only for >> domains with such URLs): they redirect traffic to a proxy via DNS. > Huh? Where's that described? I've not heard/seen that UK ISPs are > MitMing any HTTP/TLS and would be quite surprised were that the case. I'm perplexed, too. Given that nearly 80% of worldwide HTTP traffic is encrypted, and that an attempt to MITM such encrypted traffic would simply result in the page not being loaded due to a certificate error, this seems like it's not even remotely a feasible approach. Or, minimally, it would be indistinguishable from a block on the entire domain, as the end result would be identical. /a From nobody Tue Aug 20 15:54:42 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A852F1200F9 for ; Tue, 20 Aug 2019 15:54:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RU5agh_FpMEl for ; Tue, 20 Aug 2019 15:54:38 -0700 (PDT) Received: from mail-vs1-xe30.google.com (mail-vs1-xe30.google.com [IPv6:2607:f8b0:4864:20::e30]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AA5A41200D8 for ; Tue, 20 Aug 2019 15:54:38 -0700 (PDT) Received: by mail-vs1-xe30.google.com with SMTP id q16so98475vsm.2 for ; Tue, 20 Aug 2019 15:54:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=vyVifUJ+nS9pnqchAIRV9DefcY1R3DoBNHhzU4n2P2A=; b=Avym8UHSGJYgdV5NNvaEXK//gA4IgCdsEwg10fmnBRnm6EEQALiQGYi1gUVAgvHFGv DgXvpUgnkzM2OoTSW0v4wTbrF8AVuZ9eI5DBvghSAFPqjU4FKC3WBJgQOH8c8mtfnkkJ U8joJWj4QTIkP/BX77KfK2QrBaHdtF3gN8KOBRMVh4j/vpdLx/RG7TX5F4AF8Mqybptl ZZ25cI2ZTBflKWfXr1gSPFLS1iMqtHpCM2tTlQsZlPntHCyipSrHYJ3sLEDaRBkLsSwo WGUvXOtoA2hLn2JKn3EwJ9bcqnx/irasy7jD2istGcWe+b/IlJx67sc//WbJ5zi0rPdA vhPw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=vyVifUJ+nS9pnqchAIRV9DefcY1R3DoBNHhzU4n2P2A=; b=NuZjTG9hBDRmb913wZOIdIYydAvuU2HVenex2buIkJJAd7rSSZ2Y6vHWVa3hFfEmK0 g7M/ZLWqFxoYXseUL7oCWxO0X+Qqkg83hUf9Povh6w+nQuZmndCPHh2cIiwWkeoV4qL8 pstf/OkybESaqmkhZTmEuVtowpI/zalbBUSOTQ81mtz/mWXuyiK0IPkcRgfN15V24pbh QMI3DVL2xf+jSEOCsjvzlJa19gbLq8s6aIev6uHt++bIAYPyP4z1hAJ+2CvlyMO8fQ2t mBdO1ESY1llhI7GDYdh4dF8jhs0PJ9mvAJZ+oEaKyLmG+Jjs/QiCdnGokbLk48CGPeS5 R8KA== X-Gm-Message-State: APjAAAVTVToCEvHDJBwYXqtdsgarf9mFkR7V7b7gkyVa29ipzdE1kzaZ Ve5DJoWGH6qI40vq5w5T14Rv7A4wrWhgKSuV1h0= X-Google-Smtp-Source: APXvYqxGskGs8s5poUgbJWghZBrw2vJ063/dC1fHOddf69uRVfFjBiDj7341Zi/fxnvAXPo4yjyvlK2pONfAaZJrEvw= X-Received: by 2002:a67:d812:: with SMTP id e18mr20133799vsj.199.1566341677699; Tue, 20 Aug 2019 15:54:37 -0700 (PDT) MIME-Version: 1.0 References: <20190817170031.6F71C1691138@fafnir.remote.dragon.net> <5ED23002-7608-4A76-8181-E344E3FC6469@fugue.com> <3a0bf623-3aee-4d4d-fff0-4d127a81bbae@bellis.me.uk> <828f51ce-d551-dc39-83d2-008f31e9f09a@bellis.me.uk> <9485DBA8-F2A1-4CBB-92B7-E63273ABCFAE@gmail.com> In-Reply-To: From: Brian Dickson Date: Tue, 20 Aug 2019 18:54:12 -0400 Message-ID: To: Stephen Farrell Cc: Ray Bellis , ADD Mailing list , Adam Roach Content-Type: multipart/alternative; boundary="0000000000004bd56a0590945730" Archived-At: Subject: Re: [Add] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 20 Aug 2019 22:54:41 -0000 --0000000000004bd56a0590945730 Content-Type: text/plain; charset="UTF-8" On Tue, Aug 20, 2019 at 5:21 PM Stephen Farrell wrote: > > > On 20/08/2019 20:55, Brian Dickson wrote: > > The problem arises in how they become a MitM selectively (only for > > domains with such URLs): they redirect traffic to a proxy via DNS. > Huh? Where's that described? https://en.wikipedia.org/wiki/Internet_Watch_Foundation#Of_proxy_server_used_by_ISPs I have no direct knowledge, I'm going off of the wikipedia page. (In particular, I haven't looked into the HTTP vs HTTPS issue at all, just summarizing what I read above.) Brian > I've not heard/seen that UK ISPs are > MitMing any HTTP/TLS and would be quite surprised were that the case. > > Cheers, > S. > --0000000000004bd56a0590945730 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Tue, Aug 20, 2019 at 5:21 PM Steph= en Farrell <stephen.farrell= @cs.tcd.ie> wrote:


On 20/08/2019 20:55, Brian Dickson wrote:
> The problem arises in how they become a MitM selectively (only for
> domains with such URLs): they redirect traffic to a proxy via DNS.
Huh? Where's that described?


I have no direct = knowledge, I'm going off of the wikipedia page.
(In particula= r, I haven't looked into the HTTP vs HTTPS issue at all, just summarizi= ng what I read above.)

Brian
=C2=A0
I've not heard/seen = that UK ISPs are
MitMing any HTTP/TLS and would be quite surprised were that the case.

Cheers,
S.
--0000000000004bd56a0590945730-- From nobody Tue Aug 20 16:23:37 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AAC84120835 for ; Tue, 20 Aug 2019 16:23:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id B0PAsQyAQ8v0 for ; Tue, 20 Aug 2019 16:23:34 -0700 (PDT) Received: from mail-io1-xd33.google.com (mail-io1-xd33.google.com [IPv6:2607:f8b0:4864:20::d33]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D3330120106 for ; Tue, 20 Aug 2019 16:23:33 -0700 (PDT) Received: by mail-io1-xd33.google.com with SMTP id l7so854843ioj.6 for ; Tue, 20 Aug 2019 16:23:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=q0iDbIhgQkRJEwO0DFN33ctEcjHebQRfTLq+yzkYVdM=; b=EElbuM0RwD7qDYro07GAbgKQl0/rPrPJ06u63wP2umU2LBF6w8irRPMO0HJPiW7XML S18rJsKwlhk1pte9lAGCRiCwH7KWBqgPwTEdc2JFIUZceAiey37rO0D1fab3vAo/53II c0OHE0EsTnEGCs21iwtdvN49aLJXrETFWy8VILWnxnbSeSsc86oJ7pRD14HsLA0zIchW FS11ortUFiXvyCPOv3RkSTfHHJKxlgQk1FfdGzryPbYvPaQ+oH19Iv2WGhlhwADblSm1 L3lz9rERhhje3VKni+nc6J3JRXUlKV4ZDvd7cR0DngF6GA4IJI3OivexR2FfxC0xG040 lbPg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=q0iDbIhgQkRJEwO0DFN33ctEcjHebQRfTLq+yzkYVdM=; b=lF+Pa7vEeS7sqHjbilpDfOJVJ4gieA31P4EK2w9anqyav9ovpPj35iWSce2AdyPTNT cqdJoo5/yNS2qL1F0YDUVQcKsS7Ittm6Et8JN0vklp91YJV3/NqrQVFGDOkymRCw4fWo XXeekDsa2eSMBZUVLtQQI4xim8FlG2Axb8+pkBdjDwu7IMnqCE3TtTpOFySXq0XDTo7j LtW2iLrm+iYDA845v7TAvX/ETEO02PITg1EL4GLxTI8X/AqlVegDHHMC6OvEPAAOg68+ Tb4ncyiu+N1rGQeHQ3IpDIAwLD4iz2QHSRCMuGy1PGoaEnJW8/hTpTItFhsq4OEhUEQ6 WHgA== X-Gm-Message-State: APjAAAVRCg8GiFOQVbglNvSc1vib/D/jcNVqJzw5CYAG7M12Sut7CANW URx7joLDyjmSO98RdoEVwIrP8A300ef2r3T9CWY= X-Google-Smtp-Source: APXvYqz7S6/MiyJsvTTaDC7KvlkNfob+N0CvL9cj3miwcso9Qw7P9IW6K+axSr7u2jY5tP3lL6yaqWCTSGstbdYH3oQ= X-Received: by 2002:a02:2384:: with SMTP id u126mr6585625jau.30.1566343412963; Tue, 20 Aug 2019 16:23:32 -0700 (PDT) MIME-Version: 1.0 References: <20190817170031.6F71C1691138@fafnir.remote.dragon.net> <5ED23002-7608-4A76-8181-E344E3FC6469@fugue.com> <3a0bf623-3aee-4d4d-fff0-4d127a81bbae@bellis.me.uk> <828f51ce-d551-dc39-83d2-008f31e9f09a@bellis.me.uk> <9485DBA8-F2A1-4CBB-92B7-E63273ABCFAE@gmail.com> In-Reply-To: From: Rob Sayre Date: Tue, 20 Aug 2019 16:23:21 -0700 Message-ID: To: Adam Roach Cc: Stephen Farrell , Brian Dickson , Ray Bellis , ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000b9df25059094be0c" Archived-At: Subject: Re: [Add] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 20 Aug 2019 23:23:36 -0000 --000000000000b9df25059094be0c Content-Type: text/plain; charset="UTF-8" On Tue, Aug 20, 2019 at 2:26 PM Adam Roach wrote: > On 8/20/19 4:21 PM, Stephen Farrell wrote: > > > > On 20/08/2019 20:55, Brian Dickson wrote: > >> The problem arises in how they become a MitM selectively (only for > >> domains with such URLs): they redirect traffic to a proxy via DNS. > > Huh? Where's that described? I've not heard/seen that UK ISPs are > > MitMing any HTTP/TLS and would be quite surprised were that the case. > > > I'm perplexed, too. Given that nearly 80% of worldwide HTTP traffic is > encrypted, and that an attempt to MITM such encrypted traffic would > simply result in the page not being loaded due to a certificate error, > this seems like it's not even remotely a feasible approach. Or, > minimally, it would be indistinguishable from a block on the entire > domain, as the end result would be identical. > They have users install trusted root certs. I think a few UK ISPs have started really locking down their routers (can't change DNS settings, etc), and I think a few products from a few of those ISPs come with installers (particularly for Windows), that install root certs, while others just direct users to install the cert using the OS control panels. It's not that common, yet, though. Here's an example of Vodafone MITMing imgur.com: < https://forums.thinkbroadband.com/vodafone/4549610-vodafone-blocks-sites-with-user-submitted-content.html#Post4610585 > thanks, Rob --000000000000b9df25059094be0c Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Tue, Aug 20, 2019 at 2:26 PM Adam Roac= h <adam@nostrum.com> wrote:
On 8/20/19 4:21 PM, Stephen Farrell wrote:
>
> On 20/08/2019 20:55, Brian Dickson wrote:
>> The problem arises in how they become a MitM selectively (only for=
>> domains with such URLs): they redirect traffic to a proxy via DNS.=
> Huh? Where's that described? I've not heard/seen that UK ISPs = are
> MitMing any HTTP/TLS and would be quite surprised were that the case.<= br>

I'm perplexed, too. Given that nearly 80% of worldwide HTTP traffic is =
encrypted, and that an attempt to MITM such encrypted traffic would
simply result in the page not being loaded due to a certificate error,
this seems like it's not even remotely a feasible approach. Or,
minimally, it would be indistinguishable from a block on the entire
domain, as the end result would be identical.

They have users install trusted root certs.

I think a few UK ISPs have started really locking down their routers (can&= #39;t change DNS settings, etc), and I think a few products from a few of t= hose ISPs come with installers (particularly for Windows), that install roo= t certs, while others just direct users to install the cert using the OS co= ntrol panels. It's not that common, yet, though.

Here's an example of Vodafone MITMing i= mgur.com: <ht= tps://forums.thinkbroadband.com/vodafone/4549610-vodafone-blocks-sites-with= -user-submitted-content.html#Post4610585>

t= hanks,
Rob

--000000000000b9df25059094be0c-- From nobody Tue Aug 20 16:30:27 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 000BC12083D for ; Tue, 20 Aug 2019 16:30:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=algebras-org.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pMZN70np0bE2 for ; Tue, 20 Aug 2019 16:30:22 -0700 (PDT) Received: from mail-io1-xd34.google.com (mail-io1-xd34.google.com [IPv6:2607:f8b0:4864:20::d34]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 25930120106 for ; Tue, 20 Aug 2019 16:30:22 -0700 (PDT) Received: by mail-io1-xd34.google.com with SMTP id q22so897423iog.4 for ; Tue, 20 Aug 2019 16:30:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=algebras-org.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to; bh=uKI9iRlj2FSExXDlE+Xwi9HRgWRVOljL86bHPTHl/IA=; b=LxgEtXZXm81uLJ0JP5nlCtF4PRtqlIUwo3i1FI7s04GbXNit+Kw14+y0zvaA5j8ghk tK9NwCrkpkS5auWhC+yGBtgUMAmmADF1be9pjF3B93BVmXZ24l1vUxU2+Dye5SBxmXuN d24XmRZYKAkzXe/O2HRtIWjfuQrPPL8aETTbcasbKdHNl2aiTc5so0FcKm3kA3bQBC1R K44ix2G61TW3mpaOpOSRw3rpuGr489jbRkh+JBRQi8S+D9mlLigt5pJZ3D9fP9wCaBf+ Psb5+nDNw6fqDGrNfSYN4A4YUFSAYW01nd2XvZGnBMlzNP8sA8NrRIm8cUN6UMHbPDq6 X2LA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to; bh=uKI9iRlj2FSExXDlE+Xwi9HRgWRVOljL86bHPTHl/IA=; b=eWjB8PuZRBmXTnLV2f11Tt0yzPiNyG6WL7yjt4oKhrHFPx/vju27sKvduq+864tZdH WQ5FsjiSQ4i8e2J1EEsR1aJBfetk2Yti2Z5bNTn6M9kH5GMCN5YJvuCpXoOm7/NzZJ+b isu0Iprah2nyGL3VECuN54aV0ymu1w6LSXrXncyxSQIX12ZyIYq1/Dz5dBCSAoeNXwot rg0t07YprMA8DBid4rg+libMEX334d/aTKYYOcrhd5vUvNeAUlXX2ELQYqVAmddEpBy8 YXWASbk7OSXyiFEcx/PI+Dng4b/iau0zDVOHVz+EsU8I1/fu8bRf0g40XiwaCTB7Rmej ZdSA== X-Gm-Message-State: APjAAAXksCb4plnSrGLmYFFhsGZWdbCtWQ/H9BtZSCSScWxlr6QXmDYp PrDmssZ6XxdcKT/TbOBd3IJbTizQEGSaaKOL5cin+ZiylGt2Fw== X-Google-Smtp-Source: APXvYqxbxYV7R5qMy9T+NJ5lrYVpBCYptJInr3XgTHyR6IDuQ3lkiGzhl65HIhD65jzkNtmE3P6u+wbBWr+H5UzN/g4= X-Received: by 2002:a02:c6b7:: with SMTP id o23mr6833782jan.48.1566343821138; Tue, 20 Aug 2019 16:30:21 -0700 (PDT) MIME-Version: 1.0 References: <20190817170031.6F71C1691138@fafnir.remote.dragon.net> <5ED23002-7608-4A76-8181-E344E3FC6469@fugue.com> <3a0bf623-3aee-4d4d-fff0-4d127a81bbae@bellis.me.uk> <828f51ce-d551-dc39-83d2-008f31e9f09a@bellis.me.uk> <9485DBA8-F2A1-4CBB-92B7-E63273ABCFAE@gmail.com> In-Reply-To: From: George Michaelson Date: Wed, 21 Aug 2019 07:30:07 +0800 Message-ID: To: ADD Mailing list Content-Type: text/plain; charset="UTF-8" Archived-At: Subject: Re: [Add] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 20 Aug 2019 23:30:26 -0000 I've always held the current model of a TA bundle inherent in the browser and embedded systems is probably a bad thing (tm) and we'd to better to have code signing TA, but as few general purpose TA's as possible pre-installed and have actually required people to THINK about this, and install the TA set they wanted. I know, I know, this is inherently complex, and probably has dangers too. But, the current model of TA distribution is a giant shell game of misplaced trust. -George From nobody Tue Aug 20 16:31:06 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 979A712083E for ; Tue, 20 Aug 2019 16:31:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.678 X-Spam-Level: X-Spam-Status: No, score=-1.678 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_INVALID=0.1, DKIM_SIGNED=0.1, HTML_MESSAGE=0.001, T_SPF_HELO_PERMERROR=0.01, T_SPF_PERMERROR=0.01, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=fail (1024-bit key) reason="fail (message has been altered)" header.d=nostrum.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tcvKJrblEa98 for ; Tue, 20 Aug 2019 16:31:03 -0700 (PDT) Received: from nostrum.com (raven-v6.nostrum.com [IPv6:2001:470:d:1130::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A54F212083D for ; Tue, 20 Aug 2019 16:31:03 -0700 (PDT) Received: from MacBook-Pro.roach.at (99-152-146-228.lightspeed.dllstx.sbcglobal.net [99.152.146.228]) (authenticated bits=0) by nostrum.com (8.15.2/8.15.2) with ESMTPSA id x7KNUqQv027446 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NO); Tue, 20 Aug 2019 18:30:54 -0500 (CDT) (envelope-from adam@nostrum.com) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=nostrum.com; s=default; t=1566343854; bh=xiZ2r6Av2CA44pRGwWxLZGLTovJkLhFXnLin/bydonE=; h=Subject:To:Cc:References:From:Date:In-Reply-To; b=NItZYBp8l9tKBYwamBFuFVqMzi2ZKSce1fQ0URgro5fuxgotu5VhsJVzPK+WRtOGv Bgr9YckPvJgtOOIyoVg82YYQKzitkQLm8FmWZ3GKWI8i/JO1CsHPDU1PSi/I113Z0f TM/vbD3uo2GpuiG4WOJoEDkh2TL1oR5XbwXzLOk8= X-Authentication-Warning: raven.nostrum.com: Host 99-152-146-228.lightspeed.dllstx.sbcglobal.net [99.152.146.228] claimed to be MacBook-Pro.roach.at To: Brian Dickson , Stephen Farrell Cc: Ray Bellis , ADD Mailing list References: <20190817170031.6F71C1691138@fafnir.remote.dragon.net> <5ED23002-7608-4A76-8181-E344E3FC6469@fugue.com> <3a0bf623-3aee-4d4d-fff0-4d127a81bbae@bellis.me.uk> <828f51ce-d551-dc39-83d2-008f31e9f09a@bellis.me.uk> <9485DBA8-F2A1-4CBB-92B7-E63273ABCFAE@gmail.com> From: Adam Roach Message-ID: <1d021d04-0633-c6fd-575b-39108ca31039@nostrum.com> Date: Tue, 20 Aug 2019 18:30:47 -0500 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/alternative; boundary="------------7CE81B23088B967007A628C0" Content-Language: en-US Archived-At: Subject: Re: [Add] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 20 Aug 2019 23:31:05 -0000 This is a multi-part message in MIME format. --------------7CE81B23088B967007A628C0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit On 8/20/19 5:54 PM, Brian Dickson wrote: > > > On Tue, Aug 20, 2019 at 5:21 PM Stephen Farrell > > wrote: > > > > On 20/08/2019 20:55, Brian Dickson wrote: > > The problem arises in how they become a MitM selectively (only for > > domains with such URLs): they redirect traffic to a proxy via DNS. > Huh? Where's that described? > > > https://en.wikipedia.org/wiki/Internet_Watch_Foundation#Of_proxy_server_used_by_ISPs > > I have no direct knowledge, I'm going off of the wikipedia page. > (In particular, I haven't looked into the HTTP vs HTTPS issue at all, > just summarizing what I read above.) Given the shift in cleartext traffic versus encrypted traffic in the past few years, I suspect that specific part of the Wikipedia article is no longer accurate. As I mention in my other note, 80% of web traffic is encrypted today, up from 30% five years ago. The described technique was questionable at 30%, and is basically completely broken at 80%. /a --------------7CE81B23088B967007A628C0 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 7bit
On 8/20/19 5:54 PM, Brian Dickson wrote:


On Tue, Aug 20, 2019 at 5:21 PM Stephen Farrell <stephen.farrell@cs.tcd.ie> wrote:


On 20/08/2019 20:55, Brian Dickson wrote:
> The problem arises in how they become a MitM selectively (only for
> domains with such URLs): they redirect traffic to a proxy via DNS.
Huh? Where's that described?


I have no direct knowledge, I'm going off of the wikipedia page.
(In particular, I haven't looked into the HTTP vs HTTPS issue at all, just summarizing what I read above.)


Given the shift in cleartext traffic versus encrypted traffic in the past few years, I suspect that specific part of the Wikipedia article is no longer accurate. As I mention in my other note, 80% of web traffic is encrypted today, up from 30% five years ago. The described technique was questionable at 30%, and is basically completely broken at 80%.

/a

--------------7CE81B23088B967007A628C0-- From nobody Tue Aug 20 16:37:30 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 90A6D12084D for ; Tue, 20 Aug 2019 16:37:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.679 X-Spam-Level: X-Spam-Status: No, score=-1.679 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_INVALID=0.1, DKIM_SIGNED=0.1, T_SPF_HELO_PERMERROR=0.01, T_SPF_PERMERROR=0.01, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=fail (1024-bit key) reason="fail (message has been altered)" header.d=nostrum.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id C5ffrZsOx9oz for ; Tue, 20 Aug 2019 16:37:27 -0700 (PDT) Received: from nostrum.com (raven-v6.nostrum.com [IPv6:2001:470:d:1130::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C2EF412083E for ; Tue, 20 Aug 2019 16:37:27 -0700 (PDT) Received: from MacBook-Pro.roach.at (99-152-146-228.lightspeed.dllstx.sbcglobal.net [99.152.146.228]) (authenticated bits=0) by nostrum.com (8.15.2/8.15.2) with ESMTPSA id x7KNbHnZ028753 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NO); Tue, 20 Aug 2019 18:37:18 -0500 (CDT) (envelope-from adam@nostrum.com) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=nostrum.com; s=default; t=1566344239; bh=+gPjEnbu7Sd/H9yy10UfQ7KtthH6H01/1cvM/WX+2RA=; h=Subject:To:Cc:References:From:Date:In-Reply-To; b=ol7HZObiLsThLXHElzyKUpioCdqU8N7SVTFVSfAJl25zEHR4505ead553gWUBHo0t 1FFgc072jX/Z9+a/Vq/nuRTsBOA5nq0+6z+XMQchUE4oyGlhpYRMTuss2q3K29ZOYR 2KNiS4iLp3wpkBlH5XVZWhcG6XXhF9RvA2Rkxlpo= X-Authentication-Warning: raven.nostrum.com: Host 99-152-146-228.lightspeed.dllstx.sbcglobal.net [99.152.146.228] claimed to be MacBook-Pro.roach.at To: Rob Sayre Cc: Stephen Farrell , Brian Dickson , Ray Bellis , ADD Mailing list References: <20190817170031.6F71C1691138@fafnir.remote.dragon.net> <5ED23002-7608-4A76-8181-E344E3FC6469@fugue.com> <3a0bf623-3aee-4d4d-fff0-4d127a81bbae@bellis.me.uk> <828f51ce-d551-dc39-83d2-008f31e9f09a@bellis.me.uk> <9485DBA8-F2A1-4CBB-92B7-E63273ABCFAE@gmail.com> From: Adam Roach Message-ID: <11f6b1be-14da-f381-5b88-02f1f42baaae@nostrum.com> Date: Tue, 20 Aug 2019 18:37:12 -0500 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Content-Language: en-US Archived-At: Subject: Re: [Add] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 20 Aug 2019 23:37:29 -0000 On 8/20/19 6:23 PM, Rob Sayre wrote: > think a few products from a few of those ISPs come with installers > (particularly for Windows), that install root certs, while others just > direct users to install the cert using the OS control panels. While I can't disprove this, I find it wildly implausible, given the loud and repeated outcry by various civil society groups whenever Kazakhstan attempts something similar. I believe any such move by the UK or any of its major ISPs would have been more widely publicized than a user-submitted comment on forums.thinkbroadband.com. /a From nobody Tue Aug 20 16:45:59 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 42BFC12084D for ; Tue, 20 Aug 2019 16:45:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Ct06QNcwAt6S for ; Tue, 20 Aug 2019 16:45:55 -0700 (PDT) Received: from mail-io1-xd2f.google.com (mail-io1-xd2f.google.com [IPv6:2607:f8b0:4864:20::d2f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0989712083D for ; Tue, 20 Aug 2019 16:45:55 -0700 (PDT) Received: by mail-io1-xd2f.google.com with SMTP id o9so968450iom.3 for ; Tue, 20 Aug 2019 16:45:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=PEqnr7eROmDA3NPRaGoaR3hPg7orhRDllhbmF3K0qco=; b=iXGGmJxEyfeTmUNwAat7Yb3gqNSbQqeYq9mvrWfuw+SD/hVtpgmlS1muQSd144POLl Y71EuIR1cy2qK2JeG0hiiLxsXLpIEaGFzLPcQgA8XRWjKfbyFc6KAjj1Lc9bnX+A7IIs D63ipOY8veh0M/AtAscT0ckkrojSsJT/W9ltgcELIX3QFElXD277YUUEhZN8HbzYATVT Quqwt3e7W2wh7hlg31+QUp5N79GoovsED+YUJCL9g6rSHxyshOfgwp32qc9qrbVonucF N5YQwa6okEY1nyyOzaPqxna+QpHnWFf1Xuh8VkH4ZUWTzKEPSTamcOBF1sC5vQNNiIl7 NVqA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=PEqnr7eROmDA3NPRaGoaR3hPg7orhRDllhbmF3K0qco=; b=cvGfZpqdyPyWh/Q/87BSpPvUMCL6KYzkcjmiaSmlo3ySUdckpvoE8FN9V00H56hdCF C/WElwSloWBVgzrkgeU75mCv0wjVeGWbe/3RqpWXdIBN9iGkEJssIvccqMQGAdNxK5uY nnipQEn0T0mmC/fCSXffrp1Q1P859HXRJcCW+Wk8wylEKHEbINiPW32xo8TAIXMGVVgU pkcweQg7pwmBtp8Pw3ECt2amPwBO8PSzotIPVGDczKRzAdIinduwA/ytw6awyzMgWgre yFfwvppcjj8F7leWv9L77228dqF0G4K9zf7n9ClULOFupz5tU3kUj/aNZ53cX49pFNfh Xizw== X-Gm-Message-State: APjAAAWrrJgIMSXnf7Vi4/MUj9g77UVKV9DGmsWRaGI0B4MRsKyN+2aj 63r7yTGZuDFsh6e6A7/5R1bW5gBadFpcRajQH8c= X-Google-Smtp-Source: APXvYqzp1k9qZa4U3g22nwcj3kl+41J8Tm6wVnUDNKx9u9QRUjeOoIwlMiPFybUhcp35NV+Fku9CcND2ovioUIjoQmM= X-Received: by 2002:a02:cc8f:: with SMTP id s15mr7085874jap.53.1566344754094; Tue, 20 Aug 2019 16:45:54 -0700 (PDT) MIME-Version: 1.0 References: <20190817170031.6F71C1691138@fafnir.remote.dragon.net> <5ED23002-7608-4A76-8181-E344E3FC6469@fugue.com> <3a0bf623-3aee-4d4d-fff0-4d127a81bbae@bellis.me.uk> <828f51ce-d551-dc39-83d2-008f31e9f09a@bellis.me.uk> <9485DBA8-F2A1-4CBB-92B7-E63273ABCFAE@gmail.com> <11f6b1be-14da-f381-5b88-02f1f42baaae@nostrum.com> In-Reply-To: <11f6b1be-14da-f381-5b88-02f1f42baaae@nostrum.com> From: Rob Sayre Date: Tue, 20 Aug 2019 16:45:42 -0700 Message-ID: To: Adam Roach Cc: Stephen Farrell , Brian Dickson , Ray Bellis , ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000a9e9fc0590950eba" Archived-At: Subject: Re: [Add] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 20 Aug 2019 23:45:57 -0000 --000000000000a9e9fc0590950eba Content-Type: text/plain; charset="UTF-8" On Tue, Aug 20, 2019 at 4:37 PM Adam Roach wrote: > On 8/20/19 6:23 PM, Rob Sayre wrote: > > think a few products from a few of those ISPs come with installers > > (particularly for Windows), that install root certs, while others just > > direct users to install the cert using the OS control panels. > > > While I can't disprove this, I find it wildly implausible, given the > loud and repeated outcry by various civil society groups whenever > Kazakhstan attempts something similar. I believe any such move by the UK > or any of its major ISPs would have been more widely publicized than a > user-submitted comment on forums.thinkbroadband.com. > I only used that because I found the report very clear. Here are some other data points: And here's a report on what mind be found in Android root stores: I also found that BT Smart Hub / Home Hub routers require installation of root certs, but I think it may only be for communicating with the router and one BT web page, at the moment. thanks, Rob --000000000000a9e9fc0590950eba Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Tue, Aug 20, 2019 at 4:37 PM Adam Roac= h <adam@nostrum.com> wrote:
On 8/20/19 6:23 PM, Rob Sayre wrote:
> think a few products from a few of those ISPs come with installers > (particularly for Windows), that install root certs, while others just=
> direct users to install the cert using the OS control panels.


While I can't disprove this, I find it wildly implausible, given the loud and repeated outcry by various civil society groups whenever
Kazakhstan attempts something similar. I believe any such move by the UK or any of its major ISPs would have been more widely publicized than a
user-submitted comment on forums.thinkbroadband.com.

I only used that because I found the report very = clear. Here are some other data points:


And = here's a report on what mind be found in Android root stores:


I also found that = BT Smart Hub / Home Hub routers require installation of root certs, but I t= hink it may only be for communicating with the router and one BT web page, = at the moment.

thanks,
Rob
--000000000000a9e9fc0590950eba-- From nobody Tue Aug 20 16:49:04 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4020012083D for ; Tue, 20 Aug 2019 16:49:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.299 X-Spam-Level: X-Spam-Status: No, score=-4.299 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xlel-32p2WVK for ; Tue, 20 Aug 2019 16:48:59 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3A268120144 for ; Tue, 20 Aug 2019 16:48:59 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 589C3BE47; Wed, 21 Aug 2019 00:48:57 +0100 (IST) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BBV_stNKpyeu; Wed, 21 Aug 2019 00:48:48 +0100 (IST) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id AF71DBE39; Wed, 21 Aug 2019 00:48:47 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1566344927; bh=OOyiUjEEyOhwyOU66/9uXfZJ0JdChy33kMZxtJmK9t0=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From; b=sHyGbObKn8HlKDNe0GUkzuZB62VTxEHlL8fQEBU1HKivhJ/0j4ZuS0BI0aJ4uXHG9 9pR51u1BOzB0w2yzmbSJA6nUjf7XgwZP/Tj6PeXxi9ZdWOl9sH2g6pXveV0M7Z1frs BRap8DKOc+QsPXGZAhP9YiJBSFvTKa6XJaHC8E8o= To: Rob Sayre , Adam Roach Cc: Ray Bellis , ADD Mailing list , Brian Dickson References: <20190817170031.6F71C1691138@fafnir.remote.dragon.net> <5ED23002-7608-4A76-8181-E344E3FC6469@fugue.com> <3a0bf623-3aee-4d4d-fff0-4d127a81bbae@bellis.me.uk> <828f51ce-d551-dc39-83d2-008f31e9f09a@bellis.me.uk> <9485DBA8-F2A1-4CBB-92B7-E63273ABCFAE@gmail.com> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: Date: Wed, 21 Aug 2019 00:48:46 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="NGWew0XCZa5OrRKZ4bGrAMWv5fShimY9i" Archived-At: Subject: Re: [Add] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 20 Aug 2019 23:49:02 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --NGWew0XCZa5OrRKZ4bGrAMWv5fShimY9i Content-Type: multipart/mixed; boundary="4PemGBxiSRYaEnghJKAkvvVE4P5HCjH69"; protected-headers="v1" From: Stephen Farrell To: Rob Sayre , Adam Roach Cc: Ray Bellis , ADD Mailing list , Brian Dickson Message-ID: Subject: Re: [Add] Participation References: <20190817170031.6F71C1691138@fafnir.remote.dragon.net> <5ED23002-7608-4A76-8181-E344E3FC6469@fugue.com> <3a0bf623-3aee-4d4d-fff0-4d127a81bbae@bellis.me.uk> <828f51ce-d551-dc39-83d2-008f31e9f09a@bellis.me.uk> <9485DBA8-F2A1-4CBB-92B7-E63273ABCFAE@gmail.com> In-Reply-To: --4PemGBxiSRYaEnghJKAkvvVE4P5HCjH69 Content-Type: multipart/mixed; boundary="------------5AAFCCA15FC898B5E4094A8B" Content-Language: en-GB This is a multi-part message in MIME format. --------------5AAFCCA15FC898B5E4094A8B Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hiya, On 21/08/2019 00:23, Rob Sayre wrote: > On Tue, Aug 20, 2019 at 2:26 PM Adam Roach wrote: >=20 >> On 8/20/19 4:21 PM, Stephen Farrell wrote: >>> >>> On 20/08/2019 20:55, Brian Dickson wrote: >>>> The problem arises in how they become a MitM selectively (only for >>>> domains with such URLs): they redirect traffic to a proxy via DNS. >>> Huh? Where's that described? I've not heard/seen that UK ISPs are >>> MitMing any HTTP/TLS and would be quite surprised were that the case.= >> >> >> I'm perplexed, too. Given that nearly 80% of worldwide HTTP traffic is= >> encrypted, and that an attempt to MITM such encrypted traffic would >> simply result in the page not being loaded due to a certificate error,= >> this seems like it's not even remotely a feasible approach. Or, >> minimally, it would be indistinguishable from a block on the entire >> domain, as the end result would be identical. >> >=20 > They have users install trusted root certs. >=20 > I think a few UK ISPs have started really locking down their routers (c= an't > change DNS settings, etc), and I think a few products from a few of tho= se > ISPs come with installers (particularly for Windows), that install root= > certs, while others just direct users to install the cert using the OS > control panels. It's not that common, yet, though. >=20 > Here's an example of Vodafone MITMing imgur.com: < > https://forums.thinkbroadband.com/vodafone/4549610-vodafone-blocks-site= s-with-user-submitted-content.html#Post4610585 >> I'm with Adam on this one. Reading at the URL above it appears like a not that clever attempt to get https from a browser within the home network to the home router, and not as an attempt to MitM the web. I guess it's possible the same private key is used in many home networks (which'd be crap but has happened numerous times) but there's no evidence of that at the URL above. And really - if Vodafone were crazy enough to try that for the web (and I do not think for a second they are), it'd have been spotted and front-page news within a day never mind 6 months. I do wish we could all base our arguments on more thoroughly validated information. There's enough complexity and controversy involved in these debates that having to deal with erroneous information could well be enough to make what's already hard impossible. "Luckily," in this case, both you and Brian appear to be making the same improbable claim, so it kinda balances out:-) Cheers, S. >=20 > thanks, > Rob >=20 >=20 --------------5AAFCCA15FC898B5E4094A8B Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------5AAFCCA15FC898B5E4094A8B-- --4PemGBxiSRYaEnghJKAkvvVE4P5HCjH69-- --NGWew0XCZa5OrRKZ4bGrAMWv5fShimY9i Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAl1cht4ACgkQWrL68XsX K+o6ohAA0APEQjCWC1nHewQSPq35HcBNwDjHFcaM93TQr74xbZ1XHLj688G86NbF EpzwUIM6WoxiAnRoudxjE9MxGPyADIrIBfHm7R0LhhGLnUSKFU6CVfaR5/m1cWxr NjIfGFqDMWDIH2SzDBDeF1dFg6j36cD/1nqIniXNRlfQiXBAouViE1acwpskZmso OWtH85EsocUXWuXB/7H9Y2YTKVM0wR5Ag3Nhr3lnjEvXI43z8BV4QO6n9ImgQ/hb MxIEJkb50yap/f7cmDstFwbNaTri/ueAc71x1+UlPTCINg9KIk0ZRJNfArStlApg DiSKGN5ZLY9hluwKkIhyxIkbeSbkpKG26lQuJZIE/plXCi5ytHZHOxOfa+5diWHG Fah3arrAQFeKMbJPeMhlqYFHcG59svlDy9+dcf7OerXQux2SIBTaCWhtriG9m18z OSC8OYSwYrsmGTKfE9yoG03EODfo3Gi+wGODGnfONyKPrwlylAHlHBIHidOPIZlI tqIf/XRBXyUjuxkjkSZxZpnowW03PZt2Qlslzik0zh6hELnyUPqNSedcnd+hjpU/ qdQ1rquehfhBHQr/z6/m83v5/azFi0VdeKDIx9uNo8nhMf/9przLYrjBRf5MWjWT Afxrl3ivmM6iNdEC1gNcQ+Nnoh4s+7rCyrqU7GCSGyYpZ5p6IUk= =6Fc6 -----END PGP SIGNATURE----- --NGWew0XCZa5OrRKZ4bGrAMWv5fShimY9i-- From nobody Tue Aug 20 16:55:11 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id ABC3C12083D for ; Tue, 20 Aug 2019 16:55:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ij6XKiJcmOAN for ; Tue, 20 Aug 2019 16:55:07 -0700 (PDT) Received: from mail-io1-xd41.google.com (mail-io1-xd41.google.com [IPv6:2607:f8b0:4864:20::d41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 43FC11200B9 for ; Tue, 20 Aug 2019 16:55:07 -0700 (PDT) Received: by mail-io1-xd41.google.com with SMTP id x4so883228iog.13 for ; Tue, 20 Aug 2019 16:55:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=YwpUB25lcrM5b70iYO5DG+rBaTZuAEeuCOfW1b+Bjtk=; b=P9y99aFdIEje5jAcx+yeAOQ2uTdJ3K7D1DxPNjbwfZa5prBG0zHUG7SxuJaOaBsyOa WcoQl0W78HfigT94eOXJNi/7K4Db3aS0NzhkKpwX6VI2Frc6P42KILmgveKKRiUAlK+Q VDtFVmM+S/8Wf5dl5FRv1TgBR5Z1tR3iSePIZPMAaxWTgw3kvevMLw3r+x7EJSRmzS/8 ea3g9Be5UY7N6SrTLeqKih8IlradNFlTC6B9iijVzxrnDi50ToJoPDluW8IRAu05KrXz fxTLV4EvVTus23WlUsL3dBEJZuH1wRY1783+RlxKwk8r3PKFJUl1QJxeZ+0Tgl5aNQcK LIMQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=YwpUB25lcrM5b70iYO5DG+rBaTZuAEeuCOfW1b+Bjtk=; b=X2calB3F6qEqt/srbMBbTYGquJR+N8rEwpJ6TDImivKv7CkPtYL5WIvCHBiv6zBYkb Lg5K4c7i5QBA9lQ4IknAt5cs7EDCpkCQkUxYay0xDi1VAubjCOCtdDRP5wL+8jGOAwj3 b9e5pQ8lNCKT0wk1GMXNO0lgwuBVvg7y+svnSTLNZPCL+YMkaLpHzqUVAz/4/bPntrEZ tjwzo34pmEAnark2LK8mP9IALXlVZp4xlKVk2w0TV+DgGn2ZD7uX3xxNRcT6zO17NV8B 0HmBy4gF0Oq9wA3fza7bhn8xskQpwkgCbCusjWe0djpKS3RvNzO4bwcmcjgRqTGHM7Z0 jSeA== X-Gm-Message-State: APjAAAUXELW0LBjbTh95usKyYRlKOCXY0PHy+nkrmrsHm/mvmncqO7iu 9gn8/79iFigG6x/qwclc093IqbKo8sgJ1Tyflpo= X-Google-Smtp-Source: APXvYqyzr4aXvmwhPPzpiSxaZZ9QAqQqB87rQUTfT8aimPWvRyYADN6z+hXQSeG78nsnesnkt8UDDN17g8BzYCbpGFU= X-Received: by 2002:a02:cc8f:: with SMTP id s15mr7121278jap.53.1566345306430; Tue, 20 Aug 2019 16:55:06 -0700 (PDT) MIME-Version: 1.0 References: <20190817170031.6F71C1691138@fafnir.remote.dragon.net> <5ED23002-7608-4A76-8181-E344E3FC6469@fugue.com> <3a0bf623-3aee-4d4d-fff0-4d127a81bbae@bellis.me.uk> <828f51ce-d551-dc39-83d2-008f31e9f09a@bellis.me.uk> <9485DBA8-F2A1-4CBB-92B7-E63273ABCFAE@gmail.com> In-Reply-To: From: Rob Sayre Date: Tue, 20 Aug 2019 16:54:54 -0700 Message-ID: To: Stephen Farrell Cc: Adam Roach , Ray Bellis , ADD Mailing list , Brian Dickson Content-Type: multipart/alternative; boundary="00000000000095dff70590952f7f" Archived-At: Subject: Re: [Add] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 20 Aug 2019 23:55:10 -0000 --00000000000095dff70590952f7f Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Tue, Aug 20, 2019 at 4:48 PM Stephen Farrell wrote: > > Hiya, > > On 21/08/2019 00:23, Rob Sayre wrote: > > On Tue, Aug 20, 2019 at 2:26 PM Adam Roach wrote: > > > >> On 8/20/19 4:21 PM, Stephen Farrell wrote: > >>> > >>> On 20/08/2019 20:55, Brian Dickson wrote: > >>>> The problem arises in how they become a MitM selectively (only for > >>>> domains with such URLs): they redirect traffic to a proxy via DNS. > >>> Huh? Where's that described? I've not heard/seen that UK ISPs are > >>> MitMing any HTTP/TLS and would be quite surprised were that the case. > >> > >> > >> I'm perplexed, too. Given that nearly 80% of worldwide HTTP traffic is > >> encrypted, and that an attempt to MITM such encrypted traffic would > >> simply result in the page not being loaded due to a certificate error, > >> this seems like it's not even remotely a feasible approach. Or, > >> minimally, it would be indistinguishable from a block on the entire > >> domain, as the end result would be identical. > >> > > > > They have users install trusted root certs. > > > > I think a few UK ISPs have started really locking down their routers > (can't > > change DNS settings, etc), and I think a few products from a few of tho= se > > ISPs come with installers (particularly for Windows), that install root > > certs, while others just direct users to install the cert using the OS > > control panels. It's not that common, yet, though. > > > > Here's an example of Vodafone MITMing imgur.com: < > > > https://forums.thinkbroadband.com/vodafone/4549610-vodafone-blocks-sites-= with-user-submitted-content.html#Post4610585 > >> > > I'm with Adam on this one. Reading at the URL above it appears > like a not that clever attempt to get https from a browser within > the home network to the home router, and not as an attempt to > MitM the web. > https://www.reddit.com/r/unitedkingdom/comments/c73b0z/new_vodaphone_router= _stealth_blocking_vpn_sites/ " It even breaks Imgur=E2=80=99s SSL by default, and they suggested to inst= all and trust their ssl certificate as a fix.. crazy" "Imgur pretty much failed to work and support felt you needed their root CA in order to simply browse." thanks, Rob --00000000000095dff70590952f7f Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Tue, Aug 20, 2019 at 4:48 PM Steph= en Farrell <stephen.farrell= @cs.tcd.ie> wrote:

Hiya,

On 21/08/2019 00:23, Rob Sayre wrote:
> On Tue, Aug 20, 2019 at 2:26 PM Adam Roach <adam@nostrum.com> wrote:
>
>> On 8/20/19 4:21 PM, Stephen Farrell wrote:
>>>
>>> On 20/08/2019 20:55, Brian Dickson wrote:
>>>> The problem arises in how they become a MitM selectively (= only for
>>>> domains with such URLs): they redirect traffic to a proxy = via DNS.
>>> Huh? Where's that described? I've not heard/seen that = UK ISPs are
>>> MitMing any HTTP/TLS and would be quite surprised were that th= e case.
>>
>>
>> I'm perplexed, too. Given that nearly 80% of worldwide HTTP tr= affic is
>> encrypted, and that an attempt to MITM such encrypted traffic woul= d
>> simply result in the page not being loaded due to a certificate er= ror,
>> this seems like it's not even remotely a feasible approach. Or= ,
>> minimally, it would be indistinguishable from a block on the entir= e
>> domain, as the end result would be identical.
>>
>
> They have users install trusted root certs.
>
> I think a few UK ISPs have started really locking down their routers (= can't
> change DNS settings, etc), and I think a few products from a few of th= ose
> ISPs come with installers (particularly for Windows), that install roo= t
> certs, while others just direct users to install the cert using the OS=
> control panels. It's not that common, yet, though.
>
> Here's an example of Vodafone MITMing imgur.com: <
> https://forums.thinkbroadband.com/vodafone/4549610-vo= dafone-blocks-sites-with-user-submitted-content.html#Post4610585
>>

I'm with Adam on this one. Reading at the URL above it appears
like a not that clever attempt to get https from a browser within
the home network to the home router, and not as an attempt to
MitM the web.


&= quot;=C2=A0It even breaks Imgur=E2=80=99s SSL by default, and they suggeste= d to install and trust their ssl certificate as a fix.. crazy"

"Imgur pretty much failed to work and support felt y= ou needed their root CA in order to simply browse."=C2=A0
thanks,
Rob
--00000000000095dff70590952f7f-- From nobody Tue Aug 20 17:05:50 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 90DF012084E for ; Tue, 20 Aug 2019 17:05:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.299 X-Spam-Level: X-Spam-Status: No, score=-4.299 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Vj5GtWrwJe4V for ; Tue, 20 Aug 2019 17:05:46 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4375512003F for ; Tue, 20 Aug 2019 17:05:45 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id A5039BE47; Wed, 21 Aug 2019 01:05:43 +0100 (IST) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id r4N1H_2TqEel; Wed, 21 Aug 2019 01:05:42 +0100 (IST) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id DA645BE39; Wed, 21 Aug 2019 01:05:41 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1566345942; bh=+N7CZ8vzTQMWmkNNFPoXMlOj8m+s0Z6glrjFh0UvIns=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From; b=vXYnR140KMKEkaRLWAoujB6WCJsyAKosef8EU+0iBiNBV369i/zgPcz4moIkdNIri rNhXzr2LlFQLPivNwAuUEt4Rvf90wSNJCJN/KZEzyqF8lhv+3blYfniQV62es2LqSW lJHJKeKrN0CFh176CtntEVIX4XWRjQjcV6FnMA6g= To: Rob Sayre Cc: ADD Mailing list , Adam Roach , Ray Bellis , Brian Dickson References: <20190817170031.6F71C1691138@fafnir.remote.dragon.net> <5ED23002-7608-4A76-8181-E344E3FC6469@fugue.com> <3a0bf623-3aee-4d4d-fff0-4d127a81bbae@bellis.me.uk> <828f51ce-d551-dc39-83d2-008f31e9f09a@bellis.me.uk> <9485DBA8-F2A1-4CBB-92B7-E63273ABCFAE@gmail.com> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: <4563fb84-98df-a271-caae-ef1b77d33e64@cs.tcd.ie> Date: Wed, 21 Aug 2019 01:05:40 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="7wfloAkOvKlpcomTgjnDsb9HEfZI2Cudo" Archived-At: Subject: Re: [Add] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Aug 2019 00:05:49 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --7wfloAkOvKlpcomTgjnDsb9HEfZI2Cudo Content-Type: multipart/mixed; boundary="mUVGmVz1uTQVmRhaAAAYYnCJ89xCEWA0t"; protected-headers="v1" From: Stephen Farrell To: Rob Sayre Cc: ADD Mailing list , Adam Roach , Ray Bellis , Brian Dickson Message-ID: <4563fb84-98df-a271-caae-ef1b77d33e64@cs.tcd.ie> Subject: Re: [Add] Participation References: <20190817170031.6F71C1691138@fafnir.remote.dragon.net> <5ED23002-7608-4A76-8181-E344E3FC6469@fugue.com> <3a0bf623-3aee-4d4d-fff0-4d127a81bbae@bellis.me.uk> <828f51ce-d551-dc39-83d2-008f31e9f09a@bellis.me.uk> <9485DBA8-F2A1-4CBB-92B7-E63273ABCFAE@gmail.com> In-Reply-To: --mUVGmVz1uTQVmRhaAAAYYnCJ89xCEWA0t Content-Type: multipart/mixed; boundary="------------BA2CF99641F878281C75560A" Content-Language: en-GB This is a multi-part message in MIME format. --------------BA2CF99641F878281C75560A Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hiya, On 21/08/2019 00:54, Rob Sayre wrote: > https://www.reddit.com/r/unitedkingdom/comments/c73b0z/new_vodaphone_ro= uter_stealth_blocking_vpn_sites/ >=20 > " It even breaks Imgur=E2=80=99s SSL by default, and they suggested to = install and > trust their ssl certificate as a fix.. crazy" >=20 > "Imgur pretty much failed to work and support felt you needed their roo= t CA > in order to simply browse." Actually, apologies to both you and Brian - following a few of those links it sure does look like people are saying Vodafone may have been or are MitMing some HTTP/TLS connections to imgur for some reason that's speculated to be connected to IWF. Can anyone verify that and send traces? If so, bugger me but that's mad and, I would hope, an absolute magnet for a fine from ICO. I'd not be that surprised if there's a GDPR exemption somewhere there, but I fail to see why should an ISP get to look at loads of users' images just for that reason? Ta, S. --------------BA2CF99641F878281C75560A Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------BA2CF99641F878281C75560A-- --mUVGmVz1uTQVmRhaAAAYYnCJ89xCEWA0t-- --7wfloAkOvKlpcomTgjnDsb9HEfZI2Cudo Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAl1citQACgkQWrL68XsX K+q5ThAA0Q6/VeyqmB95lld5nITZ1BcYOk/e1c4RdE8e6+wwR/nakFkXCB2CDy7/ 7oNDK6XPQwGX93iB0tZXpLPovEq8LLlcF/HVzHJRINx5lKF512AFzJ+XVleY54Fy 79flNh+fr6Fw7DmLeUJOnhBsfmB/7gXPWpBdjFhNBhduVYd0PzLpEnV1hvjY4kBf 1lLZDkTMnROMrH0VsaEAXNgv54Tf5OYyTm5FgH3OIvbSNUSCfQcspvTXqhV5GkwK F8QrJOa7rm4fGk8GrqTVCUZmi+qAstvtzuz/3Y2F2uOZmSCQub6EOO8MYnMxIGJm d3zrUsV3watjU3p4TXHyx1PQSVFc7gR72bjKLsYWVTn4LFCU4anXvAtvPxAAsFZu qarPKjkSz2kMTcWbgYxmDxJNqDAfEAL2kcNi2dnmmIzdjxFceWFAY8NGjWF7+oqo KKeYcvun5evGSRTD8NN4BvEVaGLS9QUSbGQ2amNmJfKke4RNtd2/z9iJRA9+JGWl uiYK7Mm3qGucumEDOnp0dSZ/Qrj721n4oIMiyyrJUkkjlenWfdf2kj37Hr7M+In2 WuORj6wb98vrjZaOZwPOe2Eb6oYVy5VwEmnYL5y/lVT2QB2gWO5IM3DjR1ueicpw D9keL8BQjO9j3FxKSG+Of2+6vELT3qJLkTHGuZew8WO7Ib21whY= =wyX5 -----END PGP SIGNATURE----- --7wfloAkOvKlpcomTgjnDsb9HEfZI2Cudo-- From nobody Tue Aug 20 17:10:42 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E77A612084E for ; Tue, 20 Aug 2019 17:10:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9etviQYYUsIQ for ; Tue, 20 Aug 2019 17:10:39 -0700 (PDT) Received: from mail-io1-xd29.google.com (mail-io1-xd29.google.com [IPv6:2607:f8b0:4864:20::d29]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F3C4412003F for ; Tue, 20 Aug 2019 17:10:38 -0700 (PDT) Received: by mail-io1-xd29.google.com with SMTP id z3so1108341iog.0 for ; Tue, 20 Aug 2019 17:10:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=INsbXGzLFkPNwX5VN4MS30b7VqXpLBE1aGjSccycN9o=; b=inn8SrQFjQZcFuK/jbgNidjQr6FijRYiHZro5uYPXYZlX8KiMTSikT/P/3Yh3UOzK/ wKyE/CHP1vvAMvbAHfimht5QHElsjlMpvSk7IodyMxspU9LkL6bSiwWFusOvOWVBXbTy gjRcmvvz1fkdxbloPLZ0q+yNj/vhUFv5YSWN9yyPcbeLLm2iim/3Lcot3f0HtZemRgOu 9xeuEQeiZpblMbXMPRQP6fJZEz+MsCImdt0puyZkZsaIZeaJKvDxYPCcR1fapAl5w43C n0HXbH+jrkyWKLvezmdj+aJIDY/sW/S7Bk3HBOc2TulsrP8LQgsI3Nza2XDc54cGhiNi pCmA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=INsbXGzLFkPNwX5VN4MS30b7VqXpLBE1aGjSccycN9o=; b=LI8JBCgVUsyHu5nhbtPVR4zc7on98MtXqLTCTbOuyomvysOKmmkSQ/jLMbDroMtCc5 BrJRB8mQutssNLsGWrglu8EUtz/UM5Yi+zbDyIY5+fbZFg6dgMRTJ8VsQ9aMV3T9T0+e Uzx8C8ALsTZXSeuxJGUJ+EPuEG9b2kYEkMxPDjsAjVQg+ElgbZ80j3bajE3ZLNnxYCRY hUpco2aOJa2NNYPtY4fW3PZ4uDLhvRwIDFkfh0pAxJcaemkHn4gfia2tLGbI5WN/jC02 4p9uJKDnje41sAnhbP/fHnln1T+Z7p03h7RA6PLjgISG6f9YrNiYA27Jc6SaAWjRjXTV LgDw== X-Gm-Message-State: APjAAAUUfMVL6nukSFD178N+kEUW3RQjMeygC0x70mq0PAMXusDcPZLj VLZrVrhizihUP2C78Adp3NW+Db9UEy20W8Cd+Zg= X-Google-Smtp-Source: APXvYqxsONKMCOL9cNayYTcjZZVm4BMYDheC1IXDzyzNx8xSDL0X/WobVrDGTAOXrNIo30xGfKivW0x13nX4gHxaLJI= X-Received: by 2002:a02:9a0b:: with SMTP id b11mr7037229jal.106.1566346238101; Tue, 20 Aug 2019 17:10:38 -0700 (PDT) MIME-Version: 1.0 References: <20190817170031.6F71C1691138@fafnir.remote.dragon.net> <5ED23002-7608-4A76-8181-E344E3FC6469@fugue.com> <3a0bf623-3aee-4d4d-fff0-4d127a81bbae@bellis.me.uk> <828f51ce-d551-dc39-83d2-008f31e9f09a@bellis.me.uk> <9485DBA8-F2A1-4CBB-92B7-E63273ABCFAE@gmail.com> <4563fb84-98df-a271-caae-ef1b77d33e64@cs.tcd.ie> In-Reply-To: <4563fb84-98df-a271-caae-ef1b77d33e64@cs.tcd.ie> From: Rob Sayre Date: Tue, 20 Aug 2019 17:10:26 -0700 Message-ID: To: Stephen Farrell Cc: ADD Mailing list , Adam Roach , Ray Bellis , Brian Dickson Content-Type: multipart/alternative; boundary="0000000000001e0e05059095673e" Archived-At: Subject: Re: [Add] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Aug 2019 00:10:42 -0000 --0000000000001e0e05059095673e Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Tue, Aug 20, 2019 at 5:05 PM Stephen Farrell wrote: > > > Hiya, > > On 21/08/2019 00:54, Rob Sayre wrote: > > > https://www.reddit.com/r/unitedkingdom/comments/c73b0z/new_vodaphone_rout= er_stealth_blocking_vpn_sites/ > > > > " It even breaks Imgur=E2=80=99s SSL by default, and they suggested to = install > and > > trust their ssl certificate as a fix.. crazy" > > > > "Imgur pretty much failed to work and support felt you needed their roo= t > CA > > in order to simply browse." > > Actually, apologies to both you and Brian - following a few > of those links it sure does look like people are saying > Vodafone may have been or are MitMing some HTTP/TLS > connections to imgur for some reason that's speculated to > be connected to IWF. > I actually found a reply from a Vodafone community manager. https://www.reddit.com/r/AskNetsec/comments/5v158o/trying_to_find_out_if_vo= dafone_broadband_uk/diuhx7l/ "Our current content controls means that HTTPS traffic to this website will appear to be insecure" thanks, Rob --0000000000001e0e05059095673e Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Tue, Aug 20, 2019 at 5:05 PM Steph= en Farrell <stephen.farrell= @cs.tcd.ie> wrote:


Hiya,

On 21/08/2019 00:54, Rob Sayre wrote:
> https://www.reddit.com/r/unitedkingdom/comments/c73b0z/new_vodaphon= e_router_stealth_blocking_vpn_sites/
>
> " It even breaks Imgur=E2=80=99s SSL by default, and they suggest= ed to install and
> trust their ssl certificate as a fix.. crazy"
>
> "Imgur pretty much failed to work and support felt you needed the= ir root CA
> in order to simply browse."

Actually, apologies to both you and Brian - following a few
of those links it sure does look like people are saying
Vodafone may have been or are MitMing some HTTP/TLS
connections to imgur for some reason that's speculated to
be connected to IWF.

I actually found a= reply from a Vodafone community manager.

https://www.reddit.com/r/AskNetsec/commen= ts/5v158o/trying_to_find_out_if_vodafone_broadband_uk/diuhx7l/=C2=A0

"Our current content controls means that HTTPS = traffic to this website will appear to be insecure"

thanks,
Rob
--0000000000001e0e05059095673e-- From nobody Tue Aug 20 17:26:51 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7656F120143 for ; Tue, 20 Aug 2019 17:26:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id J_j4sfZIXnWs for ; Tue, 20 Aug 2019 17:26:47 -0700 (PDT) Received: from mail-io1-xd32.google.com (mail-io1-xd32.google.com [IPv6:2607:f8b0:4864:20::d32]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 42F3F12003F for ; Tue, 20 Aug 2019 17:26:47 -0700 (PDT) Received: by mail-io1-xd32.google.com with SMTP id o9so1121222iom.3 for ; Tue, 20 Aug 2019 17:26:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=rWycNKjgkqXzCeALpmPcWrwMxGSUImJ0oi8fa1Y7fcY=; b=mTUQlC2GCnp6xbHqna7ubm16NT3N8XMYUdqigsHShYu6/M0KxpDnAWOsiQDXAtIMDQ D8OdOx/D7DP7G9W9OeWb67qP3ckMimHebF0bb1+lnr/Xt8GkDWdWiu7kdyDkKl5T3FGc lH5hUac00zBjMlCyuImgkq/xTytiFw/KI+HJ9fLRgajsUTufHSzvt8SaHN3SMxiw2XBg EIe1IOKJf+dEq1diMzcNE6Cbwe1B4uvtxUIN7sUUjB4tT2Dax79Vpp6YKQ8bpnESitsn MrCrwWdYUWbZ/NHosqEGhX5k15AJb7PQY2fktU9fnXZbVGI2t4PZ8no6GVHg/QvbqkUT MBzw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=rWycNKjgkqXzCeALpmPcWrwMxGSUImJ0oi8fa1Y7fcY=; b=SLWnbxRq6OIVgd3VWQCQr8P5GUxq7ats3ny9SaqXlkdeOXNesKd2/6BchKZAMrbbSU q0qBqVjoTAs7oHRRFvZNa+9a12vNczR4yFxcrohoF8ouVvLf8yiZOUo/9GKXiRe3ogpF ENAzegF0aEQXC2wQRAE0AexpmkRBRlDW3dWGuPXUHOQH9fwPnqLlrOBFpcZrfspZaXVL QqHk13RMds+0tRy2hf2amBTaNcA2OGVAvVOJUJkgIFGaWQDWTJTKlBPtI9uBVex4pWe1 BOWU8YxMQewbz/0/g9ZmIJxbU6L5vNyMMa0haOm3Ky/D1/bq1/y85NbRtEr29BrRRVJV KUjA== X-Gm-Message-State: APjAAAUrT7elUccZlsoxkYx+5iur9dytxcR/5jdgYDakP91NG1zmCQDx zSRluToRrLhcquA7NeEQAMjCVOuSy79naIOhMUQ= X-Google-Smtp-Source: APXvYqxJpsjNIMEO1OszN3Q/R/AwV/uNSOXaMliLUcS4cZuFgcZB88B33boH5Ll/V5F3RsI0Clvm+uxaTFn9hBc09Sg= X-Received: by 2002:a05:6638:303:: with SMTP id w3mr6795887jap.103.1566347206481; Tue, 20 Aug 2019 17:26:46 -0700 (PDT) MIME-Version: 1.0 References: <20190817170031.6F71C1691138@fafnir.remote.dragon.net> <5ED23002-7608-4A76-8181-E344E3FC6469@fugue.com> <3a0bf623-3aee-4d4d-fff0-4d127a81bbae@bellis.me.uk> <828f51ce-d551-dc39-83d2-008f31e9f09a@bellis.me.uk> <9485DBA8-F2A1-4CBB-92B7-E63273ABCFAE@gmail.com> <4563fb84-98df-a271-caae-ef1b77d33e64@cs.tcd.ie> In-Reply-To: From: Rob Sayre Date: Tue, 20 Aug 2019 17:26:34 -0700 Message-ID: To: Stephen Farrell Cc: ADD Mailing list , Adam Roach , Ray Bellis , Brian Dickson Content-Type: multipart/alternative; boundary="000000000000d65b2b059095a02a" Archived-At: Subject: Re: [Add] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Aug 2019 00:26:49 -0000 --000000000000d65b2b059095a02a Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Tue, Aug 20, 2019 at 5:10 PM Rob Sayre wrote: > > > On Tue, Aug 20, 2019 at 5:05 PM Stephen Farrell > wrote: > >> >> >> Hiya, >> >> On 21/08/2019 00:54, Rob Sayre wrote: >> > >> https://www.reddit.com/r/unitedkingdom/comments/c73b0z/new_vodaphone_rou= ter_stealth_blocking_vpn_sites/ >> > >> > " It even breaks Imgur=E2=80=99s SSL by default, and they suggested to= install >> and >> > trust their ssl certificate as a fix.. crazy" >> > >> > "Imgur pretty much failed to work and support felt you needed their >> root CA >> > in order to simply browse." >> >> Actually, apologies to both you and Brian - following a few >> of those links it sure does look like people are saying >> Vodafone may have been or are MitMing some HTTP/TLS >> connections to imgur for some reason that's speculated to >> be connected to IWF. >> > > I actually found a reply from a Vodafone community manager. > > > https://www.reddit.com/r/AskNetsec/comments/5v158o/trying_to_find_out_if_= vodafone_broadband_uk/diuhx7l/ > > > "Our current content controls means that HTTPS traffic to this website > will appear to be insecure" > I found this too: < https://wiki.openrightsgroup.org/wiki/Vodafone_Content_Control>. I guess they're running Blue Coat on the whole ISP. I wonder if this shows up as Blue Coat interception on < https://malcolm.cloudflare.com>. thanks, Rob --000000000000d65b2b059095a02a Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Tue, Aug 20, 2019 at 5:10 PM Rob Sayre= <sayrer@gmail.com> wrote:


On Tue, Aug 20, 2019 at 5:= 05 PM Stephen Farrell <stephen.farrell@cs.tcd.ie> wrote:


Hiya,

On 21/08/2019 00:54, Rob Sayre wrote:
> https://www.reddit.com/r/unitedkingdom/comments/c73b0z/new_vodaphon= e_router_stealth_blocking_vpn_sites/
>
> " It even breaks Imgur=E2=80=99s SSL by default, and they suggest= ed to install and
> trust their ssl certificate as a fix.. crazy"
>
> "Imgur pretty much failed to work and support felt you needed the= ir root CA
> in order to simply browse."

Actually, apologies to both you and Brian - following a few
of those links it sure does look like people are saying
Vodafone may have been or are MitMing some HTTP/TLS
connections to imgur for some reason that's speculated to
be connected to IWF.

I actually found a= reply from a Vodafone community manager.


"Our current content controls= means that HTTPS traffic to this website will appear to be insecure"<= /div>

I found this too: <htt= ps://wiki.openrightsgroup.org/wiki/Vodafone_Content_Control>. I gues= s they're running Blue Coat on the whole ISP.

= I wonder if this shows up as Blue Coat interception on <https://malcolm.cloudflare.com>.

thanks,
Rob=C2=A0
--000000000000d65b2b059095a02a-- From nobody Tue Aug 20 17:31:33 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 40EEC120835 for ; Tue, 20 Aug 2019 17:31:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.996 X-Spam-Level: X-Spam-Status: No, score=-1.996 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Q1RbwAuEQDIK for ; Tue, 20 Aug 2019 17:31:28 -0700 (PDT) Received: from mail-qk1-x72c.google.com (mail-qk1-x72c.google.com [IPv6:2607:f8b0:4864:20::72c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8CADD12003F for ; Tue, 20 Aug 2019 17:31:28 -0700 (PDT) Received: by mail-qk1-x72c.google.com with SMTP id d23so384368qko.3 for ; Tue, 20 Aug 2019 17:31:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=jotnE/WYRqimqgVAJSpF27Qi463YC/rUTeuTa/Tbeh8=; b=u2LRvia6WByjMIWSjN4gQLiFXIqMkPO5uMxK2zFuccXOfL/rnWzpkrzOgA221rYbHg L+YnGQ7DEHIBrZmppcpnZ4udtfFMj/c3qHKlCgFcCZLrEnmjTTwqDXysOosRXUFfOjfE 7hbaNwQ5dD8QnuJ4jsK3Yke+kFGO9tWzydmplux7U70/3YGKbGTmIn5EEXwMYQ/gsHtY kQKCHsjWp4AM8lkViPpRFU6j5mcxWDNqOMgt/BYwS79+ZEfZdoLnvOd/lLHpWOq8Jr7Q RgTcNlDU3Te6+gavUmJabJT4Xy+v6R4Tr1BC6rXkQ/dxD1gxP9s53ckQfULrYKt77Vud xm2g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=jotnE/WYRqimqgVAJSpF27Qi463YC/rUTeuTa/Tbeh8=; b=MdFDBnNE9d+WsZnuK/11SC+yOmrqAdcTMReAitGmV+2yoORNT1saVdP0OgWiNEnQEX MOwUFh43wgHglC/lN/VJ+22MBbGiuj3+0ic62IGVkjaY/DHyh1YOppfW5TOB1RaYxfyP NJNYqnG5gw0p2d2jc1bQ67976VCqXNaDvB8aLoQAZhAOh99oVG3fknUSxe/rLso9yFWu 9eO3SMnG73EgSaoa2Qam/5vm/ZjuLWm/3GQGjCPKm1P5C186JE5mCJlb5I/5fa+ZY29T Ns0q9pLGGVz9i5RklWhmOcjoa0iJTFQtPGJn8MR7ovCXtgEn7wK/45jdprpzezD3T3d/ uVAw== X-Gm-Message-State: APjAAAVBNsKUBJGHVxYPxlcyyoQvWjEE5CYdCKkXMySN+REkeM0ljim5 tLmSuP9d1x9lDWHHTEpGHfk= X-Google-Smtp-Source: APXvYqxVFZmZy3vtlW0fsXQBEoy+n4YiSdQVJ79mU5a15xHQ/SXZOmjx9XZCBfd31qWWsYQmnMRkYA== X-Received: by 2002:a37:4f8a:: with SMTP id d132mr12856928qkb.292.1566347487615; Tue, 20 Aug 2019 17:31:27 -0700 (PDT) Received: from [192.168.2.4] (cpe-76-179-66-50.maine.res.rr.com. [76.179.66.50]) by smtp.gmail.com with ESMTPSA id h66sm9321240qke.61.2019.08.20.17.31.26 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 20 Aug 2019 17:31:27 -0700 (PDT) Content-Type: multipart/alternative; boundary=Apple-Mail-6376BE33-243C-42AE-A5B4-E79F5CDA880A Mime-Version: 1.0 (1.0) From: Brian Dickson X-Mailer: iPhone Mail (16G77) In-Reply-To: <1d021d04-0633-c6fd-575b-39108ca31039@nostrum.com> Date: Tue, 20 Aug 2019 20:31:25 -0400 Cc: Stephen Farrell , Ray Bellis , ADD Mailing list Content-Transfer-Encoding: 7bit Message-Id: <024678E6-4F74-47F0-862D-3E8115451784@gmail.com> References: <20190817170031.6F71C1691138@fafnir.remote.dragon.net> <5ED23002-7608-4A76-8181-E344E3FC6469@fugue.com> <3a0bf623-3aee-4d4d-fff0-4d127a81bbae@bellis.me.uk> <828f51ce-d551-dc39-83d2-008f31e9f09a@bellis.me.uk> <9485DBA8-F2A1-4CBB-92B7-E63273ABCFAE@gmail.com> <1d021d04-0633-c6fd-575b-39108ca31039@nostrum.com> To: Adam Roach Archived-At: Subject: Re: [Add] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Aug 2019 00:31:31 -0000 --Apple-Mail-6376BE33-243C-42AE-A5B4-E79F5CDA880A Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Given some of the recent information we have collectively uncovered, I sugge= st more research may be worth doing. The things I think are worth getting to the bottom of are: Methods used by UK ISPs Listings (UK vs non-UK, as IWF=E2=80=99s page seems to suggest different pra= ctices for those) Durations of listings and number of concurrent listings=20 False positives reported, confirmed Given the consequences and implications, I would encourage some kind of offi= cial outreach from Mozilla and Google (browser department), to engage with I= WF. Some independent verification of the nature and severity of the images, o= n a sampled basis, may allow a better comprehension of the legitimacy of the= CAI URL list. Whether and how either browser might decide to endorse their URL list, inclu= ding whether that should be UK only or perhaps wider in scope, is something b= est handled by those with responsibility and accountability. Third and fourth hand, and anecdotal reports are probably not suitable for i= mportant issues such as child abuse images . Brian > On Aug 20, 2019, at 7:30 PM, Adam Roach wrote: >=20 >> On 8/20/19 5:54 PM, Brian Dickson wrote: >>=20 >>=20 >>> On Tue, Aug 20, 2019 at 5:21 PM Stephen Farrell wrote: >>>=20 >>>=20 >>> On 20/08/2019 20:55, Brian Dickson wrote: >>> > The problem arises in how they become a MitM selectively (only for >>> > domains with such URLs): they redirect traffic to a proxy via DNS. >>> Huh? Where's that described? >>=20 >> https://en.wikipedia.org/wiki/Internet_Watch_Foundation#Of_proxy_server_u= sed_by_ISPs >>=20 >> I have no direct knowledge, I'm going off of the wikipedia page. >> (In particular, I haven't looked into the HTTP vs HTTPS issue at all, jus= t summarizing what I read above.) >=20 > Given the shift in cleartext traffic versus encrypted traffic in the past f= ew years, I suspect that specific part of the Wikipedia article is no longer= accurate. As I mention in my other note, 80% of web traffic is encrypted to= day, up from 30% five years ago. The described technique was questionable at= 30%, and is basically completely broken at 80%. >=20 > /a --Apple-Mail-6376BE33-243C-42AE-A5B4-E79F5CDA880A Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable Given some of the recent information we hav= e collectively uncovered, I suggest more research may be worth doing.
The things I think are worth getting to the bottom of are:
Methods used by UK ISPs
Listings (UK vs non-UK, as IWF=E2=80= =99s page seems to suggest different practices for those)
Duration= s of listings and number of concurrent listings 
False positi= ves reported, confirmed

Given the consequences and i= mplications, I would encourage some kind of official outreach from Mozilla a= nd Google (browser department), to engage with IWF. Some independent verific= ation of the nature and severity of the images, on a sampled basis, may allo= w a better comprehension of the legitimacy of the CAI URL list.
Whether and how either browser might decide to endorse their UR= L list, including whether that should be UK only or perhaps wider in scope, i= s something best handled by those with responsibility and accountability.

Third and fourth hand, and anecdotal reports are prob= ably not suitable for important issues such as child abuse images .

<= div dir=3D"ltr">Brian

On Aug 20, 2019, at 7:30 PM,= Adam Roach <adam@nostrum.com>= wrote:

=20 =20 =20
On 8/20/19 5:54 PM, Brian Dickson wrote:


On Tue, Aug 20, 2019 at 5:21= PM Stephen Farrell <stephen.farrell@cs.tcd.ie> wrote:


On 20/08/2019 20:55, Brian Dickson wrote:
> The problem arises in how they become a MitM selectively (only for
> domains with such URLs): they redirect traffic to a proxy via DNS.
Huh? Where's that described?


I have no direct knowledge, I'm going off of the wikipedia page.
(In particular, I haven't looked into the HTTP vs HTTPS issue at all, just summarizing what I read above.)


Given the shift in cleartext traffic versus encrypted traffic in the past few years, I suspect that specific part of the Wikipedia article is no longer accurate. As I mention in my other note, 80% of web traffic is encrypted today, up from 30% five years ago. The described technique was questionable at 30%, and is basically completely broken at 80%.

/a

=20
= --Apple-Mail-6376BE33-243C-42AE-A5B4-E79F5CDA880A-- From nobody Tue Aug 20 17:34:46 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 52E0912008B for ; Tue, 20 Aug 2019 17:34:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.679 X-Spam-Level: X-Spam-Status: No, score=-1.679 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_INVALID=0.1, DKIM_SIGNED=0.1, T_SPF_HELO_PERMERROR=0.01, T_SPF_PERMERROR=0.01, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=fail (1024-bit key) reason="fail (message has been altered)" header.d=nostrum.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eOSnnsGPB7FV for ; Tue, 20 Aug 2019 17:34:43 -0700 (PDT) Received: from nostrum.com (raven-v6.nostrum.com [IPv6:2001:470:d:1130::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 390B212003F for ; Tue, 20 Aug 2019 17:34:43 -0700 (PDT) Received: from MacBook-Pro.roach.at (99-152-146-228.lightspeed.dllstx.sbcglobal.net [99.152.146.228]) (authenticated bits=0) by nostrum.com (8.15.2/8.15.2) with ESMTPSA id x7L0YWmc038415 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NO); Tue, 20 Aug 2019 19:34:33 -0500 (CDT) (envelope-from adam@nostrum.com) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=nostrum.com; s=default; t=1566347674; bh=+OaP3ZivjPZS30qPo+iIjjs0pSXHsAJIx+AHza8+USI=; h=Subject:To:Cc:References:From:Date:In-Reply-To; b=asqrxxD99CaS5/7UOypcl1pjqjDnp8HLemJ7jqI2rAv9M+LS9NNuLGAlwCjj9erTQ r6Lw0Z4p5E9c1GzV81UMVHZxLqAeSomjbMwcJdnGOyl4NMbox26PlBso/Jee7Qg4Vl xnZKok9JLqB/g5Z/YFHQdwnVVAsXgrbmU3tkYxrw= X-Authentication-Warning: raven.nostrum.com: Host 99-152-146-228.lightspeed.dllstx.sbcglobal.net [99.152.146.228] claimed to be MacBook-Pro.roach.at To: Stephen Farrell , Rob Sayre Cc: ADD Mailing list , Ray Bellis , Brian Dickson References: <20190817170031.6F71C1691138@fafnir.remote.dragon.net> <5ED23002-7608-4A76-8181-E344E3FC6469@fugue.com> <3a0bf623-3aee-4d4d-fff0-4d127a81bbae@bellis.me.uk> <828f51ce-d551-dc39-83d2-008f31e9f09a@bellis.me.uk> <9485DBA8-F2A1-4CBB-92B7-E63273ABCFAE@gmail.com> <4563fb84-98df-a271-caae-ef1b77d33e64@cs.tcd.ie> From: Adam Roach Message-ID: <20e747be-8a74-ece3-2dd3-c1350ab0d236@nostrum.com> Date: Tue, 20 Aug 2019 19:34:27 -0500 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: <4563fb84-98df-a271-caae-ef1b77d33e64@cs.tcd.ie> Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Content-Language: en-US Archived-At: Subject: Re: [Add] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Aug 2019 00:34:44 -0000 On 8/20/19 7:05 PM, Stephen Farrell wrote: > > Hiya, > > On 21/08/2019 00:54, Rob Sayre wrote: >> https://www.reddit.com/r/unitedkingdom/comments/c73b0z/new_vodaphone_router_stealth_blocking_vpn_sites/ >> >> " It even breaks Imgur’s SSL by default, and they suggested to install and >> trust their ssl certificate as a fix.. crazy" >> >> "Imgur pretty much failed to work and support felt you needed their root CA >> in order to simply browse." > Actually, apologies to both you and Brian - following a few > of those links it sure does look like people are saying > Vodafone may have been or are MitMing some HTTP/TLS > connections to imgur for some reason that's speculated to > be connected to IWF. > > Can anyone verify that and send traces? > > If so, bugger me but that's mad and, I would hope, an > absolute magnet for a fine from ICO. I'd not be that > surprised if there's a GDPR exemption somewhere there, > but I fail to see why should an ISP get to look at > loads of users' images just for that reason? Wow. I'm going to have to walk back my comments as well, and extend a similar apology. This is utter madness. I'll note that the comments on the cited reddit discussion quickly get into the finer points of using 1.1.1.1 versus 8.8.8.8. That isn't applications doing DNS, although it touches on the centralization issue that is frequently conflated with it. /a From nobody Tue Aug 20 18:15:34 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B57B7120019 for ; Tue, 20 Aug 2019 18:15:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id f4ScX-Ku02Xh for ; Tue, 20 Aug 2019 18:15:31 -0700 (PDT) Received: from mail-io1-xd35.google.com (mail-io1-xd35.google.com [IPv6:2607:f8b0:4864:20::d35]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2C627120018 for ; Tue, 20 Aug 2019 18:15:31 -0700 (PDT) Received: by mail-io1-xd35.google.com with SMTP id i22so1308746ioh.2 for ; Tue, 20 Aug 2019 18:15:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=vlI5sZcJTmYfLoh9ZFhZTG+8lSWYRzrIAp9ZHO5VosM=; b=IgyikLKvnlacILqjCY5lszLEfT69o8z2Fh0fX2rkDVKA8bTXQtgn1AMvP3Vzw01GqX 95W3T8mo7+R3XxLM8ehdSw7KMkaIu7kRYpPPsMypbXqHD+MUSkecceB4i/UjpMDYdnGV jWRPlPp7Yy+RweyS96r6JVoEQMdIxO9fr2R7zZEznFpZJ4kaYI8MDgb2vmnBWtaRbw8K x9rWrCubm2LdYrHOKya0pI5D8h5fDoUhoCEDRjsMosBmPpcE6FYojONdJgyVSIlou+WG /mVjsxQTLvPf9ymPBI80tXViyQSbh8LQfTczO23d/0cr6q8iy1Yye+PMwZ6GxDge6frx mvmA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=vlI5sZcJTmYfLoh9ZFhZTG+8lSWYRzrIAp9ZHO5VosM=; b=oBr2yuCeQzVh9UWgClJ+7g3OX8DYvOKMBWJ/n7H/VeTxx0uDD17WbT1iGuDBxjSDZm kRaaUpA8UXe7cUZnzFm7WglMXHJp9fyS6Wpz0Ih4xjcFC/Qjd+Ca6EZaPpiRLfVrgHsu yLqfMfFOnpZDKUBxnBlUHQGuewXKditAcJqA1Sqd53I/OKOhCPiUE5YZO8CQGKO1ygg+ OAQZ5FJlMJx4dWIArhNw3SB8rz4FhAokSjP+uab6liHm0edwtfKesBdPf8kynWIyqAbo mxdjM6oi/HBJBvkVhq/MrL8xwZuhs00Ib4ubAtD9esgbzZqX9A2lcG7VfZfJUt2o09Av iitw== X-Gm-Message-State: APjAAAXG7SPbApn0J9qqbbOCeRi4Q49kKvwACl2Wj0YTLXiOY4o+7MNp VODJhkg3Be4n/hoiwZ1hxnezH8Ot1GO8wQdmJKk= X-Google-Smtp-Source: APXvYqyYN3nzW+5UNMK7dcvgy+zeN+XGACDMP0wi9D+LnLSfnMCIEiT4tgLs5RTY2ZPxGxnQhmFHmHN4eF7AQ6aLXhQ= X-Received: by 2002:a02:c90e:: with SMTP id t14mr7363425jao.131.1566350130162; Tue, 20 Aug 2019 18:15:30 -0700 (PDT) MIME-Version: 1.0 References: <20190817170031.6F71C1691138@fafnir.remote.dragon.net> <5ED23002-7608-4A76-8181-E344E3FC6469@fugue.com> <3a0bf623-3aee-4d4d-fff0-4d127a81bbae@bellis.me.uk> <828f51ce-d551-dc39-83d2-008f31e9f09a@bellis.me.uk> <9485DBA8-F2A1-4CBB-92B7-E63273ABCFAE@gmail.com> <4563fb84-98df-a271-caae-ef1b77d33e64@cs.tcd.ie> <20e747be-8a74-ece3-2dd3-c1350ab0d236@nostrum.com> In-Reply-To: <20e747be-8a74-ece3-2dd3-c1350ab0d236@nostrum.com> From: Rob Sayre Date: Tue, 20 Aug 2019 18:15:18 -0700 Message-ID: To: Adam Roach Cc: Stephen Farrell , ADD Mailing list , Ray Bellis , Brian Dickson Content-Type: multipart/alternative; boundary="0000000000001a30420590964ff8" Archived-At: Subject: Re: [Add] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Aug 2019 01:15:34 -0000 --0000000000001a30420590964ff8 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Tue, Aug 20, 2019 at 5:34 PM Adam Roach wrote: > On 8/20/19 7:05 PM, Stephen Farrell wrote: > > > > Hiya, > > > > On 21/08/2019 00:54, Rob Sayre wrote: > >> > https://www.reddit.com/r/unitedkingdom/comments/c73b0z/new_vodaphone_rout= er_stealth_blocking_vpn_sites/ > >> > >> " It even breaks Imgur=E2=80=99s SSL by default, and they suggested to= install > and > >> trust their ssl certificate as a fix.. crazy" > >> > >> "Imgur pretty much failed to work and support felt you needed their > root CA > >> in order to simply browse." > > Actually, apologies to both you and Brian - following a few > > of those links it sure does look like people are saying > > Vodafone may have been or are MitMing some HTTP/TLS > > connections to imgur for some reason that's speculated to > > be connected to IWF. > > > > Can anyone verify that and send traces? > > > > If so, bugger me but that's mad and, I would hope, an > > absolute magnet for a fine from ICO. I'd not be that > > surprised if there's a GDPR exemption somewhere there, > > but I fail to see why should an ISP get to look at > > loads of users' images just for that reason? > > > Wow. I'm going to have to walk back my comments as well, and extend a > similar apology. This is utter madness. > I agree it seems strange, even if well-meaning. To recap, we have well-documented examples of: ISPs using Classic DNS to fuel ad networks (they could still do this if they provided DoT/DoH) ISPs MITMing TLS connections in an effort to provide content filtering Entertainment devices hard-coding DNS services, ignoring the OS and network administrator Routers that use centralized DNS services without user interaction, ignoring the OS and network administrator Android handsets that enable a VPN on certain networks by default, and all networks with user interaction, bypassing local DNS Home routers being exploited to hijack Classic DNS It just doesn't seem like consensus is likely in this landscape. thanks, Rob --0000000000001a30420590964ff8 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Tue, Aug 20, 2019 at 5:34 PM Adam Roac= h <adam@nostrum.com> wrote:
On 8/20/19 7:05 PM, Stephen Farrell wrote:
>
> Hiya,
>
> On 21/08/2019 00:54, Rob Sayre wrote:
>> https://www.reddit.com/r/unitedkingdom/comments/c73b0z/new_voda= phone_router_stealth_blocking_vpn_sites/
>>
>> " It even breaks Imgur=E2=80=99s SSL by default, and they sug= gested to install and
>> trust their ssl certificate as a fix.. crazy"
>>
>> "Imgur pretty much failed to work and support felt you needed= their root CA
>> in order to simply browse."
> Actually, apologies to both you and Brian - following a few
> of those links it sure does look like people are saying
> Vodafone may have been or are MitMing some HTTP/TLS
> connections to imgur for some reason that's speculated to
> be connected to IWF.
>
> Can anyone verify that and send traces?
>
> If so, bugger me but that's mad and, I would hope, an
> absolute magnet for a fine from ICO. I'd not be that
> surprised if there's a GDPR exemption somewhere there,
> but I fail to see why should an ISP get to look at
> loads of users' images just for that reason?


Wow. I'm going to have to walk back my comments as well, and extend a <= br> similar apology. This is utter madness.

I agree it seems strange, even if well-meaning. To recap, we have well-doc= umented examples of:

ISPs using Classic DNS to fue= l ad networks (they could still do this if they provided DoT/DoH)
ISPs MITMing TLS connections in an effort to provide content filtering
Entertainment devices hard-coding DNS services, ignoring the OS and = network administrator
Routers that use centralized DNS services w= ithout user interaction,=C2=A0ignoring the OS and network administrator
Android handsets that enable a VPN on certain networks by default, a= nd all networks with user interaction, bypassing local DNS
Home r= outers being exploited to hijack Classic DNS

It ju= st doesn't seem like consensus is likely in this landscape.
<= br>
thanks,
Rob


--0000000000001a30420590964ff8-- From nobody Tue Aug 20 22:11:10 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EBCF512085A for ; Tue, 20 Aug 2019 22:11:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FROM_EXCESS_BASE64=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=frobbit.se Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cGWa1Pp1JdcY for ; Tue, 20 Aug 2019 22:11:06 -0700 (PDT) Received: from mail.frobbit.se (mail.frobbit.se [85.30.129.176]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BA45B120071 for ; Tue, 20 Aug 2019 22:11:06 -0700 (PDT) Received: from [192.168.10.199] (c-c4b7d954.028-114-73746f27.bbcust.telenor.se [84.217.183.196]) by mail.frobbit.se (Postfix) with ESMTPSA id 1029020742; Wed, 21 Aug 2019 07:11:03 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=frobbit.se; s=mail; t=1566364263; bh=jIxU6JnuwkvbJ/7+azi4v20/NqWpw8n6XJ7coNxB54k=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Q3d0Irh203AXbSb0jq2W7a3e667Y+3rFNo0YFHTUb8+EcZVXaEhZkifN6VIlMwj68 gqNjpczx7epQmpOnxdpTmaYWmY72UElx3HdxdsGSc4+KnK1wpTr4xMQaBwXsptsPFq HsopG5CKPufi5lUszyNPPCtoAvVtUwzP/RCCWjSI= From: "Patrik =?utf-8?b?RsOkbHRzdHLDtm0=?=" To: "Stephen Farrell" Cc: "Rob Sayre" , "Adam Roach" , "ADD Mailing list" , "Ray Bellis" , "Brian Dickson" Date: Wed, 21 Aug 2019 07:11:02 +0200 X-Mailer: MailMate (1.12.5r5635) Message-ID: <2ABE9821-1CF9-4FBC-907A-E0402E139C03@frobbit.se> In-Reply-To: References: <20190817170031.6F71C1691138@fafnir.remote.dragon.net> <5ED23002-7608-4A76-8181-E344E3FC6469@fugue.com> <3a0bf623-3aee-4d4d-fff0-4d127a81bbae@bellis.me.uk> <828f51ce-d551-dc39-83d2-008f31e9f09a@bellis.me.uk> <9485DBA8-F2A1-4CBB-92B7-E63273ABCFAE@gmail.com> MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=_MailMate_F2EB8276-E109-403E-9624-75BF6CA38744_="; micalg=pgp-sha1; protocol="application/pgp-signature" Archived-At: Subject: Re: [Add] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Aug 2019 05:11:09 -0000 This is an OpenPGP/MIME signed message (RFC 3156 and 4880). --=_MailMate_F2EB8276-E109-403E-9624-75BF6CA38744_= Content-Type: text/plain Content-Transfer-Encoding: quoted-printable On 21 Aug 2019, at 1:48, Stephen Farrell wrote: > And really - if Vodafone were crazy enough to try that for the web (and= I do not think for a second they are), it'd have been spotted and front-= page news within a day never mind 6 months. Agree, and those issues can only be resolved by really doing an outcry an= d choosing a different access provider. That customers use their feet. Patrik --=_MailMate_F2EB8276-E109-403E-9624-75BF6CA38744_= Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iG0EARECAC0WIQRUH/cJI8i4DDUU3qWsxpsaC4jXzQUCXVzSZg8ccGFmQGZyb2Ji aXQuc2UACgkQrMabGguI182KHACfUtXJ7jHT++ONFwB7WZUZKdLCdGkAn29iJS9T v6Th6rw/JhH4VxnjPXD+ =J5yP -----END PGP SIGNATURE----- --=_MailMate_F2EB8276-E109-403E-9624-75BF6CA38744_=-- From nobody Tue Aug 20 23:12:02 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3A23A120865 for ; Tue, 20 Aug 2019 23:12:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FHjDkcq59Ctq for ; Tue, 20 Aug 2019 23:11:59 -0700 (PDT) Received: from mail-io1-xd2b.google.com (mail-io1-xd2b.google.com [IPv6:2607:f8b0:4864:20::d2b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 89912120863 for ; Tue, 20 Aug 2019 23:11:59 -0700 (PDT) Received: by mail-io1-xd2b.google.com with SMTP id l7so2291859ioj.6 for ; Tue, 20 Aug 2019 23:11:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=GiOQsCqA/pGBZG8ZxiRXye/mStTldV4C8rSRPtEt8H4=; b=lOFXVaHEH5tSiEgOIhi3IR0jq/b9zhkJ39pgIYrkRplzUdWqsjgsNw17wBt0sl/d1j IZf0j6IEscv4cL587ivZl9mKW1RxXEWP21zZfauaSRETvZIXo2rJ/bUyC8RcJJf2J/O9 C4F9zVxsgRWAPgzEI/yDhz2EOHr8HNEgVH4RnKISHdbHjz1N1SuK3KTX5aVMFe0lwK4q Yz9BAWXnZZS3iuvv2AaL9vsE6W2qL1mWv496Lb3BSlGk53Wj68X9yOJOTzl2tYeXufT7 QDrpfDwHQNoo4jgl/k67E8kyuuR1jrx4TOPDOkLlnjLs/3yzFT+G9bCFAkf+IKY5mqXQ dd2w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=GiOQsCqA/pGBZG8ZxiRXye/mStTldV4C8rSRPtEt8H4=; b=VKldS6w2QU9BYnIYO5UbWavAAE/t/VbnJpHj9dIlJY21IYsRtcf8+XyXc5M5Jsy/wK iY6W+NxIJ0GiYcRpeqmJrmWoSAwmj2DuKLeXcSKLbxrA/BXE0tSsba0k1KsPm6k1E9Ue Vmvcb0xQ2LCWl0RSfvTUAxVEIXci5EI0CpHInm9nzQukl86ZywAGAycd3VsgC5Q0GT0A t3J5nQjZ2/I3DvlvY8KtRme/CtRZJpXAYrynjyijnDaVf86CHWzVm3msvJaFIM/0578q 3eZ3d49AUmMnnpepZLSpFt18DraxHU5IwdxUErcJoat0aBuAQ0tE9BdH+H+B0bHZNvpF Z/Xw== X-Gm-Message-State: APjAAAXxlZ8jQTD7dHx4F6JI8pJ+bGfgKr1Fr8ASxa4USm8IyCzQ7GgR mIm2XpmZN/vPaZRfSWCTGIIX8TmoVn1L/32N+8Q= X-Google-Smtp-Source: APXvYqyChSgNRwUpZhKyYUUZTPCtupZFG+4lX9zDHyYolF/BdCjF0gKu0r+zgGvBog7Utz2PUo/zGdw1Ju0HavjzUaA= X-Received: by 2002:a02:cc8f:: with SMTP id s15mr8458742jap.53.1566367918609; Tue, 20 Aug 2019 23:11:58 -0700 (PDT) MIME-Version: 1.0 References: <20190817170031.6F71C1691138@fafnir.remote.dragon.net> <5ED23002-7608-4A76-8181-E344E3FC6469@fugue.com> <3a0bf623-3aee-4d4d-fff0-4d127a81bbae@bellis.me.uk> <828f51ce-d551-dc39-83d2-008f31e9f09a@bellis.me.uk> <9485DBA8-F2A1-4CBB-92B7-E63273ABCFAE@gmail.com> <2ABE9821-1CF9-4FBC-907A-E0402E139C03@frobbit.se> In-Reply-To: <2ABE9821-1CF9-4FBC-907A-E0402E139C03@frobbit.se> From: Rob Sayre Date: Tue, 20 Aug 2019 23:11:47 -0700 Message-ID: To: =?UTF-8?B?UGF0cmlrIEbDpGx0c3Ryw7Zt?= Cc: Stephen Farrell , Adam Roach , ADD Mailing list , Ray Bellis , Brian Dickson Content-Type: multipart/alternative; boundary="000000000000605e0205909a73e0" Archived-At: Subject: Re: [Add] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Aug 2019 06:12:01 -0000 --000000000000605e0205909a73e0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Tue, Aug 20, 2019 at 10:11 PM Patrik F=C3=A4ltstr=C3=B6m wrote: > > Agree, and those issues can only be resolved by really doing an outcry an= d > choosing a different access provider. That customers use their feet. > I think reasonable people can disagree on this kind of issue. Do you work for a big company or a government or something? I don't, but I feel like it's a fair question. thanks, Rob --000000000000605e0205909a73e0 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Tue, Aug 20, 2019 at 10:11 PM Patrik F= =C3=A4ltstr=C3=B6m <paf@frobbit.se= > wrote:

Agree, and those issues can only be resolved by really doing an outcry and = choosing a different access provider. That customers use their feet.

I think reasonable people can disagree on thi= s kind of issue. Do you work for a big company or a government or something= ? I don't, but I feel like it's a fair question.

thanks,
Rob=C2=A0
--000000000000605e0205909a73e0-- From nobody Tue Aug 20 23:58:55 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0E2BC120815 for ; Tue, 20 Aug 2019 23:58:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FROM_EXCESS_BASE64=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=frobbit.se Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id u5w9rZDQeeQz for ; Tue, 20 Aug 2019 23:58:52 -0700 (PDT) Received: from mail.frobbit.se (mail.frobbit.se [85.30.129.176]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9EB7012010C for ; Tue, 20 Aug 2019 23:58:51 -0700 (PDT) Received: from [77.72.226.235] (unknown [IPv6:2a01:3f0:1:0:6967:111:5c2f:4425]) by mail.frobbit.se (Postfix) with ESMTPSA id 4BAF722FBD; Wed, 21 Aug 2019 08:58:48 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=frobbit.se; s=mail; t=1566370728; bh=HPjrYhI7cmm0Ze8tqY0xBMNuVA+RgY5R0/rtabIkx/4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=O3ruppaxp3Eu9BNiOOWgjcvVIMJ3DZLNbUIEYhJZkVExkYVv9G97XRLrdQMlKsgEa 8K4rM5dBRZrzjCUa7V/fDsf6LzTPpa6bLTmRdCGZgXtxYpiSN6MJVu0wRZgumoUSCw D9g0ruj1zrxHsN7dd1ehzJakCjvEKiJ3YTwsBuzU= From: "Patrik =?utf-8?b?RsOkbHRzdHLDtm0=?=" To: "Rob Sayre" Cc: "Stephen Farrell" , "Adam Roach" , "ADD Mailing list" , "Ray Bellis" , "Brian Dickson" Date: Wed, 21 Aug 2019 08:58:45 +0200 X-Mailer: MailMate (1.12.5r5635) Message-ID: <8D42902D-CD20-4A64-8F38-CF96F1A351F1@frobbit.se> In-Reply-To: References: <20190817170031.6F71C1691138@fafnir.remote.dragon.net> <5ED23002-7608-4A76-8181-E344E3FC6469@fugue.com> <3a0bf623-3aee-4d4d-fff0-4d127a81bbae@bellis.me.uk> <828f51ce-d551-dc39-83d2-008f31e9f09a@bellis.me.uk> <9485DBA8-F2A1-4CBB-92B7-E63273ABCFAE@gmail.com> <2ABE9821-1CF9-4FBC-907A-E0402E139C03@frobbit.se> MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=_MailMate_96B663D7-371C-4F6C-A37F-8783785D9960_="; micalg=pgp-sha1; protocol="application/pgp-signature" Archived-At: Subject: Re: [Add] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Aug 2019 06:58:54 -0000 This is an OpenPGP/MIME signed message (RFC 3156 and 4880). --=_MailMate_96B663D7-371C-4F6C-A37F-8783785D9960_= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On 21 Aug 2019, at 8:11, Rob Sayre wrote: > On Tue, Aug 20, 2019 at 10:11 PM Patrik F=C3=A4ltstr=C3=B6m wrote: > >> >> Agree, and those issues can only be resolved by really doing an outcry= and >> choosing a different access provider. That customers use their feet. >> > > I think reasonable people can disagree on this kind of issue. Do you wo= rk for a big company or a government or something? I don't, but I feel li= ke it's a fair question. Let me expand on this a bit. As myself and others have said many times on this list, court orders have= ordered access providers in many legislations to block access to certain= "things". Some of these court orders are sealed, and of course people ar= e trying to get their hands on the orders, validate whether they are corr= ect and what not. With "things" I have seen everything from IP addresses via domain names t= o URLs. I have not seen any explicit statements in the court orders I have seen h= ow this is to be implemented, so the implementation is up to the access p= rovider. There might very well exist such details, and I am happy to see = what they contain. We all know that such court orders might be viewed differently if they ar= e coming from a difficult democracy than when they come from for example = courts in Sweden where the courts are (as the president of the USA seems = to not understand) completely independent from the political system. But = the fact is that the court orders are there. We all seems to agree that ultimately we want the end user to a. discover= that something fishy is going on and b. be able to control the situation= =2E Now, this is something that is not going to go away, and the fact that th= e access provider is responsible for the blocking of access will probably= not go away either. MAYBE if centralized recursive resolvers are growing= in use (DoH or DoT or Do53 does not matter) there might be interest in c= ourts to have those be changing the responses just like they attack regis= tries and registrars. But I have not seen that (yet). Maybe it is happeni= ng in the jurisdictions where The Big Players are located, I do not know.= What I am because of this talking about is whether the access provider (t= hat is the target of the court order) is doing "the right thing", and let= me be clear, I do not think forcing me as an end user to trust the CA th= at the access provider forces on me is the right way of moving forward. I= know that some enterprises do this, and I have reluctantly viewed this a= s acceptable. Better than the eTLS solution discussed in ETSI. I am very = very nervous over what is going on in GSMA. And I am disappointed in IETF not looking more carefully at this situatio= n and including it as a scenario IETF should look into. This is the basis for my view that: - We should add privacy as much as we can do DNS queries, and this includ= es query minimization and DoT *in*the*client*, not accept any queries wit= h RD flag go out from the client - We should do DNSSEC validation *in*the*client* so that the client notic= es when some modification is happening - If the RD flag must be set on a query, or if validation can not be done= , we MUST use the extended status flags in the DNS query so that the TRUS= TED resolver can signal back really what has happened - On top of that, we must allow the access provider to separate the DNS t= raffic from other HTTPS traffic <--- This is something I missed pushing w= hen the DoH spec did flow through the IETF, I was sleeping at the wheel..= =2Ebut that said, I do not mind having DoH specified so that we do get in= teroperability, I just do not think it is appropriate to use it at large = scale for the reasons above Ok, when then to do in difficult democracies? Am I not with these "rules"= help the regimes there, the regimes we (including myself) is doing bad t= hings? Yes I am doing that, but I also want anyone "to do the right thing" while= the end user should detect when bad things happen. When the access provi= der is NOT "doing the right thing". At that point in time, the end user probably want to run TOR, VPN, tunnel= IP packets over DNS or whatever else. I.e. the issues there are not solv= ed by running DoH. Then we have another shade of gray, and that include the access providers= in democracies and States which are ok. The ones that do support an open= Internet and UK is definitely up there. UK is one of the few members of SG20 in ITU that for example do fight in = favor actively for an open Internet, and not that "IoT" (whatever that is= ) should be something special. We can not compare UK with other States. We just can not! So in the UK, the access providers, like Vodaphone, must be helped by the= IETF on technical measures on how they deal with court orders. Together = with us helping Vodaphone explain to the courts what words should be in t= he orders "to make sense". And to conclude, if the access providers in such good States like UK is s= till not follow our recommendations, THEN we should vote with our feet, u= se the tools we have in the market economy and go somewhere else. Some people might not agree with me, but this is my view. Patrik --=_MailMate_96B663D7-371C-4F6C-A37F-8783785D9960_= Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iG0EARECAC0WIQRUH/cJI8i4DDUU3qWsxpsaC4jXzQUCXVzrpQ8ccGFmQGZyb2Ji aXQuc2UACgkQrMabGguI182C+wCeI5ojg+IY4k3v/yU5jxDkxnw8ezMAnj0s8iu1 9e/Se+nmQeDf3GxJC4hS =GZsL -----END PGP SIGNATURE----- --=_MailMate_96B663D7-371C-4F6C-A37F-8783785D9960_=-- From nobody Wed Aug 21 00:15:31 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2C5F2120122 for ; Wed, 21 Aug 2019 00:15:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sWkRl3dJPlE8 for ; Wed, 21 Aug 2019 00:15:26 -0700 (PDT) Received: from mail-io1-xd30.google.com (mail-io1-xd30.google.com [IPv6:2607:f8b0:4864:20::d30]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6C4F312010C for ; Wed, 21 Aug 2019 00:15:26 -0700 (PDT) Received: by mail-io1-xd30.google.com with SMTP id 18so2504757ioe.10 for ; Wed, 21 Aug 2019 00:15:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=y9XIhu6wjsPKA1CTpL0jqwrZMU1ff++VJBifDB+Ay8Q=; b=QzLhZPqm9X9tXNa7CfZV9gdfsKMkU13xo9TUX7W2XK3YLm+8/Cx0Au6AO4MZgc95L9 ha09mIOXVorlhxEKKSmx2NFZEZHYWi/C2uxtfYV+ljikE8qJNfjZ7u3Gc5EPnR1nFNBJ WSJSn/sRgU8lQkqDA1P7R3ndEL9nGBN9qyQNIoQxbkhQYi2oja2qx+aFADCGODudxALA hK+AKYf+twylsHtg4/ccBPqlUQmhCskglRL8KMfmZ2vRRmCjqtxJO+aKevhSlA7vYeE4 zSnE6yXTUMd6sUch3lkm3oURDkTwkK5HnsTM69LlPmhyAqsYIlImQ1x9NMJHRm8MPllA s7BA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=y9XIhu6wjsPKA1CTpL0jqwrZMU1ff++VJBifDB+Ay8Q=; b=cYdyaZOjTlW5x9cq0gpSn1m9z4YPy5RAbqW2R75pCxokaQzbxGL7oZSCOxjmEqGmX1 A+fo8TCW5BTtyRiYPUcNPJpo4gBFxs5xr2Vku3jWsgsSom0NzfoXb4nU5NIRMBt9cV6X SFH/wSiRYH4IlwVr9cghuytUJnrFWeU3PR0Iy0h6PsIMIcweUZ/O9SourgtuajQRkBj4 RgqCbFb2xOPcoSWLmliVm0SqlGP0GE+/NxOIqi6Dtg4PDHd5uaB7JSN6cN3QPfyDfoU4 LSfFV6b6xrlZyyS8LsFvQi+BgDzen55v9pm4NCvxiaZ2Ub1HzNE9vNB5xnwD68lXTsDo PfBw== X-Gm-Message-State: APjAAAVwLjuE4MUVNRZMlDGb3snPUoxpzFs/D5bu+0tPH9mB4XLgfZ/3 dymAGikoRLsBQVVKIcQ76CDM9e95BO2AjWNQsrM= X-Google-Smtp-Source: APXvYqxnZxTXh3QN6MJPK3BtmIjDI/iwnkONJ59LkU3OHLklT2hdOQadkQfqeYMbmMqTBUN8v006f4yuJ3L1SUw9PX8= X-Received: by 2002:a02:c90e:: with SMTP id t14mr8553790jao.131.1566371725450; Wed, 21 Aug 2019 00:15:25 -0700 (PDT) MIME-Version: 1.0 References: <20190817170031.6F71C1691138@fafnir.remote.dragon.net> <5ED23002-7608-4A76-8181-E344E3FC6469@fugue.com> <3a0bf623-3aee-4d4d-fff0-4d127a81bbae@bellis.me.uk> <828f51ce-d551-dc39-83d2-008f31e9f09a@bellis.me.uk> <9485DBA8-F2A1-4CBB-92B7-E63273ABCFAE@gmail.com> <2ABE9821-1CF9-4FBC-907A-E0402E139C03@frobbit.se> <8D42902D-CD20-4A64-8F38-CF96F1A351F1@frobbit.se> In-Reply-To: <8D42902D-CD20-4A64-8F38-CF96F1A351F1@frobbit.se> From: Rob Sayre Date: Wed, 21 Aug 2019 00:15:13 -0700 Message-ID: To: =?UTF-8?B?UGF0cmlrIEbDpGx0c3Ryw7Zt?= Cc: Stephen Farrell , Adam Roach , ADD Mailing list , Ray Bellis , Brian Dickson Content-Type: multipart/alternative; boundary="00000000000048237205909b5682" Archived-At: Subject: Re: [Add] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Aug 2019 07:15:29 -0000 --00000000000048237205909b5682 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable I think Patrik's message does a great job of representing a certain worldview. While I might disagree with that view, I must also admit that it exists. thanks, Rob On Tue, Aug 20, 2019 at 11:58 PM Patrik F=C3=A4ltstr=C3=B6m wrote: > On 21 Aug 2019, at 8:11, Rob Sayre wrote: > > > On Tue, Aug 20, 2019 at 10:11 PM Patrik F=C3=A4ltstr=C3=B6m > wrote: > > > >> > >> Agree, and those issues can only be resolved by really doing an outcry > and > >> choosing a different access provider. That customers use their feet. > >> > > > > I think reasonable people can disagree on this kind of issue. Do you > work for a big company or a government or something? I don't, but I feel > like it's a fair question. > > Let me expand on this a bit. > > As myself and others have said many times on this list, court orders have > ordered access providers in many legislations to block access to certain > "things". Some of these court orders are sealed, and of course people are > trying to get their hands on the orders, validate whether they are correc= t > and what not. > > With "things" I have seen everything from IP addresses via domain names t= o > URLs. > > I have not seen any explicit statements in the court orders I have seen > how this is to be implemented, so the implementation is up to the access > provider. There might very well exist such details, and I am happy to see > what they contain. > > We all know that such court orders might be viewed differently if they ar= e > coming from a difficult democracy than when they come from for example > courts in Sweden where the courts are (as the president of the USA seems = to > not understand) completely independent from the political system. But the > fact is that the court orders are there. > > We all seems to agree that ultimately we want the end user to a. discover > that something fishy is going on and b. be able to control the situation. > > Now, this is something that is not going to go away, and the fact that th= e > access provider is responsible for the blocking of access will probably n= ot > go away either. MAYBE if centralized recursive resolvers are growing in u= se > (DoH or DoT or Do53 does not matter) there might be interest in courts to > have those be changing the responses just like they attack registries and > registrars. But I have not seen that (yet). Maybe it is happening in the > jurisdictions where The Big Players are located, I do not know. > > What I am because of this talking about is whether the access provider > (that is the target of the court order) is doing "the right thing", and l= et > me be clear, I do not think forcing me as an end user to trust the CA tha= t > the access provider forces on me is the right way of moving forward. I kn= ow > that some enterprises do this, and I have reluctantly viewed this as > acceptable. Better than the eTLS solution discussed in ETSI. I am very ve= ry > nervous over what is going on in GSMA. > > And I am disappointed in IETF not looking more carefully at this situatio= n > and including it as a scenario IETF should look into. > > This is the basis for my view that: > > - We should add privacy as much as we can do DNS queries, and this > includes query minimization and DoT *in*the*client*, not accept any queri= es > with RD flag go out from the client > - We should do DNSSEC validation *in*the*client* so that the client > notices when some modification is happening > - If the RD flag must be set on a query, or if validation can not be done= , > we MUST use the extended status flags in the DNS query so that the TRUSTE= D > resolver can signal back really what has happened > - On top of that, we must allow the access provider to separate the DNS > traffic from other HTTPS traffic <--- This is something I missed pushing > when the DoH spec did flow through the IETF, I was sleeping at the > wheel...but that said, I do not mind having DoH specified so that we do g= et > interoperability, I just do not think it is appropriate to use it at larg= e > scale for the reasons above > > Ok, when then to do in difficult democracies? Am I not with these "rules" > help the regimes there, the regimes we (including myself) is doing bad > things? > > Yes I am doing that, but I also want anyone "to do the right thing" while > the end user should detect when bad things happen. When the access provid= er > is NOT "doing the right thing". > > At that point in time, the end user probably want to run TOR, VPN, tunnel > IP packets over DNS or whatever else. I.e. the issues there are not solve= d > by running DoH. > > Then we have another shade of gray, and that include the access providers > in democracies and States which are ok. The ones that do support an open > Internet and UK is definitely up there. > > UK is one of the few members of SG20 in ITU that for example do fight in > favor actively for an open Internet, and not that "IoT" (whatever that is= ) > should be something special. > > We can not compare UK with other States. > > We just can not! > > So in the UK, the access providers, like Vodaphone, must be helped by the > IETF on technical measures on how they deal with court orders. Together > with us helping Vodaphone explain to the courts what words should be in t= he > orders "to make sense". > > And to conclude, if the access providers in such good States like UK is > still not follow our recommendations, THEN we should vote with our feet, > use the tools we have in the market economy and go somewhere else. > > Some people might not agree with me, but this is my view. > > Patrik > --00000000000048237205909b5682 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
I think Patrik's message does a great job of represent= ing a certain worldview.

While I might disagree with tha= t view, I must also admit that it exists.

thanks,<= /div>
Rob


On Tue, Aug 20, 2019 at 11:58 PM Patrik F= =C3=A4ltstr=C3=B6m <paf@frobbit.se= > wrote:
On 2= 1 Aug 2019, at 8:11, Rob Sayre wrote:

> On Tue, Aug 20, 2019 at 10:11 PM Patrik F=C3=A4ltstr=C3=B6m <paf@frobbit.se> wrote:=
>
>>
>> Agree, and those issues can only be resolved by really doing an ou= tcry and
>> choosing a different access provider. That customers use their fee= t.
>>
>
> I think reasonable people can disagree on this kind of issue. Do you w= ork for a big company or a government or something? I don't, but I feel= like it's a fair question.

Let me expand on this a bit.

As myself and others have said many times on this list, court orders have o= rdered access providers in many legislations to block access to certain &qu= ot;things". Some of these court orders are sealed, and of course peopl= e are trying to get their hands on the orders, validate whether they are co= rrect and what not.

With "things" I have seen everything from IP addresses via domain= names to URLs.

I have not seen any explicit statements in the court orders I have seen how= this is to be implemented, so the implementation is up to the access provi= der. There might very well exist such details, and I am happy to see what t= hey contain.

We all know that such court orders might be viewed differently if they are = coming from a difficult democracy than when they come from for example cour= ts in Sweden where the courts are (as the president of the USA seems to not= understand) completely independent from the political system. But the fact= is that the court orders are there.

We all seems to agree that ultimately we want the end user to a. discover t= hat something fishy is going on and b. be able to control the situation.
Now, this is something that is not going to go away, and the fact that the = access provider is responsible for the blocking of access will probably not= go away either. MAYBE if centralized recursive resolvers are growing in us= e (DoH or DoT or Do53 does not matter) there might be interest in courts to= have those be changing the responses just like they attack registries and = registrars. But I have not seen that (yet). Maybe it is happening in the ju= risdictions where The Big Players are located, I do not know.

What I am because of this talking about is whether the access provider (tha= t is the target of the court order) is doing "the right thing", a= nd let me be clear, I do not think forcing me as an end user to trust the C= A that the access provider forces on me is the right way of moving forward.= I know that some enterprises do this, and I have reluctantly viewed this a= s acceptable. Better than the eTLS solution discussed in ETSI. I am very ve= ry nervous over what is going on in GSMA.

And I am disappointed in IETF not looking more carefully at this situation = and including it as a scenario IETF should look into.

This is the basis for my view that:

- We should add privacy as much as we can do DNS queries, and this includes= query minimization and DoT *in*the*client*, not accept any queries with RD= flag go out from the client
- We should do DNSSEC validation *in*the*client* so that the client notices= when some modification is happening
- If the RD flag must be set on a query, or if validation can not be done, = we MUST use the extended status flags in the DNS query so that the TRUSTED = resolver can signal back really what has happened
- On top of that, we must allow the access provider to separate the DNS tra= ffic from other HTTPS traffic <--- This is something I missed pushing wh= en the DoH spec did flow through the IETF, I was sleeping at the wheel...bu= t that said, I do not mind having DoH specified so that we do get interoper= ability, I just do not think it is appropriate to use it at large scale for= the reasons above

Ok, when then to do in difficult democracies? Am I not with these "rul= es" help the regimes there, the regimes we (including myself) is doing= bad things?

Yes I am doing that, but I also want anyone "to do the right thing&quo= t; while the end user should detect when bad things happen. When the access= provider is NOT "doing the right thing".

At that point in time, the end user probably want to run TOR, VPN, tunnel I= P packets over DNS or whatever else. I.e. the issues there are not solved b= y running DoH.

Then we have another shade of gray, and that include the access providers i= n democracies and States which are ok. The ones that do support an open Int= ernet and UK is definitely up there.

UK is one of the few members of SG20 in ITU that for example do fight in fa= vor actively for an open Internet, and not that "IoT" (whatever t= hat is) should be something special.

We can not compare UK with other States.

We just can not!

So in the UK, the access providers, like Vodaphone, must be helped by the I= ETF on technical measures on how they deal with court orders. Together with= us helping Vodaphone explain to the courts what words should be in the ord= ers "to make sense".

And to conclude, if the access providers in such good States like UK is sti= ll not follow our recommendations, THEN we should vote with our feet, use t= he tools we have in the market economy and go somewhere else.

Some people might not agree with me, but this is my view.

=C2=A0 =C2=A0Patrik
--00000000000048237205909b5682-- From nobody Wed Aug 21 01:29:14 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1A45612081F for ; Wed, 21 Aug 2019 01:29:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id n2xaswrGJmlk for ; Wed, 21 Aug 2019 01:29:10 -0700 (PDT) Received: from mail-lf1-x12a.google.com (mail-lf1-x12a.google.com [IPv6:2a00:1450:4864:20::12a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 05CDA120122 for ; Wed, 21 Aug 2019 01:29:10 -0700 (PDT) Received: by mail-lf1-x12a.google.com with SMTP id h28so1159142lfj.5 for ; Wed, 21 Aug 2019 01:29:09 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=4DPOPnTf4pqa1NAHZhNZvCXOWlET5OO1adLyReE9AnI=; b=woF7ZhPXsGVwkLDJ/VJEVmceN6W4LlDhGiuq6nLLra39/1bB+41CGEswQb92bHxJHJ YwmJxflnF8he7cyf+ktj0dSkJFxL8heZuAquNgWPhIeof2GWCFN8AodenkEUyL2tf29G OVodpLcBRb1I9HIaiHNdo5kSvv+x5cQprR9b+/ZrIImkoq6VvAOTa4dZkXMgnj5RVkKO s5GL/ZVWXiWRMx6XLJUTaEhXOC9x63mvMLwSqnm1bMPc5MlIZ3VgLq/scC5s9a75DSUy Bg5ZWRZMuAiizeK4LQ7msoVpNnY19KLSMjDUAxKlA2TUY85xiLd6fSDU5EqXL3lloPdq j0/A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=4DPOPnTf4pqa1NAHZhNZvCXOWlET5OO1adLyReE9AnI=; b=IRT9XfFqK8/cSSKlYiAF63VBwrUSb0t7PT++0Hktr/ZoOaulQXlh0ONmqfUp7UAy2D fOtt5bBtU8bBN5Oc6aY8MAxHfDDZEmmXB3QJbsgpwet675AdoDDriIPiWKoslwk3Nbjp SYyNWCLIZmwjpNLRNFrZwO+JEy3DhnFWdCcHrHNv8iOcdmi7ItvML94BrisLMeGleKPO dsWkECygA85BemtM4jL5cIQdYjX3u46ZEcP04S8amckvPjAAQEdFxNC8vTlebL3J8kK6 EJLLVEth2HJf5C88by4aSA3MyHbWklYs5jRpV7lJfcg55TBOUPsQkxn14uv9V6mkFh4f MrNA== X-Gm-Message-State: APjAAAVFhIUsBEhJvme0LMlalnyl+KvIEX4rin6sPnOQRGJLAFnjPOlL 635Mj9Wh6M9yehPqzPR3vmwa7K0O8P5arXEzeM2T0Q== X-Google-Smtp-Source: APXvYqzIXx4nYh+hNakxxc3we6ynZP9Z3cVJlsVtQX71ACCJHWFerMGMGyHKhBrswecV6qAvC7LVotdxqf+d1s2z4kw= X-Received: by 2002:a05:6512:1da:: with SMTP id f26mr17869361lfp.129.1566376148193; Wed, 21 Aug 2019 01:29:08 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Eric Rescorla Date: Wed, 21 Aug 2019 01:28:31 -0700 Message-ID: To: Jari Arkko Cc: ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000e5e6b405909c5dda" Archived-At: Subject: Re: [Add] What to do in this potential working group X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Aug 2019 08:29:12 -0000 --000000000000e5e6b405909c5dda Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Tue, Aug 20, 2019 at 1:01 PM Jari Arkko wrote: > * Recommendation that having devices or apps =E2=80=9Ccall home=E2=80=9D = for every user > action to a centralised global service is bad practice and should be avoi= ded > I certainly agree that centralization is not ideal, but this recommendation needs to be balanced against other values, in this case, having the DNS queries go to a provider with determined, acceptable, privacy policies -- which, after all, is how we got here in the first place. So, no, I don't think that this proposed recommendation would be right as-is. -Ekr Jari > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --000000000000e5e6b405909c5dda Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Tue, Aug 20, 2019 at 1:01 PM Jari = Arkko <jari.arkko@piuha.net&= gt; wrote:
* Recommendation that having devices or apps =E2=80=9Ccall home=E2=80=9D fo= r every user action to a centralised global service is bad practice and sho= uld be avoided

I certainly agree that c= entralization is not ideal, but this recommendation needs to be balanced ag= ainst other values, in this case, having the DNS queries go to a provider w= ith determined, acceptable, privacy policies -- which, after all, is how we= got here in the first place. So, no, I don't think that this proposed = recommendation would be right as-is.

--000000000000e5e6b405909c5dda-- From nobody Wed Aug 21 02:31:24 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3056612080C for ; Wed, 21 Aug 2019 02:31:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8AFbZjx05CoC for ; Wed, 21 Aug 2019 02:31:17 -0700 (PDT) Received: from shaun.rfc1035.com (shaun.rfc1035.com [93.186.33.42]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 86749120142 for ; Wed, 21 Aug 2019 02:31:17 -0700 (PDT) Received: from gromit.rfc1035.com (gromit.rfc1035.com [195.54.233.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by shaun.rfc1035.com (Postfix) with ESMTPSA id F08A6242109D; Wed, 21 Aug 2019 09:31:13 +0000 (UTC) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) From: Jim Reid In-Reply-To: Date: Wed, 21 Aug 2019 10:31:13 +0100 Cc: Jari Arkko , ADD Mailing list Content-Transfer-Encoding: quoted-printable Message-Id: <414D5D04-FD8A-4F44-9F96-062752667248@rfc1035.com> References: To: Eric Rescorla X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: Re: [Add] What to do in this potential working group X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Aug 2019 09:31:22 -0000 > On 21 Aug 2019, at 09:28, Eric Rescorla wrote: >=20 > having the DNS queries go to a provider with determined, acceptable, = privacy policies=20 Acceptable to whom? And who gets to decide what=E2=80=99s acceptable or = not? There=E2=80=99s a very broad spectrum of possible answers to those = questions and the IETF should somehow do its best to accommodate or at = least tolerate that diversity. Easier said than done I know... From nobody Wed Aug 21 03:43:56 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1AAF21208FF for ; Wed, 21 Aug 2019 03:43:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.299 X-Spam-Level: X-Spam-Status: No, score=-4.299 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=open-xchange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Ll_SODQSM--E for ; Wed, 21 Aug 2019 03:43:53 -0700 (PDT) Received: from mx4.open-xchange.com (alcatraz.open-xchange.com [87.191.39.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6F7B41200B4 for ; Wed, 21 Aug 2019 03:43:53 -0700 (PDT) Received: from open-xchange.com (imap.open-xchange.com [10.20.30.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx4.open-xchange.com (Postfix) with ESMTPS id 4E8206A273; Wed, 21 Aug 2019 12:43:50 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=open-xchange.com; s=201705; t=1566384230; bh=BE2tuD/pzhnEUZaVwYMz/pIDO+371t9rrH1OYuS/Ws8=; h=Date:From:Reply-To:To:In-Reply-To:References:Subject:From; b=nx1O8VdFg9RAj2aNarZ687E4gGr5Uk9GRTCnSsEgO7xdl7QWFMbsrY3gjoMSrzHJP DXIRzo6TnER5KTh0m1FdR/DgOUCsF4IUexcv24O7qrZt9pfOguyRfjW01cmEt4Na8y fDZ7uL2gh8vR2CazJGp4F+YlagZ9mcXqz7yGSIBppKD7sT8iDRPGgs5GBWP2IpRzIl YyhBKWQYCIdo3tSxYbDDtN5UQJo6bNfzcrb4CDWVKE9XII2qA1QnFSFK20UQBo2AN5 7CC6CsJBbdED+zD3B75mMvsXKknsX87PpWoLigJHMoCIYtVZ1hwb1QlAPK7ovFchxv gy5HN2Q+sg/yQ== Received: from appsuite-gw1.open-xchange.com (appsuite-gw1.open-xchange.com [10.20.28.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by open-xchange.com (Postfix) with ESMTPSA id 433853C0434; Wed, 21 Aug 2019 12:43:50 +0200 (CEST) Date: Wed, 21 Aug 2019 12:43:50 +0200 (CEST) From: Vittorio Bertola Reply-To: Vittorio Bertola To: Jari Arkko , add@ietf.org Message-ID: <1081276693.4678.1566384230225@appsuite-gw1.open-xchange.com> In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable X-Priority: 3 Importance: Medium X-Mailer: Open-Xchange Mailer v7.10.2-Rev10 X-Originating-Client: open-xchange-appsuite Autocrypt: addr=vittorio.bertola@open-xchange.com; prefer-encrypt=mutual; keydata= mQENBFhFR+UBCACfoywFKBRfzasiiR9/6dwY36eLePXcdScumDMR8qoXvRS55QYDjp5bs+yMq41qWV9 xp/cqryY9jnvHbeF3TsE5yEazpD1dleRbkpElUBpPwXqkrSP8uXO9KkS9KoX6gdml6M4L+F82WpqYC1 uTzOE6HPmhmQ4cGSgoia2jolxAhRpzoYN99/BwpvoZeTSLP5K6yPlMPYkMev/uZlAkMMhelli9IN6yA yxcC0AeHSnOAcNKUr13yXyMlTyi1cdMJ4sk88zIbefxwg3PAtYjkz3wgvP96cNVwAgSt4+j/ZuVaENP pgVuM512m051j9SlspWDHtzrci5pBKKFsibnTelrABEBAAG0NUJlcnRvbGEsIFZpdHRvcmlvIDx2aXR 0b3Jpby5iZXJ0b2xhQG9wZW4teGNoYW5nZS5jb20+iQFABBMBAgAqBAsJCAcGFQoJCAsCBRYCAwEAAp 4BAhsDBYkSzAMABQMAAAAABYJYRUflAAoJEIU2cHmzj8qNaG0H/ROY+suCP86hoN+9RIV66Ej8b3sb8 UgwFJOJMupZfeb9yTIJwE4VQT5lTt146CcJJ5jvxD6FZn1Htw9y4/45pPAF7xLE066jg3OqRvzeWRZ3 IDUfJJIiM5YGk1xWxDqppSwhnKcMOuI72iioWxX0nGQrWxpnWJsjt08IEEwuYucDkul1PHsrLJbTd58 fiMKLVwag+IE1SPHOwkPF6arZQZIfB5ThtOZV+36Jn8Hok9XfeXWBVyPkiWCQYVX39QsIbr0JNR9kQy 4g2ZFexOcTe8Jo12jPRL7V8OqStdDes3cje9lWFLnX05nrfLuE0l0JKWEg8akN+McFXc+oV68h7nu5A Q0EWEVH5QEIAIDKanNBe1uRfk8AjLirflZO291VNkOAeUu+dIhecGnZeQW6htlDinlYOnXhtsY1mK9W PUu+xshDq7lXn2G0LxldYwyJYZaJtDgIKqVqwxfA34Lj27oqPuXwcvGhdCgt0SW/YcalRdAi0/AzUCu 5GSaj2kaGUSnBYYUP4szGJXjaK2psP5toQSCtx2pfSXQ6MaqPK9Zzy+D5xc6VWQRp/iRImodAcPf8fg JJvRyJ8Jla3lKWyvBBzJDg6MOf6Fts78bJSt23X0uPp93g7GgbYkuRMnFI4RGoTVkxjD/HBEJ0CNg22 hoHJondhmKnZVrHEluFuSnW0wBEIYomcPSPB+cAEQEAAYkBMQQYAQIAGwUCWEVH5QIbDAQLCQgHBhUK CQgLAgUJEswDAAAKCRCFNnB5s4/KjdO8B/wNpvWtOpLdotR/Xh4fu08Fd63nnNfbIGIETWsVi0Sbr8i E5duuGaaWIcMmUvgKe/BM0Fpj9X01Zjm90uoPrlVVuQWrf+vFlbalUYVZr51gl5UyUFHk+iAZCAA0WB rsmACKvuV1P7GuiX3UV9b59T9taYJxN3dNFuftrEuvsqHimFtlekUjUwoCekTJdncFusBhwz2OrKhHr WWrEsXkfh0+pURWYAlKlTxvXuI7gAfHEQM+6OnrWvXYtlhd0M1sBPnCjbyG63Qws7Rek9bEWKtH6dA6 dmT2FQT+g1S9Mdf0WkPTQNX0x24dm8IoHuD3KYwX7Svx43Xa17aZnXqUjtj1 Archived-At: Subject: Re: [Add] What to do in this potential working group X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Aug 2019 10:43:55 -0000 > Il 20 agosto 2019 22:01 Jari Arkko ha scritto: >=20 > I=E2=80=99ve been on vacation and doing some other things for the last co= uple of weeks, and now I=E2=80=99ve been trying to read the mailing list di= scussions. Not easy! I am also trying to clear the backlog - still 300+ messages left (though al= most half of them seem to come from a single person). > In any case, to start with the parts that we possibly do agree on, there = is at least a beginning of a list of work items. For instance: >=20 > * Improved mechanisms for discovery and selection of encrypted DNS transp= orts > * Best operational practices for running an encrypted DNS transport servi= ce (possibly subdivided for the type of deployment, e.g., ISP or global ser= vice) > * Recommendation for precedence of configuration mechanisms > * Recommendation that having devices or apps =E2=80=9Ccall home=E2=80=9D = for every user action to a centralised global service is bad practice and s= hould be avoided I still think that having an agreed write-up of the issues and/or of the us= e cases, even without any recommendation on how to deal with them, could al= so be useful. This was the main subject of the original three drafts presen= ted in Prague. This said, the elephant in the room is the use of DNS as a control surface.= The IETF as a community disagrees on whether this should exist or not, but= as Patrik pointed out, many sovereign countries have already decided that = a control surface has to exist, and the industry is required to provide it = (or go to jail). There are also plenty of cases in which end-users themselv= es ask the industry to provide similar control features to them. A clear and final agreement on whether the IETF is ever going to work on pr= oviding such a control surface in a standard way (either DNS-based or in so= me other way that is at least as effective as DNS filtering is today), or w= hether the part of the industry that is required to provide it should work = on it somewhere else, would IMHO make the rest of the discussion much more = focused. --=20 =20 Vittorio Bertola | Head of Policy & Innovation, Open-Xchange vittorio.bertola@open-xchange.com=20 Office @ Via Treviso 12, 10144 Torino, Italy From nobody Wed Aug 21 03:55:13 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5D463120041 for ; Wed, 21 Aug 2019 03:55:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oWybWt1UEgLG for ; Wed, 21 Aug 2019 03:55:09 -0700 (PDT) Received: from p130.piuha.net (p130.piuha.net [IPv6:2001:14b8:1829::130]) by ietfa.amsl.com (Postfix) with ESMTP id 565A81200B4 for ; Wed, 21 Aug 2019 03:55:09 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by p130.piuha.net (Postfix) with ESMTP id ED9356600F1; Wed, 21 Aug 2019 13:55:06 +0300 (EEST) Received: from p130.piuha.net ([127.0.0.1]) by localhost (p130.piuha.net [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NrCwFkg5EVRT; Wed, 21 Aug 2019 13:55:05 +0300 (EEST) Received: from [127.0.0.1] (p130.piuha.net [IPv6:2001:14b8:1829::130]) by p130.piuha.net (Postfix) with ESMTPS id 9FB04660202; Wed, 21 Aug 2019 13:55:05 +0300 (EEST) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\)) From: Jari Arkko In-Reply-To: Date: Wed, 21 Aug 2019 13:55:05 +0300 Cc: ADD Mailing list Content-Transfer-Encoding: quoted-printable Message-Id: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> References: To: Eric Rescorla X-Mailer: Apple Mail (2.3273) Archived-At: Subject: Re: [Add] What to do in this potential working group X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Aug 2019 10:55:11 -0000 Ekr, I fully realise that there will be differences of viewpoints when it = comes to the trustworthiness of individual DNS service providers. But I was trying to make a different point. While we may disagree which = provider I=E2=80=99d like to use for the DNS service, I think it would = be quite reasonable for us to agree that if all of us put our all our = queries in one place (whatever that is) that this causes severe = problems: - That place becomes immensely valuable from a commercial data mining = perspective. There=E2=80=99s a risk that it will at least at some point = be used for data mining, despite whatever the intentions of the people = who set this system up now is. - That place becomes immensely interesting to for governments to tap. = There=E2=80=99s a risk that this tapping is either already happening or = will be happening going forward, despite best intentions of the people = who set it up or who manage it. - That places becomes critical infrastructure and a weak point that we = do not need in the Internet. As a result, I would like to suggest that the IETF actually concludes = the above and recommends against this practice. For whatever it is worth, I can understand some motivations for doing = something like this e.g. in browsers. Some good reasons and potentially = also some not so good reasons. But even with that background, it is = difficult for me to imagine a worse act for the Internet than making = browsers call home for every action of the user. The privacy impacts for = the users are unimaginably bad. A few years ago we realised that surveillance organisations were looking = at people's traffic, and we managed to change the Internet to protect = this traffic with cryptographic means. I think it is to think about the = next step, and ensure that we don=E2=80=99t create an Internet = architecture that puts everyone=E2=80=99s data at central location. Obviously, encrypted DNS is still hugely important, as are global DNS = services. However, the deployment model of using one (or a small number = of) providers is just wrong. That would be fixable. Jari From nobody Wed Aug 21 05:45:13 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4B1A612091E for ; Wed, 21 Aug 2019 05:45:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.5 X-Spam-Level: X-Spam-Status: No, score=-14.5 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com header.b=es8z/VS3; dkim=pass (1024-bit key) header.d=cisco.onmicrosoft.com header.b=PJMXIbxb Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cgib2U25FQk0 for ; Wed, 21 Aug 2019 05:45:06 -0700 (PDT) Received: from rcdn-iport-3.cisco.com (rcdn-iport-3.cisco.com [173.37.86.74]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7B301120922 for ; Wed, 21 Aug 2019 05:45:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=3580; q=dns/txt; s=iport; t=1566391506; x=1567601106; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-id:content-transfer-encoding: mime-version; bh=5DmqSJyw9lZo4KiSXYNUrI20kLreae9P9ZQ7GShOWBk=; b=es8z/VS36SyMHKFdL7WmNRrM5lqaICScZHFgaCqkwxlPj+HcduuZU40C eU7kc1Bnr6Uv8PNH1m6zW+MV3tS1KTWUgdNBk61BklOAtRnmPzTg3nxPd z1j0/ZZAa+CbVz81jNA3IP+711ymbOg8PqQ7J0PzhysYEicRdCC5ZOhwN M=; IronPort-PHdr: =?us-ascii?q?9a23=3AOr6AnhN0jtirGRsqVkol6mtXPHoupqn0MwgJ65?= =?us-ascii?q?Eul7NJdOG58o//OFDEu60/l0fHCIPc7f8My/HbtaztQyQh2d6AqzhDFf4ETB?= =?us-ascii?q?oZkYMTlg0kDtSCDBj2Mu/sZC83NM9DT1RiuXq8NBsdFQ=3D=3D?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0BxAABMPF1d/5tdJa1lHAEBAQQBAQc?= =?us-ascii?q?EAQGBVAYBAQsBgURQA21VIAQLKoQfg0cDimaaQYEugSQDVAkBAQEMAQEYCwo?= =?us-ascii?q?CAQGEPwIXgkUjNQgOAgUBAQQBAQMBBgRthScMhUsCBAEBEBERDAEBLAsBDwI?= =?us-ascii?q?BCBIIAiYCAgIlCxUCDgIEDgUigwABgWoDHQECDJ8oAoE4iGFzgTKCewEBBYJ?= =?us-ascii?q?HglAYghYDBoEMKAGLSx0YgUA/gTgfgh4uPoJhAQGBYReCdDKCJo8XnEIJAoI?= =?us-ascii?q?di2WIVBuYRqVpAgQCBAUCDgEBBYFSAjSBWHAVOyoBgkGCQoNyhRSFP3KBKYt?= =?us-ascii?q?+AQE?= X-IronPort-AV: E=Sophos;i="5.64,412,1559520000"; d="scan'208";a="606324299" Received: from rcdn-core-4.cisco.com ([173.37.93.155]) by rcdn-iport-3.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 21 Aug 2019 12:44:58 +0000 Received: from XCH-RCD-017.cisco.com (xch-rcd-017.cisco.com [173.37.102.27]) by rcdn-core-4.cisco.com (8.15.2/8.15.2) with ESMTPS id x7LCiwIA000767 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL); Wed, 21 Aug 2019 12:44:58 GMT Received: from xhs-rtp-002.cisco.com (64.101.210.229) by XCH-RCD-017.cisco.com (173.37.102.27) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Wed, 21 Aug 2019 07:44:57 -0500 Received: from xhs-aln-001.cisco.com (173.37.135.118) by xhs-rtp-002.cisco.com (64.101.210.229) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Wed, 21 Aug 2019 08:44:54 -0400 Received: from NAM02-SN1-obe.outbound.protection.outlook.com (173.37.151.57) by xhs-aln-001.cisco.com (173.37.135.118) with Microsoft SMTP Server (TLS) id 15.0.1473.3 via Frontend Transport; Wed, 21 Aug 2019 07:44:54 -0500 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=kg7W53cZC2ToVmPw5IpBIoCHibXoWx1V/AnscK8jU6W31ao6EBESmxwJe7napEWEq/HiP3ImDK3eNmdjhRo1Eqztwbb5XSSvYXw8L0W5g1HXEC+AK7usoLwEjAJWN2s3t2GX3sBaSYd3jHrL8rODBMC3spknuWgN0aWn649n9X13eVKy4agUa+XqBNV2vyKv4OdAtqlPYsa92NQPt0Yue0+XCUg2vyLQ8MUYwTlUbYDUErr8DxldO3ZHwZkD2K2JTAKcvk6FPyLRLBJyarfJXS+dC5vN41pLSvFBEGf1cIuDZHblFaM7KNUPBGOAgCfc6JL22CBdOEwH3fNoY26sjg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=5DmqSJyw9lZo4KiSXYNUrI20kLreae9P9ZQ7GShOWBk=; b=em1mP3bnComH5xzKPH96IIy7CgG6NDxX7Hei3hIJNtshjrM1hty37i/Q0+ZBBxz45jYq2AapB4cDljg0gUqtjzjNTrhSE7NA9E3nIuYc87/zPn1bFoIQdyiXN5QK0/FyQ/yqQFd1pwBtses3HtCr1JzXrV/Uwx/Jfm+jjbFiDWHV2e9a+WrBJOP0tOByeHe4UJ/Va18qnkRqq43Or0fIBHFczW1iLlC2JorwAXIbZgtwCdXvliAa1n2ZQm6ZYArxy3dkQrjxWsrIX4H4o5SO9g8b2Ig4GeqpITcsXHbgzoPL7CrlX4l+mX+BIZep6FvrfGNbiKH+DCQK4GGmCSpVNw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=cisco.com; dmarc=pass action=none header.from=cisco.com; dkim=pass header.d=cisco.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.onmicrosoft.com; s=selector2-cisco-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=5DmqSJyw9lZo4KiSXYNUrI20kLreae9P9ZQ7GShOWBk=; b=PJMXIbxb35UHmpqlUUU4yQgRXPO2FqpL4Wexrh5qK2JIwbBPROYF2euVm7a3P61Jsh5+lIO3BPsmsQkv53+uEHiN+Xhs9VGcq2FYeHKNIphGghM+bhCQFdslNcKPva4eUd96mdNHozdUpBB+RQ+phvsfTO3A5qBVix1BO4tgiIE= Received: from MN2PR11MB4144.namprd11.prod.outlook.com (20.179.150.210) by MN2PR11MB4365.namprd11.prod.outlook.com (52.135.38.32) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2178.18; Wed, 21 Aug 2019 12:44:53 +0000 Received: from MN2PR11MB4144.namprd11.prod.outlook.com ([fe80::d5c4:be39:66cb:449b]) by MN2PR11MB4144.namprd11.prod.outlook.com ([fe80::d5c4:be39:66cb:449b%6]) with mapi id 15.20.2178.018; Wed, 21 Aug 2019 12:44:53 +0000 From: "Eric Vyncke (evyncke)" To: Jari Arkko CC: ADD Mailing list Thread-Topic: [Add] What to do in this potential working group Thread-Index: AQHVV5I7hsqAJe/wcEqNONbR1WqNNqcFRa+AgAAo84CAAEA1gA== Date: Wed, 21 Aug 2019 12:44:53 +0000 Message-ID: <079D125A-B2F0-41B3-A6F6-CAAFA7F51E6D@cisco.com> References: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> In-Reply-To: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> Accept-Language: fr-BE, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.1c.0.190812 authentication-results: spf=none (sender IP is ) smtp.mailfrom=evyncke@cisco.com; x-originating-ip: [2001:420:c0c1:36:f552:172b:da2f:5e62] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 57334461-9bcb-48b9-9adb-08d726355d74 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:MN2PR11MB4365; x-ms-traffictypediagnostic: MN2PR11MB4365: x-ms-exchange-purlcount: 1 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-forefront-prvs: 0136C1DDA4 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(4636009)(39860400002)(376002)(136003)(396003)(346002)(366004)(189003)(199004)(5660300002)(186003)(66574012)(8676002)(102836004)(36756003)(2906002)(6116002)(8936002)(33656002)(58126008)(81156014)(81166006)(316002)(71200400001)(7736002)(2616005)(14444005)(4326008)(476003)(99286004)(6916009)(446003)(11346002)(6306002)(6512007)(76176011)(6246003)(6486002)(6436002)(14454004)(86362001)(486006)(71190400001)(256004)(478600001)(53936002)(966005)(229853002)(305945005)(76116006)(91956017)(66946007)(6506007)(25786009)(64756008)(66446008)(66476007)(66556008)(46003); DIR:OUT; SFP:1101; SCL:1; SRVR:MN2PR11MB4365; H:MN2PR11MB4144.namprd11.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: cisco.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: TyJStdd8Tkaa9WSHAgmL1LxZtG0hs/gasIDlAExS/JKlf83XtEqyqhv1pR/w7ZF7RabWbIkqHzniZz0Y1XVWHjaYtdZCwLDVOIFmG60SI5FEzON9yEXeG39G2hJbXyuLYpMGVg+4fs2vOPzNasq6GJqf99TabRUqs5nSA0CpgMqDRL6qGv2fs4P9ywVyEewGwXpB0cZzUXI+Mc/iyW6YTTGZrNitstTK0IIqgXBz/0MzrTUQOsiIwtxtshM2Je/VDFfVClson29pGBjJ1W1EeO7B/ZvtVUuHbuLjPW4xs5UjSUSh/fNyXwXRiLla8QehzWYjXxXfoy+Op4D0va+qq8hc7oLREcaqVy8qcKLncA82SS9vioGLPLx1vDDvNJKMpImCsDGaSZU/XesU0pO054AfVdCg7CsTMyIKqQCIkmQ= x-ms-exchange-transport-forked: True Content-Type: text/plain; charset="utf-8" Content-ID: <0B77E85B7094B14CB3CA41E06413ECF4@namprd11.prod.outlook.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: 57334461-9bcb-48b9-9adb-08d726355d74 X-MS-Exchange-CrossTenant-originalarrivaltime: 21 Aug 2019 12:44:53.7290 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5ae1af62-9505-4097-a69a-c1553ef7840e X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: acbzkuMpGGfcf/vZCcJbqmIS2HpTdknKoWaJLkv+jn1aYdJSCyQrhXlKldrH0sCmFNRt7tI3IQFsp4+ccXyfqQ== X-MS-Exchange-Transport-CrossTenantHeadersStamped: MN2PR11MB4365 X-OriginatorOrg: cisco.com X-Outbound-SMTP-Client: 173.37.102.27, xch-rcd-017.cisco.com X-Outbound-Node: rcdn-core-4.cisco.com Archived-At: Subject: Re: [Add] What to do in this potential working group X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Aug 2019 12:45:09 -0000 TGV0IG1lIGNoaW1lIGZvciBvbmNlIGluIHRoaXMgaGVhdGVkIGRpc2N1c3Npb24gYXMgYW4gaW5k aXZpZHVhbCBJbnRlcm5ldCB1c2VyOiBKYXJpLCB5b3UgYXJlIDEwMCUgcmlnaHQgKGV4Y2VwdCBw ZXJoYXBzIHRoZSBvcmRlciBvZiB5b3VyIGxpc3QsIEkgd291bGQgaGF2ZSBwdXQgdGhlIGNyaXRp Y2FsIHBhcnQgb24gdGhlIHRvcCBhcyBjb21wYW5pZXMgY2FuIGdvIGJhbmtydXB0KQ0KDQotw6ly aWMNCg0K77u/T24gMjEvMDgvMjAxOSwgMTI6NTUsICJBZGQgb24gYmVoYWxmIG9mIEphcmkgQXJr a28iIDxhZGQtYm91bmNlc0BpZXRmLm9yZyBvbiBiZWhhbGYgb2YgamFyaS5hcmtrb0BwaXVoYS5u ZXQ+IHdyb3RlOg0KDQogICAgRWtyLA0KICAgIA0KICAgIEkgZnVsbHkgcmVhbGlzZSB0aGF0IHRo ZXJlIHdpbGwgYmUgZGlmZmVyZW5jZXMgb2Ygdmlld3BvaW50cyB3aGVuIGl0IGNvbWVzIHRvIHRo ZSB0cnVzdHdvcnRoaW5lc3Mgb2YgaW5kaXZpZHVhbCBETlMgc2VydmljZSBwcm92aWRlcnMuDQog ICAgDQogICAgQnV0IEkgd2FzIHRyeWluZyB0byBtYWtlIGEgZGlmZmVyZW50IHBvaW50LiBXaGls ZSB3ZSBtYXkgZGlzYWdyZWUgd2hpY2ggcHJvdmlkZXIgSeKAmWQgbGlrZSB0byB1c2UgZm9yIHRo ZSBETlMgc2VydmljZSwgSSB0aGluayBpdCB3b3VsZCBiZSBxdWl0ZSByZWFzb25hYmxlIGZvciB1 cyB0byBhZ3JlZSB0aGF0IGlmIGFsbCBvZiB1cyBwdXQgb3VyIGFsbCBvdXIgcXVlcmllcyBpbiBv bmUgcGxhY2UgKHdoYXRldmVyIHRoYXQgaXMpIHRoYXQgdGhpcyBjYXVzZXMgc2V2ZXJlIHByb2Js ZW1zOg0KICAgIA0KICAgIC0gVGhhdCBwbGFjZSBiZWNvbWVzIGltbWVuc2VseSB2YWx1YWJsZSBm cm9tIGEgY29tbWVyY2lhbCBkYXRhIG1pbmluZyBwZXJzcGVjdGl2ZS4gVGhlcmXigJlzIGEgcmlz ayB0aGF0IGl0IHdpbGwgYXQgbGVhc3QgYXQgc29tZSBwb2ludCBiZSB1c2VkIGZvciBkYXRhIG1p bmluZywgZGVzcGl0ZSB3aGF0ZXZlciB0aGUgaW50ZW50aW9ucyBvZiB0aGUgcGVvcGxlIHdobyBz ZXQgdGhpcyBzeXN0ZW0gdXAgbm93IGlzLg0KICAgIA0KICAgIC0gVGhhdCBwbGFjZSBiZWNvbWVz IGltbWVuc2VseSBpbnRlcmVzdGluZyB0byBmb3IgZ292ZXJubWVudHMgdG8gdGFwLiBUaGVyZeKA mXMgYSByaXNrIHRoYXQgdGhpcyB0YXBwaW5nIGlzIGVpdGhlciBhbHJlYWR5IGhhcHBlbmluZyBv ciB3aWxsIGJlIGhhcHBlbmluZyBnb2luZyBmb3J3YXJkLCBkZXNwaXRlIGJlc3QgaW50ZW50aW9u cyBvZiB0aGUgcGVvcGxlIHdobyBzZXQgaXQgdXAgb3Igd2hvIG1hbmFnZSBpdC4NCiAgICANCiAg ICAtIFRoYXQgcGxhY2VzIGJlY29tZXMgY3JpdGljYWwgaW5mcmFzdHJ1Y3R1cmUgYW5kIGEgd2Vh ayBwb2ludCB0aGF0IHdlIGRvIG5vdCBuZWVkIGluIHRoZSBJbnRlcm5ldC4NCiAgICANCiAgICBB cyBhIHJlc3VsdCwgSSB3b3VsZCBsaWtlIHRvIHN1Z2dlc3QgdGhhdCB0aGUgSUVURiBhY3R1YWxs eSBjb25jbHVkZXMgdGhlIGFib3ZlIGFuZCByZWNvbW1lbmRzIGFnYWluc3QgdGhpcyBwcmFjdGlj ZS4NCiAgICANCiAgICBGb3Igd2hhdGV2ZXIgaXQgaXMgd29ydGgsIEkgY2FuIHVuZGVyc3RhbmQg c29tZSBtb3RpdmF0aW9ucyBmb3IgZG9pbmcgc29tZXRoaW5nIGxpa2UgdGhpcyBlLmcuIGluIGJy b3dzZXJzLiBTb21lIGdvb2QgcmVhc29ucyBhbmQgcG90ZW50aWFsbHkgYWxzbyBzb21lIG5vdCBz byBnb29kIHJlYXNvbnMuIEJ1dCBldmVuIHdpdGggdGhhdCBiYWNrZ3JvdW5kLCBpdCBpcyBkaWZm aWN1bHQgZm9yIG1lIHRvIGltYWdpbmUgYSB3b3JzZSBhY3QgZm9yIHRoZSBJbnRlcm5ldCB0aGFu IG1ha2luZyBicm93c2VycyBjYWxsIGhvbWUgZm9yIGV2ZXJ5IGFjdGlvbiBvZiB0aGUgdXNlci4g VGhlIHByaXZhY3kgaW1wYWN0cyBmb3IgdGhlIHVzZXJzIGFyZSB1bmltYWdpbmFibHkgYmFkLg0K ICAgIA0KICAgIEEgZmV3IHllYXJzIGFnbyB3ZSByZWFsaXNlZCB0aGF0IHN1cnZlaWxsYW5jZSBv cmdhbmlzYXRpb25zIHdlcmUgbG9va2luZyBhdCBwZW9wbGUncyB0cmFmZmljLCBhbmQgd2UgbWFu YWdlZCB0byBjaGFuZ2UgdGhlIEludGVybmV0IHRvIHByb3RlY3QgdGhpcyB0cmFmZmljIHdpdGgg Y3J5cHRvZ3JhcGhpYyBtZWFucy4gSSB0aGluayBpdCBpcyB0byB0aGluayBhYm91dCB0aGUgbmV4 dCBzdGVwLCBhbmQgZW5zdXJlIHRoYXQgd2UgZG9u4oCZdCBjcmVhdGUgYW4gSW50ZXJuZXQgYXJj aGl0ZWN0dXJlIHRoYXQgcHV0cyBldmVyeW9uZeKAmXMgZGF0YSBhdCBjZW50cmFsIGxvY2F0aW9u Lg0KICAgIA0KICAgIE9idmlvdXNseSwgZW5jcnlwdGVkIEROUyBpcyBzdGlsbCBodWdlbHkgaW1w b3J0YW50LCBhcyBhcmUgZ2xvYmFsIEROUyBzZXJ2aWNlcy4gSG93ZXZlciwgdGhlIGRlcGxveW1l bnQgbW9kZWwgb2YgdXNpbmcgb25lIChvciBhIHNtYWxsIG51bWJlciBvZikgcHJvdmlkZXJzIGlz IGp1c3Qgd3JvbmcuIFRoYXQgd291bGQgYmUgZml4YWJsZS4NCiAgICANCiAgICBKYXJpDQogICAg DQogICAgLS0gDQogICAgQWRkIG1haWxpbmcgbGlzdA0KICAgIEFkZEBpZXRmLm9yZw0KICAgIGh0 dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vYWRkDQogICAgDQoNCg== From nobody Wed Aug 21 05:55:33 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BB3C31208A5 for ; Wed, 21 Aug 2019 05:55:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nVnGO2EvETWd for ; Wed, 21 Aug 2019 05:55:29 -0700 (PDT) Received: from mail-qk1-x732.google.com (mail-qk1-x732.google.com [IPv6:2607:f8b0:4864:20::732]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8323B12004D for ; Wed, 21 Aug 2019 05:55:29 -0700 (PDT) Received: by mail-qk1-x732.google.com with SMTP id p13so1635207qkg.13 for ; Wed, 21 Aug 2019 05:55:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=sPHRQQ+VB2MpeL441cdTWtSHGy0pWUNNk0owZceA/TU=; b=Tc+gn+nByym1uC28a9kZDbl3Eovx9fqs9+GShaf8K0H1lA4lNQLUdQVn4YYufWCaww yx9VvriR4L4ZbPkQyyjy8qgMco4T059nKHeJ3/+I372DAkiW9strwdx1MKXEEyociIO+ 8wSwqy49mybVOIo9NIa65/elbp7Eq2qmeR0WD/ShUbWa9z8FvCu0LFejySSOTiq1ufil Vok5GXZ3QpyUoxD45GFqHJ3D90eby9UK/w1MP2W47ISQajOWL0tNq5AN/P4FH8PfQpxS XjGW2d5I6Lx4u3mhZN7gqOCnihKHKrj6/RN6JwfK/vYiLl/eICR3q2FI8Jvt4CVmgctW gYWQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=sPHRQQ+VB2MpeL441cdTWtSHGy0pWUNNk0owZceA/TU=; b=lBAFR7ppDW2QgnIr9Is2HEO4ltDwOJGhxjweY7mPaq/SqEdVnAZmcCxgeNBfa+kCN/ YOKaKVW8xbGQvn/3ZD4vDO5ARRIkc/XdMhnnTosZ2+2NKK1Kotb8WG1yDo30Gu/kqu8o N3IOhlGhuFrdi85kyRaOf1+r2YvKEFckgr74LEIIy1f6VOHOExO4WgnBtyfEG47hMpC3 w9sQ8qmir4jJdW0FnzD1RiAuBFKWMSp2VF0IVMeIYA3Ds/h61HKUSmgWANS0d3JKwkIS SBqAGmbyggIQRdFhS8z4aWT8bPYjUSYjtHgJPfewIpy5/9UqxPEgusu/ZL2+FEFpGSV7 Ce/Q== X-Gm-Message-State: APjAAAWha5cuZe3bMf3QPCblUDpB5jr5j2y7HCY55NscIMzJZshzSEHw pL3WwQybG6nz50ZkizqCugMdjpbbNtazQg== X-Google-Smtp-Source: APXvYqwidUVGFPvwFp7caoTEay90NynUgu7971OVvnmX8zU30zdYQJC5PMQkz7WTjuJOSkNoteWc0A== X-Received: by 2002:a37:3d6:: with SMTP id 205mr29144892qkd.117.1566392128597; Wed, 21 Aug 2019 05:55:28 -0700 (PDT) Received: from ?IPv6:2001:470:c1a2:1:ed6b:91fc:f80e:f44a? ([2001:470:c1a2:1:ed6b:91fc:f80e:f44a]) by smtp.gmail.com with ESMTPSA id m92sm4164321qte.50.2019.08.21.05.55.27 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 21 Aug 2019 05:55:27 -0700 (PDT) From: Ted Lemon Message-Id: Content-Type: multipart/alternative; boundary="Apple-Mail=_E0112652-5081-4D6C-AE03-3205E7D4BBAD" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Wed, 21 Aug 2019 05:55:27 -0700 In-Reply-To: <414D5D04-FD8A-4F44-9F96-062752667248@rfc1035.com> Cc: ADD Mailing list To: Jim Reid References: <414D5D04-FD8A-4F44-9F96-062752667248@rfc1035.com> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] What to do in this potential working group X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Aug 2019 12:55:32 -0000 --Apple-Mail=_E0112652-5081-4D6C-AE03-3205E7D4BBAD Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 On Aug 21, 2019, at 2:31 AM, Jim Reid wrote: > Acceptable to whom? And who gets to decide what=E2=80=99s acceptable = or not? Who decides now? --Apple-Mail=_E0112652-5081-4D6C-AE03-3205E7D4BBAD Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 On = Aug 21, 2019, at 2:31 AM, Jim Reid <jim@rfc1035.com> wrote:
Acceptable to whom? And who gets to decide what=E2=80=99s = acceptable or not?

Who decides now?

= --Apple-Mail=_E0112652-5081-4D6C-AE03-3205E7D4BBAD-- From nobody Wed Aug 21 05:58:10 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 069AF1208A5 for ; Wed, 21 Aug 2019 05:58:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KsxGhvu0H9U2 for ; Wed, 21 Aug 2019 05:58:06 -0700 (PDT) Received: from shaun.rfc1035.com (shaun.rfc1035.com [93.186.33.42]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 94D1912004D for ; Wed, 21 Aug 2019 05:58:06 -0700 (PDT) Received: from gromit.rfc1035.com (gromit.rfc1035.com [195.54.233.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by shaun.rfc1035.com (Postfix) with ESMTPSA id 89C7D242109D; Wed, 21 Aug 2019 12:58:04 +0000 (UTC) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) From: Jim Reid In-Reply-To: Date: Wed, 21 Aug 2019 13:58:03 +0100 Cc: ADD Mailing list Content-Transfer-Encoding: quoted-printable Message-Id: References: <414D5D04-FD8A-4F44-9F96-062752667248@rfc1035.com> To: Ted Lemon X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: Re: [Add] What to do in this potential working group X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Aug 2019 12:58:08 -0000 > On 21 Aug 2019, at 13:55, Ted Lemon wrote: >=20 > On Aug 21, 2019, at 2:31 AM, Jim Reid wrote: >> Acceptable to whom? And who gets to decide what=E2=80=99s acceptable = or not? >=20 > Who decides now? It appears to be Mozilla. Though perhaps I=E2=80=99ve misunderstood = their TRR policy. From nobody Wed Aug 21 06:02:34 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 59DF412091E for ; Wed, 21 Aug 2019 06:02:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Mdo00jj8sniu for ; Wed, 21 Aug 2019 06:02:30 -0700 (PDT) Received: from mail-qt1-x82c.google.com (mail-qt1-x82c.google.com [IPv6:2607:f8b0:4864:20::82c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A39DF120929 for ; Wed, 21 Aug 2019 06:02:30 -0700 (PDT) Received: by mail-qt1-x82c.google.com with SMTP id q4so2917811qtp.1 for ; Wed, 21 Aug 2019 06:02:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=/qDgVnxf4gzYakcP4x4798OW4g4SG8jI122HqwArxsc=; b=S8IHbB3x918JZ7985l4ppzXof7rn/Vl3KGxFxNcUfdY1XOvi1k16S4qjiDY3vFERxX j5BG+Oucx5j/GzWwmFbjVr2hpb8DaFFD1HPJF3sPN36G30r5RlbGSvKM40R7XoO0P06I 0uzyAOowQ1nzw4H8L7zmdJPDHA8CVmMZN78asvzZhEPqd+0MZGrNVuw2L1wGVwuX1Wvl AebGu919+lKyFDqJAT9y79iBmeIpdXh7iTyK/cPJALQJ4ZJlPAy2BmJ3IS048taX2F7G qoaXO4+5j9esKM/b6iT7VTtsdJdyBLBNOy552Gmqh0iXAhwcIPyat9oVCmoA2Su+YR81 C0Ig== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=/qDgVnxf4gzYakcP4x4798OW4g4SG8jI122HqwArxsc=; b=RyEBLh6a5bQqscGjuxiCSbqIBz/N18ZHbSviiw2K0pH2o8NKtxUsaIk202cEUZU2pM rAEqqjI03sE3gDggScem09P1q+Wz/VLQEwFqaQYONFJ1eX2EYnbTf01rBMUVPkkfiP5p /QYFnoDHOfaIgTIttMUDBPAJsEt6qTEu8BXsWdu9HgOmoQ7TBTWLSgB61I8JblJpu2VM QpYq8HYNMn66bNB1OZqJo5tj+i4HXF3DOkOtcVmceYRD6TyH+cFLNN12eOL5ddPF0d8C oDVDcvlg0HxFLrCT0BeDezubieScStv+rnKvz567/xbc6CzK1c2t3uCfUJGm5lbwwCnM UUAA== X-Gm-Message-State: APjAAAXAAcSZSjsTzjCDV+LFRHCX207xLW2aZtbFJiQgPhGXBvL42LSV B1LNDCbu8hBpujGQVlJiqPwrGctflNqsDA== X-Google-Smtp-Source: APXvYqy7ti5/qb6D0/4tlj5KYfDQYC4l/xmXFQ9Zq9MsD1NAGebd7/+oMAaRRaUjM1QAS2jRyEX1BA== X-Received: by 2002:ac8:23cf:: with SMTP id r15mr29656181qtr.97.1566392549767; Wed, 21 Aug 2019 06:02:29 -0700 (PDT) Received: from ?IPv6:2001:470:c1a2:1:ed6b:91fc:f80e:f44a? ([2001:470:c1a2:1:ed6b:91fc:f80e:f44a]) by smtp.gmail.com with ESMTPSA id x28sm11303130qtk.8.2019.08.21.06.02.28 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 21 Aug 2019 06:02:29 -0700 (PDT) From: Ted Lemon Message-Id: <6AC61DB6-D34C-409A-AF12-3FE44BA28992@fugue.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_63FF9661-1988-4297-AEA0-4DEDDEA1A6FC" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Wed, 21 Aug 2019 06:02:28 -0700 In-Reply-To: Cc: ADD Mailing list To: Jim Reid References: <414D5D04-FD8A-4F44-9F96-062752667248@rfc1035.com> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] What to do in this potential working group X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Aug 2019 13:02:33 -0000 --Apple-Mail=_63FF9661-1988-4297-AEA0-4DEDDEA1A6FC Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 On Aug 21, 2019, at 5:58 AM, Jim Reid wrote: > It appears to be Mozilla. Though perhaps I=E2=80=99ve misunderstood = their TRR policy. No, I mean assuming you aren=E2=80=99t running Mozilla with DoH enabled. --Apple-Mail=_63FF9661-1988-4297-AEA0-4DEDDEA1A6FC Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 On = Aug 21, 2019, at 5:58 AM, Jim Reid <jim@rfc1035.com> wrote:
It appears to be Mozilla. Though perhaps I=E2=80=99ve = misunderstood their TRR policy.

No, I mean assuming you aren=E2=80=99t = running Mozilla with DoH enabled.

= --Apple-Mail=_63FF9661-1988-4297-AEA0-4DEDDEA1A6FC-- From nobody Wed Aug 21 06:41:48 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 79B07120963 for ; Wed, 21 Aug 2019 06:41:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id H1sz6U9G2Thy for ; Wed, 21 Aug 2019 06:41:42 -0700 (PDT) Received: from NAM06-DM3-obe.outbound.protection.outlook.com (mail-dm3nam06on071a.outbound.protection.outlook.com [IPv6:2a01:111:f400:fe56::71a]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5AEC912002F for ; Wed, 21 Aug 2019 06:41:42 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=c16R3r1r/7G+1iQkLILZ8Im4x8KjengkM4P+Ka8LtYDTxzNEXU6uaSd9y0G9PnVmQ1l+0CgbZ+15KewJyTTTtP5fvilFrkOPtAM3kevJY10YhIf8v7ijHRaC7P52HukZkfkIcr5uA5iB1EGcyYyMk8YJ/pUdIoCqt3UROnzs8Znd/E+ZLKCEBPqqZ85PVtVoJ67FGkha86WyNj8TQ67WvQsoMbHssl6rNhUly2rqsrz81Xm3M5Mdi5lNBJScXNO+rkSOkAxMiEeNjcYbGU2AnSD5EGW5scFtT7NB9cupf1FgCq/InrkF3ROW+/DuS/GN4r0Hy7FM4ozK7Gc4CuP1aA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=ptZe1KVLjX6e/kLnkyVKC/4/Bh3qbAsutAKiCdIQYWQ=; b=hu9CeTWGDAiMPkPnv3HSZ7I+fZxDjMl+Iv/5Hpolw1U7oxorYY8+U2h1kcBlcu/u05uqIoPDA15TD/pRhl43SlcgFC+qyPUvAKLBPGpeUmPSJ/SNxsZhkgeCB8StR7gdSKTEuGPORdoU8jrp3+N8mEWe/ErZTeABD4Fzqy1G6GyJWJ1j50M4PpUPPRfLCyWLUzOMnOdH1KHm5tDSimj1rpzTZHINxMklTZdvvHYz8Hdt5jKPCTQuZd99MfRUBlSJveE/em24SxY2JoiK/kDefnDLluHfY+gi+2sduI9tLWE9FXKhPsx1RHwAWlD2gcI5Iks7FTaWRGsQSoO5bSFfTA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=microsoft.com; dmarc=pass action=none header.from=microsoft.com; dkim=pass header.d=microsoft.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=ptZe1KVLjX6e/kLnkyVKC/4/Bh3qbAsutAKiCdIQYWQ=; b=JzikCQEY0WEE7pRXP+o0Nn6fGKegETORDf/zXFuVzmSyvQvgFUCGokjmMXj6JDDC6DND4y25risby206BjXQ4pJtZTOR28ipOa/J1C4TVP8dx5coYU5r1BPT4YyDitOkCCz/CxGgzicoJzNKsiV+3ndkRdKNmetKzdUkDbvkMoY= Received: from CO2PR00MB0069.namprd00.prod.outlook.com (10.166.215.135) by CO2PR00MB0216.namprd00.prod.outlook.com (10.166.214.140) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2232.0; Wed, 21 Aug 2019 13:41:33 +0000 Received: from CO2PR00MB0069.namprd00.prod.outlook.com ([fe80::fde6:4e4f:4f2f:2cae]) by CO2PR00MB0069.namprd00.prod.outlook.com ([fe80::fde6:4e4f:4f2f:2cae%9]) with mapi id 15.20.2238.000; Wed, 21 Aug 2019 13:41:33 +0000 From: Tommy Jensen To: "Eric Vyncke (evyncke)" , Jari Arkko CC: ADD Mailing list Thread-Topic: [Add] What to do in this potential working group Thread-Index: AQHVV5IgfN2/dHLA30mC7zQtvTMK5KcFRa+AgAAo9ICAAB6tgIAADsvX Date: Wed, 21 Aug 2019 13:41:32 +0000 Message-ID: References: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net>, <079D125A-B2F0-41B3-A6F6-CAAFA7F51E6D@cisco.com> In-Reply-To: <079D125A-B2F0-41B3-A6F6-CAAFA7F51E6D@cisco.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Jensen.Thomas@microsoft.com; x-originating-ip: [2601:600:a080:7f23:f82a:7616:fed5:c4c2] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 3b65c407-d5bb-44f0-0a6b-08d7263d4794 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600158)(711020)(4605104)(1401327)(4618075)(2017052603328)(7193020); SRVR:CO2PR00MB0216; x-ms-traffictypediagnostic: CO2PR00MB0216: x-ms-exchange-purlcount: 1 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-forefront-prvs: 0136C1DDA4 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(4636009)(346002)(136003)(396003)(39860400002)(376002)(366004)(189003)(199004)(7736002)(6506007)(229853002)(8676002)(66574012)(6116002)(478600001)(236005)(8936002)(6436002)(5660300002)(606006)(52536014)(71190400001)(8990500004)(81166006)(81156014)(966005)(14454004)(10090500001)(14444005)(256004)(2906002)(102836004)(7696005)(76116006)(11346002)(66946007)(6246003)(33656002)(66476007)(486006)(25786009)(476003)(99286004)(110136005)(53546011)(66446008)(64756008)(71200400001)(9686003)(53936002)(10290500003)(55016002)(22452003)(54896002)(46003)(74316002)(86362001)(76176011)(66556008)(4326008)(316002)(186003)(446003)(6306002); DIR:OUT; SFP:1102; SCL:1; SRVR:CO2PR00MB0216; H:CO2PR00MB0069.namprd00.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: telfhPDehLMlNJCDbxZ3j6VkQbHjRDkOwP5qgAO2bpmIHO6SiGQGPyCnN8IjkZyQgUvVp7HLSitdVPrK7fxnRGa6te0NUl7fBKRL+b2HGprGon7wmpWaU6AXgpigO6eYxXcDIbFAdnZaP2HpjtB+8c4fOmPD5Z45hyuA0eC8KjbTABGSkgZGF93F5Lq6kw4p+9LrhoWEno03OL5k/KkboLObkkXY/ZzfPubaBCUNyB3UyxO8fKmqa5z01CICKuV9YE32n3H1vp89bmhoal8d8RjOZ/I017JEQqz3U4L8gwOZbZyT0MGEGnA1vMYiFdNtukEtPZ9BOT7CgPbiPpUUn8acVwnwjswTTOv8gi1AaLkeC3h9PDZpkoSI9BnMWSn6M07gk0WxQpCOsmUV0w2Yz8ThLEtay0moJG5zux6uYEY= x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_CO2PR00MB0069BAEABBD9BD202B146461FAAA0CO2PR00MB0069namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: 3b65c407-d5bb-44f0-0a6b-08d7263d4794 X-MS-Exchange-CrossTenant-originalarrivaltime: 21 Aug 2019 13:41:32.8520 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: KHFd4oqOMfUvIIL6vTTiNMw/yUu745QxaVtPCsyDZj/v4d4IkN7Hf/bwpRtM98ifkUof4A/TJGAG9mzNpyYCtQ== X-MS-Exchange-Transport-CrossTenantHeadersStamped: CO2PR00MB0216 Archived-At: Subject: Re: [Add] What to do in this potential working group X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Aug 2019 13:41:46 -0000 --_000_CO2PR00MB0069BAEABBD9BD202B146461FAAA0CO2PR00MB0069namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SeKAmWQgbGlrZSB0byBwb2ludCBvdXQgb25lIG90aGVyIHBvaW50IGluIHRoZSBjb250ZXh0IG9m IGNlbnRyYWxpemVkIGRhdGEgYmVpbmcgYSBkcmF3YmFjazogZGF0YSBicmVhY2hlcy4gRXZlcnkg Y29tcGFueSBpcyBzdXNjZXB0aWJsZSB0byB0aGVtLCBhbmQgY2VudHJhbGl6ZWQgZGF0YSByZXF1 aXJlcyBmZXdlciBicmVhY2hlcyB0byBvY2N1ciBpbiBhIGdpdmVuIHRpbWUgd2luZG93IHRvIGdh aW4gYWNjZXNzIHRvIHRoZSBlbnRpcmUgZGF0YSBzZXQuIFRoaXMsIHVubGlrZSB0aGUgZGF0YSBt aW5pbmcgcG90ZW50aWFsLCBkb2VzbuKAmXQgcmVxdWlyZSBuZWZhcmlvdXMgaW50ZW50IGJ5IHRo ZSBkYXRhIGhvbGRlci4NCg0KVGhhbmtzLA0KVG9tbXkNCl9fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fDQpGcm9tOiBBZGQgPGFkZC1ib3VuY2VzQGlldGYub3JnPiBvbiBiZWhhbGYgb2Yg RXJpYyBWeW5ja2UgKGV2eW5ja2UpIDxldnluY2tlQGNpc2NvLmNvbT4NClNlbnQ6IFdlZG5lc2Rh eSwgQXVndXN0IDIxLCAyMDE5IDU6NDQgQU0NClRvOiBKYXJpIEFya2tvIDxqYXJpLmFya2tvQHBp dWhhLm5ldD4NCkNjOiBBREQgTWFpbGluZyBsaXN0IDxhZGRAaWV0Zi5vcmc+DQpTdWJqZWN0OiBS ZTogW0FkZF0gV2hhdCB0byBkbyBpbiB0aGlzIHBvdGVudGlhbCB3b3JraW5nIGdyb3VwDQoNCkxl dCBtZSBjaGltZSBmb3Igb25jZSBpbiB0aGlzIGhlYXRlZCBkaXNjdXNzaW9uIGFzIGFuIGluZGl2 aWR1YWwgSW50ZXJuZXQgdXNlcjogSmFyaSwgeW91IGFyZSAxMDAlIHJpZ2h0IChleGNlcHQgcGVy aGFwcyB0aGUgb3JkZXIgb2YgeW91ciBsaXN0LCBJIHdvdWxkIGhhdmUgcHV0IHRoZSBjcml0aWNh bCBwYXJ0IG9uIHRoZSB0b3AgYXMgY29tcGFuaWVzIGNhbiBnbyBiYW5rcnVwdCkNCg0KLcOpcmlj DQoNCu+7v09uIDIxLzA4LzIwMTksIDEyOjU1LCAiQWRkIG9uIGJlaGFsZiBvZiBKYXJpIEFya2tv IiA8YWRkLWJvdW5jZXNAaWV0Zi5vcmcgb24gYmVoYWxmIG9mIGphcmkuYXJra29AcGl1aGEubmV0 PiB3cm90ZToNCg0KICAgIEVrciwNCg0KICAgIEkgZnVsbHkgcmVhbGlzZSB0aGF0IHRoZXJlIHdp bGwgYmUgZGlmZmVyZW5jZXMgb2Ygdmlld3BvaW50cyB3aGVuIGl0IGNvbWVzIHRvIHRoZSB0cnVz dHdvcnRoaW5lc3Mgb2YgaW5kaXZpZHVhbCBETlMgc2VydmljZSBwcm92aWRlcnMuDQoNCiAgICBC dXQgSSB3YXMgdHJ5aW5nIHRvIG1ha2UgYSBkaWZmZXJlbnQgcG9pbnQuIFdoaWxlIHdlIG1heSBk aXNhZ3JlZSB3aGljaCBwcm92aWRlciBJ4oCZZCBsaWtlIHRvIHVzZSBmb3IgdGhlIEROUyBzZXJ2 aWNlLCBJIHRoaW5rIGl0IHdvdWxkIGJlIHF1aXRlIHJlYXNvbmFibGUgZm9yIHVzIHRvIGFncmVl IHRoYXQgaWYgYWxsIG9mIHVzIHB1dCBvdXIgYWxsIG91ciBxdWVyaWVzIGluIG9uZSBwbGFjZSAo d2hhdGV2ZXIgdGhhdCBpcykgdGhhdCB0aGlzIGNhdXNlcyBzZXZlcmUgcHJvYmxlbXM6DQoNCiAg ICAtIFRoYXQgcGxhY2UgYmVjb21lcyBpbW1lbnNlbHkgdmFsdWFibGUgZnJvbSBhIGNvbW1lcmNp YWwgZGF0YSBtaW5pbmcgcGVyc3BlY3RpdmUuIFRoZXJl4oCZcyBhIHJpc2sgdGhhdCBpdCB3aWxs IGF0IGxlYXN0IGF0IHNvbWUgcG9pbnQgYmUgdXNlZCBmb3IgZGF0YSBtaW5pbmcsIGRlc3BpdGUg d2hhdGV2ZXIgdGhlIGludGVudGlvbnMgb2YgdGhlIHBlb3BsZSB3aG8gc2V0IHRoaXMgc3lzdGVt IHVwIG5vdyBpcy4NCg0KICAgIC0gVGhhdCBwbGFjZSBiZWNvbWVzIGltbWVuc2VseSBpbnRlcmVz dGluZyB0byBmb3IgZ292ZXJubWVudHMgdG8gdGFwLiBUaGVyZeKAmXMgYSByaXNrIHRoYXQgdGhp cyB0YXBwaW5nIGlzIGVpdGhlciBhbHJlYWR5IGhhcHBlbmluZyBvciB3aWxsIGJlIGhhcHBlbmlu ZyBnb2luZyBmb3J3YXJkLCBkZXNwaXRlIGJlc3QgaW50ZW50aW9ucyBvZiB0aGUgcGVvcGxlIHdo byBzZXQgaXQgdXAgb3Igd2hvIG1hbmFnZSBpdC4NCg0KICAgIC0gVGhhdCBwbGFjZXMgYmVjb21l cyBjcml0aWNhbCBpbmZyYXN0cnVjdHVyZSBhbmQgYSB3ZWFrIHBvaW50IHRoYXQgd2UgZG8gbm90 IG5lZWQgaW4gdGhlIEludGVybmV0Lg0KDQogICAgQXMgYSByZXN1bHQsIEkgd291bGQgbGlrZSB0 byBzdWdnZXN0IHRoYXQgdGhlIElFVEYgYWN0dWFsbHkgY29uY2x1ZGVzIHRoZSBhYm92ZSBhbmQg cmVjb21tZW5kcyBhZ2FpbnN0IHRoaXMgcHJhY3RpY2UuDQoNCiAgICBGb3Igd2hhdGV2ZXIgaXQg aXMgd29ydGgsIEkgY2FuIHVuZGVyc3RhbmQgc29tZSBtb3RpdmF0aW9ucyBmb3IgZG9pbmcgc29t ZXRoaW5nIGxpa2UgdGhpcyBlLmcuIGluIGJyb3dzZXJzLiBTb21lIGdvb2QgcmVhc29ucyBhbmQg cG90ZW50aWFsbHkgYWxzbyBzb21lIG5vdCBzbyBnb29kIHJlYXNvbnMuIEJ1dCBldmVuIHdpdGgg dGhhdCBiYWNrZ3JvdW5kLCBpdCBpcyBkaWZmaWN1bHQgZm9yIG1lIHRvIGltYWdpbmUgYSB3b3Jz ZSBhY3QgZm9yIHRoZSBJbnRlcm5ldCB0aGFuIG1ha2luZyBicm93c2VycyBjYWxsIGhvbWUgZm9y IGV2ZXJ5IGFjdGlvbiBvZiB0aGUgdXNlci4gVGhlIHByaXZhY3kgaW1wYWN0cyBmb3IgdGhlIHVz ZXJzIGFyZSB1bmltYWdpbmFibHkgYmFkLg0KDQogICAgQSBmZXcgeWVhcnMgYWdvIHdlIHJlYWxp c2VkIHRoYXQgc3VydmVpbGxhbmNlIG9yZ2FuaXNhdGlvbnMgd2VyZSBsb29raW5nIGF0IHBlb3Bs ZSdzIHRyYWZmaWMsIGFuZCB3ZSBtYW5hZ2VkIHRvIGNoYW5nZSB0aGUgSW50ZXJuZXQgdG8gcHJv dGVjdCB0aGlzIHRyYWZmaWMgd2l0aCBjcnlwdG9ncmFwaGljIG1lYW5zLiBJIHRoaW5rIGl0IGlz IHRvIHRoaW5rIGFib3V0IHRoZSBuZXh0IHN0ZXAsIGFuZCBlbnN1cmUgdGhhdCB3ZSBkb27igJl0 IGNyZWF0ZSBhbiBJbnRlcm5ldCBhcmNoaXRlY3R1cmUgdGhhdCBwdXRzIGV2ZXJ5b25l4oCZcyBk YXRhIGF0IGNlbnRyYWwgbG9jYXRpb24uDQoNCiAgICBPYnZpb3VzbHksIGVuY3J5cHRlZCBETlMg aXMgc3RpbGwgaHVnZWx5IGltcG9ydGFudCwgYXMgYXJlIGdsb2JhbCBETlMgc2VydmljZXMuIEhv d2V2ZXIsIHRoZSBkZXBsb3ltZW50IG1vZGVsIG9mIHVzaW5nIG9uZSAob3IgYSBzbWFsbCBudW1i ZXIgb2YpIHByb3ZpZGVycyBpcyBqdXN0IHdyb25nLiBUaGF0IHdvdWxkIGJlIGZpeGFibGUuDQoN CiAgICBKYXJpDQoNCiAgICAtLQ0KICAgIEFkZCBtYWlsaW5nIGxpc3QNCiAgICBBZGRAaWV0Zi5v cmcNCiAgICBodHRwczovL25hbTA2LnNhZmVsaW5rcy5wcm90ZWN0aW9uLm91dGxvb2suY29tLz91 cmw9aHR0cHMlM0ElMkYlMkZ3d3cuaWV0Zi5vcmclMkZtYWlsbWFuJTJGbGlzdGluZm8lMkZhZGQm YW1wO2RhdGE9MDIlN0MwMSU3Q0plbnNlbi5UaG9tYXMlNDBtaWNyb3NvZnQuY29tJTdDMjQ3Zjg3 Zjc1OWY3NGVlMWE2ZjcwOGQ3MjYzNTZjOTElN0M3MmY5ODhiZjg2ZjE0MWFmOTFhYjJkN2NkMDEx ZGI0NyU3QzElN0MwJTdDNjM3MDE5ODgzMjE2NTY3MjE0JmFtcDtzZGF0YT1jaHphVUtzNDFLWXl3 ck1jNUEzNTIlMkJ5dnROV0FzcEFLeTN0a1Z6NWlUJTJCdyUzRCZhbXA7cmVzZXJ2ZWQ9MA0KDQoN Ci0tDQpBZGQgbWFpbGluZyBsaXN0DQpBZGRAaWV0Zi5vcmcNCmh0dHBzOi8vbmFtMDYuc2FmZWxp bmtzLnByb3RlY3Rpb24ub3V0bG9vay5jb20vP3VybD1odHRwcyUzQSUyRiUyRnd3dy5pZXRmLm9y ZyUyRm1haWxtYW4lMkZsaXN0aW5mbyUyRmFkZCZhbXA7ZGF0YT0wMiU3QzAxJTdDSmVuc2VuLlRo b21hcyU0MG1pY3Jvc29mdC5jb20lN0MyNDdmODdmNzU5Zjc0ZWUxYTZmNzA4ZDcyNjM1NmM5MSU3 QzcyZjk4OGJmODZmMTQxYWY5MWFiMmQ3Y2QwMTFkYjQ3JTdDMSU3QzAlN0M2MzcwMTk4ODMyMTY1 NjcyMTQmYW1wO3NkYXRhPWNoemFVS3M0MUtZeXdyTWM1QTM1MiUyQnl2dE5XQXNwQUt5M3RrVno1 aVQlMkJ3JTNEJmFtcDtyZXNlcnZlZD0wDQo= --_000_CO2PR00MB0069BAEABBD9BD202B146461FAAA0CO2PR00MB0069namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWw+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIgY29udGVudD0i dGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjwvaGVhZD4NCjxib2R5Pg0KPGRpdj5J4oCZZCBs aWtlIHRvIHBvaW50IG91dCBvbmUgb3RoZXIgcG9pbnQgaW4gdGhlIGNvbnRleHQgb2YgY2VudHJh bGl6ZWQgZGF0YSBiZWluZyBhIGRyYXdiYWNrOiBkYXRhIGJyZWFjaGVzLiBFdmVyeSBjb21wYW55 IGlzIHN1c2NlcHRpYmxlIHRvIHRoZW0sIGFuZCBjZW50cmFsaXplZCBkYXRhIHJlcXVpcmVzIGZl d2VyIGJyZWFjaGVzIHRvIG9jY3VyIGluIGEgZ2l2ZW4gdGltZSB3aW5kb3cgdG8gZ2FpbiBhY2Nl c3MgdG8gdGhlIGVudGlyZSBkYXRhDQogc2V0LiBUaGlzLCB1bmxpa2UgdGhlIGRhdGEgbWluaW5n IHBvdGVudGlhbCwgZG9lc27igJl0IHJlcXVpcmUgbmVmYXJpb3VzIGludGVudCBieSB0aGUgZGF0 YSBob2xkZXIuPC9kaXY+DQo8ZGl2Pjxicj4NCjwvZGl2Pg0KPGRpdj5UaGFua3MsPC9kaXY+DQo8 ZGl2PlRvbW15PC9kaXY+DQo8aHIgc3R5bGU9ImRpc3BsYXk6aW5saW5lLWJsb2NrO3dpZHRoOjk4 JSIgdGFiaW5kZXg9Ii0xIj4NCjxkaXYgaWQ9ImRpdlJwbHlGd2RNc2ciIGRpcj0ibHRyIj48Zm9u dCBmYWNlPSJDYWxpYnJpLCBzYW5zLXNlcmlmIiBzdHlsZT0iZm9udC1zaXplOjExcHQiIGNvbG9y PSIjMDAwMDAwIj48Yj5Gcm9tOjwvYj4gQWRkICZsdDthZGQtYm91bmNlc0BpZXRmLm9yZyZndDsg b24gYmVoYWxmIG9mIEVyaWMgVnluY2tlIChldnluY2tlKSAmbHQ7ZXZ5bmNrZUBjaXNjby5jb20m Z3Q7PGJyPg0KPGI+U2VudDo8L2I+IFdlZG5lc2RheSwgQXVndXN0IDIxLCAyMDE5IDU6NDQgQU08 YnI+DQo8Yj5Ubzo8L2I+IEphcmkgQXJra28gJmx0O2phcmkuYXJra29AcGl1aGEubmV0Jmd0Ozxi cj4NCjxiPkNjOjwvYj4gQUREIE1haWxpbmcgbGlzdCAmbHQ7YWRkQGlldGYub3JnJmd0Ozxicj4N CjxiPlN1YmplY3Q6PC9iPiBSZTogW0FkZF0gV2hhdCB0byBkbyBpbiB0aGlzIHBvdGVudGlhbCB3 b3JraW5nIGdyb3VwPC9mb250Pg0KPGRpdj4mbmJzcDs8L2Rpdj4NCjwvZGl2Pg0KPGRpdiBjbGFz cz0iQm9keUZyYWdtZW50Ij48Zm9udCBzaXplPSIyIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx cHQ7Ij4NCjxkaXYgY2xhc3M9IlBsYWluVGV4dCI+TGV0IG1lIGNoaW1lIGZvciBvbmNlIGluIHRo aXMgaGVhdGVkIGRpc2N1c3Npb24gYXMgYW4gaW5kaXZpZHVhbCBJbnRlcm5ldCB1c2VyOiBKYXJp LCB5b3UgYXJlIDEwMCUgcmlnaHQgKGV4Y2VwdCBwZXJoYXBzIHRoZSBvcmRlciBvZiB5b3VyIGxp c3QsIEkgd291bGQgaGF2ZSBwdXQgdGhlIGNyaXRpY2FsIHBhcnQgb24gdGhlIHRvcCBhcyBjb21w YW5pZXMgY2FuIGdvIGJhbmtydXB0KTxicj4NCjxicj4NCi3DqXJpYzxicj4NCjxicj4NCu+7v09u IDIxLzA4LzIwMTksIDEyOjU1LCAmcXVvdDtBZGQgb24gYmVoYWxmIG9mIEphcmkgQXJra28mcXVv dDsgJmx0O2FkZC1ib3VuY2VzQGlldGYub3JnIG9uIGJlaGFsZiBvZiBqYXJpLmFya2tvQHBpdWhh Lm5ldCZndDsgd3JvdGU6PGJyPg0KPGJyPg0KJm5ic3A7Jm5ic3A7Jm5ic3A7IEVrciw8YnI+DQom bmJzcDsmbmJzcDsmbmJzcDsgPGJyPg0KJm5ic3A7Jm5ic3A7Jm5ic3A7IEkgZnVsbHkgcmVhbGlz ZSB0aGF0IHRoZXJlIHdpbGwgYmUgZGlmZmVyZW5jZXMgb2Ygdmlld3BvaW50cyB3aGVuIGl0IGNv bWVzIHRvIHRoZSB0cnVzdHdvcnRoaW5lc3Mgb2YgaW5kaXZpZHVhbCBETlMgc2VydmljZSBwcm92 aWRlcnMuPGJyPg0KJm5ic3A7Jm5ic3A7Jm5ic3A7IDxicj4NCiZuYnNwOyZuYnNwOyZuYnNwOyBC dXQgSSB3YXMgdHJ5aW5nIHRvIG1ha2UgYSBkaWZmZXJlbnQgcG9pbnQuIFdoaWxlIHdlIG1heSBk aXNhZ3JlZSB3aGljaCBwcm92aWRlciBJ4oCZZCBsaWtlIHRvIHVzZSBmb3IgdGhlIEROUyBzZXJ2 aWNlLCBJIHRoaW5rIGl0IHdvdWxkIGJlIHF1aXRlIHJlYXNvbmFibGUgZm9yIHVzIHRvIGFncmVl IHRoYXQgaWYgYWxsIG9mIHVzIHB1dCBvdXIgYWxsIG91ciBxdWVyaWVzIGluIG9uZSBwbGFjZSAo d2hhdGV2ZXIgdGhhdCBpcykgdGhhdCB0aGlzDQogY2F1c2VzIHNldmVyZSBwcm9ibGVtczo8YnI+ DQombmJzcDsmbmJzcDsmbmJzcDsgPGJyPg0KJm5ic3A7Jm5ic3A7Jm5ic3A7IC0gVGhhdCBwbGFj ZSBiZWNvbWVzIGltbWVuc2VseSB2YWx1YWJsZSBmcm9tIGEgY29tbWVyY2lhbCBkYXRhIG1pbmlu ZyBwZXJzcGVjdGl2ZS4gVGhlcmXigJlzIGEgcmlzayB0aGF0IGl0IHdpbGwgYXQgbGVhc3QgYXQg c29tZSBwb2ludCBiZSB1c2VkIGZvciBkYXRhIG1pbmluZywgZGVzcGl0ZSB3aGF0ZXZlciB0aGUg aW50ZW50aW9ucyBvZiB0aGUgcGVvcGxlIHdobyBzZXQgdGhpcyBzeXN0ZW0gdXAgbm93IGlzLjxi cj4NCiZuYnNwOyZuYnNwOyZuYnNwOyA8YnI+DQombmJzcDsmbmJzcDsmbmJzcDsgLSBUaGF0IHBs YWNlIGJlY29tZXMgaW1tZW5zZWx5IGludGVyZXN0aW5nIHRvIGZvciBnb3Zlcm5tZW50cyB0byB0 YXAuIFRoZXJl4oCZcyBhIHJpc2sgdGhhdCB0aGlzIHRhcHBpbmcgaXMgZWl0aGVyIGFscmVhZHkg aGFwcGVuaW5nIG9yIHdpbGwgYmUgaGFwcGVuaW5nIGdvaW5nIGZvcndhcmQsIGRlc3BpdGUgYmVz dCBpbnRlbnRpb25zIG9mIHRoZSBwZW9wbGUgd2hvIHNldCBpdCB1cCBvciB3aG8gbWFuYWdlIGl0 Ljxicj4NCiZuYnNwOyZuYnNwOyZuYnNwOyA8YnI+DQombmJzcDsmbmJzcDsmbmJzcDsgLSBUaGF0 IHBsYWNlcyBiZWNvbWVzIGNyaXRpY2FsIGluZnJhc3RydWN0dXJlIGFuZCBhIHdlYWsgcG9pbnQg dGhhdCB3ZSBkbyBub3QgbmVlZCBpbiB0aGUgSW50ZXJuZXQuPGJyPg0KJm5ic3A7Jm5ic3A7Jm5i c3A7IDxicj4NCiZuYnNwOyZuYnNwOyZuYnNwOyBBcyBhIHJlc3VsdCwgSSB3b3VsZCBsaWtlIHRv IHN1Z2dlc3QgdGhhdCB0aGUgSUVURiBhY3R1YWxseSBjb25jbHVkZXMgdGhlIGFib3ZlIGFuZCBy ZWNvbW1lbmRzIGFnYWluc3QgdGhpcyBwcmFjdGljZS48YnI+DQombmJzcDsmbmJzcDsmbmJzcDsg PGJyPg0KJm5ic3A7Jm5ic3A7Jm5ic3A7IEZvciB3aGF0ZXZlciBpdCBpcyB3b3J0aCwgSSBjYW4g dW5kZXJzdGFuZCBzb21lIG1vdGl2YXRpb25zIGZvciBkb2luZyBzb21ldGhpbmcgbGlrZSB0aGlz IGUuZy4gaW4gYnJvd3NlcnMuIFNvbWUgZ29vZCByZWFzb25zIGFuZCBwb3RlbnRpYWxseSBhbHNv IHNvbWUgbm90IHNvIGdvb2QgcmVhc29ucy4gQnV0IGV2ZW4gd2l0aCB0aGF0IGJhY2tncm91bmQs IGl0IGlzIGRpZmZpY3VsdCBmb3IgbWUgdG8gaW1hZ2luZSBhIHdvcnNlIGFjdCBmb3INCiB0aGUg SW50ZXJuZXQgdGhhbiBtYWtpbmcgYnJvd3NlcnMgY2FsbCBob21lIGZvciBldmVyeSBhY3Rpb24g b2YgdGhlIHVzZXIuIFRoZSBwcml2YWN5IGltcGFjdHMgZm9yIHRoZSB1c2VycyBhcmUgdW5pbWFn aW5hYmx5IGJhZC48YnI+DQombmJzcDsmbmJzcDsmbmJzcDsgPGJyPg0KJm5ic3A7Jm5ic3A7Jm5i c3A7IEEgZmV3IHllYXJzIGFnbyB3ZSByZWFsaXNlZCB0aGF0IHN1cnZlaWxsYW5jZSBvcmdhbmlz YXRpb25zIHdlcmUgbG9va2luZyBhdCBwZW9wbGUncyB0cmFmZmljLCBhbmQgd2UgbWFuYWdlZCB0 byBjaGFuZ2UgdGhlIEludGVybmV0IHRvIHByb3RlY3QgdGhpcyB0cmFmZmljIHdpdGggY3J5cHRv Z3JhcGhpYyBtZWFucy4gSSB0aGluayBpdCBpcyB0byB0aGluayBhYm91dCB0aGUgbmV4dCBzdGVw LCBhbmQgZW5zdXJlIHRoYXQgd2UgZG9u4oCZdCBjcmVhdGUNCiBhbiBJbnRlcm5ldCBhcmNoaXRl Y3R1cmUgdGhhdCBwdXRzIGV2ZXJ5b25l4oCZcyBkYXRhIGF0IGNlbnRyYWwgbG9jYXRpb24uPGJy Pg0KJm5ic3A7Jm5ic3A7Jm5ic3A7IDxicj4NCiZuYnNwOyZuYnNwOyZuYnNwOyBPYnZpb3VzbHks IGVuY3J5cHRlZCBETlMgaXMgc3RpbGwgaHVnZWx5IGltcG9ydGFudCwgYXMgYXJlIGdsb2JhbCBE TlMgc2VydmljZXMuIEhvd2V2ZXIsIHRoZSBkZXBsb3ltZW50IG1vZGVsIG9mIHVzaW5nIG9uZSAo b3IgYSBzbWFsbCBudW1iZXIgb2YpIHByb3ZpZGVycyBpcyBqdXN0IHdyb25nLiBUaGF0IHdvdWxk IGJlIGZpeGFibGUuPGJyPg0KJm5ic3A7Jm5ic3A7Jm5ic3A7IDxicj4NCiZuYnNwOyZuYnNwOyZu YnNwOyBKYXJpPGJyPg0KJm5ic3A7Jm5ic3A7Jm5ic3A7IDxicj4NCiZuYnNwOyZuYnNwOyZuYnNw OyAtLSA8YnI+DQombmJzcDsmbmJzcDsmbmJzcDsgQWRkIG1haWxpbmcgbGlzdDxicj4NCiZuYnNw OyZuYnNwOyZuYnNwOyBBZGRAaWV0Zi5vcmc8YnI+DQombmJzcDsmbmJzcDsmbmJzcDsgPGEgaHJl Zj0iaHR0cHM6Ly9uYW0wNi5zYWZlbGlua3MucHJvdGVjdGlvbi5vdXRsb29rLmNvbS8/dXJsPWh0 dHBzJTNBJTJGJTJGd3d3LmlldGYub3JnJTJGbWFpbG1hbiUyRmxpc3RpbmZvJTJGYWRkJmFtcDth bXA7ZGF0YT0wMiU3QzAxJTdDSmVuc2VuLlRob21hcyU0MG1pY3Jvc29mdC5jb20lN0MyNDdmODdm NzU5Zjc0ZWUxYTZmNzA4ZDcyNjM1NmM5MSU3QzcyZjk4OGJmODZmMTQxYWY5MWFiMmQ3Y2QwMTFk YjQ3JTdDMSU3QzAlN0M2MzcwMTk4ODMyMTY1NjcyMTQmYW1wO2FtcDtzZGF0YT1jaHphVUtzNDFL WXl3ck1jNUEzNTIlMkJ5dnROV0FzcEFLeTN0a1Z6NWlUJTJCdyUzRCZhbXA7YW1wO3Jlc2VydmVk PTAiPg0KaHR0cHM6Ly9uYW0wNi5zYWZlbGlua3MucHJvdGVjdGlvbi5vdXRsb29rLmNvbS8/dXJs PWh0dHBzJTNBJTJGJTJGd3d3LmlldGYub3JnJTJGbWFpbG1hbiUyRmxpc3RpbmZvJTJGYWRkJmFt cDthbXA7ZGF0YT0wMiU3QzAxJTdDSmVuc2VuLlRob21hcyU0MG1pY3Jvc29mdC5jb20lN0MyNDdm ODdmNzU5Zjc0ZWUxYTZmNzA4ZDcyNjM1NmM5MSU3QzcyZjk4OGJmODZmMTQxYWY5MWFiMmQ3Y2Qw MTFkYjQ3JTdDMSU3QzAlN0M2MzcwMTk4ODMyMTY1NjcyMTQmYW1wO2FtcDtzZGF0YT1jaHphVUtz NDFLWXl3ck1jNUEzNTIlMkJ5dnROV0FzcEFLeTN0a1Z6NWlUJTJCdyUzRCZhbXA7YW1wO3Jlc2Vy dmVkPTA8L2E+PGJyPg0KJm5ic3A7Jm5ic3A7Jm5ic3A7IDxicj4NCjxicj4NCi0tIDxicj4NCkFk ZCBtYWlsaW5nIGxpc3Q8YnI+DQpBZGRAaWV0Zi5vcmc8YnI+DQo8YSBocmVmPSJodHRwczovL25h bTA2LnNhZmVsaW5rcy5wcm90ZWN0aW9uLm91dGxvb2suY29tLz91cmw9aHR0cHMlM0ElMkYlMkZ3 d3cuaWV0Zi5vcmclMkZtYWlsbWFuJTJGbGlzdGluZm8lMkZhZGQmYW1wO2FtcDtkYXRhPTAyJTdD MDElN0NKZW5zZW4uVGhvbWFzJTQwbWljcm9zb2Z0LmNvbSU3QzI0N2Y4N2Y3NTlmNzRlZTFhNmY3 MDhkNzI2MzU2YzkxJTdDNzJmOTg4YmY4NmYxNDFhZjkxYWIyZDdjZDAxMWRiNDclN0MxJTdDMCU3 QzYzNzAxOTg4MzIxNjU2NzIxNCZhbXA7YW1wO3NkYXRhPWNoemFVS3M0MUtZeXdyTWM1QTM1MiUy Qnl2dE5XQXNwQUt5M3RrVno1aVQlMkJ3JTNEJmFtcDthbXA7cmVzZXJ2ZWQ9MCI+aHR0cHM6Ly9u YW0wNi5zYWZlbGlua3MucHJvdGVjdGlvbi5vdXRsb29rLmNvbS8/dXJsPWh0dHBzJTNBJTJGJTJG d3d3LmlldGYub3JnJTJGbWFpbG1hbiUyRmxpc3RpbmZvJTJGYWRkJmFtcDthbXA7ZGF0YT0wMiU3 QzAxJTdDSmVuc2VuLlRob21hcyU0MG1pY3Jvc29mdC5jb20lN0MyNDdmODdmNzU5Zjc0ZWUxYTZm NzA4ZDcyNjM1NmM5MSU3QzcyZjk4OGJmODZmMTQxYWY5MWFiMmQ3Y2QwMTFkYjQ3JTdDMSU3QzAl N0M2MzcwMTk4ODMyMTY1NjcyMTQmYW1wO2FtcDtzZGF0YT1jaHphVUtzNDFLWXl3ck1jNUEzNTIl MkJ5dnROV0FzcEFLeTN0a1Z6NWlUJTJCdyUzRCZhbXA7YW1wO3Jlc2VydmVkPTA8L2E+PGJyPg0K PC9kaXY+DQo8L3NwYW4+PC9mb250PjwvZGl2Pg0KPC9ib2R5Pg0KPC9odG1sPg0K --_000_CO2PR00MB0069BAEABBD9BD202B146461FAAA0CO2PR00MB0069namp_-- From nobody Wed Aug 21 07:36:15 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4A955120020 for ; Wed, 21 Aug 2019 07:36:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PKylZ8TnVxou for ; Wed, 21 Aug 2019 07:36:12 -0700 (PDT) Received: from p130.piuha.net (p130.piuha.net [IPv6:2001:14b8:1829::130]) by ietfa.amsl.com (Postfix) with ESMTP id 82074120058 for ; Wed, 21 Aug 2019 07:36:12 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by p130.piuha.net (Postfix) with ESMTP id CD6FF660202; Wed, 21 Aug 2019 17:36:10 +0300 (EEST) Received: from p130.piuha.net ([127.0.0.1]) by localhost (p130.piuha.net [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9SBsptQV42Fh; Wed, 21 Aug 2019 17:36:07 +0300 (EEST) Received: from [127.0.0.1] (p130.piuha.net [IPv6:2001:14b8:1829::130]) by p130.piuha.net (Postfix) with ESMTPS id 127316600F1; Wed, 21 Aug 2019 17:36:07 +0300 (EEST) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\)) From: Jari Arkko In-Reply-To: Date: Wed, 21 Aug 2019 17:36:06 +0300 Cc: ADD Mailing list Content-Transfer-Encoding: quoted-printable Message-Id: <44FC08D4-200B-4464-84F7-3785C2A9E8BA@piuha.net> References: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> <079D125A-B2F0-41B3-A6F6-CAAFA7F51E6D@cisco.com> To: Tommy Jensen X-Mailer: Apple Mail (2.3273) Archived-At: Subject: Re: [Add] What to do in this potential working group X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Aug 2019 14:36:14 -0000 Yes, that=E2=80=99s right. Jari From nobody Wed Aug 21 08:06:34 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0FC5C120ACF for ; Wed, 21 Aug 2019 08:06:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.299 X-Spam-Level: X-Spam-Status: No, score=-4.299 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=open-xchange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IFdGswqog2kS for ; Wed, 21 Aug 2019 08:06:31 -0700 (PDT) Received: from mx4.open-xchange.com (alcatraz.open-xchange.com [87.191.39.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EAE59120943 for ; Wed, 21 Aug 2019 08:06:30 -0700 (PDT) Received: from open-xchange.com (imap.open-xchange.com [10.20.30.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx4.open-xchange.com (Postfix) with ESMTPS id B21406A361; Wed, 21 Aug 2019 17:06:28 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=open-xchange.com; s=201705; t=1566399988; bh=Sy/OL9dcrOLD/w8ZSXU/ZMNWDzQWYjECpDkovH6DMzg=; h=Date:From:Reply-To:To:In-Reply-To:References:Subject:From; b=Yj0a4EB1MCbCmTwZzRzhw2WGBdplZWtwc8OeaKkcZf+wgWK3NIHEmVhK7rBYCIVoB S2iO7GU5ZrUJBTsTI8hNUcBeq7/ipqNJB4U5piekz3XeCdeiwbT+jwnRj5kDJzZZsz RG3X5eBoodvVhBAY4K8Ci8MvExhthrX5o5VAM1jwWuTq2ytVPH9A6nOipW66z+nrfa 5sgGqp4466SKO4E8da3/g7L48UEoakz9+ZSMDed9zgIiY9t/Fpnna6Xm+g+TNTospv fvP0Q4JeUUiNeeewnkQ5L26Aa2lZ/Wdqnvus8PL5/4dOGdmg/OV0FIgLqTUsvED4x7 J5MKeLxopGg0A== Received: from appsuite-gw1.open-xchange.com (appsuite-gw1.open-xchange.com [10.20.28.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by open-xchange.com (Postfix) with ESMTPSA id A5ED13C02A7; Wed, 21 Aug 2019 17:06:28 +0200 (CEST) Date: Wed, 21 Aug 2019 17:06:28 +0200 (CEST) From: Vittorio Bertola Reply-To: Vittorio Bertola To: Stephen Farrell , ADD Mailing list Message-ID: <2089049068.233.1566399988626@appsuite-gw1.open-xchange.com> In-Reply-To: <6402e345-ce5e-da66-5b16-35412d50801d@cs.tcd.ie> References: <2D09D61DDFA73D4C884805CC7865E6114E25D279@GAALPA1MSGUSRBF.ITServices.sbc.com> <1F093592-14EC-41F8-B91C-5617388B8A5E@gmail.com> <7766e4b8-9284-6bfc-0e91-19992e95abc4@cs.tcd.ie> <9FF158A5-4D6E-4BBE-8FCF-D54016D09ADC@gmail.com> <26802715-e42d-d47a-d2ac-7f23766c542e@cs.tcd.ie> <8e00891f-2aa2-ee11-559a-b5a8967b22d9@nostrum.com> <2C23D415-84F9-4B6C-B67B-0CC3EB600520@gmail.com> <2704899B-E43D-4978-A3C9-30E9E7CEBEBD@fugue.com> <4CC4C262-BEF4-4B39-ACB1-A595AB66D6CD@gmail.com> <23893.60122.817218.615568@gro.dd.org> <6402e345-ce5e-da66-5b16-35412d50801d@cs.tcd.ie> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable X-Priority: 3 Importance: Medium X-Mailer: Open-Xchange Mailer v7.10.2-Rev10 X-Originating-Client: open-xchange-appsuite Autocrypt: addr=vittorio.bertola@open-xchange.com; prefer-encrypt=mutual; keydata= mQENBFhFR+UBCACfoywFKBRfzasiiR9/6dwY36eLePXcdScumDMR8qoXvRS55QYDjp5bs+yMq41qWV9 xp/cqryY9jnvHbeF3TsE5yEazpD1dleRbkpElUBpPwXqkrSP8uXO9KkS9KoX6gdml6M4L+F82WpqYC1 uTzOE6HPmhmQ4cGSgoia2jolxAhRpzoYN99/BwpvoZeTSLP5K6yPlMPYkMev/uZlAkMMhelli9IN6yA yxcC0AeHSnOAcNKUr13yXyMlTyi1cdMJ4sk88zIbefxwg3PAtYjkz3wgvP96cNVwAgSt4+j/ZuVaENP pgVuM512m051j9SlspWDHtzrci5pBKKFsibnTelrABEBAAG0NUJlcnRvbGEsIFZpdHRvcmlvIDx2aXR 0b3Jpby5iZXJ0b2xhQG9wZW4teGNoYW5nZS5jb20+iQFABBMBAgAqBAsJCAcGFQoJCAsCBRYCAwEAAp 4BAhsDBYkSzAMABQMAAAAABYJYRUflAAoJEIU2cHmzj8qNaG0H/ROY+suCP86hoN+9RIV66Ej8b3sb8 UgwFJOJMupZfeb9yTIJwE4VQT5lTt146CcJJ5jvxD6FZn1Htw9y4/45pPAF7xLE066jg3OqRvzeWRZ3 IDUfJJIiM5YGk1xWxDqppSwhnKcMOuI72iioWxX0nGQrWxpnWJsjt08IEEwuYucDkul1PHsrLJbTd58 fiMKLVwag+IE1SPHOwkPF6arZQZIfB5ThtOZV+36Jn8Hok9XfeXWBVyPkiWCQYVX39QsIbr0JNR9kQy 4g2ZFexOcTe8Jo12jPRL7V8OqStdDes3cje9lWFLnX05nrfLuE0l0JKWEg8akN+McFXc+oV68h7nu5A Q0EWEVH5QEIAIDKanNBe1uRfk8AjLirflZO291VNkOAeUu+dIhecGnZeQW6htlDinlYOnXhtsY1mK9W PUu+xshDq7lXn2G0LxldYwyJYZaJtDgIKqVqwxfA34Lj27oqPuXwcvGhdCgt0SW/YcalRdAi0/AzUCu 5GSaj2kaGUSnBYYUP4szGJXjaK2psP5toQSCtx2pfSXQ6MaqPK9Zzy+D5xc6VWQRp/iRImodAcPf8fg JJvRyJ8Jla3lKWyvBBzJDg6MOf6Fts78bJSt23X0uPp93g7GgbYkuRMnFI4RGoTVkxjD/HBEJ0CNg22 hoHJondhmKnZVrHEluFuSnW0wBEIYomcPSPB+cAEQEAAYkBMQQYAQIAGwUCWEVH5QIbDAQLCQgHBhUK CQgLAgUJEswDAAAKCRCFNnB5s4/KjdO8B/wNpvWtOpLdotR/Xh4fu08Fd63nnNfbIGIETWsVi0Sbr8i E5duuGaaWIcMmUvgKe/BM0Fpj9X01Zjm90uoPrlVVuQWrf+vFlbalUYVZr51gl5UyUFHk+iAZCAA0WB rsmACKvuV1P7GuiX3UV9b59T9taYJxN3dNFuftrEuvsqHimFtlekUjUwoCekTJdncFusBhwz2OrKhHr WWrEsXkfh0+pURWYAlKlTxvXuI7gAfHEQM+6OnrWvXYtlhd0M1sBPnCjbyG63Qws7Rek9bEWKtH6dA6 dmT2FQT+g1S9Mdf0WkPTQNX0x24dm8IoHuD3KYwX7Svx43Xa17aZnXqUjtj1 Archived-At: Subject: Re: [Add] [Ext] Validity of network administrator role X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Aug 2019 15:06:33 -0000 > Il 16 agosto 2019 02:40 Stephen Farrell ha sc= ritto: >=20 > I'm also personally leery of the moz/cf model as being > a possible one-off. The "we'd like more TRRs" aspiration > seems like a good, and genuine, one, but hasn't so far > produced other TRRs AFAIK. Continued work on that seems > like a good thing. Well, if you run infrastructure that resolves millions of DNS queries per s= econd, turning DoH on is not a matter of clicking a button et voil=C3=A0. B= ut I am confident that we will see more big DoH resolvers appear in some mo= nths (whether Mozilla will then accept them on their list is another matter= ). At the same time, the uncertainty on what the browsers are going to do does= not help to convince managers to authorize investment on wide scale DoH de= ployment. > However, I've not seen other (!=3D moz/TRR) models proposed. >=20 > If someone has one to propose, now and here would seem > like a good time and place. By a "proposed model" I mean > a worked-out model and not a "not yet even on a beer-mat" > nor just a "sent from my iphone" type random thought;-) Ideally, one could put together a working group of people from all stakehol= ders (at the IETF or ad hoc) and work out a generalization of Mozilla's pol= icy that could become an industry standard (perhaps allowing for some leewa= y for different resolvers to offer different features and different clients= to require different features). This would allow resolver operators to hav= e a single set of requirements to meet to become accepted by all clients (a= s long as the minimum requirements for each client are met).=20 In turn, this would make it much easier for people to deploy resolvers - mu= ch easier than having to apply once per browser and meet sets of potentiall= y conflicting requirements to be accepted on each of their trusted lists, o= r taking the risk to invest a lot of time and money and deploy encrypted DN= S services on a mass scale, just to be told later by the browsers "we don't= like you, so users will not be allowed to use your resolver unless they ma= nually change a 3-level-deep configuration option". And there could be some= kind of entity tasked with administering the standard and running accredit= ations. Note that this is orthogonal to the issue of resolver discovery and choice = by the client, though I suppose that some clients might be more willing to = use a locally discovered DoH resolver if it is on that list. I also wrote the above on a beer-mat to meet your condition, but of course = this is still totally abstract - however, it does not make sense to spend m= ore effort on this idea if there is not significant interest in working on = it together. --=20 =20 Vittorio Bertola | Head of Policy & Innovation, Open-Xchange vittorio.bertola@open-xchange.com=20 Office @ Via Treviso 12, 10144 Torino, Italy From nobody Wed Aug 21 09:01:32 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 31B75120B7F; Wed, 21 Aug 2019 09:01:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=netorgft5189650.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ct93yDOENZfs; Wed, 21 Aug 2019 09:01:27 -0700 (PDT) Received: from GBR01-CWL-obe.outbound.protection.outlook.com (mail-eopbgr110089.outbound.protection.outlook.com [40.107.11.89]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D8903120B7E; Wed, 21 Aug 2019 09:01:26 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=iunSlf6da2OQyx4xRNDTuBJvIXBq5wkW2dsw9h48h/NNZNgbEcVQjfdidYZbXgG+vv/JaJcvcXb02jtF8MgflBXnZvYXuXEjhS5gh54KtgMIWlcUMoRI5LOgqDa+hrzzx3lnnTj3K0Pn+BjqGbz9eDmBDYAqGfOh+9sH7kYIzoGWatGgrvRo/ZJQmXoBukk+8JYJ+oieKeACWD8k05AYc3SdrknITD25l/el3FhR/HLNjgKjjvTZZUEuSspAMfUjTmqi78JTyy2fXcvFIVHWTQKMJlBRsI4Lf3OIBFfVYNWulpEBLOZ1enXYZ7sQ0ycF6m18gPiV1onaq5UGIVNHlA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=UWyoDGPgruYA1jazCLXxjhUpS7x9amvZGf34vBGo6F0=; b=AKomBVQMWA4KVznfWCiuVgtQY/FQndcOvPQ6oc6NXTSWXbuG7FSivFTcPmP7Rumq5ppg1lCO2RluNX8kBHlVWaBmzU1QIzoYJOhgtakNNJM3REJSR7Q3H19aMh3Dd0eJT3DcEdsuQpxVE29XiqetrtVsDs6lQxJ3n/eec7Uvy1DieKfWDOhJp94Ze9qpOC/rkcBEpJbKLTywGTnaihAV7Xt7jH8X7wpGrDyDvXlfTiywQPQF91afN59b6nph8J/ZhZlHFtfjpww7R5r8xEQDjtJMUAKIcQGRD3Adx3t27NXWliXDMZfKCmk1cvLdqbvfTC1r4P+zTSWENKWdF5d0Kg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=419.consulting; dmarc=pass action=none header.from=419.consulting; dkim=pass header.d=419.consulting; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=NETORGFT5189650.onmicrosoft.com; s=selector1-NETORGFT5189650-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=UWyoDGPgruYA1jazCLXxjhUpS7x9amvZGf34vBGo6F0=; b=snxIekpydx4fvUUj6ftOn61/lxqDrjLVmS4QckZd7ugsNi8WZWvcyloeZhOhuKjb9b8t02MTUBGPYYhY4tCiKhDj/uSoIRNrsDNw8k71Pvcfp/8n1i5ZFtmXWTKYDPFR6aPjbxR97KSXvR2AUuYZaAd5kmnrf2K2qlzc2qp/qoE= Received: from LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM (20.176.138.146) by LO2P265MB1008.GBRP265.PROD.OUTLOOK.COM (20.176.142.137) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2178.18; Wed, 21 Aug 2019 16:01:23 +0000 Received: from LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM ([fe80::64e9:9b9e:59fc:26f]) by LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM ([fe80::64e9:9b9e:59fc:26f%5]) with mapi id 15.20.2178.018; Wed, 21 Aug 2019 16:01:23 +0000 From: Andrew Campling To: ADD Mailing list , "doh-request@ietf.org" Thread-Topic: DoH discussion at UKNOF44 (the UK Network Operator's Forum), 10th September 2019 Thread-Index: AdVYNrPKVhR5PQ9NS6yq/HNtB4W4sA== Date: Wed, 21 Aug 2019 16:01:23 +0000 Message-ID: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=andrew.campling@419.consulting; x-originating-ip: [2a00:23c4:a499:2e00:75a8:a800:6507:148e] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 28fda93d-10d2-4d70-330d-08d72650d09c x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(7021145)(8989299)(4534185)(7022145)(4603075)(4627221)(201702281549075)(8990200)(7048125)(7024125)(7027125)(7023125)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:LO2P265MB1008; x-ms-traffictypediagnostic: LO2P265MB1008: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-forefront-prvs: 0136C1DDA4 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(39830400003)(396003)(376002)(136003)(346002)(366004)(199004)(189003)(86362001)(2501003)(966005)(256004)(76116006)(30864003)(316002)(305945005)(7736002)(508600001)(74316002)(8936002)(25786009)(33656002)(81166006)(81156014)(14454004)(110136005)(7696005)(476003)(8676002)(6116002)(52536014)(186003)(55016002)(450100002)(99286004)(6506007)(53936002)(44832011)(46003)(486006)(6306002)(102836004)(9686003)(5660300002)(66476007)(71190400001)(66556008)(2906002)(71200400001)(66446008)(66946007)(6436002)(64756008)(46492003); DIR:OUT; SFP:1101; SCL:1; SRVR:LO2P265MB1008; H:LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: 419.consulting does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: Tg3EpISDoEvzbxMrEAwBbPmiJiw5QqiAEXAEX2uNYFNY1QMYB7A+ai2zLicOMKt3p3RhgBdEfabqrBfG7zIftovHTLDmbmkzHDoZUl9G1cXukBWs+FeMMm5NYv0gTdKvbw38sPIDhr6nS6tpyrAQdOcD9Ty+XsyWIsgBxCI8muQRsurKoui8hnDJWXhHvdgXPeNTlkBD4wX7pAR8hzXzbWMnpdBpB9vc2aj5orBHsQsgMAX49mzY/VIDabG0Lg5vYPRJzdK+R4VIbE15evSw2M9OxvNb/0MUYutwemPs0b88+wuLrpZPKtiW+yH+bk3cIz+MsTYATF2u4Q5B+8BlkeQPRkKQ1V+kzznXyzMhNoq5ANEgBbnO264us6+urMj+z82bQDgdC3KNG/UlF+onKA1WF+bd98sUOqT5MDLdEyI= x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_LO2P265MB1327D4E4104A9D12F141AE83C2AA0LO2P265MB1327GBRP_" MIME-Version: 1.0 X-OriginatorOrg: 419.consulting X-MS-Exchange-CrossTenant-Network-Message-Id: 28fda93d-10d2-4d70-330d-08d72650d09c X-MS-Exchange-CrossTenant-originalarrivaltime: 21 Aug 2019 16:01:23.4871 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 9c2ced3e-7522-4755-87dc-f983abc66ec3 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: 9sJo3VR52MtWxjALVOSnrqQNRGp8S6WLBaUeq1wjFRdZ5dbGNuOlQTJjeDrHJ1hjlXwkjDwKtfXUe/StDphysCy7H0BHGvirTNt15VcL1R8= X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO2P265MB1008 Archived-At: Subject: [Add] DoH discussion at UKNOF44 (the UK Network Operator's Forum), 10th September 2019 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Aug 2019 16:01:30 -0000 --_000_LO2P265MB1327D4E4104A9D12F141AE83C2AA0LO2P265MB1327GBRP_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Those on this list that are based in the UK or Europe may be interested to = know that DNS in general, and DoH in particular, are being covered in two p= resentations and a panel discussion at the UK Network Operator's Forum in B= elfast on 10th September. Details of the event are available via https://i= ndico.uknof.org.uk/event/47/, it would be great to meet a few people from t= his list there to discuss some of the issues face-to-face. NB I've no connection with the event or its organisers, other than as a hum= ble delegate. Andrew --_000_LO2P265MB1327D4E4104A9D12F141AE83C2AA0LO2P265MB1327GBRP_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable
Those on this list that are based in the UK or Europe may be intereste= d to know that DNS in general, and DoH in particular, are being covered in = two presentations and a panel discussion at the UK Network Operator’s= Forum in Belfast on 10th September.  Details of the event are available via https://indico.uk= nof.org.uk/event/47/, it would be great to meet a few people= from this list there to discuss some of the issues face-to-face. 
 
NB I’ve no connection with the event or its organisers, other th= an as a humble delegate. 
 <= /div>
 <= /div>
Andrew
&nb= sp;
 <= /div> --_000_LO2P265MB1327D4E4104A9D12F141AE83C2AA0LO2P265MB1327GBRP_-- From nobody Wed Aug 21 09:31:51 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C0C01120C54 for ; Wed, 21 Aug 2019 09:31:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OWEuZOF0Lzf2 for ; Wed, 21 Aug 2019 09:31:48 -0700 (PDT) Received: from mail-lj1-x22d.google.com (mail-lj1-x22d.google.com [IPv6:2a00:1450:4864:20::22d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6219D120C55 for ; Wed, 21 Aug 2019 09:31:48 -0700 (PDT) Received: by mail-lj1-x22d.google.com with SMTP id z17so2772750ljz.0 for ; Wed, 21 Aug 2019 09:31:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=DFzujBZ/qo0SWSJ+x5QYe0NCre7E55sL5Ti3vUIl7yo=; b=COFD64EVs2VH1sOtjS4WUS3c0xMBX06JiK23UBPQvtEAN2LpO38mZuDhwRl9yIjEQx Xh2HUhHvBm8ZBbU9alom09HwzpQGzxXnrm5UMVfSpFCC2SiJAp+mgur6x28ge5edSE9k XvE52nG2DfBkvzx7PRw5a5QKuVNaxya1DLGWAlkZubuslzE6Ijm8LYYuJmjSxmKwnQYU bL5Xvfn78C8yMbSyMsPG8Urg6fa9B3EZkRGJp5PzCbCTdd1GhWt7kCcYffPqgrGCpvas EVx1R/ABLfFtGdqPAJ52lbjPsZBJnflQqBZJleMS7mulF7V1FRNQdSAEttA0AbiGZays gYAA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=DFzujBZ/qo0SWSJ+x5QYe0NCre7E55sL5Ti3vUIl7yo=; b=EzD9aF92Ilu1P7RF9Tf8y3+T4CaaBUDExABqqtUyrxNt1w9MV6EG3U1I79SFyFbD9z pdKqgi7AEHZ4iFA/0BQYF9KLkt8644wtFahaqNrn9SzQ1c4Ye+7ixW5WqvlZkNZsFaFP wp90ymEMsGokrz9qiXM95G1QJ+LMv74Jb6JF9CnTdSgMHiXgVzcByKE6QtWtl4GwRhw5 Pb9VK/rZa8nFRU4fQCa/NP//hpGjWM23z0ppJMb1hXJNFlYxml7lubYTcBNzQFk+RTCu PNnizLrx6sGTV43F9az0jNuJCa8UH4olZxzgC6ujR1eUhi/4mAnt9lz0AyVq6n/PT7/X LY7w== X-Gm-Message-State: APjAAAUN/M72iPrILcU2o9Y5hDIVfTgcvcnMpVnVyNrK9bJNtAZebuXv UlJrV2JP4+nmpxqi/ta6L2r3YIJupAvLN+sSqRF7cw== X-Google-Smtp-Source: APXvYqw1NuVOD+FAf8hRI+TXPEDdcQFLFlNli9U5jE9u85sRKjQL8TD2ZB1umltHQsov7IA6edsTmC12KOf20SgpdNc= X-Received: by 2002:a2e:9acf:: with SMTP id p15mr19669731ljj.13.1566405106383; Wed, 21 Aug 2019 09:31:46 -0700 (PDT) MIME-Version: 1.0 References: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> In-Reply-To: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> From: Eric Rescorla Date: Wed, 21 Aug 2019 17:31:10 +0100 Message-ID: To: Jari Arkko Cc: ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000f0cef10590a31b14" Archived-At: Subject: Re: [Add] What to do in this potential working group X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Aug 2019 16:31:51 -0000 --000000000000f0cef10590a31b14 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Jari, I understand that this is your opinion and the argument you re making but I can't say I agree with the overall assessment you are making. We have a situation now where the DNS is tragically insecure and nonprivate -- and not really that decentralized -- and we have an opportunity ti make it more secure at the cost of making it more centralized. In this instance, I think that's a tradeoff worth considering, while also looking for ways to minimize centralization. -Ekr On Wed, Aug 21, 2019 at 11:55 AM Jari Arkko wrote: > Ekr, > > I fully realise that there will be differences of viewpoints when it come= s > to the trustworthiness of individual DNS service providers. > > But I was trying to make a different point. While we may disagree which > provider I=E2=80=99d like to use for the DNS service, I think it would be= quite > reasonable for us to agree that if all of us put our all our queries in o= ne > place (whatever that is) that this causes severe problems: > > - That place becomes immensely valuable from a commercial data mining > perspective. There=E2=80=99s a risk that it will at least at some point b= e used for > data mining, despite whatever the intentions of the people who set this > system up now is. > > - That place becomes immensely interesting to for governments to tap. > There=E2=80=99s a risk that this tapping is either already happening or w= ill be > happening going forward, despite best intentions of the people who set it > up or who manage it. > > - That places becomes critical infrastructure and a weak point that we do > not need in the Internet. > > As a result, I would like to suggest that the IETF actually concludes the > above and recommends against this practice. > > For whatever it is worth, I can understand some motivations for doing > something like this e.g. in browsers. Some good reasons and potentially > also some not so good reasons. But even with that background, it is > difficult for me to imagine a worse act for the Internet than making > browsers call home for every action of the user. The privacy impacts for > the users are unimaginably bad. > > A few years ago we realised that surveillance organisations were looking > at people's traffic, and we managed to change the Internet to protect thi= s > traffic with cryptographic means. I think it is to think about the next > step, and ensure that we don=E2=80=99t create an Internet architecture th= at puts > everyone=E2=80=99s data at central location. > > Obviously, encrypted DNS is still hugely important, as are global DNS > services. However, the deployment model of using one (or a small number o= f) > providers is just wrong. That would be fixable. > > Jari > > --000000000000f0cef10590a31b14 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Jari,

I understand that this= is your opinion and the argument you re making but I can't say I agree= with the overall assessment you are making.

We ha= ve a situation now where the DNS is tragically insecure and nonprivate -- a= nd not really that decentralized -- and we have an opportunity ti make it m= ore secure at the cost of making it more centralized. In this instance, I t= hink that's a tradeoff worth considering, while also looking for ways t= o minimize centralization.

-Ekr

On Wed, Aug 21, 2019 at 11:55 AM Jari Arkko <jari.arkko@piuha.net> wrote:
Ekr,

I fully realise that there will be differences of viewpoints when it comes = to the trustworthiness of individual DNS service providers.

But I was trying to make a different point. While we may disagree which pro= vider I=E2=80=99d like to use for the DNS service, I think it would be quit= e reasonable for us to agree that if all of us put our all our queries in o= ne place (whatever that is) that this causes severe problems:

- That place becomes immensely valuable from a commercial data mining persp= ective. There=E2=80=99s a risk that it will at least at some point be used = for data mining, despite whatever the intentions of the people who set this= system up now is.

- That place becomes immensely interesting to for governments to tap. There= =E2=80=99s a risk that this tapping is either already happening or will be = happening going forward, despite best intentions of the people who set it u= p or who manage it.

- That places becomes critical infrastructure and a weak point that we do n= ot need in the Internet.

As a result, I would like to suggest that the IETF actually concludes the a= bove and recommends against this practice.

For whatever it is worth, I can understand some motivations for doing somet= hing like this e.g. in browsers. Some good reasons and potentially also som= e not so good reasons. But even with that background, it is difficult for m= e to imagine a worse act for the Internet than making browsers call home fo= r every action of the user. The privacy impacts for the users are unimagina= bly bad.

A few years ago we realised that surveillance organisations were looking at= people's traffic, and we managed to change the Internet to protect thi= s traffic with cryptographic means. I think it is to think about the next s= tep, and ensure that we don=E2=80=99t create an Internet architecture that = puts everyone=E2=80=99s data at central location.

Obviously, encrypted DNS is still hugely important, as are global DNS servi= ces. However, the deployment model of using one (or a small number of) prov= iders is just wrong. That would be fixable.

Jari

--000000000000f0cef10590a31b14-- From nobody Wed Aug 21 09:50:06 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A84E6120C19 for ; Wed, 21 Aug 2019 09:50:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zVtPzxA8NgGj for ; Wed, 21 Aug 2019 09:50:02 -0700 (PDT) Received: from mail1.bemta26.messagelabs.com (mail1.bemta26.messagelabs.com [85.158.142.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7AC25120C05 for ; Wed, 21 Aug 2019 09:50:02 -0700 (PDT) Received: from [85.158.142.103] (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256 bits)) by server-1.bemta.az-a.eu-central-1.aws.symcld.net id 5B/F4-16636-7367D5D5; Wed, 21 Aug 2019 16:49:59 +0000 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFlrGJsWRWlGSWpSXmKPExsWi75kzV9e8LDb W4OB6WYv/p9exOTB6LFnykymAMYo1My8pvyKBNeP+rgbGgnfsFb/nLGBrYNzG1sXIxSEksJ1R YsWEyawQzmFGidUv5zDBZW7uPAjlXGSU+LH3HFRZP5PEgzvfoZz7jBKnZu1i72Lk5GATsJe4t O4FK4gtIqAo0bjxDiOILQxk/1v7iAkiriYx79MtqBo9iXcvZ7KB2CwCqhI77v8Dq+EViJFY8n I3mM0oICvxpXE1M4jNLCAucevJfLC4hICAxJI955khbFGJl4//sUL0PmSR+LK/CKI3SmLnsw4 2iBoFifkLTkL1ykpcmt/NCGH7Sqy8fokd5BkJgZuMEouOf2KBSGhJdLefYYewsyVeflsE1aAm ceNNB9RiGYn2zztYIexmNomD6y1AbCGBFIm5G7dB9cpJrOp9yAKx4DyzxK7HV4EGcQA5KhL/D lVOYDSYheQ3CFtHYsHuT2wQtrbEsoWvmWeB/SYocXLmE5YFjCyrGC2TijLTM0pyEzNzdA0NDH QNDY11waReYpVuol5qqW5yal5JUSJQVi+xvFivuDI3OSdFLy+1ZBMjMMmkFDIU7mD8MOuN3iF GSQ4mJVHeKamxsUJ8SfkplRmJxRnxRaU5qcWHGGU4OJQkeONLgXKCRanpqRVpmTnAhAeTluDg URLh3V0ClOYtLkjMLc5Mh0idYtTlmPBy7iJmIZa8/LxUKXHeQpAZAiBFGaV5cCNgyfcSo6yUM C8jAwODEE9BalFuZgmq/CtGcQ5GJWHezyCreDLzSuA2vQI6ggnkiMORIEeUJCKkpBqYOv/3FZ 5TXtKhWLHsYtwNBX3TpzOnbhI5mL/s+/pDv3wiTsfunny4w2zWjuOdPM59gqvslwtZWBbsMuu X5c2dOUtFpLCtYmfLt2/qbtart58J0nsasrzn3fLUEwo7xN78cBZ+IKKg8U5SzTTt49TIF58E SnwvbTD58CSjeKvLTlX/qKtf7hbcSjdl89irFS6b410970pivV7Vb3ubsLN/Z7gxxrlfucKb8 njT85COhx8Zzq70UX9z7KK/RoXGnqPqU5iPz3TW01vZHeFZUi8/rWvmUgcbiXtXti2+dvPU5/ ky/d5Bfy81sx8/+GMDj8DVtih/f89H63bdqEpb/SuE5bHAkum3WNXZZjCH+9SLK7EUZyQaajE XFScCANIEid85BAAA X-Env-Sender: Kevin.Smith@vodafone.com X-Msg-Ref: server-8.tower-228.messagelabs.com!1566406198!64985!2 X-Originating-IP: [47.73.108.157] X-SYMC-ESS-Client-Auth: outbound-route-from=pass X-StarScan-Received: X-StarScan-Version: 9.43.9; banners=-,-,- X-VirusChecked: Checked Received: (qmail 23931 invoked from network); 21 Aug 2019 16:49:59 -0000 Received: from vgdpm15vr.vodafone.com (HELO voxe01hw.internal.vodafone.com) (47.73.108.157) by server-8.tower-228.messagelabs.com with AES256-SHA256 encrypted SMTP; 21 Aug 2019 16:49:59 -0000 Received: from VOEXH07W.internal.vodafone.com (47.73.211.205) by edge1.vodafone.com (195.232.244.46) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Wed, 21 Aug 2019 18:49:58 +0200 Received: from voxe03hw.internal.vodafone.com (195.232.244.48) by VOEXH07W.internal.vodafone.com (47.73.211.205) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Wed, 21 Aug 2019 18:49:58 +0200 Received: from VOEXH11W.internal.vodafone.com (47.73.211.209) by edge1.vodafone.com (195.232.244.48) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Wed, 21 Aug 2019 18:49:58 +0200 Received: from EUR03-DB5-obe.outbound.protection.outlook.com (172.17.213.41) by VOEXH11W.internal.vodafone.com (47.73.211.215) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Wed, 21 Aug 2019 18:49:58 +0200 Received: from AM6PR05MB5861.eurprd05.prod.outlook.com (20.179.3.87) by AM6PR05MB5255.eurprd05.prod.outlook.com (20.177.196.216) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2178.16; Wed, 21 Aug 2019 16:49:57 +0000 Received: from AM6PR05MB5861.eurprd05.prod.outlook.com ([fe80::f096:d9cb:634d:57c8]) by AM6PR05MB5861.eurprd05.prod.outlook.com ([fe80::f096:d9cb:634d:57c8%3]) with mapi id 15.20.2178.020; Wed, 21 Aug 2019 16:49:57 +0000 From: "Smith, Kevin, Vodafone Group" To: "add@ietf.org" Thread-Topic: Re: [Add] Participation Thread-Index: AdVYP+NHXrZ4SZ1vRB6kelNmi+FQDA== Date: Wed, 21 Aug 2019 16:49:57 +0000 Message-ID: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_0359f705-2ba0-454b-9cfc-6ce5bcaac040_Enabled=True; MSIP_Label_0359f705-2ba0-454b-9cfc-6ce5bcaac040_SiteId=68283f3b-8487-4c86-adb3-a5228f18b893; MSIP_Label_0359f705-2ba0-454b-9cfc-6ce5bcaac040_Owner=Kevin.Smith@vodafone.com; MSIP_Label_0359f705-2ba0-454b-9cfc-6ce5bcaac040_SetDate=2019-08-21T16:49:55.4813793Z; MSIP_Label_0359f705-2ba0-454b-9cfc-6ce5bcaac040_Name=C2 General; MSIP_Label_0359f705-2ba0-454b-9cfc-6ce5bcaac040_Application=Microsoft Azure Information Protection; MSIP_Label_0359f705-2ba0-454b-9cfc-6ce5bcaac040_Extended_MSFT_Method=Automatic; Sensitivity=C2 General x-originating-ip: [47.73.248.47] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: efb16a06-eef8-44bc-f550-08d726579948 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:AM6PR05MB5255; x-ms-traffictypediagnostic: AM6PR05MB5255: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-forefront-prvs: 0136C1DDA4 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(4636009)(376002)(346002)(136003)(396003)(39860400002)(366004)(189003)(199004)(53754006)(86362001)(99286004)(52536014)(6916009)(229853002)(316002)(33656002)(66066001)(6436002)(55016002)(9686003)(7696005)(4744005)(14454004)(66574012)(71200400001)(71190400001)(478600001)(102836004)(186003)(26005)(6506007)(305945005)(2351001)(74316002)(14444005)(256004)(8676002)(1730700003)(81156014)(81166006)(6116002)(2906002)(3846002)(53936002)(6246003)(4743002)(2501003)(76116006)(66446008)(64756008)(486006)(5660300002)(7736002)(5640700003)(66476007)(66946007)(8936002)(66556008)(476003)(25786009); DIR:OUT; SFP:1101; SCL:1; SRVR:AM6PR05MB5255; H:AM6PR05MB5861.eurprd05.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: vodafone.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: uvBGnvGYkorIqYvAqmNy4/JZKy/tWblO+uToCs5scOfwmLeoMbxpmti6fiTT7wUcRURWYNE26J77Pb1ISrUH2abqg4ljyLLHpOM5ZidnowRiLoI3IfBRfki+GjM11mgpK+4dfR0yeMNDLOqN8kUV9DjsW2qMPf/465b8HOa4tzmRKfbwHQT21wqbxkeU4L0QWC5XHDISuY29Ojp/gwdQNXoeQpU2xz9MWudzN6SbfykmlJlq8Xy6sGAOImfwkEiqU0Uygrt7iDEUCIiIK2RQWiQr8SWeVYAvmD6b9HCp9VZ96n3+91iAqO8fH3Wp/ic41gUi7ubOgrfbxyoXP1atBN2NGderUu/GkLJShJdD03gw7k742fIYTJa2BR3924Mt9mL6iKfpWk1CeivACqBilLuhn/28YS0+THF/+HsFyQc= x-ms-exchange-transport-forked: True arc-seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=gCZSbjp3rMsLXjZzrAvVhXUI/ub63+p3RGwhkNrfbkX3R0t4SHvnZs2IKI/fly1b17nU3Sa5xTw76h5jLGMnK40R+QFglGZyyM7XOrNZtU76NZ8+JDFgQk8dcZWQ+qylv+76OFy7SNlEbhrIV6CUqGwcyjCY8J653fFDc4z+S0PTOc/MPjmwjVPm2fqa05XaSKVQ2VExpGg5X3x9BYl5BpLcK36uYKCd1K8UCNHtwfQOUVjF7kvwyIfMyvtN2pyCk4e6fD+jKyZ12q64Jn6YaJVNJanTvGrvyyRn5etunrsi8zTdGG+6O/KEHk/4mQ2IGGOhVg4pMMV9r0hW+KJhyg== arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=3NguhEMoKiVJyp3+3CFF9HNpbgSqbgtH3OOSyDjrT4A=; b=mgD33w9J636dyU5deyuEM6HRfyC6FNBiwRS9nQ/lGMmVEwbX//9dPfhIrzdBKTZX3HdoOmBpjQTpg4ZfZzpt1wGrEcmHpMwYp8DtUFQ+xpyhkx3y3kB9TDVOi++Y9LlgpOk5bUwCnok0oMtpfLPkbuleA0+1pofwWV6Bq1cf57yvqDECMligIZrqHS/lr9eXGVMp0wxQUtpA9T0G8gExTOI/3OwyVFyHlUqnQ5xtz94gdjcasNYymNlfNb9bB10QUjvPv6VOPeM7JQHR3160PD4Z8oyaGmIqY6Bkkmy3Jd/Xg32juUPi/7gQKonGw2arbyMEtUqSIxPtu/IzpIGSTA== arc-authentication-results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=vodafone.com; dmarc=pass action=none header.from=vodafone.com; dkim=pass header.d=vodafone.com; arc=none x-ms-exchange-crosstenant-network-message-id: efb16a06-eef8-44bc-f550-08d726579948 x-ms-exchange-crosstenant-originalarrivaltime: 21 Aug 2019 16:49:57.0920 (UTC) x-ms-exchange-crosstenant-fromentityheader: Hosted x-ms-exchange-crosstenant-id: 68283f3b-8487-4c86-adb3-a5228f18b893 x-ms-exchange-crosstenant-mailboxtype: HOSTED x-ms-exchange-crosstenant-userprincipalname: 16eP18jVwGPiimKxtozp6Emt8b1Hz/fN1nJu9FH077qOCYuqgcRv7ICeAn+kwJPGqYrA1AhoL4kdcR7z3zquY8Uj4YrqYuXf1nEGrxEdwes= x-ms-exchange-transport-crosstenantheadersstamped: AM6PR05MB5255 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: vodafone.com X-CFilter-Loop: Reflected Archived-At: Subject: Re: [Add] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Aug 2019 16:50:05 -0000 Hello all, I've confirmed with Vodafone UK's network and home broadband teams that the= y do not perform HTTPS interception/Man in the Middle. The imgur issue is the result of DNS 53-based filtering. The error appears = that the Vodafone root certificate (used to secure the user's configuration= channel to the home router) was also used when the request was redirected = to the secure 'warning page' at the network proxy, apparently causing the = browser to prompt 'add certificate to exception list'. The imgur issue was = from January, the fix has been rolled out and I'm told that this certificat= e error should not happen anymore. The NordVPN issue appears to be a user with content controls enabled at the= router, which as I understand it may block certain VPNs based on DNS 53. I= suspect they would simply disable the content controls to solve this. So to confirm: no HTTPS interception/Man in the Middle in Vodafone UK. All best, Kevin Mr Kevin Smith Vodafone Group R&D C2 General From nobody Wed Aug 21 09:58:04 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 90899120C95 for ; Wed, 21 Aug 2019 09:58:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=portfast.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DYBHmH-BjjuR for ; Wed, 21 Aug 2019 09:58:01 -0700 (PDT) Received: from mail.portfast.net (mail.portfast.net [IPv6:2a03:9800:20:1::2]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E2EA71201DC for ; Wed, 21 Aug 2019 09:58:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=portfast.net; s=dkim; h=Content-Transfer-Encoding:Content-Type:In-Reply-To: MIME-Version:Date:Message-ID:From:References:To:Subject:Sender:Reply-To:Cc: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=jQqH/TXjyLle/sepTPuWNGInQ878NujG581MYkvnFks=; b=c1YR0NhFSzu9dYMbZPy2DArlZD kHsUK913acncCMqKlrgni777m8yNynX9av+m2FH4lbi55gIg7POnVhyPBfAH/fJz8GCERFOcZdzqY wMzN6Ug+oSgle7i9S3qK+BQLDEWyFjX/CVrckbYZcG/cXQGJejX0MYwpppWVcRFHFfCw=; Received: from [88.212.170.135] (port=58057 helo=Rays-MacBook-Pro.local) by mail.portfast.net ([188.246.200.9]:465) with esmtpsa (fixed_plain:ray@bellis.me.uk) (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) id 1i0Tvq-0000ua-Sy (Exim 4.89) for add@ietf.org (return-path ); Wed, 21 Aug 2019 16:57:58 +0000 To: add@ietf.org References: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> From: Ray Bellis Message-ID: Date: Wed, 21 Aug 2019 17:57:57 +0100 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-GB Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [Add] What to do in this potential working group X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Aug 2019 16:58:04 -0000 On 21/08/2019 17:31, Eric Rescorla wrote: > Jari, > > I understand that this is your opinion and the argument you re making > but I can't say I agree with the overall assessment you are making. > > We have a situation now where the DNS is tragically insecure and > nonprivate -- and not really that decentralized -- and we have an > opportunity ti make it more secure at the cost of making it more > centralized. In this instance, I think that's a tradeoff worth > considering, while also looking for ways to minimize centralization. With respect, the DNS operations community doesn't appear to agree with you. There are perfectly good ways to protect both the privacy and integrity of the DNS that don't require that centralization. Ray From nobody Wed Aug 21 10:02:06 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 99E0A120CAA for ; Wed, 21 Aug 2019 10:01:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XTgsZrGOmgLT for ; Wed, 21 Aug 2019 10:01:55 -0700 (PDT) Received: from mail-lj1-x235.google.com (mail-lj1-x235.google.com [IPv6:2a00:1450:4864:20::235]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 67DE2120CDD for ; Wed, 21 Aug 2019 10:01:55 -0700 (PDT) Received: by mail-lj1-x235.google.com with SMTP id x4so2827559ljj.6 for ; Wed, 21 Aug 2019 10:01:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=tl3hHs0j76JXTz/jBmkfJRqVVU0tp7uYBzQa49p28HE=; b=QqOgrObf79aOE2US2Pc+ml4/WvOnrZo71Nm7FGJeFPD2rf7z7YOqKx71x/KROwbCPm 8AgXWHBzFvyrhDLhA89qOoR/Xe276iMHcREDKl0aXVRg2+ah2Nt7R39W85V1sKU6KPuY gHPKi0h7EEP4nf0wcaAcXsCDpM06fNL4U6NK8XNJp7IM4gknTyq2zGsi3BjqxHdWOr0b b1KT/faVCSY4Dt+eBWsZyUsYiHqMmNAP+4dTSB3C20AWKeBKs55nB48vHHh3CTUxWMHP f2uERSZcmWBMXnGhxp6IwC6cfz7u31pzbx2VCvVgY8ZPYbYZhd/Sdwrbd6XV9+vwTdIb kQRg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=tl3hHs0j76JXTz/jBmkfJRqVVU0tp7uYBzQa49p28HE=; b=SrEjU1OER23qlyPLU/jUFPDtSgjVMsBH/kThAzCu/5krE6C1IHUA7eResbop8izVYo 3Bf48zh7XkpMCE1HR8+uqmznSVxu7qrftPp8LPeGXwmP4N/vbhio9IWvytocn+Nvq+bk lMQo4vyM/anqkXcwNoBTbH8DIhPVXXQb6yG49mAaDRnBbRX/GKJA0xCVTG0fOPS2ZYa1 rtcDHGfg4OT4p4hQSpAsxuwGiDNQYt9wvF/+RZ6sefuwU14nDTQzByAhDHasdDw9AvXS uTM68ygVf89x8mPPH50fUe0XZzppMSwuEKEp8ZcuUvQyw1sJuGsstiPLtkufQ3JpvkuB HwdQ== X-Gm-Message-State: APjAAAW7eva+0auq8cqaU51rVS9DVn1EaZ0p3GR+jC2BAdAOwzxTIL7K Dwf+GvNHKlNTUF4jbSel7yemH8XAwlZX9TOe6a9MnKXv X-Google-Smtp-Source: APXvYqwpR6doNPScaph6ofbi0zplfZPGRN7+0NbMS/pppv6hYsq74sX6BnjJ7tuYJdZySVCam5zj81f3Unw/gvud03A= X-Received: by 2002:a2e:9acf:: with SMTP id p15mr19746606ljj.13.1566406913619; Wed, 21 Aug 2019 10:01:53 -0700 (PDT) MIME-Version: 1.0 References: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> In-Reply-To: From: Eric Rescorla Date: Wed, 21 Aug 2019 18:01:16 +0100 Message-ID: To: Ray Bellis Cc: ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000a908640590a38701" Archived-At: Subject: Re: [Add] What to do in this potential working group X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Aug 2019 17:02:04 -0000 --000000000000a908640590a38701 Content-Type: text/plain; charset="UTF-8" On Wed, Aug 21, 2019 at 5:58 PM Ray Bellis wrote: > > > On 21/08/2019 17:31, Eric Rescorla wrote: > > Jari, > > > > I understand that this is your opinion and the argument you re making > > but I can't say I agree with the overall assessment you are making. > > > > We have a situation now where the DNS is tragically insecure and > > nonprivate -- and not really that decentralized -- and we have an > > opportunity ti make it more secure at the cost of making it more > > centralized. In this instance, I think that's a tradeoff worth > > considering, while also looking for ways to minimize centralization. > > With respect, the DNS operations community doesn't appear to agree with > you. > No doubt. There are perfectly good ways to protect both the privacy and integrity > of the DNS that don't require that centralization. > Indeed: this is what I was referring to when I said "ways to minimize centralization". Specifically, ISPs could commit to strong privacy policies and join our TRR program. -Ekr > Ray > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --000000000000a908640590a38701 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Wed, Aug 21, 2019 at 5:58 PM Ray B= ellis <ray@bellis.me.uk> wrot= e:


On 21/08/2019 17:31, Eric Rescorla wrote:
> Jari,
>
> I understand that this is your opinion and the argument you re making =
> but I can't say I agree with the overall assessment you are making= .
>
> We have a situation now where the DNS is tragically insecure and
> nonprivate -- and not really that decentralized -- and we have an
> opportunity ti make it more secure at the cost of making it more
> centralized. In this instance, I think that's a tradeoff worth > considering, while also looking for ways to minimize centralization.
With respect, the DNS operations community doesn't appear to agree with= you.

No doubt.


There are perfectly good ways to protect both the privacy and integrity of the DNS that don't require that centralization.

Indeed: this is what I was referring to when I said "w= ays to minimize centralization". Specifically, ISPs could commit to st= rong privacy policies and join our TRR program.

-Ekr

Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--000000000000a908640590a38701-- From nobody Wed Aug 21 10:05:18 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7D377120CA2 for ; Wed, 21 Aug 2019 10:05:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=portfast.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JXzdIOpcK7Vp for ; Wed, 21 Aug 2019 10:05:15 -0700 (PDT) Received: from mail.portfast.net (mail.portfast.net [IPv6:2a03:9800:20:1::2]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6467A120BFB for ; Wed, 21 Aug 2019 10:05:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=portfast.net; s=dkim; h=Content-Transfer-Encoding:Content-Type:In-Reply-To: MIME-Version:Date:Message-ID:From:References:Cc:To:Subject:Sender:Reply-To: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=pUFFnNj0W9NGb61BwwfnLLVYxsbPgCcWc0usPkPf3rc=; b=JkND0XC8jUY6FyueqPwNlbEOuT 5BsUDl+S3JO+aMqpDx/uAXf0YUrDEXLi8KljraReClrwZkrEAyIankGIORJwNvm3OIrzh3LbpQnm+ LsOYlfWhhg04nP0NIWTu7gQ9WD9vjaYGTSJnoZjdQTdfgI6BA8wiibFWltJLmnqT+lSo=; Received: from [88.212.170.135] (port=58147 helo=Rays-MacBook-Pro.local) by mail.portfast.net ([188.246.200.9]:465) with esmtpsa (fixed_plain:ray@bellis.me.uk) (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) id 1i0U2r-00012K-L5 (Exim 4.89) (return-path ); Wed, 21 Aug 2019 17:05:13 +0000 To: Eric Rescorla Cc: ADD Mailing list References: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> From: Ray Bellis Message-ID: Date: Wed, 21 Aug 2019 18:05:13 +0100 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-GB Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [Add] What to do in this potential working group X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Aug 2019 17:05:17 -0000 On 21/08/2019 18:01, Eric Rescorla wrote: > Indeed: this is what I was referring to when I said "ways to minimize > centralization". Specifically, ISPs could commit to strong privacy > policies and join our TRR program. Or Mozilla could embrace DNSSEC and DoT thereby encouraging their deployment for the benefit of all internet users... Ray From nobody Wed Aug 21 10:15:39 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6CC2A120BFE for ; Wed, 21 Aug 2019 10:15:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 61Gv534Dz4uU for ; Wed, 21 Aug 2019 10:15:36 -0700 (PDT) Received: from mail-lj1-x22d.google.com (mail-lj1-x22d.google.com [IPv6:2a00:1450:4864:20::22d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8DBFE1201DC for ; Wed, 21 Aug 2019 10:15:35 -0700 (PDT) Received: by mail-lj1-x22d.google.com with SMTP id h15so2846599ljg.10 for ; Wed, 21 Aug 2019 10:15:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=9/NeqI6tpbl66gNdIykKM6B7FgM7mGqbwuCGYWe+cYs=; b=2Fwirh2jb005Mx/BFMudUknNNrts8XWFgG6Fja/MVIO+j+4ZvDdoKwpZEBcD2DBRtG /eQCZznDklPKPyqJzVa071eBxgg2Q86xThI+AunjzXV9+ZBWtpLIiFq8rl08B4as1C4h 1h9Rfo3gPTedmz1ypMPw1+b3tsVfSyNqivEaEyZ9iOyXx1L9Tl1+8wQoqWrS1J2SviFY jTBu12lD05GvmEPoQ/J+BuoG8A6ln9sJassuMdW/GP17DWRbn4/i7zFPKKopkrJwuWKm T9r1cfWLeU/5D+rCTjr0ZMAiK77OBopJZiwTvc0usrqpvFEY8jKhF4VAhHOFcZEfM/Gi o8rw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=9/NeqI6tpbl66gNdIykKM6B7FgM7mGqbwuCGYWe+cYs=; b=WbL1T3C2l0QkI3ITY9VcI+MhZ7dAewjZfHZb1ELsnv0aSxqVo5O43XE3bSXC2oiJyE sjRjBJLGpA8rwbMONgar7NmyegFfKWu2Qelb8GHY02WZ7fnTDdYVez1hmpCFZzgJ+kEO BzF7Vy+Ed8iUiO9qHLT8ZaZhLqm6qd/BLBCE0RnPwINp5Zsw3k33D73iE1v/Te17kmrt hDoFQtFyj6GFJ9KHiaJ2DtYsj3s28O3hcLYun3gECCTgN5h3L1wD/goHle1+SA1t0V29 7gpdn/hfUiwEJBLCBQsgeM06porQmCGMA2+zfJQSIkwFY3buHfvOgbWHQSW6+nP3vuI/ Yx6Q== X-Gm-Message-State: APjAAAU95mv1wL1ZwWrc8RTkLTpCs7q/oD5Af8u7p4i1x9SOgTps5BLV jAfrEAsjKfLJm/uGteKUjPD5ojQrehD8t93Jx3DCSg== X-Google-Smtp-Source: APXvYqwC5F9UjyX2PijBFcs2O1/aUurHXowzwicvNikIU+DJ7mHwEyNNb7I2cNFpy2H/J0kpZpbMNHDu38Ptr37tItQ= X-Received: by 2002:a2e:5c43:: with SMTP id q64mr6661902ljb.14.1566407733764; Wed, 21 Aug 2019 10:15:33 -0700 (PDT) MIME-Version: 1.0 References: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> In-Reply-To: From: Eric Rescorla Date: Wed, 21 Aug 2019 18:14:57 +0100 Message-ID: To: Ray Bellis Cc: ADD Mailing list Content-Type: multipart/alternative; boundary="0000000000008b767e0590a3b8f6" Archived-At: Subject: Re: [Add] What to do in this potential working group X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Aug 2019 17:15:38 -0000 --0000000000008b767e0590a3b8f6 Content-Type: text/plain; charset="UTF-8" On Wed, Aug 21, 2019 at 6:05 PM Ray Bellis wrote: > > > On 21/08/2019 18:01, Eric Rescorla wrote: > > > Indeed: this is what I was referring to when I said "ways to minimize > > centralization". Specifically, ISPs could commit to strong privacy > > policies and join our TRR program. > > Or Mozilla could embrace DNSSEC and DoT thereby encouraging their > deployment for the benefit of all internet users... > I feel like everything meaningful to be said about DNSSEC has already been said, so I'll spare people that. The issue isn't DoH versus DoT. but rather having a connection with an authenticated resolver with defined privacy policies. DoT (or for that matter DoH) to an arbitrary network-provided resolver doesn't provide that. Ekr > Ray > > --0000000000008b767e0590a3b8f6 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Wed, Aug 21, 2019 at 6:05 PM Ray B= ellis <ray@bellis.me.uk> wrot= e:


On 21/08/2019 18:01, Eric Rescorla wrote:

> Indeed: this is what I was referring to when I said "ways to mini= mize
> centralization". Specifically, ISPs could commit to strong privac= y
> policies and join our TRR program.

Or Mozilla could embrace DNSSEC and DoT thereby encouraging their
deployment for the benefit of all internet users...
I feel like everything meaningful to be said about DNSSEC has = already been said, so I'll spare people that.

The issue isn't DoH v= ersus DoT. but rather having a connection with an authenticated resolver wi= th defined privacy policies. DoT (or for that matter DoH) to an arbitrary n= etwork-provided resolver doesn't provide that.

Ekr


Ray

--0000000000008b767e0590a3b8f6-- From nobody Wed Aug 21 10:37:10 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7CFE0120D8B for ; Wed, 21 Aug 2019 10:37:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ok9giolIGXTX for ; Wed, 21 Aug 2019 10:37:05 -0700 (PDT) Received: from mail-io1-xd2d.google.com (mail-io1-xd2d.google.com [IPv6:2607:f8b0:4864:20::d2d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 65A21120D87 for ; Wed, 21 Aug 2019 10:37:05 -0700 (PDT) Received: by mail-io1-xd2d.google.com with SMTP id t6so6237553ios.7 for ; Wed, 21 Aug 2019 10:37:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=CHrKloXMIS8nIXHOKcaLNjoasN7sqGuZTNc6ipZhB8A=; b=chaQG77k0AixouhDoCB2tp630gZU2DWFeEkIn2FlublxL2olo5hW0jtLKHsF5FgehO +mV8c8r6LHX9Wdi0cpY3dsAoe+rA2UIqYEuAeCcCXOUYT4JSpOFKZcg3Hwa/s+WsNK9j tokH7yOvcuQJLwouTV0HrWkaXexIkckUSkD3S+ytcGvLH93XBgK8ErgUkB2jE50LURmS iC+QFhw8HgaDT9UAM8XRo1qKJotI6dxHxqLcY3knku9qRaoPOi8kY3X+SdWB59cdTnIX dqLVF2nAYmHsfrXlQCRm73p840ixxA6dweklFDMPHbKXJEQMcVu3TTsejcPWMQIpRlpV xVTQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=CHrKloXMIS8nIXHOKcaLNjoasN7sqGuZTNc6ipZhB8A=; b=cPqXBmL0f010YPcpn7X/EEwvuEmaQ6kvYqH0DTvf3TBD5hcJ4npExzRdN1YlD4oZbO ycodwfriCAnTMsGc5ioQXzVwflkdjOBxWe9rLheRRxEKpLmX4COsQWc7meeAF06TOgsW xfW/F98NXd8MfpBtcAFALHkz30EVYJWD7YMS2RGe71MaoheyP/RxUFjoiG7ODIBQqjma YzcftyRRo5yi5DIo6uqv91V8uZWWugBXtdLjJmfAf4h9vkF8tU2qNPFHlYnd2AuoUQw5 Aprwd8C8ss3wbMiaNB+9Z+nC6m/7fqsqfoxr3uraDMmE7obCNWLcRXxyzdEtzTZc75tn nYoA== X-Gm-Message-State: APjAAAWRu844Sp3j7yKz9cF63pluGfKvqy8rKbHxNkN6kT/Fm2qlMm8A Ltocuibc9YzBKDvLReeM7Vwtdb5DEmx6jJ3HlKoPrg== X-Google-Smtp-Source: APXvYqwgdYbaO0hyWHqQ8+9tjg++neYmlpRfVOf/iBHEZCoqG9V9hl1vm9R/glVSoSLbSMF3yRjPQFNC2md07SRb9/E= X-Received: by 2002:a5e:c911:: with SMTP id z17mr10439367iol.119.1566409024254; Wed, 21 Aug 2019 10:37:04 -0700 (PDT) MIME-Version: 1.0 References: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> In-Reply-To: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> From: Ted Hardie Date: Wed, 21 Aug 2019 10:36:38 -0700 Message-ID: To: Jari Arkko Cc: Eric Rescorla , ADD Mailing list Content-Type: multipart/alternative; boundary="00000000000076bb8b0590a405a9" Archived-At: Subject: Re: [Add] What to do in this potential working group X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Aug 2019 17:37:07 -0000 --00000000000076bb8b0590a405a9 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi Jari, I'd like to slightly re-cast your point and see if you still agree. If so, I think I understand better what the working group might do. If not, the discussion may help me personally understand your point. I think there are several possible threat models here. The basic threat model that DoT and DoH respond to is lack of confidentiality from observers on the path. That is addressed if the selected resolver implements DoT or DoH and is reachable to the client.* The second threat model is that a resolver may provide an untrustworthy answer (e.g. captive portal). The use of DoT and DoH can help with this if the client device, application, or user selects a trustworthy resolver** and uses the TLS certificate to verify they have reached that service. The third threat model is that the use of a single large common recursive resolver mitigates against attacks which track resolution events at the authoritative servers (since there are common cached replies), but results in that large common recursive becoming an attractive target for unsavory business practices, court orders, and infiltration attacks. Because of browser fingerprinting techniques the available information may be larger for DoH than it would be for other clients. Your concern is that using DoH as a response to the first and second attacks is increasing the risks related to the third. Is that approximately correct? If so, I think there are practices that we might develop and recommend (e.g. selectively sending queries to different trusted resolvers) and some of those may also touch on the split DNS issue. My modest experience in this realm suggests, though, that experiments are the only thing that would tell you the impact of those practices on latency, correctness, and leakage. So I'd want some indication that folks are willing to run those experiments before taking on that work. regards, Ted (as an individual) *DoH was suggested in part because DoT was commonly getting blocked; I don't have fresh data, though, on whether this is still the case. **For whatever value of trustworthy is assigned; this point doesn't rely on a definition of that being common. On Wed, Aug 21, 2019 at 3:55 AM Jari Arkko wrote: > Ekr, > > I fully realise that there will be differences of viewpoints when it come= s > to the trustworthiness of individual DNS service providers. > > But I was trying to make a different point. While we may disagree which > provider I=E2=80=99d like to use for the DNS service, I think it would be= quite > reasonable for us to agree that if all of us put our all our queries in o= ne > place (whatever that is) that this causes severe problems: > > - That place becomes immensely valuable from a commercial data mining > perspective. There=E2=80=99s a risk that it will at least at some point b= e used for > data mining, despite whatever the intentions of the people who set this > system up now is. > > - That place becomes immensely interesting to for governments to tap. > There=E2=80=99s a risk that this tapping is either already happening or w= ill be > happening going forward, despite best intentions of the people who set it > up or who manage it. > > - That places becomes critical infrastructure and a weak point that we do > not need in the Internet. > > As a result, I would like to suggest that the IETF actually concludes the > above and recommends against this practice. > > For whatever it is worth, I can understand some motivations for doing > something like this e.g. in browsers. Some good reasons and potentially > also some not so good reasons. But even with that background, it is > difficult for me to imagine a worse act for the Internet than making > browsers call home for every action of the user. The privacy impacts for > the users are unimaginably bad. > > A few years ago we realised that surveillance organisations were looking > at people's traffic, and we managed to change the Internet to protect thi= s > traffic with cryptographic means. I think it is to think about the next > step, and ensure that we don=E2=80=99t create an Internet architecture th= at puts > everyone=E2=80=99s data at central location. > > Obviously, encrypted DNS is still hugely important, as are global DNS > services. However, the deployment model of using one (or a small number o= f) > providers is just wrong. That would be fixable. > > Jari > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --00000000000076bb8b0590a405a9 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi Jari,

I'd like to sli= ghtly re-cast your point and see if you still agree.=C2=A0 If so, I think I= understand better what the working group might do.=C2=A0 If not, the discu= ssion may help me personally understand your point.

I think there are several possible threat models here.=C2=A0

The basic threat model that DoT and DoH respond to is lac= k of confidentiality from observers on the path.=C2=A0 That is addressed if= the selected resolver implements DoT or DoH and is reachable to the client= .*

The second threat model is that a resolver may = provide an untrustworthy answer (e.g. captive portal). The use of DoT and D= oH can help with this if the client device, application, or user selects a = trustworthy resolver** and uses the TLS certificate to verify they have rea= ched that service.

The third threat model is that = the use of a single large common recursive resolver mitigates against attac= ks which track resolution events at the authoritative servers (since there = are common cached replies), but results in that large common recursive beco= ming an attractive target for unsavory business practices, court orders, an= d infiltration attacks.=C2=A0 Because of browser fingerprinting techniques = the available information may be larger for DoH than it would be for other = clients.

Your concern is that using DoH as a r= esponse to the first and second attacks is increasing the risks related to = the third.=C2=A0 Is that approximately correct?

If= so, I think there are practices that we might develop and recommend (e.g. = selectively sending queries to different trusted resolvers) and some of tho= se may also touch on the split DNS issue.=C2=A0 My modest experience in thi= s realm suggests, though, that experiments are the only thing that would te= ll you the impact of those practices on latency, correctness, and leakage.= =C2=A0 So I'd want some indication that folks are willing to run those = experiments before taking on that work.

regard= s,

Ted (as an individual)

=
*DoH was suggested in part because DoT was commonly getting blocked; I= don't have fresh data, though, on whether this is still the case.
**For whatever value of trustworthy is assigned; this point doesn'= ;t rely on a definition of that being common.

On Wed, Aug 21, 2019= at 3:55 AM Jari Arkko <jari.ark= ko@piuha.net> wrote:
Ekr,

I fully realise that there will be differences of viewpoints when it comes = to the trustworthiness of individual DNS service providers.

But I was trying to make a different point. While we may disagree which pro= vider I=E2=80=99d like to use for the DNS service, I think it would be quit= e reasonable for us to agree that if all of us put our all our queries in o= ne place (whatever that is) that this causes severe problems:

- That place becomes immensely valuable from a commercial data mining persp= ective. There=E2=80=99s a risk that it will at least at some point be used = for data mining, despite whatever the intentions of the people who set this= system up now is.

- That place becomes immensely interesting to for governments to tap. There= =E2=80=99s a risk that this tapping is either already happening or will be = happening going forward, despite best intentions of the people who set it u= p or who manage it.

- That places becomes critical infrastructure and a weak point that we do n= ot need in the Internet.

As a result, I would like to suggest that the IETF actually concludes the a= bove and recommends against this practice.

For whatever it is worth, I can understand some motivations for doing somet= hing like this e.g. in browsers. Some good reasons and potentially also som= e not so good reasons. But even with that background, it is difficult for m= e to imagine a worse act for the Internet than making browsers call home fo= r every action of the user. The privacy impacts for the users are unimagina= bly bad.

A few years ago we realised that surveillance organisations were looking at= people's traffic, and we managed to change the Internet to protect thi= s traffic with cryptographic means. I think it is to think about the next s= tep, and ensure that we don=E2=80=99t create an Internet architecture that = puts everyone=E2=80=99s data at central location.

Obviously, encrypted DNS is still hugely important, as are global DNS servi= ces. However, the deployment model of using one (or a small number of) prov= iders is just wrong. That would be fixable.

Jari

--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--00000000000076bb8b0590a405a9-- From nobody Wed Aug 21 10:44:03 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 72E24120D5D for ; Wed, 21 Aug 2019 10:44:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VqrbXuiyGthe for ; Wed, 21 Aug 2019 10:44:00 -0700 (PDT) Received: from ppa4.dc.icann.org (ppa4.dc.icann.org [192.0.46.77]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 10BA612013B for ; Wed, 21 Aug 2019 10:43:59 -0700 (PDT) Received: from PFE112-CA-1.pexch112.icann.org (out.west.pexch112.icann.org [64.78.40.7]) by ppa4.dc.icann.org (8.16.0.27/8.16.0.27) with ESMTPS id x7LHhvt1019376 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT); Wed, 21 Aug 2019 17:43:58 GMT Received: from PMBX112-W1-CA-1.pexch112.icann.org (64.78.40.21) by PMBX112-W1-CA-1.pexch112.icann.org (64.78.40.21) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Wed, 21 Aug 2019 10:43:55 -0700 Received: from PMBX112-W1-CA-1.pexch112.icann.org ([64.78.40.21]) by PMBX112-W1-CA-1.PEXCH112.ICANN.ORG ([64.78.40.21]) with mapi id 15.00.1473.005; Wed, 21 Aug 2019 10:43:55 -0700 From: Paul Hoffman To: "Smith, Kevin, Vodafone Group" CC: "add@ietf.org" Thread-Topic: [Ext] [Add] Participation Thread-Index: AQHVWEgAKJzILE5ZaUCvX2tOj2WyOQ== Date: Wed, 21 Aug 2019 17:43:54 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [192.0.32.234] x-source-routing-agent: Processed Content-Type: text/plain; charset="us-ascii" Content-ID: <8E4864E2AF5DEB47B5073287D87645D2@pexch112.icann.org> Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-08-21_06:, , signatures=0 Archived-At: Subject: Re: [Add] [Ext] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Aug 2019 17:44:01 -0000 Thank you for the very clear update on this. The topic was starting to caus= e a lot of concern across the network. --Paul Hoffman On Aug 21, 2019, at 9:49 AM, Smith, Kevin, Vodafone Group wrote: >=20 > Hello all, >=20 > I've confirmed with Vodafone UK's network and home broadband teams that t= hey do not perform HTTPS interception/Man in the Middle. >=20 > The imgur issue is the result of DNS 53-based filtering. The error appear= s that the Vodafone root certificate (used to secure the user's configurati= on channel to the home router) was also used when the request was redirecte= d to the secure 'warning page' at the network proxy, apparently causing th= e browser to prompt 'add certificate to exception list'. The imgur issue wa= s from January, the fix has been rolled out and I'm told that this certific= ate error should not happen anymore. >=20 > The NordVPN issue appears to be a user with content controls enabled at t= he router, which as I understand it may block certain VPNs based on DNS 53.= I suspect they would simply disable the content controls to solve this. >=20 > So to confirm: no HTTPS interception/Man in the Middle in Vodafone UK. >=20 > All best, > Kevin >=20 > Mr Kevin Smith > Vodafone Group R&D >=20 >=20 >=20 > C2 General From nobody Wed Aug 21 10:52:50 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A4912120E05 for ; Wed, 21 Aug 2019 10:52:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.299 X-Spam-Level: X-Spam-Status: No, score=-4.299 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id h6tzb2U9IQcm for ; Wed, 21 Aug 2019 10:52:45 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6E613120E09 for ; Wed, 21 Aug 2019 10:52:41 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id D73F7BE5B; Wed, 21 Aug 2019 18:52:39 +0100 (IST) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie X-Amavis-Alert: BAD HEADER SECTION, Improper folded header field made up entirely of whitespace (char 20 hex): References: ...51F1E-7E9A-4B16-81B7-42AFD2655437@icann.org> Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rzr7xmLY7cLd; Wed, 21 Aug 2019 18:52:38 +0100 (IST) Received: from [10.244.2.235] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 21AD6BE58; Wed, 21 Aug 2019 18:52:38 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1566409958; bh=OZK3EXC1RvBSx9wu9muzYBYrFOEtJr3hEd6fzaBde10=; h=To:Cc:From:Subject:In-Reply-To:References:Date:From; b=bGh4DJPeZD1GElGyNPkLnftClfauPI+Hqz+KfU0CisV5GVEY+/VqG5M3hBRNy0vhI fpIi90N8ICWPY5Nb25NW9OMHoqwQ/rcLiKKUUAQgqqya26hFuxw1F7cUGKIckbWD7c Y3r03y8xX/e9v1t8QVfh0NhMMUJHArWTq6CnPONo= X-Priority: 3 To: paul.hoffman@icann.org Cc: add@ietf.org,Kevin.Smith@vodafone.com From: stephen.farrell@cs.tcd.ie In-Reply-To: References: Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: base64 Date: Wed, 21 Aug 2019 17:52:37 +0000 Message-ID: MIME-Version: 1.0 Archived-At: Subject: Re: [Add] [Ext] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Aug 2019 17:52:48 -0000 DQoNCk9uIFdlZG5lc2RheSwgMjEgQXVndXN0IDIwMTksIFBhdWwgSG9mZm1hbiB3cm90ZToNCj4g VGhhbmsgeW91IGZvciB0aGUgdmVyeSBjbGVhciB1cGRhdGUgb24gdGhpcy4NCg0KKzENCg0KUy4N Cg0KPiBUaGUgdG9waWMgd2FzIHN0YXJ0aW5nIHRvIGNhdXNlIGEgbG90IG9mIGNvbmNlcm4gYWNy b3NzIHRoZSBuZXR3b3JrLg0KPiANCj4gLS1QYXVsIEhvZmZtYW4NCj4gDQo+IE9uIEF1ZyAyMSwg MjAxOSwgYXQgOTo0OSBBTSwgU21pdGgsIEtldmluLCBWb2RhZm9uZSBHcm91cCA8S2V2aW4uU21p dGhAdm9kYWZvbmUuY29tPiB3cm90ZToNCj4gPiANCj4gPiBIZWxsbyBhbGwsDQo+ID4gDQo+ID4g SSd2ZSBjb25maXJtZWQgd2l0aCBWb2RhZm9uZSBVSydzIG5ldHdvcmsgYW5kIGhvbWUgYnJvYWRi YW5kIHRlYW1zIHRoYXQgdGhleSBkbyBub3QgcGVyZm9ybSBIVFRQUyBpbnRlcmNlcHRpb24vTWFu IGluIHRoZSBNaWRkbGUuDQo+ID4gDQo+ID4gVGhlIGltZ3VyIGlzc3VlIGlzIHRoZSByZXN1bHQg b2YgRE5TIDUzLWJhc2VkIGZpbHRlcmluZy4gVGhlIGVycm9yIGFwcGVhcnMgdGhhdCB0aGUgVm9k YWZvbmUgcm9vdCBjZXJ0aWZpY2F0ZSAodXNlZCB0byBzZWN1cmUgdGhlIHVzZXIncyBjb25maWd1 cmF0aW9uIGNoYW5uZWwgdG8gdGhlIGhvbWUgcm91dGVyKSB3YXMgYWxzbyB1c2VkIHdoZW4gdGhl IHJlcXVlc3Qgd2FzIHJlZGlyZWN0ZWQgdG8gdGhlIHNlY3VyZSAnd2FybmluZyBwYWdlJyAgYXQg dGhlIG5ldHdvcmsgcHJveHksIGFwcGFyZW50bHkgY2F1c2luZyB0aGUgYnJvd3NlciB0byBwcm9t cHQgJ2FkZCBjZXJ0aWZpY2F0ZSB0byBleGNlcHRpb24gbGlzdCcuIFRoZSBpbWd1ciBpc3N1ZSB3 YXMgZnJvbSBKYW51YXJ5LCB0aGUgZml4IGhhcyBiZWVuIHJvbGxlZCBvdXQgYW5kIEknbSB0b2xk IHRoYXQgdGhpcyBjZXJ0aWZpY2F0ZSBlcnJvciBzaG91bGQgbm90IGhhcHBlbiBhbnltb3JlLg0K PiA+IA0KPiA+IFRoZSBOb3JkVlBOIGlzc3VlIGFwcGVhcnMgdG8gYmUgYSB1c2VyIHdpdGggY29u dGVudCBjb250cm9scyBlbmFibGVkIGF0IHRoZSByb3V0ZXIsIHdoaWNoIGFzIEkgdW5kZXJzdGFu ZCBpdCBtYXkgYmxvY2sgY2VydGFpbiBWUE5zIGJhc2VkIG9uIEROUyA1My4gSSBzdXNwZWN0IHRo ZXkgd291bGQgc2ltcGx5IGRpc2FibGUgdGhlIGNvbnRlbnQgY29udHJvbHMgdG8gc29sdmUgdGhp cy4NCj4gPiANCj4gPiBTbyB0byBjb25maXJtOiBubyBIVFRQUyBpbnRlcmNlcHRpb24vTWFuIGlu IHRoZSBNaWRkbGUgaW4gVm9kYWZvbmUgVUsuDQo+ID4gDQo+ID4gQWxsIGJlc3QsDQo+ID4gS2V2 aW4NCj4gPiANCj4gPiBNciBLZXZpbiBTbWl0aA0KPiA+IFZvZGFmb25lIEdyb3VwIFImRA0KPiA+ IA0KPiA+IA0KPiA+IA0KPiA+IEMyIEdlbmVyYWwNCj4gDQo+IA0KPiAtLSANCj4gQWRkIG1haWxp bmcgbGlzdA0KPiBBZGRAaWV0Zi5vcmcNCj4gaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9s aXN0aW5mby9hZGQNCj4= From nobody Wed Aug 21 10:59:41 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D3C6112011F for ; Wed, 21 Aug 2019 10:59:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=virtualized-org.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XBlfzz1M-bfY for ; Wed, 21 Aug 2019 10:59:37 -0700 (PDT) Received: from mail-pf1-x42b.google.com (mail-pf1-x42b.google.com [IPv6:2607:f8b0:4864:20::42b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 97A2512008C for ; Wed, 21 Aug 2019 10:59:37 -0700 (PDT) Received: by mail-pf1-x42b.google.com with SMTP id q139so1900524pfc.13 for ; Wed, 21 Aug 2019 10:59:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtualized-org.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc:message-id:references :to; bh=XOllIL6fBhd7S0ySrxBIK/qf4XuA+Z6K/4RzCWYwh9A=; b=JCvByoBIy2NwxskzUGjNAaGRMY5ZpgJyKPVqUIGFPsaftD9ZY4YtvcqIH9I/j6FyIK MJkmMV/jVqZJekOnF5A2AqI07h6cRtt2YYsefl8+hpV1ExU4ls+sfQ39laqwUxLlUc0n hA2ifqGv2IBuSOkik7qBYm+dCPZheGSKbg36a8RucDqHnqCAFY0EulmNqvvl2r8nAzAp hmdeXE/VqLVaOqo2DA4/jaqr0TqRrCPg3RClRqKrx5RdyNdvgnq7bmddWi6Xa6bMa0fc lOlKLBtAVmy+bXGKuEx6ZkvRl4BqzYWRhCdq21LpsblY3nHBa+M3xtr68B+PIhQ20qqq 89lg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :message-id:references:to; bh=XOllIL6fBhd7S0ySrxBIK/qf4XuA+Z6K/4RzCWYwh9A=; b=uk7tzzafXoaZzWWM/1Hndq8QUEZHUtoiIGcaK/xDu4EVE7PX5rzr77eZeaedrVAXKv djeGi0bgeD8Dm5sqGHHwkYlEe58X/hF9Ji/2ihZbsMMabArTcZQNzCUnnoy69znk32b4 59hL3xmRAhB8SBjFKW3X6jCTUgHb2J+Yw+tke+miVEUR7cdFH1N+XKKy1ED/NMjzzEy/ jd8TFITALk5Tv99NhpRZoRbi2qVj7QWzfkUkdewjTv7aYpZr65Fwku4PEEX7jVXtLDGT olFtUPJbW8jCOusFT0trgZGYMtR681kdQiS53rGLQyg03DhjQhQKyrJiMWONViC7sSmT A+yA== X-Gm-Message-State: APjAAAUw69Gx9uyJ0EacTVhk9AfGR9gIQgZd6EMF1udSLUa6ns9BRWUS 3CHpFlecv3ISEwKEk7GMv7NHBg== X-Google-Smtp-Source: APXvYqx1CvPsPV0rSqHJhmg1/rFRKWCir2AWKmYAEJw9GWOyBelK+RccaAVR0pPiY6cUgoR0MZaUfQ== X-Received: by 2002:a17:90a:342d:: with SMTP id o42mr1225880pjb.27.1566410376619; Wed, 21 Aug 2019 10:59:36 -0700 (PDT) Received: from ?IPv6:2620::2d0:110:a001:9cbc:6eb4:c2df? ([2620:0:2d0:110:a001:9cbc:6eb4:c2df]) by smtp.gmail.com with ESMTPSA id f27sm21399583pgm.60.2019.08.21.10.59.35 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 21 Aug 2019 10:59:35 -0700 (PDT) Content-Type: multipart/signed; boundary="Apple-Mail=_B0C81A3F-58D0-4598-95E7-38F6704A2A1B"; protocol="application/pgp-signature"; micalg=pgp-sha512 Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) From: David Conrad In-Reply-To: Date: Wed, 21 Aug 2019 10:59:34 -0700 Cc: ADD Mailing list X-Mailbutler-Message-Id: A169F2F5-EB78-4F2B-A272-306C2013190B Message-Id: References: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> To: Ted Hardie X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] What to do in this potential working group X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Aug 2019 17:59:40 -0000 --Apple-Mail=_B0C81A3F-58D0-4598-95E7-38F6704A2A1B Content-Type: multipart/alternative; boundary="Apple-Mail=_FB452C94-A9FB-4007-B360-18CBBCB3F43E" --Apple-Mail=_FB452C94-A9FB-4007-B360-18CBBCB3F43E Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Ted, Not Jari, but wanted to point out one thing: On Aug 21, 2019, at 10:36 AM, Ted Hardie wrote: > The second threat model is that a resolver may provide an = untrustworthy answer (e.g. captive portal). The use of DoT and DoH can = help with this if the client device, application, or user selects a = trustworthy resolver** and uses the TLS certificate to verify they have = reached that service. You probably need to define =E2=80=9Ctrustworthy answer=E2=80=9D here. = Traditionally, a =E2=80=9Ctrustworthy answer=E2=80=9D was the data = originally supplied by the zone owner of the domain being looked up. = DNSSEC was created to ensure this. However, network operators (e.g., = CDNs) playing =E2=80=9Cstupid DNS tricks=E2=80=9D, resolver operators = providing filtering, etc. may have changed what is a =E2=80=9Ctrustworthy = answer=E2=80=9D over the years. With that said, and assuming you=E2=80=99re using the traditional = interpretation of =E2=80=9Ctrustworthy answer=E2=80=9D, then DoT/DoH do = not ensure a =E2=80=9Ctrustworthy answer.=E2=80=9D DoT/DoH provide = transport protection. The only way to truly ensure a trustworthy answer = is to protect the actual answer. Which is what DNSSEC does. Regards, -drc (Speaking only for myself) --Apple-Mail=_FB452C94-A9FB-4007-B360-18CBBCB3F43E Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Ted,

Not Jari, = but wanted to point out one thing:

On = Aug 21, 2019, at 10:36 AM, Ted Hardie <ted.ietf@gmail.com> = wrote:
The second threat model = is that a resolver may provide an untrustworthy answer (e.g. captive = portal). The use of DoT and DoH can help with this if the client device, = application, or user selects a trustworthy resolver** and uses the TLS = certificate to verify they have reached that = service.

You = probably need to define =E2=80=9Ctrustworthy answer=E2=80=9D here. =  Traditionally, a =E2=80=9Ctrustworthy answer=E2=80=9D was the data = originally supplied by the zone owner of the domain being looked up. = DNSSEC was created to ensure this. However, network operators (e.g., = CDNs) playing =E2=80=9Cstupid DNS tricks=E2=80=9D, resolver operators = providing filtering, etc. may have changed what is a =E2=80=9Ctrustworthy = answer=E2=80=9D over the years.

With = that said, and assuming you=E2=80=99re using the traditional = interpretation of =E2=80=9Ctrustworthy answer=E2=80=9D, then DoT/DoH do = not ensure a =E2=80=9Ctrustworthy answer.=E2=80=9D DoT/DoH provide = transport protection. The only way to truly ensure a trustworthy answer = is to protect the actual answer. Which is what DNSSEC = does.

Regards,
-drc
(Speaking only for = myself)

= --Apple-Mail=_FB452C94-A9FB-4007-B360-18CBBCB3F43E-- --Apple-Mail=_B0C81A3F-58D0-4598-95E7-38F6704A2A1B Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEzEaOGlQw4bcyWBNfoCss/bh3zPcFAl1dhoYACgkQoCss/bh3 zPf6pA//ThT6HLFDX/MTfQZkcigYBjwCUqoCHh2g0YGKHuQFUvPz/w8/88Wrw1vJ tjTYtBpXVA/TAhMl89jA71bqX+3oIfSgHS8o/8yEXx6u2GLJpAPA9RpQS9+SYZoj 2GAfKHVOXpXfjjVKq5YoRt03GtPtJjMCXilFoNd0tXYzeTt8JOu4RTYJdqyUEwts zPN9mo1JDaQkdxS4sK5mmBRsaHFlY7MOEuaSu/MJWKtpmQSMRTfAwyNasPRRfU1z if91HiiVQFGcxlE3Yht5hgef1HLsH4IX9au6Hn30u+xY/QsjNDGarpnOLipszO5m Gh/kHfRNFPtVRRK9SMrthvuLbYhfyF/Cxl1JrV3Fc0Geu9o8gmwyYgruZYYxlBd5 L09iO51H5bhxEuPvM5Bjsbzd1bIIGnil2azqAx9nI0/3ZMjleiSPkfG7zJaclJwn XzLZCyLEreRLFS2MPsDcpDfd1Qw5W+tJBrdRP0A8pGAfmQP0LQ7YAVtW6hz8PgKM XPpykGcfS85yUY5oDBBgwv6Y0zFm97PLhHdAW1BcEn0O8Kfw2/M4BwaEgZYRf8L7 XPAeJ+JJ6p9kehy2QzknhctZ+WSI6nN1J2fo7B9aprGbiZIzl9kYI4c8s6+AlxgF mKwu4XH3PaIZ4iowKXv4tG+uuB1xR9/5x0UiOqMr8HQBviDimq4= =5L4h -----END PGP SIGNATURE----- --Apple-Mail=_B0C81A3F-58D0-4598-95E7-38F6704A2A1B-- From nobody Wed Aug 21 11:06:32 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 70C77120CD8 for ; Wed, 21 Aug 2019 11:06:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 38iH9dk4CbNk for ; Wed, 21 Aug 2019 11:06:29 -0700 (PDT) Received: from mail-yw1-xc29.google.com (mail-yw1-xc29.google.com [IPv6:2607:f8b0:4864:20::c29]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E89C9120850 for ; Wed, 21 Aug 2019 11:06:28 -0700 (PDT) Received: by mail-yw1-xc29.google.com with SMTP id n69so1265264ywd.12 for ; Wed, 21 Aug 2019 11:06:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=vKHeKWKbJ4z8bLhyhoyCNk43p6CoexmJieAsxGK2vMk=; b=iIexh16kAIjkYpydmPMiwfyhRuVyBaXkiplGNfMfuzgl1SDRMfmqLVUIQ5/+t/CzzT YFsqHR59Lp5cL7dLRG2c6VjJElju3acMLkxbzUKsmsRG4GldJcyxDADGGzQO1pugwV4c xn7uJa2vg5kPoD/u7xptcbCsec19dQIuDjfvsfymqOL5SrBG76IM54b1Z44u4w3+6hrM 491Hfuk7htG+vMQ4tkbIeLcN9LO+7Jy6gK3fYyO68XA27abNuUbB1NlNWN5c+G44fCc3 g/x1Xp6LSSYrt4tT96HaeEy+mT7hGhiXPVBLyHbjhJEHX8fM9ZhojgYRuxFaXmlD3G68 gKyg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=vKHeKWKbJ4z8bLhyhoyCNk43p6CoexmJieAsxGK2vMk=; b=pp8uj8kQscIr92xWDQef0oM4h5iUNPGyS06Ma8Wse9MsTMEuE0Abc6d4bxG2GDMUe0 /unWHrQn0Rjg/IOlAfRb0fC/Co6xYZT6FSxRzeNx8boWEeovTNP/623iu/AkFGpYrLLi OUkboakz7ag359Kj25oJg45r+1KzkG1Kb3FjWZWTNCUhpPJPV76+DS1Y6kFL6YAjrQ23 jmYSfEs663vr7e0HPq4OQHnqhUg/0RpZT6fvrtQugbUn7TBubflnSj10r7dUxar1okLG ApL8KE+XrXQ83v3eAzZCDMyKCrmi97Z9lJoBdv/VWIOHuidSdKMMMBT8y6AuSou5p91E ytZw== X-Gm-Message-State: APjAAAUf74MEN2qoz4bzLE+xiXbO73AAJzlwWx5O4btr0eicIKYxpRCa uZgsrEF81q0ro0IoOceoNTmnwS13WXqy7Ffo5q0= X-Google-Smtp-Source: APXvYqz/bGMKtIaLzbOhoBN02kj+Zr9VrMFH8Iag741g0k24Xs1MMKRGMKqefh9T5e2vmTJhP9ymwk0lDiRrzleFQCo= X-Received: by 2002:a0d:e6cb:: with SMTP id p194mr25219209ywe.83.1566410787128; Wed, 21 Aug 2019 11:06:27 -0700 (PDT) MIME-Version: 1.0 References: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> In-Reply-To: From: Alec Muffett Date: Wed, 21 Aug 2019 19:06:17 +0100 Message-ID: To: David Conrad Cc: Ted Hardie , ADD Mailing list Content-Type: multipart/alternative; boundary="0000000000008a0cc20590a46e13" Archived-At: Subject: Re: [Add] What to do in this potential working group X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Aug 2019 18:06:30 -0000 --0000000000008a0cc20590a46e13 Content-Type: text/plain; charset="UTF-8" On Wed, 21 Aug 2019, 18:59 David Conrad, wrote: > The only way to truly ensure a trustworthy answer is to protect the actual > answer. Which is what DNSSEC does. > Fortunately we do not have to wait for DNSSEC in order to get answers from the people from whom we wish them supplied, privately and untampered-with, which is the whole point of DNS over HTTPS. -a --0000000000008a0cc20590a46e13 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


On Wed, 21 Aug 2019, 18:59 David Conrad, <= drc@virtualized.org> wrote:
The only way to truly ensure a trust= worthy answer is to protect the actual answer. Which is what DNSSEC does.

Fortunately we do not have to wait for DNSSEC in order to get answers= from the people from whom we wish them supplied, privately and untampered-= with, which is the whole point of DNS over HTTPS.
-a


--0000000000008a0cc20590a46e13-- From nobody Wed Aug 21 11:11:44 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C0AA0120DFA for ; Wed, 21 Aug 2019 11:11:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rsrI4zcJLKAL for ; Wed, 21 Aug 2019 11:11:39 -0700 (PDT) Received: from mail-io1-xd33.google.com (mail-io1-xd33.google.com [IPv6:2607:f8b0:4864:20::d33]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CF911120DE4 for ; Wed, 21 Aug 2019 11:11:39 -0700 (PDT) Received: by mail-io1-xd33.google.com with SMTP id j5so6437951ioj.8 for ; Wed, 21 Aug 2019 11:11:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=DZiD/P5JBTbLMI4X3crrdtM268caiEMYP2dwmW8e7qg=; b=OgGaHuab2n7DrR13KUEEhL/PHHQnpAp/4MdYR5QAwnhDy/hNmA/znnPaNFMvlvpKVa vY3mps/sJ21IKcNNdJJpIEDFvaVu1FWoUipqxOXLKO8JarbNkL0jNe3LNhDyLp5F1m1P PYTkKaju7xzOjC0b5F+CnVm5i5obEmEgrHhvtvz64CsW8d4Vz3f3OcguY+lBS5Gh7/CJ PhBJ4cEH3hNIhwgBdFVyxGRcaDPT9QsrJrtEiT9iozBxO8hlQgBtOX7SmWG3IYUwaz2u T7x58iEu5iw36KSRbpgOvC/63jP5teHGihSWHNFWaA6CXFnhP4siYM6IaETXUmHctj8D aA+w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=DZiD/P5JBTbLMI4X3crrdtM268caiEMYP2dwmW8e7qg=; b=jXaikxpHNRyLV3XP0F0fH27t8Vtf+SY6lsGoc4LUBU6g1xCtQZ7NsrMGLS0sLTaah+ hw/bm6S0s471h9NUeT7x7x1FCjmDM3AGHq7Ha9uvWC1B4CpkjoMDKU19INGGRri8vCjD 4qj5k5BsiGq+7FloM5V67sDkFQas3JAjIBjHU3YlHNCl2uj7jCrHQnUmGwD8dBuISuEm /GRJSKzvlNipscv1wA4Kxw0Y67pPFYjiSceqli5ruerGks1fXdnmZs/J/LZH7mAB9znL zVUGGyADMANkNeAPRnwxnUyaRlQq/9y4/hYmlzyiwetwgnl9h0fgQHycLF33ofy1JFrk 3vpw== X-Gm-Message-State: APjAAAUlXBXPBFtYVkC3utYQJMQ/m+RkoRJYUFRg0uacxGMaHCiBH9E2 jXxjglWOM3xaI0aPY897Bk4iEBln1kjAJiZoOHU= X-Google-Smtp-Source: APXvYqw2yuvE0uMNslxGmFIwVNe2TVo4NIIO8q4W46Kpk2RKqUpc56Mte1X08pUKlOf03NtgaeKpG23sKlKfBYwHBzU= X-Received: by 2002:a02:cc6c:: with SMTP id j12mr11103601jaq.29.1566411098855; Wed, 21 Aug 2019 11:11:38 -0700 (PDT) MIME-Version: 1.0 References: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> In-Reply-To: From: Ted Hardie Date: Wed, 21 Aug 2019 11:11:11 -0700 Message-ID: To: David Conrad Cc: ADD Mailing list Content-Type: multipart/alternative; boundary="0000000000001e9eb70590a481d1" Archived-At: Subject: Re: [Add] What to do in this potential working group X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Aug 2019 18:11:42 -0000 --0000000000001e9eb70590a481d1 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi David, On Wed, Aug 21, 2019 at 10:59 AM David Conrad wrote: > Ted, > > Not Jari, but wanted to point out one thing: > > On Aug 21, 2019, at 10:36 AM, Ted Hardie wrote: > > The second threat model is that a resolver may provide an untrustworthy > answer (e.g. captive portal). The use of DoT and DoH can help with this i= f > the client device, application, or user selects a trustworthy resolver** > and uses the TLS certificate to verify they have reached that service. > > > You probably need to define =E2=80=9Ctrustworthy answer=E2=80=9D here. > I tried to finesse that saying by saying it is up to the client to decide this. If there is an objective reality to "trustyworthy answer", though, I think "true to the data supplied by the zone maintainer" may still be it. I'm not sure there is, though, if you have any belief in the use of the DNS as a control surface. In the case of household using a DNS filtering service, the answer may be that the "trustyworthy" resolver provides the data supplied by the zone maintainer after the application of the filters to which the subscriber has agreed. > Traditionally, a =E2=80=9Ctrustworthy answer=E2=80=9D was the data origi= nally supplied by > the zone owner of the domain being looked up. DNSSEC was created to ensur= e > this. However, network operators (e.g., CDNs) playing =E2=80=9Cstupid DNS= tricks=E2=80=9D, > resolver operators providing filtering, etc. may have changed what is a > =E2=80=9Ctrustworthy answer=E2=80=9D over the years. > > With that said, and assuming you=E2=80=99re using the traditional interpr= etation > of =E2=80=9Ctrustworthy answer=E2=80=9D, then DoT/DoH do not ensure a =E2= =80=9Ctrustworthy answer.=E2=80=9D > DoT/DoH provide transport protection. The only way to truly ensure a > trustworthy answer is to protect the actual answer. Which is what DNSSEC > does. > > Evidently I was unclear, sorry. It doesn't assure you that the answer is trustworthy; it can assure you have reached the resolver that you intend. If you trust that resolver (for whatever value of trustworthy you have), that may help. Thanks for pointing out the lack of clarity, Ted (as an individual) > Regards, > -drc > (Speaking only for myself) > > --0000000000001e9eb70590a481d1 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi David,

On Wed, Aug 21, 2019 at 10:= 59 AM David Conrad <drc@virtualiz= ed.org> wrote:
Ted,

Not Jari, but wanted to point out one thing:

On A= ug 21, 2019, at 10:36 AM, Ted Hardie <ted.ietf@gmail.com> wrote:
The second threat model is that a resolver may provi= de an untrustworthy answer (e.g. captive portal). The use of DoT and DoH ca= n help with this if the client device, application, or user selects a trust= worthy resolver** and uses the TLS certificate to verify they have reached = that service.

You probabl= y need to define =E2=80=9Ctrustworthy answer=E2=80=9D here.

I tried to finesse that saying by sayin= g it is up to the client to decide this.=C2=A0 If there is an objective rea= lity to "trustyworthy answer", though, I think "true to the = data supplied by the zone maintainer" may still be it.=C2=A0 I'm n= ot sure there is, though, if you have any belief in the use of the DNS as a= control surface.=C2=A0 In the case of household using a DNS filtering serv= ice, the answer may be that the "trustyworthy" resolver provides = the data supplied by the zone maintainer after the application of the filte= rs to which the subscriber has agreed.=C2=A0
=C2=A0
=C2=A0Traditionally, a =E2=80=9Ctrustworthy answer= =E2=80=9D was the data originally supplied by the zone owner of the domain = being looked up. DNSSEC was created to ensure this. However, network operat= ors (e.g., CDNs) playing =E2=80=9Cstupid DNS tricks=E2=80=9D, resolver oper= ators providing filtering, etc. may have changed what is a =E2=80=9Ctrustwo= rthy answer=E2=80=9D over the years.

With that sai= d, and assuming you=E2=80=99re using the traditional interpretation of =E2= =80=9Ctrustworthy answer=E2=80=9D, then DoT/DoH do not ensure a =E2=80=9Ctr= ustworthy answer.=E2=80=9D DoT/DoH provide transport protection. The only w= ay to truly ensure a trustworthy answer is to protect the actual answer. Wh= ich is what DNSSEC does.


<= div>Evidently I was unclear, sorry.=C2=A0 It doesn't assure you that th= e answer is trustworthy; it can assure you have reached the resolver that y= ou intend.=C2=A0 If you trust that resolver (for whatever value of trustwor= thy you have), that may help.

Thanks for pointing = out the lack of clarity,

Ted
(as an indi= vidual)

=C2=A0
Rega= rds,
-drc
(Speaking only for myself)

--0000000000001e9eb70590a481d1-- From nobody Wed Aug 21 11:17:10 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 18AFD120E34 for ; Wed, 21 Aug 2019 11:17:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=virtualized-org.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id r7HYZRHW2-cl for ; Wed, 21 Aug 2019 11:17:07 -0700 (PDT) Received: from mail-pf1-x42d.google.com (mail-pf1-x42d.google.com [IPv6:2607:f8b0:4864:20::42d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A7D74120E2F for ; Wed, 21 Aug 2019 11:17:07 -0700 (PDT) Received: by mail-pf1-x42d.google.com with SMTP id q139so1932312pfc.13 for ; Wed, 21 Aug 2019 11:17:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtualized-org.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc:message-id:references :to; bh=UHz26Ct/MbdK+cuZdmubd0Ty7bsj/m/haioBFho+Sls=; b=LG2GIQWdmLVPwsHRm9614ao52OLyGJD2rFa7JeamwO3w0uwdf3lO+rSqtuBdYS9Oux 3irol1N9heLoNrYjWfry8tB0QWiB3a/g9pzqf319au2H4B7NpFM70gMk1LwLznIMX1qK YErmmSbsAWHJasHpPC9mf9GQtk77U5UwXb2enbtNSIJsHQReSG0uBfSguWCUmAecQXhN uxJD3zihMixS6cLdq1F3qUzmk/eAVBPOs9xEnomKmFPphmBX56syVCRmdRDJawJCIA6O jGf+c4atyMOKKMcHTXRo6n+paCvTVMDlhEJ+z4ndxmArE5JpLaY50W/BGbuA2MWmwtBP foNQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :message-id:references:to; bh=UHz26Ct/MbdK+cuZdmubd0Ty7bsj/m/haioBFho+Sls=; b=PDtiVA3Bin9XrBJTKn6pUtfQQbBgFoeoyOizVfoyTAvONW22f8P+USUVzVCR9Sj0Jk wGTZVm51O5t1SAZpcXNrt7j70FsxYs2X4GK1/jQDbiIISJ2x6VzcYzvIsX029bWbatbS +PnzAwUMOblhRwHDcf3rt7UAWNFHJg0MQyvjhmaMaS6h9kM728SrETYdvstT7VKfEWe3 zoVcyQR9zcIHDY/jViZWCJ73t6NqdhWFopMeFIBklKeW3Y2iH34YH2QANgO3nJOIb+xu xAfi0PshF9XSdvoIRssnN4GxDSgAYAGT603zcXB8rD5Xqj2gPkmnRFXUQt89kuooacIG SjfQ== X-Gm-Message-State: APjAAAVyA+F1W6EDNlXmNxj+bF7gb9TQr8zTkI0+nOa/JulUh+47II5d owX9IB0JMsYr5RQIR61hoErOPQ== X-Google-Smtp-Source: APXvYqwoPsrSlknyw2u0wGOOQCFO+mBIcq+ROVwd4zPBwzQPYY+Ih8UczPlp4piIzgp6D/iixSau6A== X-Received: by 2002:a62:754a:: with SMTP id q71mr32349879pfc.15.1566411427189; Wed, 21 Aug 2019 11:17:07 -0700 (PDT) Received: from ?IPv6:2620::2d0:110:a001:9cbc:6eb4:c2df? ([2620:0:2d0:110:a001:9cbc:6eb4:c2df]) by smtp.gmail.com with ESMTPSA id 14sm28988240pfy.40.2019.08.21.11.17.06 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 21 Aug 2019 11:17:06 -0700 (PDT) Content-Type: multipart/signed; boundary="Apple-Mail=_BCD895CE-8E28-490B-90D9-CB61331199E7"; protocol="application/pgp-signature"; micalg=pgp-sha512 Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) From: David Conrad In-Reply-To: Date: Wed, 21 Aug 2019 11:17:05 -0700 Cc: ADD Mailing list X-Mailbutler-Message-Id: 8FB71730-055E-437B-A2E5-3DA38C7DF151 Message-Id: <59E0EC53-0E30-431C-8376-52C7BFC121A8@virtualized.org> References: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> To: Alec Muffett X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] What to do in this potential working group X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Aug 2019 18:17:09 -0000 --Apple-Mail=_BCD895CE-8E28-490B-90D9-CB61331199E7 Content-Type: multipart/alternative; boundary="Apple-Mail=_57241994-E781-4AD6-80CD-D9CB7890911D" --Apple-Mail=_57241994-E781-4AD6-80CD-D9CB7890911D Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Alec, On Aug 21, 2019, at 11:06 AM, Alec Muffett = wrote: > On Wed, 21 Aug 2019, 18:59 David Conrad, > wrote: > The only way to truly ensure a trustworthy answer is to protect the = actual answer. Which is what DNSSEC does. > Fortunately we do not have to wait for DNSSEC in order to get answers = from the people from whom we wish them supplied, privately and = untampered-with, which is the whole point of DNS over HTTPS. As mentioned, this is not the traditional answer for what is = =E2=80=9Ctrustworthy=E2=80=9D when it comes to DNS data: instead of = trusting the zone owner (more specifically, the holder to the zone = signing key), you are trusting the resolver operator. The data is ONLY private between the end user and the resolver operator. = It is NOT private to the resolver operator (something people have been = repeatedly pointing out) nor is it private between the resolver operator = and the authorities. Further, you cannot ensure to the end user that the =E2=80=9Ctrusted=E2=80= =9D resolver operator has not tampered with the data, be it due to court = order, internal attack, software bugs, etc. Again, DNS over HTTPS protects the data channel. It does NOT protect the = data. Regards, -drc --Apple-Mail=_57241994-E781-4AD6-80CD-D9CB7890911D Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Alec,

On Aug 21, = 2019, at 11:06 AM, Alec Muffett <alec.muffett@gmail.com> wrote:
On Wed, 21 Aug 2019, 18:59 David Conrad, <drc@virtualized.org> wrote:
The only way to truly ensure a trustworthy = answer is to protect the actual answer. Which is what DNSSEC = does.
Fortunately we do not have to wait for DNSSEC in order to get = answers from the people from whom we wish them supplied, privately and = untampered-with, which is the whole point of DNS over = HTTPS.

As = mentioned, this is not the traditional answer for what is = =E2=80=9Ctrustworthy=E2=80=9D when it comes to DNS data: instead of = trusting the zone owner (more specifically, the holder to the zone = signing key), you are trusting the resolver operator.

The data is ONLY private between the end user and = the resolver operator.  It is NOT private to the resolver operator = (something people have been repeatedly pointing out) nor is it private = between the resolver operator and the authorities.

Further, you cannot ensure to the end user that = the =E2=80=9Ctrusted=E2=80=9D resolver operator has not tampered with = the data, be it due to court order, internal attack, software bugs, = etc.

Again, DNS over = HTTPS protects the data channel. It does NOT protect the data.

Regards,
-drc

= --Apple-Mail=_57241994-E781-4AD6-80CD-D9CB7890911D-- --Apple-Mail=_BCD895CE-8E28-490B-90D9-CB61331199E7 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEzEaOGlQw4bcyWBNfoCss/bh3zPcFAl1diqEACgkQoCss/bh3 zPcTmQ//fWIafw1Ab9Y4AhgdxNNbSsLcAqfxbvpW4ZfLGIXfPjhg2yhDkZLb1GMy QbGeXwl93zfp93J97SHrrCQOugf25LOT2BSW//UdlNh0fT84Xy/nmPXjgDuJhzDa HNzi8mf2oLWsfC4ibTCAbde+PISH8RpscLqDULJln4uEFts28+pIPCO1OmN3VwZN /3qxvVUimFfNmcxqQi4QDYFl6bVuMZSun9VFPcystn7y7+u4VMCs48wegCTtC4T3 qCax6ckseSFRfSfHTJ5s6imCQBHYWhL2cpTcq9wkPgcqkpWe3/Z2QJHVCdgfL6kr gQgKWflhJzW+4P4a9JC5FB+16uQi+BM8lK2wnjZNtLG2jwQL6FvJD9shMedkpcz0 wk1a6zTiUGP5EjoXogOioB92TjRfMAwjFW1Y3XWJCGuuF4F1hVJJHuCaTKlrXZFA lPeDXBg891zvkLDVljhaF6dT+jphpBk6iZUTioZ/n/HjGpNCjn/Q31qI32EVgOpj dlTv6BwcTa/FvkFrMTycnaEQrz05LX8i3kadRygHEXHJDjhhCW1dK/Bk3lJd4odB uq8R4n9A5GmPhkDSbQx203ooe+IfhBZ/1ubafXStoBQAnx19Ch9UFb5N3FKv4WcV YIKEjOWoP44ht8c5sNUwIbTaDJEqb4q+fPm/8Yq2d+358CCp9mM= =4g7o -----END PGP SIGNATURE----- --Apple-Mail=_BCD895CE-8E28-490B-90D9-CB61331199E7-- From nobody Wed Aug 21 11:25:05 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 64357120E2F for ; Wed, 21 Aug 2019 11:25:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Zh5dOWsf7PZl for ; Wed, 21 Aug 2019 11:24:59 -0700 (PDT) Received: from bizet.nethelp.no (bizet.nethelp.no [IPv6:2001:8c0:9e04:500::1]) by ietfa.amsl.com (Postfix) with ESMTP id 5B2F2120CE0 for ; Wed, 21 Aug 2019 11:24:59 -0700 (PDT) Received: from localhost (bizet.nethelp.no [IPv6:2001:8c0:9e04:500::1]) by bizet.nethelp.no (Postfix) with ESMTP id BB5ECE6079 for ; Wed, 21 Aug 2019 20:24:57 +0200 (CEST) Date: Wed, 21 Aug 2019 20:24:57 +0200 (CEST) Message-Id: <20190821.202457.210468432.sthaug@nethelp.no> To: add@ietf.org From: sthaug@nethelp.no In-Reply-To: <8D42902D-CD20-4A64-8F38-CF96F1A351F1@frobbit.se> References: <2ABE9821-1CF9-4FBC-907A-E0402E139C03@frobbit.se> <8D42902D-CD20-4A64-8F38-CF96F1A351F1@frobbit.se> X-Mailer: Mew version 6.7 on Emacs 26 / Mule 6.0 (HANACHIRUSATO) Mime-Version: 1.0 Content-Type: Text/Plain; charset=iso-8859-1 Content-Transfer-Encoding: quoted-printable Archived-At: Subject: Re: [Add] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Aug 2019 18:25:02 -0000 > As myself and others have said many times on this list, court orders = have ordered access providers in many legislations to block access to c= ertain "things". Some of these court orders are sealed, and of course p= eople are trying to get their hands on the orders, validate whether the= y are correct and what not. > = > With "things" I have seen everything from IP addresses via domain nam= es to URLs. > = > I have not seen any explicit statements in the court orders I have se= en how this is to be implemented, so the implementation is up to the ac= cess provider. There might very well exist such details, and I am happy= to see what they contain. There have been several verdicts in the Oslo District Court ordering Norwegian ISPs to prevent access to certain domains - and to implement this explicitly using DNS blocking. One such verdict from 2015 is available here (in Norwegian): https://docplayer.me/2483170-Oslo-tingrett-kjennelse-01-09-2015-i-oslo-= tingrett-15-067093tvi-otir-05-tingrettsdommer-jon-ostensvig-1-warner-br= os-entertainment-norge-as.html The latest verdict we received is from 01.06.2018, court reference number is 18-039103TVI-OTIR/02. Excerpt from the text: " p=E5legges: - =E5 hindre eller vanskeliggj=F8re kundenes tilgang til LiveTV ved =E5= iverksette DNS-blokkering av f=F8lgende domenenavn med subdomener: livetv.sx, livetvcdn.net, ... " The key phrase is "DNS-blokkering", i.e. DNS domain name blocking. In these cases the court verdicts are of course openly available, with the full list of domain names the ISPs are required to block. I happen to work for one of the ISPs required to perform such blocking. *In the context of such a verdict* it is completely irrelevant for us how effective (or ineffective) such domain name blocking is - we are simply required by the court to perform domain name blocking. Steinar Haug, AS2116 From nobody Wed Aug 21 11:26:52 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 093E5120E3B for ; Wed, 21 Aug 2019 11:26:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6-s8KhqtSlGV for ; Wed, 21 Aug 2019 11:26:33 -0700 (PDT) Received: from mail-vk1-xa29.google.com (mail-vk1-xa29.google.com [IPv6:2607:f8b0:4864:20::a29]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2AFC6120E40 for ; Wed, 21 Aug 2019 11:26:33 -0700 (PDT) Received: by mail-vk1-xa29.google.com with SMTP id z67so806942vkd.5 for ; Wed, 21 Aug 2019 11:26:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=HT8mmlMYOS05qCL2wby67lIMPMnHbUgqmJT5Cyry8+0=; b=d8KLebHpHGrefN+X3KWaNJacuYb83b1Mdo9qcrQbrgjnPkRGoYCGzIXXE5z2hBo3QV gXWxZVt0xHy0zEz+/J/WJVKlKMuqv5wZlW0tIdVMY5++pNTk5/DmsCcLGSLnnuhZSagL DqR0kYNiWBFxWSfoUHLz+A6kQOdYfMdbtx4vt5RxnSr82Wc8iNajsDVyMDRMpIl8fLMX mNwgptz4gRJ/NLCdjpCuuKtwlSihYKGvcS/9hwO3kFZgVU8Dk12AP6UJraHJEZuset2a rhrvRs1nVS3k4YQrvJ6p/cQP/OOP6rg7tDhcBu6KZmmfY4GCkRblHlhl2DMXTtNiEyKW 9thQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=HT8mmlMYOS05qCL2wby67lIMPMnHbUgqmJT5Cyry8+0=; b=ulxjgwEnEnpsz96wGWCK+c0+dzcyj4eVK3eiWoA+glL/breNfTd5KwHz/GCCdfRsqj 6YJ04h/YzviOqQ2gUsZ+2gl3mSn5sPBw4GDXePJGSY3c3HBIHcQkvPm2d4EbBPRdWS/y hzg7bfdN4uAC/rMp1oMikqMCPHF82V0D7oQPIQPmUhC1LSL4AU/y9urgRMVOrhlAXZ2G rUXrNxUK8W99gZ+FK7c0/hRF+SoZjmJVNTaQziLwkSyrGxO46L0OavpfKKSVjWAH+0iz ZefeAm3qdfAahUrWGkZes/+VeimiJU9TT4bWO6u64NBkhWiuUWaxpCvcGBraZncrMt2N t8rg== X-Gm-Message-State: APjAAAXjDVzDwVsIqOYxN/0ksSzxhcnrRPifXsqGmW8Bdm1DkBoEyECc DULJfP4HS1QF6AoBneIkjsvJXfVi4T7Hx38EoShyFAXq X-Google-Smtp-Source: APXvYqzB2aA8p5OTcdlAdHHxDY9WeVgB/bEcnIlII1tUOaUqldh5qeoe3FEox20lwp6hPtDDVf68R8Dl+6xFaprouYc= X-Received: by 2002:ac5:cc4d:: with SMTP id l13mr3639480vkm.72.1566411992039; Wed, 21 Aug 2019 11:26:32 -0700 (PDT) MIME-Version: 1.0 References: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> In-Reply-To: From: Brian Dickson Date: Wed, 21 Aug 2019 14:26:06 -0400 Message-ID: To: Eric Rescorla Cc: Ray Bellis , ADD Mailing list Content-Type: multipart/alternative; boundary="0000000000005b86f30590a4b64b" Archived-At: Subject: Re: [Add] What to do in this potential working group X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Aug 2019 18:26:36 -0000 --0000000000005b86f30590a4b64b Content-Type: text/plain; charset="UTF-8" On Wed, Aug 21, 2019 at 1:15 PM Eric Rescorla wrote: > > > On Wed, Aug 21, 2019 at 6:05 PM Ray Bellis wrote: > >> >> Or Mozilla could embrace DNSSEC and DoT thereby encouraging their >> deployment for the benefit of all internet users... >> > > I feel like everything meaningful to be said about DNSSEC has already been > said, so I'll spare people that. > Actually, there is one thing you could say about DNSSEC that would help clarify Mozilla's position. Basically, without doing validation, a stub resolver can be categorized two different ways: - security-unaware stub resolver - security-aware non-validating stub resolver I think it would be helpful if Mozilla were to state which kind of stub resolver it will be implementing (security-unaware or security-aware). In either case, a validating resolver will return RCODE=2 if validation fails, so I think it doesn't have any practical impact. Brian --0000000000005b86f30590a4b64b Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Wed, Aug 21, 2019 at 1:15 PM Eric = Rescorla <ekr@rtfm.com> wrote:
<= div dir=3D"ltr">

On Wed, Aug 21, 2019 at 6:05 PM Ray Bellis <ray@bellis.me.uk> wro= te:

Or Mozilla could embrace DNSSEC and DoT thereby encouraging their
deployment for the benefit of all internet users...
I feel like everything meaningful to be said about DNSSEC has = already been said, so I'll spare people that.

Actually, there is one thing you could say about D= NSSEC that would help clarify Mozilla's position.

<= div>Basically, without doing validation, a stub resolver can be categorized= two different ways:
  • security-unaware stub resolver
    • <= li>security-aware non-validating stub resolver
I think = it would be helpful if Mozilla were to state which kind of stub resolver it= will be implementing (security-unaware or security-aware).

<= /div>
In either case, a validating resolver will return RCODE=3D2 if va= lidation fails, so I think it doesn't have any practical impact.
<= div>
Brian
--0000000000005b86f30590a4b64b-- From nobody Wed Aug 21 12:03:38 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D21B212099B for ; Wed, 21 Aug 2019 12:03:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jubxpp5AZ5Dj for ; Wed, 21 Aug 2019 12:03:35 -0700 (PDT) Received: from mail-vs1-xe35.google.com (mail-vs1-xe35.google.com [IPv6:2607:f8b0:4864:20::e35]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0977B120993 for ; Wed, 21 Aug 2019 12:03:35 -0700 (PDT) Received: by mail-vs1-xe35.google.com with SMTP id m62so2068788vsc.8 for ; Wed, 21 Aug 2019 12:03:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=3934PqE4R3ak4dag75ItXyrxtasT2CEMrU8VDWIVaQA=; b=ULyoKrKI76T35DDcWcSY3fkIJmx2a2dbxr/INmkuSMfC/Ja2Ckk2+fYTBc2BNPJbAg S0LTfjXU5IpF4XSAOumMGIMRwS1pT+5I3zIXCkIzFp4XzPOfCJmeqbLpudHar4dJ7y9S o1AJtUc0Mco6sg/cGg1tDFBeWZPr+KVWmegni63AtIFGO/UIUjLyeWaFNDi8afq0EweZ 7ifha9Rr4DglnTt52yQyG9hVvEhMhjABhomEhkOpIv4wHGdQOKKe8IAnM/uatpvl0Pz8 VOerk+ZPuRMZMMYIzq1FeAyx1veM5nUe7M2IvqfrXQLbLbsBFdak06U0891y7KxCHkrj esQA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=3934PqE4R3ak4dag75ItXyrxtasT2CEMrU8VDWIVaQA=; b=RtrK9Fqdk2NB/DbprLvOXEc/te84T2R8kia0xd6yYpzgVPJF/hW1MOm7Tce2LJcZBt ZhD1Ku+IkNvYZeYmlsUfc2sDpl7LkKATq2EiNOGMD4Yw85SlCalJoGkZo1asQgqmO1mH Knf649ZH1oi40wmHiItJSv3myAONJEyZh5It09lkVewtrkhK+RxKzvG8vpTPsGS4dXRY gpNI8vLmKjC1JmUV37pNE7N5U6xQuQdx6GEnNyUnVUzwKwV3hSfPWpHSUTG6QI99L5UD tAOCKiwZLj9s28Az8pkat7xgCO/29/y7S0SO/wGN7GnY59gAHRr37JiE3J/T/X9OqCum ZqPA== X-Gm-Message-State: APjAAAV/79vz2nZSK2EyMmQ7MoGDAc3Hw2ztweO/iAzq8G1eMspjvvJD GaTDEAxOnuqgoCrSDiq55ZKhnQlkqhDWrG6eXTs= X-Google-Smtp-Source: APXvYqzGA9T1iJ61rwmOXXby7y/Y+tGoxZ4GrfpLDYlKpD39wqzgmINCB4nLLfeVZ6K3o3d7Tf3lJNxYyM7FnCNgxuQ= X-Received: by 2002:a67:f043:: with SMTP id q3mr21208161vsm.219.1566414213851; Wed, 21 Aug 2019 12:03:33 -0700 (PDT) MIME-Version: 1.0 References: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> <59E0EC53-0E30-431C-8376-52C7BFC121A8@virtualized.org> In-Reply-To: <59E0EC53-0E30-431C-8376-52C7BFC121A8@virtualized.org> From: Brian Dickson Date: Wed, 21 Aug 2019 15:03:08 -0400 Message-ID: To: David Conrad Cc: Alec Muffett , ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000c9afc30590a53a58" Archived-At: Subject: Re: [Add] What to do in this potential working group X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Aug 2019 19:03:37 -0000 --000000000000c9afc30590a53a58 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Wed, Aug 21, 2019 at 2:17 PM David Conrad wrote: > Alec, > > On Aug 21, 2019, at 11:06 AM, Alec Muffett wrote= : > > On Wed, 21 Aug 2019, 18:59 David Conrad, wrote: > >> The only way to truly ensure a trustworthy answer is to protect the >> actual answer. Which is what DNSSEC does. >> > Fortunately we do not have to wait for DNSSEC in order to get answers fro= m > the people from whom we wish them supplied, privately and untampered-with= , > which is the whole point of DNS over HTTPS. > > > As mentioned, this is not the traditional answer for what is =E2=80=9Ctru= stworthy=E2=80=9D > when it comes to DNS data: instead of trusting the zone owner (more > specifically, the holder to the zone signing key), you are trusting the > resolver operator. > > The data is ONLY private between the end user and the resolver operator. > It is NOT private to the resolver operator (something people have been > repeatedly pointing out) nor is it private between the resolver operator > and the authorities. > > Further, you cannot ensure to the end user that the =E2=80=9Ctrusted=E2= =80=9D resolver > operator has not tampered with the data, be it due to court order, intern= al > attack, software bugs, etc. > It is probably useful to highlight the impact of "local policy", especially with respect to trust anchors. For example, it might be the case that a given resolver operator has been compelled to install (and use) some additional trust anchor(s). Under that resolver operator's local policy, it is possible that the validity of a given DNS answer from an authority, only due the use of an additional trust anchor. In that circumstance, a validating stub would actually determine that the DNS answer it received from that resolver is BOGUS. The resolver operator might not be directly involved in modification of the DNS answer and signatures. For example, there could be a state actor in the same jurisdiction as the operator and the respective court. The additional trust anchor presumably would have been used by the state actor for signing the substituted data. (This would be analogous to the root CA thing being used for TLS MITM ongoing somewhere.) Since a resolver operator's data is mostly cached, and cached based on DNSSEC validity if they validate, such state actions scale extremely well. This is a significant reason that DNSSEC was designed from the ground up for client (stub) validation: trust, but verify. Note: Having multiple resolver operators to choose from helps this situation, but ONLY if the stub does local validation, and if the jurisdictions for those operators was different. The stub treats the invalid data as a failure, and uses the other provider. This only occurs if the failure to validate is detected by the stub, by local validation. NB: recursive-to-authoritative is not encrypted, and on-path attackers can modify the data. DNSSEC enables detection of this tampering via validation on signed data, modulo the trust anchor(s) in use. Brian > > Again, DNS over HTTPS protects the data channel. It does NOT protect the > data. > > Regards, > -drc > > --000000000000c9afc30590a53a58 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Wed, Aug 21, 2019 at 2:17 PM David= Conrad <drc@virtualized.org&= gt; wrote:
Alec,

On Aug 21= , 2019, at 11:06 AM, Alec Muffett <alec.muffett@gmail.com> wrote:
On Wed, 21 Aug 2019, 18:59 David Conrad, <drc@virtualized.org<= /a>> wrote:
The only way= to truly ensure a trustworthy answer is to protect the actual answer. Whic= h is what DNSSEC does.
Fortunately we do not have to wait for DNSSEC in order to get answers fro= m the people from whom we wish them supplied, privately and untampered-with= , which is the whole point of DNS over HTTPS.

As mentioned, this is not the traditional answer for what i= s =E2=80=9Ctrustworthy=E2=80=9D when it comes to DNS data: instead of trust= ing the zone owner (more specifically, the holder to the zone signing key),= you are trusting the resolver operator.

The data = is ONLY private between the end user and the resolver operator.=C2=A0 It is= NOT private to the resolver operator (something people have been repeatedl= y pointing out) nor is it private between the resolver operator and the aut= horities.

Further, you cannot ensure to the end us= er that the =E2=80=9Ctrusted=E2=80=9D resolver operator has not tampered wi= th the data, be it due to court order, internal attack, software bugs, etc.=

It is probably useful to highl= ight the impact of "local policy", especially with respect to tru= st anchors.
For example, it might be the case that a given resolv= er operator has been compelled to install (and use) some additional trust a= nchor(s).

Under that resolver operator's local= policy, it is possible that the validity of a given DNS answer from an aut= hority, only due the use of an additional trust anchor.

In that circumstance, a validating stub would actually determine that= the DNS answer it received from that resolver is BOGUS.

The resolver operator might not be directly involved in modification= of the DNS answer and signatures. For example, there could be a state acto= r in the same jurisdiction as the operator and the respective court. The ad= ditional trust anchor presumably would have been used by the state actor fo= r signing the substituted data. (This would be analogous to the root CA thi= ng being used for TLS MITM ongoing somewhere.)

Sin= ce a resolver operator's data is mostly cached, and cached based on DNS= SEC validity if they validate, such state actions scale extremely well. Thi= s is a significant reason that DNSSEC was designed from the ground up for c= lient (stub) validation: trust, but verify.

Note: = Having multiple resolver operators to choose from helps this situation, but= ONLY if the stub does local validation, and if the jurisdictions for those= operators was different.=C2=A0 The stub treats the invalid data as a failu= re, and uses the other provider. This only occurs if the failure to validat= e is detected by the stub, by local validation.

NB= : recursive-to-authoritative is not encrypted, and on-path attackers can mo= dify the data. DNSSEC enables detection of this tampering via validation on= signed data, modulo the trust anchor(s) in use.

B= rian
=C2=A0

Again, DNS over HTTPS = protects the data channel. It does NOT protect the data.

Regards,
-drc

--000000000000c9afc30590a53a58-- From nobody Wed Aug 21 12:44:11 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6F13912011E for ; Wed, 21 Aug 2019 12:44:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bwJWObrZ-Q3U for ; Wed, 21 Aug 2019 12:44:07 -0700 (PDT) Received: from mail-io1-xd35.google.com (mail-io1-xd35.google.com [IPv6:2607:f8b0:4864:20::d35]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BFCE5120099 for ; Wed, 21 Aug 2019 12:44:07 -0700 (PDT) Received: by mail-io1-xd35.google.com with SMTP id o9so7077535iom.3 for ; Wed, 21 Aug 2019 12:44:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to; bh=wimoRslwGqwjkHLmpiEBWCuMnUuYs2RXEpFEvyFcPF8=; b=IUAmgnzMs8xIriDwhVr14XfkKgx+bj4L2rvR7yt8IAOA3Cu7VXUjnA0w/D6rsg2Iv/ Yw8ZuoRfB6OOFnfbhTyl4mlJZjXKnDjO9vBdpK3f8Q8zAp5nNOixNah4dZnVug99RFf/ 71kG/MLe4U7tObaFuLR174uLdYdIOzU4JRHt5BjGYzdgiNT3WmeNcEkhGHvtfxJp8zYu RbVu0SiA1UyQ2uEm22lGSO/R5LzNsGjAu6iUkmoQgF1FB6i7NuAR8Jf8l102sSGQtTPz DbzwUpWZ82Mzj/d36rBGt9c1Ms+Gfr1skqn/IqevqG1hFj3P49cPcqU8P7M+eI0Vj1an 3d0A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=wimoRslwGqwjkHLmpiEBWCuMnUuYs2RXEpFEvyFcPF8=; b=nx8XR04c/SCp7xtklOjoZ800+9dCT8MbxR2Q8SCaY1qDn0iTs2o/ttWe/zgCzVr1hJ EnKYe++2xUwQ6hSrVsXFFfqmoR529ht4utzR4FVjiJMsCH+3KmSJLzoQaZlf4pJhWpuR x4nSeFogd2VipBlkSJUxYjOaP2taDa8KCHzwTH8EDZwjj2tyPp5+t9EvhhayebHlnPdC 8wLbtiXZHu8qA21FK/3s1eKZ9cIwUhZvtO6wy/3VPVY0DW/r6M2BJNH3RbD76j5BL20i YW4U2xioQtRMU9gAv6mwC1iDFqIEgScOMx5R3cko9o69kD750qkm/ne+mNt11o6GfIRQ p2xQ== X-Gm-Message-State: APjAAAVLSAiLmhGJaU511V13jepNtonPJVLNrkXRUcERIifB5S+W2tLR 8F4vjQWu/PP1NCucGT5U0gPNqCrNnRLf++teR9Z+1Ei9AINELw== X-Google-Smtp-Source: APXvYqycWRnb9NzuS7K61OmZ/Gafr95RYAHBc7fYGNMQjmBdC//K8btAx97oHXfJYvQ2Ho/jAXCh1I4PTin/hUKUEXg= X-Received: by 2002:a5e:d618:: with SMTP id w24mr5788635iom.73.1566416646549; Wed, 21 Aug 2019 12:44:06 -0700 (PDT) MIME-Version: 1.0 From: Rob Sayre Date: Wed, 21 Aug 2019 12:43:55 -0700 Message-ID: To: ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000c9b5f20590a5cbc0" Archived-At: Subject: [Add] FYI: regarding HTTPS interception X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Aug 2019 19:44:10 -0000 --000000000000c9b5f20590a5cbc0 Content-Type: text/plain; charset="UTF-8" Hi, I thought readers of this list might find this blog post relevant: "When making secure connections, Chrome trusts certificates that have been locally installed on a user's computer or mobile device. This allows users to run tools to inspect and debug connections during website development, or for corporate environments to intercept and monitor internal traffic. It is not appropriate for this mechanism to be used to intercept traffic on the public internet." < https://security.googleblog.com/2019/08/protecting-chrome-users-in-kazakhstan.html > thanks, Rob --000000000000c9b5f20590a5cbc0 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi,

I thought readers of this list migh= t find this blog post relevant:

"When making = secure connections, Chrome trusts certificates that have been locally insta= lled on a user's computer or mobile device. This allows users to run to= ols to inspect and debug connections during website development, or for cor= porate environments to intercept and monitor internal traffic. It is not ap= propriate for this mechanism to be used to intercept traffic on the public = internet."


--000000000000c9b5f20590a5cbc0-- From nobody Wed Aug 21 12:58:22 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 37DAD1209AB for ; Wed, 21 Aug 2019 12:58:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KIQG90ve1KjB for ; Wed, 21 Aug 2019 12:58:18 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5F0761209BC for ; Wed, 21 Aug 2019 12:58:18 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 8393DBE50; Wed, 21 Aug 2019 20:58:16 +0100 (IST) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5NTl-l_BnziM; Wed, 21 Aug 2019 20:58:15 +0100 (IST) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id B763EBE55; Wed, 21 Aug 2019 20:58:14 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1566417494; bh=jH5hLEg4ripyMy4KYAYqv8ayq3t8JUj8Q549rdb1dYs=; h=To:Cc:References:From:Subject:Date:In-Reply-To:From; b=HUZVXr6sij0Qu8of1ARuB8bSQSyskGxg7Rqb6pP9xMjQs6BJWvy7Yyl6XFDGeIiom 5ZoGUldT1q/BVSEPFS+mohOFGd7Prsjw++PD7mWXus6/XPUkgU281WHE7bIaXLa+Yg D02nwQJsJu3U/VDmmJsaoxFGFd3H1hhipzQLanww= To: Ted Hardie , Jari Arkko Cc: Eric Rescorla , ADD Mailing list References: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: <8f856492-f5da-9a02-f76d-67c2795b2ecc@cs.tcd.ie> Date: Wed, 21 Aug 2019 20:58:13 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="vE75soWwUcyb5LAZTs8vLu1cPjDAbwSKR" Archived-At: Subject: Re: [Add] What to do in this potential working group X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Aug 2019 19:58:21 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --vE75soWwUcyb5LAZTs8vLu1cPjDAbwSKR Content-Type: multipart/mixed; boundary="npIZmq7BQKpxUjCKVcUcTB0GNqoKQihXf"; protected-headers="v1" From: Stephen Farrell To: Ted Hardie , Jari Arkko Cc: Eric Rescorla , ADD Mailing list Message-ID: <8f856492-f5da-9a02-f76d-67c2795b2ecc@cs.tcd.ie> Subject: Re: [Add] What to do in this potential working group References: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> In-Reply-To: --npIZmq7BQKpxUjCKVcUcTB0GNqoKQihXf Content-Type: multipart/mixed; boundary="------------8CF069F33E227F5B4E62473D" Content-Language: en-GB This is a multi-part message in MIME format. --------------8CF069F33E227F5B4E62473D Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable HIya, I think I share Jari's concern on this, perhaps though being somewhat more sanguine about Mozilla's so far announced plans and what might flow from those... On 21/08/2019 18:36, Ted Hardie wrote: > The third threat model is that the use of a single large common recursi= ve Single or small number. I don't know what might be a good number for the number of independent, reliable and privacy- friendly public resolver organisations in the world, nor in any particular situation. As you say, experiments need to be done and I hope would include this as a research question. (As well as of course comparing hypotheses and findings to reality as that also changes.) > Your concern is that using DoH as a response to the first and second > attacks is increasing the risks related to the third. Is that > approximately correct? Perhaps not so much "using DoH" as (over-)concentrating queries. (And I'm not at all claiming that's the only valid concern in the ADD space.) > If so, I think there are practices that we might develop and recommend > (e.g. selectively sending queries to different trusted resolvers) and s= ome > of those may also touch on the split DNS issue. =20 As previously mentioned, trickiness abounds - selecting one at a time with a duration measured in days would just spread the same information over more organisations etc. > My modest experience in > this realm suggests, though, that experiments are the only thing that w= ould > tell you the impact of those practices on latency, correctness, and > leakage. =20 I agree. > So I'd want some indication that folks are willing to run those > experiments before taking on that work. Mozilla seem willing so far and I'd sure academic researchers will find this an attractive space to explore (I bet a beer we see a raft of publications in the next year or so:-). I don't think I've heard of other DNS operators or large-scale clients being very active in that regard yet, but it would be good to hear they were. I guess partly the above indicates there's a longer-term element to all this, where we're really far from ready for BCP-like text. I'm not sure how much time there is though to get that kind of experimenting done before it'd be moot. In terms of current venues, pearg seems like a place where some of that work would fit very well. Cheers, S. --------------8CF069F33E227F5B4E62473D Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------8CF069F33E227F5B4E62473D-- --npIZmq7BQKpxUjCKVcUcTB0GNqoKQihXf-- --vE75soWwUcyb5LAZTs8vLu1cPjDAbwSKR Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAl1dolUACgkQWrL68XsX K+qdIw//dU7BgUkSdEKH3X65p3smmHZse4jvemQGN77Nt6VLsX6bptkp8iC8L444 8wTL70j8iwXB/8MCuvwABp3dY5+kp/ugNh67X8Lwc7+9Jmi0j9sPrDnIxd8vTNkt uXLA2FPgsmJcNcht110QYiGh6S6OkaUaoXY7cL7WVcin2mKBiz3htQWxHu6l+SXx bDlzxS1sg6o6yUnsY1t43bpfQt+YHDFCqKh2iXtq2MN1v3A2rYsCbQXp9ZEgwmWG uYbylC0EfW4tp7W6pvrr2v2Q2yfjckG+S5ez5iRpDAmxV7ZDFOO0Pu5+lT9groga 4nPGHTL6sqBqd1qoT1UhwTv+/kAjECPurCkMEr7Q+8NHFg4REfmeLyoWvCnQh71f KPX3OoXxFCfg1aZlPZxOZSgsT8TY2po7OII/wZuw4InSYoszdD6QaXSk7ftvMrNS phMN7/z+9Vfq+V7gTfmp/rLv95WcnA3T5vSlrd7RqAYyQBXiu0H44jcR0zQ4/vty Bj62zDroi9y5pReNWfMnrqTlQ05pzise+R55yZezQWq8kHvxdC/31fRxI6q0fTaG +7evsmxt7wuQkwNw6YJvXlZstPGkxOiFNGwk/b6LlcC/P2yZ8JdfAwXMGZxZ4mLg c061ulcS2YNQdAy+iOoF6eksKfnwODRH4AhSasjTW+mFpMhcFJs= =oMrf -----END PGP SIGNATURE----- --vE75soWwUcyb5LAZTs8vLu1cPjDAbwSKR-- From nobody Wed Aug 21 13:11:05 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 91F8F12011C for ; Wed, 21 Aug 2019 13:11:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id boCJmmsX_eoL for ; Wed, 21 Aug 2019 13:11:00 -0700 (PDT) Received: from mail-io1-xd31.google.com (mail-io1-xd31.google.com [IPv6:2607:f8b0:4864:20::d31]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9DD451201A3 for ; Wed, 21 Aug 2019 13:11:00 -0700 (PDT) Received: by mail-io1-xd31.google.com with SMTP id q22so7233985iog.4 for ; Wed, 21 Aug 2019 13:11:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=sQhddgUZy7O3bpeXe4AUrFMscCEymur2B683w0SJkfQ=; b=Ai8D+WkZhJT226rqi3OFmuMF/2ZM1fjrMduRgQfUqcny5Ro5wGedWddxvb6ZRA+tjN ZQPN642iM3etN8Z489LXeUYdskn8EHBVNYZNRzIHSe9HdqkYlRfwBoAiqxLwqRXGMjiP qSAeTbpX/ry2ef9ujFmPxRppugHq7QK3wQB3TyN4/hhIJINN67PSEs84yptk/qlrD3jO rwJyDuwYs2zg1U/XgaB8Upkiwl6j7wJdf390+du1QbG/MHF2FzZEOyGShsEs2cPgN4o/ d3nIiu6i6ZioqmjRCEPYEoAxsDERF8J2uvz1n+uS9ZtSFPl6kQqLSvBcpelDJ6o+DgFX 3lLw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=sQhddgUZy7O3bpeXe4AUrFMscCEymur2B683w0SJkfQ=; b=GxjeBUyeGn05UN7nccBrHrVvk5dsnrLgv9p6GLnCC6HyQQ4voakcDK3Fc+Ln6joc5o Dfm4qkg5EQO21b5kA4vmV6m9zhoX5GMIvWHQzAoiqnaHbx7KSL6MeEQ3JKIFyPedCf9x nne51M61BS5BZShxdLbmewKdN+J2pz6k5qJXUyPTn9943I+WSRhJBty0n5TunC7umSne Syc5iSEIE/p5u8HetUxSiTfDXJcFmv4Yig9myLTkaFAqsRP1j2wsX2bXBhl3nmzCMnEv 4AtkDJpmopqH7yqwzt4A5mz3baCmZEWcIdReYL9YI5g1GrAKkr1kJRY9TNzPqAy5u4Js 57hA== X-Gm-Message-State: APjAAAXxYrED/M3paWGRwGproM9RStOT8cuWLh38owSUX9IsWBaCkzmy 9XuBtcOaN1JMXFzpmfanjjAski3AvlPAm8RJ2CS9GQ== X-Google-Smtp-Source: APXvYqwZvlJ74ChkJvKaUdRvpmHybXj7cbNst6vkrWh+7yTjxMQeUBOHF0nZ//MfVbOYIXEd3iDy/p72qc96jPpFK4w= X-Received: by 2002:a02:5ec3:: with SMTP id h186mr12303417jab.110.1566418259679; Wed, 21 Aug 2019 13:10:59 -0700 (PDT) MIME-Version: 1.0 References: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> <8f856492-f5da-9a02-f76d-67c2795b2ecc@cs.tcd.ie> In-Reply-To: <8f856492-f5da-9a02-f76d-67c2795b2ecc@cs.tcd.ie> From: Ted Hardie Date: Wed, 21 Aug 2019 13:10:32 -0700 Message-ID: To: Stephen Farrell Cc: Jari Arkko , Eric Rescorla , ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000f0237c0590a62b84" Archived-At: Subject: Re: [Add] What to do in this potential working group X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Aug 2019 20:11:04 -0000 --000000000000f0237c0590a62b84 Content-Type: text/plain; charset="UTF-8" Hi Stephen, Once small point: On Wed, Aug 21, 2019 at 12:58 PM Stephen Farrell wrote: > > > Your concern is that using DoH as a response to the first and second > > attacks is increasing the risks related to the third. Is that > > approximately correct? > > Perhaps not so much "using DoH" as (over-)concentrating > queries. > I think it is important for us in this group to focus on areas where there is protocol work to be done or operational practice to change where it relates to applications doing DNS. If you wish to write a document on the general topic of why over-concentrating queries to the common resolvers is risky, then I am not sure this is the right group for it. And I personally think the risks are actually quite different for DNS over port 53 than for DNS over DoH or DoT, as the primary risk of observation or active MITM attacks looms much larger there (and is made much easier when there are common destinations). regards, Ted Hardie (as an individual contributor) --000000000000f0237c0590a62b84 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi Stephen,

Once small point:

On Wed, Aug 21, 2019 at 12:58 PM Stephen Farr= ell <stephen.farrell@cs.tcd= .ie> wrote:

> Your concern is that using DoH as a response to the first and second > attacks is increasing the risks related to the third.=C2=A0 Is that > approximately correct?

Perhaps not so much "using DoH" as (over-)concentrating
queries.

I think it is important for u= s in this group to focus on areas where there is protocol work to be done o= r operational practice to change where it relates to applications doing DNS= .=C2=A0 If you wish to write a document on the general topic of why over-co= ncentrating queries to the common resolvers is risky, then I am not sure th= is is the right group for it.=C2=A0 And I personally think the risks are ac= tually quite different for DNS over port 53 than for DNS over DoH or DoT, a= s the primary risk of observation or active MITM attacks looms much larger = there (and is made much easier when there are common destinations).

regards,

Ted Hardie
(a= s an individual contributor)
--000000000000f0237c0590a62b84-- From nobody Wed Aug 21 13:24:38 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9F9FD120091 for ; Wed, 21 Aug 2019 13:24:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nKZFuUZA4OmJ for ; Wed, 21 Aug 2019 13:24:35 -0700 (PDT) Received: from mail-yb1-xb2e.google.com (mail-yb1-xb2e.google.com [IPv6:2607:f8b0:4864:20::b2e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E01AD12002E for ; Wed, 21 Aug 2019 13:24:34 -0700 (PDT) Received: by mail-yb1-xb2e.google.com with SMTP id t5so1565366ybt.4 for ; Wed, 21 Aug 2019 13:24:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=kT/Cg6qQEmr13Tf3ElFoAGOmJmJNeCR/Urf7QOoHxlY=; b=LOxMSjfOUxI2y2eLkYQlrJQq10IjuJPduVDlC21tzmI5QjMG4TNg7kuFa7Iv4ArgCi XJEve/tiziVfSvBXfa0xVvfOYuZs/YLfEAhHdQfdzHXptm1Ffxc9P2Xiu84HTRi06XZ3 uNctTonmxpEqA7nGJy/da4UXei0QoNQp1urNAajFjzL+Y873Qtx/UimG1aRCXc0XciQ0 k9VFgn2zuak+l3q/jZp6GJ7hN6ML+4r/cYxlp8XOgvk55zlgdwks8XtwK9Vj1X+Q5sL8 wcud15Yx0BjKl1mrWTDSIAhMmT2YBgcie6/iwxgJE0WtFXFarOC9J3axxUK8P6LvoOj+ 0Ggw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=kT/Cg6qQEmr13Tf3ElFoAGOmJmJNeCR/Urf7QOoHxlY=; b=JfdFBdfTPkg90em7rTY6aJXVVqfsg1Ga0e3MAbUbXWlrForL/Qm/H0H9vfSLPDz/YH +t+B3NYF/TkKvvOO0n5K094+nsqaQG3RX/s+LaLFq99y3IayLvCXx2lgvNd73RSB3156 6xKAEssLjdXj6p+FmfFuHJhSMNLWQqLnbG/zsFmeF0HmhmHI1dRm+Ec3Q7sm5bDxea9N 2zokm6ATdWD1K3gsOueCSwT2tuetrSFtXf/pmd4q+q73w719SdpAKEucZQODreW7au8V hRB3bST4UeT+ODFfsmbH35fqEmlo2Aim9iiFLK0KNX2idX40pKTJL9E1b8Hze1L2uTzV SSfw== X-Gm-Message-State: APjAAAVHhjYJkHCOpykdVUXyRVTVgIHjJkshFuVBPSteh2LsefIyxCa7 EVFx4nt3CsiUGfZMNSn9LW00b4V0YSWVU7v9jJk= X-Google-Smtp-Source: APXvYqyRJROZ65ux82ZCNv2YF/AJcaGz91zdJeaI5eZytULhxJqckNqatdrZ7oiC5sa2u2KQ/j6la1MGRmjGlXslQZ4= X-Received: by 2002:a25:778f:: with SMTP id s137mr25301197ybc.245.1566419073922; Wed, 21 Aug 2019 13:24:33 -0700 (PDT) MIME-Version: 1.0 References: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> <59E0EC53-0E30-431C-8376-52C7BFC121A8@virtualized.org> In-Reply-To: <59E0EC53-0E30-431C-8376-52C7BFC121A8@virtualized.org> From: Alec Muffett Date: Wed, 21 Aug 2019 21:24:23 +0100 Message-ID: To: David Conrad Cc: ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000787d260590a65ca2" Archived-At: Subject: Re: [Add] What to do in this potential working group X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Aug 2019 20:24:38 -0000 --000000000000787d260590a65ca2 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Wed, 21 Aug 2019, 19:17 David Conrad, wrote: > Further, you cannot ensure to the end user that the =E2=80=9Ctrusted=E2= =80=9D resolver > operator has not tampered with the data, be it due to court order, intern= al > attack, software bugs, etc. > But you can assure that it is a response from the resolver which you chose (contracted?) to deal with, rather than some happenstance resolver. This latter is a major dent in the typical broad DNS threat model, one which is glibly underplayed by those who would demand some theoretical and upcoming "perfection" of trust - eg: DNSSEC - when a "better than extant" option is already available and ready to be adopted by appropriate clients, in the form of DoH. To play with metaphor: Seatbelts won't protect you if your car's petrol tank explodes or if a meteor lands on it; but that's not an argument to deride seatbelts. One could attempt to make the argument "we won't need seatbelts when we have a car which is proof against meteorite strike!" - but I for one shall still wear them, and where they are not available - for instance on a bicycle - then I shall not. Equally: I shall (as available) use DoH, Do53, and perhaps even DoT on occasion, and I shall look down scornfully upon anyone who suggests that there is only one true DNS resolution transport. And I will lobby for DoH as "better than extant, where available" =E2=80=94= and not hold my breath for bolt-ons like DNSSEC. -a --000000000000787d260590a65ca2 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


On Wed, 21 Aug 2019, 19:17 David Conrad, <= drc@virtualized.org> wrote:
Further, you cannot ensure to the end user th= at the =E2=80=9Ctrusted=E2=80=9D resolver operator has not tampered with th= e data, be it due to court order, internal attack, software bugs, etc.

But= you can assure that it is a response from the resolver which you chose (co= ntracted?) to deal with,=C2=A0 rather than some happenstance resolver.=C2= =A0

This latter is a maj= or dent in the typical broad DNS threat model, one which is glibly underpla= yed by those who would demand some theoretical and upcoming "perfectio= n" of trust - eg: DNSSEC - when a "better than extant" optio= n is already available and ready to be adopted by appropriate clients, in t= he form of DoH.

To play = with metaphor: Seatbelts won't protect you if your car's petrol tan= k explodes or if a meteor lands on it; but that's not an argument to de= ride seatbelts. One could attempt to make the argument "we won't n= eed seatbelts when we have a car which is proof against meteorite strike!&q= uot; - but I for one shall still wear them, and where they are not availabl= e - for instance on a bicycle - then I shall not.
Equally: I shall (as available) use DoH, Do53, an= d perhaps even DoT on occasion, and I shall look down scornfully upon anyon= e who suggests that there is only one true DNS resolution transport.
<= div dir=3D"auto">
And I will lobby for DoH as &q= uot;better than extant, where available" =E2=80=94 and not hold my bre= ath for bolt-ons like DNSSEC.

-a



--000000000000787d260590a65ca2-- From nobody Wed Aug 21 13:26:05 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6804812002E for ; Wed, 21 Aug 2019 13:26:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=uniregistry.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KlKsz7MUYOce for ; Wed, 21 Aug 2019 13:26:01 -0700 (PDT) Received: from a-mx.uniregistry.com (a.mx.uniregistry.net [64.96.177.8]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2B3A0120091 for ; Wed, 21 Aug 2019 13:26:00 -0700 (PDT) Abuse: Forward to abuse@uniregistry.com with full headers X-Virus-Scanned: Content filter at a-mx.uniregistry.com Powered-By: https://www.uniregistry.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=uniregistry.com; s=bravo; t=1566419159; bh=JymXwajZbeWoyvb+621LJb4mPI2EXZTZURu4NPcK7OU=; h=Subject:To:References:From:Date:In-Reply-To; b=ekHfaxswUdB8wkyvCxIryxrjniBgdfnfLh9UkClm/1CUrYHWZmXklMVLqTuLPhdIO B0wKXTNQIVTuEqKWFJfD1r0pjJM5XRHEtHB6QatZjeoS/6/BZsYoeoP3E1SPdFKWFt 622j0woc2YzSot4qDdYKqwjHCa+xD4qvDZuR8AkdBSh2j/50PE+wk+ePflPhtQUfBG GddiD/92Jo4LYpERyTouUYQ1C2+UKBkk2+YWJAYSUddvlhDyzHS81P8hep9K6KerhH e6h7hgADMSE2mc6/4aTRmXpWyPJQv0xY1xnpbPuueAx4Lrri+B5VpTR2ikk8Vq3WMl 6IYD8LXqhINcA== Received: from PatrickM.local (b01.uniregistrar.net [52.204.70.64]) (authenticated bits=0) by a-mx.uniregistry.com (8.15.2/8.15.2/Debian-8) with ESMTPSA id x7LKPv6G047635 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NOT); Wed, 21 Aug 2019 20:25:58 GMT To: ADD Mailing list References: From: Patrick Mevzek Organization: Uniregistry Message-ID: <68e0e8f4-cd1b-f1a9-a44b-29541e02b021@uniregistry.com> Date: Wed, 21 Aug 2019 15:25:57 -0500 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [Add] FYI: regarding HTTPS interception X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Aug 2019 20:26:04 -0000 On 2019-08-21 14:43 -0500, Rob Sayre wrote: > "When making secure connections, Chrome trusts certificates that have > been locally installed on a user's computer or mobile device. This > allows users to run tools to inspect and debug connections during > website development, or for corporate environments to intercept and > monitor internal traffic. It is not appropriate for this mechanism to be > used to intercept traffic on the public internet." > > A recent change in Firefox does the same (importing OS-level CAs into its own trust store): https://support.mozilla.org/en-US/kb/how-disable-enterprise-roots-preference Firefox may display a TLS connection error when your antivirus software prevents data from being sent to your browser. This happens when your antivirus software fails to register itself with Firefox as a valid issuer of TLS certificates. Mozilla has added the Enterprise Roots preference to Firefox as a solution to the problem. This preference can be used to import any root certificate authorities (CAs) that have been added to the operating system to resolve your TLS connection error. You can determine if a website is relying on an imported root by clicking the Information icon from the address bar. With Firefox version 68, when a TLS connection error occurs, Firefox automatically enables the Enterprise Roots preference and attempts to connect again. If the issue is resolved, then the Enterprise Roots preference remains enabled. However, you may want to disable this behavior, so this article explains how to do just that without compromising security. As for MITM and Kazakhstan: https://blog.mozilla.org/blog/2019/08/21/mozilla-takes-action-to-protect-users-in-kazakhstan/ (same day and action as Google). -- Patrick Mevzek From nobody Wed Aug 21 13:41:21 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 29913120098 for ; Wed, 21 Aug 2019 13:41:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.299 X-Spam-Level: X-Spam-Status: No, score=-4.299 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CMjG4ziNHfZQ for ; Wed, 21 Aug 2019 13:41:18 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D75AB120091 for ; Wed, 21 Aug 2019 13:41:17 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id C7AB7BE50; Wed, 21 Aug 2019 21:41:15 +0100 (IST) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RgiXOX7348Mp; Wed, 21 Aug 2019 21:41:14 +0100 (IST) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 34102BE47; Wed, 21 Aug 2019 21:41:14 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1566420074; bh=HM//4JnNLlYWmAZUh+mYckhHGo61zwmhXX+0FaRkdH8=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From; b=TT5dDzdgq8dL9KZHlaKMIlj6Liu8LV1BjjvnPPoogar1Gl9k2U2H2DyeLteXo/uuN ILJqbXDkJzegkRDX+JdSX6fMWDwP0gO3KLyY5r2+7h5scVEGxZQwrZqOAdSVBCX/d6 ++1nmRft7e7TH9DnCPsrM5yd7Snh9QOEfH69byvs= To: Ted Hardie Cc: Eric Rescorla , ADD Mailing list , Jari Arkko References: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> <8f856492-f5da-9a02-f76d-67c2795b2ecc@cs.tcd.ie> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: <4505d6b8-0521-dd2f-245d-8fa73e2313c3@cs.tcd.ie> Date: Wed, 21 Aug 2019 21:41:13 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="eLkxbkGE7d8HsvFq0yBo6KsrULLttor7h" Archived-At: Subject: Re: [Add] What to do in this potential working group X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Aug 2019 20:41:20 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --eLkxbkGE7d8HsvFq0yBo6KsrULLttor7h Content-Type: multipart/mixed; boundary="dD5gsTSgxK5X8cRLo2hdTwO5DIIs3Pj31"; protected-headers="v1" From: Stephen Farrell To: Ted Hardie Cc: Eric Rescorla , ADD Mailing list , Jari Arkko Message-ID: <4505d6b8-0521-dd2f-245d-8fa73e2313c3@cs.tcd.ie> Subject: Re: [Add] What to do in this potential working group References: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> <8f856492-f5da-9a02-f76d-67c2795b2ecc@cs.tcd.ie> In-Reply-To: --dD5gsTSgxK5X8cRLo2hdTwO5DIIs3Pj31 Content-Type: multipart/mixed; boundary="------------CFDA1916C801991679898ADC" Content-Language: en-GB This is a multi-part message in MIME format. --------------CFDA1916C801991679898ADC Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hiya, On 21/08/2019 21:10, Ted Hardie wrote: > Hi Stephen, >=20 > Once small point: I'm honestly not sure if that's a small point or not;-) >=20 > On Wed, Aug 21, 2019 at 12:58 PM Stephen Farrell > wrote: >=20 >> >>> Your concern is that using DoH as a response to the first and second >>> attacks is increasing the risks related to the third. Is that >>> approximately correct? >> >> Perhaps not so much "using DoH" as (over-)concentrating >> queries. >> >=20 > I think it is important for us in this group to focus on areas where th= ere > is protocol work to be done or operational practice to change where it > relates to applications doing DNS. If you wish to write a document on = the > general topic of why over-concentrating queries to the common resolvers= is > risky, then I am not sure this is the right group for it. But that wasn't quite what I intended. ISTM clear that having O(1) TRRs in the world would be over-concentrated. I think it's maybe equally clear that with a different per-LAN recursive (which is kinda like today) it'd be extremely hard to authenticate those as TRR-like entities - so perhaps O(10^7) is too many TRRs. I do think considering "how many TRR-like things would be good" is a relevant (research?) question that could affect protocol design and implementations and deployments. For example, if there's an answer at all and O(100) were that answer, that might change how a DoT/DoH client might usefully spread it's queries over those vs. if the answer were O(10^4). > And I personally > think the risks are actually quite different for DNS over port 53 than = for > DNS over DoH or DoT, as the primary risk of observation or active MITM > attacks looms much larger there (and is made much easier when there are= > common destinations). I agree. (As I said concentration is not the only valid concern.) Cheers, S. >=20 > regards, >=20 > Ted Hardie > (as an individual contributor) >=20 >=20 --------------CFDA1916C801991679898ADC Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------CFDA1916C801991679898ADC-- --dD5gsTSgxK5X8cRLo2hdTwO5DIIs3Pj31-- --eLkxbkGE7d8HsvFq0yBo6KsrULLttor7h Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAl1drGkACgkQWrL68XsX K+oBgBAAs3WFzdVrNx+ttz7LlqVUEi5DxWd15sK66U9Usxu/m9QBQeYTL8zE3o9u NiznYVH46NztRrkPqTfhURX6U+BH84PVeRrzdMSwG0F0Q1W5x41FL/cyahfijYcw BKkulEfFSWHpN6NencZErMzDHase+MXjLcecorB3a4VJtaMHvc1ftTpfskXHBN8Z ZF1XqpkzG5KX5vEuGaUfs3DSc3M967nHXGZHth2zZBLPoE2AjTbJvhDghc4974bi 76lHnMeqgU2flYi2OBClNfSFqCHXAftETDmXlVwcLR0Kzd19NNf6xqkyWpDLMGYm nlrLS/LBj9YPZAMthDunssIDkPmFwx9EQnTvUVWgn9OzJMcgzFQzSZEuzipGYbaE vs3MCvvNVUxEqr26W1U+GRgm4PVxI0D7Vd6AcIr5FPAsFyqX3ZNG6WkyARk8GmYx kDUZvYeYZ1/xipXgSTeuV4nw27u4M8M23sMaCFg32Sq20eX4Dh741k6zQwHkCrrw 8hSmA05PQO+ARVOB7no8A38EB6UDPln8RvWO+ad5F/Pf4U4MHzOT9iJGcGeQFeP/ H9noksBpMWrJNMwsH2wv2pWKFahA/Db2y+6T4ufzgJtu4xdLQnGQEhgJ63yBpwAi qvDh7xt/mBqpCj4StttiOHceYVd1SzooWq5et3Mb+xhISYigc58= =QMLv -----END PGP SIGNATURE----- --eLkxbkGE7d8HsvFq0yBo6KsrULLttor7h-- From nobody Wed Aug 21 14:04:56 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D9C96120091 for ; Wed, 21 Aug 2019 14:04:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=virtualized-org.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id na8fQD_vEPYD for ; Wed, 21 Aug 2019 14:04:53 -0700 (PDT) Received: from mail-pf1-x432.google.com (mail-pf1-x432.google.com [IPv6:2607:f8b0:4864:20::432]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1727512007C for ; Wed, 21 Aug 2019 14:04:53 -0700 (PDT) Received: by mail-pf1-x432.google.com with SMTP id b24so2271611pfp.1 for ; Wed, 21 Aug 2019 14:04:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtualized-org.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc:message-id:references :to; bh=EsyRIVqdps1CXDK4j2Ob3JxM7oq0/62ieQJ67KHFyvc=; b=AZVEV5VzowsnNWZUgaLNkrV57BHHxpd3jLZX2f+kRkdgVavZB6enmpMfKjU1u+vDwl qy7tfVnQj3dC0s+ftkOP5xUpK1jjqvPM76MmmSoo93y1jtFu1ELW+ZQQ+RD/69lPB9xn PMVvt6CVXOgtPFhHRr+9k99YYBis/f+S7QsLW6FoUhq26PE7HzL0YSsSlW3vlh4FVDaj 3f9+VtN+r3rpl9cRwkpYyeUIdCYC1Fb71I6SSoYsfQx4fz10rXaNnxm5Eh+BMpzEs2qu aJZPyMqaVNCZDkDh96t0/r9YhhVRBdk0UO2CUsHtLZjm7s4QzPMS4/NRcPoj0YcZvvSv bjBA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :message-id:references:to; bh=EsyRIVqdps1CXDK4j2Ob3JxM7oq0/62ieQJ67KHFyvc=; b=Flak8G5RRIdPWMYerT+G9jau8QSbJ7YoImRoFUTNoPHAOwcpKAj+uvLOnVR7ta3I2Y b5ItPMFMeZG3NzEj7doSiOsut1Std22Syg9fKlrOyX/ahNbPR5cmihAaa3qKaM8R9ZbC LrtagTsDARITTVt1UEUGbJJ4dwGP0dJRl7jYJ/kkMmFf4RJADz0rLTVeGOAQgJgzlBjw GcKqlJQX5w/f3rPuzfHtAlobh0uUohRt4VL+XUWrHnzkz+fXzfP0b2xRdOTwH5SPS0VC SyrCCWXAOmcEHYP6PgsbYHh0Jmy5QZPchzAYvUIOzz9W+NyySViPx3ZPKu1DO2HpE8oD F1fw== X-Gm-Message-State: APjAAAU4tUJYohkV4LDWvlCZMZFZE1jV0CZT7jxKs/zquTVn2dIUq1mn S/yFFn5dgIsa6Y0tIbTQ+hC0jA== X-Google-Smtp-Source: APXvYqxpPFZban2rjiMFlnz++BQH62VgPO4cQh1pBMr1SIjs67PVVKglUbFfe+OvbI5fqn+dLQ+UBw== X-Received: by 2002:a17:90a:de02:: with SMTP id m2mr1983451pjv.18.1566421492642; Wed, 21 Aug 2019 14:04:52 -0700 (PDT) Received: from ?IPv6:2620::2d0:110:a001:9cbc:6eb4:c2df? ([2620:0:2d0:110:a001:9cbc:6eb4:c2df]) by smtp.gmail.com with ESMTPSA id e17sm943745pjt.6.2019.08.21.14.04.51 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 21 Aug 2019 14:04:51 -0700 (PDT) Content-Type: multipart/signed; boundary="Apple-Mail=_E99A8D52-03CD-4330-AC22-1CC77982D104"; protocol="application/pgp-signature"; micalg=pgp-sha512 Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) From: David Conrad In-Reply-To: Date: Wed, 21 Aug 2019 14:04:50 -0700 Cc: ADD Mailing list X-Mailbutler-Message-Id: 8C19922D-D1DA-4766-8ECC-EEFD9A5AC8D8 Message-Id: <589DAFCB-1BDC-4156-A2CA-179C4559A6B2@virtualized.org> References: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> <59E0EC53-0E30-431C-8376-52C7BFC121A8@virtualized.org> To: Alec Muffett X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] What to do in this potential working group X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Aug 2019 21:04:55 -0000 --Apple-Mail=_E99A8D52-03CD-4330-AC22-1CC77982D104 Content-Type: multipart/alternative; boundary="Apple-Mail=_EA73051C-D571-44ED-BDCC-602D43849496" --Apple-Mail=_EA73051C-D571-44ED-BDCC-602D43849496 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Alec, On Aug 21, 2019, at 1:24 PM, Alec Muffett = wrote: > On Wed, 21 Aug 2019, 19:17 David Conrad, > wrote: > Further, you cannot ensure to the end user that the =E2=80=9Ctrusted=E2=80= =9D resolver operator has not tampered with the data, be it due to court = order, internal attack, software bugs, etc. > But you can assure that it is a response from the resolver which you = chose (contracted?) to deal with, rather than some happenstance = resolver. If your interest is ensuring that the DNS data the client is receiving = corresponds with what the authority for the domain inserted into the = zone, what you are assuring is essentially meaningless, regardless of = which resolver you talk to. Actually, given TRRs would be concentration = points, the situation is arguably worse than if you used a happenstance = resolver: what would happen if the TRR you contracted with is subject to = a court order under seal that requires that TRR to modify responses for = particular domains? How would you know? DoH is channel protection. Can we please stop suggesting DoH addresses = data integrity? Regards, -drc --Apple-Mail=_EA73051C-D571-44ED-BDCC-602D43849496 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Alec,

On Aug 21, = 2019, at 1:24 PM, Alec Muffett <alec.muffett@gmail.com> wrote:
On Wed, 21 Aug 2019, 19:17 David Conrad, <drc@virtualized.org> wrote:
Further, you cannot ensure to the end user that the = =E2=80=9Ctrusted=E2=80=9D resolver operator has not tampered with the = data, be it due to court order, internal attack, software bugs, = etc.
But you = can assure that it is a response from the resolver which you chose = (contracted?) to deal with,  rather than some happenstance = resolver. 

If your interest is ensuring that the DNS data the = client is receiving corresponds with what the authority for the domain = inserted into the zone, what you are assuring is essentially = meaningless, regardless of which resolver you talk to.  Actually, = given TRRs would be concentration points, the situation is arguably = worse than if you used a happenstance resolver: what would happen if the = TRR you contracted with is subject to a court order under seal that = requires that TRR to modify responses for particular domains?  How = would you know?

DoH is channel = protection. Can we please stop suggesting DoH addresses data = integrity?

Regards,
-drc

= --Apple-Mail=_EA73051C-D571-44ED-BDCC-602D43849496-- --Apple-Mail=_E99A8D52-03CD-4330-AC22-1CC77982D104 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEzEaOGlQw4bcyWBNfoCss/bh3zPcFAl1dsfIACgkQoCss/bh3 zPcm4A/+N6gBeTDflBqvWoMoLC2jZ5iPUc4NYF7+w7gXi5k+BJ2ebzlYY4A0XI0J TOnHFqGlI3GQkslQWSPlFb0jDzxoCzu66INrU2j74Ms5W/bicrAl7WniQAnMFg/h BfgQ+uxCeSfwp+MJet3RlmXOYWO/o1n7Mt27S6hcIn+bTAnOGmHNcMUgCMn4Y7jH 4ScxlbMZ89cExWqqsLWGAvjLIxlILxF2Tb3j41BFjbeP4J2KbB6aFl90sEfZicyR MKf2gYSwRNCRmcr1GB1v3jYvnVF74++aoPqQQK1vGvpRIrrMMJhieTexCJ3jbia4 fKrrgFvPK4ySSF5X58gASXGSo4+j0WjqiVrw8eb5KdQyEvLl5jKwe3CYqbknm1Bp aFbwcRQIxKMpi+tyqMtuRYoJDdPsIzYCGV3ytwcv230QSwbdfJrySHBu1Uowz+Eu AK7vV8cUo3Mh3DQ72IqMMO0ygjb43uRtV/Xwc66A/UPjOg0SeZbVV0pTrfBRIDgY lvQX79VWzdpN61hxl8T+Ov6BUBYl4CXwGPGYuJ7Inj/xIJ8qK1ak7J/8MFiSvdut DfW/kJ/6AvOIdr1XV1+NEmy8rXabWBNpBmwi/zXWd0ozURFYLMfYV+gNS+uA8j+k pN76tiKHgLWT2JWPIUCVrMfEFOXWjnWnu2DShPq5N03YzHM89gQ= =pmjD -----END PGP SIGNATURE----- --Apple-Mail=_E99A8D52-03CD-4330-AC22-1CC77982D104-- From nobody Wed Aug 21 14:08:44 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2294C120168 for ; Wed, 21 Aug 2019 14:08:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dIWZpwAClwtx for ; Wed, 21 Aug 2019 14:08:26 -0700 (PDT) Received: from mail-io1-xd35.google.com (mail-io1-xd35.google.com [IPv6:2607:f8b0:4864:20::d35]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7287D12007C for ; Wed, 21 Aug 2019 14:08:26 -0700 (PDT) Received: by mail-io1-xd35.google.com with SMTP id j5so7512381ioj.8 for ; Wed, 21 Aug 2019 14:08:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=XfrZrylVmDwXrob0cyT/3ZiD25WdPqW8Y1alwzdqPrY=; b=sYaznRubN67PZ/1cRop+4NdQD5gWJ3lNvLOjkombXPUM12Lg5O98MgtSy1rBnWqGjR 4sNIkIvxbiw2VHTsw9UIRtpqS7BTpfgolX6o6Vc5mYTY4aj2eOV0HAKBuKKwmWMSiAMv r1xEX0PHeRedEhWQGqAPkpCBdmcaBfM9ntubZhDf/tD2wjjv68stzJdXG24mRXrDBqRJ uWNNaMJrjuPe57UR5yQ4dgr1vOutaqCSeYyJ1lEP09z0QpK4kynCvnpZZQXLQRfCKw1/ CHO54Uz1hpdxF37Shs4hReF9xa97OWOdB2A2PhUZBFRjKuaLjWf5a+ll47F2F4E5b51y qtwg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=XfrZrylVmDwXrob0cyT/3ZiD25WdPqW8Y1alwzdqPrY=; b=NUS19ezgZS9cqwxsdOp9hhnX0LjX70wOm9BI3EG4R4upTPu7zeLWZKuV0Sqd0Rbg81 bVPjmecRKcvPM22CvmaumPMVXSJ/RWQfFdgxcRcx+dHm9qIceoZvOh1yI2XAmS3ya4s3 /r0SNh48xl90gZHgcANEOePOKrgdBw/0JBlwS5zdf4lCKPnJ2JhuNypJSZUW8kPiuUzs JGxLugsQF47Thfk+3iYW2uHcICyhnsmqvYogke3lkn6NlPrXDvL2UJm+cB3PTsTyMZT2 lraBqjE6/ix+HO9k9fTGKrABvQeqqf0tiIxiTdPmzPyzL12BN99iCBSnoiQzoG7ctbSk akdQ== X-Gm-Message-State: APjAAAUOfgzb0dqCSueG81hFMEkYa5Bd6HYmv9LaH3rVj5eWbxPqwq+p ycoUYzijqyrBEDA5QB9HhWR/LG/QPnyGrcj0Z3c= X-Google-Smtp-Source: APXvYqw7lnhQTjpCc5lldGrvgYFBRvj9MUkQ0aFiJjUL6UcHkyL0pPPU/X9QvtybtEEcfVIWAj4K6vZi9DBQ28ZFjA8= X-Received: by 2002:a5e:9b12:: with SMTP id j18mr1693018iok.54.1566421705564; Wed, 21 Aug 2019 14:08:25 -0700 (PDT) MIME-Version: 1.0 References: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> <59E0EC53-0E30-431C-8376-52C7BFC121A8@virtualized.org> <589DAFCB-1BDC-4156-A2CA-179C4559A6B2@virtualized.org> In-Reply-To: <589DAFCB-1BDC-4156-A2CA-179C4559A6B2@virtualized.org> From: Rob Sayre Date: Wed, 21 Aug 2019 14:08:14 -0700 Message-ID: To: David Conrad Cc: Alec Muffett , ADD Mailing list Content-Type: multipart/alternative; boundary="00000000000054272c0590a6f959" Archived-At: Subject: Re: [Add] What to do in this potential working group X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Aug 2019 21:08:30 -0000 --00000000000054272c0590a6f959 Content-Type: text/plain; charset="UTF-8" On Wed, Aug 21, 2019 at 2:05 PM David Conrad wrote: > > DoH is channel protection. Can we please stop suggesting DoH addresses > data integrity? > I think the issue is that the various DNS WGs have left DNS unencrypted for 30 years. So, while a lot of these arguments have valid points on both sides, the results are obvious. thanks, Rob --00000000000054272c0590a6f959 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Wed, Aug 21, 2019 at 2:05 PM David Con= rad <drc@virtualized.org> = wrote:

=
DoH is channel protection. Can we please stop suggesting DoH addresses= data integrity?

I think the is= sue is that the various DNS WGs have left DNS unencrypted for 30 years. So,= while a lot of these arguments have valid points on both sides, the result= s are obvious.

thanks,
Rob=C2=A0
--00000000000054272c0590a6f959-- From nobody Wed Aug 21 14:10:43 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DA888120098 for ; Wed, 21 Aug 2019 14:10:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Xh5EbgTmTXFJ for ; Wed, 21 Aug 2019 14:10:40 -0700 (PDT) Received: from p130.piuha.net (p130.piuha.net [IPv6:2001:14b8:1829::130]) by ietfa.amsl.com (Postfix) with ESMTP id 2D758120091 for ; Wed, 21 Aug 2019 14:10:40 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by p130.piuha.net (Postfix) with ESMTP id C3A6C6600CB; Thu, 22 Aug 2019 00:10:38 +0300 (EEST) Received: from p130.piuha.net ([127.0.0.1]) by localhost (p130.piuha.net [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9nSbpCK6CYzy; Thu, 22 Aug 2019 00:10:37 +0300 (EEST) Received: from [127.0.0.1] (p130.piuha.net [IPv6:2001:14b8:1829::130]) by p130.piuha.net (Postfix) with ESMTPS id 259996600AD; Thu, 22 Aug 2019 00:10:37 +0300 (EEST) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\)) From: Jari Arkko In-Reply-To: Date: Thu, 22 Aug 2019 00:10:36 +0300 Cc: Eric Rescorla , ADD Mailing list Content-Transfer-Encoding: quoted-printable Message-Id: References: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> To: Ted Hardie X-Mailer: Apple Mail (2.3273) Archived-At: Subject: Re: [Add] What to do in this potential working group X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Aug 2019 21:10:43 -0000 Thanks for your email, Ted. Your questions are useful and can help us = understand the situation better. > The third threat model is that the use of a single large common = recursive resolver mitigates against attacks which track resolution = events at the authoritative servers (since there are common cached = replies), but results in that large common recursive becoming an = attractive target for unsavory business practices, court orders, and = infiltration attacks. Because of browser fingerprinting techniques the = available information may be larger for DoH than it would be for other = clients. >=20 > Your concern is that using DoH as a response to the first and second = attacks is increasing the risks related to the third. Is that = approximately correct? Yes, but only approximately. There are multiple factors at play, one is = use of encrypted transport and the other one is the degree of = centralisation of users=E2=80=99 queries. And some other factors, such = as to what extent various parties can change the situation, what the = majority of Internet users will be doing based on defaults, etc. But the main issue that I have is centralisation of DNS queries to an = administratively single entity. This is actually an issue even without = DoH, but the potential introduction of new defaults and DoH makes the = situation more acute. I do want to underline that there are obviously great benefits with DoH, = and even some benefits with centralised DNS setups. But I=E2=80=99m = concerned that if we look from a privacy perspective, the = default-to-quad-n setup seems=E2=80=A6 shall we say suboptimal. Let me make this a bit more personal. I live in Finland, where there is = in practice no or very little DNS filtering. My favourite = privacy-sensitive browser will today ask my network/my ISP network for = DNS resolution services, and the entire process (at least if cached) is = local within organisations that I have a contractual relationship with, = and who I trust. Now, imagine that the next version of the browser comes = with by-default quad-n/doh setting, and now the browser will be = contacting a different server that I have first of all no relationship = with, and who is very likely either outside Finland or at least = administratively controlled by an entity residing in a five eyes country = that Snowden revealed performs extensive and indiscriminate = surveillance. I know personally some of the people who run some of the = global DNS services and have the highest trust on them. But, even they = aren=E2=80=99t immune to laws, governments, and various surveillance = techniques. I will have to assume that my queries are being tracked. On = *every click* that I do on my browser. You can imagine that I don=E2=80=99t like that situation. I can of = course change my settings, but what about my mom or the million other = people living nearby? I would consider such browser behaviour = essentially spyware. I realise that I=E2=80=99m using a heavy word; I = don't use the word lightly but I think that=E2=80=99s a very reasonable = description of what=E2=80=99s actually happening. But onwards to happier things. First, wouldn=E2=80=99t it be great if I could get DoH to work with my = ISP? What other things would that require than my ISP=E2=80=99s action? > If so, I think there are practices that we might develop and recommend = (e.g. selectively sending queries to different trusted resolvers) Indeed. I don=E2=80=99t think the the only answer is default quad-n (or doh). I = suspect that there=E2=80=99s others things that could be pursued, if one = wanted to preserve privacy, *not* collect huge amount of data, and still = want to provide better confidentiality. Starting from not sending to one = place but say a collaborative large-ish group of services. Or not = sending queries to overseas entities to begin with :-) > and some of those may also touch on the split DNS issue. My modest = experience in this realm suggests, though, that experiments are the only = thing that would tell you the impact of those practices on latency, = correctness, and leakage. So I'd want some indication that folks are = willing to run those experiments before taking on that work. I think step one is recognising that we have a problem. And having = willingness to care about that problem. Step two is thinking about = potential approaches to mitigating problems. There may be experiments to = be run as well in step three, would be happy to see that. At least if = that was not happening as a side distraction to keep as IETFers happy = while the business world is busy switching the entire Internet DNS to a = centralised model... Note also that my particularly worry is about privacy and surveillance, = and I think the filtering/control/split DNS etc issues are complex and = will take some time. I think. Jari From nobody Wed Aug 21 14:11:14 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 71C0C120129; Wed, 21 Aug 2019 14:11:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=netorgft5189650.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jGx9cW3mpdZT; Wed, 21 Aug 2019 14:11:09 -0700 (PDT) Received: from GBR01-CWL-obe.outbound.protection.outlook.com (mail-eopbgr110084.outbound.protection.outlook.com [40.107.11.84]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2843D1200EB; Wed, 21 Aug 2019 14:11:09 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=Kkoxd6ItuL6a1vsNw8KTRrLsVosN5rengacIU2weSq0NPnwM8fkHjkk3J8dSCPLoYkR832b88UGyZi+HgHhV8K1t30IrL4Cc6y+GSbT+FCzWOFkmZ8Fa6+qpxcjz05iCNS5rTVg46Rc4ivEG+Htm/yAFmGlcg3Jc/0xjqyx6gLH2EnQt8fmHaPXrsrGEt6Y7lbb+SY8lnJ60cR28N15JgpgfMYE4XwPkLpoK1YlRN8+Yo/ucZVFdSfNrvsAjk5kv0vY5NHmpHD7/OeRdsMbUIN1kNF+nzj65/3WlXeJJs9RpYQdR/V1TSQFQFxYFN28JYTmY8zY1jXNaoNz2/gSMGg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=zPkr9ud0CLRsLWGQnoGdvLLuZ/9TOypmuF6fdSqVkS0=; b=M3mYK/NYqI4HKHQUj2++njmnFGAR+EVY/k+WTMcQ04wc4VC0041UCGFO3AYPWTOORQVADiLzjGKMaLfSU/9+t3ueDrzDP9VbotyMYcQ6M9qwZYWMi/RH9Z5C0XvtN0LU4dILDWCO2UBqmgWqQdL72qqI62afgPhA/9K7QjFKYZb4ReteziRx/1xHokySeb15tbSJAblOpCxuY9bPqt32IG0WjrkynzVyTws9Ftze7heETJeKiSIzZlbtwumiRMRY+WikQrF0XOK0hHu1MEOSIGae9ms5ScK0qWE6xFPXhgR0lKNGL79+Gv5lG75GrhEv/GtzEKZi+JGb43biYw1ipw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=419.consulting; dmarc=pass action=none header.from=419.consulting; dkim=pass header.d=419.consulting; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=NETORGFT5189650.onmicrosoft.com; s=selector1-NETORGFT5189650-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=zPkr9ud0CLRsLWGQnoGdvLLuZ/9TOypmuF6fdSqVkS0=; b=GoYwaUViLKt+wN390q1X1GjhSq6WRgAFtSyaHxf82IMXfp/3JG9Hb9eOtGesUU/Y4tRslnkXmnqO9D5kl4nzRD1+cZwL7fnv8JS9W9cz+jKq1AJtya+OeRXKep7nA/ohvKIql74YMZ+Q3hGcIYP3iN4nF4rL3WrwKIRhJEP6XWc= Received: from LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM (20.176.138.146) by LO2P265MB1613.GBRP265.PROD.OUTLOOK.COM (20.176.139.21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2178.18; Wed, 21 Aug 2019 21:11:07 +0000 Received: from LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM ([fe80::64e9:9b9e:59fc:26f]) by LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM ([fe80::64e9:9b9e:59fc:26f%5]) with mapi id 15.20.2178.018; Wed, 21 Aug 2019 21:11:07 +0000 From: Andrew Campling To: ADD Mailing list , "doh-request@ietf.org" Thread-Topic: DoH discussion at UKNOF44 (the UK Network Operators' Forum), 10th September 2019 Thread-Index: AdVYZPIAeHAjN3NrQpWXnPfm4Zke3w== Date: Wed, 21 Aug 2019 21:11:06 +0000 Message-ID: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=andrew.campling@419.consulting; x-originating-ip: [2a00:23c4:a499:2e00:75a8:a800:6507:148e] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 916bfc78-3d4c-4245-300d-08d7267c1540 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(7021145)(8989299)(4534185)(7022145)(4603075)(4627221)(201702281549075)(8990200)(7048125)(7024125)(7027125)(7023125)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:LO2P265MB1613; x-ms-traffictypediagnostic: LO2P265MB1613: x-ms-exchange-purlcount: 3 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-forefront-prvs: 0136C1DDA4 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(366004)(39830400003)(376002)(346002)(396003)(136003)(189003)(199004)(53936002)(52536014)(316002)(790700001)(71200400001)(110136005)(71190400001)(6306002)(33656002)(55016002)(74316002)(450100002)(81166006)(76116006)(81156014)(7736002)(102836004)(86362001)(25786009)(6246003)(229853002)(9686003)(2906002)(236005)(8936002)(66946007)(66446008)(606006)(64756008)(66556008)(66476007)(508600001)(6116002)(21615005)(186003)(53546011)(54896002)(486006)(256004)(14444005)(14454004)(6506007)(8676002)(6436002)(476003)(44832011)(46003)(99286004)(5660300002)(7696005)(2501003)(966005)(46492003)(5378815003); DIR:OUT; SFP:1101; SCL:1; SRVR:LO2P265MB1613; H:LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: 419.consulting does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: Lop5cwcp9vgtkCdD1WtY7PkM3kbC7y58NZlra0VCzehB19efjtPAPcubsQGd3fqCD/1E90NKwhr1BUP0nOinFkvZEU8+k+4h3SHJ6ONKMznEzGMDIbue9JhaRcRf54QCMAuphVU/0JB/TsNUivJ4Aav3o6uvUjBL4RC1nS84wSC9aTPW8gCPa53jwSX5/JpsDEeqnXrUngtiqVgSD26YCkQuV/L7T00Ycqf8tpr0+nCEMlm2jhsmGGgShvcELpzvG/LiYk6zWWa+mxsk2RflLFFzUf/6Ixs4GPGpYAxpxg5BHEAl/clTDCjYdmlbG4EbsTmZN9Nq5GL/wfuDluYwt1G9FVED6RhxF56zSpVhiaGO30onwpnlM9Ll9mdCKO4NPgMf6GbPCqxxZFExWWuN6cSynu8VQB/1fYtrjFYFv7s= x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_LO2P265MB1327484EEFDC1D79E4B60BDEC2AA0LO2P265MB1327GBRP_" MIME-Version: 1.0 X-OriginatorOrg: 419.consulting X-MS-Exchange-CrossTenant-Network-Message-Id: 916bfc78-3d4c-4245-300d-08d7267c1540 X-MS-Exchange-CrossTenant-originalarrivaltime: 21 Aug 2019 21:11:06.9603 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 9c2ced3e-7522-4755-87dc-f983abc66ec3 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: 1umro0ZWMnRIzoeKofDRH0VMFC/IvpUII4gOw49R5FvOZOzKQVV6fokcjBdy/nC0nMKAFSGVW02VRqdp5kYcC/ifdY5s5S1DD7O3ICd7iko= X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO2P265MB1613 Archived-At: Subject: Re: [Add] DoH discussion at UKNOF44 (the UK Network Operators' Forum), 10th September 2019 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Aug 2019 21:11:13 -0000 --_000_LO2P265MB1327484EEFDC1D79E4B60BDEC2AA0LO2P265MB1327GBRP_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable In response to questions about streaming of the UK Network Operators' Forum= for those unable to attend in person, the details are: Webcast: http://uknof.bogons.net/uknof44.html (live on 10 September) IRC Chatroom: #uknof@irc.terahertz.net Twitter hashtag: #UKNOF44 Andrew From: Andrew Campling Sent: 21 August 2019 17:01 To: ADD Mailing list ; doh-request@ietf.org Subject: [Add] DoH discussion at UKNOF44 (the UK Network Operator's Forum),= 10th September 2019 Those on this list that are based in the UK or Europe may be interested to = know that DNS in general, and DoH in particular, are being covered in two p= resentations and a panel discussion at the UK Network Operator's Forum in B= elfast on 10th September. Details of the event are available via https://i= ndico.uknof.org.uk/event/47/, it would be great to meet a few people from t= his list there to discuss some of the issues face-to-face. NB I've no connection with the event or its organisers, other than as a hum= ble delegate. Andrew --_000_LO2P265MB1327484EEFDC1D79E4B60BDEC2AA0LO2P265MB1327GBRP_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

In response to questions about streaming of the UK Network Operator= s’ Forum for those unable to attend in person, the details are: 

 

Webcast:=  http= ://uknof.bogons.net/uknof44.html (live on 10 September)
IRC Chat= room: #ukn= of@irc.terahertz.net
Twitter = hashtag: #UKNOF44

 

Andrew

 

From: Andrew Campling <andrew.campling@419.consulting>
Sent: 21 August 2019 17:01
To: ADD Mailing list <add@ietf.org>; doh-request@ietf.org
Subject: [Add] DoH discussion at UKNOF44 (the UK Network Operator's = Forum), 10th September 2019

 

Those on this list = that are based in the UK or Europe may be interested to know that DNS in ge= neral, and DoH in particular, are being covered in two presentations and a = panel discussion at the UK Network Operator’s Forum in Belfast on 10th September.  Details of the ev= ent are available via https://indico.uknof.org.uk/event/47/, it would be great to= meet a few people from this list there to discuss some of the issues face-= to-face. 

 

NB I’ve no co= nnection with the event or its organisers, other than as a humble delegate.=  

 

 

Andrew

 

 

--_000_LO2P265MB1327484EEFDC1D79E4B60BDEC2AA0LO2P265MB1327GBRP_-- From nobody Wed Aug 21 14:13:17 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EAC79120098 for ; Wed, 21 Aug 2019 14:13:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XNaMjILuVcie for ; Wed, 21 Aug 2019 14:13:13 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 899FE120091 for ; Wed, 21 Aug 2019 14:13:13 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id A97E2BE50; Wed, 21 Aug 2019 22:13:11 +0100 (IST) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JQfnCc-aTups; Wed, 21 Aug 2019 22:13:10 +0100 (IST) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 207A2BE55; Wed, 21 Aug 2019 22:13:10 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1566421990; bh=XQj3JRU2ZHuGH7UBj0RBYqI0CcENo1ShIVEgLLtCpjI=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From; b=Wd5VNYVRyWGKen1wiaOOxvLmsoHZPt2yxH/tp6CPLPZzyDj1tHOfWtdgT1c8MHSJ5 PFB7B+GH93uyqwHPg7r91k5+jG0CzY8xodOgmDCR5k7Pbu5vZvIrQxtlFbCvwRtWC+ tldzZZciZIWbQt9/kuddoV2OWhmtQv8lYs9Iyn9U= To: David Conrad , Alec Muffett Cc: ADD Mailing list References: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> <59E0EC53-0E30-431C-8376-52C7BFC121A8@virtualized.org> <589DAFCB-1BDC-4156-A2CA-179C4559A6B2@virtualized.org> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: Date: Wed, 21 Aug 2019 22:13:09 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: <589DAFCB-1BDC-4156-A2CA-179C4559A6B2@virtualized.org> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="veNH1aBnDARHspm2joXjKzuHFjtEiNB6L" Archived-At: Subject: Re: [Add] What to do in this potential working group X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Aug 2019 21:13:15 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --veNH1aBnDARHspm2joXjKzuHFjtEiNB6L Content-Type: multipart/mixed; boundary="rGi8Gi1mTdxmSoZJg4fCJqKuMR76hKhy7"; protected-headers="v1" From: Stephen Farrell To: David Conrad , Alec Muffett Cc: ADD Mailing list Message-ID: Subject: Re: [Add] What to do in this potential working group References: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> <59E0EC53-0E30-431C-8376-52C7BFC121A8@virtualized.org> <589DAFCB-1BDC-4156-A2CA-179C4559A6B2@virtualized.org> In-Reply-To: <589DAFCB-1BDC-4156-A2CA-179C4559A6B2@virtualized.org> --rGi8Gi1mTdxmSoZJg4fCJqKuMR76hKhy7 Content-Type: multipart/mixed; boundary="------------2BCA41279B42D1256B7E543E" Content-Language: en-GB This is a multi-part message in MIME format. --------------2BCA41279B42D1256B7E543E Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On 21/08/2019 22:04, David Conrad wrote: > DoH is channel protection. Can we please stop suggesting DoH > addresses data integrity? IMO you're both right but not quite using super-precise terminology:-) DNSSEC provides origin-authentication and data integrity for DNS answers between the signer and validator. If the client validates the TLS server cert, DoH provides TLS-server authentication, confidentiality and data integrity between the TLS client and server. So yep, both give data integrity, just differently. I think that was already said in the recent storm of mail as well:-) Cheers, S. --------------2BCA41279B42D1256B7E543E Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------2BCA41279B42D1256B7E543E-- --rGi8Gi1mTdxmSoZJg4fCJqKuMR76hKhy7-- --veNH1aBnDARHspm2joXjKzuHFjtEiNB6L Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAl1ds+UACgkQWrL68XsX K+o89w/7Bx9lOQnWGbTo/W/0PbqcqpLpd9KgnfikAK9IjShA2GPsVFS7NzsdF35g sIY8AKUtnHJmjKp7gZWuxuBbg87ZzEOQ6XqIAzlGl7Wn9VssZ0uY1M9eKpAXGvuF +z1PWabKR/c5jtiitpgInfyCLwVN3MCEQYYyTE48y7mj/NdG0e5L8EvQZrRwdVx8 SmgLLqLBl4ppnxMQQutlTo6G7AsKvW3KmqDK63XVRIHgpfa6jS1vXfdgVskObfi/ sxZeSaBjZv36jo68dv+MLrx+5aHUsFOcf5KP/YY7n1VVyLfPDLIyRR4NYmEFL8d7 532g4CiOyPENkA6HGZEPvTJEPtP9LZLT4OF1d0YG02IwXmw15zaqtD+rQpDGPQMi 8S2S2nIgQOXJiMYRIHFJOeHUdHbMiHMzQB26F8IUk891T6crNPxebaZiOjVW29fj utuTL6DlkB1NFytpWQjkmEKE3KH+14tdWsduVhqZmJmCtmZUxsi1jLEG+g/UipNI 3j2OGMQgfD83DiuFoznBRH9TRXc3uFRkHDWPXJPkCyPtzzyCGxEewrC8Hff0igL0 oGQlRPsTHpgwiITbzEdg6GPNobdF/IAm8260rmJpybkWEU9xsJuwiY8y5CXP+czO lzLjCyHBwrLEAeYSgjcZRWrqLQA6LM5Jul2q7PxQJk/jA0WOBsU= =pRe9 -----END PGP SIGNATURE----- --veNH1aBnDARHspm2joXjKzuHFjtEiNB6L-- From nobody Wed Aug 21 14:26:15 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6CC2312081E for ; Wed, 21 Aug 2019 14:26:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kLHl9gGF0AgB for ; Wed, 21 Aug 2019 14:26:05 -0700 (PDT) Received: from mail-yb1-xb34.google.com (mail-yb1-xb34.google.com [IPv6:2607:f8b0:4864:20::b34]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C890612080D for ; Wed, 21 Aug 2019 14:26:05 -0700 (PDT) Received: by mail-yb1-xb34.google.com with SMTP id h8so1619893ybq.9 for ; Wed, 21 Aug 2019 14:26:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=hePCjxWevwiyqmZl2kkcUWafAN/EOd++UgFbz/0FHD8=; b=H9N/fVSL4a9svidNspdD981tQJO/oRuZHOygnYejFIiSkfRZQ9uAd+RHVIo3nAGzeR LHe/d7GrC3P84eeQmRuHwaIX5FGMVLh6CCofB6Z2NxxUUb7gxAMVvUPcETnAm7+eL7g4 f+LAHRDzCRP50K+UiOximdv32RRC48qQFjmpabig3DXuYEW9pu/Ansr5Upioqsha3jz1 Z+EpGcIsrWhknBxPoLB9jiqSleV+r9B8a/le2RGEzXbgDbn2DGZGipG8dlsY44fc+MhL p8Vnx3KDu2h5tP7olOLJ293YA6wJhTVTnv0lSJkymX1VV3kPwld5QWl9j3oVPyaAqaF8 Kc6Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=hePCjxWevwiyqmZl2kkcUWafAN/EOd++UgFbz/0FHD8=; b=NqjX9Bgl8pgQqdP6UQU+dESb0xoR64wVRExDkNid0MaKUgsJZt2oebFiu2+NtOvjaQ G9qgNGR1V6Godp6tXq1LIHM3pVbTE2ARYwmxazv8dtGv3AUsf4uWp8Gz/NM58hc3txxA JSSrdJccx27oaNBtr8SbSKX9WN/n8FuMKUpmOF8eLVnl/BWiH5q4Pd3/XOl7jJ7KCFsZ FpDhqd4GAbaFnO9fZbyENQFS4IE+fynIwYykBODkwG9Y1eaM/WAAQ83QmsdhQ4xJSPoK bIl96JUwBeQiFMgkAeCqyifLgpHRQPT53sPE6qUvc/a37Wt2C7TAMukJJfHVXEliJ4t5 BVKA== X-Gm-Message-State: APjAAAVnUjxGsM8N9x6XyltNyRh+/VzUcuW86JIBXoKzqWvpShvysg2X iFK8MGWUunF+HdHCQ2YXXauiT4+lefez/ZO88ci/nQ== X-Google-Smtp-Source: APXvYqzXQTO/s4zQCYq99WpKnmgMNdyBWLKBl8gzZU5MUTiHlhIMvlDmaZgBi2SmOLmbMvPzT6LaNMLlgWc4fPEViMM= X-Received: by 2002:a25:ada8:: with SMTP id z40mr24262562ybi.147.1566422764730; Wed, 21 Aug 2019 14:26:04 -0700 (PDT) MIME-Version: 1.0 References: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> <59E0EC53-0E30-431C-8376-52C7BFC121A8@virtualized.org> <589DAFCB-1BDC-4156-A2CA-179C4559A6B2@virtualized.org> In-Reply-To: <589DAFCB-1BDC-4156-A2CA-179C4559A6B2@virtualized.org> From: Alec Muffett Date: Wed, 21 Aug 2019 22:25:53 +0100 Message-ID: To: David Conrad Cc: ADD Mailing list Content-Type: multipart/alternative; boundary="00000000000075becc0590a7386d" Archived-At: Subject: Re: [Add] What to do in this potential working group X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Aug 2019 21:26:13 -0000 --00000000000075becc0590a7386d Content-Type: text/plain; charset="UTF-8" On Wed, 21 Aug 2019, 22:04 David Conrad, wrote: > If your interest is ensuring that the DNS data the client is receiving > corresponds with what the authority for the domain inserted into the zone, > what you are assuring is essentially meaningless, > Concur; but the thing is, to hammer this point home in really short words: that is not what I am concerned about. DoH is channel protection. Can we please stop suggesting DoH addresses data > integrity? > We are not doing so; in fact at the risk of appearing ad-hominem, I will go so far as to suggest that you are only pretending that we are talking about data integrity, because it is the only lever you have available in order to attempt to attack this channel protection value proposition. We are talking about channel protection as a value proposition to clients and applications in the typical threat models which are relevant to them. We are talking about "Applications Doing DNS". We are talking about clients and channels. Data integrity is a matter of DNS infrastructure, both systems and data and metadata. I propose that it is outside of the scope of this list. -a --00000000000075becc0590a7386d Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


On Wed, 21 Aug 2019, 22:04 David Conrad, <= drc@virtualized.org> wrote:
If your interest is ensuring that the DN= S data the client is receiving corresponds with what the authority for the = domain inserted into the zone, what you are assuring is essentially meaning= less,

Concur; but the thing is, to hammer this point home in really= short words: that is not what I am concerned about.


DoH is channel protection. Can we please= stop suggesting DoH addresses data integrity?

We are not doing so; = in fact at the risk of appearing ad-hominem, I will go so far as to suggest= that you are only pretending that we are talking about data integrity, bec= ause it is the only lever you have available in order to attempt to attack = this channel protection value proposition.

We are talking about channel protection as a value propo= sition to clients and applications in the typical threat models which are r= elevant to them.

We are = talking about "Applications Doing DNS".
We are talking about clients and channels.
<= div dir=3D"auto">
Data integrity is a matter of = DNS infrastructure, both systems and data and metadata. I propose that it i= s outside of the scope of this list.

-a



--00000000000075becc0590a7386d-- From nobody Wed Aug 21 14:27:14 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 705BA120089 for ; Wed, 21 Aug 2019 14:27:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UFE6_MXiTeQp for ; Wed, 21 Aug 2019 14:27:10 -0700 (PDT) Received: from mail-io1-xd2d.google.com (mail-io1-xd2d.google.com [IPv6:2607:f8b0:4864:20::d2d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9B3F112001E for ; Wed, 21 Aug 2019 14:27:10 -0700 (PDT) Received: by mail-io1-xd2d.google.com with SMTP id j4so7569498iop.11 for ; Wed, 21 Aug 2019 14:27:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=YldQuD6P8tsHQGfCrIKvtEaJOppcTc33GczgkGifTCM=; b=mAVKHSJ1B+1lNAe5LWV5R3WHF13mW4C/99C9sd6JfIKOEF1po3+p+f1ygwYXnB0E1b pVhcwMygWN0XyMzlFS4LwLk+PdfBEoViq6vQ0YpH/z4pjtlqoO6F92DyQPDy+KShWgc+ uVNaT4NsGGXnpyS5llQNNgMAUac0VQ6A3weugSI2lamoY4bHVALtBJ2SwV5xb/VD1po9 sPyPHObuS8bpcbK7tCkyK9iEzKAMwLa6Y6yvAJDH2ci8aijG+Wza7qEKP7qeWQl4mU0t +WzzZ+YLLC2ttaj8tUEM/39VUSAYD6RDuaw8KcgTF237IJSBBN9cncs/J5JbEHRhY+EI 7+MA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=YldQuD6P8tsHQGfCrIKvtEaJOppcTc33GczgkGifTCM=; b=qsioZaY+BsIx1NCfyopSPaob8VcACKsKXLFttQxuvQ6fY17ka/XJWsXkGjc0mCOLoe o1E0rQlpafPLT8gMzUlAfnuEyH6Aa0FzDBDckvZoQU/EW9/jIRuoc8lcGNGAN/aFdw6V Qu9Qh9genPNIqMXHCPYo2mCZbD24MP1YxWxl84G/YmzhOelW4tTn0+heSlqYZEPrKU08 EE2tsHilv4mOYxQ1JggzsGcjccSlp94V7KApshtVElQAhMkI2P6RR4yVo0uaTFL0Uq4J 89L0Cg+BIvZng9WSnIQjez2It1x37qRSEP3b9p99B3oBHV258Il/Jy+MU+1+W8Oeswr4 ttcQ== X-Gm-Message-State: APjAAAW/653kj/PIQZ8uv5zbEuWF/YT3hWVmy/qMzJkXxGZ46HErouGw tqhmTFyx/U6oA1c1Qo/8dpvsNA2tN6VXz1CoPKQ= X-Google-Smtp-Source: APXvYqzVpkijZd4JW6u6Gexucl9Od80M2sW7HbhihS9E5rQ29xK7fcxrq2vGK8XiQ8Ev/FqLgCn+ik7K7nOeWJd+Sx0= X-Received: by 2002:a02:ba91:: with SMTP id g17mr11702381jao.11.1566422829758; Wed, 21 Aug 2019 14:27:09 -0700 (PDT) MIME-Version: 1.0 References: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> <59E0EC53-0E30-431C-8376-52C7BFC121A8@virtualized.org> <589DAFCB-1BDC-4156-A2CA-179C4559A6B2@virtualized.org> In-Reply-To: <589DAFCB-1BDC-4156-A2CA-179C4559A6B2@virtualized.org> From: Ted Hardie Date: Wed, 21 Aug 2019 14:26:42 -0700 Message-ID: To: David Conrad Cc: Alec Muffett , ADD Mailing list Content-Type: multipart/alternative; boundary="00000000000055fd4f0590a73c0f" Archived-At: Subject: Re: [Add] What to do in this potential working group X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Aug 2019 21:27:13 -0000 --00000000000055fd4f0590a73c0f Content-Type: text/plain; charset="UTF-8" Hi David, On Wed, Aug 21, 2019 at 2:05 PM David Conrad wrote: > > DoH is channel protection. Can we please stop suggesting DoH addresses > data integrity? > > At least what I've been trying to say is that it gives you on-path confidentiality and authentication. You can confirm to whom you are connecting, and no one has access to the query/response stream by virtue of being on-path. That authentication is different from "data integrity" of the data being sent and I recognize that it is different. But it is nonetheless something that folks would like to see, especially in the case where they have a reason to believe that party has a policy aligned with their own (e.g. parental controls). My apologies for any lack of clarity, Ted --00000000000055fd4f0590a73c0f Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi David,

On Wed, Aug 21, 2019 at 2:05 PM David Co= nrad <drc@virtualized.org>= wrote:

DoH is channel protection. Can w= e please stop suggesting DoH addresses data integrity?

=

At least what I've been trying t= o say is that it gives you on-path confidentiality and authentication.=C2= =A0 You can confirm to whom you are connecting, and no one has access to th= e query/response stream by virtue of being on-path.

That authentication is different from "data integrity" of the d= ata being sent and I recognize that it is different.=C2=A0=C2=A0 But it is = nonetheless something that folks would like to see, especially in the case = where they have a reason to believe that party has a policy aligned with th= eir own (e.g. parental controls).

My apologies for= any lack of clarity,

Ted
--00000000000055fd4f0590a73c0f-- From nobody Wed Aug 21 14:27:26 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9B87512001E for ; Wed, 21 Aug 2019 14:27:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.98 X-Spam-Level: X-Spam-Status: No, score=-1.98 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, T_SPF_HELO_PERMERROR=0.01, T_SPF_PERMERROR=0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nostrum.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id puS1zV7mnLkG for ; Wed, 21 Aug 2019 14:27:24 -0700 (PDT) Received: from nostrum.com (raven-v6.nostrum.com [IPv6:2001:470:d:1130::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 54824120089 for ; Wed, 21 Aug 2019 14:27:24 -0700 (PDT) Received: from MacBook-Pro.roach.at (99-152-146-228.lightspeed.dllstx.sbcglobal.net [99.152.146.228]) (authenticated bits=0) by nostrum.com (8.15.2/8.15.2) with ESMTPSA id x7LLRKJH002173 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NO) for ; Wed, 21 Aug 2019 16:27:21 -0500 (CDT) (envelope-from adam@nostrum.com) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=nostrum.com; s=default; t=1566422842; bh=K4g+UTiea8P+h9HcFK2mDKkKoHW2W2A3iUyoGEd6rUg=; h=Subject:To:References:From:Date:In-Reply-To; b=KPxFXvVZbGN1Iffbwq5q3jOGRnZiJepFM/Qg85+zcble3e8ra5Omdq/VkyTvJMOXS qQwsO4vM7/x3aepDH25Nno/Nj6OdDt4x0JxGokfIZMA+LUNmtgkvd9yNXwyaCMNEzm zd2d6WMjoSyN1jI+NyMKsK5kRBuCdHZUVzEyYyjs= X-Authentication-Warning: raven.nostrum.com: Host 99-152-146-228.lightspeed.dllstx.sbcglobal.net [99.152.146.228] claimed to be MacBook-Pro.roach.at To: add@ietf.org References: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> From: Adam Roach Message-ID: <279abf8c-198b-5da8-1cb9-4f86bf1f37c7@nostrum.com> Date: Wed, 21 Aug 2019 16:27:15 -0500 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Content-Language: en-US Archived-At: Subject: Re: [Add] What to do in this potential working group X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Aug 2019 21:27:26 -0000 On 8/21/19 4:10 PM, Jari Arkko wrote: > Now, imagine that the next version of the browser comes with by-default quad-n/doh setting, and now the browser will be contacting a different server... I really wish people wouldn't persist in ignoring repeated explanations that Firefox (at least) will have actual user interaction at the time that DoH is made available in a user's region, with a one-click option to turn it off. Theoreticals that presume DoH will be activated silently imply a level of incompetence and/or malice on behalf of Mozilla's product managers that I don't believe is warranted. If there's any progress to be made, it almost certainly requires us to limit the discussion to situations that may realistically arise rather than hypothesizing worst-case scenarios that won't. /a From nobody Wed Aug 21 14:28:37 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0A79C120089 for ; Wed, 21 Aug 2019 14:28:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wvkbqBVXCwj5 for ; Wed, 21 Aug 2019 14:28:34 -0700 (PDT) Received: from mail-io1-xd30.google.com (mail-io1-xd30.google.com [IPv6:2607:f8b0:4864:20::d30]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 58DDC12001E for ; Wed, 21 Aug 2019 14:28:34 -0700 (PDT) Received: by mail-io1-xd30.google.com with SMTP id l7so7651725ioj.6 for ; Wed, 21 Aug 2019 14:28:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=fJgibdHBXX5zf2CCLLsKqVoHws5taZZl2rFSlXfNbmw=; b=BGOhxsk/J653l+NN3os/BGPYrrEG4Nwh89e5plp6Tw6b+HxqWTjK0p/r8C2+xQ7pKg m5Baq6p+q73xhEHYQKaPKwcMLlg+h7JO309uTYN+guxfzrt6GiYdE49RnIoY2b4/dt2b 2/R3YM8LcmqzgH8d6sPbTPLjO/h//rDtdkU0fUbtB+r9v++xrOMw4y+GQaFGkCSkXB3B MN5dkbjbT62jOfn3pTeQLoLP1Qg5IrU7u/7aFbApZTNelUOs/wGClLwyjiaDFu83z9P+ An5x25qHWvzOzEYdBeg4BsSKo/Ll8PIZB57GMaRdVh7jUJcazmyXNZapPNMvj744GxXg IfGg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=fJgibdHBXX5zf2CCLLsKqVoHws5taZZl2rFSlXfNbmw=; b=ffsWm21rD1cb8Zjm7M6ZOHPA16sc8IG21OmJvvxgHVJY0rGKryIX3oVReFOSyUl9dD jXlCkJmjaB5HgRr2KlC1CgQTCeDlpt9XKq8s2kUYkPQva6u9acs9xe1BN/2WTqB0Icql DCbEBMQKp8Qu1mUNdYG5pB0picPfRD7HzxDQPtgAfL29+GDWSFTruK53wBdMzA/GZrrC CjclnbBSKVsB4dSqlxB98jafY9XNlnkIiM9dYDxI2kz60pRgDzoxoNdy5Bb9dODGUFYD qd5Y/WYpeQVFqLGan4hCR4uBMSncmqdWfupiibBJWHhxb1g7P4/w+nhXtYlyZylKcbOb dvmQ== X-Gm-Message-State: APjAAAWItFoj6RsY+oEVkD6ziOi2I0nvE2Tn8d0mgOc5mBxLELY57rbG PgNxwj/oCvN9ZLbfmR23eXbypa4fVzYRib95PzI= X-Google-Smtp-Source: APXvYqwa/iuCoEjbPmCNLKBamIe0Vz/+uu6U8YZYxK8mHo9ZmJRSAaL2Hmr2wmdcwaE5pCWCNk783wT4mQBW9mSYKlc= X-Received: by 2002:a5e:c113:: with SMTP id v19mr10222556iol.219.1566422913500; Wed, 21 Aug 2019 14:28:33 -0700 (PDT) MIME-Version: 1.0 References: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> <59E0EC53-0E30-431C-8376-52C7BFC121A8@virtualized.org> <589DAFCB-1BDC-4156-A2CA-179C4559A6B2@virtualized.org> In-Reply-To: From: Ted Hardie Date: Wed, 21 Aug 2019 14:28:06 -0700 Message-ID: To: Alec Muffett Cc: David Conrad , ADD Mailing list Content-Type: multipart/alternative; boundary="00000000000053c9ea0590a741f4" Archived-At: Subject: Re: [Add] What to do in this potential working group X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Aug 2019 21:28:36 -0000 --00000000000053c9ea0590a741f4 Content-Type: text/plain; charset="UTF-8" Alec, On Wed, Aug 21, 2019 at 2:26 PM Alec Muffett wrote: > > We are not doing so; in fact at the risk of appearing ad-hominem, I will > go so far as to suggest that you are only pretending that we are talking > about data integrity, because it is the only lever you have available in > order to attempt to attack this channel protection value proposition. > > Please do not impugn the motives of other members of the list. That's damaging to the exchange of ideas, and inappropriate behavior to our colleagues. regards, Ted --00000000000053c9ea0590a741f4 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Alec,

On Wed, Aug 21, 2019 at 2:26 PM = Alec Muffett <alec.muffett@gma= il.com> wrote:

We are not doing so; in fact = at the risk of appearing ad-hominem, I will go so far as to suggest that yo= u are only pretending that we are talking about data integrity, because it = is the only lever you have available in order to attempt to attack this cha= nnel protection value proposition.

<= /blockquote>

Please do not impugn the motives of other m= embers of the list.=C2=A0 That's damaging to the exchange of ideas, and= inappropriate behavior to our colleagues.

regards= ,

Ted

--00000000000053c9ea0590a741f4-- From nobody Wed Aug 21 14:28:48 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9FF3F1200B6 for ; Wed, 21 Aug 2019 14:28:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=virtualized-org.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1dLYx24a7rQz for ; Wed, 21 Aug 2019 14:28:44 -0700 (PDT) Received: from mail-pl1-x634.google.com (mail-pl1-x634.google.com [IPv6:2607:f8b0:4864:20::634]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 13A1C120170 for ; Wed, 21 Aug 2019 14:28:44 -0700 (PDT) Received: by mail-pl1-x634.google.com with SMTP id z3so2052811pln.6 for ; Wed, 21 Aug 2019 14:28:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtualized-org.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc:message-id:references :to; bh=2AyTCf1fL/bBwGUw0RmEM79uYvGLYaQQ4gAoidU7/NE=; b=jLPNocjkTsS70o3oU8WmtOMA3cdAKAsDuzYvEngKqv9b00B4dpERZabAuMOiC3tIGH Co9wsebM7sXW/2K76K004Ac5pOTfYHZfvFY1PwqNkCqeYsXzTx4+F16nsCYsIxfWCaii hafntVZqRELnJuvjbdZZ3sVQSYCH4tCGNfR1FMWEFzyVdGfPrlax87iHCtKP0QOzgpgd 8v/h7VwnwmyDQ97dSO9tZOIu3XkIELlF9nzcXGf3WwdPjHFiUb8f+vVUGNIG5ZUE3BEr wLSSUeBaOdBd4zCtjxELD02+1/zYPyHQIpRi/sZER1P7jtklPfw8XcmggmVemrfNWBCq KugQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :message-id:references:to; bh=2AyTCf1fL/bBwGUw0RmEM79uYvGLYaQQ4gAoidU7/NE=; b=gqzEB36adAfcdvo+GTvd6xcVk81hFfgQS452ZBkprHhX7smW9tbQ9NSl3lK1E4kpvO gc9C1JbHsUt6Wy0YADq4miExDgzzhzwZzJybUOf6K4pTiDmqq7vZYs5BGuJhRrVQtJYK SK3Born3DXhRdrM/tVuZbqOo9nixDGrXRqlmU5PvoLI7fyALDiGgCGEDiWIdpYioBRe3 eswkMFjJFVF2FxXrYViT9MAYIGPJ6pyKKwaPkYvIFAkRCFb/B44hfzhBH66HCzx/zUYq ELWTxhuIdgBlGOYs+Asu41IdIn3t6UwO4J6JGpHHU6JFuvTwX3eL9ycqMRYRBRfXLYzn plcw== X-Gm-Message-State: APjAAAUs3y11Y7qNlvLW54X5VS8a61yLbx0iIYe7stpp8wT33Hyfop2E R3oJ6v9J343DhONxhsezzOAS77pVnAk= X-Google-Smtp-Source: APXvYqz4Srg/VPapgAqhUxMpd3lRUX3dP0ehQCu57kJ0xRMFPdYHP2dZP7JSjPuobwOQnyKRw50YmA== X-Received: by 2002:a17:902:8a81:: with SMTP id p1mr34836853plo.71.1566422923546; Wed, 21 Aug 2019 14:28:43 -0700 (PDT) Received: from ?IPv6:2620::2d0:110:a001:9cbc:6eb4:c2df? ([2620:0:2d0:110:a001:9cbc:6eb4:c2df]) by smtp.gmail.com with ESMTPSA id a10sm34628303pfl.159.2019.08.21.14.28.42 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 21 Aug 2019 14:28:42 -0700 (PDT) Content-Type: multipart/signed; boundary="Apple-Mail=_0644262A-E2B0-45E0-AE85-D62F682F75D0"; protocol="application/pgp-signature"; micalg=pgp-sha512 Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) From: David Conrad In-Reply-To: Date: Wed, 21 Aug 2019 14:28:41 -0700 Cc: ADD Mailing list X-Mailbutler-Message-Id: EC50B568-694B-44B4-82FF-EB8FC990666F Message-Id: <3F133840-DE9E-4B8B-84F8-30CF458003B6@virtualized.org> References: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> <59E0EC53-0E30-431C-8376-52C7BFC121A8@virtualized.org> <589DAFCB-1BDC-4156-A2CA-179C4559A6B2@virtualized.org> To: Stephen Farrell X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] What to do in this potential working group X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Aug 2019 21:28:47 -0000 --Apple-Mail=_0644262A-E2B0-45E0-AE85-D62F682F75D0 Content-Type: multipart/alternative; boundary="Apple-Mail=_C91E8104-B689-48DE-95C9-7EE2515F9735" --Apple-Mail=_C91E8104-B689-48DE-95C9-7EE2515F9735 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Stephen, On Aug 21, 2019, at 2:13 PM, Stephen Farrell = wrote: > DNSSEC provides origin-authentication and data integrity > for DNS answers between the signer and validator. >=20 > If the client validates the TLS server cert, DoH provides > TLS-server authentication, confidentiality and data > integrity between the TLS client and server. "TLS client and server" !=3D "signer and validator=E2=80=9D > So yep, both give data integrity, just differently. No. What you say would be true ONLY if the DoH client connects to the = authoritative source of the data. Which, of course, it doesn=E2=80=99t. Again, what would happen if the TRR you contracted with is subject to a = court order under seal that requires that TRR to modify responses for = particular domains? How would you know? Regards, -drc --Apple-Mail=_C91E8104-B689-48DE-95C9-7EE2515F9735 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Stephen,

On Aug = 21, 2019, at 2:13 PM, Stephen Farrell <stephen.farrell@cs.tcd.ie> wrote:
DNSSEC provides origin-authentication and data = integrity
for DNS answers between the signer and validator.

If the client = validates the TLS server cert, DoH provides
TLS-server = authentication, confidentiality and data
integrity between the TLS client and server.

"TLS = client and server" !=3D "signer and validator=E2=80=9D

So yep, both = give data integrity, just differently.

No.

What you say = would be true ONLY if the DoH client connects to the authoritative = source of the data. Which, of course, it doesn=E2=80=99t.

Again, what would happen if the TRR you = contracted with is subject to a court order under seal that requires = that TRR to modify responses for particular domains?  How would you = know?

Regards,
-drc


= --Apple-Mail=_C91E8104-B689-48DE-95C9-7EE2515F9735-- --Apple-Mail=_0644262A-E2B0-45E0-AE85-D62F682F75D0 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEzEaOGlQw4bcyWBNfoCss/bh3zPcFAl1dt4kACgkQoCss/bh3 zPdEOw/8Dqk71d88SgIZkNWCs4DPvjTz/gTmHP/YToZH+jqQkvn1c6PseaJrvTNp tmRPJCjyg50BvmQfR6jY3Pd2m0uiSYQIcRws4Bc2RooifFjH9bKceXz2/h8iwHz0 o2swseCeTu+iAni3tEY9cKlbMTYCqOsaM/Ipc8oNxmGOAfWr5M7D55rblJ6AejJH d9NEDO8t9qHjamSlt+MhnXRrceO0o4C8Q2lshjy499UqKMEEyQkhuaHOIQROLKYf SrxVr3Kt371Wi/+xWUkxy2qx4dpfA+5XDd8GcGKTMI9UnrIA6yf4L/AXKoPrHC9g W0WajCNeJ6pE8Z6CKQ8oYOEZP8tp1FcHNtQzEWNNbOsMUdmWTiqxy1Nftg8I2vIU YIqUCTkkhOkQLEFKaoDvuaSCu2vhrhV99vgb4T2PtDiWWQN0Z8rbYyszNL0ePLmF 1qyOKQJysNLTzstRmMmNgSnvpMeol/lzj9KVdA1PkPASnEIS6xy1ODTT6/LrwAKZ b8TGIPqdFlItjd8SQYTRWvHb+7Ue/NsgXjkithnhEVVKNJV1N4JiDBZQmYVp06P9 YStQ51XUVGWS2vy4OpHDpxgqJfjXHG51IbUZFFQucFqvsWFeEjChYttKZA6JJzu2 ftomiNiPfdW3h7KWzSQf8dsBCW77fgXpGcVgotPKfcySlKcWEYU= =+3bm -----END PGP SIGNATURE----- --Apple-Mail=_0644262A-E2B0-45E0-AE85-D62F682F75D0-- From nobody Wed Aug 21 14:31:30 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D7425120090 for ; Wed, 21 Aug 2019 14:31:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NQ_izIBGnwaJ for ; Wed, 21 Aug 2019 14:31:25 -0700 (PDT) Received: from mail-io1-xd34.google.com (mail-io1-xd34.google.com [IPv6:2607:f8b0:4864:20::d34]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4A3AB120089 for ; Wed, 21 Aug 2019 14:31:25 -0700 (PDT) Received: by mail-io1-xd34.google.com with SMTP id j5so7631728ioj.8 for ; Wed, 21 Aug 2019 14:31:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=k24nM4ZhPL52yCc9265TLSPHE3vscngDTZ/bgahTumw=; b=url1lyZ/pG1u2ikKDOcRVRl3Q7KElLNBdQgzVEhanHio19n1n06TsJ+5mN3z3+K4b2 ziMrFwZprditpJKu/0dmq7BCd3ZKb/ENH/WeQyUYlhUyh+Wtuhe1iv8yF2/qPIThBN3D iQXVHRaew+uD/4XMOv5Xz0PtoAHFWRhN+SeYeRGo3UYkYd0FU4l1hx7egGaotFGOBSgL m1JefnJvzy3XXuMnwkpGq6kpHavzluqRn+7Kvm0NqYDEReWfD10ZlubA4YgYe9o3UZQ7 UxtZuESY2cfM+Ao8tXDux8s9vwcg6rzKE/+5cJaxhejgT317R0ovQUkwCEhloJ1eqcRV Q1cA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=k24nM4ZhPL52yCc9265TLSPHE3vscngDTZ/bgahTumw=; b=IXhSPjxEzWs0GImEaUvvVYv4rRww9WvtXn/qnlj+888nxWIclKRD2OnzLk4NCL5hbQ 7wIB6LTId5RIYsvxQMM4fgofcnIGJc70Cc5nhJIEJJYZfUSGPoEcqFR/SLGR6rjMONNj 4rAntGw4gkMw0mzpjvw/6c6cprlZuT4mh7yoeuPzJc6ofQ/tEJgQIn4z9Wb/XfYsj+DB HPrVMVyTM8bXxs+Csi2a4yHye9/h/KLFuSfmnUTJGiLSD3dcB6WDswEdwWEz+VoCkfR6 YWhcqU1kEAHP1L2lvkec0yeWM3f2GmyjnVWEtAitc3vF4xK1rjuA9l9EDqt0LPH2eChB pOrg== X-Gm-Message-State: APjAAAUJAt5EGlCUvC+kx567wEzj7clFE899rLoOIhZHR+1Ww/sppx/B nqTh5ZnGI1NY4lO+bj6zH15ajq0XSousUQE/ju0= X-Google-Smtp-Source: APXvYqzyDvl6/NMFWWH568a1aHOrLWdOQNaXBegVWG0UoiZndBGDBBKIMbAz225ensjmzAX+lztADNk6ESCCVbppPQY= X-Received: by 2002:a5e:d618:: with SMTP id w24mr6343133iom.73.1566423084551; Wed, 21 Aug 2019 14:31:24 -0700 (PDT) MIME-Version: 1.0 References: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> <59E0EC53-0E30-431C-8376-52C7BFC121A8@virtualized.org> <589DAFCB-1BDC-4156-A2CA-179C4559A6B2@virtualized.org> In-Reply-To: From: Rob Sayre Date: Wed, 21 Aug 2019 14:31:13 -0700 Message-ID: To: Ted Hardie Cc: Alec Muffett , ADD Mailing list , David Conrad Content-Type: multipart/alternative; boundary="00000000000085d4100590a74b45" Archived-At: Subject: Re: [Add] What to do in this potential working group X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Aug 2019 21:31:27 -0000 --00000000000085d4100590a74b45 Content-Type: text/plain; charset="UTF-8" On Wed, Aug 21, 2019 at 2:28 PM Ted Hardie wrote: > > Please do not impugn the motives of other members of the list. That's > damaging to the exchange of ideas, and inappropriate behavior to our > colleagues. > I must agree, even though I agree with Alec on this issue. It seems easy enough to investigate what actual software and hardware does, and make points that way. thanks, Rob --00000000000085d4100590a74b45 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Wed, Aug 21, 2019 at 2:28 PM Ted H= ardie <ted.ietf@gmail.com> = wrote:

Please = do not impugn the motives of other members of the list.=C2=A0 That's da= maging to the exchange of ideas, and inappropriate behavior to our colleagu= es.

I must agree, even th= ough I agree with Alec on this issue. It seems easy enough to investigate w= hat actual software and hardware does, and make points that way.
=
thanks,
Rob=C2=A0
--00000000000085d4100590a74b45-- From nobody Wed Aug 21 14:39:18 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 21908120091 for ; Wed, 21 Aug 2019 14:39:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.299 X-Spam-Level: X-Spam-Status: No, score=-4.299 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GaRWT7BLyPZw for ; Wed, 21 Aug 2019 14:39:15 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D907112001E for ; Wed, 21 Aug 2019 14:39:14 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id D5EEBBE55; Wed, 21 Aug 2019 22:39:12 +0100 (IST) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7qC7i1fliNs5; Wed, 21 Aug 2019 22:39:11 +0100 (IST) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 46647BE50; Wed, 21 Aug 2019 22:39:11 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1566423551; bh=GeTihWmZLF2tA2iRzcdzs8L8dMhr/rtlORPQCATgsDw=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From; b=enzedzC1LUVVRaK4v/ZDXJ+MCVaUQeHagYQ4l6wmB3kHnTAF4biLVHIdQK2hFaw4N iAFHf6pO5QFIFS/aIZOskrUd7+AWUiPi+nQw6v8VTPjlxFr7f4hw/ccTwbtZj3tJNf zNL/2EX/oLb71sXm2elOdngXDQ9S4HdDhpK0anek= To: David Conrad Cc: ADD Mailing list References: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> <59E0EC53-0E30-431C-8376-52C7BFC121A8@virtualized.org> <589DAFCB-1BDC-4156-A2CA-179C4559A6B2@virtualized.org> <3F133840-DE9E-4B8B-84F8-30CF458003B6@virtualized.org> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: <84120ae7-c32f-4994-d4f9-e560eeab3dec@cs.tcd.ie> Date: Wed, 21 Aug 2019 22:39:10 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: <3F133840-DE9E-4B8B-84F8-30CF458003B6@virtualized.org> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="3o3FPMWji7nD93kVgr8QlvGLuHK01VLiC" Archived-At: Subject: Re: [Add] What to do in this potential working group X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Aug 2019 21:39:17 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --3o3FPMWji7nD93kVgr8QlvGLuHK01VLiC Content-Type: multipart/mixed; boundary="isinkrP5N10eOjuIAvDwlhGmVL5d8C3cY"; protected-headers="v1" From: Stephen Farrell To: David Conrad Cc: ADD Mailing list Message-ID: <84120ae7-c32f-4994-d4f9-e560eeab3dec@cs.tcd.ie> Subject: Re: [Add] What to do in this potential working group References: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> <59E0EC53-0E30-431C-8376-52C7BFC121A8@virtualized.org> <589DAFCB-1BDC-4156-A2CA-179C4559A6B2@virtualized.org> <3F133840-DE9E-4B8B-84F8-30CF458003B6@virtualized.org> In-Reply-To: <3F133840-DE9E-4B8B-84F8-30CF458003B6@virtualized.org> --isinkrP5N10eOjuIAvDwlhGmVL5d8C3cY Content-Type: multipart/mixed; boundary="------------01FD4FCEE3C156C428075E86" Content-Language: en-GB This is a multi-part message in MIME format. --------------01FD4FCEE3C156C428075E86 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hiya, On 21/08/2019 22:28, David Conrad wrote: > Stephen, >=20 > On Aug 21, 2019, at 2:13 PM, Stephen Farrell > wrote: >> DNSSEC provides origin-authentication and data integrity for DNS >> answers between the signer and validator. >>=20 >> If the client validates the TLS server cert, DoH provides=20 >> TLS-server authentication, confidentiality and data integrity >> between the TLS client and server. >=20 > "TLS client and server" !=3D "signer and validator=E2=80=9D Yes. That was part of my point. >=20 >> So yep, both give data integrity, just differently. >=20 > No. Sorry, but yes:-) >=20 > What you say would be true ONLY if the DoH client connects to the > authoritative source of the data. Which, of course, it doesn=E2=80=99t.= Disagree. Data integrity is a security service that can be provided via digital signatures (in the DNSSEC case) or via message authentication (use of an AEAD in the TLS case). Please see RFC4949. >=20 > Again, what would happen if the TRR you contracted with is subject to > a court order under seal that requires that TRR to modify responses > for particular domains? How would you know? That's a good question but not relevant when considering whether DNSSEC or TLS provide data integrity in the sense of a cryptographic protocol. Both do that. If you want to talk about data integrity in the sense of "answer faithfully matches the zonefile equivalent content" then that's possibly a confusing term to use in this case. It may have been used historically amongst DNSSEC folks, not sure, but certainly once TLS is in the mix, it'd be better to call that another thing. That is what I meant by origin authentication + data integrity though. Anyway point is: yes, TLS does provide data integrity for an entirely reasonable definition of the term. And so does DNSSEC. But they do different things. Cheers, S. >=20 > Regards, -drc >=20 >=20 >=20 >=20 --------------01FD4FCEE3C156C428075E86 Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------01FD4FCEE3C156C428075E86-- --isinkrP5N10eOjuIAvDwlhGmVL5d8C3cY-- --3o3FPMWji7nD93kVgr8QlvGLuHK01VLiC Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAl1duf4ACgkQWrL68XsX K+o7iRAAvOyXvkYhlXzhT0pirCsDfGm4dazHdraVeFBplFwmbH8WOMkSBA0p6TgP poi30g6I68FeRzQJMYmvcP7//9XyltvLnP+3XUUqYtPjGz4KYzs+Ud+0pJ94H4xr bgUCOKhsp+EaofqcERMQmw1sIEBZFS65IG7JAZCOfKcDno0YhJYiB9LA2xvBVHH2 uzZ8GSItqFxGD/AqTeD7A4GlA3TSreyk/WYjeJ6OSjBOvEhn/3AC+JOs9a5SxJen KQxWNStCHC9uVk3AKQHgKG+AduqAhpxyrwIVixKH+V4AJIXFG9LY/OFnBlR7Omvp Q6TuR8xqfC9ukw7zYMC2VNQjj+9/Nw7omduPK6xOydxrgzeyF2mpNM1FtNSePBmZ rsVMsSiDKXQP57oTIla3vMziFfLQjvpZwkNXsxIDE8FpWotqHmEraA+nTYSvWjGK LF/hSn2cC31Us/qb6+8dkypMU+kncG0SRYgFpmKveGMKjqSGCouC6cIaNmsI/CqG 6oNCSJUXATi/rHkJkvmmMsaFbd+NIv8CbHQLNEzFuLSuQpQ3ll4iH1PsS1Wyj4/u 2regLc40pwW6KE3lxAw7G6gjjAcRWpJIQGpTYBC/nmbTANHgTYN9YT4RnYbbV5ci +62Q22wnfwp8Ine67sWpXu0N6cRmBMevZQLsAya84xjnHzWa8lg= =GWA6 -----END PGP SIGNATURE----- --3o3FPMWji7nD93kVgr8QlvGLuHK01VLiC-- From nobody Wed Aug 21 14:42:22 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7D6D6120091 for ; Wed, 21 Aug 2019 14:42:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id raN7Ova6CL3W for ; Wed, 21 Aug 2019 14:42:18 -0700 (PDT) Received: from mail-yw1-xc2f.google.com (mail-yw1-xc2f.google.com [IPv6:2607:f8b0:4864:20::c2f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 05E9F12001E for ; Wed, 21 Aug 2019 14:42:18 -0700 (PDT) Received: by mail-yw1-xc2f.google.com with SMTP id w10so1515536ywa.13 for ; Wed, 21 Aug 2019 14:42:17 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=fu78mKNSqlrbhKwDuKhSO7Xr2FXwJaOlZXtoTDuuxu8=; b=qYByLc2g760ngmtbQz2TTV9Ii5ppKPiTysoeoSD5BykoJB6BQAjRF8G6TZhdB8EDf0 v4AoFqygfayk4BsOA8brzeHkpifaJ/C9fLphNiPnPS3jrysfQJYFMkt/bQr1Krytl/rX derBDPH0AgPT8saY/2faViLM9CTlXS+KTrH2ZNFkqbz/pcQDk9queTdPXPqAc87T5ZhK 0cxWvweOd8rmxOBKJmrr0UGmz4eUO7yE/mxKVZsU+B/35Tc3qEDZNQB5gYZqucONYsF8 1cza27HUB5j8o7V15geC1OwuDVUYE7xDR3pROB9jvs3Vim2sHraMMloXRcUKhBEG1gjx mHBQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=fu78mKNSqlrbhKwDuKhSO7Xr2FXwJaOlZXtoTDuuxu8=; b=DUb88hPO7/RHXO6BbGLLkGYPw4CGzD8iRIhHpWO2pLPeMxrm2294ydYuc+6Kap4tGp 8BYTQ02mA2e7MF5wZRwqsKE2Fcl+enLYC/gVYoq/o44I7HKHa3/lkX8Xwi5gjm5PWBGw FrALCeQKkywIJdYsfOF70z4jKlEbETcTa3aPWQKSYv52Y4wCKXrh8jsEU2XXlUkG7Zx5 ISfozC2nWXLZebjhbFPLFwTzuBIJsgDkya0HQZiWKm9Ky7Uqq5dY0aiyQ2AxmsDNzUjr vyWjasxQdMLQoCtTGixlpUTIq+Z/iUs3L/iY6k+xC5jqwTt0mjPAmxVz68br7Wemnm8w UQkQ== X-Gm-Message-State: APjAAAX8Itcf65GwEN+aNAAvnbQyzHwW0vatw8BdhrkY/lqf+KG0yp9P ueE/HSy4oooE6o3Ajawt2B/YqRzUCwMfi3PFgDI= X-Google-Smtp-Source: APXvYqzLVau93gfMawlquPk9EGwj0O0nQTf6/1Oh7d+gLKETiBiU2epVwHxuYyCaaht9C5zxTxZJB6yrLI85ayW5yRA= X-Received: by 2002:a81:4c55:: with SMTP id z82mr12794366ywa.367.1566423737093; Wed, 21 Aug 2019 14:42:17 -0700 (PDT) MIME-Version: 1.0 References: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> <59E0EC53-0E30-431C-8376-52C7BFC121A8@virtualized.org> <589DAFCB-1BDC-4156-A2CA-179C4559A6B2@virtualized.org> In-Reply-To: From: Alec Muffett Date: Wed, 21 Aug 2019 22:41:40 +0100 Message-ID: To: Ted Hardie Cc: David Conrad , ADD Mailing list Content-Type: multipart/alternative; boundary="0000000000006ad2420590a772f1" Archived-At: Subject: Re: [Add] What to do in this potential working group X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Aug 2019 21:42:21 -0000 --0000000000006ad2420590a772f1 Content-Type: text/plain; charset="UTF-8" On Wed, 21 Aug 2019 at 22:28, Ted Hardie wrote: > Alec, > On Wed, Aug 21, 2019 at 2:26 PM Alec Muffett > wrote: > >> >> We are not doing so; in fact at the risk of appearing ad-hominem, I will >> go so far as to suggest that you are only pretending that we are talking >> about data integrity, because it is the only lever you have available in >> order to attempt to attack this channel protection value proposition. >> > > Please do not impugn the motives of other members of the list. That's > damaging to the exchange of ideas, and inappropriate behavior to our > colleagues. > In which case I shall withdraw that comment and replace it with an allusion to the author's inability to address the argument at hand, for reasons that are unclear. -a -- http://dropsafe.crypticide.com/aboutalecm --0000000000006ad2420590a772f1 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Wed, 21 Aug 2019 at 22:28, Ted Har= die <ted.ietf@gmail.com> wr= ote:
Alec,
On Wed, A= ug 21, 2019 at 2:26 PM Alec Muffett <alec.muffett@gmail.com> wrote:

We are not doing so; = in fact at the risk of appearing ad-hominem, I will go so far as to suggest= that you are only pretending that we are talking about data integrity, bec= ause it is the only lever you have available in order to attempt to attack = this channel protection value proposition.
Please do not impugn the motives of other members of the list.= =C2=A0 That's damaging to the exchange of ideas, and inappropriate beha= vior to our colleagues.

I= n which case I shall withdraw that comment and replace it with an allusion = to the author's inability to address the argument at hand, for reasons = that are unclear.

=C2=A0 =C2=A0 -a
=C2= =A0

--
http://dropsafe.crypticide.com/aboutalecm
--0000000000006ad2420590a772f1-- From nobody Wed Aug 21 14:43:25 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1985D120086 for ; Wed, 21 Aug 2019 14:43:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=virtualized-org.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id K2v9qCh37tEe for ; Wed, 21 Aug 2019 14:43:19 -0700 (PDT) Received: from mail-pf1-x430.google.com (mail-pf1-x430.google.com [IPv6:2607:f8b0:4864:20::430]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D46F012001E for ; Wed, 21 Aug 2019 14:43:19 -0700 (PDT) Received: by mail-pf1-x430.google.com with SMTP id g2so2337281pfq.0 for ; Wed, 21 Aug 2019 14:43:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtualized-org.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc:message-id:references :to; bh=4M5GXSmarNqtrwVCPj8+uhqpvpvdghWssSXDriRKGzk=; b=Jn9dGU9CeI22dhSoDUm+lnTm+33Pt3LdsGWEDvmE2s30K8LkdbzAlueINgI0mKFBmX GzP4AccoaN1SRt4IWJTZi8TC82oXmM+29Bl/HXagkx+vndpIBgWlR/Rwbz8NCrpS/NzB 53prpvPd4B3tFW1zBEwoRLbaMtB9rGyEqiSgjlWZkQBDm9O8ubN5YGSfxQurSUOoRqsu gYMDBvQfNJ/EkqWzK7xGaCQmJqi/A/dyM0jGGZ9yrqTYtIgfAQSZiW8zZYEuzuc427NI fHdihOGYxYhUCU4vMZdkXNbGCbBLCsRZqbA0aeropXyupmPHEyuNbhfSuIzT+QhEshHH lo0A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :message-id:references:to; bh=4M5GXSmarNqtrwVCPj8+uhqpvpvdghWssSXDriRKGzk=; b=E1HkoZjl6+QDuxY26kqur71utIf+rbFgotcHvDGN6elP84THxfXtEXdnK7TvfYYJIH n2vvqTXVb5ttw+4FbuKPh0Jt6SruQ8sOFp5dwHCjx0Yo1EcS73J9KpsgGBmk0ohYcOEc Q5Nf15hta0GSRu3FwNX4bWhyQWL7Y3tYxYoW0QBGcswRveA+mYwEtZyfB1Z590G/HwSD QXoTSj5CM4ENrFis2m2seAo7hM6dKI9EHxvDSE9jl4Ahadk/So3ozrQ++e1tJqGFIFl5 CqrHW6Rb35RqpdBlEtoQH3M8SYSoackA6MbEptXcdWsq8PENmLxmZKtUEcZgQ9KzIBjl HsYg== X-Gm-Message-State: APjAAAVsGueoIW1NI05QRnvROZFGOnUcFspeg2skqWiB4LLMI1U0lOWL 1dzVt2irEulJgWiBpWssUipK5g== X-Google-Smtp-Source: APXvYqyMHyHvUPOPUfvIY/GT9SDoeIIvApmuLBAt0oW6eeZxqCYz8JJZ/K8FNWCKmB+iqEdfJbXU7Q== X-Received: by 2002:a63:6f81:: with SMTP id k123mr31559368pgc.12.1566423799314; Wed, 21 Aug 2019 14:43:19 -0700 (PDT) Received: from ?IPv6:2620::2d0:110:a001:9cbc:6eb4:c2df? ([2620:0:2d0:110:a001:9cbc:6eb4:c2df]) by smtp.gmail.com with ESMTPSA id c5sm26360628pfo.175.2019.08.21.14.43.18 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 21 Aug 2019 14:43:18 -0700 (PDT) Content-Type: multipart/signed; boundary="Apple-Mail=_47787951-7F51-49C0-B817-38F887E45A08"; protocol="application/pgp-signature"; micalg=pgp-sha512 Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) From: David Conrad In-Reply-To: Date: Wed, 21 Aug 2019 14:43:17 -0700 Cc: ADD Mailing list X-Mailbutler-Message-Id: F88E1B7E-DAF0-4FEB-8BBE-52CD5068AF00 Message-Id: <044B5944-B0A2-414E-8C88-5C0F93D2AED6@virtualized.org> References: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> <59E0EC53-0E30-431C-8376-52C7BFC121A8@virtualized.org> <589DAFCB-1BDC-4156-A2CA-179C4559A6B2@virtualized.org> To: Rob Sayre X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] What to do in this potential working group X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Aug 2019 21:43:21 -0000 --Apple-Mail=_47787951-7F51-49C0-B817-38F887E45A08 Content-Type: multipart/alternative; boundary="Apple-Mail=_8007A6D9-1C9A-465A-A7AD-705B2ADF6465" --Apple-Mail=_8007A6D9-1C9A-465A-A7AD-705B2ADF6465 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Rob, On Aug 21, 2019, at 2:08 PM, Rob Sayre wrote: > On Wed, Aug 21, 2019 at 2:05 PM David Conrad > wrote: > DoH is channel protection. Can we please stop suggesting DoH addresses = data integrity? > I think the issue is that the various DNS WGs have left DNS = unencrypted for 30 years. No. The fact that the requirements for the DNS protocol transport did = not include confidentiality is _an_ issue, not _the_ issue. Asserting DoH does something that it doesn=E2=80=99t isn=E2=80=99t = helping address that particular issue. Regards, -drc --Apple-Mail=_8007A6D9-1C9A-465A-A7AD-705B2ADF6465 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Rob,

On Aug 21, 2019, at = 2:08 PM, Rob Sayre <sayrer@gmail.com> wrote:
On Wed, Aug 21, 2019 at 2:05 PM David Conrad = <drc@virtualized.org> wrote:
DoH is = channel protection. Can we please stop suggesting DoH addresses data = integrity?
I think the issue is = that the various DNS WGs have left DNS unencrypted for 30 years. =

No. = The fact that the requirements for the DNS protocol transport did not = include confidentiality is _an_ issue, not _the_ issue.

Asserting DoH does something that it doesn=E2=80=99t= isn=E2=80=99t helping address that particular issue.

Regards,
-drc

= --Apple-Mail=_8007A6D9-1C9A-465A-A7AD-705B2ADF6465-- --Apple-Mail=_47787951-7F51-49C0-B817-38F887E45A08 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEzEaOGlQw4bcyWBNfoCss/bh3zPcFAl1duvUACgkQoCss/bh3 zPfHeQ/+Ogn1ffo7HpJUONXXCkmWOO67g/cbyfsOH0ThpjM7KQw5egUksu0sFliG yquDc+OcA1uDNZOq3of++/ffeZoIGovZzxUsEju19lVAzA/rd0TbHiFktdE/Jk4Q Igk0mlgH2pj6saGf8kiyR8K3Q7mlefUQf9rL+KyPJsNNF46XyM1Jl60K6dvwePDe /P9N3f2wLDj9qb68eG/lzhDBqTXZy5nxA/YYTcwn+9uM6SZNReWiHvNiLCUJY2bF UnxF44hfKsFQtpYe9NIDJBJuYZ51fHPMdcMaS8vOxCZOlMT0aXE76H5+Bl1WbqJV HGP3hbxaOAeLjJOuJI8Xcq8E8xzddImVhE45Phnc9YltxSAK5IsU7uk2BvUx1MDy fIVYwUSDfB974VEalhI/sJJbAUvdbHgQmWnP/EEtTV853qOYcYOkp3sXB8zt94Wa Jk+GVqypxFDadfIghm+Ul0+QM133tR7xzLHqMBAQwHYG1hNfFeVj2iSztXKXykQg uSAW6FNa9pkPQg7yOgSD3tXEG13FariT17nNe0SPnW38aYLmHU2Iq9KAFo2ncDBg VMkI4K6GRDq6NF/WeoSqRntzZbSpvsJ17pTITRsUXeCDoOdBVE/7UTNCpGyaQ1eF qrvcqgcB//RfYOcTSc1kNel0+GxV35lYIA64Vfu8NH91cSdOsOg= =NB4l -----END PGP SIGNATURE----- --Apple-Mail=_47787951-7F51-49C0-B817-38F887E45A08-- From nobody Wed Aug 21 14:43:47 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A7F4C120086 for ; Wed, 21 Aug 2019 14:43:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id alnlbRspbCzU for ; Wed, 21 Aug 2019 14:43:42 -0700 (PDT) Received: from shaun.rfc1035.com (shaun.rfc1035.com [93.186.33.42]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3EB0412001E for ; Wed, 21 Aug 2019 14:43:42 -0700 (PDT) Received: from gromit.rfc1035.com (gromit.rfc1035.com [195.54.233.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by shaun.rfc1035.com (Postfix) with ESMTPSA id 635952421481; Wed, 21 Aug 2019 21:43:40 +0000 (UTC) From: Jim Reid Message-Id: <683A176C-3CE6-4866-A736-F2A7465FA5B5@rfc1035.com> Content-Type: multipart/signed; boundary="Apple-Mail=_9C95AF30-DF62-43A3-8F5A-7C1AA52F4527"; protocol="application/pgp-signature"; micalg=pgp-sha256 Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) Date: Wed, 21 Aug 2019 22:43:39 +0100 In-Reply-To: Cc: ADD Mailing list To: Stephen Farrell References: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> <59E0EC53-0E30-431C-8376-52C7BFC121A8@virtualized.org> <589DAFCB-1BDC-4156-A2CA-179C4559A6B2@virtualized.org> X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: [Add] data integrity and DNSSEC or DoH/DoT X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Aug 2019 21:43:46 -0000 --Apple-Mail=_9C95AF30-DF62-43A3-8F5A-7C1AA52F4527 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 > On 21 Aug 2019, at 22:13, Stephen Farrell = wrote: >=20 > IMO you're both right but not quite using super-precise terminology:-) >=20 > ... >=20 > So yep, both give data integrity, just differently. If we=E2=80=99re being super-precise, that=E2=80=99s not quite right = either Stephen. :-) DNSSEC and DoH/DoT are not different paths to the same end goal of data = integrity. They provide different flavours of data integrity. DNSSEC validation means you get the truth, the whole truth and nothing = but the truth regardless of your choice of resolver or the transport = path between you and that resolver. DoH and DoT offer no protection at = all from a lying resolver - you=E2=80=99re just guaranteed to receive = precisely whatever lies or truth that resolver sends. So in effect you = somehow decide to =E2=80=9Ctrust=E2=80=9D a TRR and hope for the best. = In some cases, that may well be good enough. In others, perhaps not. --Apple-Mail=_9C95AF30-DF62-43A3-8F5A-7C1AA52F4527 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQEzBAEBCAAdFiEECqYQ4ZU4r6HCYB+s/1mQu0V56F8FAl1duwsACgkQ/1mQu0V5 6F9rbgf/Q87BOE9o8rEyxS267Bf5drTTQPwVl2L4y7F5iaVQDX8W6kyg4K4v0qo1 tPydZPYd8N9MX+FBTdMepTKNNzg8gb/LslZQU4ohTc4AraBgwjnz1PyGL9QaYOx3 I+NJPpwrPmwaRZMv+pW3ViVionSMHCbsQhjQ18oDhrOpGFcjWRXQFJvMSma9/A6s qyTtagVRnlLxGfRU4InlKNGFQzpaKyjY9YtKW58MOOJxlN1CHHFryt0t/7Nnbsjp MIuKJI6FKSknLokN1TN/uEZ2cPIIre070XIkIQaCkTxw9548GG2CxY5u6911VmwJ 0tj3HTMCyfNn6ysCzzvCfe6b00LBRQ== =dkvj -----END PGP SIGNATURE----- --Apple-Mail=_9C95AF30-DF62-43A3-8F5A-7C1AA52F4527-- From nobody Wed Aug 21 14:46:25 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C9659120091 for ; Wed, 21 Aug 2019 14:46:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TLovVHeQA25L for ; Wed, 21 Aug 2019 14:46:21 -0700 (PDT) Received: from mail-io1-xd30.google.com (mail-io1-xd30.google.com [IPv6:2607:f8b0:4864:20::d30]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3B74812001E for ; Wed, 21 Aug 2019 14:46:21 -0700 (PDT) Received: by mail-io1-xd30.google.com with SMTP id q22so7752582iog.4 for ; Wed, 21 Aug 2019 14:46:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=Bl6lkMHK6l5/r5wV0EZe7hgAdIlUpp865psIXKyVNAc=; b=hZ6xbZer0V87yab2hX6sfqFEJHBTV+1MvyEISDULThpWaqOIKldd8DPXQH6tZwuCZW izU7YcSUEQwjaFLcJyfDWxfWtqp6MAcR1wwQsh1yZgOqb92gvAJb27pOeJeNyLTBJeWe oZfyMbfhsDivaMP7Bsp3FXLadYX0C/h2vdF87CU5Em57VkK9wuXIMdRd5YDM7I/w/jiY uFjkz+4wG1LfFr/n+IGO+lkO4STfZnkNAFq6D1ee9eVAwLOEHNoQx2dTL6MK6vHRv+8B YFmVyWgsl7+3PVyJbhj1iFKUKUteOPitymjDIgyJaRApzj3yvVr1W+AYEA7a99OzXpR4 IAUQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=Bl6lkMHK6l5/r5wV0EZe7hgAdIlUpp865psIXKyVNAc=; b=U7aOTgIuoLUH5WDEISBgK1KqFAScrutfQq2wDjcFGt6FgT03oI2/tlLuLfaTaZWL+D B+rBpl/A9tQGCkC6BIWZ5gc8McrbbSe+xbbFWD/Nfo1Yr/jzEw9d0kn5P/GP6C4gwG3H xpJ0fqvLNs3BiHDYp9u+DguEch3YgoFpmV2bMNXSs1GzSNKLqRgBkgMNyPXjMe2Cfv9J nwl1IepfcqR7QXAPxFxo6Ke0iQx2ojDDpaZTLnA4bUJt5Kr82L0BJmFIaEr+NxU4ClSP JV2GcZcBrY0i0FpeBV7jjMAgDmMj7+KU/C2qxwOh4KuQ6DlrkpBxYvhJQa7DqxJnr3BN 5Vyw== X-Gm-Message-State: APjAAAW5rhR6/UDrBKbP0hFoawf/+lxwzbdxdvinEyx6Oun6HFXePjmc 9ourQalpyhupme1nIbyaCntnrz5BZ8bjTSQln4sWUPjoWSWNqQ== X-Google-Smtp-Source: APXvYqwV+bLfy0rZTREWMeo/gXITlvnhclSDtLsOiTOoVFoS8y9zE2kQRHxurSJrhu0FmrVYevfy2FWMMCVCde87xMM= X-Received: by 2002:a02:cc8f:: with SMTP id s15mr12836799jap.53.1566423980337; Wed, 21 Aug 2019 14:46:20 -0700 (PDT) MIME-Version: 1.0 References: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> <59E0EC53-0E30-431C-8376-52C7BFC121A8@virtualized.org> <589DAFCB-1BDC-4156-A2CA-179C4559A6B2@virtualized.org> <044B5944-B0A2-414E-8C88-5C0F93D2AED6@virtualized.org> In-Reply-To: <044B5944-B0A2-414E-8C88-5C0F93D2AED6@virtualized.org> From: Rob Sayre Date: Wed, 21 Aug 2019 14:46:09 -0700 Message-ID: To: David Conrad Cc: ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000ea6ff40590a7804f" Archived-At: Subject: Re: [Add] What to do in this potential working group X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Aug 2019 21:46:23 -0000 --000000000000ea6ff40590a7804f Content-Type: text/plain; charset="UTF-8" On Wed, Aug 21, 2019 at 2:43 PM David Conrad wrote: > > No. The fact that the requirements for the DNS protocol transport did not > include confidentiality is _an_ issue, not _the_ issue. > Let's dive deeper on that assertion. Why did you write this message? thanks, Rob --000000000000ea6ff40590a7804f Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Wed, Aug 21, 2019 at 2:43 PM David Con= rad <drc@virtualized.org> = wrote:
=
No. The fact that the requirements for the DNS protocol tran= sport did not include confidentiality is _an_ issue, not _the_ issue.
=

Let's dive deeper on= that assertion. Why did you write this message?

t= hanks,
Rob=C2=A0
--000000000000ea6ff40590a7804f-- From nobody Wed Aug 21 14:48:00 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B13A9120086 for ; Wed, 21 Aug 2019 14:47:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.299 X-Spam-Level: X-Spam-Status: No, score=-4.299 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pyhgMyzR-S_c for ; Wed, 21 Aug 2019 14:47:56 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3450112001E for ; Wed, 21 Aug 2019 14:47:56 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 61D8CBE55; Wed, 21 Aug 2019 22:47:53 +0100 (IST) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id evvNKIdYCvSv; Wed, 21 Aug 2019 22:47:52 +0100 (IST) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id CAE21BE50; Wed, 21 Aug 2019 22:47:51 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1566424071; bh=W6bMgoUKBuedzTBLtkYD50EwjAMomVx/gctQvp2FU2U=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From; b=oz3TgUIh83bGOCa3s7bzZoFYxDmeZXd5WLF6XeOyOu7cpXJCo3vM74Jpp2dNow5ul WcM6YDEHD2K7koMkcRWaiA9dPSzf/3RFeH1srngIKBo537Vn3a8uTsiSwqd0lt7Ovt TmSGbRLH+M6qKhfk271N+drXgB1am/qX+mq0nHwY= To: Jim Reid Cc: ADD Mailing list References: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> <59E0EC53-0E30-431C-8376-52C7BFC121A8@virtualized.org> <589DAFCB-1BDC-4156-A2CA-179C4559A6B2@virtualized.org> <683A176C-3CE6-4866-A736-F2A7465FA5B5@rfc1035.com> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: Date: Wed, 21 Aug 2019 22:47:51 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: <683A176C-3CE6-4866-A736-F2A7465FA5B5@rfc1035.com> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="UtQqanugDLzJKbq46DvatS6hgcqgy9EW2" Archived-At: Subject: Re: [Add] data integrity and DNSSEC or DoH/DoT X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Aug 2019 21:47:59 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --UtQqanugDLzJKbq46DvatS6hgcqgy9EW2 Content-Type: multipart/mixed; boundary="555yXCuVIK21iWLie1boWBBlHLsE3Zgk3"; protected-headers="v1" From: Stephen Farrell To: Jim Reid Cc: ADD Mailing list Message-ID: Subject: Re: [Add] data integrity and DNSSEC or DoH/DoT References: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> <59E0EC53-0E30-431C-8376-52C7BFC121A8@virtualized.org> <589DAFCB-1BDC-4156-A2CA-179C4559A6B2@virtualized.org> <683A176C-3CE6-4866-A736-F2A7465FA5B5@rfc1035.com> In-Reply-To: <683A176C-3CE6-4866-A736-F2A7465FA5B5@rfc1035.com> --555yXCuVIK21iWLie1boWBBlHLsE3Zgk3 Content-Type: multipart/mixed; boundary="------------8239A1C36B180D0C91CF8525" Content-Language: en-GB This is a multi-part message in MIME format. --------------8239A1C36B180D0C91CF8525 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hiya, On 21/08/2019 22:43, Jim Reid wrote: >=20 >=20 >> On 21 Aug 2019, at 22:13, Stephen Farrell >> wrote: >>=20 >> IMO you're both right but not quite using super-precise >> terminology:-) >>=20 >> ... >>=20 >> So yep, both give data integrity, just differently. >=20 > If we=E2=80=99re being super-precise, that=E2=80=99s not quite right ei= ther Stephen. > :-) Happy to have a definitions-at-dawn duel later... after a pile of beers some time perhaps:-) >=20 > DNSSEC and DoH/DoT are not different paths to the same end goal of > data integrity. They provide different flavours of data integrity. I don't agree that the goals are precisely the same as the actors involved in providing the security services differ. There's a lot in common, but they aren't identical. > DNSSEC validation means you get the truth, the whole truth and > nothing but the truth=20 Phrases such as that don't occur in RFC4949. That's where we find definitions for these kinds of security service. I can think of many reasons why it's a good idea to avoid such phrases when defining technical terms:-) Cheers, S. > regardless of your choice of resolver or the > transport path between you and that resolver. DoH and DoT offer no > protection at all from a lying resolver - you=E2=80=99re just guarantee= d to > receive precisely whatever lies or truth that resolver sends. So in > effect you somehow decide to =E2=80=9Ctrust=E2=80=9D a TRR and hope for= the best. In > some cases, that may well be good enough. In others, perhaps not. >=20 >=20 >=20 --------------8239A1C36B180D0C91CF8525 Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------8239A1C36B180D0C91CF8525-- --555yXCuVIK21iWLie1boWBBlHLsE3Zgk3-- --UtQqanugDLzJKbq46DvatS6hgcqgy9EW2 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAl1dvAcACgkQWrL68XsX K+pdqxAA0aJG67oSO0xk4N1rNDY9ehuSYKZNAJKejhk9Eq1mhv2TK4YGWqOeKBiU zyQf5pTBvQuJQung7BCzhJ4Sldf7xY7CQ2eui6ldub3J5ZJ8hmXqM1DjOMdjhg4F StevO34ioigBUXdoRQNsTvMZVLnXoDxW+tpriKHwGO5CrUqfU03XR2womzkpRz4D xBNxGFRpauawTffmdRhQr/hYgkZSGeUjSueGP1ldv3N1awHgC1dU/7kuwxOR8gOJ GlP0at1oAnFeAUGmcW01JJTEr4SuVVdnhrfoz9ldv0BsRB6kHVXiFVrBB7hfKsAD B+8t2Pb241zG64bYVzTc7kWuwWvHf0HvBIplKQb57Vw6Jucg8OEej27qoaqqPHe9 xuXng+nHUQlZwqL+J2a4k5b6R4vMt10tRR4tjLGtS968QT7zLCIh+dV9EGnssbP9 eh0NdSkMqTCXvGKGB0iCPWad7LC7CVCgh3kdLdQgp0nXBvZB1o3HmiJ2ysnfiY1D qFr8aUNB9p2hWlN08CCQUwF33NQtCPY/hKZyDB6KvvQ5KhmMQvhZQq1qYQ3rROcC nl4ZWqkSn7eF8esehB5i1hSZgF6Bzi41lMctj8kfr0iNx2E8RxIess3MXIQoAY8u te0zZCUYKjP116nAnd0QNdlzztX0AythCXmok4vwu/HE2r6AfYs= =lPj1 -----END PGP SIGNATURE----- --UtQqanugDLzJKbq46DvatS6hgcqgy9EW2-- From nobody Wed Aug 21 15:14:58 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A0A4612010F for ; Wed, 21 Aug 2019 15:14:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=virtualized-org.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FdBkQr5_vBWS for ; Wed, 21 Aug 2019 15:14:55 -0700 (PDT) Received: from mail-pg1-x532.google.com (mail-pg1-x532.google.com [IPv6:2607:f8b0:4864:20::532]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 325D91200A3 for ; Wed, 21 Aug 2019 15:14:55 -0700 (PDT) Received: by mail-pg1-x532.google.com with SMTP id u17so2159558pgi.6 for ; Wed, 21 Aug 2019 15:14:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtualized-org.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc:message-id:references :to; bh=IPSV3K+uOmmDViemM3CStDlBqlzzCc2H414hpxFRemc=; b=oNcv0q2A2kH/Ddjr7xUfKkIR4uYwzy8w3O/YKH3gRlyieLNbsaM1WufZBLcFyF6jMN LeR+YNxzXq1+pxqSBHzcCaF1vTkeQcZag3t2rII0KmgkKtfKS0AxpCdrQiYQ1phxQdsu y385Yc4dMzUoAqiubKEMJ5BK5dNO6Xb2F9hEj7//IzotzymSZadr9oIcMgc4Jb5jOH9X a+/S/1eDTzkebGVRHGj3lg/1+02tzvV5X5E+QOQLhQv6obPV2rodjHA6BdD3KYcG0pGZ kEu/ql/Sweuz+RSmlBtlqfSkyJuYqqnIMQ4iqI4r3DRoW8drIGWUBEiOpboIaSUcAkI9 QEdQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :message-id:references:to; bh=IPSV3K+uOmmDViemM3CStDlBqlzzCc2H414hpxFRemc=; b=pFTyArJetto5Vfb+U5Rpmqx+ZTJitCt7OxRqVplNiKUXMkNEX/WJ20jfm0jyUZ1ahh JBR6hHM+DZGTIyWs1uJD/yT6/N4Qo3M17KWcgVNkHmV/wO4WOPB/9schYltuYfTcMrrx XqHdUK4JsPlf0XYDPLgEYW4iQpjAsHGSpFrrdCWi/rC/2QMvX8URAWt12yMOhaDY/QRg k+6PMnB18w69YYM7TByRvcv3fb5TiPxJqRdV18b0KNQyO5SUYbi1JLytcsfBea5D3xHK 9JmwqYRZc4jh9yJP4f0Jv9PKQphzqNxUGNBxntPobeZ6r5w9iKUXPDVq/6CIxcvhD+g4 bF4w== X-Gm-Message-State: APjAAAV1BEe7Z/dyy8rj2wNSg6MBcZODZX4wV/iGDCbSTCO8UZnAwxNi OQl0Fk+9RDiYDmtscdKm7wK3Kla7qQY= X-Google-Smtp-Source: APXvYqyLHPIvCMPzJffEt8ghy7J6iYosrA4dvWq+F/uC15/O5ABhr5yns9GC9dXFljxMJUx21LXzYw== X-Received: by 2002:a65:5144:: with SMTP id g4mr31078680pgq.202.1566425694656; Wed, 21 Aug 2019 15:14:54 -0700 (PDT) Received: from ?IPv6:2620::2d0:110:a001:9cbc:6eb4:c2df? ([2620:0:2d0:110:a001:9cbc:6eb4:c2df]) by smtp.gmail.com with ESMTPSA id ce20sm852362pjb.16.2019.08.21.15.14.53 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 21 Aug 2019 15:14:53 -0700 (PDT) Content-Type: multipart/signed; boundary="Apple-Mail=_30E8F686-D526-461D-8B94-D4E3B6226CAA"; protocol="application/pgp-signature"; micalg=pgp-sha512 Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) From: David Conrad In-Reply-To: Date: Wed, 21 Aug 2019 15:14:51 -0700 Cc: Jim Reid , ADD Mailing list X-Mailbutler-Message-Id: 18518016-CBA5-4F83-88EC-CA50F5CD109D Message-Id: References: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> <59E0EC53-0E30-431C-8376-52C7BFC121A8@virtualized.org> <589DAFCB-1BDC-4156-A2CA-179C4559A6B2@virtualized.org> <683A176C-3CE6-4866-A736-F2A7465FA5B5@rfc1035.com> To: Stephen Farrell X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [Add] data integrity and DNSSEC or DoH/DoT X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Aug 2019 22:14:57 -0000 --Apple-Mail=_30E8F686-D526-461D-8B94-D4E3B6226CAA Content-Type: multipart/alternative; boundary="Apple-Mail=_E4D2F882-3B83-4778-AA24-A393A1A5708F" --Apple-Mail=_E4D2F882-3B83-4778-AA24-A393A1A5708F Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Stephen, On Aug 21, 2019, at 2:47 PM, Stephen Farrell = wrote: >> DNSSEC and DoH/DoT are not different paths to the same end goal of >> data integrity. They provide different flavours of data integrity. >=20 > I don't agree that the goals are precisely the same as the > actors involved in providing the security services differ. > There's a lot in common, but they aren't identical. You appear to be agreeing with Jim. DNSSEC provides data integrity _for what the zone authority put into the = zone_, regardless of how it gets to the client. A TLS channel between a client and a resolver (DoH or DoT) provides data = integrity and confidentiality (and _resolver_ origin authentication) = _for what the RESOLVER chooses to serve_. DoH _will not help_ if the =E2=80=9Ctrusted=E2=80=9D resolver is = compromised to modify the response (something I suspect concentrating = the resolver function will encourage). DNSSEC would help that = particular attack. My response to Ted that caused me to get sucked into this particular = swamp (something I already regret) was merely trying to point out there = is a significant difference there. I hope that clarifies. Regards, -drc --Apple-Mail=_E4D2F882-3B83-4778-AA24-A393A1A5708F Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8
Stephen,

On Aug 21, = 2019, at 2:47 PM, Stephen Farrell <stephen.farrell@cs.tcd.ie> wrote:
DNSSEC and DoH/DoT are not different paths to = the same end goal of
data integrity. They provide = different flavours of data integrity.

I don't agree that the goals are precisely the same as the
actors involved in providing the security services differ.
There's a lot in common, but they aren't identical.

You = appear to be agreeing with Jim.

DNSSEC= provides data integrity _for what the zone authority put into the = zone_, regardless of how it gets to the client.

A TLS channel between a client and a resolver (DoH = or DoT) provides data integrity and confidentiality (and _resolver_ = origin authentication)  _for what the RESOLVER chooses to = serve_.

DoH _will not help_ if the = =E2=80=9Ctrusted=E2=80=9D resolver is compromised to modify the response = (something I suspect concentrating the resolver function will = encourage).  DNSSEC would help that particular = attack.

My response to Ted that = caused me to get sucked into this particular swamp (something I already = regret) was merely trying to point out there is a significant difference = there.

I hope that = clarifies.

Regards,
-drc

= --Apple-Mail=_E4D2F882-3B83-4778-AA24-A393A1A5708F-- --Apple-Mail=_30E8F686-D526-461D-8B94-D4E3B6226CAA Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEzEaOGlQw4bcyWBNfoCss/bh3zPcFAl1dwlwACgkQoCss/bh3 zPc4PA//bEJQw4rvvA6TzGh3WG4cwZCHt1WU6s//9gEa7e7L9kPmmHpOPkN1dFhK HQVdpe+vEgRqWjFV7iM//gWr0CUSTzGywB8jGf7b85IWusAdVRHr6NQyXlJNMafN /X6rStJJa/c8ihW1y0rD7SNOWbRIrVa3hE0gEaUCLf3jhqSW2RUA8w/pczys/7eZ IwwlYungKzs+Cq46bc9WpJ+niTnVNm+iygU/3wyuNNYBIYcAmsHIOTo1pMFY9kga 68bsmDHZxOWOkvWQzosAbJTeqpfM9C68e3YjzTCT5fhPjCZUaYTTlYFh7bowpk+E LBEhk717wr31xHoh1Ng4P6KrIlGCcuEKkzg5CWEIr8vx29SzSAe15X4DD4UUj3HB LnfWdHahum+XZPzyZ9CCmyN8Q+4c39CrTF/5oEW6qfTfLoFiTwJPYylMS8u8jSbr 5fCfSh9yh3djlN31x+5jej1f6SDtevHBxw+IEfgjKNfkWqOlhDBiF1k7Vjjp8IwZ zghiNP5UU89xSzFnaa+4ZLPJvhZBrG/iSb8kwxD00Xf2jTuk4hZ3JIH5XNS+SZt0 vzrEnJIuA6Buei3hIduYSRJpXZnhL9I8zAjfj+RosUbKfu8J4BJZP0Kh5RIq+gC8 q96gdEBDKipRJx5r6pVOxM0n5DWlDhbRyHavGPfq5PJeHuI4Jl4= =S/Lg -----END PGP SIGNATURE----- --Apple-Mail=_30E8F686-D526-461D-8B94-D4E3B6226CAA-- From nobody Wed Aug 21 15:19:12 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 492F012010F for ; Wed, 21 Aug 2019 15:19:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Ct7qQSbtKCrk for ; Wed, 21 Aug 2019 15:19:08 -0700 (PDT) Received: from mail-io1-xd2f.google.com (mail-io1-xd2f.google.com [IPv6:2607:f8b0:4864:20::d2f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B11C512010E for ; Wed, 21 Aug 2019 15:19:08 -0700 (PDT) Received: by mail-io1-xd2f.google.com with SMTP id z3so7955461iog.0 for ; Wed, 21 Aug 2019 15:19:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=+c3lbnA1HJdrSk+1XOEl8lk0M+PSnfIonGHkzMSSb+c=; b=dB2QAjjoeYbkSVSLUDSl6ZbTtmcQuFQrxNoK5eB6NweUFlIzfENglq+syZXbYvfWxu PGr2d6JJ7rH2qb09K0i45meX40FMVul1cq62guIzDFY3TCoE/LEyXirLZXuwqa6dWDgt cPw2lIE5CUtn9ZA/AFtJZoiNGFjWuBY295p0ZXJ6vz3XVs8xr6K9r2LB0jJudzGMqPwI /rsDVxW6kALv/wwnvJhzB4JH5GQzG7IVPxmXDN5bwbNc2nwIk/z8noGhUeF2KnHFUQuy A46657tBmYcUqMLtYA5dwjjnBZ4Z1HzcOIqgMT1Hf494oqOU8S2z9jnFcUEw93MhYWvq JW8A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=+c3lbnA1HJdrSk+1XOEl8lk0M+PSnfIonGHkzMSSb+c=; b=USetnur84esOrnb8acoXp1HiIfxb0c5zlC8Ojl457vBjIjGjBuHmMa+t1titYdEXz9 WEyxAk2OdFA3VIYdBzmFV6o6efOctRQHXK78T0MQikU5KaZgEwwtpn0dffejI2OieaZ4 4lzP95OHFsdik+8O+osirQ+KRV6zitWLIOMkUxfJctOJMTn/FaUf2XXKP8W766QuiCrW K4vUhaMpQSAxPjYiXwOI6CFnunh5Ai7K5pNF6S9rEACaew/MbYB1JHXIb2vXcBrCjvTz WG3oXyRP0yy7uxGUZ+J3mOLEhg+8IuxRdYqTnZNsYLkdJPu6r70ozPEPiJiVMYE+m7S8 CO5A== X-Gm-Message-State: APjAAAUeDpUknIuHyQKfWUZNHDhgBGWuVf37m1iRwBR/zpJuEReRgbj4 eNv80wcbkwy+XsdO7HU/UWfQueZ2s4SCmbMkvY8= X-Google-Smtp-Source: APXvYqwdBlcZeoRcJURf5mXz74sOdMPNU+O6ZonSwYIwEgsS+LdGze6k3UB4IGIy8FUvf4TOqit4iDHqAaetNtxMxOU= X-Received: by 2002:a02:cc8f:: with SMTP id s15mr12997247jap.53.1566425947659; Wed, 21 Aug 2019 15:19:07 -0700 (PDT) MIME-Version: 1.0 References: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> <59E0EC53-0E30-431C-8376-52C7BFC121A8@virtualized.org> <589DAFCB-1BDC-4156-A2CA-179C4559A6B2@virtualized.org> <683A176C-3CE6-4866-A736-F2A7465FA5B5@rfc1035.com> In-Reply-To: From: Rob Sayre Date: Wed, 21 Aug 2019 15:18:56 -0700 Message-ID: To: David Conrad Cc: Stephen Farrell , Jim Reid , ADD Mailing list Content-Type: multipart/alternative; boundary="0000000000002d65ca0590a7f6a1" Archived-At: Subject: Re: [Add] data integrity and DNSSEC or DoH/DoT X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Aug 2019 22:19:10 -0000 --0000000000002d65ca0590a7f6a1 Content-Type: text/plain; charset="UTF-8" On Wed, Aug 21, 2019 at 3:15 PM David Conrad wrote: > My response to Ted that caused me to get sucked into this particular swamp > (something I already regret) > Is that the swamp where the only significant DNSSEC providers are Google and Cloudflare? thanks, Rob --0000000000002d65ca0590a7f6a1 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Wed, Aug 21, 2019 at 3:15 PM David Con= rad <drc@virtualized.org> = wrote:
My respons= e to Ted that caused me to get sucked into this particular swamp (something= I already regret)=C2=A0

Is tha= t the swamp where the only significant DNSSEC providers are Google and Clou= dflare?

thanks,
Rob=C2=A0
--0000000000002d65ca0590a7f6a1-- From nobody Wed Aug 21 15:27:56 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0A4C7120110 for ; Wed, 21 Aug 2019 15:27:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.299 X-Spam-Level: X-Spam-Status: No, score=-4.299 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lCll7LTUdGZN for ; Wed, 21 Aug 2019 15:27:52 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8A28B1200A3 for ; Wed, 21 Aug 2019 15:27:52 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 22D5FBE55; Wed, 21 Aug 2019 23:27:50 +0100 (IST) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FsQJFm2jCtlD; Wed, 21 Aug 2019 23:27:48 +0100 (IST) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 693EABE50; Wed, 21 Aug 2019 23:27:48 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1566426468; bh=MaMbT6mpwh5QR7AAJUJRlb5pShjtFF546NEiqdOr4zY=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From; b=KN5bdl+U4a4f96QebPA8+azHSyovsXCvjlo2tzr2FHWrXPcOLPXxoC8B/m//neQ3V JS1HNBrBo66jwicmLj0NiHAaGRxlwikmuxAMK3b3AafntHnevJikKnmQvmZ7ZeB3Og TZWcxWVF4kSqITrtbv3wLTN5356aTOcK5v5mMudc= To: David Conrad Cc: Jim Reid , ADD Mailing list References: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> <59E0EC53-0E30-431C-8376-52C7BFC121A8@virtualized.org> <589DAFCB-1BDC-4156-A2CA-179C4559A6B2@virtualized.org> <683A176C-3CE6-4866-A736-F2A7465FA5B5@rfc1035.com> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: <1459e7d8-a98d-92e8-8c69-7667d6bb4bdb@cs.tcd.ie> Date: Wed, 21 Aug 2019 23:27:47 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="KWm3Jf5pDP93a1ur8fbyFabJHaPeFavb5" Archived-At: Subject: Re: [Add] data integrity and DNSSEC or DoH/DoT X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Aug 2019 22:27:55 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --KWm3Jf5pDP93a1ur8fbyFabJHaPeFavb5 Content-Type: multipart/mixed; boundary="pbMhTOShsolIQ8kzIre8zCidZJ67wWPaP"; protected-headers="v1" From: Stephen Farrell To: David Conrad Cc: Jim Reid , ADD Mailing list Message-ID: <1459e7d8-a98d-92e8-8c69-7667d6bb4bdb@cs.tcd.ie> Subject: Re: [Add] data integrity and DNSSEC or DoH/DoT References: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> <59E0EC53-0E30-431C-8376-52C7BFC121A8@virtualized.org> <589DAFCB-1BDC-4156-A2CA-179C4559A6B2@virtualized.org> <683A176C-3CE6-4866-A736-F2A7465FA5B5@rfc1035.com> In-Reply-To: --pbMhTOShsolIQ8kzIre8zCidZJ67wWPaP Content-Type: multipart/mixed; boundary="------------2596C774B5E705587D41AC73" Content-Language: en-GB This is a multi-part message in MIME format. --------------2596C774B5E705587D41AC73 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hiya, On 21/08/2019 23:14, David Conrad wrote: > Stephen, >=20 > On Aug 21, 2019, at 2:47 PM, Stephen Farrell > wrote: >>> DNSSEC and DoH/DoT are not different paths to the same end goal >>> of data integrity. They provide different flavours of data >>> integrity. >>=20 >> I don't agree that the goals are precisely the same as the actors >> involved in providing the security services differ. There's a lot >> in common, but they aren't identical. >=20 > You appear to be agreeing with Jim. I often do :-) > DNSSEC provides data integrity _for what the zone authority put into > the zone_, regardless of how it gets to the client. >=20 > A TLS channel between a client and a resolver (DoH or DoT) provides > data integrity and confidentiality (and _resolver_ origin > authentication) _for what the RESOLVER chooses to serve_. Yep. > DoH _will not help_ if the =E2=80=9Ctrusted=E2=80=9D resolver is compro= mised to > modify the response (something I suspect concentrating the resolver > function will encourage). DNSSEC would help that particular attack. Yep. Those are both true statements. There are equally true statements that'd demonstrate cases where DoH or DoT do better than DNSSEC - IIUC an important one being: given the (unfortunate) relative sparsity of DNSSEC signed data, the data integrity service that DoH or DoT can provide could well be argued to be as good as what a client can get via DNSSEC when the full set of queries a client makes are taken into account. I'm not saying I agree with that as a winning-argument, but it is an entirely arguable proposition. > My response to Ted that caused me to get sucked into this particular > swamp (something I already regret) was merely trying to point out > there is a significant difference there. Sure. But I figure its important we try be precise in how we talk about those differences - given how controversial people find this topic, we otherwise end up making a hard discussion harder, as was evident in some recent exchanges. Cheers, S. >=20 > I hope that clarifies. >=20 > Regards, -drc >=20 >=20 >=20 --------------2596C774B5E705587D41AC73 Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------2596C774B5E705587D41AC73-- --pbMhTOShsolIQ8kzIre8zCidZJ67wWPaP-- --KWm3Jf5pDP93a1ur8fbyFabJHaPeFavb5 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAl1dxWMACgkQWrL68XsX K+rMaw//UwP+ObzEeYKUxPXLsydYSqxdIHm+OCoxlEbD6P6eVN+Z3qNVMymTARQ8 qU4T3cCXPhrhq9JfZJ8PW2gNzdEubWb/0dtHrrpt6IXY9vF3fCGlWT8+kpZpWIHM PHhoPe+skK1D/JlL/eVnKb8blha/78LnmAfDlXK4KP8nPhjLsHXhC9X0vZ7NCqyf moQM4xO43YTICpwbwZJFQDCJMRR1YC/kJ1l203L5yCme6aheDk6jWNk2RqkrSLIf JPvqFBw1ERsm1on5jyHTZWLKauod2BfI68SwPwBLnU6wcfuihUx15gnofp0jqUZq 2njLN0B2whDAmTaUPzrxtpuZauRjYK6M4FZiW6Nx+ef4FFYfs5hniy3wkK9vci1n L82mpnBybHjZZWPQSY24dz1jw3iT/FrPch8z3PMPyzgK2ZInrW6w//M4ySga+/qQ O1xcXoAO/2TJWb9HWA7s9vbIgahO7EjF2tTQWpwHDgqsqd2CgIPwHDCri7SeTXys lwJq1NmLk6NGwV5/6mLwhRZEB5Pp60q7FcF4uNLk2PvpHzBBs1/XA+KOFvJ6ExGu hxfiHvlYsoC6BCGba2h7e9dVPd1DwcUK6sXVRCKMFKLIV4+r0fxCVoAk46nR7ciD qH+XO5dywHW8PKg/qCkCuTWjFvmUalTlcK/cfwIBWYKT+z1GW7o= =A/Br -----END PGP SIGNATURE----- --KWm3Jf5pDP93a1ur8fbyFabJHaPeFavb5-- From nobody Wed Aug 21 18:08:59 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 530DC12010E for ; Wed, 21 Aug 2019 18:08:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.75 X-Spam-Level: X-Spam-Status: No, score=-1.75 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.249, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1536-bit key) header.d=iecc.com header.b=egYbvxlD; dkim=pass (1536-bit key) header.d=taugh.com header.b=QGJ7jnTo Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dYrCcNTyftVf for ; Wed, 21 Aug 2019 18:08:51 -0700 (PDT) Received: from gal.iecc.com (gal.iecc.com [IPv6:2001:470:1f07:1126:0:43:6f73:7461]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C4C9912004C for ; Wed, 21 Aug 2019 18:08:50 -0700 (PDT) Received: (qmail 94037 invoked from network); 22 Aug 2019 01:08:49 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=iecc.com; h=date:message-id:from:to:cc:subject:in-reply-to:mime-version:content-type:content-transfer-encoding; s=16f53.5d5deb21.k1908; i=printer-iecc.com@submit.iecc.com; bh=3r9NdOofiVGqwkfoGHoYkulTBPC9wCdX4EKmX95p0ec=; b=egYbvxlDiaHN4kIARPCWuR3xaghZcvAKLkkaGo7jFT7p62UGziwMQdrf7/K71+13ULR5OOmkiaEKVA4kUwFn+sF0MIjrnrNko5RjcXecFfvCISYr8b3blOZsG2Q5mKQ55iPQlTRJWiv5n0vD/LPqxKnhASQweCgZBjAT574Po4DikIuM+zXg5hlaqTHW05E0SSvmYR/7W/A5kw3Ya3xBp/LeXwlIorFJPFyADPV/WK+G0GqhNZ0guwJWf8dfQP/Z DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=taugh.com; h=date:message-id:from:to:cc:subject:in-reply-to:mime-version:content-type:content-transfer-encoding; s=16f53.5d5deb21.k1908; olt=printer-iecc.com@submit.iecc.com; bh=3r9NdOofiVGqwkfoGHoYkulTBPC9wCdX4EKmX95p0ec=; b=QGJ7jnToyFD1KKyELmK47thG8Hcb/Pw67tbPzRL2ci5tVJzCytwhod6m7/5BJRNVCDrqbcd9A2X/KhvQJ3H1jUamypVws9HMX/nmtgwUe+26IOdZZR3HMUlDnorjr7f47egSUAQXArctBWtEG3n64T9Ux9hgilGnc5lL3KWqBCIvMskAN5bao+x5U0ZKwFhfaXI5RAD0CQ+4suhoyLl5C+WhzaKVCW8moa2xJgRyojXFPEViIYsfgmvHHfyRNHon Received: from ary.qy ([64.246.232.221]) by imap.iecc.com ([64.57.183.75]) with ESMTPSA (TLS1.2 ECDHE-RSA AES-256-GCM AEAD, printer@iecc.com) via TCP; 22 Aug 2019 01:08:49 -0000 Received: by ary.qy (Postfix, from userid 501) id 0010F89BB7F; Wed, 21 Aug 2019 21:08:48 -0400 (EDT) Date: 21 Aug 2019 21:08:48 -0400 Message-Id: <20190822010849.0010F89BB7F@ary.qy> From: "John Levine" To: add@ietf.org Cc: vittorio.bertola@open-xchange.com In-Reply-To: <1081276693.4678.1566384230225@appsuite-gw1.open-xchange.com> Organization: Taughannock Networks X-Headerized: yes Mime-Version: 1.0 Content-type: text/plain; charset=utf-8 Content-transfer-encoding: 8bit Archived-At: Subject: Re: [Add] Unstated assumptions in What to do in this potential working group X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 22 Aug 2019 01:08:52 -0000 In article <1081276693.4678.1566384230225@appsuite-gw1.open-xchange.com> you write: >I still think that having an agreed write-up of the issues and/or of the use cases, even without any recommendation on how to deal with them, could also be useful. This was the main >subject of the original three drafts presented in Prague. Agreed. We're still seeing people argue with unstated assumptions that are obviously not the same. For example, a bunch of messages have gone by that clearly assume that the person using a device has chosen to use a particular DoH service. I can easily believe that could be the case for the very atypical bunch of people in this discussion, but not for grandma using whatever defaults her browser or phone app or ISP or malware set, nor for IoT devices that use whatever. I see similar cross assumptions in "trustworthy result." Some people apparently assume it's synonymous with DNSSEC validated, but for me if it's a bot trying to find its C&C host, the trustworthy result is NXDOMAIN or SERVFAIL. I think it would be useful to try and tease these out so we at least have a chance of agreeing on what we disagree about. R's, John From nobody Wed Aug 21 20:31:28 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D13CF12003F for ; Wed, 21 Aug 2019 20:31:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WumLo47meMar for ; Wed, 21 Aug 2019 20:31:26 -0700 (PDT) Received: from mail-qt1-x830.google.com (mail-qt1-x830.google.com [IPv6:2607:f8b0:4864:20::830]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F28CE120018 for ; Wed, 21 Aug 2019 20:31:25 -0700 (PDT) Received: by mail-qt1-x830.google.com with SMTP id v38so5937807qtb.0 for ; Wed, 21 Aug 2019 20:31:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=KZxIXpPcya58QeGmAi0dt+oRHhqNrpOQT78rURfYCiQ=; b=LcWp45065GaTUZZGB7WakBzwrQssb2NOiM4o6vd7KfL2GT8NNr8v65mTbItUTKS3Bt O76Xi48qHhtBgRAruVr4EcpQCHNnLOgtxlYAx0+a9xXrwitOfb48eMgqZ8IL/2tKUKO6 1IAk0djCGT/wjNJCYfIjmhR2+zFYMiqfUaOKRdi/pdQA8JvykByLrRxtG7bbROar4CUJ a8oXQcMfpnrUzyjWVvozJvQ4/MTeJhB7sZE/fgEhXH6efgdDwXuno4aQogs/eFOCz0zX MOhKoIsDRqnuN1V0JKBWPzV2lUvVqBvFMUT5QPXVrUzgRBLyetPtcCCePIfxqsdM1sXB lVeg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=KZxIXpPcya58QeGmAi0dt+oRHhqNrpOQT78rURfYCiQ=; b=QipmjUW4QNUVrK19gIQpQ5oFTL4EhUSXBofDbEV6/DkTmX1LEYMHfem/F/4NvIv6J1 WTFESAph9o0xaZHSFHUKMIlZdWL31pFFfNoTjMKPliVxBJGgZs82Q8IHtCb8I4lPCPTH 4BLzgvgnBxOLEwsVx8Jef525j4R0g2WL8qBARlTMt/lCHPBCVon7+0Gpmq8HsOwglRJ6 9yV7oIM9nljXYGLUtQznmU27ZOqF3cXwWatGYoPkoI9MPPd9dkPpOvs1JNpanKAsSeXK 0ze4Lwwhm2bHz/MBnW991cxaqrts0rA+i2iDPcXPKroqPhd11OJNOZGTzwb4R4Ionx1p Brcw== X-Gm-Message-State: APjAAAVn/5/LlxldFoOof9Cm+UsY/dbQxzTpBgOrfGoDGRpluzd6NBPG S6F/+MFDW46BHmmCFDGVXn8= X-Google-Smtp-Source: APXvYqzssVDSows/hl3mYnq86/7n5Nvf7iCu81vN2DEJ3XJIBJYFiti0W5WeerUfgRyzVVnMx7ebQQ== X-Received: by 2002:a05:6214:561:: with SMTP id cj1mr20334690qvb.50.1566444684932; Wed, 21 Aug 2019 20:31:24 -0700 (PDT) Received: from [192.168.2.4] (cpe-76-179-66-50.maine.res.rr.com. [76.179.66.50]) by smtp.gmail.com with ESMTPSA id g24sm13413842qtc.38.2019.08.21.20.31.24 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 21 Aug 2019 20:31:24 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (1.0) From: Brian Dickson X-Mailer: iPhone Mail (16G77) In-Reply-To: <1459e7d8-a98d-92e8-8c69-7667d6bb4bdb@cs.tcd.ie> Date: Wed, 21 Aug 2019 23:31:22 -0400 Cc: David Conrad , Jim Reid , ADD Mailing list Content-Transfer-Encoding: quoted-printable Message-Id: <16B52A77-92D0-44F7-866D-D3420D6FE162@gmail.com> References: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> <59E0EC53-0E30-431C-8376-52C7BFC121A8@virtualized.org> <589DAFCB-1BDC-4156-A2CA-179C4559A6B2@virtualized.org> <683A176C-3CE6-4866-A736-F2A7465FA5B5@rfc1035.com> <1459e7d8-a98d-92e8-8c69-7667d6bb4bdb@cs.tcd.ie> To: Stephen Farrell Archived-At: Subject: Re: [Add] data integrity and DNSSEC or DoH/DoT X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 22 Aug 2019 03:31:28 -0000 > On Aug 21, 2019, at 6:27 PM, Stephen Farrell w= rote: >=20 >=20 > Hiya, >=20 >> On 21/08/2019 23:14, David Conrad wrote: >> Stephen, >>=20 >> On Aug 21, 2019, at 2:47 PM, Stephen Farrell >> wrote: >>>> DNSSEC and DoH/DoT are not different paths to the same end goal >>>> of data integrity. They provide different flavours of data >>>> integrity. >>>=20 >>> I don't agree that the goals are precisely the same as the actors >>> involved in providing the security services differ. There's a lot >>> in common, but they aren't identical. >>=20 >> You appear to be agreeing with Jim. >=20 > I often do :-) >=20 >> DNSSEC provides data integrity _for what the zone authority put into >> the zone_, regardless of how it gets to the client. >>=20 >> A TLS channel between a client and a resolver (DoH or DoT) provides >> data integrity and confidentiality (and _resolver_ origin >> authentication) _for what the RESOLVER chooses to serve_. >=20 > Yep. >=20 >> DoH _will not help_ if the =E2=80=9Ctrusted=E2=80=9D resolver is compromi= sed to >> modify the response (something I suspect concentrating the resolver >> function will encourage). DNSSEC would help that particular attack. >=20 > Yep. >=20 > Those are both true statements. There are equally true > statements that'd demonstrate cases where DoH or DoT do > better than DNSSEC - IIUC an important one being: given > the (unfortunate) relative sparsity of DNSSEC signed > data, the data integrity service that DoH or DoT can > provide could well be argued to be as good as what a > client can get via DNSSEC when the full set of queries > a client makes are taken into account. Actually, no, it cannot, at least if the only trust anchor on the DNSSEC val= idation is the ICANN/IANA root trust anchor. The protection of data integrity is almost entirely a dependency on whether t= he resolver validates DNSSEC or not. If the resolver does not validate, then the resolver is in an unknown data i= ntegrity situation for DNSSEC signed zones. Use of DoT/DoH to such a resolve= r does not change anything. It is strictly garbage in, garbage out (or clean= data in, clean data out if no data tampering was attempted). DoX neither el= evates nor lowers the integrity of the data compared to the original zone da= ta. NB: If the incoming DNS data was altered, the adversary succeeds EVEN IF= THE DATA WAS DNSSEC SIGNED. Comparing against anything other than the original zone data is meaningless (= with the exception of filtering services, which is relevant only if the clie= nt opted in to using a resolver that does such.) A non-DNSSEC zone is basically fair game, irrespective of any validation or c= hannel security. In addition to on path attackers, unsigned zones can be att= acked at the resolver by off-path adversaries. They are also susceptible to l= ocal attacks on the resolver server itself, and to malicious activity by ins= iders.=20 A DNSSEC signed zone validated by the DNS end client is immune to all of the= se attacks, reducing otherwise successful attacks to DOS. If the resolver does validate, DoT/DoH adds nothing at all to the data integ= rity state. Here is where it is fair to compare DoX to DNSSEC: =46rom a validating resol= ver to a client. The data integrity starts in a known state on the validating resolver. DoX prevents changing the data integrity via channel security. DNSSEC =E2=80=9Cprevents=E2=80=9D changing the data integrity via cryptograp= hic signatures which prevent tampering by detection of tampering. (Both DoX and DNSSEC are susceptible to DOS by an on-path adversary.) In summary: If the resolver validates DNSSEC signed data, DoX and client DNSSEC validati= on have exactly the same protection against tampering. If the resolver does not validate DNSSEC signed data, a DNSSEC validating cl= ient can still detect tampering and protect itself, whereas DoX does not and= cannot. If the data is not DNSSEC signed, the only path component protection occurs b= etween the resolver and client. A risk analysis of DNS vs tampering would show the place to attack DNS is no= t on the client side, but rather on the authority side. The reason is that a= single successful attack impacts ALL clients rather than a single clients. T= his also means the more clients a resolver has, the more valuable it is to a= n attacker. As to the perceived value of DNSSEC based on how many domains are signed, th= ere is more to this than numbers or percentages. The flaw is in treating all domains as equally valuable, rather than weighti= ng those values. You can get to a very high percentage of aggregate value with a small number= of zones, if the small number are particularly important, like all of the Fo= rtune 500 or all national governments or a significant portion of critical i= nfrastructure or a combination of those. And in particular, the value to the individual domain owner doing DNSSEC is i= gnored in use of raw numbers alone. The value of DNSSEC to joes-bait-shop.ho= sted-dns.example.com is likely a lot less than iana.org or whitehouse.gov (I= =E2=80=99m guessing). A large bank or government department, for examples, is probably already usi= ng DNSSEC. Clients who neither use a validating resolver nor do client-side v= alidation are failing to protect themselves. Even if the raw numbers are not so great today, if they improve drastically (= eg up to 40% of all of DNS zones) in 2020, IMHO it behooves us to not reject= those protections, which the domain owners themselves have selected; archit= ectural and operational decisions should be being made in a manner compatibl= e with DNSSEC validation. Remember, the signing in DNSSEC is not done by the resolver operators, it is= done by domain owners themselves (or parties to whom they have outsourced t= his). Brian From nobody Wed Aug 21 22:12:26 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 622441200DB for ; Wed, 21 Aug 2019 22:12:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id K1VGDACBK1v2 for ; Wed, 21 Aug 2019 22:12:22 -0700 (PDT) Received: from mail-io1-xd29.google.com (mail-io1-xd29.google.com [IPv6:2607:f8b0:4864:20::d29]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AD43012006F for ; Wed, 21 Aug 2019 22:12:22 -0700 (PDT) Received: by mail-io1-xd29.google.com with SMTP id j5so9327165ioj.8 for ; Wed, 21 Aug 2019 22:12:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=mtFuz2xsoyPUZQoqt+a+D2+DfCuF8smgsTW66FXEGls=; b=r36O0ZiM2p8gMleipdyImT217l+fVfG3bC79YruTFufLrBbt7vyF2ijQvNqxBtCUbp co3EezWtBPjU42+7ImPl1zieAJgaftBQFUGLEE0OFySmY0udL0Y+FkAS+paY6Eo3eHxa XWW141/6RASK6BkAZeqUWdxhIr1iMGvC2yS6gcIogngmoI3vut8EYAH4KSgjeDm7g31t Rg9HlvZIhRYLKGEtZvagDHnAApFtEp0ehCbcpNykDa/bwtBA3cpn/RnGN5j8kvLZHV/I zjxCR7UwmS0flEnHVEGGZA5uzztqg672MJYIvEktqCLcr/Nw8Q/DoDOAGCsavj4wi9cs 3AlQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=mtFuz2xsoyPUZQoqt+a+D2+DfCuF8smgsTW66FXEGls=; b=gad6L0L0SCt8bdiMCxQ4sqTEi6vGGA5osxSaZbfOWG9KyS8i7VGVW0ugvOzGNaJeku FyjuAQEF47+Uolv/uMOAVOJ71FSvtL3tY74jn3FFany2M5nbNE5u+sfY6WRxygYjU6uD KHxeMTv/vAyK3jLZEJe3SFxxbPtUt5IBFdH5+4znqvEiBMH7XsbYVoMX8b5AP2jNuCR/ v7NSd20AIY+QBi9lAPhRwG5nlchUmySOk6QVXjEStrt3Xu/hlHwkQr6t93pr38e2XMPK Q1dgplv7Wt7AUzYC8CvHxiu0WcjnM0Apw1hTmth0sMpaEIsHGMwk6b1w9wZNmbUNLHyi iJtQ== X-Gm-Message-State: APjAAAUimrlepuotpGPRtMSvi46k6/hRiffkEkqXvry2oZqJPSxVtgfk mOiqt1CBYjs023ysWdEj+8oNA1XsMZyHzidQ+2A= X-Google-Smtp-Source: APXvYqyxrMoh3tUZ5tjKrmUt71g+g5+TZWRPmhdIvNs59+336oMZms1vx/bKcSBqSKG5+9/t0h/7DPsZg2H/+HNp2Ow= X-Received: by 2002:a05:6638:303:: with SMTP id w3mr13637707jap.103.1566450740742; Wed, 21 Aug 2019 22:12:20 -0700 (PDT) MIME-Version: 1.0 References: <68e0e8f4-cd1b-f1a9-a44b-29541e02b021@uniregistry.com> In-Reply-To: <68e0e8f4-cd1b-f1a9-a44b-29541e02b021@uniregistry.com> From: Rob Sayre Date: Wed, 21 Aug 2019 22:12:06 -0700 Message-ID: To: Patrick Mevzek Cc: ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000f5cfae0590adbbb0" Archived-At: Subject: Re: [Add] FYI: regarding HTTPS interception X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 22 Aug 2019 05:12:24 -0000 --000000000000f5cfae0590adbbb0 Content-Type: text/plain; charset="UTF-8" On Wed, Aug 21, 2019 at 1:26 PM Patrick Mevzek wrote: > As for MITM and Kazakhstan: > > https://blog.mozilla.org/blog/2019/08/21/mozilla-takes-action-to-protect-users-in-kazakhstan/ > > (same day and action as Google). > Thanks for sending that along. I gather that at least Google, Mozilla, and Apple acted together today: < https://www.zdnet.com/article/apple-google-and-mozilla-block-kazakhstans-https-intercepting-certificate > I didn't know this action would be taken, but I do hope other browser makers join in. thanks, Rob --000000000000f5cfae0590adbbb0 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Wed, Aug 21, 2019 at 1:26 PM Patrick M= evzek <mevzek@uniregistry.com<= /a>> wrote:
As for MITM and Kazakhstan:
https:/= /blog.mozilla.org/blog/2019/08/21/mozilla-takes-action-to-protect-users-in-= kazakhstan/

(same day and action as Google).

Thanks= for sending that along. I gather that at least Google, Mozilla, and Apple = acted together today:


<= div>I didn't know this action would be taken, but I do hope other brows= er makers join in.

thanks,
Rob

--000000000000f5cfae0590adbbb0-- From nobody Wed Aug 21 22:52:29 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C0912120143 for ; Wed, 21 Aug 2019 22:52:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FROM_EXCESS_BASE64=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=frobbit.se Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jG8fIxe8MCFh for ; Wed, 21 Aug 2019 22:52:25 -0700 (PDT) Received: from mail.frobbit.se (mail.frobbit.se [IPv6:2a02:80:3ffe::176]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A6A9512006F for ; Wed, 21 Aug 2019 22:52:25 -0700 (PDT) Received: from [169.254.213.39] (unknown [IPv6:2a01:3f0:1:0:9109:5e28:d24c:aca4]) by mail.frobbit.se (Postfix) with ESMTPSA id C59062150A; Thu, 22 Aug 2019 07:52:21 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=frobbit.se; s=mail; t=1566453141; bh=CUmZaAYLtHf/5JfcrN5HEp9LUdYK7NtdhD3zqWfBYCw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ppztgDslFQdGWu6sc3b/Ry2+UphfDrSfKivroFj3mmSkTED1CgPyIdHXNjlmfwVGe hxZTq6qgh5Lqmg3WwuQpatxWm2kqrJ90Kjdh/6oaBHwGAMXwnNgw5t/6WUJjtkbhTj IloexSE1dxF9pOwEcSk4HbGe4nBpJCZoiF0S2cXg= From: "Patrik =?utf-8?b?RsOkbHRzdHLDtm0=?=" To: "Ted Hardie" Cc: "Jari Arkko" , "Eric Rescorla" , "ADD Mailing list" Date: Thu, 22 Aug 2019 07:52:21 +0200 X-Mailer: MailMate (1.12.5r5635) Message-ID: <458B5AD2-D956-43B5-A0A3-28660BBDC6E2@frobbit.se> In-Reply-To: References: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=_MailMate_37C3F551-1562-4B6B-A667-A7B967A9219D_="; micalg=pgp-sha1; protocol="application/pgp-signature" Archived-At: Subject: Re: [Add] What to do in this potential working group X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 22 Aug 2019 05:52:28 -0000 This is an OpenPGP/MIME signed message (RFC 3156 and 4880). --=_MailMate_37C3F551-1562-4B6B-A667-A7B967A9219D_= Content-Type: text/plain Content-Transfer-Encoding: quoted-printable On 21 Aug 2019, at 19:36, Ted Hardie wrote: > The second threat model is that a resolver may provide an untrustworthy= answer (e.g. captive portal). The use of DoT and DoH can help with this = if the client device, application, or user selects a trustworthy resolver= ** and uses the TLS certificate to verify they have reached that service.= This is resolved by having DNSSEC validation in the client. Patrik --=_MailMate_37C3F551-1562-4B6B-A667-A7B967A9219D_= Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iG0EARECAC0WIQRUH/cJI8i4DDUU3qWsxpsaC4jXzQUCXV4tlQ8ccGFmQGZyb2Ji aXQuc2UACgkQrMabGguI181EWACbBHSHILqguLj7O1LXLyU9U4ndqJAAn3wZclC8 V31SmdTt8z4bnwXqwdNd =IuDn -----END PGP SIGNATURE----- --=_MailMate_37C3F551-1562-4B6B-A667-A7B967A9219D_=-- From nobody Wed Aug 21 22:54:50 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7E0E5120807 for ; Wed, 21 Aug 2019 22:54:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FROM_EXCESS_BASE64=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=frobbit.se Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id teIb8cFTzHk2 for ; Wed, 21 Aug 2019 22:54:39 -0700 (PDT) Received: from mail.frobbit.se (mail.frobbit.se [IPv6:2a02:80:3ffe::176]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 98DD712082A for ; Wed, 21 Aug 2019 22:54:39 -0700 (PDT) Received: from [169.254.213.39] (unknown [IPv6:2a01:3f0:1:0:9109:5e28:d24c:aca4]) by mail.frobbit.se (Postfix) with ESMTPSA id 955A622CEA; Thu, 22 Aug 2019 07:54:37 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=frobbit.se; s=mail; t=1566453277; bh=vDOnfEOB/vz8BHP7dXWa2R1MdapidRBssMnaj0vw88A=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=bWnXFQLQF7DYAakkjCzSd0gEGrIB/8ahTYv7Kbt+PL4nXdQHkuQwJZcHj09600Qzc s4yL60UZT3aq7iOXaKTPzuIc/09jhzRXzH8AxsirnXaSSd1eVZR5nPwkfllwhUc6zo zEE+W6dzY0zNwPndxadyFBsEPvRxhFzGDspajC7o= From: "Patrik =?utf-8?b?RsOkbHRzdHLDtm0=?=" To: "Alec Muffett" Cc: "David Conrad" , "Ted Hardie" , "ADD Mailing list" Date: Thu, 22 Aug 2019 07:54:37 +0200 X-Mailer: MailMate (1.12.5r5635) Message-ID: In-Reply-To: References: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=_MailMate_C79088F9-B327-4F34-AF32-B10EB16EAAD2_="; micalg=pgp-sha1; protocol="application/pgp-signature" Archived-At: Subject: Re: [Add] What to do in this potential working group X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 22 Aug 2019 05:54:48 -0000 This is an OpenPGP/MIME signed message (RFC 3156 and 4880). --=_MailMate_C79088F9-B327-4F34-AF32-B10EB16EAAD2_= Content-Type: text/plain Content-Transfer-Encoding: quoted-printable On 21 Aug 2019, at 20:06, Alec Muffett wrote: > Fortunately we do not have to wait for DNSSEC in order to get answers f= rom the people from whom we wish them supplied, privately and untampered-= with, which is the whole point of DNS over HTTPS. Only if you do DNS over HTTPS directly to an authoritative DNS server. Patrik --=_MailMate_C79088F9-B327-4F34-AF32-B10EB16EAAD2_= Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iG0EARECAC0WIQRUH/cJI8i4DDUU3qWsxpsaC4jXzQUCXV4uHQ8ccGFmQGZyb2Ji aXQuc2UACgkQrMabGguI183YDgCfTg/EPKZOYs0JGoqzJ14aiFkiC40AnRZBOJtp CLL6BBNlOCath9Px2LWX =azYC -----END PGP SIGNATURE----- --=_MailMate_C79088F9-B327-4F34-AF32-B10EB16EAAD2_=-- From nobody Wed Aug 21 22:56:40 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3AD8C120144 for ; Wed, 21 Aug 2019 22:56:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FROM_EXCESS_BASE64=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=frobbit.se Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZpIfMO5Ggyy6 for ; Wed, 21 Aug 2019 22:56:36 -0700 (PDT) Received: from mail.frobbit.se (mail.frobbit.se [85.30.129.176]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E90AD12011A for ; Wed, 21 Aug 2019 22:56:35 -0700 (PDT) Received: from [169.254.213.39] (unknown [IPv6:2a01:3f0:1:0:9109:5e28:d24c:aca4]) by mail.frobbit.se (Postfix) with ESMTPSA id CBB0C22CFD; Thu, 22 Aug 2019 07:56:33 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=frobbit.se; s=mail; t=1566453393; bh=hvC/w3WJeTnhCTf8MG+3ji8+IbdbFn2NcZbX+hW9Q7w=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=NOe5KHuxUQRrQ70ehvUJN1uLXwdufSlyBI7QAUWd/etNEZgPDVKRVqJ+WLJ08Pdmm t1TVw4T275SimEchux79jOLu6JVPlbMPDmT2XvykMrtaHUv5mnCebUbOqdnJZBXAWw +g2qJy7jQQxlB4H+PqjHfNaTXrdCmjAkgDq3EB2w= From: "Patrik =?utf-8?b?RsOkbHRzdHLDtm0=?=" To: sthaug@nethelp.no Cc: add@ietf.org Date: Thu, 22 Aug 2019 07:56:33 +0200 X-Mailer: MailMate (1.12.5r5635) Message-ID: In-Reply-To: <20190821.202457.210468432.sthaug@nethelp.no> References: <2ABE9821-1CF9-4FBC-907A-E0402E139C03@frobbit.se> <8D42902D-CD20-4A64-8F38-CF96F1A351F1@frobbit.se> <20190821.202457.210468432.sthaug@nethelp.no> MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=_MailMate_7F2012D0-16B0-4B14-B14B-9BBADEC0F297_="; micalg=pgp-sha1; protocol="application/pgp-signature" Archived-At: Subject: Re: [Add] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 22 Aug 2019 05:56:38 -0000 This is an OpenPGP/MIME signed message (RFC 3156 and 4880). --=_MailMate_7F2012D0-16B0-4B14-B14B-9BBADEC0F297_= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Thanks for the information. Patrik On 21 Aug 2019, at 20:24, sthaug@nethelp.no wrote: >> As myself and others have said many times on this list, court orders h= ave ordered access providers in many legislations to block access to cert= ain "things". Some of these court orders are sealed, and of course people= are trying to get their hands on the orders, validate whether they are c= orrect and what not. >> >> With "things" I have seen everything from IP addresses via domain name= s to URLs. >> >> I have not seen any explicit statements in the court orders I have see= n how this is to be implemented, so the implementation is up to the acces= s provider. There might very well exist such details, and I am happy to s= ee what they contain. > > There have been several verdicts in the Oslo District Court ordering No= rwegian ISPs to prevent access to certain domains - and to implement this= explicitly using DNS blocking. > > One such verdict from 2015 is available here (in Norwegian): > > https://docplayer.me/2483170-Oslo-tingrett-kjennelse-01-09-2015-i-oslo-= tingrett-15-067093tvi-otir-05-tingrettsdommer-jon-ostensvig-1-warner-bros= -entertainment-norge-as.html > > The latest verdict we received is from 01.06.2018, court reference numb= er is 18-039103TVI-OTIR/02. Excerpt from the text: > > " > p=C3=A5legges: > > - =C3=A5 hindre eller vanskeliggj=C3=B8re kundenes tilgang til LiveTV v= ed =C3=A5 > iverksette DNS-blokkering av f=C3=B8lgende domenenavn med subdomener: > livetv.sx, livetvcdn.net, ... > " > > Livefootballol, Cricfree> > > The key phrase is "DNS-blokkering", i.e. DNS domain name blocking. > > In these cases the court verdicts are of course openly available, with = the full list of domain names the ISPs are required to block. > > I happen to work for one of the ISPs required to perform such blocking.= *In the context of such a verdict* it is completely irrelevant for us ho= w effective (or ineffective) such domain name blocking is - we are simply= required by the court to perform domain name blocking. > > Steinar Haug, AS2116 > > -- = > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add --=_MailMate_7F2012D0-16B0-4B14-B14B-9BBADEC0F297_= Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iG0EARECAC0WIQRUH/cJI8i4DDUU3qWsxpsaC4jXzQUCXV4ukQ8ccGFmQGZyb2Ji aXQuc2UACgkQrMabGguI182pvgCfQBB9IaIkG09F2bciccJJQzQktLsAoIiC6+CY QffnPjfjsGa9lrNRcc9d =OrTg -----END PGP SIGNATURE----- --=_MailMate_7F2012D0-16B0-4B14-B14B-9BBADEC0F297_=-- From nobody Wed Aug 21 23:02:00 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 493AA12011A for ; Wed, 21 Aug 2019 23:01:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HAF08ihgrEeh for ; Wed, 21 Aug 2019 23:01:56 -0700 (PDT) Received: from mail-io1-xd2b.google.com (mail-io1-xd2b.google.com [IPv6:2607:f8b0:4864:20::d2b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 88C5412006F for ; Wed, 21 Aug 2019 23:01:56 -0700 (PDT) Received: by mail-io1-xd2b.google.com with SMTP id j5so9513050ioj.8 for ; Wed, 21 Aug 2019 23:01:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=afrPpsKthqQq9aHWZteNetEFw8UuGwnLlgMywLkJC3k=; b=VuOllUIdVtVn4eWLkxoN2HnEGTOiNwSD28W3mWM5cA2dzKPi+cEhLrkbNFsat346uJ 20OnMsoSO6iogkhaoZdfQcOLOwvqDaX7ERVcyYFCa6FT5s5b58CCuA+AqNSpMwiqGxmq zYw+VU22ieeOryI+BF4F8Nr7g8hApbq4guGKwHJtK4ZvSRUi+xAx2W+hV2VUE23saqaQ dFMQN3mIg5ljDvFC/T48LrcgjQO2jRS4orLhnDgt3LdGcPS4elGSSLtphvDQjiHwyxhG 7mhYanKzUn21W51tLryRJtNyo3uVk13OA7oYGjkVSZDOxYRE1jQmYeaWdVl7q+eZr1+K M2Qw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=afrPpsKthqQq9aHWZteNetEFw8UuGwnLlgMywLkJC3k=; b=OKWqX46M3r+KVqN7Wxy2QdmSUdk+wBo4j/SNE24BKTWJiD8+H4runZtpaJ+8i3bDt9 7uGSlqy3hzwg7c21EUci73QiNwuQOCufvaON/ZFunan2bYeLdmULleiBf/6o0L9whLEM G9sTX+d8JmuW1gbjR4BNsG7X7wSLdBqeO8i6sp6FXSWBc4n3PGZh6UFwQMquWBldd4Pl BqXiTqCt6Wv8X1464lQPhb2e+gwaDr5CIhPOJ3UQnKYZOJgZFSO4uDL/FAUsYbm6uZnM 0c/9bLocdo7I55TZexngr3ptwSqxRgmLLOBsZgQeI2a46Ewj9aMffPTO+gRkoy2z9Dao DPMg== X-Gm-Message-State: APjAAAUXG41NFtHYsm031n6bG4mygc1tcFyz0lH1bH8ip7GeNQx05x8u tCfEQLHeJNtOwFpp6vg4gKrCK+6+nMqs74Wz34k= X-Google-Smtp-Source: APXvYqz9v1uvBPc7ALkGurIwof9r4eA/pmjKuw5BvvhIPf09YyqZ9f7XdSxzSMob8DurbV6dnZsolSLDdqdijfAqWdI= X-Received: by 2002:a5e:9515:: with SMTP id r21mr18085303ioj.257.1566453715644; Wed, 21 Aug 2019 23:01:55 -0700 (PDT) MIME-Version: 1.0 References: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> In-Reply-To: From: Rob Sayre Date: Wed, 21 Aug 2019 23:01:40 -0700 Message-ID: To: =?UTF-8?B?UGF0cmlrIEbDpGx0c3Ryw7Zt?= Cc: Alec Muffett , Ted Hardie , ADD Mailing list , David Conrad Content-Type: multipart/alternative; boundary="0000000000004739960590ae6dc2" Archived-At: Subject: Re: [Add] What to do in this potential working group X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 22 Aug 2019 06:01:58 -0000 --0000000000004739960590ae6dc2 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Wed, Aug 21, 2019 at 10:55 PM Patrik F=C3=A4ltstr=C3=B6m wrote: > On 21 Aug 2019, at 20:06, Alec Muffett wrote: > > > Fortunately we do not have to wait for DNSSEC in order to get answers > from the people from whom we wish them supplied, privately and > untampered-with, which is the whole point of DNS over HTTPS. > > Only if you do DNS over HTTPS directly to an authoritative DNS server. > Won't the client use the DNS information to make a request over TLS? If you doubt the security of that, you are questioning the entire global PKI. I happen to think that infrastructure is a joke, but I do agree that it foils common criminals and overzealous local administrators. thanks, Rob --0000000000004739960590ae6dc2 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Wed, Aug 21, 2019 at 10:55 PM Patrik F= =C3=A4ltstr=C3=B6m <paf=3D40frobbit.se@dmarc.ietf.org> wrote:
On 21 Aug 2019, at 2= 0:06, Alec Muffett wrote:

> Fortunately we do not have to wait for DNSSEC in order to get answers = from the people from whom we wish them supplied, privately and untampered-w= ith, which is the whole point of DNS over HTTPS.

Only if you do DNS over HTTPS directly to an authoritative DNS server.
<= /blockquote>

Won't the client use the DNS informatio= n to make a request over TLS?

If you doubt the sec= urity of that, you are questioning the entire global PKI. I happen to think= that infrastructure is a joke, but I do agree that it foils common crimina= ls and overzealous local administrators.

thanks,
Rob
--0000000000004739960590ae6dc2-- From nobody Wed Aug 21 23:12:44 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 72767120071 for ; Wed, 21 Aug 2019 23:12:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id blOvaLmhbyfT for ; Wed, 21 Aug 2019 23:12:40 -0700 (PDT) Received: from mail-yb1-xb29.google.com (mail-yb1-xb29.google.com [IPv6:2607:f8b0:4864:20::b29]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id ADBE312006F for ; Wed, 21 Aug 2019 23:12:40 -0700 (PDT) Received: by mail-yb1-xb29.google.com with SMTP id u68so2086858ybg.1 for ; Wed, 21 Aug 2019 23:12:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=VYZ8ykTpa+PjdT/o9o1Bdp8apl3mRpujwpylEdKXogE=; b=apDZvD+Sl3L0Yg3dKWePpXg/kC3FozrrYRJmShaVC7xBAe6ChuFh2g3MSs6kVKVaSX 6Tln8vxbQcb3s8AvP3ptCaExlrIO/yxPbMPfkybY/OUtJ7MA0lpcflABvhdH7jQ83exs eu7bBTSFANhqopYraKtN2fiOjmWC7GEtHWLrrtnu0+mUqz0oY+f4jwpuZI6bFHUe+cgM hoSJl2HHThg8Nd6aNuqGFC4z1pBfeMt6Lk8ZbMb6VResirOBoWwiA84NDB5o4UyP8gmC onHsLrdDpE8/sqBocaaqfAnlLkaLAkkfEaqQquX/fw1OzwLcKjH8Rpw8VkjHT0OXF7Wl Q5NA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=VYZ8ykTpa+PjdT/o9o1Bdp8apl3mRpujwpylEdKXogE=; b=bEbT6stMIQpCveACQYHFNXpPiVmSkVQ7FGQ0c3eec5JsZPsYvFM6ujoMaRCKHZ+lCV YVcdW4ER0QNLZEpcjkyNo0Ajfs7J3QU9SeaHB3KciXr6t4I96SCwzVDZnjI7NxfVLbfG Wp3I6kqa4DE5x1xhcdKxksII/v5tXGXENcBUQFULslXppmoBelJW/4msVjGtcLcwWanE jJSTXG2o6vKWxRQEZ1lJSpU327npyMu5vJO57hHn6vxwKUzFZAFRYmy1VPKj1ZbeuTb9 17nEUCg+k64KS3RZbhDiVpGGye8oLzBP9VBxj1bGkaYnkYzWlT/FT0lvkFGT8SMOcwV/ mqlg== X-Gm-Message-State: APjAAAXBvzWVPBEsy7rYD0N590VroruCxcRCDyXoEMQLt6KPHQ5QgQVS BJV+A37XkMez2ICGZ+2HXpbsouZoWgj9U1b25xaglg== X-Google-Smtp-Source: APXvYqzsQM1lOd+VGEAUkhXPqWjZ7YG9vhGbEzYBI23YiuSrjn5Ot6NpR7MebqAKXhQ0UabT2fS/WWs+786fD/+mnVY= X-Received: by 2002:a25:bac3:: with SMTP id a3mr10435105ybk.25.1566454359688; Wed, 21 Aug 2019 23:12:39 -0700 (PDT) MIME-Version: 1.0 References: <2ABE9821-1CF9-4FBC-907A-E0402E139C03@frobbit.se> <8D42902D-CD20-4A64-8F38-CF96F1A351F1@frobbit.se> <20190821.202457.210468432.sthaug@nethelp.no> In-Reply-To: <20190821.202457.210468432.sthaug@nethelp.no> From: Alec Muffett Date: Thu, 22 Aug 2019 07:12:02 +0100 Message-ID: To: sthaug@nethelp.no Cc: ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000aa8bbc0590ae9398" Archived-At: Subject: Re: [Add] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 22 Aug 2019 06:12:43 -0000 --000000000000aa8bbc0590ae9398 Content-Type: text/plain; charset="UTF-8" On Wed, 21 Aug 2019 at 19:25, wrote: > There have been several verdicts in the Oslo District Court ordering > Norwegian ISPs to prevent access to certain domains - and to implement > this explicitly using DNS blocking. > > ... > The key phrase is "DNS-blokkering", i.e. DNS domain name blocking. > In these cases the court verdicts are of course openly available, > with the full list of domain names the ISPs are required to block. > > I happen to work for one of the ISPs required to perform such > blocking. *In the context of such a verdict* it is completely > irrelevant for us how effective (or ineffective) such domain name > blocking is - we are simply required by the court to perform domain > name blocking. > So, for clarity, do the verdicts / obligations also extend to requiring [Norwegian ISPs] to ban access to alternative name-resolution services in order to support the efficacy of such a block? - alec -- http://dropsafe.crypticide.com/aboutalecm --000000000000aa8bbc0590ae9398 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Wed, 21 Aug 2019 at 19:25, <sthaug@nethelp.no> wrote:
There have been several verdicts i= n the Oslo District Court ordering
Norwegian ISPs to prevent access to certain domains - and to implement
this explicitly using DNS blocking.

...
=C2=A0
The key phrase is &qu= ot;DNS-blokkering", i.e. DNS domain name blocking.
In these cases the court verdicts are of course openly available,
with the full list of domain names the ISPs are required to block.

I happen to work for one of the ISPs required to perform such
blocking. *In the context of such a verdict* it is completely
irrelevant for us how effective (or ineffective) such domain name
blocking is - we are simply required by the court to perform domain
name blocking.

So, for clarity, do the = verdicts / obligations also extend to requiring [Norwegian ISPs] to ban acc= ess to alternative name-resolution services in order to support the efficac= y of such a block?

=C2=A0 =C2=A0 - alec
= =C2=A0
--
http://dro= psafe.crypticide.com/aboutalecm
--000000000000aa8bbc0590ae9398-- From nobody Wed Aug 21 23:27:59 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7FCF5120071 for ; Wed, 21 Aug 2019 23:27:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OeeWIZlGPUhW for ; Wed, 21 Aug 2019 23:27:55 -0700 (PDT) Received: from bizet.nethelp.no (bizet.nethelp.no [IPv6:2001:8c0:9e04:500::1]) by ietfa.amsl.com (Postfix) with ESMTP id 625D012006F for ; Wed, 21 Aug 2019 23:27:55 -0700 (PDT) Received: from localhost (bizet.nethelp.no [IPv6:2001:8c0:9e04:500::1]) by bizet.nethelp.no (Postfix) with ESMTP id 89264E6079; Thu, 22 Aug 2019 08:27:53 +0200 (CEST) Date: Thu, 22 Aug 2019 08:27:53 +0200 (CEST) Message-Id: <20190822.082753.251801273.sthaug@nethelp.no> To: alec.muffett@gmail.com Cc: add@ietf.org From: sthaug@nethelp.no In-Reply-To: References: <8D42902D-CD20-4A64-8F38-CF96F1A351F1@frobbit.se> <20190821.202457.210468432.sthaug@nethelp.no> X-Mailer: Mew version 6.7 on Emacs 26 / Mule 6.0 (HANACHIRUSATO) Mime-Version: 1.0 Content-Type: Text/Plain; charset=us-ascii Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [Add] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 22 Aug 2019 06:27:57 -0000 >> There have been several verdicts in the Oslo District Court ordering >> Norwegian ISPs to prevent access to certain domains - and to implement >> this explicitly using DNS blocking. >> >> ... > > > >> The key phrase is "DNS-blokkering", i.e. DNS domain name blocking. >> In these cases the court verdicts are of course openly available, >> with the full list of domain names the ISPs are required to block. >> >> I happen to work for one of the ISPs required to perform such >> blocking. *In the context of such a verdict* it is completely >> irrelevant for us how effective (or ineffective) such domain name >> blocking is - we are simply required by the court to perform domain >> name blocking. >> > > So, for clarity, do the verdicts / obligations also extend to requiring > [Norwegian ISPs] to ban access to alternative name-resolution services in > order to support the efficacy of such a block? The verdicts don't say anything about alternative name-resolution services. My personal view (note: IANAL): If only a few customers used such alternative name-resolution, authorities probably wouldn't care. If "sufficiently many" customers did this, authorities would probably take note, and require ISPs to implement blocking by other methods. Steinar Haug, AS2116 From nobody Wed Aug 21 23:44:33 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 96EBF120100 for ; Wed, 21 Aug 2019 23:44:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2LSRsQPqDj_Y for ; Wed, 21 Aug 2019 23:44:29 -0700 (PDT) Received: from mail-lf1-x12a.google.com (mail-lf1-x12a.google.com [IPv6:2a00:1450:4864:20::12a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 61BDD120059 for ; Wed, 21 Aug 2019 23:44:29 -0700 (PDT) Received: by mail-lf1-x12a.google.com with SMTP id n19so3653300lfe.13 for ; Wed, 21 Aug 2019 23:44:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=HuHH9UC/010Qey2up0iTngq9PLTDpvfmkBIGYTH46Bg=; b=Y8ESP5mW8GTt/UW71ucqXn96zXKZ2WZo0ko51x/kMs8pbCHusRA1PqTf9Sl/VCPkt8 wLSpktfmpgLI4maID4287iUKlivMs38ZUf0QloUoz6Gq0AjJdS9YjE4/3qCl2pK4rGVl 91UG9/WBzfha8DiLxvYWlFQqnIQgLHVMo/uvqGkh4HhS6pM6NuqKI2h5UAr/l3kk6jRM ywnM2zniZOqQw0+OUaxMBqhZjVUA9xRaXAL/0dY/aZWjMql9zjp5QCW5Y4lhGT+Bsx8C 2clSGqeevJtvRfl5jXTtPDvPs236BzAe7otY32ctfgHYeiD9Pj22qKN2uKmXOvKiGAW8 9TLQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=HuHH9UC/010Qey2up0iTngq9PLTDpvfmkBIGYTH46Bg=; b=DnmB1Fl1fLGTvjxBOP6tWit8f5WR+bHny3raVfcEPyoFAHCWnRsJ+d4sNyjf1/tOYB 1cMFlagcHJXqWanYppXGLUEeUx1HWKoxETpRa4N+omZtTkfZywCrVLesqHz7WEzH1B5z TBJFlNtqrxqOrufpOnCO+ocWJ5CHDsDiIW1mqLxOXYVA3YuY1+yriWvgIkqFWVpMOlx+ wyagxfqxnTxXijRWl+1+oHHnXPloZwmUHjjgaS6Evo2vJ4k/NX16dNF3Ai5SI2omgyIF hUtlibVxmMqsHydaYqx3+sVktQ+btyAVpE6s2RcFNWtBawbdfGZ6VxxJKo3V/DdoUNrW 5KiA== X-Gm-Message-State: APjAAAX7I5IxLvFNZ8VQ0zZWbAdrWqTaPL85nWF+H94gIy7yInNDp5W8 vPb8Aw6Mg0V9OfkNauAi2gArWT75eLQ0++kHRrFXuA== X-Google-Smtp-Source: APXvYqxsv8e6aQ+G3zmZWi9bHJYwJmzvbbvFfrO90fJ8jCLS/rDPvkKoXf0JYHuGJKINaGEBL8ljUBruYQ90/1rkwms= X-Received: by 2002:a05:6512:1da:: with SMTP id f26mr20775554lfp.129.1566456267617; Wed, 21 Aug 2019 23:44:27 -0700 (PDT) MIME-Version: 1.0 References: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> In-Reply-To: From: Eric Rescorla Date: Thu, 22 Aug 2019 07:43:50 +0100 Message-ID: To: Brian Dickson Cc: Ray Bellis , ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000634d2c0590af05bd" Archived-At: Subject: Re: [Add] What to do in this potential working group X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 22 Aug 2019 06:44:32 -0000 --000000000000634d2c0590af05bd Content-Type: text/plain; charset="UTF-8" On Wed, Aug 21, 2019 at 7:26 PM Brian Dickson wrote: > > > On Wed, Aug 21, 2019 at 1:15 PM Eric Rescorla wrote: > >> >> >> On Wed, Aug 21, 2019 at 6:05 PM Ray Bellis wrote: >> >>> >>> Or Mozilla could embrace DNSSEC and DoT thereby encouraging their >>> deployment for the benefit of all internet users... >>> >> >> I feel like everything meaningful to be said about DNSSEC has already >> been said, so I'll spare people that. >> > > Actually, there is one thing you could say about DNSSEC that would help > clarify Mozilla's position. > > Basically, without doing validation, a stub resolver can be categorized > two different ways: > > - security-unaware stub resolver > - security-aware non-validating stub resolver > > I think it would be helpful if Mozilla were to state which kind of stub > resolver it will be implementing (security-unaware or security-aware). > Are these defined somewhere? If so, can you send a pointer? -Ekr > In either case, a validating resolver will return RCODE=2 if validation > fails, so I think it doesn't have any practical impact. > > Brian > --000000000000634d2c0590af05bd Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Wed, Aug 21, 2019 at 7:26 PM Brian= Dickson <brian.peter.d= ickson@gmail.com> wrote:


On Wed, Aug 21, 2019= at 1:15 PM Eric Rescorla <ekr@rtfm.com> wrote:


On Wed, Aug 21, 2019= at 6:05 PM Ray Bellis <ray@bellis.me.uk> wrote:

Or Mozilla could embrace DNSSEC and DoT thereby encouraging their
deployment for the benefit of all internet users...
I feel like everything meaningful to be said about DNSSEC has = already been said, so I'll spare people that.

Actually, there is one thing you could say about D= NSSEC that would help clarify Mozilla's position.

<= div>Basically, without doing validation, a stub resolver can be categorized= two different ways:
  • security-unaware stub resolver
    • <= li>security-aware non-validating stub resolver
I think = it would be helpful if Mozilla were to state which kind of stub resolver it= will be implementing (security-unaware or security-aware).

Are these defined somewhere? If so, can = you send a pointer?

-Ekr

<= div>

In either case, a vali= dating resolver will return RCODE=3D2 if validation fails, so I think it do= esn't have any practical impact.

Brian
--000000000000634d2c0590af05bd-- From nobody Wed Aug 21 23:51:58 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 85D7D120143 for ; Wed, 21 Aug 2019 23:51:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=lowentropy.net header.b=dfQMHKqa; dkim=pass (2048-bit key) header.d=messagingengine.com header.b=CitJN+b7 Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uZCBXk0vNniz for ; Wed, 21 Aug 2019 23:51:56 -0700 (PDT) Received: from wout4-smtp.messagingengine.com (wout4-smtp.messagingengine.com [64.147.123.20]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DE202120100 for ; Wed, 21 Aug 2019 23:51:55 -0700 (PDT) Received: from compute1.internal (compute1.nyi.internal [10.202.2.41]) by mailout.west.internal (Postfix) with ESMTP id 26F46721 for ; Thu, 22 Aug 2019 02:51:55 -0400 (EDT) Received: from imap2 ([10.202.2.52]) by compute1.internal (MEProxy); Thu, 22 Aug 2019 02:51:55 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lowentropy.net; h=mime-version:message-id:in-reply-to:references:date:from:to :subject:content-type; s=fm3; bh=XGo0Bc6rMMpdtwPI4Ju42KfhPKRGTqt MZwGM8s19Ir8=; b=dfQMHKqa10hK/BpQrAfsNZi5ClsShr9E+5QehZawfzyJ/ym +lG4aUeDCWiqzONEU99fbuDpUtIGtxkiznBSoNul2q/gtPpIvT7U9Maav3btnJBJ CYuIx/pFMwYgCAdUPMp+ulPLx5Wu4pj01NhFv77md2JFlFxviVeHZmcUmALgibyh 4Lu+O2+zWF7ssvy2e1U/wnfvcXu3oR14rDSPDzlc8F1FTkWJHVcQr2FIb2WnVKOl jv9A+8aPmrVA21pFJCvfoBkmhkUw44Hwd2GR+6R1WZzIURY4+HxffJFvlLjaykwW o46IlG9FVwvG+wGO6W8oBkn3CY8k5Da6/SN1ewg== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to:x-me-proxy :x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm3; bh=XGo0Bc 6rMMpdtwPI4Ju42KfhPKRGTqtMZwGM8s19Ir8=; b=CitJN+b78QePrfdq4v5OPW 7KvaxsEE3kHkAZxgTbWH2hVAGg6fdhPbykgeVWQsaKk8uGDKOQ0WoLmodgB9kZgs SGz0TKkRIuRiXt4qrjnBnVrxW4s+p0nT+/EKJICoF7ltDBM6XDaQkrWZPkstqMqy 8/Y6pE4DO6YglCqi/3dBkQmJQuJ+DVsGEhOJoOL/aSBqeeSf0eTO4EYxazNfM6+M g+SIABrErkokL1/G0L0kcwqIH26ZQjdftjGriy1FqfEdLmklyC7ysJr4NbMECENU TWZ73PMr4VWtcwtSoScT2B+IHoutGolswJtElJC6t8/j6ec4acfR6kw984vDcyqQ == X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeduvddrudeggedgudduiecutefuodetggdotefrod ftvfcurfhrohhfihhlvgemucfhrghsthforghilhdpqfgfvfdpuffrtefokffrpgfnqfgh necuuegrihhlohhuthemuceftddtnecunecujfgurhepofgfggfkjghffffhvffutgesth dtredtreertdenucfhrhhomhepfdforghrthhinhcuvfhhohhmshhonhdfuceomhhtsehl ohifvghnthhrohhphidrnhgvtheqnecuffhomhgrihhnpehivghtfhdrohhrghenucfrrg hrrghmpehmrghilhhfrhhomhepmhhtsehlohifvghnthhrohhphidrnhgvthenucevlhhu shhtvghrufhiiigvpedt X-ME-Proxy: Received: by mailuser.nyi.internal (Postfix, from userid 501) id 5B4A1E00A3; Thu, 22 Aug 2019 02:51:54 -0400 (EDT) X-Mailer: MessagingEngine.com Webmail Interface User-Agent: Cyrus-JMAP/3.1.6-916-g49fca03-fmstable-20190821v7 Mime-Version: 1.0 Message-Id: In-Reply-To: References: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> Date: Thu, 22 Aug 2019 16:51:36 +1000 From: "Martin Thomson" To: add@ietf.org Content-Type: text/plain Archived-At: Subject: Re: [Add] What to do in this potential working group X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 22 Aug 2019 06:51:58 -0000 On Thu, Aug 22, 2019, at 16:44, Eric Rescorla wrote: > > Basically, without doing validation, a stub resolver can be categorized two different ways: > > * security-unaware stub resolver > > * security-aware non-validating stub resolver > > I think it would be helpful if Mozilla were to state which kind of stub resolver it will be implementing (security-unaware or security-aware). > > Are these defined somewhere? If so, can you send a pointer? https://tools.ietf.org/html/rfc4033#section-2 I think that we've implemented the former. From nobody Thu Aug 22 00:01:03 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8A1EB12007A for ; Thu, 22 Aug 2019 00:01:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cu_oaJ5zbHWR for ; Thu, 22 Aug 2019 00:00:59 -0700 (PDT) Received: from mail-lj1-x22d.google.com (mail-lj1-x22d.google.com [IPv6:2a00:1450:4864:20::22d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 404D4120059 for ; Thu, 22 Aug 2019 00:00:59 -0700 (PDT) Received: by mail-lj1-x22d.google.com with SMTP id x4so4504013ljj.6 for ; Thu, 22 Aug 2019 00:00:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=YtG/Df1vAkHF8b09w6XsBLcm64I/q3Qr8MUx5nlWNnA=; b=OW+0SVui6lnXmRVGWbYis52vyE7HAJ348F8pLOzqt14uYEeQavFmBz/0sc5S3mngBF sjQFLocVD7fKTh8FxAYwuxYrERpcMpQ0WEV18yw6tdsNb8UuCczIMHK6/mxlG1HrZb6W o/dgIAVQoGazd3sWOyN4Dy/qLUniH34Pi2W/J5JxadiTlVtvXzALC8pddc2pVlnwh4j7 2+2X+OB6jtCFKwXHaIfckIondzwgsZR0YsNMU/WyPIWor14Dj5XnLonNq2SiV8sy7eaZ MPXqLZa0kJmLOqfO3ftrxmChMbPWj+BdqDq81XyrejKu/Ee38d2Nkqrakfmiiq0USgox LHcQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=YtG/Df1vAkHF8b09w6XsBLcm64I/q3Qr8MUx5nlWNnA=; b=KV8Ej93EUBDhoefqJlK5npvadw+A35S6r3zbIYjCIeP5/6Px3wMdLtb1g1CKaQvrlI aRKaJGxmyh2ZQn+DvUIM4O6NNotNdOFNK/8ExiA9pBbEPQaz7dsSSE/InOdrB0zmbaC8 Vl/d01Qysoa6iOgv0W0S0VhuzsgOf4IBPSvMC7cgTRAtZQjU9pGYa7srafJVY6d3u7f4 OWkCDUpuZFaSat+aRWK0BrSlDn4VyI6I8SLR7FYSY3/485L2Ck7ordVB0QW95OKuGomR lwMlRcuvuvC9msD+jl//OuuM8g8Zy+Dcpgn+I8pFCoR9nu5otK72PkFuyDLeTx28n2dQ keGQ== X-Gm-Message-State: APjAAAUb3fg6C/HriUgiaUqfLysd93vcIYTFEy2/DDMqF0pszVAucFNN QLmynuBPmI66l5VX7AVqBhengUX2PE2SbbcELHNvWX2iWZM= X-Google-Smtp-Source: APXvYqwDZaG+Dz8CQrs+mWiQ6fG078qNsga52tRR1p/ZWUsJkRhePRJvktCemdlqg1zaweJJZxjEUJbsUWYPzlqxW7s= X-Received: by 2002:a2e:5c43:: with SMTP id q64mr8262935ljb.14.1566457257575; Thu, 22 Aug 2019 00:00:57 -0700 (PDT) MIME-Version: 1.0 References: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> <59E0EC53-0E30-431C-8376-52C7BFC121A8@virtualized.org> <589DAFCB-1BDC-4156-A2CA-179C4559A6B2@virtualized.org> <683A176C-3CE6-4866-A736-F2A7465FA5B5@rfc1035.com> In-Reply-To: <683A176C-3CE6-4866-A736-F2A7465FA5B5@rfc1035.com> From: Eric Rescorla Date: Thu, 22 Aug 2019 08:00:21 +0100 Message-ID: To: Jim Reid Cc: Stephen Farrell , ADD Mailing list Content-Type: multipart/alternative; boundary="00000000000064d74b0590af4050" Archived-At: Subject: Re: [Add] data integrity and DNSSEC or DoH/DoT X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 22 Aug 2019 07:01:02 -0000 --00000000000064d74b0590af4050 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Wed, Aug 21, 2019 at 10:43 PM Jim Reid wrote: > > > > On 21 Aug 2019, at 22:13, Stephen Farrell > wrote: > > > > IMO you're both right but not quite using super-precise terminology:-) > > > > ... > > > > So yep, both give data integrity, just differently. > > If we=E2=80=99re being super-precise, that=E2=80=99s not quite right eith= er Stephen. :-) > > DNSSEC and DoH/DoT are not different paths to the same end goal of data > integrity. They provide different flavours of data integrity. > This I agree with. > DNSSEC validation means you get the truth, the whole truth and nothing bu= t > the truth regardless of your choice of resolver or the transport path > between you and that resolver. DoH and DoT offer no protection at all fro= m > a lying resolver - you=E2=80=99re just guaranteed to receive precisely wh= atever > lies or truth that resolver sends. So in effect you somehow decide to > =E2=80=9Ctrust=E2=80=9D a TRR and hope for the best. In some cases, that = may well be good > enough. In others, perhaps not. > I'd like to push on this slightly, if I may. I certainly agree that from a cryptographic perspective, DNSSEC allows you to evaluate whether or not the records that you receive are those which were provisioned (modulo typos, key expiry, etc.). However, as has been observed here a number of times, there are many cases where the resolver desires to elide certain records (e.g., for malware filtering) or to redirect you to some other location (e.g., captive portals). So from a systems perspective it seems like things are more complicated. Suppose that I receive a bogus response to my A record query, how am I to usefully distinguish "this is malware blocking" from "this resolver is malicious"? -Ekr > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --00000000000064d74b0590af4050 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Wed, Aug 21, 2019 at 10:43 PM Jim = Reid <jim@rfc1035.com> wrote:<= br>


> On 21 Aug 2019, at 22:13, Stephen Farrell <stephen.farrell@cs.tcd.ie> wr= ote:
>
> IMO you're both right but not quite using super-precise terminolog= y:-)
>
> ...
>
> So yep, both give data integrity, just differently.

If we=E2=80=99re being super-precise, that=E2=80=99s not quite right either= Stephen. :-)

DNSSEC and DoH/DoT are not different paths to the same end goal of data int= egrity. They provide different flavours of data integrity.
=

This I agree with.

=C2=A0
DNSSEC validation means you get the truth, the whole truth and nothing but = the truth regardless of your choice of resolver or the transport path betwe= en you and that resolver. DoH and DoT offer no protection at all from a lyi= ng resolver - you=E2=80=99re just guaranteed to receive precisely whatever = lies or truth that resolver sends. So in effect you somehow decide to =E2= =80=9Ctrust=E2=80=9D a TRR and hope for the best. In some cases, that may w= ell be good enough. In others, perhaps not.

=
I'd like to push on this slightly, if I may.

<= div>I certainly agree that from a cryptographic perspective, DNSSEC allows = you to evaluate whether or not the records that you receive are those which= were provisioned (modulo typos, key expiry, etc.). However, as has been ob= served here a number of times, there are many cases where the resolver desi= res to elide certain records (e.g., for malware filtering) or to redirect y= ou to some other location (e.g., captive portals). So from a systems perspe= ctive it seems like things are more complicated. Suppose that I receive a b= ogus response to my A record query, how am I to usefully distinguish "= this is malware blocking" from "this resolver is malicious"?=

-Ekr



--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--00000000000064d74b0590af4050-- From nobody Thu Aug 22 00:06:26 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A9165120100 for ; Thu, 22 Aug 2019 00:06:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id j6f2szxo8b5v for ; Thu, 22 Aug 2019 00:06:23 -0700 (PDT) Received: from mail-lf1-x12c.google.com (mail-lf1-x12c.google.com [IPv6:2a00:1450:4864:20::12c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D8F6C1200C7 for ; Thu, 22 Aug 2019 00:06:22 -0700 (PDT) Received: by mail-lf1-x12c.google.com with SMTP id a30so3701634lfk.12 for ; Thu, 22 Aug 2019 00:06:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=5FDrk1s2TPYIcB7e8+hC0PhAxW/P2sBSXYDvBHkSQIM=; b=QVElLRpT9s29/X+n6SIoBXJJ3nRt6u+gPC4J0NYGtMWSjaXZX/UDIYTjgUxFwREDam iR4gympedOPaqmRpwN0G3UrBHEi5T8/Lrdow1Nr1kCKGkjTiGRSmUYD5iVuRZxNureyt 118WDyuHA6fzVhrfsv1mTmkAV20hhmagaYVKaKjklno58oAW52DTq+SSCbK1BRvv9KNA vIFAKe1Iwo1bKt8dQiMnsAKtLEoslGgZMzFNctk8W9OwxcW7HixLoM+gLw5JXBWnyCVG 80fTH7bLtrFii7RoonVu7Bk5PuQN2cookks5DLoQkRMcEFq/QTdZT1RM9Xuu4H3G2PUP sjqA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=5FDrk1s2TPYIcB7e8+hC0PhAxW/P2sBSXYDvBHkSQIM=; b=O4KVnEVpMMrTwzmVCc+7iKl9CLSSqF8IEqAVStTGrXFnNiHoNHC9APO904l/z1oSvB ZfX/CoOY6ynRQXzs46M69pe4IaoxQ+HqgbBHm0VXg+ESb2WjQnv34AgvIdvU/mx7qDgv KWajA3045/lsRbAIkzVZu9ypHZM1VFizXPZ7EtwQmMaFBfamTPF+3oaiiQTX8EubqfrR 6bZVG/TJRl06VYsHjVJ4lQm9d7ANEOXCSfzMTjwRvnwHYIDRV8utegcoLV0yJTmjZSZD HcNn66wgNiJhwAyq7H99iASaqt3n2bXvrBkwHUg879i0PYXGFwU7LLDB+ltOjloFeLRE dy+A== X-Gm-Message-State: APjAAAVEssxNNb8fXOMiVL8iGYsEa2R5CiV9kGGITi26btYqbJlp6F1S qNEhJJE+4gHQmnZO8QUN38a+46kvyaHq48pD7m/0oniMRYk= X-Google-Smtp-Source: APXvYqw24hj7VQRU7EorwRajDReFWR24u9oRiWhjbX9/MWWRCehYmzyANOwZ35TXbHuYx/Xu7yVn4vM/Wsz5osPonW8= X-Received: by 2002:ac2:51d0:: with SMTP id u16mr1596972lfm.178.1566457580504; Thu, 22 Aug 2019 00:06:20 -0700 (PDT) MIME-Version: 1.0 References: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> In-Reply-To: From: Eric Rescorla Date: Thu, 22 Aug 2019 08:05:43 +0100 Message-ID: To: Martin Thomson Cc: ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000a4600e0590af5366" Archived-At: Subject: Re: [Add] What to do in this potential working group X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 22 Aug 2019 07:06:25 -0000 --000000000000a4600e0590af5366 Content-Type: text/plain; charset="UTF-8" On Thu, Aug 22, 2019 at 7:52 AM Martin Thomson wrote: > On Thu, Aug 22, 2019, at 16:44, Eric Rescorla wrote: > > > Basically, without doing validation, a stub resolver can be > categorized two different ways: > > > * security-unaware stub resolver > > > * security-aware non-validating stub resolver > > > I think it would be helpful if Mozilla were to state which kind of > stub resolver it will be implementing (security-unaware or security-aware). > > > > Are these defined somewhere? If so, can you send a pointer? > > https://tools.ietf.org/html/rfc4033#section-2 > > I think that we've implemented the former. > Yes, this seems right. -Ekr > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --000000000000a4600e0590af5366 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Thu, Aug 22, 2019 at 7:52 AM Marti= n Thomson <mt@low= entropy.net> wrote:
On Thu, Aug 22, 2019, at 16:44, Eric Rescorla wrote:
> > Basically, without doing validation, a stub resolver can be categ= orized two different ways:
> >=C2=A0 * security-unaware stub resolver
> >=C2=A0 * security-aware non-validating stub resolver
> > I think it would be helpful if Mozilla were to state which kind o= f stub resolver it will be implementing (security-unaware or security-aware= ).
>
> Are these defined somewhere? If so, can you send a pointer?

https://tools.ietf.org/html/rfc4033#section-2

I think that we've implemented the former.

Yes, this seems right.

-Ekr
=



--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--000000000000a4600e0590af5366-- From nobody Thu Aug 22 00:16:58 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 44317120169 for ; Thu, 22 Aug 2019 00:16:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id U8wGuVBeRzRN for ; Thu, 22 Aug 2019 00:16:55 -0700 (PDT) Received: from p130.piuha.net (p130.piuha.net [IPv6:2001:14b8:1829::130]) by ietfa.amsl.com (Postfix) with ESMTP id 237081200C7 for ; Thu, 22 Aug 2019 00:16:55 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by p130.piuha.net (Postfix) with ESMTP id E3DEE6601F5; Thu, 22 Aug 2019 10:16:53 +0300 (EEST) Received: from p130.piuha.net ([127.0.0.1]) by localhost (p130.piuha.net [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id x6fLXmpNC00V; Thu, 22 Aug 2019 10:16:52 +0300 (EEST) Received: from [127.0.0.1] (p130.piuha.net [IPv6:2001:14b8:1829::130]) by p130.piuha.net (Postfix) with ESMTPS id 8913166012C; Thu, 22 Aug 2019 10:16:52 +0300 (EEST) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\)) From: Jari Arkko In-Reply-To: <279abf8c-198b-5da8-1cb9-4f86bf1f37c7@nostrum.com> Date: Thu, 22 Aug 2019 10:16:51 +0300 Cc: add@ietf.org Content-Transfer-Encoding: quoted-printable Message-Id: References: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> <279abf8c-198b-5da8-1cb9-4f86bf1f37c7@nostrum.com> To: Adam Roach X-Mailer: Apple Mail (2.3273) Archived-At: Subject: Re: [Add] What to do in this potential working group X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 22 Aug 2019 07:16:57 -0000 Adam, >> Now, imagine that the next version of the browser comes with = by-default quad-n/doh setting, and now the browser will be contacting a = different server... >=20 > I really wish people wouldn't persist in ignoring repeated = explanations that Firefox (at least) will have actual user interaction = at the time that DoH is made available in a user's region, with a = one-click option to turn it off. Theoreticals that presume DoH will be = activated silently =E2=80=A6 Thanks for this. I did not know that there was a user interaction. (Is = there a pointer to go read more of the details of the plan?) However, I did not presume that there=E2=80=99d be no way to turn this = off. Glad to hear the turn of knob is easy though. But at the end of the day, there are two groups of users=E2=80=A6 those = that will fine-tune their settings (and I=E2=80=99m glad that=E2=80=99s = possible on Firefox), and those that will accept the default settings. = The latter group may get notifications about things, but they are = unlikely to do anything else than to accept the recommended default = option. Or understand what the implications of the different options = are. My mom will be in this group, and I care about what privacy = settings she gets. > imply a level of incompetence and/or malice on behalf of Mozilla's = product managers that I don't believe is warranted. I=E2=80=99m sorry if this was inferred. For what it is worth, I believe = everyone is acting with the best intents. And are very respected experts = about the complex situation. However, I think the analysis of the = situation in this case has stopped short, and the implications are more = dire than people thought, as outlined in previous emails. That=E2=80=99s = ok though, the purpose of our discussions is to learn and improve. I=E2=80= =99m happy I learned something from your email. Jari From nobody Thu Aug 22 00:25:06 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A6B1D1200C7 for ; Thu, 22 Aug 2019 00:25:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.199 X-Spam-Level: X-Spam-Status: No, score=-4.199 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eKm2BOy5o5n9 for ; Thu, 22 Aug 2019 00:25:03 -0700 (PDT) Received: from giant.haxx.se (www.haxx.se [IPv6:2a00:1a28:1200:9::2]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9D1961201A3 for ; Thu, 22 Aug 2019 00:25:02 -0700 (PDT) Received: from giant.haxx.se (mail [127.0.0.1]) by giant.haxx.se (8.15.2/8.15.2/Debian-4) with ESMTPS id x7M7OvtF000968 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 22 Aug 2019 09:24:57 +0200 Received: from localhost (dast@localhost) by giant.haxx.se (8.15.2/8.15.2/Submit) with ESMTP id x7M7OvuZ000950; Thu, 22 Aug 2019 09:24:57 +0200 X-Authentication-Warning: giant.haxx.se: dast owned process doing -bs Date: Thu, 22 Aug 2019 09:24:57 +0200 (CEST) From: Daniel Stenberg X-X-Sender: dast@giant.haxx.se To: Jari Arkko cc: Adam Roach , add@ietf.org In-Reply-To: Message-ID: References: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> <279abf8c-198b-5da8-1cb9-4f86bf1f37c7@nostrum.com> User-Agent: Alpine 2.20 (DEB 67 2015-01-07) X-fromdanielhimself: yes MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII; format=flowed Archived-At: Subject: Re: [Add] What to do in this potential working group X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 22 Aug 2019 07:25:05 -0000 On Thu, 22 Aug 2019, Jari Arkko wrote: > they are unlikely to do anything else than to accept the recommended default > option. Or understand what the implications of the different options are. My > mom will be in this group, and I care about what privacy settings she gets. This argumentation assumes that the "default" your mom should get is the default that is dictated by the coffee shop owner whose wifi she connects to. I don't think that's a given. I don't think DHCP is a default that we must live with until the end of times. Privacy? Which is better? Do53 to a server handed out over DHCP or DoH to another server? There's not a single answer to this, it depends on who you are and what you believe in. -- / daniel.haxx.se From nobody Thu Aug 22 00:30:33 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 94A711201C6 for ; Thu, 22 Aug 2019 00:30:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 660aUqLTFaOv for ; Thu, 22 Aug 2019 00:30:29 -0700 (PDT) Received: from mail-yw1-xc2f.google.com (mail-yw1-xc2f.google.com [IPv6:2607:f8b0:4864:20::c2f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B68D61201DB for ; Thu, 22 Aug 2019 00:30:17 -0700 (PDT) Received: by mail-yw1-xc2f.google.com with SMTP id l79so2015466ywe.11 for ; Thu, 22 Aug 2019 00:30:17 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to; bh=qLyqJ6UPRgC9QU/Sjd9eCpjnkIViOnczzGoeXWCKe2U=; b=HZDBG35veORMPmcm0DUjkc81dX7afVDSsWaibYk9h3xw3NSXm2TdD5ACk60FWTUy6D rXcHX9cKtewcJG1g5zx1i29bDqYvq/qn1kJcMv0tVO1qidaVDMKLniYaQVRM0ws3xL0h wlPKX6Cuj9QcsnSwUfelyBQOBWbTVY6ACerPAPMieyHySD6xEmpzA5DkuLF2G1mj/4iw smprv/N4ts+04Pvw4oT/89fAM5EVAwJGjAJMPaCAIHhPzw0r2zcKVJ9KmgQbkyfWCC5l JNBVdImKKoh8k+Awq386a9LVbCFne9Ng6fcHJ6xQBxQaK2Z7KlavRs+mmxyQzVpENFr/ 9Giw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to; bh=qLyqJ6UPRgC9QU/Sjd9eCpjnkIViOnczzGoeXWCKe2U=; b=XzZS0k/R+RH1/Ox/2i7xdZwLVv+S6D2Ny/4vMW1/39OZo9mtCrQEa951dz7NcO5k0m w0/E1uEAijK3QEtg/aMkEeI9P+u0LNpyDpu/IXaerr6Q7HeO6zxyjs4mo4UJLt5RlD5Q cCJNJa9fw64iVBJOHYVHUouTtuLTqyL053TJ5jCy1cHqRf3VJW1ghhivooam2C0CQDyV nRbmSDKuLRqeE19bhSB6t2rfRyopGjXAfDy2OLXQcey0kfr8vPjGaxGSt2A3aGKfdhx/ IXjpnJOEDcaRtuWCqoilABFDexnWwPpiD5lSYfdUkYZsgul0AwyKTXCZocKGBWQxuasB 9PIA== X-Gm-Message-State: APjAAAVQPG/kuQ0xw3mn/z/ReYUfFwOvq/GvT3wLNKtDTcgRVlKpa5GF INXPbqEdketp7Ds9dGhg0yFAgZCnHlWpMHdx62mQIMGw X-Google-Smtp-Source: APXvYqzueR1a0+HTtyShbfpSn8FFyUhZuuSJ4BkvjBD0hUNcD87aap24nDJItsPG3oOu+3aYybGf3Kj4AQc+6w6hAVY= X-Received: by 2002:a0d:e6cb:: with SMTP id p194mr27107481ywe.83.1566459016457; Thu, 22 Aug 2019 00:30:16 -0700 (PDT) MIME-Version: 1.0 References: <8D42902D-CD20-4A64-8F38-CF96F1A351F1@frobbit.se> <20190821.202457.210468432.sthaug@nethelp.no> <20190822.082753.251801273.sthaug@nethelp.no> In-Reply-To: <20190822.082753.251801273.sthaug@nethelp.no> From: Alec Muffett Date: Thu, 22 Aug 2019 08:29:39 +0100 Message-ID: To: ADD Mailing list Content-Type: multipart/alternative; boundary="0000000000003b332f0590afa9c2" Archived-At: Subject: Re: [Add] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 22 Aug 2019 07:30:32 -0000 --0000000000003b332f0590afa9c2 Content-Type: text/plain; charset="UTF-8" On Thu, 22 Aug 2019 at 07:27, wrote: > My personal view (note: IANAL): If only a few customers used such > alternative name-resolution, authorities probably wouldn't care. If > "sufficiently many" customers did this, authorities would probably > take note, and require ISPs to implement blocking by other methods. > Noted; that's a concern that I hear a lot, that increasing adoption of more secure, more private technologies - incidentally thereby creating a two-tier internet for the "privacy-haves" and the "privacy-have-nots" - will bring about a general political backlash against freedom of expression and online privacy. My experience of realpolitik is that in most "western" countries, such blocks are essentially meant to symbolically express that the state has "done something" to address access to [whatever]. They are only symbolic because (as we all understand) such blocks are trivially circumvented via increasingly popular technologies such as VPNs and Tor; and we all fear the blocks becoming more concrete, eg: by implementation of a "Great Fjordwall of Norway" filtering all traffic between Norway and the rest of the world. I don't fear the cited "require ISPs to implement blocking by other methods" - but then I am not an ISP. Instead, I am someone who spends a *lot* of time[1][2][3] explaining to politicians why their various blocks and restrictions won't work. In this era of Netflix / Amazon / streaming services increasingly shipping own-brand content and geolocking it, I would greatly welcome the opportunity to put politicians to the test regards whether they believe (say) VPNs are morally acceptable in any given country, rather than timorously live and work in a grey area. This is because I believe that no internet technology or protocol is inherently immoral, and that the only objective moral metric which can be applied reasonably to an internet technology is the intent of the specific user and the result of its being used. If and when this is recognised, then we will not have to expend time in discussions such as these, which themselves are only echoes of similar arguments[4][5] back in ~1998 about how the adoption of HTTPS was going to lead to Government crackdowns and demands for key escrow. And we will also reduce, perhaps stop, the destructive tendency of splitting society into tiers of people who are technologically capable of bypassing blocks, versus those (older? poorer? less educated?) who lack the capability. - alec [1] https://medium.com/@alecmuffett/on-the-digital-economy-bill-1df356862ac2 [2] https://www.theguardian.com/technology/2017/mar/29/uk-government-encryption-whatsapp-investigatory-powers-act [3] https://www.openrightsgroup.org/blog/2017/the-british-public-and-its-freedom-to-tinker-with-data [4] https://www.cnet.com/news/white-house-shuns-fbi-crypto-plan/ [5] https://www.eff.org/deeplinks/2014/09/nine-epic-failures-regulating-cryptography -- http://dropsafe.crypticide.com/aboutalecm --0000000000003b332f0590afa9c2 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


On Thu, 22 Aug 2019 at 07:27, <sthaug@nethelp.no> wrote:
My personal v= iew (note: IANAL): If only a few customers used such
alternative name-resolution, authorities probably wouldn't care.=C2=A0 = If
"sufficiently many" customers did this, authorities would probabl= y
take note, and require ISPs to implement blocking by other methods.

Noted; that's a concern that I hear a lot,= that increasing adoption of more secure, more private technologies - incid= entally thereby creating a two-tier internet for the "privacy-haves&qu= ot; and the "privacy-have-nots" - will bring about a general poli= tical backlash against freedom of expression and online privacy.
=
My experience of realpolitik is that in most "western&q= uot; countries, such blocks are essentially meant to symbolically express t= hat the state has "done something" to address access to [whatever= ].

They are only symbolic because (as we all under= stand) such blocks are trivially circumvented via increasingly popular tech= nologies such as VPNs and Tor; and we all fear the blocks becoming more con= crete, eg: by implementation of a "Great Fjordwall of Norway" fil= tering all traffic between Norway and the rest of the world.

=
I don't fear the cited "require ISPs to implement block= ing by other methods" - but then I am not an ISP.=C2=A0

=
Instead, I am someone who spends a *lot* of time[1][2][3] explai= ning to politicians why their various blocks and restrictions won't wor= k.

In this era of Netflix / Amazon / streaming ser= vices increasingly shipping own-brand content and geolocking it, I would gr= eatly welcome the opportunity to put politicians to the test regards whethe= r they believe (say) VPNs are morally acceptable in any given country, rath= er than timorously live and work in a grey area.

T= his is because I believe that no internet technology or protocol is inheren= tly immoral, and that the only objective moral metric which can be applied = reasonably to an internet technology is the intent of the specific user and= the result of its being used.

If and when this is= recognised, then we will not have to expend time in discussions such as th= ese, which themselves are only echoes of similar arguments[4][5] back in ~1= 998 about how the adoption of HTTPS was going to lead to Government crackdo= wns and demands for key escrow.

And we will also r= educe, perhaps stop, the destructive tendency of splitting society into tie= rs of people who are technologically capable of bypassing blocks, versus th= ose (older? poorer? less educated?) who lack the capability.
=C2= =A0
=C2=A0 =C2=A0 - alec

[1] <= a href=3D"https://medium.com/@alecmuffett/on-the-digital-economy-bill-1df35= 6862ac2">https://medium.com/@alecmuffett/on-the-digital-economy-bill-1df356= 862ac2

--
http://dropsafe.crypticide.com/aboutalecm
--0000000000003b332f0590afa9c2-- From nobody Thu Aug 22 00:57:25 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4FE331201E0 for ; Thu, 22 Aug 2019 00:57:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nKZYc6R4v8jF for ; Thu, 22 Aug 2019 00:57:22 -0700 (PDT) Received: from p130.piuha.net (p130.piuha.net [193.234.218.130]) by ietfa.amsl.com (Postfix) with ESMTP id 09DF11200C7 for ; Thu, 22 Aug 2019 00:57:22 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by p130.piuha.net (Postfix) with ESMTP id B31F16601F5; Thu, 22 Aug 2019 10:57:19 +0300 (EEST) Received: from p130.piuha.net ([127.0.0.1]) by localhost (p130.piuha.net [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Z_aHyKKQvjCD; Thu, 22 Aug 2019 10:57:17 +0300 (EEST) Received: from [127.0.0.1] (p130.piuha.net [IPv6:2001:14b8:1829::130]) by p130.piuha.net (Postfix) with ESMTPS id A83DA66012C; Thu, 22 Aug 2019 10:57:17 +0300 (EEST) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\)) From: Jari Arkko In-Reply-To: Date: Thu, 22 Aug 2019 10:57:17 +0300 Cc: Adam Roach , add@ietf.org Content-Transfer-Encoding: quoted-printable Message-Id: <87C8E6E6-2DEE-4637-9C86-65B27615611C@piuha.net> References: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> <279abf8c-198b-5da8-1cb9-4f86bf1f37c7@nostrum.com> To: Daniel Stenberg X-Mailer: Apple Mail (2.3273) Archived-At: Subject: Re: [Add] What to do in this potential working group X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 22 Aug 2019 07:57:24 -0000 Daniel, I agree of course that there are different situations, and that in some = cases DHCP default is the wrong option as well. I know in my mom=E2=80=99s= case it would have been the right answer, however. But the = architectural point I wanted to raise was that regardless of the = differences in any specific selection of a server, there seems to be a = clear downside to having everyone select the same server. The data = source that this creates is far too valuable to be put in one place. I do have another point as well. We=E2=80=99re not limited to two = options =E2=80=94 there=E2=80=99s more choice than =E2=80=9Ctrust your = network/evil-local-dns-filter=E2=80=9D and =E2=80=9Ctrust the = quad-n/large-content-provider/nsa=E2=80=9D. If people really are serious = about improving security and privacy, how about, for instance, creating = a collaborative group of content providers, ISPs, and other = organisations that wish to provide clean, unfiltered, and not = commercially mined DNS service, and have clients use that in some = distributed fashion? I=E2=80=99m obviously handwaving the solution a bit, but my point is =E2=80= =94 if we want to make an improvement, then it should be an incumbent on = us to do a full solution. Shipping my mom=E2=80=99s queries to a single = entity /w possible risk of surveillance and other leaks is a recipe for = insufficient design, IMHO. If we want an improvement, sell me a solution = that I actually want, one that does improve my privacy and resilience = against filtering. Jari From nobody Thu Aug 22 01:41:40 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1784E120236 for ; Thu, 22 Aug 2019 01:41:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MOPXLAqBiIe0 for ; Thu, 22 Aug 2019 01:41:35 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8C91012006D for ; Thu, 22 Aug 2019 01:41:34 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id ECB71BEB5; Thu, 22 Aug 2019 09:41:32 +0100 (IST) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CIEWl_F7OzhR; Thu, 22 Aug 2019 09:41:31 +0100 (IST) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 643BEBE8A; Thu, 22 Aug 2019 09:41:31 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1566463291; bh=7+qnR0l1VdIE6BC9Z0EgduiLS6JXLnn369nE2i3+4Nc=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From; b=io+Xhda+SqyTY8ja31TzvxZalhxDVj7OZTq3vvuXM5tZPuJhF522WlmEvSHA5aDiU niFh0Ylb+Tnl0AbxIrRw4n2worm1Vz9sWbqfRSacjDbkykEHrkNSnmXQu3gjZJN/9g 8JcTxD/qKel5sLuA0x+4WRgXshsvGceYyz9ojHUI= To: Brian Dickson Cc: Jim Reid , ADD Mailing list , David Conrad References: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> <59E0EC53-0E30-431C-8376-52C7BFC121A8@virtualized.org> <589DAFCB-1BDC-4156-A2CA-179C4559A6B2@virtualized.org> <683A176C-3CE6-4866-A736-F2A7465FA5B5@rfc1035.com> <1459e7d8-a98d-92e8-8c69-7667d6bb4bdb@cs.tcd.ie> <16B52A77-92D0-44F7-866D-D3420D6FE162@gmail.com> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: <3653d944-c8c4-dc2a-9f5e-c1fbca8555cb@cs.tcd.ie> Date: Thu, 22 Aug 2019 09:41:30 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: <16B52A77-92D0-44F7-866D-D3420D6FE162@gmail.com> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="78xzVTMMlrfz1AnSG3WdKXSylg78qctPO" Archived-At: Subject: Re: [Add] data integrity and DNSSEC or DoH/DoT X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 22 Aug 2019 08:41:38 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --78xzVTMMlrfz1AnSG3WdKXSylg78qctPO Content-Type: multipart/mixed; boundary="3NuE7q2lwiIK0cCGOMVk92dtnbp0IP35L"; protected-headers="v1" From: Stephen Farrell To: Brian Dickson Cc: Jim Reid , ADD Mailing list , David Conrad Message-ID: <3653d944-c8c4-dc2a-9f5e-c1fbca8555cb@cs.tcd.ie> Subject: Re: [Add] data integrity and DNSSEC or DoH/DoT References: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> <59E0EC53-0E30-431C-8376-52C7BFC121A8@virtualized.org> <589DAFCB-1BDC-4156-A2CA-179C4559A6B2@virtualized.org> <683A176C-3CE6-4866-A736-F2A7465FA5B5@rfc1035.com> <1459e7d8-a98d-92e8-8c69-7667d6bb4bdb@cs.tcd.ie> <16B52A77-92D0-44F7-866D-D3420D6FE162@gmail.com> In-Reply-To: <16B52A77-92D0-44F7-866D-D3420D6FE162@gmail.com> --3NuE7q2lwiIK0cCGOMVk92dtnbp0IP35L Content-Type: multipart/mixed; boundary="------------165D42BB4C50B6BBBD64E588" Content-Language: en-GB This is a multi-part message in MIME format. --------------165D42BB4C50B6BBBD64E588 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hiya, I agree with the overall thrust of your mail that a fair analysis of the efficacy of the DNS data integrity services provided by DoT/DoH vs. what's provided by DNSSEC, in the real DNS... is complex. I would quibble with a bunch of things you said but it's probably better I try resist the temptation, so I'll limit myself to one, for illustration - I'm not at all trying to claim this is "the important bit" you missed, just emphasising the subtlety here: On 22/08/2019 04:31, Brian Dickson wrote: > A risk analysis of DNS vs tampering would show the place to attack > DNS is not on the client side, but rather on the authority side. Some attackers don't want to be easily noticed, and for them, it can be better if they tamper more locally. Again, I'm not disagreeing with your overall message but rather agreeing about the complexity here. I think a consequence that follows from that is that anyone making claims that there is one simple difference between use of DoH/DoT and DNSSEC is mistaken, and further that it doesn't really make sense to say one is "better" than the other, when it comes to providing data integrity. Personally, when it comes to data integrity of both forms, I want both and more of both, and I think that is a pretty defensible conclusion. Note: the conclusion above only considers data integrity services. It does not ask anyone to reach a conclusion about how DoT/DoH might lead to over-concentration of queries. Cheers, S. --------------165D42BB4C50B6BBBD64E588 Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------165D42BB4C50B6BBBD64E588-- --3NuE7q2lwiIK0cCGOMVk92dtnbp0IP35L-- --78xzVTMMlrfz1AnSG3WdKXSylg78qctPO Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAl1eVToACgkQWrL68XsX K+ri5hAAs3DcmduCEd+O2qXuMb+NSY1ag2IYI3FIdu+4TDrJyWw4RVSYp8yuVvnq fk2OCPZXDW9ghpJ13rGcV9aBgxs/h7tV4vXJt+PB0Dvze3aji85y0Ks3upMA6Ec3 GE4vRqIncGc9fwLmNajU+73X7rhZQVq4ooieZnUmt65moFKmHlixB/RKJl8/Dauc tnT0mvnOViDegNSi0lZMuMqNuYVczWuTRR1zTxPrqHapmc6V93mI7hXKCgw3cY0T 3e4ihqU+Nd6t3/DjJuu9cn+NDJ6SHC85ub0ZKuhNIe/i/iQM/i0POW+k37z3u6H0 Blssg36OqCqvhmhQ/UFJ5415A47Rd6UC8rSrG3md9xQwNheMIv5o6pKhqmD1V7bB C1pSRyL3amKax8rXyeCE2At1yJjbTVDzdRRMImXmF/f6RR0vhQsbBypFb6M8txTz 4trDGE+yB2baV3svK4RnuxDvDhprM/5x5twO8i0q/bgkOXgHrCuwv0NGq2F982fE Rkeaj2Y3rLPiP+SVgfGmjaEjNHLywNQTYS/M3mO0y3OqmuXv3iCOCoafZj0BwY15 KRo+fTR4CVA7pTASmY63aDirnrQYg5wrmviJNgoTrs1Y/N+kbnK/Tj5Z4TKonO6r Sq/3DCBA8T11aG51DuMxqRbX3m5yiMjhZKjEMxZ7kkWiCPp09XM= =jJcg -----END PGP SIGNATURE----- --78xzVTMMlrfz1AnSG3WdKXSylg78qctPO-- From nobody Thu Aug 22 02:37:23 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 56228120813 for ; Thu, 22 Aug 2019 02:37:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=portfast.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SgCs-UjN5ryq for ; Thu, 22 Aug 2019 02:37:19 -0700 (PDT) Received: from mail.portfast.net (mail.portfast.net [IPv6:2a03:9800:20:1::2]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 28B6E1200B2 for ; Thu, 22 Aug 2019 02:37:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=portfast.net; s=dkim; h=Content-Transfer-Encoding:Content-Type:In-Reply-To: MIME-Version:Date:Message-ID:From:References:To:Subject:Sender:Reply-To:Cc: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=i7jeyvyf7qUt0MNl4Kgsatx3Qd4kUw75Skru3l3TyAM=; b=VMei4+48K8fMsT3bu8Vh5CFazb upgP3XlCgUd1OhS4iLgSE81uMQr1pvJ3FkuTn/JA/+tIzHtVy6ObIgCTi8VEDkZ8SnH+tTVBUm2/E 16JMo7HIODHfvsQpQb/cM73bPGLbiRPJPuPHfLlHbT3UPhtNEgqYvqsz3neQOXUs+Sgk=; Received: from [88.212.170.135] (port=63547 helo=Rays-MacBook-Pro.local) by mail.portfast.net ([188.246.200.9]:465) with esmtpsa (fixed_plain:ray@bellis.me.uk) (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) id 1i0jWt-0005VG-TO (Exim 4.89) for add@ietf.org (return-path ); Thu, 22 Aug 2019 09:37:15 +0000 To: add@ietf.org References: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> <8f856492-f5da-9a02-f76d-67c2795b2ecc@cs.tcd.ie> <4505d6b8-0521-dd2f-245d-8fa73e2313c3@cs.tcd.ie> From: Ray Bellis Message-ID: <52f571ea-9884-ba23-76c5-246fa668ef68@bellis.me.uk> Date: Thu, 22 Aug 2019 10:37:15 +0100 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: <4505d6b8-0521-dd2f-245d-8fa73e2313c3@cs.tcd.ie> Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-GB Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [Add] What to do in this potential working group X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 22 Aug 2019 09:37:21 -0000 On 21/08/2019 21:41, Stephen Farrell wrote: > But that wasn't quite what I intended. ISTM clear that having O(1) > TRRs in the world would be over-concentrated. I think it's maybe > equally clear that with a different per-LAN recursive (which is > kinda like today) it'd be extremely hard to authenticate those > as TRR-like entities - so perhaps O(10^7) is too many TRRs. I do > think considering "how many TRR-like things would be good" is a > relevant (research?) question that could affect protocol design > and implementations and deployments. > > For example, if there's an answer at all and O(100) were that > answer, that might change how a DoT/DoH client might usefully > spread it's queries over those vs. if the answer were O(10^4). There's a possible scaling issue here. To allow efficient use of CDNs it is necessary for some form of client geo-location to occur. It's already been observed in the Samknows report[1] that Cloudflare's lack of support for EDNS-Client-Subnet [2] (RFC 7871) leads to suboptimal performance when accessing non-CF hosted content. If every network has a "nearby" recursor (whether that be using normal DNS, or DoH) then ECS is not required becase the IP address of the recursor serves as a good proxy for that of the client. In that sense, O(10^7) is a good thing. However, RFC 7871 envisaged that the ECS option would only be exchanged between consenting servers. It also says "it is expected that only a few Recursive Resolvers will need to use ECS" and alludes to ECS only be exchanged on specific agreement between recursive operators and authoritative operators. At the moment we're about O(5) global DNS operators, and O(30) major CDNs. But, if you're talking about getting to the O(100) scale of TRR operators all of whom are receiving queries from clients all over the world then that's a lot of bilateral agreements and configurations that would need to be set up, and a lot of ECS meta-information buzzing around the network. Ray [1] https://samknows.com/blog/dns-over-https-performance [2] Cloudflare use Anycast for their CDN instead of "stupid DNS tricks", so they don't need ECS. From nobody Thu Aug 22 02:51:47 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CC460120813 for ; Thu, 22 Aug 2019 02:51:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, FROM_EXCESS_BASE64=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=itaoyama.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id u7wIVUt_1ahO for ; Thu, 22 Aug 2019 02:51:43 -0700 (PDT) Received: from APC01-HK2-obe.outbound.protection.outlook.com (mail-eopbgr1300119.outbound.protection.outlook.com [40.107.130.119]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 041341200B2 for ; Thu, 22 Aug 2019 02:51:42 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=FiJ8f2o65dcBQ7Z3i0ZmOI5IxRRd0SY8DeFa4JkIwzXTnQlQTZJle6x1yVN73jhl/Av3bqfB8AtDdIq6FH+fNBsroA/6Sfa9dStWouDcV46UCQv/FQgJLIbUTCn+NQKiulgt/FSUZ6ZxzvZ09X1r7RbcqnPKU9sn1PDUbpowNvstJVjulxe7uT2zqNqPFYpclvdfej8jYlZj0hXquV6sBJsTeJBt1bbnikuofFSQicTyXat1BOT8fs6YK0wZGx+GgJPugRxRLqMeLGy2fpi9caDb5xFumcTBsUuiL9QrKeyR2pUMooruumfAqT4k8/QQWQnyCo91XhnNMAP/e7DcvA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=A8Tx649jcsmaxPA/4qKNci4QD475spc/p/qAhVajO6s=; b=b6nAye9kstiBy3qUuQwzXz71lXegjpmJK+abHAqFUbgblhLpeRtln0c4HJdruCcnlB3ch1pZRaSys54zO6KfriePy+fli3sBu/+9AEQ7MuNSGn3ZF2veWWP+lx2D1s5vYgEiUWGqzXiWevDsyZSEnUbznMKMkzh0fkvHTkRcUuEhAa1dz399+4XNz/bOT/xAJU9Okw4tqSFuDRCyRcjk4eEDYrwFxkhbGXP65QhdmKede8hFqQBpSdRpnirKmzmM7svENtaQ+7ToX2N20LyrxRVkFeZkt/hnCRzFjURF9h699Z4paNwH6MHhS/DYlm3AJOtOlnJ8WFuwklm7MRWLFQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=it.aoyama.ac.jp; dmarc=pass action=none header.from=it.aoyama.ac.jp; dkim=pass header.d=it.aoyama.ac.jp; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=itaoyama.onmicrosoft.com; s=selector2-itaoyama-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=A8Tx649jcsmaxPA/4qKNci4QD475spc/p/qAhVajO6s=; b=S5h+5mj7phL8W7WaRprUqfvAADk3c6zDPfXI40DYKFoSDZiM51uGID7lIjp2/Wf/7osYbzbVJ3bw/gTUMESgF/prPBxXbgycnd6IS5c6rSLjc+TB1dgusWbHBJMd8rsFo9ottMDV2Rm9ZZj66uoFTzHNkbQ+EZ3c/ZlBfa/HznQ= Received: from TY2PR01MB3401.jpnprd01.prod.outlook.com (20.178.141.204) by TY2PR01MB4089.jpnprd01.prod.outlook.com (20.178.143.145) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2178.16; Thu, 22 Aug 2019 09:51:39 +0000 Received: from TY2PR01MB3401.jpnprd01.prod.outlook.com ([fe80::9538:388:6e72:4340]) by TY2PR01MB3401.jpnprd01.prod.outlook.com ([fe80::9538:388:6e72:4340%5]) with mapi id 15.20.2178.018; Thu, 22 Aug 2019 09:51:39 +0000 From: =?utf-8?B?TWFydGluIEouIETDvHJzdA==?= To: Stephen Farrell CC: ADD Mailing list Thread-Topic: [Add] What to do in this potential working group Thread-Index: AQHVV5IhM8MdSBmqgkWbxFdpNks5+qcFRa+AgAAo9ICAAHAxAIAAJ4+AgAADcACAAAiTgIAA3NaA Date: Thu, 22 Aug 2019 09:51:38 +0000 Message-ID: <2e44b80b-2264-b6b5-9062-6b05f627925c@it.aoyama.ac.jp> References: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> <8f856492-f5da-9a02-f76d-67c2795b2ecc@cs.tcd.ie> <4505d6b8-0521-dd2f-245d-8fa73e2313c3@cs.tcd.ie> In-Reply-To: <4505d6b8-0521-dd2f-245d-8fa73e2313c3@cs.tcd.ie> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-clientproxiedby: TYAPR01CA0240.jpnprd01.prod.outlook.com (2603:1096:404:11e::36) To TY2PR01MB3401.jpnprd01.prod.outlook.com (2603:1096:404:d1::12) authentication-results: spf=none (sender IP is ) smtp.mailfrom=duerst@it.aoyama.ac.jp; x-ms-exchange-messagesentrepresentingtype: 1 x-originating-ip: [133.2.210.64] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: b40dfa73-c02f-46fd-8558-08d726e653e9 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(7021145)(8989299)(5600166)(711020)(4605104)(1401327)(4534185)(7022145)(4603075)(4627221)(201702281549075)(8990200)(7048125)(7024125)(7025125)(7027125)(7023125)(2017052603328)(7193020); SRVR:TY2PR01MB4089; x-ms-traffictypediagnostic: TY2PR01MB4089: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-forefront-prvs: 01371B902F x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(366004)(376002)(396003)(346002)(136003)(39840400004)(199004)(189003)(71190400001)(229853002)(81166006)(6436002)(6916009)(5660300002)(76176011)(52116002)(6486002)(256004)(14454004)(508600001)(186003)(102836004)(53546011)(14444005)(99286004)(6512007)(26005)(66946007)(66066001)(66556008)(66446008)(66476007)(71200400001)(64756008)(25786009)(446003)(2616005)(85202003)(2906002)(11346002)(8936002)(7736002)(4326008)(386003)(6506007)(81156014)(305945005)(8676002)(31696002)(86362001)(31686004)(316002)(786003)(53936002)(85182001)(3846002)(6116002)(476003)(6246003)(486006); DIR:OUT; SFP:1102; SCL:1; SRVR:TY2PR01MB4089; H:TY2PR01MB3401.jpnprd01.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:0; MX:1; received-spf: None (protection.outlook.com: it.aoyama.ac.jp does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: RYlftg/RPb0e6ejlImTG0pVTR2ouunyrI1Lx5vl7NW5iApKaEavYUNAe+g9fdVP5k9C1Ab3LfYIA+9oRaYdTWFDPa4LmZ4TdicODf6wN7IepEKpV4GxIm4Z7AcCM3C5g79R+O03jNPGXjtbfjrKJHsrkvofskgDdfhvv/cLIoFJyZPXazRnuQ8XtCcNUqmdUCwejFfCxDmRq8T71aMRYAyd9IX896vdaFla5d54a6EoOdTvjZhl4NsEdJwn7kLL908BiKSW1TISED30x5/GOYOS+Ywqsx+wVowe/p4VNJQGCYyPBm91j3T0w0QN6i6dbw3uhoHVf/yqJCuvG0d8EId8yGbwAAGCEFKIu9z9PLgjZi7z+zT5toRUf2Uz/DmYr2DraAdG98qbv/Yz4TMbykr+JXMZ+nix2WdQVGThQK4M= x-ms-exchange-transport-forked: True Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: it.aoyama.ac.jp X-MS-Exchange-CrossTenant-Network-Message-Id: b40dfa73-c02f-46fd-8558-08d726e653e9 X-MS-Exchange-CrossTenant-originalarrivaltime: 22 Aug 2019 09:51:39.3058 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: e02030e7-4d45-463e-a968-0290e738c18e X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: Bo6j82jxYHDn8lsomZxbzRjqD9VibuCBmDQmsAkQwoCv07i6WL3S7MQZvZhcQsI62ER5bPmU2gvcpbMJCc3f5w== X-MS-Exchange-Transport-CrossTenantHeadersStamped: TY2PR01MB4089 Archived-At: Subject: Re: [Add] What to do in this potential working group X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 22 Aug 2019 09:51:46 -0000 SGVsbG8gU3RlcGhlbiwgb3RoZXJzLg0KDQpPbiAyMDE5LzA4LzIyIDA1OjQxLCBTdGVwaGVuIEZh cnJlbGwgd3JvdGU6DQoNCj4gQnV0IHRoYXQgd2Fzbid0IHF1aXRlIHdoYXQgSSBpbnRlbmRlZC4g SVNUTSBjbGVhciB0aGF0IGhhdmluZyBPKDEpDQo+IFRSUnMgaW4gdGhlIHdvcmxkIHdvdWxkIGJl IG92ZXItY29uY2VudHJhdGVkLiBJIHRoaW5rIGl0J3MgbWF5YmUNCj4gZXF1YWxseSBjbGVhciB0 aGF0IHdpdGggYSBkaWZmZXJlbnQgcGVyLUxBTiByZWN1cnNpdmUgKHdoaWNoIGlzDQo+IGtpbmRh IGxpa2UgdG9kYXkpIGl0J2QgYmUgZXh0cmVtZWx5IGhhcmQgdG8gYXV0aGVudGljYXRlIHRob3Nl DQo+IGFzIFRSUi1saWtlIGVudGl0aWVzIC0gc28gcGVyaGFwcyBPKDEwXjcpIGlzIHRvbyBtYW55 IFRSUnMuIEkgZG8NCj4gdGhpbmsgY29uc2lkZXJpbmcgImhvdyBtYW55IFRSUi1saWtlIHRoaW5n cyB3b3VsZCBiZSBnb29kIiBpcyBhDQo+IHJlbGV2YW50IChyZXNlYXJjaD8pIHF1ZXN0aW9uIHRo YXQgY291bGQgYWZmZWN0IHByb3RvY29sIGRlc2lnbg0KPiBhbmQgaW1wbGVtZW50YXRpb25zIGFu ZCBkZXBsb3ltZW50cy4NCj4gDQo+IEZvciBleGFtcGxlLCBpZiB0aGVyZSdzIGFuIGFuc3dlciBh dCBhbGwgYW5kIE8oMTAwKSB3ZXJlIHRoYXQNCj4gYW5zd2VyLCB0aGF0IG1pZ2h0IGNoYW5nZSBo b3cgYSBEb1QvRG9IIGNsaWVudCBtaWdodCB1c2VmdWxseQ0KPiBzcHJlYWQgaXQncyBxdWVyaWVz IG92ZXIgdGhvc2UgdnMuIGlmIHRoZSBhbnN3ZXIgd2VyZSBPKDEwXjQpLg0KDQpJIGtub3cgd2hl cmUgeW91IHdhbnQgdG8gZ2V0IGF0LCBidXQgZHVlIHRvIHRoZSBwcm9wZXJ0aWVzIG9mIHRoZSBC aWctTyANCm5vdGF0aW9uLCBPKDEpLCBPKDEwXjcpLCBPKDEwMCksIGFuZCBPKDEwXjQpIGFyZSBh bGwgdGhlIHNhbWUgKGJlY2F1c2UgDQp0aGV5IGFyZSBhbGwgY29uc3RhbnRzLCBhbmQgY29uc3Rh bnQgZmFjdG9ycyBhcmUgZWxpbWluYXRlZCBpbiBCaWctTyANCnRoaW5raW5nKS4gUGxlYXNlIGNo ZWNrIHlvdXIgc291cmNlcyBpZiB5b3UgZG9uJ3QgcmVtZW1iZXIgdGhpcywgb3IgDQpuZXZlciBo YXZlIGhhZCB0aGUgY2hhbmNlIHRvIHN0dWR5IGl0LiBJIGNhbiBzdWdnZXN0IHNvdXJjZXMgaWYg bmVjZXNzYXJ5Lg0KDQpJZiB5b3Ugd2FudCB0byBzYXkgImFib3V0IDEiIG9yICJhYm91dCAxMDAi LCB0aGVuIH4xIG9yIH4xMDAgb3Igc28gbWF5IA0KYmUgYXBwcm9wcmlhdGUuDQoNCkluIG9yZGVy IChzaWMhKSBmb3IgQmlnLU8gbm90YXRpb24gdG8gYmVjb21lIHVzZWZ1bCwgd2UgaGF2ZSB0byBh c3N1bWUgDQp3ZSBoYXZlIGEgbnVtYmVyIG9mIC9uLyBjbGllbnRzLiBUaGVuLCBzZW5zaWJsZSBh bnN3ZXJzIGludm9sdmluZyBCaWctTyANCm5vdGF0aW9uIG1heSBiZSBPKG5eMC41KSBvciBzb21l IHN1Y2guIE8obl4wLjUpIHdvdWxkIG1lYW4gdGhhdCBhIA0KcmVhc29uYWJsZSBudW1iZXIgb2Yg IlRSUi1saWtlIHRoaW5ncyIgd291bGQgYmUgb24gdGhlIG9yZGVyIG9mIHRoZSANCnNxdWFyZSBy b290IG9mIHRoZSBudW1iZXIgb2YgY2xpZW50cy4NCg0KT2YgY291cnNlIEkgaGF2ZSBubyBpZGVh IHdoZXRoZXIgaXQgd291bGQgYmUgTyhuXjAuNSkgb3IgTyhuXjAuMSkgb3IgDQpPKGxvZyBuKSBv ciBhbnkgb3RoZXIga2luZCBvZiBvcmRlci4gQSBmaXJzdCBndWVzcyB3aWxsIHB1dCB0aGUgcmVz dWx0IA0KYmV0d2VlbiAxIChub3QgTygxKSkgYW5kIE8obiksIGJ1dCB0aGF0J3Mgb2J2aW91cyBh bmQgbm90IHZlcnkgdXNlZnVsLiANCkhvd2V2ZXIsIHRoZXJlIHNob3VsZCBiZSBwZW9wbGUgd2hv IHVuZGVyc3RhbmQgdGhlIHRoZW9yZXRpY2FsIA0KZnJhbWV3b3JrKHMpIHRoYXQgbWF5IGdpdmUg bW9yZSBwcmVjaXNlIGFuc3dlcnMuIEFuZCB0aGVyZSBzaG91bGQgYmUgDQpwZW9wbGUgd2hvIGtu b3cgaG93IHRvIGRlc2lnbiBhbmQgcnVuIGV4cGVyaW1lbnRzIHRvIGdldCBzb21lIG1vcmUgDQpw cmVjaXNlIGlkZWFzLg0KDQpSZWdhcmRzLCAgIE1hcnRpbi4NCg== From nobody Thu Aug 22 03:02:42 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8DD46120813 for ; Thu, 22 Aug 2019 03:02:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id E4jYHjBSbuYh for ; Thu, 22 Aug 2019 03:02:38 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 25D611200B2 for ; Thu, 22 Aug 2019 03:02:37 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id EF055BE77; Thu, 22 Aug 2019 11:02:32 +0100 (IST) Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id svt_JEzsQeM4; Thu, 22 Aug 2019 11:02:32 +0100 (IST) Received: from [134.226.36.93] (unknown [134.226.36.93]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id B33E7BE74; Thu, 22 Aug 2019 11:02:32 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1566468152; bh=rTG0oIH9i9SKtxdam7c2vqyMqOHeMTqTW7PuWDmLjfg=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From; b=C4ljZWvjbXoEVpiHXjUq14uGudZaRQuGh8w9NlQjcr9paKZiJgYnfNnHUjLkfNkUT 9W9ecERP7jscmoWSikURWIBp5Yj26AVLrS2yvQn7OAx1G/kBk5PFj18lJJfg7+H8yV TMWlxMWNcuf7fPbvnsLxmCVTtbrg+f76BEctDSwo= To: =?UTF-8?Q?Martin_J=2e_D=c3=bcrst?= Cc: ADD Mailing list References: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> <8f856492-f5da-9a02-f76d-67c2795b2ecc@cs.tcd.ie> <4505d6b8-0521-dd2f-245d-8fa73e2313c3@cs.tcd.ie> <2e44b80b-2264-b6b5-9062-6b05f627925c@it.aoyama.ac.jp> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: <38bcb874-4aad-7ce2-0ddd-7827c3c1cf69@cs.tcd.ie> Date: Thu, 22 Aug 2019 11:02:32 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: <2e44b80b-2264-b6b5-9062-6b05f627925c@it.aoyama.ac.jp> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="5QiIplgL953sU81lK4W0MuyBViXoL1m09" Archived-At: Subject: Re: [Add] What to do in this potential working group X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 22 Aug 2019 10:02:41 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --5QiIplgL953sU81lK4W0MuyBViXoL1m09 Content-Type: multipart/mixed; boundary="tMvlqEZODjHpONI7KOA5ieXPovSLFOAHN"; protected-headers="v1" From: Stephen Farrell To: =?UTF-8?Q?Martin_J=2e_D=c3=bcrst?= Cc: ADD Mailing list Message-ID: <38bcb874-4aad-7ce2-0ddd-7827c3c1cf69@cs.tcd.ie> Subject: Re: [Add] What to do in this potential working group References: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> <8f856492-f5da-9a02-f76d-67c2795b2ecc@cs.tcd.ie> <4505d6b8-0521-dd2f-245d-8fa73e2313c3@cs.tcd.ie> <2e44b80b-2264-b6b5-9062-6b05f627925c@it.aoyama.ac.jp> In-Reply-To: <2e44b80b-2264-b6b5-9062-6b05f627925c@it.aoyama.ac.jp> --tMvlqEZODjHpONI7KOA5ieXPovSLFOAHN Content-Type: multipart/mixed; boundary="------------4961FC6756F2D6AA88C42679" Content-Language: en-GB This is a multi-part message in MIME format. --------------4961FC6756F2D6AA88C42679 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On 22/08/2019 10:51, Martin J. D=C3=BCrst wrote: > If you want to say "about 1" or "about 100", then ~1 or ~100 or so may = > be appropriate. I was indeed guilty of misusing big-O notation and yes the above was what I meant. Thanks, S. --------------4961FC6756F2D6AA88C42679 Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------4961FC6756F2D6AA88C42679-- --tMvlqEZODjHpONI7KOA5ieXPovSLFOAHN-- --5QiIplgL953sU81lK4W0MuyBViXoL1m09 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAl1eaDgACgkQWrL68XsX K+pyBBAAsCiRIeSzlMLevYMgPZzXB5phyD0ZFoAjTu7LI2N0Fgi7A6o56XuOhmVi 0Agm14yne6hyJ7/I/pZ88KhcrnUDXtTDRcCrVLJpfRDeGOleHv+gjiUqg56gJ5iB 2YtfK5f6aEVG5Hbb51cnKX+rp+IGU8/tJqxs9PVVrAcs4nmZrrQGYIGTyFpjvIHZ mnjAocbbGrVx4SL1knbht3AFT0lnpbH/mrWGnrXxvRHgXwgwUMrlOa7NepL7UL0U 2EPbQjQUqO4SdDjKnjh2JwL8N/B/b7ltW6+Ox65mc+KRkjw1PmCKlKqAL3cJBHXO hKcyMimcQqMpkOfcLqWAbLuOFCmnKnCf9DRolaCK57ocTdyDwdejbthPYS9+KPlQ eeiSqaQYzryrrOWbauPHmn48snHAxAtXbrGb0AlvRiepn1fCNl7URzZocOZYRapj omeVItm1NG84N7UEZvVdbIRzEFpB3WgFjpDJ7tWHk9EHJcw8cx2thd2cP91UFQx3 y5GQQWhTLuD0hZ1Dj6+Vb3DrpKQFERguVqi1YraLfqefu3FCA78v/H5dRg4HtlJC 2bCa4oxdGdidgJozlFCBOiW3jiQ41buEQ6fDOohZOBvNFzGlfTElF1Eo8tW6+Qw3 Xy/W91P/W7pWbqtmt6+vpjlZs1ewcHioYmxQM14iOUvj3OUqc5A= =Xr51 -----END PGP SIGNATURE----- --5QiIplgL953sU81lK4W0MuyBViXoL1m09-- From nobody Thu Aug 22 03:13:16 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 03E86120815 for ; Thu, 22 Aug 2019 03:13:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.299 X-Spam-Level: X-Spam-Status: No, score=-4.299 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=open-xchange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id n155tbcirh4i for ; Thu, 22 Aug 2019 03:13:13 -0700 (PDT) Received: from mx4.open-xchange.com (alcatraz.open-xchange.com [87.191.39.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7A4AE1200B2 for ; Thu, 22 Aug 2019 03:13:13 -0700 (PDT) Received: from open-xchange.com (imap.open-xchange.com [10.20.30.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx4.open-xchange.com (Postfix) with ESMTPS id 90D8E6A363; Thu, 22 Aug 2019 12:13:10 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=open-xchange.com; s=201705; t=1566468790; bh=6iQcYUjOMXSTy1rwFa5rH9KIhoFlZv5Vuj0k+lcNEsI=; h=Date:From:Reply-To:To:Cc:In-Reply-To:References:Subject:From; b=zkzkykRZAMNeSCZqLpTi8vjr8uM4tPkCYucQpbzjfiPeN8wKOGrYPWsCPyilpUX9a d5T87R9xlXfqVNgpq6lx0DeX2qmDr09GcyEN5chWoi1sRvvGgtYhjUSbQg6D9qwsup MBBpJhNfJraRLEjHUQeoAAxnLjCQSbzDZcwv7wMt8KdVFC8fcMugzX+ozbHb+JHxQK +BEW6zLKpDEr0Sc3RlAqGLXJIemUo0GMSxt1gMo7dCWsOp8Og1Vh/86JnPGlOk1zgp kaKLXdMtU/5bXFs5rLi4a1cMjM7UkFOBY+Cbu/SyZiWqk+VzCA8DvbT/g6QOje2wn2 QBvhDehp8VrVA== Received: from appsuite-gw1.open-xchange.com (appsuite-gw1.open-xchange.com [10.20.28.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by open-xchange.com (Postfix) with ESMTPSA id 84B833C0434; Thu, 22 Aug 2019 12:13:10 +0200 (CEST) Date: Thu, 22 Aug 2019 12:13:10 +0200 (CEST) From: Vittorio Bertola Reply-To: Vittorio Bertola To: Ted Hardie Cc: ADD Mailing list Message-ID: <1684913634.340.1566468790495@appsuite-gw1.open-xchange.com> In-Reply-To: References: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Priority: 3 Importance: Medium X-Mailer: Open-Xchange Mailer v7.10.2-Rev11 X-Originating-Client: open-xchange-appsuite Autocrypt: addr=vittorio.bertola@open-xchange.com; prefer-encrypt=mutual; keydata= mQENBFhFR+UBCACfoywFKBRfzasiiR9/6dwY36eLePXcdScumDMR8qoXvRS55QYDjp5bs+yMq41qWV9 xp/cqryY9jnvHbeF3TsE5yEazpD1dleRbkpElUBpPwXqkrSP8uXO9KkS9KoX6gdml6M4L+F82WpqYC1 uTzOE6HPmhmQ4cGSgoia2jolxAhRpzoYN99/BwpvoZeTSLP5K6yPlMPYkMev/uZlAkMMhelli9IN6yA yxcC0AeHSnOAcNKUr13yXyMlTyi1cdMJ4sk88zIbefxwg3PAtYjkz3wgvP96cNVwAgSt4+j/ZuVaENP pgVuM512m051j9SlspWDHtzrci5pBKKFsibnTelrABEBAAG0NUJlcnRvbGEsIFZpdHRvcmlvIDx2aXR 0b3Jpby5iZXJ0b2xhQG9wZW4teGNoYW5nZS5jb20+iQFABBMBAgAqBAsJCAcGFQoJCAsCBRYCAwEAAp 4BAhsDBYkSzAMABQMAAAAABYJYRUflAAoJEIU2cHmzj8qNaG0H/ROY+suCP86hoN+9RIV66Ej8b3sb8 UgwFJOJMupZfeb9yTIJwE4VQT5lTt146CcJJ5jvxD6FZn1Htw9y4/45pPAF7xLE066jg3OqRvzeWRZ3 IDUfJJIiM5YGk1xWxDqppSwhnKcMOuI72iioWxX0nGQrWxpnWJsjt08IEEwuYucDkul1PHsrLJbTd58 fiMKLVwag+IE1SPHOwkPF6arZQZIfB5ThtOZV+36Jn8Hok9XfeXWBVyPkiWCQYVX39QsIbr0JNR9kQy 4g2ZFexOcTe8Jo12jPRL7V8OqStdDes3cje9lWFLnX05nrfLuE0l0JKWEg8akN+McFXc+oV68h7nu5A Q0EWEVH5QEIAIDKanNBe1uRfk8AjLirflZO291VNkOAeUu+dIhecGnZeQW6htlDinlYOnXhtsY1mK9W PUu+xshDq7lXn2G0LxldYwyJYZaJtDgIKqVqwxfA34Lj27oqPuXwcvGhdCgt0SW/YcalRdAi0/AzUCu 5GSaj2kaGUSnBYYUP4szGJXjaK2psP5toQSCtx2pfSXQ6MaqPK9Zzy+D5xc6VWQRp/iRImodAcPf8fg JJvRyJ8Jla3lKWyvBBzJDg6MOf6Fts78bJSt23X0uPp93g7GgbYkuRMnFI4RGoTVkxjD/HBEJ0CNg22 hoHJondhmKnZVrHEluFuSnW0wBEIYomcPSPB+cAEQEAAYkBMQQYAQIAGwUCWEVH5QIbDAQLCQgHBhUK CQgLAgUJEswDAAAKCRCFNnB5s4/KjdO8B/wNpvWtOpLdotR/Xh4fu08Fd63nnNfbIGIETWsVi0Sbr8i E5duuGaaWIcMmUvgKe/BM0Fpj9X01Zjm90uoPrlVVuQWrf+vFlbalUYVZr51gl5UyUFHk+iAZCAA0WB rsmACKvuV1P7GuiX3UV9b59T9taYJxN3dNFuftrEuvsqHimFtlekUjUwoCekTJdncFusBhwz2OrKhHr WWrEsXkfh0+pURWYAlKlTxvXuI7gAfHEQM+6OnrWvXYtlhd0M1sBPnCjbyG63Qws7Rek9bEWKtH6dA6 dmT2FQT+g1S9Mdf0WkPTQNX0x24dm8IoHuD3KYwX7Svx43Xa17aZnXqUjtj1 Archived-At: Subject: Re: [Add] What to do in this potential working group X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 22 Aug 2019 10:13:15 -0000 > Il 21 agosto 2019 20:11 Ted Hardie ha scritto: > > I tried to finesse that saying by saying it is up to the client > to decide this. If there is an objective reality to "trustyworthy > answer", though, I think "true to the data supplied by the zone > maintainer" may still be it. I'm not sure there is, though, if > you have any belief in the use of the DNS as a control surface. > In the case of household using a DNS filtering service, the > answer may be that the "trustyworthy" resolver provides the data > supplied by the zone maintainer after the application of the > filters to which the subscriber has agreed. This was actually the subject of a thought exercise that I presented at ICANN's DNSSEC workshop in Kobe in March ( https://static.ptbl.co/static/attachments/200613/1552292990.pdf?1552292990 ). IMHO, possibly we have to change (or we already changed, in many people's minds) our understanding of the DNS from a "dumb" global distributed database to a "smart" application-layer traffic control system for the Internet, which indeed will direct you to different resources depending on who and where you are and on a number of policy and technical considerations. In this scenario, trust derives from the resolver you use, and not directly from the ICANN root. If we got rid of the idea that there is just one correct answer for each given query - something that has ceased to be true for quite a while anyway - we could collectively optimize the DNS for the actual current scenario, which also includes the use of the DNS as a control surface and as a content distribution management system. -- Vittorio Bertola | Head of Policy & Innovation, Open-Xchange vittorio.bertola@open-xchange.com Office @ Via Treviso 12, 10144 Torino, Italy From nobody Thu Aug 22 03:27:37 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 15EAB120816 for ; Thu, 22 Aug 2019 03:27:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id W0qOIW9asXpJ for ; Thu, 22 Aug 2019 03:27:33 -0700 (PDT) Received: from mail-lf1-x12f.google.com (mail-lf1-x12f.google.com [IPv6:2a00:1450:4864:20::12f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 45901120815 for ; Thu, 22 Aug 2019 03:27:33 -0700 (PDT) Received: by mail-lf1-x12f.google.com with SMTP id c9so4147448lfh.4 for ; Thu, 22 Aug 2019 03:27:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=jfCvgdwnvTBi4iy2ezw5Gja9G2w38qOX9nYMvcXlEgo=; b=bticJcYfevmidfzBPQovWGcD/KaD8rJlHdmL9Bw+7FePVcsULo3q/EFpvK36st9WWF n+uEyAhk6VEQq30MMtg30pP2RIyGrNH+RaA4XtLEd3Wth9bcbhpIQDU2zLGcDlUM+7zT 9lalUWltzWydUcjwmJpgAhWqRJWQVlFvHgv8GsaHfPjyN/5Yq691Tpg/Pl1YrP86Bgn9 V9vMD/eZpVoIqK3JkJLCHe7Vu2aUpl4k44X6WRf/4MeSNYR4YHcO+wuz+0eW+PyvmcHh 6CYqIXZX/I9GdXIHN4+CG4SqWhTn1ETddKe1+zMC/XF3QUKw/1pT+s2KQqoeifHJRXUQ ZXcw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=jfCvgdwnvTBi4iy2ezw5Gja9G2w38qOX9nYMvcXlEgo=; b=MaxJrfA51hIhZlF14mU6IeRGaqMXGeRtTwuRE8MI1zM5iZzy3LPKrlGDqAQ0u+Q+lO O3ukczoOkZgG59I2aE272k9FodGoIzspZTHSUz+wR2m4G1qBlv0TIouy0WXFe2nayfMj 0o1AJQ5zt612WuFTDCarJbtOspnF6Lp63SkmHwtr3A8LtGtE+24AxpQr2oRCs0QW6N81 7AuULL31VFw2OjnoHL6nkb/mEqdvwZnJkQaSUyVHr9c5IfeemYADdhpFyPEg2rA/viCJ 8tD+xVYLSrTmdsZzR2AepBHBZRcXdGKehJMHE0kpPxtC73MpznRG0s8F6xs7igLuxgA3 4eXQ== X-Gm-Message-State: APjAAAUS1HEZ0fGdms0j+JWoWV56tSwGmY6Mc4SNBfVjP6Dmv4L2p0tz 5byz+KzghUNPuPpK2dYDO7/bUgEHq33TKpoh3xciSA== X-Google-Smtp-Source: APXvYqxWQEQQjBghhzITJwii6L60mP4EDN+uKWk11MykzZMOGRpgxDxbQMWpxR3sw2/g7+6V7ZJjYhxWgjj2b+AtRHw= X-Received: by 2002:ac2:51a3:: with SMTP id f3mr20365245lfk.94.1566469651492; Thu, 22 Aug 2019 03:27:31 -0700 (PDT) MIME-Version: 1.0 References: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> <279abf8c-198b-5da8-1cb9-4f86bf1f37c7@nostrum.com> <87C8E6E6-2DEE-4637-9C86-65B27615611C@piuha.net> In-Reply-To: <87C8E6E6-2DEE-4637-9C86-65B27615611C@piuha.net> From: Eric Rescorla Date: Thu, 22 Aug 2019 11:26:54 +0100 Message-ID: To: Jari Arkko Cc: Daniel Stenberg , ADD Mailing list , Adam Roach Content-Type: multipart/alternative; boundary="0000000000002115430590b223b2" Archived-At: Subject: Re: [Add] What to do in this potential working group X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 22 Aug 2019 10:27:35 -0000 --0000000000002115430590b223b2 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Thu, Aug 22, 2019 at 8:57 AM Jari Arkko wrote: > I=E2=80=99m obviously handwaving the solution a bit, but my point is =E2= =80=94 if we want > to make an improvement, then it should be an incumbent on us to do a full > solution. This is not a standard we apply anywhere else in the IETF. Rather we strive for incremental improvement. I certainly agree that your proposal has merit, and if you have a concrete way of going about it, rather than just handwaving about how someone else should do it, let's talk. Shipping my mom=E2=80=99s queries to a single entity /w possible risk of > surveillance and other leaks is a recipe for insufficient design, I agree that there is a risk, but given that we know that the current design *also* has a high risk of surveillance and other leaks, and that in fact those sorts of things regularly occur, this doesn't seem to me to be anywhere near as strong an argument as you seem to think it is. > IMHO. If we want an improvement, sell me a solution that I actually want, > one that does improve my privacy and resilience against filtering. > Our view is that TRR will do so. You obviously have a different opinion, and as Adam said, at least in Firefox, you will be able to make that choice for yourself. -Ekr > Jari > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --0000000000002115430590b223b2 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Thu, Aug 22, 2019 at 8:57 AM Jari = Arkko <jari.arkko@piuha.net&= gt; wrote:
I=E2= =80=99m obviously handwaving the solution a bit, but my point is =E2=80=94 = if we want to make an improvement, then it should be an incumbent on us to = do a full solution.

This is not a standard= we apply anywhere else in the IETF. Rather we strive for incremental impro= vement. I certainly agree that your proposal has merit, and if you have a c= oncrete way of going about it, rather than just handwaving about how someon= e else should do it, let's talk.


Shipping my mom=E2=80= =99s queries to a single entity /w possible risk of surveillance and other = leaks is a recipe for insufficient design,

= I agree that there is a risk, but given that we know that the current desig= n *also* has a high risk of surveillance and other leaks, and that in fact = those sorts of things regularly occur, this doesn't seem to me to be an= ywhere near as strong an argument as you seem to think it is.

=C2=A0
IMHO. If we want an improvement, sell me a solution that I actually wa= nt, one that does improve my privacy and resilience against filtering.
<= /blockquote>

Our view is that TRR will do so. You obviou= sly have a different opinion, and as Adam said, at least in Firefox, you wi= ll be able to make that choice for yourself.

-= Ekr




Jari

--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--0000000000002115430590b223b2-- From nobody Thu Aug 22 04:12:18 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0B142120832 for ; Thu, 22 Aug 2019 04:12:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vdSdduxoXdgq for ; Thu, 22 Aug 2019 04:12:14 -0700 (PDT) Received: from smtp.guxx.net (nyx.guxx.net [85.10.208.173]) by ietfa.amsl.com (Postfix) with ESMTP id 6D97D120837 for ; Thu, 22 Aug 2019 04:12:13 -0700 (PDT) Received: by nyx.guxx.net (Postfix, from userid 107) id D06115F42CA1; Thu, 22 Aug 2019 13:12:12 +0200 (CEST) Received: from [192.168.2.190] (p54B8ABDF.dip0.t-ipconnect.de [84.184.171.223]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by nyx.guxx.net (Postfix) with ESMTPSA id 028D25F42377; Thu, 22 Aug 2019 13:12:11 +0200 (CEST) From: "Ralf Weber" To: "Eric Rescorla" Cc: "Ray Bellis" , "ADD Mailing list" Date: Thu, 22 Aug 2019 13:12:11 +0200 X-Mailer: MailMate (1.12.5r5635) Message-ID: <7893F89E-ACB5-42EF-B8B6-5CF460FA5D0E@fl1ger.de> In-Reply-To: References: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [Add] What to do in this potential working group X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 22 Aug 2019 11:12:17 -0000 Moin! On 21 Aug 2019, at 19:01, Eric Rescorla wrote: > Indeed: this is what I was referring to when I said "ways to minimize > centralization". Specifically, ISPs could commit to strong privacy policies > and join our TRR program. A lot of ISPs have way stronger privacy policies then the TRR program, yet they can not join because it’s impossible to fulfil the other requirements and IMHO bad decsisions in the TRR program what to require and what not: - No DNSSEC - But qname minimisation that breaks stuff and for larger resolvers adds not much - Requirement to publish block lists So long -Ralf --- Ralf Weber From nobody Thu Aug 22 04:28:37 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4C98A1200FD for ; Thu, 22 Aug 2019 04:28:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QK7Ia1vuJA3o for ; Thu, 22 Aug 2019 04:28:35 -0700 (PDT) Received: from smtp.guxx.net (nyx.guxx.net [85.10.208.173]) by ietfa.amsl.com (Postfix) with ESMTP id D8A7F120026 for ; Thu, 22 Aug 2019 04:28:34 -0700 (PDT) Received: by nyx.guxx.net (Postfix, from userid 107) id C90085F42A11; Thu, 22 Aug 2019 13:28:33 +0200 (CEST) Received: from [192.168.2.190] (p54B8ABDF.dip0.t-ipconnect.de [84.184.171.223]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by nyx.guxx.net (Postfix) with ESMTPSA id 3FDB65F41172; Thu, 22 Aug 2019 13:28:32 +0200 (CEST) From: "Ralf Weber" To: "Rob Sayre" Cc: "David Conrad" , "Jim Reid" , "ADD Mailing list" , "Stephen Farrell" Date: Thu, 22 Aug 2019 13:28:31 +0200 X-Mailer: MailMate (1.12.5r5635) Message-ID: In-Reply-To: References: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> <59E0EC53-0E30-431C-8376-52C7BFC121A8@virtualized.org> <589DAFCB-1BDC-4156-A2CA-179C4559A6B2@virtualized.org> <683A176C-3CE6-4866-A736-F2A7465FA5B5@rfc1035.com> MIME-Version: 1.0 Content-Type: text/plain; format=flowed Archived-At: Subject: Re: [Add] data integrity and DNSSEC or DoH/DoT X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 22 Aug 2019 11:28:37 -0000 Moin! On 22 Aug 2019, at 0:18, Rob Sayre wrote: > On Wed, Aug 21, 2019 at 3:15 PM David Conrad > wrote: > >> My response to Ted that caused me to get sucked into this particular >> swamp >> (something I already regret) >> > > Is that the swamp where the only significant DNSSEC providers are > Google > and Cloudflare? I assume you are talking about validating recursive resolvers here. There are way more, e.g Comcast, all the swedish ISP, a couple of ISPs in South America and I know that there are more European ISPs that are planning to turn it on. Plus even without validation in the recursive resolver you could have validation on your end device if you want. So long -Ralf --- Ralf Weber From nobody Thu Aug 22 04:59:26 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B3B8D120820 for ; Thu, 22 Aug 2019 04:59:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9N8mBiLP7ex5 for ; Thu, 22 Aug 2019 04:59:22 -0700 (PDT) Received: from bizet.nethelp.no (bizet.nethelp.no [195.1.209.33]) by ietfa.amsl.com (Postfix) with ESMTP id 9BEE9120072 for ; Thu, 22 Aug 2019 04:59:22 -0700 (PDT) Received: from localhost (bizet.nethelp.no [IPv6:2001:8c0:9e04:500::1]) by bizet.nethelp.no (Postfix) with ESMTP id 3CA9AE6079; Thu, 22 Aug 2019 13:59:20 +0200 (CEST) Date: Thu, 22 Aug 2019 13:59:20 +0200 (CEST) Message-Id: <20190822.135920.06419090.sthaug@nethelp.no> To: alec.muffett@gmail.com Cc: add@ietf.org From: sthaug@nethelp.no In-Reply-To: References: <20190822.082753.251801273.sthaug@nethelp.no> X-Mailer: Mew version 6.7 on Emacs 26 / Mule 6.0 (HANACHIRUSATO) Mime-Version: 1.0 Content-Type: Text/Plain; charset=us-ascii Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [Add] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 22 Aug 2019 11:59:25 -0000 > My experience of realpolitik is that in most "western" countries, such > blocks are essentially meant to symbolically express that the state has > "done something" to address access to [whatever]. I agree with this view, at least partly. However, > They are only symbolic because (as we all understand) such blocks are > trivially circumvented via increasingly popular technologies such as VPNs > and Tor; and we all fear the blocks becoming more concrete, eg: by > implementation of a "Great Fjordwall of Norway" filtering all traffic > between Norway and the rest of the world. > > I don't fear the cited "require ISPs to implement blocking by other > methods" - but then I am not an ISP. The fact that I agree to at least part of your view here is totally irrelevant for my employer. My employer has been served with a court order, and it would be extremely difficult to convince my employer that such a court order should *not* be followed - especially since this concerns rather blatant copyright violations. > Instead, I am someone who spends a *lot* of time[1][2][3] explaining to > politicians why their various blocks and restrictions won't work. I'm happy to hear that some people are trying to convince politicians about this. Steinar Haug, AS2116 From nobody Thu Aug 22 05:08:01 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5745412083A for ; Thu, 22 Aug 2019 05:08:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.999 X-Spam-Level: X-Spam-Status: No, score=-6.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nlnetlabs.nl Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eOEkHKfes5dp for ; Thu, 22 Aug 2019 05:07:58 -0700 (PDT) Received: from dicht.nlnetlabs.nl (dicht.nlnetlabs.nl [IPv6:2a04:b900::1:0:0:10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5595A120820 for ; Thu, 22 Aug 2019 05:07:58 -0700 (PDT) Received: from [IPv6:2a04:b900:0:1:a1f3:df44:eb14:5b20] (unknown [IPv6:2a04:b900:0:1:a1f3:df44:eb14:5b20]) by dicht.nlnetlabs.nl (Postfix) with ESMTPSA id 8934F2793E for ; Thu, 22 Aug 2019 14:07:55 +0200 (CEST) Authentication-Results: dicht.nlnetlabs.nl; dmarc=pass (p=none dis=none) header.from=nlnetlabs.nl Authentication-Results: dicht.nlnetlabs.nl; spf=pass smtp.mailfrom=willem@nlnetlabs.nl DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=nlnetlabs.nl; s=default; t=1566475675; bh=gRTVbX6Xnn03q9bhSun0sBZTBCY1vODqnZw7Ipptb6U=; h=To:References:From:Subject:Date:In-Reply-To; b=bgcku4zol+5+TeUfcU8/mhbmf6IxNX1Glk0+UGF3CXKxMp2ibLky0kd1ro6X737z/ v18FWPFey2sRwxl2FewdPwizcArRUdAvlE9+vVGPNOkqSCvIergu13Zo/odcgSJ29D IWDJuRR21VOHowcQYjNk6TcVDE+7YDrln8RSvTPg= To: add@ietf.org References: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> <59E0EC53-0E30-431C-8376-52C7BFC121A8@virtualized.org> <589DAFCB-1BDC-4156-A2CA-179C4559A6B2@virtualized.org> <683A176C-3CE6-4866-A736-F2A7465FA5B5@rfc1035.com> From: Willem Toorop Openpgp: preference=signencrypt Autocrypt: addr=willem@nlnetlabs.nl; prefer-encrypt=mutual; keydata= mQINBE1s81EBEACuJzGgccrmYEAzHc//vBq66gH7orM0GtKfQZHh4uR1FMxZXl07WevUYNuB ywTpinU9rpY1Q3S4w6QgNklgpsaHXmbOpyFjJ8FpllV8TRPiXiNrNxTpMnlb6InoszopX69t kBVHTP6cJkNgPx6R4BM0ARqEGQmOL8mAcoWyGVzbsamuGRaia54zs/kc3i9yiqEzRkoQmfwr 7sr49n7gOpmaqXvonOSiUvgEziep77emMcqVa/qZxR1r7KUq85qTNTqsQwl2cQdKS7WwOeuG 6ZIJmJ1bakriKzLBYF5xIHKSYJW0ZA20tNFrVKgTkEjiXvAJh4HlJEIi35tqa/IzWUJSc1ai nhBjxbwSl8BRq5aaPgwB+xXiDqY6BrQW1slvl5TF2A6Xr7JJ0rkH3EZgXxABAZ3WJ3RLwq1z 8jnNYj+UW/mSLsbOtgfOiBhFUXMZneHvVVvz6F6XAtyrejDl5sD2gnzm1VDfK6T6bvLtR7zr kWre0lpycDmgmUKgaEiXzfLvwT9RaWk8GdqU2GG+QOiwf+hT0peDieuodjMr59sUbx7GqVe/ 45rJBRSx+HCl2Jm7Th2Xr0kpStCd7ebVoEq9wpMyu+dM9wOTtibA9P3+9u4rAdimpAdQxEbh WbRNCng2EVhThbqRK3cTZLbtqKaWgAJqa/IQVpL9b5ps8Z4JVQARAQABtCNXaWxsZW0gVG9v cm9wIDx3aWxsZW1AbmxuZXRsYWJzLm5sPokCPgQTAQIAKAIbIwYLCQgHAwIGFQgCCQoLBBYC AwECHgECF4AFAlbUE5oFCRDr7kkACgkQ5fj4IS93pJiGfA/8C1+/M+EaQItVzQ/iPCbagBTq WOSispMzJne9gmimJzPs+lxgnrXOuYlIBywHpWB2Jmz45h+Cc4+di48WQfV9tHENn9MVFkwK zSdcY6v5eot6xSY5FRHS226MPR9UJ8/z5PvlizZUVbbM+Ngxg3Rx045Q0FnQm0o5VasEJ1Po R3CSiELJoZ13ukTk5pQlKyVknUKH1E1ds+Xtg1jpZBqiLiBzcLkKWYqBvrXI6XAEPr+woRgj 3xV8P24Uj232uK7xoe82jWIeZWXt/AbHBSmNOWPIgMd9i3FjdeTDml5sZSy3BlDYMr8hINen hYLhdLpJnXwPcsaj0ivcV+xSjLtSh0mE4gudcVhk5XR1M6emSlATC6+Bqn0M9JNTn4SHhkNS yo87aPwKqWFDlvjAZlRyPym9miJBlzech2uOlYSk6GFuead7MpGAipf5PwNNRKDMDi3y+H47 YG2izbrqj3cOZdqZmErwrzCU8xVkxzY/EY6w/MNMFNeqmXVGxzIZ8y9KAjH6JO96M/AxS4mX HJh1ocfHtSm90Ahy/HPJK+2+5+IgkAymKsvyIbvjs7FccMUo+OiSPWYi+xO/NXA4pBlUuGmV 55Kog7ym1flzo8OD9uHfLPrVORBHgnsITbzf9vgJ0emy8fxMCkzFT334gC1OVhD1ff1frbPX yVbcGI8AO+q5Ag0ETWzzUQEQAKTs4hWz94K66PtsHj/cBtHmJCJx9BsHP8eoUjd4iBR7cWgT Tgt1PGCNBzCPGIuUia808dqxu1L8OWjQpwXDCjXqAibn0mCJMRONVszxJKkjYnZGKGOo8cg7 OmQBZyEd6qrfxVf/dwHLsdQTJZzz9bGOxuYVAAu0q3PHW5gGFc+pp3eN47qzGMxEjsoETj/c laxjqisohG13/hkP6PvDoD7OOdOGdQQP8b4GRBD6rZ/FqMLv4C80zDnzCH1rLpNGQplf1any 06WTAsDL4f6gEALH62TIxOX4U7WxeuvHxyKXOAuN+ex/MvF2az124YbcWC7t1dqVW3ys20zK aememyXSKxV6aMn4KBcJF3CdM1oABZDyviL9el7Q/yQylpZC6El4QowaPIOAuzOdIc6cuM6P TWvBArcKVgQhWfJshfeFmfkxpz/hWc9K40yCjmb+hPZIr3RbXSsQItUUkBqOSMHNroIgX+Ia WMq3e7yMHdMqlKr0lU52lfBbfECjleB/NO4K3SGJBPzTgLtze+LsWxSJQoQMWKv6ISwQrW3r smUjqgQNrSGROX3rRy8Nvuzravs4a3FmdUpHIWw2KfY2M6AsX9HBFuRsimgqFjQm5VbqXA7N tHJCnA1RvqXlg/iJ5w+DElHosxwjHS+UbejDGmVQ+ITqlh3991osPjZq1Iy1ABEBAAGJAiUE GAECAA8CGwwFAlbUE5oFCRDr7kkACgkQ5fj4IS93pJjBwxAAnko5CSFDX/ZqW97satNacACH SAOOM8/jz1p2QtJSwbrbLsJRMpN1mSnjXWPBTmXoP4SGHGtxTVZxrYCpSMEHMqOV4yK3QlUn QXnf+CSvo2Ud3rpCh/lFLVHqG2Sy5Ietf/T+GGsoPd9DIdTHO0aFlW2yRQPxSrbYpv1v2aAC gRO4114qkex2j36diqlLod/OU4OQ51nuSesjTrUM9Fz6ikBJ1UDjakjAXe/HiRxUmdv4LANC mso+Gn17Co5lUdpn3fa8zTwNNAgLm6RBiBSSdaYExM9ir6pHrcWL5N+iZKnVmfE5CBufziZq 7V1E3I4FRuvDN4echbf58c6YxBQDsd9VZMJeFWY60w4JEXpHQdt129GS1FN/2PQ8NmAUXYCk YYk6Lv1tnGJCSLnD3ObLyWm+sjA5yAK2H8WU+nutsDF63yFJujNMpmB3bi9+699TzsyQNVKd 2fH38cgk1gZFb6Nbx9+lrTIwzAJJlOu8UwbR0HgGuRmrWp0EIm3tcy4xqWF3CavnM22BAOKK KH+qnwx8BRrx58coHQFMswW4W7Bo+jpKbQJ4RV2cXUEbmHbYUoXDHZyv/RzOI46dXAoWFc3o CoqLqpsZYZstJ4UJHXB5aHi1zxJDwzKxsflmSKfIUr3glRWCy/ylcPMEXzPBb3qbGFMUboio UjqLuNV4SSY= Message-ID: <3d4b79a2-70a8-68b0-a9d9-c48d6f91a6a2@nlnetlabs.nl> Date: Thu, 22 Aug 2019 14:07:55 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [Add] data integrity and DNSSEC or DoH/DoT X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 22 Aug 2019 12:08:00 -0000 On 22-08-19 13:28, Ralf Weber wrote: > Moin! > > On 22 Aug 2019, at 0:18, Rob Sayre wrote: > >> On Wed, Aug 21, 2019 at 3:15 PM David Conrad wrote: >> >>> My response to Ted that caused me to get sucked into this particular >>> swamp >>> (something I already regret) >>> >> >> Is that the swamp where the only significant DNSSEC providers are Google >> and Cloudflare? > I assume you are talking about validating recursive resolvers here. > There are > way more, e.g Comcast, all the swedish ISP, a couple of ISPs in South > America > and I know that there are more European ISPs that are planning to turn > it on. Yes, on RIPE Atlas 60% of the resolvers now does DNSSEC validation: https://dnsthought.nlnetlabs.nl/#rsasha256 And here is the graph showing the top ASNs of the IPs seen at the authoritative for those DNSSEC validating resolvers: https://dnsthought.nlnetlabs.nl/can_rsasha256/#top_auth_asns Yes, Google & Cloudflare count for 43.7% of validating resolvers, but validation is increasing also without them. One noteworthy party that started DNSSEC validation recently is Deutsche Telekom, see: https://dnsthought.nlnetlabs.nl/auth_AS3320/#rsasha256 Consequently they also stopped NX domain hijacking :) https://dnsthought.nlnetlabs.nl/auth_AS3320/#top_nxhj_asns Perhaps the threat of DoH (and the TRR) alone already stimulates the ISPs to deliver better resolvers? ;) -- Willem > Plus even without validation in the recursive resolver you could have > validation > on your end device if you want. > > So long > -Ralf > --- > Ralf Weber > From nobody Thu Aug 22 05:23:05 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A168C12083F for ; Thu, 22 Aug 2019 05:23:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.002 X-Spam-Level: X-Spam-Status: No, score=-2.002 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sky.uk Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 28LQUOf5oJdz for ; Thu, 22 Aug 2019 05:23:00 -0700 (PDT) Received: from EUR02-AM5-obe.outbound.protection.outlook.com (mail-eopbgr00059.outbound.protection.outlook.com [40.107.0.59]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8367A120820 for ; Thu, 22 Aug 2019 05:23:00 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=QlGhfAVGckDgPS/qhCr31Mngj5BtxhIiWE3PBYzZ/2un/L0rJ5S3c/pGW7zgk6mwyEfTxPt51hGUHanIJq6EN/smyWrNFunUSk5DeuZzuxHL3NOG5psomiCRrVYlNxgkauIDyZ7Jjw720Pj3kcKZgOqLjq1VcnHvOz2U265i+NhM/tXLIi2/1dH68Apq7ZDb6qF8j0RZJcbv2GU6fD1Vp6RvQZqE3xg0QBG46Og31NAoMt4HqeNAfDM6HDsFZbqdgOYrldZ+hXU+dEtkT3A+lSsA3yUm7ioOyqIifZst7xa+CO8SKvcUtD4CvAOjvrq7DHJ9OPQjumWmgG6dTCBlDg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=2xTf+i8oI1bRVqO/bsR4iC1l4/ziVHhGAZ36NKkwyaA=; b=nXTjE/L//CrGVeJVsg3yeswPFUPT+mOh04HP0IUS0RMN/brO5F+NRh4ZhedEQuCW61CZZQlWh/atpkRR0nhb77Yg16QIhiQqXuEB3mLsiI8JyR/5siKLvZMtQyRZWr7Oq/4dvY+uo7zi/6Ss9kOS/y50pzIKwY73aOQKnZmynRxEpSHCiEEIl72ga12BlICJF8VmrOWri8M03tpjjDgA8fQMYywqqTHKlns5sVrLKZ94QM1ZSSbCrSMM/ap/TcJuYB8iLva979f/4k9yszDv9TNHmxXc3AnkiLuZkJOcl/lYJ1IyO/1rE09+eHzxMgG6wx9tE8f2nCH/SNIOcAdRog== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=sky.uk; dmarc=pass action=none header.from=sky.uk; dkim=pass header.d=sky.uk; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sky.uk; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=2xTf+i8oI1bRVqO/bsR4iC1l4/ziVHhGAZ36NKkwyaA=; b=YUPGvCIMxuzN0npKp1q92ynGeWk5iDUGzmVxE0orCTFvWKMng9nk7OKMPqtGJhHxh32tp/5DGnNj1sBiGcV5epNpsjA8S0RFRWfdBQCodR38Up5lSGeB8L8SwyGjHQ1mXiIgjMZ3LcfZapnhNq4+nr5Bl7aUU86cVOikanIYYEI= Received: from DB6PR0601MB2184.eurprd06.prod.outlook.com (10.168.51.153) by DB6PR0601MB2472.eurprd06.prod.outlook.com (10.169.214.9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2178.18; Thu, 22 Aug 2019 12:22:57 +0000 Received: from DB6PR0601MB2184.eurprd06.prod.outlook.com ([fe80::ec90:5874:54dd:a617]) by DB6PR0601MB2184.eurprd06.prod.outlook.com ([fe80::ec90:5874:54dd:a617%9]) with mapi id 15.20.2178.020; Thu, 22 Aug 2019 12:22:57 +0000 From: "Winfield, Alister" To: "add@ietf.org" Thread-Topic: A thought -- Move the policy decisions outside the application. Thread-Index: AQHVWORURTxxj+1200Sc5H0OM/Ik9g== Date: Thu, 22 Aug 2019 12:22:57 +0000 Message-ID: <1444D5E7-DEA7-437C-B12B-6C31FEA563DD@sky.uk> Accept-Language: en-GB, en-US Content-Language: en-GB X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.1c.0.190812 authentication-results: spf=none (sender IP is ) smtp.mailfrom=Alister.Winfield@sky.uk; x-originating-ip: [90.216.150.239] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 0e2570c5-0174-45a0-dc0f-08d726fb7751 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(5600166)(711020)(4605104)(1401327)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(2017052603328)(7193020); SRVR:DB6PR0601MB2472; x-ms-traffictypediagnostic: DB6PR0601MB2472: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-forefront-prvs: 01371B902F x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(4636009)(396003)(376002)(366004)(346002)(39860400002)(136003)(199004)(189003)(486006)(2906002)(6436002)(5640700003)(71190400001)(6486002)(71200400001)(81166006)(1730700003)(8676002)(91956017)(53936002)(2351001)(36756003)(6116002)(58126008)(81156014)(256004)(316002)(99286004)(6512007)(14444005)(3846002)(76116006)(25786009)(186003)(66066001)(476003)(64756008)(5024004)(14454004)(66946007)(5660300002)(66476007)(66446008)(66556008)(478600001)(8936002)(102836004)(2501003)(86362001)(33656002)(26005)(305945005)(6506007)(2616005)(6916009)(7736002); DIR:OUT; SFP:1101; SCL:1; SRVR:DB6PR0601MB2472; H:DB6PR0601MB2184.eurprd06.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:0; MX:1; received-spf: None (protection.outlook.com: sky.uk does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: fimtZpQo3UdreIHou1mmQJTwXYOJcqszm5ESNyRmf0LoBuWrIQgQpmVvNfYYOYGd8CEv010PMZwEV1a6MHolp8XZZID61WD+abxYSk3oxpMfn/l0HgukstqKKavRPbHVdtA26X29o9Jt2fyeJUS6fF9Lz/xB4IFtawUWDilyKZPrnSgY4J/CoCkKhhtPYs3DAPKCtA6m4jEBiBSyVB2zo3nyPR8ZbatAmZhNwtMH1xXa/CG2GWQhrvD5Rf6VF7MT9gHpy8a7ZEUxIh1soAM7IH7zRmkbT1ONgrnPyTOgUjnUI98m/ij+xAoKzchGOfFJ1r5jQLYeIhAHWAV2MEycUSHyF4nw//BvtvWoM1yo74+eH9GpqzC585sSENXjHsJ4AsJn2JfjV+a+Fud4TafqtOZ+27S4ThI2y+LGkxGfdY8= x-ms-exchange-transport-forked: True Content-Type: text/plain; charset="utf-8" Content-ID: <4338988FF112FB40A12285D7599F9552@eurprd06.prod.outlook.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: sky.uk X-MS-Exchange-CrossTenant-Network-Message-Id: 0e2570c5-0174-45a0-dc0f-08d726fb7751 X-MS-Exchange-CrossTenant-originalarrivaltime: 22 Aug 2019 12:22:57.5945 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 68b865d5-cf18-4b2b-82a4-a4eddb9c5237 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: zk2rMfw3l5rZCtNg6NmrKAd8jdLtbb9TQ52SPztNKYWEhMwxTQfopZJAaQbZf2mMwLKDgZQN+SQGGpOykXsY3w== X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB6PR0601MB2472 Archived-At: Subject: [Add] A thought -- Move the policy decisions outside the application. X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 22 Aug 2019 12:23:04 -0000 VGhlIGRpc2N1c3Npb25zIHN1cnJvdW5kaW5nIOKAmXBvbGljeeKAmSBvbiB0aGlzIGxpc3QgYXJl IGxvbmcgYW5kIGRvbid0IGxvb2sgdG8gYmUgdXNlZnVsIG90aGVyIHRoYW4gdG8gaGlnaGxpZ2h0 IGhvdyBoYXJkIHRoZSBwcm9ibGVtcyBhcmUgdG8gc29sdmUuIFdpdGggbm8gZW5kIGluIHNpZ2h0 IEknZCBsaWtlIHRvIHNlZSBpZiBzb21lIG9mIHRoZSBpc3N1ZXMgY2FuIGJlIHNvbHZlZCBieSBh IGRpZmZlcmVudCBtZXRob2QuDQoNCldoYXQgSSBwcm9wb3NlIGlzIHRvIGV4dGVybmFsaXplIHRo ZSBwb2xpY3kgZGVjaXNpb25zLiBUaGF0IGlzIHRha2UgaXQgb3V0c2lkZSB0aGUgY2xpZW50IGFu ZCBpbnRvIHNvbWV0aGluZyAobGlrZWx5IGFuIEFQSSAvIE9TIGRhZW1vbikgdGhhdCBjYW4gZG8g dGhlIEROUyBzZXJ2ZXIgc2VsZWN0aW9uLiBUaGlzIGRvZXNu4oCZdCByZW1vdmUgYWxsIGlzc3Vl cyBhbmQgZG9lc27igJl0IHN0b3AgbWFsaWNpb3VzIC8gbm9uLWNvbXBsaWFudCBhcHBsaWNhdGlv bnMgZnJvbSBkb2luZyB3aGF0IHRoZXkgd2FudCBidXTigKYuDQoNCkl0IGFsbG93cyBhbnkgdmll d3BvaW50IHRvIGJlIHZhbGlkLCBnaXZlbiBpdCBjb3VsZCBlYXNpbHkgYmUgYSBwbHVnZ2FibGUg c29sdXRpb24gdGhhdCBhbGxvd3MgYW55IHBhcnR5IHRvIHByb3ZpZGUgYSBwb2xpY3kgbW9kdWxl Lg0KSXQgYWxsb3dzIGRpYWdub3N0aWMgdG9vbHMgdG8gdXNlIHRoZSBzYW1lIHNldHRpbmdzIGFz IHRoZSBhcHBsaWNhdGlvbnMga25vd2luZyB0aGF0IGZvciB0aGUgbW9zdCBwYXJ0IHRoZSBzYW1l IEROUyBzZXJ2ZXJzIGFuZCB0cmFuc3BvcnRzIGFyZSB1c2VkLg0KSXQgYWxsb3dzIGEgc2luZ2xl IHBvaW50IHRvIGNoYW5nZSBzZXR0aW5ncyBvbiBtb3N0IGFwcGxpY2F0aW9ucyAoY2xlYXJseSBh bnkgYXBwbGljYXRpb24gY2FuIHN0aWxsIGlnbm9yZSB0aGUgc2V0dGluZ3MgYnV0IHRoaXMgb3Vn aHQgdG8gYmUgcmFyZSkNCkl0IGtlZXBzIHRoZSBzZXR0aW5ncyBiZWhpbmQgYWRtaW5pc3RyYXRp dmUgYXV0aG9yaXR5IHRodXMgcHJvdGVjdGluZyB0aGVtIGZyb20gdHJpdmlhbCBhYnVzZSBieSBt YWxpY2lvdXMgYXBwbGljYXRpb25zLg0KVGhlIHBvbGljeSByZXNwb25zZSBjYW4gcHJvdmlkZSBp bmZvcm1hdGlvbiBhYm91dCBzcGxpdCB2aWV3cyB0aHVzIGdpdmluZyBhIG1ldGhvZCB0byBoYW5k bGUgY29ycG9yYXRlIEROUw0KVGhlIHBvbGljeSBtb2R1bGVzIGNhbiB1c2UgYW55IE9TIGF2YWls YWJsZSBpbmZvcm1hdGlvbiwgc29tZSBvZiB3aGljaCBtYXkgYmUgYmxvY2tlZCBmcm9tIGFwcGxp Y2F0aW9ucyBmb3IgYSBnb29kIHJlYXNvbiwgZWcgR1BTLCA4MDIuMXgsIFZQTiBzdGF0ZSBldGMu DQoNCk5vdGUgSSdtIG5vdCB3ZWRkZWQgdG8gYW55IHNwZWNpZmljIG1lY2hhbmlzbSBqdXN0IHRo ZSBjb25jZXB0IG9mIGV4dGVybmFsaXplZCBoYW5kbGluZyBvZiBETlMgc2VydmVyIHBvbGljeSBk ZWNpc2lvbnMuDQoNClNvIGRvZXMgYW55b25lIGVsc2UgaGVyZSBzZWUgdGhpcyBhcyBhIHJlYXNv bmFibGUgbGluZSBvZiB0aGlua2luZyB3b3J0aCBwdXJzdWluZyA/DQoNCi0tDQpBbGlzdGVyIFdp bmZpZWxkDQoNCkluZm9ybWF0aW9uIGluIHRoaXMgZW1haWwgaW5jbHVkaW5nIGFueSBhdHRhY2ht ZW50cyBtYXkgYmUgcHJpdmlsZWdlZCwgY29uZmlkZW50aWFsIGFuZCBpcyBpbnRlbmRlZCBleGNs dXNpdmVseSBmb3IgdGhlIGFkZHJlc3NlZS4gVGhlIHZpZXdzIGV4cHJlc3NlZCBtYXkgbm90IGJl IG9mZmljaWFsIHBvbGljeSwgYnV0IHRoZSBwZXJzb25hbCB2aWV3cyBvZiB0aGUgb3JpZ2luYXRv ci4gSWYgeW91IGhhdmUgcmVjZWl2ZWQgaXQgaW4gZXJyb3IsIHBsZWFzZSBub3RpZnkgdGhlIHNl bmRlciBieSByZXR1cm4gZS1tYWlsIGFuZCBkZWxldGUgaXQgZnJvbSB5b3VyIHN5c3RlbS4gWW91 IHNob3VsZCBub3QgcmVwcm9kdWNlLCBkaXN0cmlidXRlLCBzdG9yZSwgcmV0cmFuc21pdCwgdXNl IG9yIGRpc2Nsb3NlIGl0cyBjb250ZW50cyB0byBhbnlvbmUuIFBsZWFzZSBub3RlIHdlIHJlc2Vy dmUgdGhlIHJpZ2h0IHRvIG1vbml0b3IgYWxsIGUtbWFpbCBjb21tdW5pY2F0aW9uIHRocm91Z2gg b3VyIGludGVybmFsIGFuZCBleHRlcm5hbCBuZXR3b3Jrcy4gU0tZIGFuZCB0aGUgU0tZIG1hcmtz IGFyZSB0cmFkZW1hcmtzIG9mIFNreSBMaW1pdGVkIGFuZCBTa3kgSW50ZXJuYXRpb25hbCBBRyBh bmQgYXJlIHVzZWQgdW5kZXIgbGljZW5jZS4NCg0KU2t5IFVLIExpbWl0ZWQgKFJlZ2lzdHJhdGlv biBOby4gMjkwNjk5MSksIFNreS1Jbi1Ib21lIFNlcnZpY2UgTGltaXRlZCAoUmVnaXN0cmF0aW9u IE5vLiAyMDY3MDc1KSwgU2t5IFN1YnNjcmliZXJzIFNlcnZpY2VzIExpbWl0ZWQgKFJlZ2lzdHJh dGlvbiBOby4gMjM0MDE1MCkgYW5kIFNreSBDUCBMaW1pdGVkIChSZWdpc3RyYXRpb24gTm8uIDk1 MTMyNTkpIGFyZSBkaXJlY3Qgb3IgaW5kaXJlY3Qgc3Vic2lkaWFyaWVzIG9mIFNreSBMaW1pdGVk IChSZWdpc3RyYXRpb24gTm8uIDIyNDc3MzUpLiBBbGwgb2YgdGhlIGNvbXBhbmllcyBtZW50aW9u ZWQgaW4gdGhpcyBwYXJhZ3JhcGggYXJlIGluY29ycG9yYXRlZCBpbiBFbmdsYW5kIGFuZCBXYWxl cyBhbmQgc2hhcmUgdGhlIHNhbWUgcmVnaXN0ZXJlZCBvZmZpY2UgYXQgR3JhbnQgV2F5LCBJc2xl d29ydGgsIE1pZGRsZXNleCBUVzcgNVFEDQo= From nobody Thu Aug 22 05:41:15 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4945912083C for ; Thu, 22 Aug 2019 05:41:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DrIyXqhiUn0l for ; Thu, 22 Aug 2019 05:41:11 -0700 (PDT) Received: from shaun.rfc1035.com (shaun.rfc1035.com [93.186.33.42]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8E10C12001B for ; Thu, 22 Aug 2019 05:41:11 -0700 (PDT) Received: from gromit.rfc1035.com (gromit.rfc1035.com [195.54.233.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by shaun.rfc1035.com (Postfix) with ESMTPSA id F4002242109D; Thu, 22 Aug 2019 12:41:08 +0000 (UTC) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) From: Jim Reid In-Reply-To: Date: Thu, 22 Aug 2019 13:41:07 +0100 Cc: ADD Mailing list Content-Transfer-Encoding: quoted-printable Message-Id: References: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> <59E0EC53-0E30-431C-8376-52C7BFC121A8@virtualized.org> <589DAFCB-1BDC-4156-A2CA-179C4559A6B2@virtualized.org> <683A176C-3CE6-4866-A736-F2A7465FA5B5@rfc1035.com> To: Eric Rescorla X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: Re: [Add] data integrity and DNSSEC or DoH/DoT X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 22 Aug 2019 12:41:13 -0000 > On 22 Aug 2019, at 08:00, Eric Rescorla wrote: >=20 > Suppose that I receive a bogus response to my A record query, how am I = to usefully distinguish "this is malware blocking" from "this resolver = is malicious"? I'm surprised that distinction matters to you. I thought any form of DNS = blocking or filtering was malicious from your PoV. :-) To be slightly less glib, the dnsop WG has an I-D on extended error = codes. [And FWIW lack of a discrete error code(s) for validation failure = is one of the things I think DNSSEC got wrong.] = draft-ietf-dnsop-extended-error already goes some way to answering your = question: 4.16. Extended DNS Error Code 15 - Blocked The resolver attempted to perfom a DNS query but the domain is blacklisted due to a security policy implemented on the server being directly talked to. 4.17. Extended DNS Error Code 16 - Censored The resolver attempted to perfom a DNS query but the domain was blacklisted by a security policy imposed upon the server being talked to. Note that how the imposed policy is applied is irrelevant (in- band DNS somehow, court order, etc). 4.18. Extended DNS Error Code 17 - Prohibited An authoritative or recursive resolver that receives a query from an "unauthorized" client can annotate its REFUSED message with this code. Examples of "unauthorized" clients are recursive queries from IP addresses outside the network, blacklisted IP addresses, local policy, etc. I suppose draft-ietf-dnsop-extended-error could add another error code = for the specific case of a malicious resolver. Whatever that might mean. = Though I doubt the operators of such servers will choose to set that = evil bit on their responses. PS A potential problem with this I-D is these extended error codes = won=E2=80=99t be signed. So they can be spoofed by bad actors.= From nobody Thu Aug 22 06:13:07 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4093C1200FA for ; Thu, 22 Aug 2019 06:13:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WutH4zkdrtqK for ; Thu, 22 Aug 2019 06:13:04 -0700 (PDT) Received: from mail1.bemta25.messagelabs.com (mail1.bemta25.messagelabs.com [195.245.230.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EDE391200F8 for ; Thu, 22 Aug 2019 06:13:03 -0700 (PDT) Received: from [46.226.52.103] (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256 bits)) by server-5.bemta.az-a.eu-west-1.aws.symcld.net id E1/3C-19057-DD49E5D5; Thu, 22 Aug 2019 13:13:01 +0000 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFlrFJsWRWlGSWpSXmKPExsWi75kzT/fulLh Yg3+XVS3+n17H5sDosWTJT6YAxijWzLyk/IoE1oxNC64zF7RIVSyfdZyxgfGGZBcjF4eQwHZG iTsH1rNBOIcZJWb/vsMGl1m8qYsJwrnIKHHu0m8op5dJYsXub8xdjJxAzn1GiX0zwkFsNgF7i UvrXrCC2CICihKNG+8wgtjCAuoS71fshIprSPTMPsQIYRtJ9D16BTaHRUBV4vyJK2BxXoEYiW MTPjJCzN/HKPHxlSCIzSlgLfF1wk2wOYwCshJfGleD9TILiEvcejKfCcSWEBCQWLLnPDOELSr x8vE/VpCjeQUeski0n1oJ1RwlsfNZBxtEkaLEw8s32CFsWYlL87sZIWxfiW+bl7JA2DcZJa68 i4OwtSR+/p8DFZeSOHHxKCuEnS3ROPUQ1Ew1ic9Pr0AdISNx/vllRpAjJAQ2sUn0dD9jgvgsR WLuxm3sExiNZyF5YhYjB5CtKbF+lz5EWFFiSvdD9lngcBGUODnzCcsCRpZVjBZJRZnpGSW5iZ k5uoYGBrqGhka6hpZGukaGhnqJVbqJeqmluuWpxSW6QG55sV5xZW5yTopeXmrJJkZggkkpOHB 5B+OEWW/0DjFKcjApifJOSY2NFeJLyk+pzEgszogvKs1JLT7EKMPBoSTB+3pyXKyQYFFqempF WmYOMNnBpCU4eJREeOeApHmLCxJzizPTIVKnGI05Jrycu4iZ48jcpYuYhVjy8vNSpcR5j00CK hUAKc0ozYMbBEvClxhlpYR5GRkYGIR4ClKLcjNLUOVfMYpzMCoJ8/aBLOTJzCuB2/cK6BQmoF Mqd8SCnFKSiJCSamA6t/lj4N2ju14u5H+1PfJX/IF1u35HvVwqsz6cOeemrnsh19qtYtU24cd eCtsaXggqkZ3045HW7W3JR+5+EJ06K1hN8JN9RHMp652mPuFuu20/kqST2957KX4ws/ZJe3DH /McT4YvFb0rd2W/Z+i0/qPFyLf8C0UUVl6WXhClrW0088PG0MTfTG5umhWefBoYpSRjenHarf /rn5A3+9lN4Kl2fPA5XunCx/u+6pRu05p6aELym3asgRXxW0+s2ZgELsVx3aymzxEdickfZWW fmXA+6tftOwIl/Zz0t7a5xxFaEPdJQ99P7tTNsa3mqzaZmab1zp9Vd9G9M9O6rktDoMXoSHeQ ker6s+HtqrroSS3FGoqEWc1FxIgBpUSX4PQQAAA== X-Env-Sender: Kevin.Smith@vodafone.com X-Msg-Ref: server-30.tower-267.messagelabs.com!1566479578!5779!6 X-Originating-IP: [47.73.108.158] X-SYMC-ESS-Client-Auth: outbound-route-from=pass X-StarScan-Received: X-StarScan-Version: 9.43.9; banners=-,-,- X-VirusChecked: Checked Received: (qmail 14811 invoked from network); 22 Aug 2019 13:13:01 -0000 Received: from vgdpm16vr.vodafone.com (HELO voxe02hw.internal.vodafone.com) (47.73.108.158) by server-30.tower-267.messagelabs.com with AES256-SHA256 encrypted SMTP; 22 Aug 2019 13:13:01 -0000 Received: from VOEXH10W.internal.vodafone.com (47.73.211.214) by edge1.vodafone.com (195.232.244.47) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Thu, 22 Aug 2019 15:12:52 +0200 Received: from voxe02hw.internal.vodafone.com (195.232.244.47) by VOEXH10W.internal.vodafone.com (47.73.211.208) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Thu, 22 Aug 2019 15:12:52 +0200 Received: from VOEXH09W.internal.vodafone.com (47.73.211.213) by edge1.vodafone.com (195.232.244.47) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Thu, 22 Aug 2019 15:12:50 +0200 Received: from EUR03-AM5-obe.outbound.protection.outlook.com (172.17.213.46) by VOEXH09W.internal.vodafone.com (47.73.211.213) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Thu, 22 Aug 2019 15:12:49 +0200 Received: from AM6PR05MB5861.eurprd05.prod.outlook.com (20.179.3.87) by AM6PR05MB6246.eurprd05.prod.outlook.com (20.179.2.219) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2178.18; Thu, 22 Aug 2019 13:12:49 +0000 Received: from AM6PR05MB5861.eurprd05.prod.outlook.com ([fe80::f096:d9cb:634d:57c8]) by AM6PR05MB5861.eurprd05.prod.outlook.com ([fe80::f096:d9cb:634d:57c8%3]) with mapi id 15.20.2178.020; Thu, 22 Aug 2019 13:12:49 +0000 From: "Smith, Kevin, Vodafone Group" To: "add@ietf.org" Thread-Topic: [Add] [Ext] Participation Thread-Index: AQHVWEk+gCf59f1JLE27pttHVtLMP6cHHU4g Date: Thu, 22 Aug 2019 13:12:48 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_0359f705-2ba0-454b-9cfc-6ce5bcaac040_Enabled=True; MSIP_Label_0359f705-2ba0-454b-9cfc-6ce5bcaac040_SiteId=68283f3b-8487-4c86-adb3-a5228f18b893; MSIP_Label_0359f705-2ba0-454b-9cfc-6ce5bcaac040_Owner=Kevin.Smith@vodafone.com; MSIP_Label_0359f705-2ba0-454b-9cfc-6ce5bcaac040_SetDate=2019-08-22T13:12:42.7951054Z; MSIP_Label_0359f705-2ba0-454b-9cfc-6ce5bcaac040_Name=C2 General; MSIP_Label_0359f705-2ba0-454b-9cfc-6ce5bcaac040_Application=Microsoft Azure Information Protection; MSIP_Label_0359f705-2ba0-454b-9cfc-6ce5bcaac040_Extended_MSFT_Method=Automatic; Sensitivity=C2 General x-originating-ip: [47.73.248.122] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 863b3da6-d706-4d47-e75f-08d727026e54 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(5600166)(711020)(4605104)(1401327)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(2017052603328)(7193020); SRVR:AM6PR05MB6246; x-ms-traffictypediagnostic: AM6PR05MB6246: x-ms-exchange-purlcount: 1 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:7691; x-forefront-prvs: 01371B902F x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(4636009)(376002)(39860400002)(136003)(396003)(346002)(366004)(199004)(189003)(13464003)(53754006)(316002)(53546011)(476003)(26005)(86362001)(186003)(76176011)(9686003)(11346002)(55016002)(102836004)(446003)(5640700003)(2351001)(6306002)(81156014)(6506007)(229853002)(71190400001)(8936002)(71200400001)(66066001)(81166006)(6436002)(256004)(7696005)(53936002)(6916009)(8676002)(1730700003)(6246003)(6116002)(66556008)(33656002)(2501003)(14454004)(64756008)(66446008)(66476007)(5660300002)(14444005)(76116006)(25786009)(3846002)(486006)(52536014)(74316002)(7736002)(99286004)(305945005)(2906002)(966005)(66574012)(66946007)(478600001); DIR:OUT; SFP:1101; SCL:1; SRVR:AM6PR05MB6246; H:AM6PR05MB5861.eurprd05.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: vodafone.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: Ey8yIosNLa0SM7LJ+rJAJBT/Aw77Rlz6/a58UUfSTlcfK9j3YXgbGHZE1rEfHAqYis0fbeF/i2sVWgLu+QGotbLyPJ/Abrc3WACFGb/ZgYhnfsc0c9/BIPM0JydyRroREW5w4Z1L8SM9WESgI52gXoS/xTNDwcz7fjeahYC/J6zRmL/L5YC09nUfzd9JfomRd4z3Y6e9iqW5RGbGm05iWRSc+L0TVIdAWrajHVkpU9FRgZtTanCeQr418B3eYf4ZovXUBDolv2x+aad+vjLG3N40g3bR27vFCGIeBGFrapFnKg7y5kjTtqZ9Xuy1fI+LufEtpbecPTRrDZjyNUWX4C4rI1PUxT7CI+bhbMgLXANNQUuyrMPd2eNCdoica0jql7jLf88gvhXd+UOjBJZDqj/UOskclAHGDKFoxIamR7Y= x-ms-exchange-transport-forked: True arc-seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=cAKpjWc+0BFzClMGTalZxijOMq8LzZFYp2ky+funuAm8tRj/45owWzsrn3RkvtKukHdOJSmUcUTMdOdbHcayo7jXTK1/O9tqrNDkyzKwGQIxf3tz4BgLcO2x4sonVCWNSdfp12jCVl2Awz8FOw6HDLfH+r6/IT423UqYOZJ88o5+LKXv0+osrP/t/l2ZG8RpCk8EzAYDUkDDazV2P3XJCaQBRlmjtWVryCy4x5c7PQlgFErvV4vhw+5sZIZxMMeaQ1mT8+OWElNErTmPU8YYBDDwZA0ivHkGnKrzflsAESSzp6AjL0X5vPgwDkfFAs9IkkFXYWuja/8mMvGfQK8wUw== arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=dP39x1wNQyOKD/HMzaq/EDfApQA40oG1WCPeVVwDH0s=; b=EO86s5ouaSzGNhyqDjMDN6R6KD0B9nO1ZSPuqwbye0IvvrzkyjZhz/7nn6+JirVKQIhLmgjejCIYCtGoZ2Kkp/It8ZRkbsYLh5p7TuGV0s1LLMMN6AFtVusy4uH5hVpd7NaCJ8jxlsl2wZ71uClR/piJmWYVS21KiDxRNxEyeX5CGtVspBt9zjZAknscjBS1LAEU5B4/zd95Ysl09RDGCvtgzCBPdjiZGvo1c9UP7/C903ADwlBbEFnwnabJxKcB0oXXGi4U36XcDKLhyLe0pMF1oVDrhGyI8SGoaRmIUmgSRHY22WAV5VlMWBtkfazzh7y/+kcZJT6PQWp3Or78aA== arc-authentication-results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=vodafone.com; dmarc=pass action=none header.from=vodafone.com; dkim=pass header.d=vodafone.com; arc=none x-ms-exchange-crosstenant-network-message-id: 863b3da6-d706-4d47-e75f-08d727026e54 x-ms-exchange-crosstenant-originalarrivaltime: 22 Aug 2019 13:12:48.9221 (UTC) x-ms-exchange-crosstenant-fromentityheader: Hosted x-ms-exchange-crosstenant-id: 68283f3b-8487-4c86-adb3-a5228f18b893 x-ms-exchange-crosstenant-mailboxtype: HOSTED x-ms-exchange-crosstenant-userprincipalname: cf6mf78wAmFHEizhccYnOGBpQtZ+PFX/v7Ad0aKazyewaRt1rJElv5eqQrAiq+8mHF3hMgTQRqHkNIjJSzp5uB+63C41EFVpzO3PZ7ty7X4= x-ms-exchange-transport-crosstenantheadersstamped: AM6PR05MB6246 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: vodafone.com X-CFilter-Loop: Reflected Archived-At: Subject: Re: [Add] [Ext] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 22 Aug 2019 13:13:06 -0000 WW91J3JlIHdlbGNvbWUgLSBJJ3ZlIGFsc28gaGFkIGFuIG9mZi1saXN0IHF1ZXN0aW9uIHJlZ2Fy ZGluZyBVUkwtZmlsdGVyaW5nLCB3aGljaCBJJ20gaGFwcHkgdG8gcG9zdCBoZXJlIHdpdGggcGVy bWlzc2lvbiBvZiB0aGUgcXVlc3Rpb25lcjoNCg0KIkNvdWxkIHlvdSBwbGVhc2UgY2xhcmlmeSBo b3cgaXQgaXMgdGhhdCBWb2RhZm9uZSBkb2VzIHRoZSBVUkwgZmlsdGVyaW5nLCBpZiBub3Qgdmlh IE1JVE0/DQpEbyB5b3UgYmxvY2sgZW50aXJlIGRvbWFpbnMgYmFzZWQgb24gdGhlIGRvbWFpbiBw YXJ0IG9mIFVSTHMsIG9yIHdoYXQgdGVjaG5pcXVlIGRvIHlvdSB1c2U/Ig0KDQpNeSBwZXJzb25h bCB1bmRlcnN0YW5kaW5nIGlzIHRoYXQgbW9zdCBlbnRyaWVzIGluIHRoZSBmaWx0ZXIgbGlzdHMg YXJlIGRvbWFpbnMgd2l0aG91dCBhIFVSTCBwYXRoIGNvbXBvbmVudCwgc28gRE5TIDUzLWJhc2Vk IGZpbHRlcmluZyBpcyBhcHBsaWVkLg0KDQpBbnkgbGlzdCBlbnRyaWVzIHRoYXQgaW5jbHVkZSBh IFVSTCBwYXRoIGNvbXBvbmVudCBhcmUgb25seSBmaWx0ZXJlZCBpZiB0aGUgcGF0aCBpcyB2aXNp YmxlIHRvIHRoZSBuZXR3b3JrOiBpLmUuIG5vdCBpbiB0aGUgY2FzZSBvZiBIVFRQUywgc2luY2Ug dGhlcmUgaXMgbm8gTWl0TS4NCg0KSG9wZSB0aGF0IGhlbHBzLg0KDQpLZXZpbg0KVm9kYWZvbmUg R3JvdXAgUiZEDQoNCg0KDQoNCg0KQzIgR2VuZXJhbA0KDQotLS0tLU9yaWdpbmFsIE1lc3NhZ2Ut LS0tLQ0KRnJvbTogc3RlcGhlbi5mYXJyZWxsQGNzLnRjZC5pZSA8c3RlcGhlbi5mYXJyZWxsQGNz LnRjZC5pZT4NClNlbnQ6IDIxIEF1Z3VzdCAyMDE5IDE4OjUzDQpUbzogcGF1bC5ob2ZmbWFuQGlj YW5uLm9yZw0KQ2M6IGFkZEBpZXRmLm9yZzsgU21pdGgsIEtldmluLCBWb2RhZm9uZSBHcm91cCA8 S2V2aW4uU21pdGhAdm9kYWZvbmUuY29tPg0KU3ViamVjdDogUmU6IFtBZGRdIFtFeHRdIFBhcnRp Y2lwYXRpb24NCg0KDQoNCk9uIFdlZG5lc2RheSwgMjEgQXVndXN0IDIwMTksIFBhdWwgSG9mZm1h biB3cm90ZToNCj4gVGhhbmsgeW91IGZvciB0aGUgdmVyeSBjbGVhciB1cGRhdGUgb24gdGhpcy4N Cg0KKzENCg0KUy4NCg0KPiBUaGUgdG9waWMgd2FzIHN0YXJ0aW5nIHRvIGNhdXNlIGEgbG90IG9m IGNvbmNlcm4gYWNyb3NzIHRoZSBuZXR3b3JrLg0KPg0KPiAtLVBhdWwgSG9mZm1hbg0KPg0KPiBP biBBdWcgMjEsIDIwMTksIGF0IDk6NDkgQU0sIFNtaXRoLCBLZXZpbiwgVm9kYWZvbmUgR3JvdXAg PEtldmluLlNtaXRoQHZvZGFmb25lLmNvbT4gd3JvdGU6DQo+ID4NCj4gPiBIZWxsbyBhbGwsDQo+ ID4NCj4gPiBJJ3ZlIGNvbmZpcm1lZCB3aXRoIFZvZGFmb25lIFVLJ3MgbmV0d29yayBhbmQgaG9t ZSBicm9hZGJhbmQgdGVhbXMgdGhhdCB0aGV5IGRvIG5vdCBwZXJmb3JtIEhUVFBTIGludGVyY2Vw dGlvbi9NYW4gaW4gdGhlIE1pZGRsZS4NCj4gPg0KPiA+IFRoZSBpbWd1ciBpc3N1ZSBpcyB0aGUg cmVzdWx0IG9mIEROUyA1My1iYXNlZCBmaWx0ZXJpbmcuIFRoZSBlcnJvciBhcHBlYXJzIHRoYXQg dGhlIFZvZGFmb25lIHJvb3QgY2VydGlmaWNhdGUgKHVzZWQgdG8gc2VjdXJlIHRoZSB1c2VyJ3Mg Y29uZmlndXJhdGlvbiBjaGFubmVsIHRvIHRoZSBob21lIHJvdXRlcikgd2FzIGFsc28gdXNlZCB3 aGVuIHRoZSByZXF1ZXN0IHdhcyByZWRpcmVjdGVkIHRvIHRoZSBzZWN1cmUgJ3dhcm5pbmcgcGFn ZScgIGF0IHRoZSBuZXR3b3JrIHByb3h5LCBhcHBhcmVudGx5IGNhdXNpbmcgdGhlIGJyb3dzZXIg dG8gcHJvbXB0ICdhZGQgY2VydGlmaWNhdGUgdG8gZXhjZXB0aW9uIGxpc3QnLiBUaGUgaW1ndXIg aXNzdWUgd2FzIGZyb20gSmFudWFyeSwgdGhlIGZpeCBoYXMgYmVlbiByb2xsZWQgb3V0IGFuZCBJ J20gdG9sZCB0aGF0IHRoaXMgY2VydGlmaWNhdGUgZXJyb3Igc2hvdWxkIG5vdCBoYXBwZW4gYW55 bW9yZS4NCj4gPg0KPiA+IFRoZSBOb3JkVlBOIGlzc3VlIGFwcGVhcnMgdG8gYmUgYSB1c2VyIHdp dGggY29udGVudCBjb250cm9scyBlbmFibGVkIGF0IHRoZSByb3V0ZXIsIHdoaWNoIGFzIEkgdW5k ZXJzdGFuZCBpdCBtYXkgYmxvY2sgY2VydGFpbiBWUE5zIGJhc2VkIG9uIEROUyA1My4gSSBzdXNw ZWN0IHRoZXkgd291bGQgc2ltcGx5IGRpc2FibGUgdGhlIGNvbnRlbnQgY29udHJvbHMgdG8gc29s dmUgdGhpcy4NCj4gPg0KPiA+IFNvIHRvIGNvbmZpcm06IG5vIEhUVFBTIGludGVyY2VwdGlvbi9N YW4gaW4gdGhlIE1pZGRsZSBpbiBWb2RhZm9uZSBVSy4NCj4gPg0KPiA+IEFsbCBiZXN0LA0KPiA+ IEtldmluDQo+ID4NCj4gPiBNciBLZXZpbiBTbWl0aA0KPiA+IFZvZGFmb25lIEdyb3VwIFImRA0K PiA+DQo+ID4NCj4gPg0KPiA+IEMyIEdlbmVyYWwNCj4NCj4NCj4gLS0NCj4gQWRkIG1haWxpbmcg bGlzdA0KPiBBZGRAaWV0Zi5vcmcNCj4gaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0 aW5mby9hZGQNCj4NCg== From nobody Thu Aug 22 08:59:02 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BF3E7120978 for ; Thu, 22 Aug 2019 08:59:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GXss2WzGmsnf for ; Thu, 22 Aug 2019 08:58:59 -0700 (PDT) Received: from mx36-out10.antispamcloud.com (mx36-out10.antispamcloud.com [209.126.121.30]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E9953120962 for ; Thu, 22 Aug 2019 08:58:58 -0700 (PDT) Received: from xse5.mail2web.com ([66.113.196.5] helo=xse.mail2web.com) by mx65.antispamcloud.com with esmtp (Exim 4.89) (envelope-from ) id 1i0pUF-0003V3-PY for add@ietf.org; Thu, 22 Aug 2019 17:58:57 +0200 Received: from xsmtp21.mail2web.com (unknown [10.100.68.60]) by xse.mail2web.com (Postfix) with ESMTPS id 46Dq2h1mqgzJbY5 for ; Thu, 22 Aug 2019 08:58:52 -0700 (PDT) Received: from [10.5.2.12] (helo=xmail02.myhosting.com) by xsmtp21.mail2web.com with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.92) (envelope-from ) id 1i0pUC-00052N-3n for add@ietf.org; Thu, 22 Aug 2019 08:58:52 -0700 Received: (qmail 28121 invoked from network); 22 Aug 2019 15:58:51 -0000 Received: from unknown (HELO [IPv6:2607:fb90:b2a5:8c49:2c02:232:b997:17e]) (Authenticated-user:_huitema@huitema.net@[172.58.45.101]) (envelope-sender ) by xmail02.myhosting.com (qmail-ldap-1.03) with ESMTPA for ; 22 Aug 2019 15:58:50 -0000 Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (1.0) From: Christian Huitema X-Mailer: iPhone Mail (16G77) In-Reply-To: <20190822.082753.251801273.sthaug@nethelp.no> Date: Thu, 22 Aug 2019 08:58:49 -0700 Cc: alec.muffett@gmail.com, add@ietf.org Content-Transfer-Encoding: quoted-printable Message-Id: <53DE546C-2E36-4988-80B7-796787A7A3C3@huitema.net> References: <8D42902D-CD20-4A64-8F38-CF96F1A351F1@frobbit.se> <20190821.202457.210468432.sthaug@nethelp.no> <20190822.082753.251801273.sthaug@nethelp.no> To: sthaug@nethelp.no X-Originating-IP: 66.113.196.5 X-Spampanel-Domain: xsmtpout.mail2web.com X-Spampanel-Username: 66.113.196.5/32 Authentication-Results: antispamcloud.com; auth=pass smtp.auth=66.113.196.5/32@xsmtpout.mail2web.com X-Spampanel-Outgoing-Class: ham X-Spampanel-Outgoing-Evidence: Combined (0.07) X-Recommended-Action: accept X-Filter-ID: Mvzo4OR0dZXEDF/gcnlw0ZMJr/TGkEWvNJbVmORegSypSDasLI4SayDByyq9LIhVJFGbJZ1bLrxX VHLj2VfmBkTNWdUk1Ol2OGx3IfrIJKywOmJyM1qr8uRnWBrbSAGDNzOpszOkW3faMySFwG163+fH zJ6mVE7ewsipSVIfs4Yuv2VcMsk37qQ4Ki/4of8+gyWFxOA5dILPypvKxNVhWQwOVcNrdpWfEYrY fLBY3+cqR/Azv01OJhPK4SsoJkVNmdySlZou9qHIGOZDEEo7O2nS6C1mWTD2n8BB0gTSSfCrE2rb Hpkagd3yMuHMqQJIX+gRCHfMVnsAk591zk0uilUI+ZL4xWiN8NS6C+dmX6OEdA4u1aThyWrQ/ou2 +v/lmX4Em37yFgrCB6NHRn1g+f3uncIqYSL3lhh5c81YyJqFoLZMmkWsaurVZfvqROaDnDtHb8z5 dpPkEuJ8SnwqlUrBK2R/GBg9vCpMGFHw53FxnHnL50HZvyS1o3x98IkV0bm2vWdo8usP65i82q1C dZgGrpL44wdx9eXqjQjbvUopOMQJvQ/Ck3iiU+4DQAj3fuQgzT3K9JUHTNiGwfwAm3OZmI6+6AcH EU4XbMnrDarMCwbYZSDsvW0enk+rZHRdWbmrNa47C03H7VMoGk5yVPiUIQAtYj+15Bxq74YRThSa O75ywFmUG/yBLieSBzSQpFEmsSTPkJgGoZ63bgddVhg66gs5OuzYxJgw5atIxeMSWlPquJoiJm+Y dI8PappRY4NhlpOo+XFzBzK20cyXxnLo9hAVhjJiw8mh8cnOjuFLOi2splgqxSuiTSbJeDi5XPWl FdaGOH191uXjgjQN/fm03Pjl8H9TodtJfdqYop3AcWtUZuYY82ZPls/8S8VpNWOfRy3it5pbjqbJ QF61U112fwop9BTafX0DKHjywhGbO+8nMRYL9kekVL4dhx06ifnL+9wgoTj4ygNPw1XfN0zsCG5v xMF5WG1gYscNCfISP4VPJRUjPgTf43t5z5OGMMhkxyAKDRV/o3FuwxpnRHnKFOL2qbwhklIekV0n lts= X-Report-Abuse-To: spam@quarantine9.antispamcloud.com Archived-At: Subject: Re: [Add] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 22 Aug 2019 15:59:01 -0000 =20 > On Aug 21, 2019, at 11:27 PM, sthaug@nethelp.no wrote: >=20 > My personal view (note: IANAL): If only a few customers used such > alternative name-resolution, authorities probably wouldn't care. If > "sufficiently many" customers did this, authorities would probably > take note, and require ISPs to implement blocking by other methods. For the courts ISP are not special, they are just convenient. We already see= plenty of examples of court orders affecting search engines, for example "r= ight to forget" cases. The obvious outcome is not for courts to force ISP to= block TLS. The most likely outcome is that court orders will apply to the q= uad resolvers as well. -- Christian Huitema=20= From nobody Thu Aug 22 09:10:53 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8DADD120A08 for ; Thu, 22 Aug 2019 09:10:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.679 X-Spam-Level: X-Spam-Status: No, score=-1.679 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_INVALID=0.1, DKIM_SIGNED=0.1, T_SPF_HELO_PERMERROR=0.01, T_SPF_PERMERROR=0.01, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=fail (1024-bit key) reason="fail (message has been altered)" header.d=nostrum.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IOuvRGzZPUHN for ; Thu, 22 Aug 2019 09:10:51 -0700 (PDT) Received: from nostrum.com (raven-v6.nostrum.com [IPv6:2001:470:d:1130::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5F5EB120A07 for ; Thu, 22 Aug 2019 09:10:51 -0700 (PDT) Received: from MacBook-Pro.roach.at (99-152-146-228.lightspeed.dllstx.sbcglobal.net [99.152.146.228]) (authenticated bits=0) by nostrum.com (8.15.2/8.15.2) with ESMTPSA id x7MGAkjN048118 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NO); Thu, 22 Aug 2019 11:10:47 -0500 (CDT) (envelope-from adam@nostrum.com) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=nostrum.com; s=default; t=1566490247; bh=vQHy20HHvol80JxAo3FHe3o30XbxFdbzcbTn8O6cRL8=; h=Subject:To:References:From:Date:In-Reply-To; b=KHA3cumVAkPleLsTDIGftzo2c3GTHnz+swQrUFXEDC33xFIeu7b1ZUpc5dXQM1y9E qYSxn82LOdUxzNzuXncuWF4OB2BEnl3GdN0IGcRF5tkSfUhj2ehjv1Ow1b6rWn2+aN xRX+ueW6cVm9HjQakRZE/UEyp/mqDCt1ewdfwFv0= X-Authentication-Warning: raven.nostrum.com: Host 99-152-146-228.lightspeed.dllstx.sbcglobal.net [99.152.146.228] claimed to be MacBook-Pro.roach.at To: "Winfield, Alister" , "add@ietf.org" References: <1444D5E7-DEA7-437C-B12B-6C31FEA563DD@sky.uk> From: Adam Roach Message-ID: <11f9dfe2-ab05-2227-7643-e53da95ec717@nostrum.com> Date: Thu, 22 Aug 2019 11:10:40 -0500 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: <1444D5E7-DEA7-437C-B12B-6C31FEA563DD@sky.uk> Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Content-Language: en-US Archived-At: Subject: Re: [Add] A thought -- Move the policy decisions outside the application. X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 22 Aug 2019 16:10:53 -0000 Top posting because I'm responding to the whole idea rather than any given point in it. At a first pass, half of this is really a call for the system resolver that is provided by the operating system to implement additional options for DNS resolution -- for example, building DoT and DoH into the Windows, OS X, and Linux platforms, and allowing for their configuration. That would be great! The other half is exposing information to applications about the way the OS is resolving names (encrypted vs cleartext, local-network versus public DNS, etc), and the means by which it was configured to do so (e.g., by the network as part of acquiring an address, by centralized enterprise policy, by local configuration override). The applications could then use this information to determine whether there is a policy reason to use the local system-configured resolver; and, if so, do so [1]. It is worth highlighting that this second thing is already implemented in Firefox [2], to the extent that relevant APIs are provided by the operating system today. There are currently two. The first is Microsoft's "Group Policy" API that is provided to allow administrators of enterprise and education networks to push policy to machines on their network. When Group Policy is used to configure Firefox, it uses whatever DoH settings are present in that policy (including honoring a policy decision to disable user configuration of DoH). If a Group Policy is present but does not mention DoH, then DoH will not be automatically offered to the user. The second is the "Parental Controls" feature offered by both Windows and OS X. If Parental Controls are configured for the account running Firefox, it will disable DoH completely, under the assumption that there may be some kind of local DNS filtering going on as part of that feature. With the caveat that I'm not in product management and am simply making an educated guess: if operating systems chose to expose the kind of information I describe above, I suspect that there is a Really Good Chance that Firefox would incorporate them into the decision making process about how to handle DoH. All of that said, it's pretty unclear about whether that kind of thing is work that the IETF could usefully take on. It seems more like the kind of thing that would need to come from OS vendors, depending on the specific features implemented and made available by their operating systems. So I like the approach, but it's a bit unclear whether it's actionable in this venue. /a ___ [1] I'll point out this is basically the same thing that Tommy Jensen proposed in https://mailarchive.ietf.org/arch/msg/add/eb_I9k01GofMYKOgSXmDr0TtR08 [2] Or, at least, will be prior to the widespread release of DoH -- I'm not 100% up-to-date on schedules. On 8/22/19 7:22 AM, Winfield, Alister wrote: > The discussions surrounding ’policy’ on this list are long and don't look to be useful other than to highlight how hard the problems are to solve. With no end in sight I'd like to see if some of the issues can be solved by a different method. > > What I propose is to externalize the policy decisions. That is take it outside the client and into something (likely an API / OS daemon) that can do the DNS server selection. This doesn’t remove all issues and doesn’t stop malicious / non-compliant applications from doing what they want but…. > > It allows any viewpoint to be valid, given it could easily be a pluggable solution that allows any party to provide a policy module. > It allows diagnostic tools to use the same settings as the applications knowing that for the most part the same DNS servers and transports are used. > It allows a single point to change settings on most applications (clearly any application can still ignore the settings but this ought to be rare) > It keeps the settings behind administrative authority thus protecting them from trivial abuse by malicious applications. > The policy response can provide information about split views thus giving a method to handle corporate DNS > The policy modules can use any OS available information, some of which may be blocked from applications for a good reason, eg GPS, 802.1x, VPN state etc. > > Note I'm not wedded to any specific mechanism just the concept of externalized handling of DNS server policy decisions. > > So does anyone else here see this as a reasonable line of thinking worth pursuing ? > > -- > Alister Winfield > > Information in this email including any attachments may be privileged, confidential and is intended exclusively for the addressee. The views expressed may not be official policy, but the personal views of the originator. If you have received it in error, please notify the sender by return e-mail and delete it from your system. You should not reproduce, distribute, store, retransmit, use or disclose its contents to anyone. Please note we reserve the right to monitor all e-mail communication through our internal and external networks. SKY and the SKY marks are trademarks of Sky Limited and Sky International AG and are used under licence. > > Sky UK Limited (Registration No. 2906991), Sky-In-Home Service Limited (Registration No. 2067075), Sky Subscribers Services Limited (Registration No. 2340150) and Sky CP Limited (Registration No. 9513259) are direct or indirect subsidiaries of Sky Limited (Registration No. 2247735). All of the companies mentioned in this paragraph are incorporated in England and Wales and share the same registered office at Grant Way, Isleworth, Middlesex TW7 5QD From nobody Thu Aug 22 09:50:46 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 565F5120A49 for ; Thu, 22 Aug 2019 09:50:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nic.br Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id y3KTvAeXEUkF for ; Thu, 22 Aug 2019 09:50:43 -0700 (PDT) Received: from mail.nic.br (mail.nic.br [200.160.4.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B40D012082E for ; Thu, 22 Aug 2019 09:50:42 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mail.nic.br (Postfix) with ESMTP id A4AA0192F79; Thu, 22 Aug 2019 13:50:38 -0300 (-03) Authentication-Results: mail.nic.br (amavisd-new); dkim=pass (1024-bit key) header.d=nic.br Received: from mail.nic.br ([127.0.0.1]) by localhost (mail.nic.br [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PqIHfBgg-ycQ; Thu, 22 Aug 2019 13:50:38 -0300 (-03) Received: from rubens.in.registro.br (unknown [IPv6:2001:12ff:0:3a::195]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) (Authenticated sender: rubensk@nic.br) by mail.nic.br (Postfix) with ESMTPSA id 67BB7192F70; Thu, 22 Aug 2019 13:50:38 -0300 (-03) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=nic.br; s=dkim; t=1566492638; bh=nshQtRwQAgGlTSpUSlIceCfy9pjQgPsZEVGcIMOhy9w=; h=Subject:From:In-Reply-To:Date:Cc:References:To:From; b=nZCOm5cJbYY7pNxGsr7b8ifpM5powdR/TzCd/kmTz8zPjCARbqjcyxeegbPu8YB2F tLsmQQt1Id66o+AMxsSLQzjlnpQXiuAP3fRDhvpbLC4/XK3E32oULyYJS6dKKtiFp5 QLktbiJzSOTT28ghpzm8OLAUAVpgN2Mr2HNAPOXc= Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) From: Rubens Kuhl In-Reply-To: Date: Thu, 22 Aug 2019 13:50:38 -0300 Cc: add@ietf.org Content-Transfer-Encoding: quoted-printable Message-Id: <9C8A8C27-35F3-438E-9408-4DB7968230AE@nic.br> References: To: Jari Arkko X-Mailer: Apple Mail (2.3445.104.11) DMARC-Filter: OpenDMARC Filter v1.3.1 mail.nic.br 67BB7192F70 Archived-At: Subject: Re: [Add] What to do in this potential working group X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 22 Aug 2019 16:50:45 -0000 While IETF usually focus on technical documents for implementers and = operators, I believe that in this space an end-user document might be in = order. Some sort of "Pick your enemy" document, where users can be = educated on the different threat actors: - Corporate network administrators - ISPs - Big web-scales - Governments - Rogue applications developers (malware etc.) - Non-rogue application developers (browser developers) Rubens > Em 20 de ago de 2019, =C3=A0(s) 17:01:000, Jari Arkko = escreveu: >=20 > I=E2=80=99ve been on vacation and doing some other things for the last = couple of weeks, and now I=E2=80=99ve been trying to read the mailing = list discussions. Not easy! >=20 > Let me try another angle into the discussion and see if it=E2=80=99s = helpful. >=20 > Much of the discussion has been about the conflicts between people=E2=80= =99s different use cases or trustworthiness perceptions for different = entities. =E2=80=9CI trust industry X more than industry Y=E2=80=9D or = =E2=80=9CI need to perform which conflicts what you=E2=80=99re = trying to do prevent =E2=80=9D. And the various details = of performing those . >=20 > There=E2=80=99s been not so much discussion about concrete things = where IETF can help, or discussion about understanding and agreeing = where our agreements and disagreements lie, or where the factual things = end and opinions begin. >=20 > So how about looking at this first by understanding what kinds of = things we might actually agree on, and acknowledging what we disagree = on? For instance, I think there are helpful small things that I don=E2=80=99= t think are hugely controversial, better discovery mechanisms for = instance. Similarly, I don=E2=80=99t think we will find an agreement = whether one trusts an ISP more or less than a large Internet company = (because it depends, duh). But we might find agreement on some more = structural things, such as what factors have an effect, and what good = solutions look like. For instance, while we might differ on what = services we consider trustworthy, to me it seems obvious that creating a = single entity that has access to all users=E2=80=99 DNS queries is = potentially very dangerous architecture for the Internet. Too attractive = target for governments to tap, for instance.=20 >=20 > We might also agree on principles, such as the ones about user = configuration taking precedence over network configuration. >=20 > We do disagree on how to handle filtering use cases, enterprise = networks, how to deal with CDN localisation and other operational use = cases. Some of these things people care deeply about. And we might = disagree on what the advice is on split DNS. >=20 > In any case, to start with the parts that we possibly do agree on, = there is at least a beginning of a list of work items. For instance: >=20 > * Improved mechanisms for discovery and selection of encrypted DNS = transports > * Best operational practices for running an encrypted DNS transport = service (possibly subdivided for the type of deployment, e.g., ISP or = global service) > * Recommendation for precedence of configuration mechanisms > * Recommendation that having devices or apps =E2=80=9Ccall home=E2=80=9D= for every user action to a centralised global service is bad practice = and should be avoided >=20 > Jari >=20 > --=20 > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add From nobody Thu Aug 22 10:41:18 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 03B71120A9C for ; Thu, 22 Aug 2019 10:41:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id H2ClF8LobVIr for ; Thu, 22 Aug 2019 10:41:12 -0700 (PDT) Received: from NAM06-BL2-obe.outbound.protection.outlook.com (mail-eopbgr650122.outbound.protection.outlook.com [40.107.65.122]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 32967120A9B for ; Thu, 22 Aug 2019 10:41:12 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=Bc7OFESPthV2bWAYy/GAuUgWvDWtcyWbxLCqPkYTPxH7rhiEOIAlnabGfVSbO0OUwQDqCcr5pz9nX6BhzDSM39OprMY+hd064icH9GjpKYcKuCthDSjafMi9xJHdKtrS2gJ4gZWP28mZ7p5wEzZvzWO0uzlubirWH7oWhzzREzspQEW9zxrGijsQdRDA3THroNonS6YbzSFOl1vznEg/uK0R/JJxgTuT5lcd/RsjqIB3eYPle0zp+fCSPaqR0XsFSvtHUyXpN6ycEU5tMJvPz4+VGYUWtvVeJ86qJFH0YF8mAnHTZ7od4Ron+5Dqp3AthsgIXiE4ZKapU2VXqSEG1A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=zwSdvU13iJll5hp44DLqg6PYGjX/Pac5YWlug+ptBmQ=; b=YGwTnjUV42Y4Fk2mmjSzIdI+4A9pOLE2qFQz0rPrLn0aEXTV5KgELWDgyVGLxL2/NWVBfYg2IHap4qgEx91ElssecJx6yj+YurWQhF1nFIOgnRgKqn5rxDrcUfmnqYP4WKNQO6k5pwsywiAjZmKx5cSG4+UJp3f78pbfCy+fOqq1nKcYozHvKlRtOVTyEhV1C2yKlPrbFxVPhXniXa7HA4EFKFOUouFw1JBNVZA7vio8Cy6CAjTSDXywFpPkHOAPf29Ksr6wbL7bJ64tKET5Ly9q83UQztEut3WtMqz75Hbd7zzE/HZ74JwEW+mflmosVv029BVK5XLPun26Sizl3Q== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=microsoft.com; dmarc=pass action=none header.from=microsoft.com; dkim=pass header.d=microsoft.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=zwSdvU13iJll5hp44DLqg6PYGjX/Pac5YWlug+ptBmQ=; b=L4BrEAVbuUC3jLLjlf84aL3IINqQW/lGw284sPtfUIr7x9vEl3RoeQ+2wU33JRBTV2xBRCS7KeZIRLx6eDsMy21AfbQBcqvNV+xmEsBuxdQamlkCoAYsDA5cHRhRhW9TnCKH+zcwJjIwFBdzdUgecTTPYfa4FxIEinxl9v+Ri6k= Received: from SN2PR00MB0077.namprd00.prod.outlook.com (10.167.20.149) by SN2PR00MB0190.namprd00.prod.outlook.com (10.167.18.148) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2235.0; Thu, 22 Aug 2019 17:41:09 +0000 Received: from SN2PR00MB0077.namprd00.prod.outlook.com ([fe80::752f:cd0:81d9:42ed]) by SN2PR00MB0077.namprd00.prod.outlook.com ([fe80::752f:cd0:81d9:42ed%14]) with mapi id 15.20.2240.000; Thu, 22 Aug 2019 17:41:09 +0000 From: Tommy Jensen To: Adam Roach , "Winfield, Alister" , "add@ietf.org" Thread-Topic: [Add] A thought -- Move the policy decisions outside the application. Thread-Index: AQHVWORURTxxj+1200Sc5H0OM/Ik9qcHVn8AgAAK8G0= Date: Thu, 22 Aug 2019 17:41:09 +0000 Message-ID: References: <1444D5E7-DEA7-437C-B12B-6C31FEA563DD@sky.uk>, <11f9dfe2-ab05-2227-7643-e53da95ec717@nostrum.com> In-Reply-To: <11f9dfe2-ab05-2227-7643-e53da95ec717@nostrum.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=True; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2019-08-22T17:41:08.339Z; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Name=General; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_ContentBits=0; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Method=Standard; authentication-results: spf=none (sender IP is ) smtp.mailfrom=Jensen.Thomas@microsoft.com; x-originating-ip: [2001:4898:80e8:0:7239:f643:26b8:7c7] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 933c0b20-452e-47ac-fc84-08d72727eaea x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(5600166)(711020)(4605104)(1401327)(4618075)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(2017052603328)(7193020); SRVR:SN2PR00MB0190; x-ms-traffictypediagnostic: SN2PR00MB0190: x-ms-exchange-purlcount: 4 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:8273; x-forefront-prvs: 01371B902F x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(4636009)(136003)(39860400002)(346002)(366004)(376002)(396003)(199004)(189003)(51914003)(52536014)(6512007)(99286004)(186003)(256004)(19627405001)(76116006)(2906002)(53936002)(66446008)(6116002)(66946007)(91956017)(229853002)(110136005)(478600001)(64756008)(46003)(66556008)(66476007)(476003)(10090500001)(2501003)(8990500004)(11346002)(10290500003)(71190400001)(71200400001)(14444005)(5024004)(6486002)(33656002)(14454004)(8936002)(6246003)(316002)(74316002)(105004)(5660300002)(6506007)(22452003)(6306002)(8676002)(606006)(6436002)(236005)(86362001)(486006)(446003)(76176011)(102836004)(25786009)(81156014)(54896002)(7736002)(53546011)(966005)(9686003)(81166006); DIR:OUT; SFP:1102; SCL:1; SRVR:SN2PR00MB0190; H:SN2PR00MB0077.namprd00.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: AW1ofjvhK6nhexD61uJU8ZVo/2E2cJNn8bLLxzEsIbbmDSDq8jUCuqy/t8ZZvnn/ExqLMMB+dsdvdzmuQZEUG2JLnnJ2mie0Ur50qiNLnq2MbQ047T03J71JqxqYralR/NVQvcLrsYHUJeTwm25fOq8rjUQQpBC/DYlCOP8U3RlXgaHJhGzveOlMJtcETwq/PGRk5V7qmof0E5RCZ6OvPlhRa++iHiw4KXFJdVTN8Gmr5P+SCKDGLW5e/uQEAfMDEpEHTZKZLLvRAcocfnrNMMUjun1Luy2MPtZxlIOerAf+bjGkroAxfk+AqSc2rM6UQVqNqT43KdjH9R6XS6zdUON12usrfIQnXgHVJqvKqcBPj21NBLycrHdeJsrioiiMhebVfi5CXhwfU+STCgMY8sP99RGi+Nh4X/QPhY8RcNg= x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_CO2PR00MB0072E480020519516A0F7F0CFAA50CO2PR00MB0072namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: 933c0b20-452e-47ac-fc84-08d72727eaea X-MS-Exchange-CrossTenant-originalarrivaltime: 22 Aug 2019 17:41:09.2102 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: u+Q/O3evCbbG1w93UDMaAt3eNPkAR0fgpKyzWmaphZZ5BgQp49+MG/y9RiPs7hgguPOuzzvFhJdYrQgIiYrhwQ== X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN2PR00MB0190 Archived-At: Subject: Re: [Add] A thought -- Move the policy decisions outside the application. X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 22 Aug 2019 17:41:16 -0000 --_000_CO2PR00MB0072E480020519516A0F7F0CFAA50CO2PR00MB0072namp_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable Thanks for the reference, Adam. The link you provided gives me a 404, not s= ure if it's a local problem for me or not, but I'll assume you meant this = message [1]. Alister, in short, I do think your thoughts are a reasonable line of thinki= ng. After various discussions here on the mailing list, at least my approac= h has been to work offline with folks on more concrete proposals for such a= n OS integration. I'd welcome ideas on or off list as I'm sure other platfo= rms would as well. I agree with Adam on the platform offering support for encrypted DNS to be = a Good Thing. After all, most apps won't think about the need for encrypted= DNS [citation needed], and should be benefiting from it anyway when the OS= has it available. I'll point out since the topic is up, that GPO and parental controls are no= t the only sources of DNS stub configuration in Windows. For example, NRPT = rules, which specify behavior for a given domain name pattern, can be creat= ed by device admin authority for a number of reasons. For anyone who is int= erested, you can see PowerShell commands related to getting and setting NRP= T rules here [2]. I'm sure other platforms also have related mechanisms for handling the some= times complex situation of knowing which RR is the correct RR to use for a = given domain name, and allowing apps to discover that logic without having = to understand each platform's nuance seems like it has significant value. E= ven better in my mind would be that the platform provides encrypted DNS sup= port and well-behaved apps continued to leave RR selection to the platform.= However, if apps would like to dive in and fully grok the system configura= tion for themselves and redo the work to ensure no user scenario breaks, th= at's better than using a single RR while ignoring the system configuration = and I'll do my best to support them (no harm in having our configuration be= more transparent anyway). Thanks, Tommy [1] https://mailarchive.ietf.org/arch/msg/add/PGSg9LN6WB9XuhmYpwrgTO1GEOI [2] https://docs.microsoft.com/en-us/powershell/module/dnsclient/Get-DnsCli= entNrptRule?view=3Dwin10-ps ________________________________ From: Add on behalf of Adam Roach Sent: Thursday, August 22, 2019 9:10 AM To: Winfield, Alister ; add@iet= f.org Subject: Re: [Add] A thought -- Move the policy decisions outside the appli= cation. Top posting because I'm responding to the whole idea rather than any given point in it. At a first pass, half of this is really a call for the system resolver that is provided by the operating system to implement additional options for DNS resolution -- for example, building DoT and DoH into the Windows, OS X, and Linux platforms, and allowing for their configuration. That would be great! The other half is exposing information to applications about the way the OS is resolving names (encrypted vs cleartext, local-network versus public DNS, etc), and the means by which it was configured to do so (e.g., by the network as part of acquiring an address, by centralized enterprise policy, by local configuration override). The applications could then use this information to determine whether there is a policy reason to use the local system-configured resolver; and, if so, do so [1]. It is worth highlighting that this second thing is already implemented in Firefox [2], to the extent that relevant APIs are provided by the operating system today. There are currently two. The first is Microsoft's "Group Policy" API that is provided to allow administrators of enterprise and education networks to push policy to machines on their network. When Group Policy is used to configure Firefox, it uses whatever DoH settings are present in that policy (including honoring a policy decision to disable user configuration of DoH). If a Group Policy is present but does not mention DoH, then DoH will not be automatically offered to the user. The second is the "Parental Controls" feature offered by both Windows and OS X. If Parental Controls are configured for the account running Firefox, it will disable DoH completely, under the assumption that there may be some kind of local DNS filtering going on as part of that feature. With the caveat that I'm not in product management and am simply making an educated guess: if operating systems chose to expose the kind of information I describe above, I suspect that there is a Really Good Chance that Firefox would incorporate them into the decision making process about how to handle DoH. All of that said, it's pretty unclear about whether that kind of thing is work that the IETF could usefully take on. It seems more like the kind of thing that would need to come from OS vendors, depending on the specific features implemented and made available by their operating systems. So I like the approach, but it's a bit unclear whether it's actionable in this venue. /a ___ [1] I'll point out this is basically the same thing that Tommy Jensen proposed in https://nam06.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fmailarc= hive.ietf.org%2Farch%2Fmsg%2Fadd%2Feb_I9k01GofMYKOgSXmDr0TtR08&data=3D0= 2%7C01%7CJensen.Thomas%40microsoft.com%7C35fd77260b174c8904a708d7271b5236%7= C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637020870616953421&sdata=3D= HeGcnAsgc099k0BRGnZtcE4T0hFUali3Fz7hSzSfui8%3D&reserved=3D0 [2] Or, at least, will be prior to the widespread release of DoH -- I'm not 100% up-to-date on schedules. On 8/22/19 7:22 AM, Winfield, Alister wrote: > The discussions surrounding =92policy=92 on this list are long and don't = look to be useful other than to highlight how hard the problems are to solv= e. With no end in sight I'd like to see if some of the issues can be solved= by a different method. > > What I propose is to externalize the policy decisions. That is take it ou= tside the client and into something (likely an API / OS daemon) that can do= the DNS server selection. This doesn=92t remove all issues and doesn=92t s= top malicious / non-compliant applications from doing what they want but=85= . > > It allows any viewpoint to be valid, given it could easily be a pluggable= solution that allows any party to provide a policy module. > It allows diagnostic tools to use the same settings as the applications k= nowing that for the most part the same DNS servers and transports are used. > It allows a single point to change settings on most applications (clearly= any application can still ignore the settings but this ought to be rare) > It keeps the settings behind administrative authority thus protecting the= m from trivial abuse by malicious applications. > The policy response can provide information about split views thus giving= a method to handle corporate DNS > The policy modules can use any OS available information, some of which ma= y be blocked from applications for a good reason, eg GPS, 802.1x, VPN state= etc. > > Note I'm not wedded to any specific mechanism just the concept of externa= lized handling of DNS server policy decisions. > > So does anyone else here see this as a reasonable line of thinking worth = pursuing ? > > -- > Alister Winfield > > Information in this email including any attachments may be privileged, co= nfidential and is intended exclusively for the addressee. The views express= ed may not be official policy, but the personal views of the originator. If= you have received it in error, please notify the sender by return e-mail a= nd delete it from your system. You should not reproduce, distribute, store,= retransmit, use or disclose its contents to anyone. Please note we reserve= the right to monitor all e-mail communication through our internal and ext= ernal networks. SKY and the SKY marks are trademarks of Sky Limited and Sky= International AG and are used under licence. > > Sky UK Limited (Registration No. 2906991), Sky-In-Home Service Limited (R= egistration No. 2067075), Sky Subscribers Services Limited (Registration No= . 2340150) and Sky CP Limited (Registration No. 9513259) are direct or indi= rect subsidiaries of Sky Limited (Registration No. 2247735). All of the com= panies mentioned in this paragraph are incorporated in England and Wales an= d share the same registered office at Grant Way, Isleworth, Middlesex TW7 5= QD -- Add mailing list Add@ietf.org https://nam06.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fwww.iet= f.org%2Fmailman%2Flistinfo%2Fadd&data=3D02%7C01%7CJensen.Thomas%40micro= soft.com%7C35fd77260b174c8904a708d7271b5236%7C72f988bf86f141af91ab2d7cd011d= b47%7C1%7C0%7C637020870616953421&sdata=3DA2dneDTBGJX2QW6DTDOvGN%2F41ebF= Pxrovp6c5LTo9S4%3D&reserved=3D0 --_000_CO2PR00MB0072E480020519516A0F7F0CFAA50CO2PR00MB0072namp_ Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable
Thanks for the reference, Adam. The link you provided gives me a 404, not s= ure if it's a local problem for me or  not, but I'll assume you meant = this message [1]. 

Alister, in short, I do think your thoughts are a reasonable line of thinki= ng. After various discussions here on the mailing list, at least my approac= h has been to work offline with folks on more concrete proposals for such a= n OS integration. I'd welcome ideas on or off list as I'm sure other platforms would as well. 

I agree with Adam on the platform offering support for encrypted DNS to be = a Good Thing. After all, most apps won't think about the need for encrypted= DNS [citation needed], and should be benefiting from it anyway when the OS= has it available.

I'll point out since the topic is up, that GPO and parental controls are no= t the only sources of DNS stub configuration in Windows. For example, NRPT = rules, which specify behavior for a given domain name pattern, can be creat= ed by device admin authority for a number of reasons. For anyone who is interested, you can see PowerShell = commands related to getting and setting NRPT rules here [2]. 

I'm sure other platforms also have related mechanisms for handling the some= times complex situation of knowing which RR is the correct RR to use for a = given domain name, and allowing apps to discover that logic without having = to understand each platform's nuance seems like it has significant value. Even better in my mind would be that = the platform provides encrypted DNS support and well-behaved apps continued= to leave RR selection to the platform. However, if apps would like to dive= in and fully grok the system configuration for themselves and redo the work to ensure no user scenario breaks, that's= better than using a single RR while ignoring the system configuration and = I'll do my best to support them (no harm in having our configuration be mor= e transparent anyway).

Thanks,
Tommy



From: Add = <add-bounces@ietf.org> on behalf of Adam Roach <adam@nostrum.com&g= t;
Sent: Thursday, August 22, 2019 9:10 AM
To: Winfield, Alister <Alister.Winfield=3D40sky.uk@dmarc.ietf.org= >; add@ietf.org <add@ietf.org>
Subject: Re: [Add] A thought -- Move the policy decisions outside th= e application.
 
Top posting because I'm responding to the whole id= ea rather than any
given point in it.

At a first pass, half of this is really a call for the system resolver
that is provided by the operating system to implement additional options for DNS resolution -- for example, building DoT and DoH into the
Windows, OS X, and Linux platforms, and allowing for their
configuration. That would be great!

The other half is exposing information to applications about the way the OS is resolving names (encrypted vs cleartext, local-network versus
public DNS, etc), and the means by which it was configured to do so
(e.g., by the network as part of acquiring an address, by centralized
enterprise policy, by local configuration override). The applications
could then use this information to determine whether there is a policy
reason to use the local system-configured resolver; and, if so, do so [1].<= br>
It is worth highlighting that this second thing is already implemented
in Firefox [2], to the extent that relevant APIs are provided by the
operating system today. There are currently two.

The first is Microsoft's "Group Policy" API that is provided to a= llow
administrators of enterprise and education networks to push policy to
machines on their network. When Group Policy is used to configure
Firefox, it uses whatever DoH settings are present in that policy
(including honoring a policy decision to disable user configuration of
DoH). If a Group Policy is present but does not mention DoH, then DoH
will not be automatically offered to the user.

The second is the "Parental Controls" feature offered by both Win= dows
and OS X. If Parental Controls are configured for the account running
Firefox, it will disable DoH completely, under the assumption that there may be some kind of local DNS filtering going on as part of that feature.
With the caveat that I'm not in product management and am simply making an educated guess: if operating systems chose to expose the kind of
information I describe above, I suspect that there is a Really Good
Chance that Firefox would incorporate them into the decision making
process about how to handle DoH.

All of that said, it's pretty unclear about whether that kind of thing
is work that the IETF could usefully take on. It seems more like the
kind of thing that would need to come from OS vendors, depending on the specific features implemented and made available by their operating
systems. So I like the approach, but it's a bit unclear whether it's
actionable in this venue.

/a

___
[1] I'll point out this is basically the same thing that Tommy Jensen
proposed in
https://nam06.safelinks.protection.outlook.com/?url= =3Dhttps%3A%2F%2Fmailarchive.ietf.org%2Farch%2Fmsg%2Fadd%2Feb_I9k01GofMYKOg= SXmDr0TtR08&amp;data=3D02%7C01%7CJensen.Thomas%40microsoft.com%7C35fd77= 260b174c8904a708d7271b5236%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637= 020870616953421&amp;sdata=3DHeGcnAsgc099k0BRGnZtcE4T0hFUali3Fz7hSzSfui8= %3D&amp;reserved=3D0

[2] Or, at least, will be prior to the widespread release of DoH -- I'm not 100% up-to-date on schedules.

On 8/22/19 7:22 AM, Winfield, Alister wrote:
> The discussions surrounding =92policy=92 on this list are long and don= 't look to be useful other than to highlight how hard the problems are to s= olve. With no end in sight I'd like to see if some of the issues can be sol= ved by a different method.
>
> What I propose is to externalize the policy decisions. That is take it= outside the client and into something (likely an API / OS daemon) that can= do the DNS server selection. This doesn=92t remove all issues and doesn=92= t stop malicious / non-compliant applications from doing what they want but=85.
>
> It allows any viewpoint to be valid, given it could easily be a plugga= ble solution that allows any party to provide a policy module.
> It allows diagnostic tools to use the same settings as the application= s knowing that for the most part the same DNS servers and transports are us= ed.
> It allows a single point to change settings on most applications (clea= rly any application can still ignore the settings but this ought to be rare= )
> It keeps the settings behind administrative authority thus protecting = them from trivial abuse by malicious applications.
> The policy response can provide information about split views thus giv= ing a method to handle corporate DNS
> The policy modules can use any OS available information, some of which= may be blocked from applications for a good reason, eg GPS, 802.1x, VPN st= ate etc.
>
> Note I'm not wedded to any specific mechanism just the concept of exte= rnalized handling of DNS server policy decisions.
>
> So does anyone else here see this as a reasonable line of thinking wor= th pursuing ?
>
> --
> Alister Winfield
>
> Information in this email including any attachments may be privileged,= confidential and is intended exclusively for the addressee. The views expr= essed may not be official policy, but the personal views of the originator.= If you have received it in error, please notify the sender by return e-mail and delete it from your system. = You should not reproduce, distribute, store, retransmit, use or disclose it= s contents to anyone. Please note we reserve the right to monitor all e-mai= l communication through our internal and external networks. SKY and the SKY marks are trademarks of Sky Limited= and Sky International AG and are used under licence.
>
> Sky UK Limited (Registration No. 2906991), Sky-In-Home Service Limited= (Registration No. 2067075), Sky Subscribers Services Limited (Registration= No. 2340150) and Sky CP Limited (Registration No. 9513259) are direct or i= ndirect subsidiaries of Sky Limited (Registration No. 2247735). All of the companies mentioned in this paragra= ph are incorporated in England and Wales and share the same registered offi= ce at Grant Way, Isleworth, Middlesex TW7 5QD


--
Add mailing list
Add@ietf.org
http= s://nam06.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fwww.ietf.or= g%2Fmailman%2Flistinfo%2Fadd&amp;data=3D02%7C01%7CJensen.Thomas%40micro= soft.com%7C35fd77260b174c8904a708d7271b5236%7C72f988bf86f141af91ab2d7cd011d= b47%7C1%7C0%7C637020870616953421&amp;sdata=3DA2dneDTBGJX2QW6DTDOvGN%2F4= 1ebFPxrovp6c5LTo9S4%3D&amp;reserved=3D0
--_000_CO2PR00MB0072E480020519516A0F7F0CFAA50CO2PR00MB0072namp_-- From nobody Thu Aug 22 11:26:19 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7949A120AC9 for ; Thu, 22 Aug 2019 11:26:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.679 X-Spam-Level: X-Spam-Status: No, score=-1.679 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_INVALID=0.1, DKIM_SIGNED=0.1, HTML_MESSAGE=0.001, T_SPF_HELO_PERMERROR=0.01, T_SPF_PERMERROR=0.01] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=fail (1024-bit key) reason="fail (message has been altered)" header.d=nostrum.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qPzXspHGRJ0V for ; Thu, 22 Aug 2019 11:26:16 -0700 (PDT) Received: from nostrum.com (raven-v6.nostrum.com [IPv6:2001:470:d:1130::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CA177120AC0 for ; Thu, 22 Aug 2019 11:26:16 -0700 (PDT) Received: from MacBook-Pro.roach.at (99-152-146-228.lightspeed.dllstx.sbcglobal.net [99.152.146.228]) (authenticated bits=0) by nostrum.com (8.15.2/8.15.2) with ESMTPSA id x7MIQE4B071865 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NO); Thu, 22 Aug 2019 13:26:15 -0500 (CDT) (envelope-from adam@nostrum.com) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=nostrum.com; s=default; t=1566498376; bh=uoOX00Nd8dRa/PzKbZe0b7CZDLTqU5nrkVj6rWl2fLs=; h=Subject:To:References:From:Date:In-Reply-To; b=FtWhTngxQO8Ma2pwJDzdlILtIITnU/1vWaNgyhlRhEVyLnPdNgPxdhQssRU6549oL 8iP2y0JjeFDloTqH9SrqYCiboTX7oaDr42/CxAwRLEdnG267zLBlWtnMUT8U9LURyH dUegqoGECt6Tm8QC2IYNdrOh/dVwwHXxt3lE4DEk= X-Authentication-Warning: raven.nostrum.com: Host 99-152-146-228.lightspeed.dllstx.sbcglobal.net [99.152.146.228] claimed to be MacBook-Pro.roach.at To: Tommy Jensen , "Winfield, Alister" , "add@ietf.org" References: <1444D5E7-DEA7-437C-B12B-6C31FEA563DD@sky.uk> <11f9dfe2-ab05-2227-7643-e53da95ec717@nostrum.com> From: Adam Roach Message-ID: <94429d81-d225-0e30-04d9-f52f68ddcaa2@nostrum.com> Date: Thu, 22 Aug 2019 13:26:09 -0500 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/alternative; boundary="------------4E7D5AA50FB1AB30E7377BE2" Content-Language: en-US Archived-At: Subject: Re: [Add] A thought -- Move the policy decisions outside the application. X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 22 Aug 2019 18:26:18 -0000 This is a multi-part message in MIME format. --------------4E7D5AA50FB1AB30E7377BE2 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit On 8/22/19 12:41 PM, Tommy Jensen wrote: > I'll point out since the topic is up, that GPO and parental controls > are not the only sources of DNS stub configuration in Windows. For > example, NRPT rules, which specify behavior for a given domain name > pattern, can be created by device admin authority for a number of > reasons. For anyone who is interested, you can see PowerShell commands > related to getting and setting NRPT rules here [2]. I've been digging through these commands recently (for reasons very similar to what you imply), and was wondering whether there was some API (rather than calling out to commandline executables) that could be used to retrieve this and similar information (like DNS search lists). Do you know? /a --------------4E7D5AA50FB1AB30E7377BE2 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 8bit
On 8/22/19 12:41 PM, Tommy Jensen wrote:
I'll point out since the topic is up, that GPO and parental controls are not the only sources of DNS stub configuration in Windows. For example, NRPT rules, which specify behavior for a given domain name pattern, can be created by device admin authority for a number of reasons. For anyone who is interested, you can see PowerShell commands related to getting and setting NRPT rules here [2]. 


I've been digging through these commands recently (for reasons very similar to what you imply), and was wondering whether there was some API (rather than calling out to commandline executables) that could be used to retrieve this and similar information (like DNS search lists). Do you know?

/a

--------------4E7D5AA50FB1AB30E7377BE2-- From nobody Thu Aug 22 11:53:37 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1755A120ADE for ; Thu, 22 Aug 2019 11:53:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.995 X-Spam-Level: X-Spam-Status: No, score=-1.995 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nohats.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id I229vP6yJvdr for ; Thu, 22 Aug 2019 11:53:33 -0700 (PDT) Received: from mx.nohats.ca (mx.nohats.ca [193.110.157.68]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2300B120AE4 for ; Thu, 22 Aug 2019 11:53:33 -0700 (PDT) Received: from localhost (localhost [IPv6:::1]) by mx.nohats.ca (Postfix) with ESMTP id 46DtwB5pMyzFZ2; Thu, 22 Aug 2019 20:53:30 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nohats.ca; s=default; t=1566500010; bh=zL+0tOS+WqvrdmmJybjZhppjw4HO7I838D7DWV2Yswg=; h=Subject:From:In-Reply-To:Date:Cc:References:To; b=EOg7uiS4lnLdzNsvgCEA74nBp/NWRnaVNy0PEXtC/zYWvips0fq74M14k4Wy59wL7 SaO5fYciV/Ah0Ecl4gJtRls615jdBTeUecKMxlSCdpjBSXEzGVhe6Fdf34lZ0lExRR 8J9T7VxRCL9n6Epjd8EG9Bvyf4bdJhBmWKImsa4A= X-Virus-Scanned: amavisd-new at mx.nohats.ca Received: from mx.nohats.ca ([IPv6:::1]) by localhost (mx.nohats.ca [IPv6:::1]) (amavisd-new, port 10024) with ESMTP id NwRYO96FHLcR; Thu, 22 Aug 2019 20:53:28 +0200 (CEST) Received: from bofh.nohats.ca (bofh.nohats.ca [76.10.157.69]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx.nohats.ca (Postfix) with ESMTPS; Thu, 22 Aug 2019 20:53:28 +0200 (CEST) Received: from [192.168.1.110] (104-195-254-115.cpe.teksavvy.com [104.195.254.115]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by bofh.nohats.ca (Postfix) with ESMTPSA id C489859CFF7; Thu, 22 Aug 2019 09:47:26 -0400 (EDT) DKIM-Filter: OpenDKIM Filter v2.11.0 bofh.nohats.ca C489859CFF7 Content-Type: multipart/alternative; boundary=Apple-Mail-C04C582F-7A6A-4465-867F-06CB188F37EA Mime-Version: 1.0 (1.0) From: Paul Wouters X-Mailer: iPhone Mail (16G77) In-Reply-To: Date: Thu, 22 Aug 2019 09:47:25 -0400 Cc: Jim Reid , ADD Mailing list , Stephen Farrell Content-Transfer-Encoding: 7bit Message-Id: <71CF51A9-A018-4D5C-9D1C-FCF565B00D0B@nohats.ca> References: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> <59E0EC53-0E30-431C-8376-52C7BFC121A8@virtualized.org> <589DAFCB-1BDC-4156-A2CA-179C4559A6B2@virtualized.org> <683A176C-3CE6-4866-A736-F2A7465FA5B5@rfc1035.com> To: Eric Rescorla Archived-At: Subject: Re: [Add] data integrity and DNSSEC or DoH/DoT X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 22 Aug 2019 18:53:36 -0000 --Apple-Mail-C04C582F-7A6A-4465-867F-06CB188F37EA Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable You move the Answer section data to the Authoritative section, and add an ex= tended error code that the answer was filtered by policy. This allows a dnss= ec validator to validate and censor if it is configured to do so. This is my proposal for rpz-bis which is only waiting on the rpz draft to go= through the ISE. Paul Sent from mobile device > On Aug 22, 2019, at 03:00, Eric Rescorla wrote: >=20 >=20 >=20 >> On Wed, Aug 21, 2019 at 10:43 PM Jim Reid wrote: >>=20 >>=20 >> > On 21 Aug 2019, at 22:13, Stephen Farrell w= rote: >> >=20 >> > IMO you're both right but not quite using super-precise terminology:-) >> >=20 >> > ... >> >=20 >> > So yep, both give data integrity, just differently. >>=20 >> If we=E2=80=99re being super-precise, that=E2=80=99s not quite right eith= er Stephen. :-) >>=20 >> DNSSEC and DoH/DoT are not different paths to the same end goal of data i= ntegrity. They provide different flavours of data integrity. >=20 > This I agree with. >=20 > =20 >> DNSSEC validation means you get the truth, the whole truth and nothing bu= t the truth regardless of your choice of resolver or the transport path betw= een you and that resolver. DoH and DoT offer no protection at all from a lyi= ng resolver - you=E2=80=99re just guaranteed to receive precisely whatever l= ies or truth that resolver sends. So in effect you somehow decide to =E2=80=9C= trust=E2=80=9D a TRR and hope for the best. In some cases, that may well be g= ood enough. In others, perhaps not. >=20 > I'd like to push on this slightly, if I may. >=20 > I certainly agree that from a cryptographic perspective, DNSSEC allows you= to evaluate whether or not the records that you receive are those which wer= e provisioned (modulo typos, key expiry, etc.). However, as has been observe= d here a number of times, there are many cases where the resolver desires to= elide certain records (e.g., for malware filtering) or to redirect you to s= ome other location (e.g., captive portals). So from a systems perspective it= seems like things are more complicated. Suppose that I receive a bogus resp= onse to my A record query, how am I to usefully distinguish "this is malware= blocking" from "this resolver is malicious"? >=20 > -Ekr >=20 >>=20 >>=20 >> --=20 >> Add mailing list >> Add@ietf.org >> https://www.ietf.org/mailman/listinfo/add > --=20 > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add --Apple-Mail-C04C582F-7A6A-4465-867F-06CB188F37EA Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable You move the Answer section data to the Aut= horitative section, and add an extended error code that the answer was filte= red by policy. This allows a dnssec validator to validate and censor if it i= s configured to do so.

This is my proposal for rpz-bis wh= ich is only waiting on the rpz draft to go through the ISE.

Paul

Sent f= rom mobile device

On Aug 22, 2019, at 03:00, Eric R= escorla <ekr@rtfm.com> wrote:
<= br>


On Wed, Aug 21, 2019 at 10:43 PM Jim Reid <jim@rfc1035.com> wrote:


> On 21 Aug 2019, at 22:13, Stephen Farrell <stephen.farrell@cs.tcd.ie> wrot= e:
>
> IMO you're both right but not quite using super-precise terminology:-)<= br> >
> ...
>
> So yep, both give data integrity, just differently.

If we=E2=80=99re being super-precise, that=E2=80=99s not quite right either S= tephen. :-)

DNSSEC and DoH/DoT are not different paths to the same end goal of data inte= grity. They provide different flavours of data integrity.

This I agree with.

 
<= blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-le= ft:1px solid rgb(204,204,204);padding-left:1ex"> DNSSEC validation means you get the truth, the whole truth and nothing but t= he truth regardless of your choice of resolver or the transport path between= you and that resolver. DoH and DoT offer no protection at all from a lying r= esolver - you=E2=80=99re just guaranteed to receive precisely whatever lies o= r truth that resolver sends. So in effect you somehow decide to =E2=80=9Ctru= st=E2=80=9D a TRR and hope for the best. In some cases, that may well be goo= d enough. In others, perhaps not.

I'd li= ke to push on this slightly, if I may.

I certainly a= gree that from a cryptographic perspective, DNSSEC allows you to evaluate wh= ether or not the records that you receive are those which were provisioned (= modulo typos, key expiry, etc.). However, as has been observed here a number= of times, there are many cases where the resolver desires to elide certain r= ecords (e.g., for malware filtering) or to redirect you to some other locati= on (e.g., captive portals). So from a systems perspective it seems like thin= gs are more complicated. Suppose that I receive a bogus response to my A rec= ord query, how am I to usefully distinguish "this is malware blocking" from "= this resolver is malicious"?

-Ekr
= --Apple-Mail-C04C582F-7A6A-4465-867F-06CB188F37EA-- From nobody Thu Aug 22 11:53:46 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8DABA120B48 for ; Thu, 22 Aug 2019 11:53:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nohats.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ewvvAaGhVeIy for ; Thu, 22 Aug 2019 11:53:38 -0700 (PDT) Received: from mx.nohats.ca (mx.nohats.ca [193.110.157.68]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F2205120B34 for ; Thu, 22 Aug 2019 11:53:37 -0700 (PDT) Received: from localhost (localhost [IPv6:::1]) by mx.nohats.ca (Postfix) with ESMTP id 46DtwJ4ZxTzFZ9; Thu, 22 Aug 2019 20:53:36 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nohats.ca; s=default; t=1566500016; bh=ZiIFbbu3DeLITX8DMMX6ycNGF8FD1/GDcQ8u4fP6x24=; h=Subject:From:In-Reply-To:Date:Cc:References:To; b=Eu4v8vHHg17iPW+fdliYSyE6OoH8ktxg/CbQzbhEMRoEqhly0Gy52gsgMypVOATTb ElW2IjWsa5W/IlYaADKlMj79fElFK96g7gnxYckhjmW7c2zYNcvRS6T6VW1AYg1VTQ QE3G+/AT/93o0DCScEcUwFwSksAUFOCVgBv2GY2k= X-Virus-Scanned: amavisd-new at mx.nohats.ca Received: from mx.nohats.ca ([IPv6:::1]) by localhost (mx.nohats.ca [IPv6:::1]) (amavisd-new, port 10024) with ESMTP id vwV_mOntZaBN; Thu, 22 Aug 2019 20:53:35 +0200 (CEST) Received: from bofh.nohats.ca (bofh.nohats.ca [76.10.157.69]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx.nohats.ca (Postfix) with ESMTPS; Thu, 22 Aug 2019 20:53:32 +0200 (CEST) Received: from [192.168.1.110] (104-195-254-115.cpe.teksavvy.com [104.195.254.115]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by bofh.nohats.ca (Postfix) with ESMTPSA id 86E1B59CFFF; Thu, 22 Aug 2019 09:53:31 -0400 (EDT) DKIM-Filter: OpenDKIM Filter v2.11.0 bofh.nohats.ca 86E1B59CFFF Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (1.0) From: Paul Wouters X-Mailer: iPhone Mail (16G77) In-Reply-To: Date: Thu, 22 Aug 2019 09:53:30 -0400 Cc: Jari Arkko , ADD Mailing list , Adam Roach , Daniel Stenberg Content-Transfer-Encoding: quoted-printable Message-Id: References: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> <279abf8c-198b-5da8-1cb9-4f86bf1f37c7@nostrum.com> <87C8E6E6-2DEE-4637-9C86-65B27615611C@piuha.net> To: Eric Rescorla Archived-At: Subject: Re: [Add] What to do in this potential working group X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 22 Aug 2019 18:53:43 -0000 > On Aug 22, 2019, at 06:26, Eric Rescorla wrote: >=20 >=20 >=20 > I agree that there is a risk, but given that we know that the current desi= gn *also* has a high risk of surveillance and other leaks, and that in fact t= hose sorts of things regularly occur, this doesn't seem to me to be anywhere= near as strong an argument as you seem to think it is.=20 As a non-US citizen, I strongly disagree that the argument that we are putti= ng all eggs in US baskets is not a strong argument. The US government formal= ly gives me 0 expectation of privacy and they dictate policy to US entities.= It is worse informally as we=E2=80=99ve seen time and time again (echelon, S= nowden etc). While I understand you might feel okay with your government=E2=80=99s polici= es to protect your privacy please remain aware that is a very privileged pos= ition to be in. Paul= From nobody Thu Aug 22 14:31:51 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 74BE612012A for ; Thu, 22 Aug 2019 14:31:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=comcast.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eIKP4oRqZJ_j for ; Thu, 22 Aug 2019 14:31:48 -0700 (PDT) Received: from copdcmhout01.cable.comcast.com (copdcmhout01.cable.comcast.com [162.150.44.71]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4C25C12002E for ; Thu, 22 Aug 2019 14:31:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; d=comcast.com; s=20190412; c=relaxed/simple; q=dns/txt; i=@comcast.com; t=1566509490; x=2430423090; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=dYBQk3om0sz/pRKwk6zt8XEht8CRpRxMjD+7k9ZZOFo=; b=rDdBfohAZxmUpdF+sshIw2gchtuR/O/OuhvNk6lM+dHiV+4m/388s6ksrH3kz5pz A/VrUHadizvxqx4zU+rgmlLTvJ5mxH2L/4ihBgsnle6CiUUl05lyz4URntzZonGr qBJcQDUjyJiX0rD4G3yvrBpej/HUIKb/x9vHFhOf/fJD4FB0+G3/QMxO8eeoYz/G NF62u4GTSqIDm8D9NExpd6Kzv+C07ri98P2s0r+zVerBVKdMNTchIFrdXMB1X8YY 13YUdeIBm+8obziuknrQ0+VjzgjTIXD0Xvrs4kMWuPG6wsdqqpFwdqguSB/YP4eM fQKCWFnIf4Oi8WptrpBlDg==; X-AuditID: a2962c47-ab9ff7000002e144-99-5d5f09b24b95 Received: from COPDCEXC37.cable.comcast.com (copdcmhoutvip.cable.comcast.com [96.114.156.147]) (using TLS with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (Client did not present a certificate) by copdcmhout01.cable.comcast.com (SMTP Gateway) with SMTP id B7.17.57668.2B90F5D5; Thu, 22 Aug 2019 15:31:30 -0600 (MDT) Received: from COPDCEXC37.cable.comcast.com (147.191.125.136) by COPDCEXC37.cable.comcast.com (147.191.125.136) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1713.5; Thu, 22 Aug 2019 17:31:47 -0400 Received: from COPDCEXC37.cable.comcast.com ([fe80::3aea:a7ff:fe36:8a94]) by COPDCEXC37.cable.comcast.com ([fe80::3aea:a7ff:fe36:8a94%15]) with mapi id 15.01.1713.008; Thu, 22 Aug 2019 17:31:46 -0400 From: "Livingood, Jason" To: "add@ietf.org" Thread-Topic: [Add] Participation Thread-Index: AQHVVJlIaQ3O+FqrgUiZC6eLnI/K5qb+2wYAgAA+MACAALszgIAABqSAgAKRaACAAHCDAIAAGrkAgAAFEoCAAAsRAIAADNWAgAGnjwCAABgPAIAAAUEAgAAg1oCAAAcaAIAAWgoAgAAQ+YCAAA0ggIAAv7iAgADFjwCAAARugIAAn4SAgAAZ94A= Date: Thu, 22 Aug 2019 21:31:46 +0000 Message-ID: <45E113D4-F17B-4622-81CB-66A2F914F8FB@cable.comcast.com> References: <8D42902D-CD20-4A64-8F38-CF96F1A351F1@frobbit.se> <20190821.202457.210468432.sthaug@nethelp.no> <20190822.082753.251801273.sthaug@nethelp.no> <53DE546C-2E36-4988-80B7-796787A7A3C3@huitema.net> In-Reply-To: <53DE546C-2E36-4988-80B7-796787A7A3C3@huitema.net> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.1c.0.190812 x-originating-ip: [96.115.73.252] Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-CFilter-Loop: Forward X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFprEKsWRmVeSWpSXmKPExsWSUDRnsu4mzvhYg49fFS3+n17H5sDosWTJ T6YAxqgGRpuSjKLUxBKX1LTUvOJUOy4FDGCTlJqWX5TqmliUUxmUmpOaiF0ZSGVKak5mWWqR PlZj9LGak9DFlPF5ySXGggMsFTdWX2FuYNzA0sXIySEhYCKx580Lxi5GLg4hgSNMEk9fnWSB cFqYJDZ8/84EUiUkcJpR4t1yThCbTcBM4u7CK8wgtoiAokTjxjuMILawgILEu2PNQPUcYPEl fZogc0QEjjFKbJi4lA2khkVAVWLBrUlgNq+Ai8Txa1/ZIZbNZJK4Mu0bWIJTwF7i3vZHYDaj gJjE91NrwI5gFhCXuPVkPhPE2QISS/acZ4awRSVePv7HCmKLCuhLLPmxmRUirijxb/Z6FpCD mAU0Jdbv0ocYYyXx8/kXqJGKElO6H7JD3CMocXLmE2ioiEscPrKDdQKjxCwkm2chTJqFZNIs JJNmIZm0gJF1FSOvoZmRnqGpgZ6JiZ654SZGYEpZNE3HfQfjh/OxhxgFOBiVeHilOeJjhVgT y4orcw8xSnAwK4nwlk2MixXiTUmsrEotyo8vKs1JLT7EKM3BoiTOe7crNlZIID2xJDU7NbUg tQgmy8TBKdXAqKxjfnDRt04mp8/Be67ujG021Z4f3nRR6kS6vemFAO2bDNcjbM3Pbdc7JxZm tst0RlXd9CVezDVvbX3NdshN2sthJ3XlzLtFM1xeKc/a/Xj1WavGdc1ud/yL7SNS76uWsUsJ 7aj8cGCRwYfkj18WZJ4/yK79+rKS3anHIZNndJW9sQjbMy9MSImlOCPRUIu5qDgRANN6Mgkl AwAA Archived-At: Subject: Re: [Add] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 22 Aug 2019 21:31:50 -0000 T24gOC8yMi8xOSwgMTE6NTkgQU0sICJBZGQgb24gYmVoYWxmIG9mIENocmlzdGlhbiBIdWl0ZW1h IiA8YWRkLWJvdW5jZXNAaWV0Zi5vcmcgb24gYmVoYWxmIG9mIGh1aXRlbWFAaHVpdGVtYS5uZXQ+ IHdyb3RlOg0KPiBUaGUgb2J2aW91cyBvdXRjb21lIGlzIG5vdCBmb3IgY291cnRzIHRvIGZvcmNl IElTUCB0byBibG9jayBUTFMuIFRoZSBtb3N0IGxpa2VseSBvdXRjb21lIGlzIHRoYXQgY291cnQg b3JkZXJzIHdpbGwgYXBwbHkgdG8gdGhlIHF1YWQgcmVzb2x2ZXJzIGFzIHdlbGwuDQoNCltKTF0g SSBzdXNwZWN0IHNvbWUgY291bnRyaWVzIGFyZSB2ZXJ5IG5lYXJseSBhdCB0aGF0IHBvaW50LCB3 aGljaCByZWZsZWN0cyB0aGUgcmVhbGl0eSBvZiBtYXJrZXQgY29uZGl0aW9ucywgc2hhcmUsIGFu ZCBjb250cm9sLiAgDQogDQoNCg== From nobody Thu Aug 22 14:37:27 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BF04C12012A for ; Thu, 22 Aug 2019 14:37:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=comcast.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JXDbW93EeGi8 for ; Thu, 22 Aug 2019 14:37:22 -0700 (PDT) Received: from copdcmhout02.cable.comcast.com (copdcmhout02.cable.comcast.com [96.114.158.212]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 31FF212002F for ; Thu, 22 Aug 2019 14:37:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; d=comcast.com; s=20190412; c=relaxed/simple; q=dns/txt; i=@comcast.com; t=1566509840; x=2430423440; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=N7gMmcumjFQOe6kL9EOxk2Hh46AHYsvo7wYunTvIIVw=; b=rjCMEBa0ULtGyHOjfNldUad54Ug6yph9iKro1kFF3SMxrrKPU6Y/iF7wCs4FqSqC yFqSroSn7EU0GVC5U/Ur0aSDOGjMNbkYU9FKoqAuuNR/K2oHgM34jMqZO34I4uyL m+tWPiLjUvtzjrHrrmo/WJ+Vz2o6g8Y/EYQX2We7zvH/pST9D992ySZRQ90x6Q+o yhI2q1RCCQe9SC2PaOQRGRKeZBPzwOrvXv0oaIMLKshUov1mdLzW0wwreYcyCLAC s3n20wTiG8AyjyddvcTlZXpbjAaTHDND5EEs3Zu++/X9BvhdPteLVVe849T/VPZ5 kwmjVjqMLrFgZVodJ0bgkg==; X-AuditID: 60729ed4-20fff700000013e0-f8-5d5f0b0f9eb6 Received: from copdcexc39.cable.comcast.com (copdcmhoutvip.cable.comcast.com [96.114.156.147]) (using TLS with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (Client did not present a certificate) by copdcmhout02.cable.comcast.com (SMTP Gateway) with SMTP id 3B.57.05088.F0B0F5D5; Thu, 22 Aug 2019 15:37:20 -0600 (MDT) Received: from COPDCEXC37.cable.comcast.com (147.191.125.136) by copdcexc39.cable.comcast.com (147.191.125.138) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1713.5; Thu, 22 Aug 2019 17:37:19 -0400 Received: from COPDCEXC37.cable.comcast.com ([fe80::3aea:a7ff:fe36:8a94]) by COPDCEXC37.cable.comcast.com ([fe80::3aea:a7ff:fe36:8a94%15]) with mapi id 15.01.1713.008; Thu, 22 Aug 2019 17:37:19 -0400 From: "Livingood, Jason" To: Rob Sayre , ADD Mailing list Thread-Topic: [Add] Participation Thread-Index: AQHVVJlIaQ3O+FqrgUiZC6eLnI/K5qb+2wYAgAA+MACAALszgIAAJFKAgAfBnQA= Date: Thu, 22 Aug 2019 21:37:19 +0000 Message-ID: References: <09178E42-08B2-4958-A1C8-AF507AEE8834@fugue.com> <0BDD4F7F-7301-476A-80DA-0CC84EE4557D@fugue.com> <6698db4f-89ff-e5be-09a5-eb544f76ebc9@nostrum.com> <20190817170031.6F71C1691138@fafnir.remote.dragon.net> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.1c.0.190812 x-originating-ip: [96.115.73.252] Content-Type: multipart/alternative; boundary="_000_B35B3709BAE84CDEA49FA56544F4F125cablecomcastcom_" MIME-Version: 1.0 X-CFilter-Loop: Forward X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFlrJKsWRmVeSWpSXmKPExsWSUDRnsq4Ad3yswaYNTBb/T69js+icNYHJ gclj56y77B5LlvxkCmCKamC0KckoSk0scUlNS80rTrXjUsAANkmpaflFqa6JRTmVQak5qYnY lYFUpqTmZJalFuljNUYfqzkJV5gyDs+PKehRr9jef52pgfGrahcjJ4eEgInE3a33mbsYuTiE BI4wSXT9+sgI4bQwSVy8O4EVwjnNKLGgcxIrSAubgJnE3YVXmEFsEQFHiUVzXrKB2MICChLv jjUzdTFyAMUVJZb0aUKU+Eksv3KUEcRmEVCV2HxoD1grr4CLxIMXU9kh5newSXzt2s0EkuAU CJQ4/aMPrIhRQEzi+6k1YHFmAXGJW0/mM0GcLSCxZM95ZghbVOLl439gt4kK6Ess+bGZFSKu KPFv9noWiN50ie6731ghFgtKnJz5hAWiRlzi8JEdrBMYxWYhWTELScssJC2zgF5jFtCUWL9L H6JEUWJK90N2CFtDonXOXCjbSuJh6y52ZDULGDlWMfJZmukZGproGZpa6BkZGm1iBCegeVd2 MF6e7nGIUYCDUYmHV40tPlaINbGsuDL3EKMEB7OSCG/ZxLhYId6UxMqq1KL8+KLSnNTiQ4zS HCxK4rys3bGxQgLpiSWp2ampBalFMFkmDk6pBsaZq8O+qk3xCJV51n+k6NXv7U/mJT1uqGB5 4Bi9fbq44IutaQG+nS9/SE9rqN3HV7N187a/vZP/XuNb5BVXzfC/jaVcLofZ8U2kfHYde22K rcL2DestZrXn91iudphlbfruyTOfK9XNcyTyflgap3T+dqlQf58WfWD5Hvm5J0qatplnT9I8 9UWJpTgj0VCLuag4EQBHIMLoPAMAAA== Archived-At: Subject: Re: [Add] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 22 Aug 2019 21:37:24 -0000 --_000_B35B3709BAE84CDEA49FA56544F4F125cablecomcastcom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 RnJvbTogQWRkIDxhZGQtYm91bmNlc0BpZXRmLm9yZz4gb24gYmVoYWxmIG9mIFJvYiBTYXlyZSA8 c2F5cmVyQGdtYWlsLmNvbT4NCj4gSSBkb24ndCBtZWFuIHRvIGltcGx5IHRoZXJlIGlzIGNvbnNl bnN1cy4gSW4gZmFjdCwgSSB0aGluayB0aGVyZSBpcyBub25lLCBhbmQgbm8gd29yayBzaG91bGQg aGFwcGVuLg0KDQpbSkxdIFRoaXMgdGhyZWFkIGhhcyBnb25lIGEgYml0IG9mZi10cmFjayBmcm9t IHRoZSBpbml0aWFsIG1lc3NhZ2UsIGJ1dCB5b3VyIHNlbnRpbWVudCBhYm92ZSBzZWVtcyB0byBi ZSBrZXkuIFNvIGxldCBtZSBub3RlIHRoYXQgcGVyc29uYWxseSBJIHRoaW5rIHlvdeKAmXZlIGV4 cHJlc3NlZCBxdWl0ZSBzdHJvbmdseSB0aGF0IHlvdSBkbyBub3QgZmVlbCBhbnkgQURELXJlbGF0 ZWQgd29yayBzaG91bGQgaGFwcGVuLCBhbmQgeW91IGFyZSB3ZWxjb21lIHRvIHRoYXQgb3Bpbmlv biBhcyBvdGhlcnMgYXJlIHRvIHRoZWlycy4gTXkgb3BpbmlvbiBpcyB0aGF0IEkgdGhpbmsgaXQg bWF5IGJlIHdvcnRoIHJlY29nbml6aW5nIHRoYXQgbWFueSBwZW9wbGUgZmVlbCB0aGF0IHRoZXJl IGlzIHdvcmsgdG8gZG8sIHNvIHBlcmhhcHMgaXQgaXMgd29ydGggbGV0dGluZyB0aGF0IGhhcHBl biBhbmQgc2VlaW5nIHdoYXQgY29tZXMgb2YgaXQgKHNwZWFraW5nIGFzIHNvbWVvbmUgd29ya2lu ZyB0byBkZXBsb3kgZW5jcnlwdGVkIEROUykuDQo= --_000_B35B3709BAE84CDEA49FA56544F4F125cablecomcastcom_ Content-Type: text/html; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2 IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToy IDE1IDUgMiAyIDIgNCAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OiJUaW1lcyBO ZXcgUm9tYW4gXChCb2R5IENTXCkiOw0KCXBhbm9zZS0xOjIgMTEgNiA0IDIgMiAyIDIgMiA0O30N Ci8qIFN0eWxlIERlZmluaXRpb25zICovDQpwLk1zb05vcm1hbCwgbGkuTXNvTm9ybWFsLCBkaXYu TXNvTm9ybWFsDQoJe21hcmdpbjowaW47DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQt c2l6ZToxMS4wcHQ7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0KYTpsaW5r LCBzcGFuLk1zb0h5cGVybGluaw0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6Ymx1 ZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCmE6dmlzaXRlZCwgc3Bhbi5Nc29IeXBl cmxpbmtGb2xsb3dlZA0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6cHVycGxlOw0K CXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KcC5tc29ub3JtYWwwLCBsaS5tc29ub3JtYWww LCBkaXYubXNvbm9ybWFsMA0KCXttc28tc3R5bGUtbmFtZTptc29ub3JtYWw7DQoJbXNvLW1hcmdp bi10b3AtYWx0OmF1dG87DQoJbWFyZ2luLXJpZ2h0OjBpbjsNCgltc28tbWFyZ2luLWJvdHRvbS1h bHQ6YXV0bzsNCgltYXJnaW4tbGVmdDowaW47DQoJZm9udC1zaXplOjExLjBwdDsNCglmb250LWZh bWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQpzcGFuLkVtYWlsU3R5bGUxOA0KCXttc28tc3R5 bGUtdHlwZTpwZXJzb25hbDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCglj b2xvcjp3aW5kb3d0ZXh0O30NCi5Nc29DaHBEZWZhdWx0DQoJe21zby1zdHlsZS10eXBlOmV4cG9y dC1vbmx5Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6 OC41aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBpbiAxLjBpbiAxLjBpbiAxLjBpbjt9DQpkaXYuV29y ZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi0tPjwvc3R5bGU+DQo8L2hlYWQ+DQo8 Ym9keSBsYW5nPSJFTi1VUyIgbGluaz0iYmx1ZSIgdmxpbms9InB1cnBsZSI+DQo8ZGl2IGNsYXNz PSJXb3JkU2VjdGlvbjEiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMi4wcHQ7Y29sb3I6YmxhY2siPkZyb206IDwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMi4wcHQ7Y29sb3I6YmxhY2siPkFkZCAmbHQ7YWRkLWJvdW5jZXNAaWV0Zi5v cmcmZ3Q7IG9uIGJlaGFsZiBvZiBSb2IgU2F5cmUgJmx0O3NheXJlckBnbWFpbC5jb20mZ3Q7PGJy Pg0KPC9zcGFuPiZndDsgSSBkb24ndCBtZWFuIHRvIGltcGx5IHRoZXJlIGlzIGNvbnNlbnN1cy4g SW4gZmFjdCwgSSB0aGluayB0aGVyZSBpcyBub25lLCBhbmQgbm8gd29yayBzaG91bGQgaGFwcGVu LjxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7 PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox NC4wcHQiPltKTF0gVGhpcyB0aHJlYWQgaGFzIGdvbmUgYSBiaXQgb2ZmLXRyYWNrIGZyb20gdGhl IGluaXRpYWwgbWVzc2FnZSwgYnV0IHlvdXIgc2VudGltZW50IGFib3ZlIHNlZW1zIHRvIGJlIGtl eS4gU28gbGV0IG1lIG5vdGUgdGhhdCBwZXJzb25hbGx5IEkgdGhpbmsgeW914oCZdmUgZXhwcmVz c2VkIHF1aXRlIHN0cm9uZ2x5IHRoYXQgeW91IGRvIG5vdCBmZWVsIGFueQ0KIEFERC1yZWxhdGVk IHdvcmsgc2hvdWxkIGhhcHBlbiwgYW5kIHlvdSBhcmUgd2VsY29tZSB0byB0aGF0IG9waW5pb24g YXMgb3RoZXJzIGFyZSB0byB0aGVpcnMuIE15IG9waW5pb24gaXMgdGhhdCBJIHRoaW5rIGl0IG1h eSBiZSB3b3J0aCByZWNvZ25pemluZyB0aGF0IG1hbnkgcGVvcGxlIGZlZWwgdGhhdCB0aGVyZSBp cyB3b3JrIHRvIGRvLCBzbyBwZXJoYXBzIGl0IGlzIHdvcnRoIGxldHRpbmcgdGhhdCBoYXBwZW4g YW5kIHNlZWluZyB3aGF0IGNvbWVzDQogb2YgaXQgKHNwZWFraW5nIGFzIHNvbWVvbmUgd29ya2lu ZyB0byBkZXBsb3kgZW5jcnlwdGVkIEROUykuIDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2 Pg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_B35B3709BAE84CDEA49FA56544F4F125cablecomcastcom_-- From nobody Thu Aug 22 14:41:59 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 31CF412008D for ; Thu, 22 Aug 2019 14:41:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=comcast.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Gd7kMuoLmlSY for ; Thu, 22 Aug 2019 14:41:56 -0700 (PDT) Received: from copdcmhout02.cable.comcast.com (copdcmhout02.cable.comcast.com [96.114.158.212]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0E24712002F for ; Thu, 22 Aug 2019 14:41:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; d=comcast.com; s=20190412; c=relaxed/simple; q=dns/txt; i=@comcast.com; t=1566510115; x=2430423715; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=lxkbcs7n3Gy/DXE5lC7e1/sDVHTT+D5XrCu84ngZSAo=; b=uON2oEvEdY7U5rr24HT0cTIv9leCPryBKhI7yRW1I0QCEMGWaFtsKJJb0VFSowX9 GugEGOEgnOLPSP0qONQROhTd3mwZSjBMks+qQy/h/HKkE6OOlGraiQ14+aCfVtEN VM1zieo1x+O3pJ+m7Zt49tiIIhbnQIfTxvKKFedArTRFeOEHJq1PwpMmbInZCJb/ PQwvjYlKJcOEW8d/rTdCKgUThB87Ukk7xIoGks5F0IMuOJ6VIR8QTycV/iHWjdrp Gvb0A7y0e6EyuItgEALr8zT9+81kiSEiA7Wll3c2dLCp0L9dr0sDsKkmO4eXhCLN PGyKK92jSEXTO+sO3218Sg==; X-AuditID: 60729ed4-227ff700000013e0-c4-5d5f0c23e8aa Received: from COPDCEXC35.cable.comcast.com (copdcmhoutvip.cable.comcast.com [96.114.156.147]) (using TLS with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (Client did not present a certificate) by copdcmhout02.cable.comcast.com (SMTP Gateway) with SMTP id 4E.97.05088.32C0F5D5; Thu, 22 Aug 2019 15:41:55 -0600 (MDT) Received: from COPDCEXC37.cable.comcast.com (147.191.125.136) by COPDCEXC35.cable.comcast.com (147.191.125.134) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1713.5; Thu, 22 Aug 2019 17:41:54 -0400 Received: from COPDCEXC37.cable.comcast.com ([fe80::3aea:a7ff:fe36:8a94]) by COPDCEXC37.cable.comcast.com ([fe80::3aea:a7ff:fe36:8a94%15]) with mapi id 15.01.1713.008; Thu, 22 Aug 2019 17:41:54 -0400 From: "Livingood, Jason" To: Rob Sayre , ADD Mailing list Thread-Topic: [Add] data integrity and DNSSEC or DoH/DoT Thread-Index: AQHVWGmJ3qmJSdjfvkSR0QaIplHAGqcGZmOAgAAHjICAAAEkAIABRO4A Date: Thu, 22 Aug 2019 21:41:54 +0000 Message-ID: References: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> <59E0EC53-0E30-431C-8376-52C7BFC121A8@virtualized.org> <589DAFCB-1BDC-4156-A2CA-179C4559A6B2@virtualized.org> <683A176C-3CE6-4866-A736-F2A7465FA5B5@rfc1035.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.1c.0.190812 x-originating-ip: [96.115.73.254] Content-Type: multipart/alternative; boundary="_000_FD390CE2922847A1A59221615D530750cablecomcastcom_" MIME-Version: 1.0 X-CFilter-Loop: Forward X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFlrJKsWRmVeSWpSXmKPExsWSUDRnsq4yT3yswbPZGhb/T69js+icNYHJ gclj56y77B5LlvxkCmCKamC0KckoSk0scUlNS80rTrXjUsAANkmpaflFqa6JRTmVQak5qYnY lYFUpqTmZJalFuljNUYfqzkJV5gyTlzYyVKwz6ZizbpnzA2MD626GDk5JARMJPo332btYuTi EBI4wiSxqXE/lNPCJDHl71wo5zSjxMIf89lBWtgEzCTuLrzCDGKLCDhKLJrzkg3EFhYwl9j6 4xkjRNxCYumLzSwQtpvErlVtQDYHB4uAqsS7h0EgYV4BF4lrE5eAlQgJXGST+HmNC8TmFAiU 2LhpP1icUUBM4vupNUwgNrOAuMStJ/OZIK4WkFiy5zwzhC0q8fLxP1YQW1RAX2LJj82sEHFF iV/zrrBB9KZLHFx/nR1ir6DEyZlPWCBqxCUOH9nBOoFRbBaSFbOQtMxC0jIL6ANmAU2J9bv0 IUoUJaZ0P2SHsDUkWufMhbKtJBafPsmGrGYBI8cqRj5LMz1DQxM9Q1MLPSNDo02M4AQ078oO xsvTPQ4xCnAwKvHwqrHFxwqxJpYVV+YeYpTgYFYS4S2bGBcrxJuSWFmVWpQfX1Sak1p8iFGa g0VJnJe1OzZWSCA9sSQ1OzW1ILUIJsvEwSnVwOi19MHMf2r5CxPM9r9I8G/g52U5+HVueb74 r4pNxWdnvzv44IW7zZoVKyoZPC8f7Sx33vKnyvGijsnCpst3f714/VI78qsQx4FnXF+4nq4V bjL49qas1079XeLDDX3J4ZrZDxI/mT2zdrfYHBsRnaNpyHT/8V4VpiZml4s7lTqibmtIiN4X N1RiKc5INNRiLipOBAAPG2enPAMAAA== Archived-At: Subject: Re: [Add] data integrity and DNSSEC or DoH/DoT X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 22 Aug 2019 21:41:58 -0000 --_000_FD390CE2922847A1A59221615D530750cablecomcastcom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 RnJvbTogQWRkIDxhZGQtYm91bmNlc0BpZXRmLm9yZz4gb24gYmVoYWxmIG9mIFJvYiBTYXlyZSA8 c2F5cmVyQGdtYWlsLmNvbT4NCkRhdGU6IFdlZG5lc2RheSwgQXVndXN0IDIxLCAyMDE5IGF0IDY6 MjMgUE0NClRvOiBEYXZpZCBDb25yYWQgPGRyY0B2aXJ0dWFsaXplZC5vcmc+DQpDYzogSmltIFJl aWQgPGppbUByZmMxMDM1LmNvbT4sIEFERCBNYWlsaW5nIGxpc3QgPGFkZEBpZXRmLm9yZz4sIFN0 ZXBoZW4gRmFycmVsbCA8c3RlcGhlbi5mYXJyZWxsQGNzLnRjZC5pZT4NClN1YmplY3Q6IFJlOiBb QWRkXSBkYXRhIGludGVncml0eSBhbmQgRE5TU0VDIG9yIERvSC9Eb1QNCg0KT24gV2VkLCBBdWcg MjEsIDIwMTkgYXQgMzoxNSBQTSBEYXZpZCBDb25yYWQgPGRyY0B2aXJ0dWFsaXplZC5vcmc8bWFp bHRvOmRyY0B2aXJ0dWFsaXplZC5vcmc+PiB3cm90ZToNCk15IHJlc3BvbnNlIHRvIFRlZCB0aGF0 IGNhdXNlZCBtZSB0byBnZXQgc3Vja2VkIGludG8gdGhpcyBwYXJ0aWN1bGFyIHN3YW1wIChzb21l dGhpbmcgSSBhbHJlYWR5IHJlZ3JldCkNCg0KPiBJcyB0aGF0IHRoZSBzd2FtcCB3aGVyZSB0aGUg b25seSBzaWduaWZpY2FudCBETlNTRUMgcHJvdmlkZXJzIGFyZSBHb29nbGUgYW5kIENsb3VkZmxh cmU/DQoNCltKTF0gUGxlYXNlIG5vdGUgdGhhdCBDb21jYXN0IHBlcmZvcm1zIEROU1NFQy12YWxp ZGF0aW9uIGluIHRoZSBVUyBmb3Igb3VyIGN1c3RvbWVycy4gSVNQcyBpbiBvdGhlciBjb3VudHJp ZXMgZG8gYXMgd2VsbC4gU28gaXTigJlzIG5vdCBqdXN0IHRoZSBiaWcgcXVhZCBwbGF0Zm9ybXMu IFRoYXQgaXNu4oCZdCB0byBzYXkgdGhhdCBETlNTRUMgZGVwbG95bWVudCBkb2VzbuKAmXQgc3Rp bGwgaGF2ZSBhIHdheXMgdG8gZ28sIGJ1dCBzdWNoIGlzIGxpZmUuIEZvciByZWZlcmVuY2UsIHNl ZSBodHRwczovL2NvcnBvcmF0ZS5jb21jYXN0LmNvbS9jb21jYXN0LXZvaWNlcy9kbnNzZWMtZGVw bG95bWVudC11cGRhdGUNCmFuZCBodHRwczovL2NvcnBvcmF0ZS5jb21jYXN0LmNvbS9jb21jYXN0 LXZvaWNlcy9jb21jYXN0LWNvbXBsZXRlcy1kbnNzZWMtZGVwbG95bWVudC4NCg0KSmFzb24NCg0K --_000_FD390CE2922847A1A59221615D530750cablecomcastcom_ Content-Type: text/html; charset="utf-8" Content-ID: <759B6CB803FC9145970A162562B48E95@comcast.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2 IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToy IDE1IDUgMiAyIDIgNCAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OiJUaW1lcyBO ZXcgUm9tYW4gXChCb2R5IENTXCkiOw0KCXBhbm9zZS0xOjIgMTEgNiA0IDIgMiAyIDIgMiA0O30N Ci8qIFN0eWxlIERlZmluaXRpb25zICovDQpwLk1zb05vcm1hbCwgbGkuTXNvTm9ybWFsLCBkaXYu TXNvTm9ybWFsDQoJe21hcmdpbjowaW47DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQt c2l6ZToxMS4wcHQ7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0KYTpsaW5r LCBzcGFuLk1zb0h5cGVybGluaw0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6Ymx1 ZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCmE6dmlzaXRlZCwgc3Bhbi5Nc29IeXBl cmxpbmtGb2xsb3dlZA0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6cHVycGxlOw0K CXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KcC5Nc29MaXN0UGFyYWdyYXBoLCBsaS5Nc29M aXN0UGFyYWdyYXBoLCBkaXYuTXNvTGlzdFBhcmFncmFwaA0KCXttc28tc3R5bGUtcHJpb3JpdHk6 MzQ7DQoJbWFyZ2luLXRvcDowaW47DQoJbWFyZ2luLXJpZ2h0OjBpbjsNCgltYXJnaW4tYm90dG9t OjBpbjsNCgltYXJnaW4tbGVmdDouNWluOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250 LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCnAubXNv bm9ybWFsMCwgbGkubXNvbm9ybWFsMCwgZGl2Lm1zb25vcm1hbDANCgl7bXNvLXN0eWxlLW5hbWU6 bXNvbm9ybWFsOw0KCW1zby1tYXJnaW4tdG9wLWFsdDphdXRvOw0KCW1hcmdpbi1yaWdodDowaW47 DQoJbXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87DQoJbWFyZ2luLWxlZnQ6MGluOw0KCWZvbnQt c2l6ZToxMS4wcHQ7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0Kc3Bhbi5F bWFpbFN0eWxlMTgNCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWwtcmVwbHk7DQoJZm9udC1mYW1p bHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6d2luZG93dGV4dDt9DQouTXNvQ2hwRGVm YXVsdA0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250LXNpemU6MTAuMHB0O30N CkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjguNWluIDExLjBpbjsNCgltYXJnaW46MS4waW4g MS4waW4gMS4waW4gMS4waW47fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9u MTt9DQotLT48L3N0eWxlPg0KPC9oZWFkPg0KPGJvZHkgbGFuZz0iRU4tVVMiIGxpbms9ImJsdWUi IHZsaW5rPSJwdXJwbGUiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2NvbG9yOmJsYWNrIj5G cm9tOiA8L3NwYW4+PC9iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2NvbG9yOmJsYWNr Ij5BZGQgJmx0O2FkZC1ib3VuY2VzQGlldGYub3JnJmd0OyBvbiBiZWhhbGYgb2YgUm9iIFNheXJl ICZsdDtzYXlyZXJAZ21haWwuY29tJmd0Ozxicj4NCjxiPkRhdGU6IDwvYj5XZWRuZXNkYXksIEF1 Z3VzdCAyMSwgMjAxOSBhdCA2OjIzIFBNPGJyPg0KPGI+VG86IDwvYj5EYXZpZCBDb25yYWQgJmx0 O2RyY0B2aXJ0dWFsaXplZC5vcmcmZ3Q7PGJyPg0KPGI+Q2M6IDwvYj5KaW0gUmVpZCAmbHQ7amlt QHJmYzEwMzUuY29tJmd0OywgQUREIE1haWxpbmcgbGlzdCAmbHQ7YWRkQGlldGYub3JnJmd0Oywg U3RlcGhlbiBGYXJyZWxsICZsdDtzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllJmd0Ozxicj4NCjxi PlN1YmplY3Q6IDwvYj5SZTogW0FkZF0gZGF0YSBpbnRlZ3JpdHkgYW5kIEROU1NFQyBvciBEb0gv RG9UPG86cD48L286cD48L3NwYW4+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxv OnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPk9uIFdlZCwgQXVnIDIxLCAyMDE5IGF0IDM6MTUgUE0gRGF2aWQgQ29ucmFkICZsdDs8 YSBocmVmPSJtYWlsdG86ZHJjQHZpcnR1YWxpemVkLm9yZyI+ZHJjQHZpcnR1YWxpemVkLm9yZzwv YT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGJsb2NrcXVvdGUg c3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGlu ZzowaW4gMGluIDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tcmlnaHQ6MGluIj4N CjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+TXkgcmVzcG9uc2UgdG8gVGVkIHRo YXQgY2F1c2VkIG1lIHRvIGdldCBzdWNrZWQgaW50byB0aGlzIHBhcnRpY3VsYXIgc3dhbXAgKHNv bWV0aGluZyBJIGFscmVhZHkgcmVncmV0KSZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZu YnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZndDsg SXMgdGhhdCB0aGUgc3dhbXAgd2hlcmUgdGhlIG9ubHkgc2lnbmlmaWNhbnQgRE5TU0VDIHByb3Zp ZGVycyBhcmUgR29vZ2xlIGFuZCBDbG91ZGZsYXJlPzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjE0LjBw dCI+W0pMXSBQbGVhc2Ugbm90ZSB0aGF0IENvbWNhc3QgcGVyZm9ybXMgRE5TU0VDLXZhbGlkYXRp b24gaW4gdGhlIFVTIGZvciBvdXIgY3VzdG9tZXJzLiBJU1BzIGluIG90aGVyIGNvdW50cmllcyBk byBhcyB3ZWxsLiBTbyBpdOKAmXMgbm90IGp1c3QgdGhlIGJpZyBxdWFkIHBsYXRmb3Jtcy4gVGhh dCBpc27igJl0IHRvIHNheSB0aGF0IEROU1NFQyBkZXBsb3ltZW50IGRvZXNu4oCZdA0KIHN0aWxs IGhhdmUgYSB3YXlzIHRvIGdvLCBidXQgc3VjaCBpcyBsaWZlLiBGb3IgcmVmZXJlbmNlLCBzZWUg PC9zcGFuPjxhIGhyZWY9Imh0dHBzOi8vY29ycG9yYXRlLmNvbWNhc3QuY29tL2NvbWNhc3Qtdm9p Y2VzL2Ruc3NlYy1kZXBsb3ltZW50LXVwZGF0ZSI+aHR0cHM6Ly9jb3Jwb3JhdGUuY29tY2FzdC5j b20vY29tY2FzdC12b2ljZXMvZG5zc2VjLWRlcGxveW1lbnQtdXBkYXRlPC9hPjxvOnA+PC9vOnA+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxNC4wcHQi PmFuZCA8L3NwYW4+PGEgaHJlZj0iaHR0cHM6Ly9jb3Jwb3JhdGUuY29tY2FzdC5jb20vY29tY2Fz dC12b2ljZXMvY29tY2FzdC1jb21wbGV0ZXMtZG5zc2VjLWRlcGxveW1lbnQiPmh0dHBzOi8vY29y cG9yYXRlLmNvbWNhc3QuY29tL2NvbWNhc3Qtdm9pY2VzL2NvbWNhc3QtY29tcGxldGVzLWRuc3Nl Yy1kZXBsb3ltZW50PC9hPi4NCjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxNC4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTQuMHB0Ij5K YXNvbjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5i c3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2JvZHk+DQo8 L2h0bWw+DQo= --_000_FD390CE2922847A1A59221615D530750cablecomcastcom_-- From nobody Thu Aug 22 15:44:31 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D71E5120098 for ; Thu, 22 Aug 2019 15:44:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=comcast.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CDEbai-G1TZL for ; Thu, 22 Aug 2019 15:44:28 -0700 (PDT) Received: from copdcmhout01.cable.comcast.com (copdcmhout01.cable.comcast.com [162.150.44.71]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 31685120089 for ; Thu, 22 Aug 2019 15:44:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; d=comcast.com; s=20190412; c=relaxed/simple; q=dns/txt; i=@comcast.com; t=1566513850; x=2430427450; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:CC:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=9YM0CXsPl256NKN7PDHHEF6DKB/qeD96T3zCr0NWT2I=; b=Yhrmq64vXz/8cIfqQep8x/uZKQwx6LvPcBeayuM/EQ+XpgrveASoba8BZoTEuzjb 8ObqLXx3FazK4Uf20bT57sOjo3l95WHfb7jvaZyUCsndyhnDgv0e01wNO1+Jd8SH eRKmh0MgwkE02fedTN5FplYngXoq3DcrTlWTji8Iqy7MR23SXvb0jg/jYhKh0kA+ Px7mq3e3NqEFqq44vTrLdXZqhKZ189nIl8ukL5iJxBbebwPJLAEI6NMwZMeae+4H dKivB9Vg1s5kGO+x/zqXG/pdYMQ9SPpRbAb8iUAMLYM1WSArZ3/C0RXxIoYBArXu zNJ1pgr85IaaKN/fzu+f/g==; X-AuditID: a2962c47-a9fff7000002e144-5f-5d5f1abab2ef Received: from COPDCEXC40.cable.comcast.com (copdcmhoutvip.cable.comcast.com [96.114.156.147]) (using TLS with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (Client did not present a certificate) by copdcmhout01.cable.comcast.com (SMTP Gateway) with SMTP id D7.5B.57668.ABA1F5D5; Thu, 22 Aug 2019 16:44:10 -0600 (MDT) Received: from COPDCEXC37.cable.comcast.com (147.191.125.136) by COPDCEXC40.cable.comcast.com (147.191.125.139) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1713.5; Thu, 22 Aug 2019 18:44:26 -0400 Received: from COPDCEXC37.cable.comcast.com ([fe80::3aea:a7ff:fe36:8a94]) by COPDCEXC37.cable.comcast.com ([fe80::3aea:a7ff:fe36:8a94%15]) with mapi id 15.01.1713.008; Thu, 22 Aug 2019 18:44:26 -0400 From: "Livingood, Jason" To: Stephen Farrell , Ted Hardie , Jari Arkko CC: Eric Rescorla , ADD Mailing list Thread-Topic: [Add] What to do in this potential working group Thread-Index: AQHVV5Ij9AP+pxnvJEqQu+QNkzMYhKcFiL2AgAAo9ICAAHAxAIAAJ4+AgAF9toA= Date: Thu, 22 Aug 2019 22:44:26 +0000 Message-ID: <94027E38-B5D0-4DF9-B24F-916AC14CC2F5@cable.comcast.com> References: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> <8f856492-f5da-9a02-f76d-67c2795b2ecc@cs.tcd.ie> In-Reply-To: <8f856492-f5da-9a02-f76d-67c2795b2ecc@cs.tcd.ie> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.1c.0.190812 x-originating-ip: [96.114.156.9] Content-Type: text/plain; charset="utf-8" Content-ID: <80130D70D24196479F2E32F3A0CF303F@comcast.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-CFilter-Loop: Forward X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFjrKKsWRmVeSWpSXmKPExsWSUDRnsu4uqfhYg7WXhSz+n17HZrHi9Tl2 ixn7VrBZTN97jd2ica6dA6vH2u6rbB47Z91l91iy5CeTx9Yl09k8Jj9uYw5gjWpgtCnJKEpN LHFJTUvNK06141LAADZJqWn5RamuiUU5lUGpOamJ2JWBVKak5mSWpRbpYzVGH6s5CV1MGQu2 r2Yq6OGo2DJlFlMD4wf2LkZODgkBE4nPfR+Zuhi5OIQEjjBJzL04hQ3CaWGS2P78PJRzmlFi zccWNpAWNgEzibsLrzCD2CICpRL7p+1iBLGZBRwl7l2YC2YLC9hKzO28zQ5RYyfx9Oc+Jgjb T+L7+UcsIDaLgKrE0lkbwOp5BVwkep6uZYZYtoFJ4sLEdaxdjBwcnECD5h0Hq2cUEJP4fmoN E8QucYlbT+YzQbwgILFkz3lmCFtU4uXjf6wgtqiAvsSSH5tZIeIKEu//nWIDGcksoCmxfpc+ xBgriY/Nj5khbEWJKd0P2SHOEZQ4OfMJC0SruMThIztYJzBKzkKyeRbCpFlIJs1CMmkWkkkL GFlXMfIamhnpGZoa6JmY6JkbbmIEJq5F03TcdzB+OB97iFGAg1GJh1eaIz5WiDWxrLgy9xCj BAezkghv2cS4WCHelMTKqtSi/Pii0pzU4kOM0hwsSuK8d7tiY4UE0hNLUrNTUwtSi2CyTByc Ug2MhefO9wppqUwXSuzUnrueY+spg1L7M2Eb4h6LfTjB6z7ZfBkTO+/Cj5vqjDQ1/xzjPFe2 ZUHB9xOipw8pPJ21oe7PjY+con/WPm74t3Jyw5WvXrMeNS2I5Q9+m6ajmF6mkXTM8Hdezk3b o+pdWiHS1//NYNNZ+t1LQDA1YWbEgWb1HIvikm9PlViKMxINtZiLihMB6n3z21gDAAA= Archived-At: Subject: Re: [Add] What to do in this potential working group X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 22 Aug 2019 22:44:30 -0000 T24gOC8yMS8xOSwgMzo1OCBQTSwgIkFkZCBvbiBiZWhhbGYgb2YgU3RlcGhlbiBGYXJyZWxsIiA8 YWRkLWJvdW5jZXNAaWV0Zi5vcmcgb24gYmVoYWxmIG9mIHN0ZXBoZW4uZmFycmVsbEBjcy50Y2Qu aWU+IHdyb3RlOg0KPiAgICBNb3ppbGxhIHNlZW0gd2lsbGluZyBzbyBmYXIgYW5kIEknZCBzdXJl IGFjYWRlbWljIHJlc2VhcmNoZXJzDQogICAgd2lsbCBmaW5kIHRoaXMgYW4gYXR0cmFjdGl2ZSBz cGFjZSB0byBleHBsb3JlIChJIGJldCBhIGJlZXIgd2UNCiAgICBzZWUgYSByYWZ0IG9mIHB1Ymxp Y2F0aW9ucyBpbiB0aGUgbmV4dCB5ZWFyIG9yIHNvOi0pLiANCg0KW0pMXSBJIGNoYWlyIGEgZ3Jh bnRzIGZ1bmQgYXQgd29yayAtIHRoZSBDb21jYXN0IElubm92YXRpb24gRnVuZCAtIGh0dHBzOi8v aW5ub3ZhdGlvbmZ1bmQuY29tY2FzdC5jb20vLiBJZiBhbnkgYWNhZGVtaWNzIHJlYWRpbmcgdGhp cyBoYXZlIGludGVyZXN0aW5nIHJlc2VhcmNoIHByb3Bvc2FscyAob3Igb3BlbiBzb3VyY2Ugc29m dHdhcmUgZGV2ZWxvcG1lbnQgcHJvcG9zYWxzKSBvbiB0aGlzIHN1YmplY3QsIHlvdSBjYW4gcG9z dCB0aGVtIGF0IHRoYXQgVVJMLiBXZSBqdXN0IGFwcHJvdmVkIGEgZmV3IERvSC1yZWxhdGVkIHRo aW5ncyAobm90IHlldCBhbm5vdW5jZWQpLiBTbywgSSB3b24ndCBiZXQgeW91IHRoYXQgYmVlciBi dXQgSSdkIGJlIG1vcmUgdGhhbiBoYXBweSB0byBoYXZlIGEgYmVlciB3aXRoIHlvdSBhbnl3YXkh IDotKQ0KICAgIA0KDQo= From nobody Thu Aug 22 16:11:57 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2572C1200A3 for ; Thu, 22 Aug 2019 16:11:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ECAdwQN7vg_v for ; Thu, 22 Aug 2019 16:11:52 -0700 (PDT) Received: from mail-io1-xd2c.google.com (mail-io1-xd2c.google.com [IPv6:2607:f8b0:4864:20::d2c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9A228120089 for ; Thu, 22 Aug 2019 16:11:52 -0700 (PDT) Received: by mail-io1-xd2c.google.com with SMTP id e20so15628758iob.9 for ; Thu, 22 Aug 2019 16:11:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=joqnvH7HqJdk1jgtl6eoibhB9fGqQNPsDe54yX+EqsM=; b=A3d7Unfi1pYxojNvuwrV5jslfh5cL6seJcWa6WXJC2yWjeDTo72luOhWOfGoq5nLxt yEjjwI/PNGQmAXCrB8BztgHiXgmeFj4AdV/2B/5KQ0D4XT7lwxBosNTOrJJGEUqfLCgO ro5lYr6SqCGffSgoTMS6Mp6Pd6OLT3p+GJ/JCMKzBDF5RLNhTJcjjWfAb+efPnPOwa0W qPN0qZG+aniSE6Phfbv5lC7bDTdRgY57ci/Zgpv+Z1ZJda9epeuUdKnzFWtbCdeoTDvi sYqgcM4L6j4AG1cBQn5OynWbjtJebgljRVFY+tH/bvbqiWykaXb5wYz8Hx/1zC2KAteM l37A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=joqnvH7HqJdk1jgtl6eoibhB9fGqQNPsDe54yX+EqsM=; b=rgGryNnph4s9ZA8T3ZOLjnJqhaNM6bL+TcoT5C1qef4e32lerxOJKGoOuGKX5VPODm mIoyLZ/fD2/ZBT0i1DHqYc5Lrv/bnsN51hrOAfbQFCGd7wa6sJp14copndECQv9EVCUl BxuO0T4+j5uu55AXbB0cKYM9my/88gM4+vkCXQUP3Pk0nrCdOaldk+HAPd5Krn7kKvrh dyuYvLu0x9mH9EtKQUauGse4E7Dw5k8MD6rZM+s2EjSwPEs14finnk+YNoQbwecRxOzp SvLeEGDlirodBd51onorwRH5DJ7Tz9OZr3nGlOwYKCs6rjxZ97Uv7HS2OyawP/BlQgen nrtw== X-Gm-Message-State: APjAAAWzI+O+bn6VpUUtNhI/bcv6fkInLPllZGn2eS++2F8TJLt82W4U hZZ81calH83RqMPiBdLkWP3XxlNxxyakcpKN4Mc= X-Google-Smtp-Source: APXvYqwv2qHZ7vdFEyeqTwIcmyWc5vnhsZD1QBpvG8jcAOBYvRE2YvaKPpfSsX/9bS97FNF4es79wG5P2QP3L8viSfg= X-Received: by 2002:a6b:7e07:: with SMTP id i7mr2996636iom.254.1566515511751; Thu, 22 Aug 2019 16:11:51 -0700 (PDT) MIME-Version: 1.0 References: <1444D5E7-DEA7-437C-B12B-6C31FEA563DD@sky.uk> <11f9dfe2-ab05-2227-7643-e53da95ec717@nostrum.com> <94429d81-d225-0e30-04d9-f52f68ddcaa2@nostrum.com> In-Reply-To: <94429d81-d225-0e30-04d9-f52f68ddcaa2@nostrum.com> From: Rob Sayre Date: Thu, 22 Aug 2019 16:11:38 -0700 Message-ID: To: Adam Roach Cc: Tommy Jensen , "Winfield, Alister" , "add@ietf.org" Content-Type: multipart/alternative; boundary="0000000000009cf7b10590bcd042" Archived-At: Subject: Re: [Add] A thought -- Move the policy decisions outside the application. X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 22 Aug 2019 23:11:56 -0000 --0000000000009cf7b10590bcd042 Content-Type: text/plain; charset="UTF-8" On Thu, Aug 22, 2019 at 11:26 AM Adam Roach wrote: > On 8/22/19 12:41 PM, Tommy Jensen wrote: > > I'll point out since the topic is up, that GPO and parental controls are > not the only sources of DNS stub configuration in Windows. For example, > NRPT rules, which specify behavior for a given domain name pattern, can be > created by device admin authority for a number of reasons. For anyone who > is interested, you can see PowerShell commands related to getting and > setting NRPT rules here [2]. > > > I've been digging through these commands recently (for reasons very > similar to what you imply), and was wondering whether there was some API > (rather than calling out to commandline executables) that could be used to > retrieve this and similar information (like DNS search lists). Do you know? > Chromium has some code for this in "dns_config_service_win.cc". It looks like they just use a generic Windows registry search routine to fish out the values. The NRPT code looks incomplete, but it is there. thanks, Rob --0000000000009cf7b10590bcd042 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Thu, Aug 22, 2019 at 11:26 AM Adam= Roach <adam@nostrum.com> wro= te:
=20 =20 =20
On 8/22/19 12= :41 PM, Tommy Jensen wrote:
I'll point out since the topic is up, that GPO and parental controls are not the only sources of DNS stub configuration in Windows. For example, NRPT rules, which specify behavior for a given domain name pattern, can be created by device admin authority for a number of reasons. For anyone who is interested, you can see PowerShell commands related to getting and setting NRPT rules here [2].=C2=A0


I've been digging through these commands recently (for reasons very similar to what you imply), and was wondering whether there was some API (rather than calling out to commandline executables) that could be used to retrieve this and similar information (like DNS search lists). Do you know?

Chromium h= as some code for this in "dns_config_service_win.cc". It looks li= ke they just use a generic Windows registry search routine to fish out the = values. The NRPT code looks incomplete, but it is there.

thanks,
Rob
=C2=A0
--0000000000009cf7b10590bcd042-- From nobody Thu Aug 22 16:48:26 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 43D5112011B for ; Thu, 22 Aug 2019 16:48:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=comcast.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4bn46IdB0gJv for ; Thu, 22 Aug 2019 16:48:22 -0700 (PDT) Received: from copdcmhout02.cable.comcast.com (copdcmhout02.cable.comcast.com [96.114.158.212]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7FB69120089 for ; Thu, 22 Aug 2019 16:48:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; d=comcast.com; s=20190412; c=relaxed/simple; q=dns/txt; i=@comcast.com; t=1566517701; x=2430431301; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=PCPRJ1yZuOg/tibJflZgTdaf4RhoEAY0oYFo2R7G7i8=; b=i6OchnyfM8qNsTY6UTkSkWN4NsjTGpD9CfHQBHslkKz0GU1nRIsL9U+COpv7fsMP qqFdFkG78LMRZXnhyai++LvsXuyADuDg28hIWOTX31zrakZHljjOfs9A4iBe2dPy IMbnBzud97cG4CJoUdNIoNI6A8ffIzs06+RAaj5PL+ebovtgzIb490zAHGTFX7FH 723RtsHIWc/1MS3akCtC+pK5lBGvGHXD1Xdl4IyVYRnBDzaG820GWMvLfQ32CESW Acd45fwW3/cBCnxI1aPFOsbzfMxXRC/rb30YUo2c1SPpgdumT5J+8+SCZWyjw+Fw 1XRDpTGGj3RZf66mnwkZKg==; X-AuditID: 60729ed4-227ff700000013e0-05-5d5f29c5770a Received: from COPDCEXC37.cable.comcast.com (copdcmhoutvip.cable.comcast.com [96.114.156.147]) (using TLS with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (Client did not present a certificate) by copdcmhout02.cable.comcast.com (SMTP Gateway) with SMTP id 0B.1E.05088.5C92F5D5; Thu, 22 Aug 2019 17:48:21 -0600 (MDT) Received: from COPDCEXC37.cable.comcast.com (147.191.125.136) by COPDCEXC37.cable.comcast.com (147.191.125.136) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1713.5; Thu, 22 Aug 2019 19:48:20 -0400 Received: from COPDCEXC37.cable.comcast.com ([fe80::3aea:a7ff:fe36:8a94]) by COPDCEXC37.cable.comcast.com ([fe80::3aea:a7ff:fe36:8a94%15]) with mapi id 15.01.1713.008; Thu, 22 Aug 2019 19:48:20 -0400 From: "Livingood, Jason" To: Adam Roach , "add@ietf.org" Thread-Topic: [Add] What to do in this potential working group Thread-Index: AQHVV5Ij9AP+pxnvJEqQu+QNkzMYhKcFiL2AgAAo9ICAAHAxAIAAO8gAgAAEp4CAAXawgA== Date: Thu, 22 Aug 2019 23:48:20 +0000 Message-ID: References: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> <279abf8c-198b-5da8-1cb9-4f86bf1f37c7@nostrum.com> In-Reply-To: <279abf8c-198b-5da8-1cb9-4f86bf1f37c7@nostrum.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.1c.0.190812 x-originating-ip: [96.115.73.253] Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-CFilter-Loop: Forward X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFprHKsWRmVeSWpSXmKPExsWSUDRnsu5RzfhYg73/+C32/F3EbvH/9Do2 ByaPJUt+MnnM2vmEJYApqoHRpiSjKDWxxCU1LTWvONWOSwED2CSlpuUXpbomFuVUBqXmpCZi VwZSmZKak1mWWqSP1Rh9rOYkdDFl/Nh+k73gAl/F/SWz2BsYF/B1MXJySAiYSGxYPIWpi5GL Q0jgCJPEzK1rWCGcFiaJfW1bGSGc04wSa/fvZwNpYRMwk7i78AoziC0i4CAx/f8VFhBbWMBW Ym7nbXaIuJ3E05/7mCDsMInlf56zgtgsAqoSty5+ALN5BVwkplzcww6x4CmTxOlll8AWcArY S9ydfhSsmVFATOL7qTVgNrOAuMStJ/OZIO4WkFiy5zwzhC0q8fLxP7ChogL6Ekt+bGaFiCtK 7PuwAqiGA6hXU2L9Ln2IMVYSa99vYoSwFSWmdD9kh7hHUOLkzCcsEK3iEoeP7GCdwCgxC8nm WQiTZiGZNAvJpFlIJi1gZF3FyGdppmdoaKJnaGqhZ2RotIkRnGrmXdnBeHm6xyFGAQ5GJR7e 5SrxsUKsiWXFlbmHGCU4mJVEeMsmxsUK8aYkVlalFuXHF5XmpBYfYpTmYFES52Xtjo0VEkhP LEnNTk0tSC2CyTJxcEo1MJa/Ob+AZ2/ZVMXl3384WX1iTd395B9v0M5rnokt5g7vxF6tlT31 /V7lyqS1IrbaBybLH53R+ijO/tSkJstUq++pWu+Wd7DLp9kqhcbv+fSV40xv6xrWsAi5b4F3 O2sUc30WL7bkLb5RbZ6d3l4WucSlb+lqAW0mr8ZWextHxc5rnSJO7jqGSizFGYmGWsxFxYkA 8pb+oDEDAAA= Archived-At: Subject: Re: [Add] What to do in this potential working group X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 22 Aug 2019 23:48:24 -0000 T24gOC8yMS8xOSwgNTozNCBQTSwgIkFkZCBvbiBiZWhhbGYgb2YgQWRhbSBSb2FjaCIgPGFkZC1i b3VuY2VzQGlldGYub3JnIG9uIGJlaGFsZiBvZiBhZGFtQG5vc3RydW0uY29tPiB3cm90ZToNCj4g ICAgSSByZWFsbHkgd2lzaCBwZW9wbGUgd291bGRuJ3QgcGVyc2lzdCBpbiBpZ25vcmluZyByZXBl YXRlZCBleHBsYW5hdGlvbnMgDQogICAgdGhhdCBGaXJlZm94IChhdCBsZWFzdCkgd2lsbCBoYXZl IGFjdHVhbCB1c2VyIGludGVyYWN0aW9uIGF0IHRoZSB0aW1lIA0KICAgIHRoYXQgRG9IIGlzIG1h ZGUgYXZhaWxhYmxlIGluIGEgdXNlcidzIHJlZ2lvbiwgd2l0aCBhIG9uZS1jbGljayBvcHRpb24g DQogICAgdG8gdHVybiBpdCBvZmYuIA0KDQpbSkxdIEl0IG1pZ2h0IGJlIHVzZWZ1bCwgd2hlbiB5 b3VyIFVYIHRlYW0gaXMgcmVhZHksIHRvIHNoYXJlIHdoYXQgdGhlIHVzZXIgaW50ZXJhY3Rpb24g ZmxvdyB3aWxsIGxvb2sgbGlrZSwgaG93IHRoZSBjaG9pY2VzIGFyZSBwcmVzZW50ZWQsIGFuZCB3 aGF0IHRoZSBkZWZhdWx0cyBhcmUuIFRoaXMgY291bGQgbGVhZCB0aGUgd2F5IGZvciBvdGhlcnMg YW5kIGhlbHAgZXN0YWJsaXNoIGJlc3QgcHJhY3RpY2VzIGFuZCB0cmFuc3BhcmVuY3kuIENlcnRh aW5seSB0aGVyZSdzIGJlZW4gbG90cyBvZiBkaXNjdXNzaW9ucyBvbiAnZGFyayBwYXR0ZXJucycg aW4gVVggZGVzaWduIChzZWUgaHR0cHM6Ly9naXptb2RvLmNvbS9zZW5hdG9ycy1pbnRyb2R1Y2Ut YmlsbC10by1zdG9wLWRhcmstcGF0dGVybnMtaHVnZS1wbGF0LTE4MzM5MjkyNzYpLCBzbyBJIHRo aW5rIGVuZCB1c2VycyBhcmUgZ2V0dGluZyBpbmNyZWFzaW5nbHkgc2Vuc2l0aXplZCB0byBob3cg aW50ZXJmYWNlIGRlc2lnbiBjaG9pY2VzIGNhbiBkcml2ZSB1c2VyIHNlbGVjdGlvbnMvYmVoYXZp b3IuIA0KDQpbSkxdIElmIHRoZSBUUlIgcHJvZ3JhbSBpcyBzdWNjZXNzZnVsIHRoZW4geW91J2xs IGJlIGFkZGluZyBuZXcgVFJScyBhbGwgdGhlIHRpbWUuIEFzIGEgcmVzdWx0LCBpdCBtaWdodCBh bHNvIGJlIHVzZWZ1bCB0byBkZXNjcmliZSB3aGV0aGVyIHVzZXJzIHdpbGwgYmUgcHJvbXB0ZWQg YWdhaW4vcGVyaW9kaWNhbGx5IGluIHRoZSBmdXR1cmUsIHN1Y2ggYXMgd2hlbiBhIG5ldyBUUlIg d2FzIGRldGVjdGVkIHRoYXQgaXMgbG9jYWwgdG8gdGhlbSAoZS5nLiBvbi1uZXR3b3JrIHZpYSB0 aGVpciBJU1ApIGFuZCBzdWdnZXN0aW5nIHRoZXkgbWF5IHdpc2ggdG8gc3dpdGNoIHRvIHRoYXQg b25lIC0tIG9yIHdoYXQgaGFwcGVucyB3aGVuIGEgY2hhbmdlIGluIGdlb2dyYXBoeSBpcyBkZXRl Y3RlZCAoZS5nLiB0aGUgdXNlciBoYXMgbW92ZWQgZnJvbSBOWUMgdG8gVG9reW8pLiANCg0KDQo= From nobody Thu Aug 22 17:03:12 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id ECB86120089 for ; Thu, 22 Aug 2019 17:03:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=comcast.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id w7NQjdBzuOtU for ; Thu, 22 Aug 2019 17:03:09 -0700 (PDT) Received: from copdcmhout02.cable.comcast.com (copdcmhout02.cable.comcast.com [96.114.158.212]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 78F8C120043 for ; Thu, 22 Aug 2019 17:03:09 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; d=comcast.com; s=20190412; c=relaxed/simple; q=dns/txt; i=@comcast.com; t=1566518585; x=2430432185; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:CC:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=Yi0xGieL5A4zHtmrApLcOGddplOm1NVe4Jf5ElBSXQI=; b=HqDXqqtaEhvgesDV8y+AS9PqOjLeS/o/Iz7BVjZ6c3UtqqZ9KvKPp6lze7PsxD3I Pbq+QH4c1wxYV6o1JwmCRZzJVu3pY4LewF23RxhUyDOx33W0M4o+4ktpsSmS4Joz 0hM2ojsffGoGAAbi1fddVg2MBiJ+FOAuHIRL+hIX8fBZBPBgIiHmtKfV1EklNnms pBKVxHuK8HnZoh227uARrTuSPXtYAzs2gC/MuWQDZbxFgU/w5Ciihbmfk8vlA6Dh 6gjVErCuXpgsbhnE+ROF7UkwWPg6Z/4SAyQv5xtDpe9PBC7OqKBIXpavabi0w3Rn aDns71dAQbpax3PDklXbLg==; X-AuditID: 60729ed4-227ff700000013e0-38-5d5f2d393a28 Received: from COPDCEXC38.cable.comcast.com (copdcmhoutvip.cable.comcast.com [96.114.156.147]) (using TLS with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (Client did not present a certificate) by copdcmhout02.cable.comcast.com (SMTP Gateway) with SMTP id 9D.DE.05088.93D2F5D5; Thu, 22 Aug 2019 18:03:05 -0600 (MDT) Received: from COPDCEXC37.cable.comcast.com (147.191.125.136) by COPDCEXC38.cable.comcast.com (147.191.125.137) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1713.5; Thu, 22 Aug 2019 20:03:04 -0400 Received: from COPDCEXC37.cable.comcast.com ([fe80::3aea:a7ff:fe36:8a94]) by COPDCEXC37.cable.comcast.com ([fe80::3aea:a7ff:fe36:8a94%15]) with mapi id 15.01.1713.008; Thu, 22 Aug 2019 20:03:05 -0400 From: "Livingood, Jason" To: Eric Rescorla , Jari Arkko CC: ADD Mailing list Thread-Topic: [Add] What to do in this potential working group Thread-Index: AQHVV5Ij9AP+pxnvJEqQu+QNkzMYhKcFiL2AgAJUYoA= Date: Fri, 23 Aug 2019 00:03:04 +0000 Message-ID: <7A41A54B-A4CA-4FE5-B0BA-AEACD1D9E105@cable.comcast.com> References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.1c.0.190812 x-originating-ip: [96.114.156.9] Content-Type: multipart/alternative; boundary="_000_7A41A54BA4CA4FE5B0BAAEACD1D9E105cablecomcastcom_" MIME-Version: 1.0 X-CFilter-Loop: Forward X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFtrHKsWRmVeSWpSXmKPExsWSUDRnsq6lbnysweJ+M4v/p9exWax4fY7d Ysa+FWwOzB5Llvxk8ti6ZDqbx+THbcwBzFENjDYlGUWpiSUuqWmpecWpdlwKGMAmKTUtvyjV NbEopzIoNSc1EbsykMqU1JzMstQifazG6GM1J+EKU8bFrjPsBW2WFZOPNzA2MG4172Lk4JAQ MJF4cNqki5GLQ0jgCJPEsTNL2SGcFiaJ15NaWSCc04wSF45fZ+5i5ORgEzCTuLvwCpgtIuAs ce7IIxYQm1lAWaLlyV2wuLCArcTcztvsEDV2Ek9/7mOCsK0kVr4+zQqymUVAVeLNFXUQk1fA RWL35GiIVc2MEif7fzOClHMKBEpc290GNpJRQEzi+6k1TBCrxCVuPZkPZksICEgs2XOeGcIW lXj5+B8riC0qoC+x5MdmVoi4gsT7f6fYIHrTJa72nAM7jVdAUOLkzCcsEDXiEoeP7GCdwCg+ C8mKWUhaZiFpmQV0NrOApsT6XfoQJYoSU7ofskPYGhKtc+ZC2VYSzecfsSCrWcDIsYqRz9JM z9DQRM/Q1ELPyNBoEyM4Vc27soPx8nSPQ4wCHIxKPLzLVeJjhVgTy4orcw8xSnAwK4nwlk2M ixXiTUmsrEotyo8vKs1JLT7EKM3BoiTOy9odGyskkJ5YkpqdmlqQWgSTZeLglGpgzN0963nu iQf7V7TIiff6/z7aGZbUvztFtWy1R+9Wy7YbEvXswftXaW8123EhZFOI6bSYxM8pO3+pM3zp nl63Ifqx3wT7oJ+8loneW51P7DDz+c5k5Z1m8fvznLmtvrG7a1gDT63ItwoSqArm8y6QmDRn HedP2RfLI3j2fbjrwtZhE5ecavFDiaU4I9FQi7moOBEA/yXijVEDAAA= Archived-At: Subject: Re: [Add] What to do in this potential working group X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 23 Aug 2019 00:03:11 -0000 --_000_7A41A54BA4CA4FE5B0BAAEACD1D9E105cablecomcastcom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 RnJvbTogQWRkIDxhZGQtYm91bmNlc0BpZXRmLm9yZz4gb24gYmVoYWxmIG9mIEVyaWMgUmVzY29y bGEgPGVrckBydGZtLmNvbT4NClN1YmplY3Q6IFJlOiBbQWRkXSBXaGF0IHRvIGRvIGluIHRoaXMg cG90ZW50aWFsIHdvcmtpbmcgZ3JvdXANCg0KPj4gT24gVHVlLCBBdWcgMjAsIDIwMTkgYXQgMTow MSBQTSBKYXJpIEFya2tvIDxqYXJpLmFya2tvQHBpdWhhLm5ldDxtYWlsdG86amFyaS5hcmtrb0Bw aXVoYS5uZXQ+PiB3cm90ZToNCiogUmVjb21tZW5kYXRpb24gdGhhdCBoYXZpbmcgZGV2aWNlcyBv ciBhcHBzIOKAnGNhbGwgaG9tZeKAnSBmb3IgZXZlcnkgdXNlciBhY3Rpb24gdG8gYSBjZW50cmFs aXNlZCBnbG9iYWwgc2VydmljZSBpcyBiYWQgcHJhY3RpY2UgYW5kIHNob3VsZCBiZSBhdm9pZGVk DQoNCj4gSSBjZXJ0YWlubHkgYWdyZWUgdGhhdCBjZW50cmFsaXphdGlvbiBpcyBub3QgaWRlYWws IGJ1dCB0aGlzIHJlY29tbWVuZGF0aW9uIG5lZWRzIHRvIGJlIGJhbGFuY2VkIGFnYWluc3Qgb3Ro ZXIgdmFsdWVzLCBpbiB0aGlzIGNhc2UsIGhhdmluZyB0aGUgRE5TIHF1ZXJpZXMgZ28gdG8gYSBw cm92aWRlciB3aXRoIGRldGVybWluZWQsIGFjY2VwdGFibGUsIHByaXZhY3kgcG9saWNpZXMgLS0g d2hpY2gsIGFmdGVyIGFsbCwgaXMgaG93IHdlIGdvdCBoZXJlIGluIHRoZSBmaXJzdCBwbGFjZS4g U28sIG5vLCBJIGRvbid0IHRoaW5rIHRoYXQgdGhpcyBwcm9wb3NlZCByZWNvbW1lbmRhdGlvbiB3 b3VsZCBiZSByaWdodCBhcy1pcy4NCg0KW0pMXSBPbiB0aGlzIG5hcnJvdyBwb2ludCwgSSBkbyB0 aGluayB0aGF0IG9uZSBvZiB0aGUgY29yZSBjb25jZXJucyB0aGF0IEkgaGVhciBmcm9tIG1hbnkg cGVvcGxlIHN0ZW1zIGZyb20gdGhlIHJpc2tzLCBpc3N1ZXMsIGFuZCBsb25nLXRlcm0gZWZmZWN0 cyBvZiBjZW50cmFsaXphdGlvbi4gSW50ZXJlc3RpbmdseSBpbiB0aGlzIGNhc2UgaXQgYXBwZWFy cyB0byBiZSBjZW50cmFsaXphdGlvbiBpbiBjb21iaW5hdGlvbiB3aXRoIHBlcmNlaXZlZCwgYWN0 dWFsLCBvciBwb3RlbnRpYWwgbWFya2V0IHNoYXJlIC8gcG93ZXIgLyBjb250cm9sLCB3aGljaCBj b21lcyBhdCBhIHRpbWUgc29jaWFsbHkgYW5kIHBvbGl0aWNhbGx5IG9mIGluY3JlYXNpbmcgY29u Y2VybnMgb3ZlciBjZW50cmFsaXphdGlvbiBpdHMgZWZmZWN0cyBvbiBzb2NpZXRpZXMuDQo= --_000_7A41A54BA4CA4FE5B0BAAEACD1D9E105cablecomcastcom_ Content-Type: text/html; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2 IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToy IDE1IDUgMiAyIDIgNCAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OiJUaW1lcyBO ZXcgUm9tYW4gXChCb2R5IENTXCkiOw0KCXBhbm9zZS0xOjIgMTEgNiA0IDIgMiAyIDIgMiA0O30N Ci8qIFN0eWxlIERlZmluaXRpb25zICovDQpwLk1zb05vcm1hbCwgbGkuTXNvTm9ybWFsLCBkaXYu TXNvTm9ybWFsDQoJe21hcmdpbjowaW47DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQt c2l6ZToxMS4wcHQ7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0KYTpsaW5r LCBzcGFuLk1zb0h5cGVybGluaw0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6Ymx1 ZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCmE6dmlzaXRlZCwgc3Bhbi5Nc29IeXBl cmxpbmtGb2xsb3dlZA0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6cHVycGxlOw0K CXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KcC5Nc29MaXN0UGFyYWdyYXBoLCBsaS5Nc29M aXN0UGFyYWdyYXBoLCBkaXYuTXNvTGlzdFBhcmFncmFwaA0KCXttc28tc3R5bGUtcHJpb3JpdHk6 MzQ7DQoJbWFyZ2luLXRvcDowaW47DQoJbWFyZ2luLXJpZ2h0OjBpbjsNCgltYXJnaW4tYm90dG9t OjBpbjsNCgltYXJnaW4tbGVmdDouNWluOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250 LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCnAubXNv bm9ybWFsMCwgbGkubXNvbm9ybWFsMCwgZGl2Lm1zb25vcm1hbDANCgl7bXNvLXN0eWxlLW5hbWU6 bXNvbm9ybWFsOw0KCW1zby1tYXJnaW4tdG9wLWFsdDphdXRvOw0KCW1hcmdpbi1yaWdodDowaW47 DQoJbXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87DQoJbWFyZ2luLWxlZnQ6MGluOw0KCWZvbnQt c2l6ZToxMS4wcHQ7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0Kc3Bhbi5F bWFpbFN0eWxlMTgNCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWwtcmVwbHk7DQoJZm9udC1mYW1p bHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6d2luZG93dGV4dDt9DQouTXNvQ2hwRGVm YXVsdA0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250LXNpemU6MTAuMHB0O30N CkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjguNWluIDExLjBpbjsNCgltYXJnaW46MS4waW4g MS4waW4gMS4waW4gMS4waW47fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9u MTt9DQotLT48L3N0eWxlPg0KPC9oZWFkPg0KPGJvZHkgbGFuZz0iRU4tVVMiIGxpbms9ImJsdWUi IHZsaW5rPSJwdXJwbGUiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2NvbG9yOmJsYWNrIj5G cm9tOiA8L3NwYW4+PC9iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2NvbG9yOmJsYWNr Ij5BZGQgJmx0O2FkZC1ib3VuY2VzQGlldGYub3JnJmd0OyBvbiBiZWhhbGYgb2YgRXJpYyBSZXNj b3JsYSAmbHQ7ZWtyQHJ0Zm0uY29tJmd0Ozxicj4NCjxiPlN1YmplY3Q6IDwvYj5SZTogW0FkZF0g V2hhdCB0byBkbyBpbiB0aGlzIHBvdGVudGlhbCB3b3JraW5nIGdyb3VwPG86cD48L286cD48L3Nw YW4+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9w Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mZ3Q7Jmd0OyBPbiBUdWUsIEF1 ZyAyMCwgMjAxOSBhdCAxOjAxIFBNIEphcmkgQXJra28gJmx0OzxhIGhyZWY9Im1haWx0bzpqYXJp LmFya2tvQHBpdWhhLm5ldCI+amFyaS5hcmtrb0BwaXVoYS5uZXQ8L2E+Jmd0OyB3cm90ZTo8bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRl ci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowaW4gMGluIDBpbiA2LjBwdDttYXJn aW4tbGVmdDo0LjhwdDttYXJnaW4tcmlnaHQ6MGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiog UmVjb21tZW5kYXRpb24gdGhhdCBoYXZpbmcgZGV2aWNlcyBvciBhcHBzIOKAnGNhbGwgaG9tZeKA nSBmb3IgZXZlcnkgdXNlciBhY3Rpb24gdG8gYSBjZW50cmFsaXNlZCBnbG9iYWwgc2VydmljZSBp cyBiYWQgcHJhY3RpY2UgYW5kIHNob3VsZCBiZSBhdm9pZGVkPG86cD48L286cD48L3A+DQo8L2Js b2NrcXVvdGU+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mZ3Q7IEkgY2VydGFpbmx5 IGFncmVlIHRoYXQgY2VudHJhbGl6YXRpb24gaXMgbm90IGlkZWFsLCBidXQgdGhpcyByZWNvbW1l bmRhdGlvbiBuZWVkcyB0byBiZSBiYWxhbmNlZCBhZ2FpbnN0IG90aGVyIHZhbHVlcywgaW4gdGhp cyBjYXNlLCBoYXZpbmcgdGhlIEROUyBxdWVyaWVzIGdvIHRvIGEgcHJvdmlkZXIgd2l0aCBkZXRl cm1pbmVkLCBhY2NlcHRhYmxlLCBwcml2YWN5IHBvbGljaWVzIC0tIHdoaWNoLCBhZnRlcg0KIGFs bCwgaXMgaG93IHdlIGdvdCBoZXJlIGluIHRoZSBmaXJzdCBwbGFjZS4gU28sIG5vLCBJIGRvbid0 IHRoaW5rIHRoYXQgdGhpcyBwcm9wb3NlZCByZWNvbW1lbmRhdGlvbiB3b3VsZCBiZSByaWdodCBh cy1pcy48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTQuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjE0LjBwdCI+W0pMXSBPbiB0aGlzIG5h cnJvdyBwb2ludCwgSSBkbyB0aGluayB0aGF0IG9uZSBvZiB0aGUgY29yZSBjb25jZXJucyB0aGF0 IEkgaGVhciBmcm9tIG1hbnkgcGVvcGxlIHN0ZW1zIGZyb20gdGhlIHJpc2tzLCBpc3N1ZXMsIGFu ZCBsb25nLXRlcm0gZWZmZWN0cyBvZiBjZW50cmFsaXphdGlvbi4gSW50ZXJlc3RpbmdseSBpbiB0 aGlzIGNhc2UgaXQgYXBwZWFycw0KIHRvIGJlIGNlbnRyYWxpemF0aW9uIGluIGNvbWJpbmF0aW9u IHdpdGggcGVyY2VpdmVkLCBhY3R1YWwsIG9yIHBvdGVudGlhbCBtYXJrZXQgc2hhcmUgLyBwb3dl ciAvIGNvbnRyb2wsIHdoaWNoIGNvbWVzIGF0IGEgdGltZSBzb2NpYWxseSBhbmQgcG9saXRpY2Fs bHkgb2YgaW5jcmVhc2luZyBjb25jZXJucyBvdmVyIGNlbnRyYWxpemF0aW9uIGl0cyBlZmZlY3Rz IG9uIHNvY2lldGllcy48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9k aXY+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_7A41A54BA4CA4FE5B0BAAEACD1D9E105cablecomcastcom_-- From nobody Thu Aug 22 17:23:28 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D6C9712011B for ; Thu, 22 Aug 2019 17:23:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.679 X-Spam-Level: X-Spam-Status: No, score=-1.679 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_INVALID=0.1, DKIM_SIGNED=0.1, T_SPF_HELO_PERMERROR=0.01, T_SPF_PERMERROR=0.01, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=fail (1024-bit key) reason="fail (message has been altered)" header.d=nostrum.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uSHqc5M_Qlu5 for ; Thu, 22 Aug 2019 17:23:26 -0700 (PDT) Received: from nostrum.com (raven-v6.nostrum.com [IPv6:2001:470:d:1130::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E509E120043 for ; Thu, 22 Aug 2019 17:23:25 -0700 (PDT) Received: from MacBook-Pro.roach.at (99-152-146-228.lightspeed.dllstx.sbcglobal.net [99.152.146.228]) (authenticated bits=0) by nostrum.com (8.15.2/8.15.2) with ESMTPSA id x7N0NHID033314 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NO); Thu, 22 Aug 2019 19:23:21 -0500 (CDT) (envelope-from adam@nostrum.com) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=nostrum.com; s=default; t=1566519802; bh=eoixE5jiL+CKaCi9l2noxcExXQ3dFD6KV2KnleX9vVo=; h=Subject:To:Cc:References:From:Date:In-Reply-To; b=P2iCA9CRxte7HPujZdr0Ziq4y0j3c1m3sfY0rbCXaupjirZp/F8zAbKHdUbPl28Mx e7iU5w8GiqnVpjwyqJ4oE5rIOZCNsf5KNtNVuz2WFs6aCHK4Kr032QvTyRsESsDrTI C+myhhm+vzgDL0St1U0UwKWDpOfv2zE8n0fRsgz0= X-Authentication-Warning: raven.nostrum.com: Host 99-152-146-228.lightspeed.dllstx.sbcglobal.net [99.152.146.228] claimed to be MacBook-Pro.roach.at To: Paul Wouters , Eric Rescorla Cc: Jari Arkko , ADD Mailing list , Daniel Stenberg References: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> <279abf8c-198b-5da8-1cb9-4f86bf1f37c7@nostrum.com> <87C8E6E6-2DEE-4637-9C86-65B27615611C@piuha.net> From: Adam Roach Message-ID: Date: Thu, 22 Aug 2019 19:23:12 -0500 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Content-Language: en-US Archived-At: Subject: Re: [Add] What to do in this potential working group X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 23 Aug 2019 00:23:27 -0000 On 8/22/19 8:53 AM, Paul Wouters wrote: > As a non-US citizen, I strongly disagree that the argument that we are putting all eggs in US baskets is not a strong argument. The US government formally gives me 0 expectation of privacy and they dictate policy to US entities. It is worse informally as we’ve seen time and time again (echelon, Snowden etc). Are you talking about Canada? https://qz.com/92648/think-us-snooping-is-bad-try-italy-india-or-canada/ https://citizenlab.ca/2019/08/canadas-new-and-irresponsible-encryption-policy-how-the-government-of-canadas-new-policy-threatens-charter-rights-cybersecurity-economic-growth-and-foreign-policy/ https://www.reuters.com/article/us-canada-spying/snowden-files-show-canada-spy-agency-runs-global-internet-watch-cbc-idUSKBN0L11W520150128 /a From nobody Thu Aug 22 21:32:43 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DDC9B12003F for ; Thu, 22 Aug 2019 21:32:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rlAQgWdwDO5L for ; Thu, 22 Aug 2019 21:32:40 -0700 (PDT) Received: from mail-lf1-x12c.google.com (mail-lf1-x12c.google.com [IPv6:2a00:1450:4864:20::12c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 260BC120091 for ; Thu, 22 Aug 2019 21:32:40 -0700 (PDT) Received: by mail-lf1-x12c.google.com with SMTP id x3so6165379lfc.0 for ; Thu, 22 Aug 2019 21:32:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=3/gLHty8RFHkLEvxJ0Uj9G7ntePG+ApUBNf/FUN5WEw=; b=Wd2JtJVb8ze3VHKqQqX8jOBj3iMz5DKRTnShR6nLB7KSK+U4Nb4U/I1G+yFE+jxNCO yYqscQjhcEHo8DB/00yuY4r6JErD/X7XCfRbUZ9F8mT/LBPj1IY9fKlMpBZN2t7rm1hq 7C2NMftjFAXXRqwaADWFRGbzkqhDAJOQ5PGWosC+g+otxU9yKC/wE8wF9qVojNnEJqV1 7j9QIFJbuyNzdYyH72exNPZEbdqrphYKLtMzJAD90QsyFbCqCm1fU2SICKhA7DzWokuc 7R8kh3xcrm7EDjUDotavqLZqBEIVU9uDyB2qf9cXJvtAtprPOZAz59ymLLKw4Z2ohveP Ciyg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=3/gLHty8RFHkLEvxJ0Uj9G7ntePG+ApUBNf/FUN5WEw=; b=qb8/pO6BZeCrTk6CU02orsrl4nEK+4DTIw4LuEDhETR/zJcweF4UytF1J21ixcATSV 33EyTjnDzXwGmx7G0cC2hswIn7QsacvFcr9nP7aaeKqII9XVb0yb8e213r+wyQEJgpsW W3xRoGu6kljIikOTrEbj0qwqo1QritGMidS2XrEXr481bpW3NM0jZ72uyONmxtrAEItQ IInAYPlTGf/7gdixpCuVGScnelGM0Ueh7uXL8yyE7tjWJuMQO/Mltjxw8JIz4oMHG0Yl 7KrZ4oWxccP8kMigX9ZczX3vYxbDp7DIvwykS7pDpKdV/KMSnbGfYSBgDf2bM6nI3qYO G2Sg== X-Gm-Message-State: APjAAAXALHEEEmbH0LlpB94QTjXH0K2FmbZc/GWkfdb8UCKBDc1hMSMV NUKN6TcHlPDpPfnw7zDiSk1oPcg909NBERGD4YNQjg== X-Google-Smtp-Source: APXvYqwjYJau4W7vfYD5be+HylU+BirtTRq/e/bLTonGRXOuvAYAyQ8eBSomFahRhuABKaSyZVZnxHRl33Us+B0qN/s= X-Received: by 2002:ac2:5336:: with SMTP id f22mr1441492lfh.180.1566534758382; Thu, 22 Aug 2019 21:32:38 -0700 (PDT) MIME-Version: 1.0 References: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> <7893F89E-ACB5-42EF-B8B6-5CF460FA5D0E@fl1ger.de> In-Reply-To: <7893F89E-ACB5-42EF-B8B6-5CF460FA5D0E@fl1ger.de> From: Eric Rescorla Date: Fri, 23 Aug 2019 05:32:01 +0100 Message-ID: To: Ralf Weber Cc: Ray Bellis , ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000cd4f1a0590c14b12" Archived-At: Subject: Re: [Add] What to do in this potential working group X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 23 Aug 2019 04:32:42 -0000 --000000000000cd4f1a0590c14b12 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Thu, Aug 22, 2019 at 12:12 PM Ralf Weber wrote: > Moin! > > On 21 Aug 2019, at 19:01, Eric Rescorla wrote: > > Indeed: this is what I was referring to when I said "ways to minimize > > centralization". Specifically, ISPs could commit to strong privacy > policies > > and join our TRR program. > A lot of ISPs have way stronger privacy policies then the TRR program, ye= t > they can not join because it=E2=80=99s impossible to fulfil the other req= uirements > Interesting. I'd be interested in seeing links to those privacy policies. and IMHO bad decsisions in the TRR program what to require and what not: > - No DNSSEC > I don't see how us not requiring DNSSEC precludes ISPs joining - But qname minimisation that breaks stuff and for larger resolvers adds > not much > - Requirement to publish block lists > I think we've explained our reasons for these, and we're not yet persuaded that relaxing them would be a good thing. -Ekr > > So long > -Ralf > --- > Ralf Weber > --000000000000cd4f1a0590c14b12 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Thu, Aug 22, 2019 at 12:12 PM Ralf= Weber <dns@fl1ger.de> wrote:
Moin!

On 21 Aug 2019, at 19:01, Eric Rescorla wrote:
> Indeed: this is what I was referring to when I said "ways to mini= mize
> centralization". Specifically, ISPs could commit to strong privac= y policies
> and join our TRR program.
A lot of ISPs have way stronger privacy policies then the TRR program, yet<= br> they can not join because it=E2=80=99s impossible to fulfil the other requi= rements

Interesting. I'd be interes= ted in seeing links to those privacy policies.

and IMHO bad decsisions in the TRR program what to require and what not: - No DNSSEC

I don't see how us not = requiring DNSSEC precludes ISPs joining


- But qname minimisation that breaks stuff and for larger resolvers adds not much
- Requirement to publish block lists

I = think we've explained our reasons for these, and we're not yet pers= uaded that relaxing them would be a good thing.

-E= kr


=C2=A0

So long
-Ralf
---
Ralf Weber
--000000000000cd4f1a0590c14b12-- From nobody Thu Aug 22 21:39:55 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7829712010E for ; Thu, 22 Aug 2019 21:39:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id R1ac7Ef61-Uj for ; Thu, 22 Aug 2019 21:39:52 -0700 (PDT) Received: from mail-lj1-x22a.google.com (mail-lj1-x22a.google.com [IPv6:2a00:1450:4864:20::22a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 22D8412003F for ; Thu, 22 Aug 2019 21:39:52 -0700 (PDT) Received: by mail-lj1-x22a.google.com with SMTP id f9so7554866ljc.13 for ; Thu, 22 Aug 2019 21:39:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=jT8ZiFmiIkDLwEjzJZ66pwHS+KQ0j2wPb2TrgspWd8I=; b=BVbDs4T0eBcE28RLlzDScxszsLZ/ljnraPjfEf26WyvvZzJc21MP6jdCxerZtaG1Ot DVn8zVjacm0O8k+/82/tI/BTR5CaW830J1uAuqYuLdR71G9tLJDNO+5FPHj8FU6n7c60 4ycxhg2QlKoiabEZBmO9JF5UurBUb3Q8LjYTY0Darv4p9TbWvIEA+qWfSgjAucLf2thq /rZEahWCZ73iJu6zoHB7NBIXDpIh6c0CW5E3kolJecxRhwz2ELccbpJdxgzf7kIvxlRe ibhMdh0ydbQJaPN+2V/qenvhYSKSMLqhjZJQR/UMKcnEIFNS9lVjB9CMKww+glyT6vHT R/jg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=jT8ZiFmiIkDLwEjzJZ66pwHS+KQ0j2wPb2TrgspWd8I=; b=mzbMen1zhmM5P3YZcreZaM5sq7LnwowbM0e07+HesIxZ9C2mtWsgseJsiwsP3I/URk UzbvlEyy87z1Aeo//kzC0Bf3K7Mpi43MpFcaEz8SDiabaavuPcZtznqmj9a2/b0uQh8m eeGTkfY1InckYCaiKZACi9ya/51DraPEIV9wsYqrXY+2Calp4/1RZMZQoPJPE5mpWkaQ nF0mI8dKN12GIR+ZP16i/L7nPI5ZefYTsBiyl3cp3btHUXBrF2uoYl+nIDRezv20aPy8 lqgvoLMPttvQ1ODSZ3y8DM1AK0eoAx/t4PuQ9bQ2P0UTjsS1Wg4ZRaKCM7JRteRa7VAH fKCA== X-Gm-Message-State: APjAAAUu1ZcHqCVPyAoJ7xGLY5Z2YoLNBHwpr603FD9bVoDb3Zs+5s83 X/rlpaOglJoVkcHtMwbIFJsxTwLR/fQQg/HlUcbpidvvSBg= X-Google-Smtp-Source: APXvYqyMKpKDjJwHBPGpiZjULitfw4gmEfGK8VySn1QYzCedHiP8TMjW/PB3ocysI665FYK7/r5hyB1hlLYFucGRdj4= X-Received: by 2002:a2e:9b0c:: with SMTP id u12mr1580517lji.239.1566535190324; Thu, 22 Aug 2019 21:39:50 -0700 (PDT) MIME-Version: 1.0 References: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> <59E0EC53-0E30-431C-8376-52C7BFC121A8@virtualized.org> <589DAFCB-1BDC-4156-A2CA-179C4559A6B2@virtualized.org> <683A176C-3CE6-4866-A736-F2A7465FA5B5@rfc1035.com> In-Reply-To: From: Eric Rescorla Date: Fri, 23 Aug 2019 05:39:13 +0100 Message-ID: To: Jim Reid Cc: ADD Mailing list Content-Type: multipart/alternative; boundary="0000000000008c3c020590c1659a" Archived-At: Subject: Re: [Add] data integrity and DNSSEC or DoH/DoT X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 23 Aug 2019 04:39:55 -0000 --0000000000008c3c020590c1659a Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Thu, Aug 22, 2019 at 1:41 PM Jim Reid wrote: > > > > On 22 Aug 2019, at 08:00, Eric Rescorla wrote: > > > > Suppose that I receive a bogus response to my A record query, how am I > to usefully distinguish "this is malware blocking" from "this resolver is > malicious"? > > I'm surprised that distinction matters to you. I thought any form of DNS > blocking or filtering was malicious from your PoV. :-) > Smiley or no, this really doesn't seem like it advances the conversation. > To be slightly less glib, the dnsop WG has an I-D on extended error codes= . > [And FWIW lack of a discrete error code(s) for validation failure is one = of > the things I think DNSSEC got wrong.] draft-ietf-dnsop-extended-error > already goes some way to answering your question: > > 4.16. Extended DNS Error Code 15 - Blocked > > The resolver attempted to perfom a DNS query but the domain is > blacklisted due to a security policy implemented on the server being > directly talked to. > > 4.17. Extended DNS Error Code 16 - Censored > > The resolver attempted to perfom a DNS query but the domain was > blacklisted by a security policy imposed upon the server being talked > to. Note that how the imposed policy is applied is irrelevant (in- > band DNS somehow, court order, etc). > > 4.18. Extended DNS Error Code 17 - Prohibited > > An authoritative or recursive resolver that receives a query from an > "unauthorized" client can annotate its REFUSED message with this > code. Examples of "unauthorized" clients are recursive queries from > IP addresses outside the network, blacklisted IP addresses, local > policy, etc. > > I suppose draft-ietf-dnsop-extended-error could add another error code fo= r > the specific case of a malicious resolver. Whatever that might mean. Thou= gh > I doubt the operators of such servers will choose to set that evil bit on > their responses. > > PS A potential problem with this I-D is these extended error codes won=E2= =80=99t > be signed. So they can be spoofed by bad actors. Yes, and for this reason I don't see how this solves the problem. It's just "resolver blocked it and claims reason X". -Ekr --0000000000008c3c020590c1659a Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Thu, Aug 22, 2019 at 1:41 PM Jim R= eid <jim@rfc1035.com> wrote:


> On 22 Aug 2019, at 08:00, Eric Rescorla <ekr@rtfm.com> wrote:
>
> Suppose that I receive a bogus response to my A record query, how am I= to usefully distinguish "this is malware blocking" from "th= is resolver is malicious"?

I'm surprised that distinction matters to you. I thought any form of DN= S blocking or filtering was malicious from your PoV. :-)

Smiley or no, this really doesn't seem like it advanc= es the conversation.


=C2=A0
<= blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-l= eft:1px solid rgb(204,204,204);padding-left:1ex"> To be slightly less glib, the dnsop WG has an I-D on extended error codes. = [And FWIW lack of a discrete error code(s) for validation failure is one of= the things I think DNSSEC got wrong.] draft-ietf-dnsop-extended-error alre= ady goes some way to answering your question:

4.16.=C2=A0 Extended DNS Error Code 15 - Blocked

=C2=A0 =C2=A0The resolver attempted to perfom a DNS query but the domain is=
=C2=A0 =C2=A0blacklisted due to a security policy implemented on the server= being
=C2=A0 =C2=A0directly talked to.

4.17.=C2=A0 Extended DNS Error Code 16 - Censored

=C2=A0 =C2=A0The resolver attempted to perfom a DNS query but the domain wa= s
=C2=A0 =C2=A0blacklisted by a security policy imposed upon the server being= talked
=C2=A0 =C2=A0to.=C2=A0 Note that how the imposed policy is applied is irrel= evant (in-
=C2=A0 =C2=A0band DNS somehow, court order, etc).

4.18.=C2=A0 Extended DNS Error Code 17 - Prohibited

=C2=A0 =C2=A0An authoritative or recursive resolver that receives a query f= rom an
=C2=A0 =C2=A0"unauthorized" client can annotate its REFUSED messa= ge with this
=C2=A0 =C2=A0code.=C2=A0 Examples of "unauthorized" clients are r= ecursive queries from
=C2=A0 =C2=A0IP addresses outside the network, blacklisted IP addresses, lo= cal
=C2=A0 =C2=A0policy, etc.

I suppose draft-ietf-dnsop-extended-error could add another error code for = the specific case of a malicious resolver. Whatever that might mean. Though= I doubt the operators of such servers will choose to set that evil bit on = their responses.

PS A potential problem with this I-D is these extended error codes won=E2= =80=99t be signed. So they can be spoofed by bad actors.
<= br>
Yes, and for this reason I don't see how this solves the = problem. It's just "resolver blocked it and claims reason X".=

-Ekr

--0000000000008c3c020590c1659a-- From nobody Thu Aug 22 21:54:08 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9C84912080B for ; Thu, 22 Aug 2019 21:54:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nFsk1yIEDOM6 for ; Thu, 22 Aug 2019 21:54:03 -0700 (PDT) Received: from mail-io1-xd35.google.com (mail-io1-xd35.google.com [IPv6:2607:f8b0:4864:20::d35]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DE9FD120C27 for ; Thu, 22 Aug 2019 21:54:02 -0700 (PDT) Received: by mail-io1-xd35.google.com with SMTP id j4so8850431iog.11 for ; Thu, 22 Aug 2019 21:54:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=DsIZJEQZYyotwkqC5QG/LN2Hd1nbSDe408CO+KqwyiU=; b=q1+Z1sVY5tSQiY1kP6hwGfMM5x9HP3FUJI/ub+U3k/8OqJf6rE3QQAmCHhH/1Rl6zw G3ep4l+7dITXQzA0hgEqwA2ds8Dx+sYqKQdWBgL3rz6wXUa0++kkGZNLyzqt6WIju0NJ HwmNVamIELUTVB67E+2n0HSJ4wCUCoO0B9MhqwQPaa38aCU+jLiBJPPRNW05llw0MGTb ol6PRK67LAN+1wOtbtprscM0utwJnP+ovtr/fe09Mb5lx9zV9MhvJBrIrCy2rxjCLad6 uBuf35Iodbm+yFh/EUVAWnzPSy2+Oal7/pzrwkO+eVbkb6Ln82c8RKrAGeT5j+doZswA YF1Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=DsIZJEQZYyotwkqC5QG/LN2Hd1nbSDe408CO+KqwyiU=; b=HRQFBd5vJbk+HQ+RkghOxhg16EmIRCUlX+HyC+CizMEkRiBt2RZBN9Scpas3lMtyGT PgVfSwuiI3A0/3liS2WS8SUMu89s9fssqkc1Iwa/dXs8Cnm0XlJ2XWBTBmmDLI+L54yK lVXBXJon2MunO8z5QRqPssin7AWmBR8qbiqBeeU90opJcCGXAaY/SbKcedm5ifhIxyxb BwgdnnYZMHxXpwFacl5T1noCIrYIMnc8XyuTx35JWQG2cjtCH0FvhTKc7VXixIJuGY1K sbkxBcJXkSHOKwK0yG6k9d/p6nAcIaf6n453VSyixHyzOrw9DpIrBsgd6RCuKjK+svES gzNw== X-Gm-Message-State: APjAAAW1quE+nEDwm1cUlspdr/8EiCIAANofVW9DnkxyKM651s4vQvmf txCN+KSKlHiPydK4lDG9kJ6dhG0MNCzsmiIIFks= X-Google-Smtp-Source: APXvYqy5AEEJbFXxovTND8WEEGnXYzbuxzmrbIi6UiEtO3S+Urz6L/kbNTbzt+DhD6BWPCaNyGiOZW0GVXq9REEB8+E= X-Received: by 2002:a05:6638:a09:: with SMTP id 9mr3134190jan.95.1566536042008; Thu, 22 Aug 2019 21:54:02 -0700 (PDT) MIME-Version: 1.0 References: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> <59E0EC53-0E30-431C-8376-52C7BFC121A8@virtualized.org> <589DAFCB-1BDC-4156-A2CA-179C4559A6B2@virtualized.org> <683A176C-3CE6-4866-A736-F2A7465FA5B5@rfc1035.com> In-Reply-To: From: Rob Sayre Date: Thu, 22 Aug 2019 21:53:49 -0700 Message-ID: To: Eric Rescorla Cc: Jim Reid , ADD Mailing list Content-Type: multipart/alternative; boundary="0000000000004fdb4b0590c198ae" Archived-At: Subject: Re: [Add] data integrity and DNSSEC or DoH/DoT X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 23 Aug 2019 04:54:07 -0000 --0000000000004fdb4b0590c198ae Content-Type: text/plain; charset="UTF-8" On Thu, Aug 22, 2019 at 9:50 PM Eric Rescorla wrote: > On Thu, Aug 22, 2019 at 1:41 PM Jim Reid wrote: > >> I'm surprised that distinction matters to you. I thought any form of DNS >> blocking or filtering was malicious from your PoV. :-) >> > > Smiley or no, this really doesn't seem like it advances the conversation. > I agree with Ekr. thanks, Rob --0000000000004fdb4b0590c198ae Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Thu, Aug 22, 2019 at 9:50 PM Eric Resc= orla <ekr@rtfm.com> wrote:
On Thu, Aug 22, 2019 at 1:41 PM Jim Reid <jim@rfc1035.com> wrote:
I'm surprised that distinction matters to you. I thought any form of DN= S blocking or filtering was malicious from your PoV. :-)

Smiley or no, this really doesn't seem like it advanc= es the conversation.

I ag= ree with Ekr.

thanks,
Rob=C2=A0
--0000000000004fdb4b0590c198ae-- From nobody Fri Aug 23 01:04:24 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A80641200CD for ; Fri, 23 Aug 2019 01:04:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RJeGurxNVYlQ for ; Fri, 23 Aug 2019 01:04:21 -0700 (PDT) Received: from shaun.rfc1035.com (smtp.v6.rfc1035.com [IPv6:2001:4b10:100:7::25]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DFF40120059 for ; Fri, 23 Aug 2019 01:04:20 -0700 (PDT) Received: from gromit.rfc1035.com (gromit.rfc1035.com [195.54.233.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by shaun.rfc1035.com (Postfix) with ESMTPSA id 7C81C242109D; Fri, 23 Aug 2019 08:04:17 +0000 (UTC) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) From: Jim Reid In-Reply-To: Date: Fri, 23 Aug 2019 09:04:16 +0100 Cc: ADD Mailing list Content-Transfer-Encoding: quoted-printable Message-Id: <69015C05-4AE8-4FB2-94D4-3B52018DEBA6@rfc1035.com> References: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> <59E0EC53-0E30-431C-8376-52C7BFC121A8@virtualized.org> <589DAFCB-1BDC-4156-A2CA-179C4559A6B2@virtualized.org> <683A176C-3CE6-4866-A736-F2A7465FA5B5@rfc1035.com> To: Eric Rescorla X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: Re: [Add] data integrity and DNSSEC or DoH/DoT X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 23 Aug 2019 08:04:23 -0000 On 23 Aug 2019, at 05:39, Eric Rescorla wrote: >=20 >=20 >=20 > On Thu, Aug 22, 2019 at 1:41 PM Jim Reid wrote: >=20 >> > On 22 Aug 2019, at 08:00, Eric Rescorla wrote: >> >=20 >> > Suppose that I receive a bogus response to my A record query, how = am I to usefully distinguish "this is malware blocking" from "this = resolver is malicious"? >>=20 >> I suppose draft-ietf-dnsop-extended-error could add another error = code for the specific case of a malicious resolver. Whatever that might = mean. Though I doubt the operators of such servers will choose to set = that evil bit on their responses. >>=20 >> PS A potential problem with this I-D is these extended error codes = won=E2=80=99t be signed. So they can be spoofed by bad actors. >>=20 > Yes, and for this reason I don't see how this solves the problem. It's = just "resolver blocked it and claims reason X". Which I thought answered your original question. Though maybe those = responses should be signed somehow. Handwave, handwave. If you have = suggestions on how to improve the security considerations of that I-D, = please supply text to dnsop. But now I=E2=80=99m confused. Could you please clarify what you mean by = malicious resolver? We seem to be using different (unwritten) = definitions. I also don=E2=80=99t understand why it matters to distinguish between = responses that say "this is malware blocking" from "this resolver is = malicious=E2=80=9D. The end result=E2=80=99s the same - the resolver=E2=80= =99s not returning the expected DNS data for the query. What difference = does it make if the resolver=E2=80=99s giving a genuine or a bogus = reason for doing that? After all, the client will almost always believe = what the resolver told them. It entered into an implicit or explicit = trust relationship with that resolver when the client sent its DNS = queries there.= From nobody Fri Aug 23 04:37:04 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BEFEB120A83 for ; Fri, 23 Aug 2019 04:37:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.198 X-Spam-Level: X-Spam-Status: No, score=-4.198 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, MIME_HTML_ONLY=0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=open-xchange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ttrUecvSBMu7 for ; Fri, 23 Aug 2019 04:37:01 -0700 (PDT) Received: from mx4.open-xchange.com (alcatraz.open-xchange.com [87.191.39.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B55EA120823 for ; Fri, 23 Aug 2019 04:37:00 -0700 (PDT) Received: from open-xchange.com (imap.open-xchange.com [10.20.30.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx4.open-xchange.com (Postfix) with ESMTPS id BCD996A34C; Fri, 23 Aug 2019 13:36:58 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=open-xchange.com; s=201705; t=1566560218; bh=EsQBM73uXLWS/x5qwDGOf/rH7nk//MsCPn1206PHZn4=; h=Date:From:Reply-To:To:In-Reply-To:References:Subject:From; b=SK20OztZCrGl8x5ZTJlWCGx26SONB5ZobLalBstprtRGxuL/fzYVWSo9P6vZB037u pQGuds8C7Dy3KLfETijKO/z0bC+PiCGVzz2XnvDdaPdrWNGdAd+rfYrKuWMi7/6VIo leeZ5P7Ry3YAODDQOE0ZmsEb3GrbqA+9UFC+pt31TDywEwsIIKgoI6cEqo0GFMSq9i O0QN4Y71NKMt/2UxaZ0oeAXYsKeTVtSgslAJmkEmlnOfqbhWeu1pqRDoJVmesAwE6p 8iQiQlJGsbyuUn1GNSJCrgkYFLFCcXaHsy2CmXmOemobhoGIVSGwd+IRxYDQKU4htz UGqlgBWePQURA== Received: from appsuite-gw1.open-xchange.com (appsuite-gw1.open-xchange.com [10.20.28.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by open-xchange.com (Postfix) with ESMTPSA id B179A3C028F; Fri, 23 Aug 2019 13:36:58 +0200 (CEST) Date: Fri, 23 Aug 2019 13:36:58 +0200 (CEST) From: Vittorio Bertola Reply-To: Vittorio Bertola To: Tommy Jensen , "add@ietf.org" Message-ID: <38910513.617.1566560218674@appsuite-gw1.open-xchange.com> In-Reply-To: References: <1444D5E7-DEA7-437C-B12B-6C31FEA563DD@sky.uk>, <11f9dfe2-ab05-2227-7643-e53da95ec717@nostrum.com> MIME-Version: 1.0 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Priority: 3 Importance: Medium X-Mailer: Open-Xchange Mailer v7.10.2-Rev11 X-Originating-Client: open-xchange-appsuite Autocrypt: addr=vittorio.bertola@open-xchange.com; prefer-encrypt=mutual; keydata= mQENBFhFR+UBCACfoywFKBRfzasiiR9/6dwY36eLePXcdScumDMR8qoXvRS55QYDjp5bs+yMq41qWV9 xp/cqryY9jnvHbeF3TsE5yEazpD1dleRbkpElUBpPwXqkrSP8uXO9KkS9KoX6gdml6M4L+F82WpqYC1 uTzOE6HPmhmQ4cGSgoia2jolxAhRpzoYN99/BwpvoZeTSLP5K6yPlMPYkMev/uZlAkMMhelli9IN6yA yxcC0AeHSnOAcNKUr13yXyMlTyi1cdMJ4sk88zIbefxwg3PAtYjkz3wgvP96cNVwAgSt4+j/ZuVaENP pgVuM512m051j9SlspWDHtzrci5pBKKFsibnTelrABEBAAG0NUJlcnRvbGEsIFZpdHRvcmlvIDx2aXR 0b3Jpby5iZXJ0b2xhQG9wZW4teGNoYW5nZS5jb20+iQFABBMBAgAqBAsJCAcGFQoJCAsCBRYCAwEAAp 4BAhsDBYkSzAMABQMAAAAABYJYRUflAAoJEIU2cHmzj8qNaG0H/ROY+suCP86hoN+9RIV66Ej8b3sb8 UgwFJOJMupZfeb9yTIJwE4VQT5lTt146CcJJ5jvxD6FZn1Htw9y4/45pPAF7xLE066jg3OqRvzeWRZ3 IDUfJJIiM5YGk1xWxDqppSwhnKcMOuI72iioWxX0nGQrWxpnWJsjt08IEEwuYucDkul1PHsrLJbTd58 fiMKLVwag+IE1SPHOwkPF6arZQZIfB5ThtOZV+36Jn8Hok9XfeXWBVyPkiWCQYVX39QsIbr0JNR9kQy 4g2ZFexOcTe8Jo12jPRL7V8OqStdDes3cje9lWFLnX05nrfLuE0l0JKWEg8akN+McFXc+oV68h7nu5A Q0EWEVH5QEIAIDKanNBe1uRfk8AjLirflZO291VNkOAeUu+dIhecGnZeQW6htlDinlYOnXhtsY1mK9W PUu+xshDq7lXn2G0LxldYwyJYZaJtDgIKqVqwxfA34Lj27oqPuXwcvGhdCgt0SW/YcalRdAi0/AzUCu 5GSaj2kaGUSnBYYUP4szGJXjaK2psP5toQSCtx2pfSXQ6MaqPK9Zzy+D5xc6VWQRp/iRImodAcPf8fg JJvRyJ8Jla3lKWyvBBzJDg6MOf6Fts78bJSt23X0uPp93g7GgbYkuRMnFI4RGoTVkxjD/HBEJ0CNg22 hoHJondhmKnZVrHEluFuSnW0wBEIYomcPSPB+cAEQEAAYkBMQQYAQIAGwUCWEVH5QIbDAQLCQgHBhUK CQgLAgUJEswDAAAKCRCFNnB5s4/KjdO8B/wNpvWtOpLdotR/Xh4fu08Fd63nnNfbIGIETWsVi0Sbr8i E5duuGaaWIcMmUvgKe/BM0Fpj9X01Zjm90uoPrlVVuQWrf+vFlbalUYVZr51gl5UyUFHk+iAZCAA0WB rsmACKvuV1P7GuiX3UV9b59T9taYJxN3dNFuftrEuvsqHimFtlekUjUwoCekTJdncFusBhwz2OrKhHr WWrEsXkfh0+pURWYAlKlTxvXuI7gAfHEQM+6OnrWvXYtlhd0M1sBPnCjbyG63Qws7Rek9bEWKtH6dA6 dmT2FQT+g1S9Mdf0WkPTQNX0x24dm8IoHuD3KYwX7Svx43Xa17aZnXqUjtj1 Archived-At: Subject: Re: [Add] A thought -- Move the policy decisions outside the application. X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 23 Aug 2019 11:37:03 -0000

Il 22 agosto 2019 19:41 Tommy Jensen <jensen.thomas=40microsoft.com@dmarc.ietf.org> ha scritto:

Alister, in short, I do think your thoughts are a reasonable line of thinking. After various discussions here on the mailing list, at least my approach has been to work offline with folks on more concrete proposals for such an OS integration. I'd welcome ideas on or off list as I'm sure other platforms would as well. 
I also think that Alister's idea is quite useful, even more when you take the policy issues into account. One of the major concerns is about the user losing control over the DNS resolution practices of their device; even if most users won't care, still many do and should be empowered to do that; the more so if you consider that the main driver for informed resolver selection by users today is exactly when something bad happens and unaware users suddenly feel the need to learn about DNS resolution and take back control, overriding their system's defaults.

A centralized configuration mechanism that can inform all applications of the user's wishes is key to this, even if we all know that applications will still be free to ignore that configuration for both user-friendly and user-adversarial reasons.

Regarding whether this is work for the IETF or not, well - this goes beyond protocol specification, but I think it's clear that the changes potentially created by the deployment of encrypted DNS involve multiple layers and many different stakeholders, so they need to be addressed through coordinated work in many places (some technical, some policy). I increasingly think that we need some ad-hoc effort to sit together and work out the overall picture and who needs to be involved where.

-- 

Vittorio Bertola | Head of Policy & Innovation, Open-Xchange
vittorio.bertola@open-xchange.com 
Office @ Via Treviso 12, 10144 Torino, Italy
From nobody Fri Aug 23 04:55:58 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 23AF7120819 for ; Fri, 23 Aug 2019 04:55:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.299 X-Spam-Level: X-Spam-Status: No, score=-4.299 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=open-xchange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id g7suBL4UPXrF for ; Fri, 23 Aug 2019 04:55:55 -0700 (PDT) Received: from mx4.open-xchange.com (alcatraz.open-xchange.com [87.191.39.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D8D0B12004F for ; Fri, 23 Aug 2019 04:55:54 -0700 (PDT) Received: from open-xchange.com (imap.open-xchange.com [10.20.30.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx4.open-xchange.com (Postfix) with ESMTPS id 1E96F6A34C; Fri, 23 Aug 2019 13:55:53 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=open-xchange.com; s=201705; t=1566561353; bh=suuPJawiBHOWQxsIdVfZqA2KsTzrIrDoqKTF75meb5E=; h=Date:From:Reply-To:To:Cc:In-Reply-To:References:Subject:From; b=hcVFGS6anVOP2IKWmZLA4Z8GsPZ3V9lG75wd7nTgB2Xcg7STfn/xKgsQaT3DkTxDW Bl0agHcy8idHNgOX20SfZ+98sztZQ7jLaeE7cG/RyFuxawlqNXGNY5P6vdQIIXs3Xr NgevuI10tVch9eKmraHxvncNGXQGsJ6azEFF+6alBSZ4ydlhxxTTtF6cwdABr6ENgw 7Jg5DOyc0MyH6Yyln6ZV6snNqVk+J5Y1xCSf8wxhfQ+PBLpo9/fPphnpFFTEKFbcXn NHptWbo9lD+RbCxaJswXVosgXasKKUU+vCL65p3LOjaLQeANHvTeIBYWKzSspngb1e xL7gFeN4wy3KA== Received: from appsuite-gw1.open-xchange.com (appsuite-gw1.open-xchange.com [10.20.28.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by open-xchange.com (Postfix) with ESMTPSA id 1258B3C028F; Fri, 23 Aug 2019 13:55:53 +0200 (CEST) Date: Fri, 23 Aug 2019 13:55:52 +0200 (CEST) From: Vittorio Bertola Reply-To: Vittorio Bertola To: Adam Roach Cc: ADD Mailing list Message-ID: <1061835509.647.1566561353025@appsuite-gw1.open-xchange.com> In-Reply-To: References: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> <279abf8c-198b-5da8-1cb9-4f86bf1f37c7@nostrum.com> <87C8E6E6-2DEE-4637-9C86-65B27615611C@piuha.net> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable X-Priority: 3 Importance: Medium X-Mailer: Open-Xchange Mailer v7.10.2-Rev11 X-Originating-Client: open-xchange-appsuite Autocrypt: addr=vittorio.bertola@open-xchange.com; prefer-encrypt=mutual; keydata= mQENBFhFR+UBCACfoywFKBRfzasiiR9/6dwY36eLePXcdScumDMR8qoXvRS55QYDjp5bs+yMq41qWV9 xp/cqryY9jnvHbeF3TsE5yEazpD1dleRbkpElUBpPwXqkrSP8uXO9KkS9KoX6gdml6M4L+F82WpqYC1 uTzOE6HPmhmQ4cGSgoia2jolxAhRpzoYN99/BwpvoZeTSLP5K6yPlMPYkMev/uZlAkMMhelli9IN6yA yxcC0AeHSnOAcNKUr13yXyMlTyi1cdMJ4sk88zIbefxwg3PAtYjkz3wgvP96cNVwAgSt4+j/ZuVaENP pgVuM512m051j9SlspWDHtzrci5pBKKFsibnTelrABEBAAG0NUJlcnRvbGEsIFZpdHRvcmlvIDx2aXR 0b3Jpby5iZXJ0b2xhQG9wZW4teGNoYW5nZS5jb20+iQFABBMBAgAqBAsJCAcGFQoJCAsCBRYCAwEAAp 4BAhsDBYkSzAMABQMAAAAABYJYRUflAAoJEIU2cHmzj8qNaG0H/ROY+suCP86hoN+9RIV66Ej8b3sb8 UgwFJOJMupZfeb9yTIJwE4VQT5lTt146CcJJ5jvxD6FZn1Htw9y4/45pPAF7xLE066jg3OqRvzeWRZ3 IDUfJJIiM5YGk1xWxDqppSwhnKcMOuI72iioWxX0nGQrWxpnWJsjt08IEEwuYucDkul1PHsrLJbTd58 fiMKLVwag+IE1SPHOwkPF6arZQZIfB5ThtOZV+36Jn8Hok9XfeXWBVyPkiWCQYVX39QsIbr0JNR9kQy 4g2ZFexOcTe8Jo12jPRL7V8OqStdDes3cje9lWFLnX05nrfLuE0l0JKWEg8akN+McFXc+oV68h7nu5A Q0EWEVH5QEIAIDKanNBe1uRfk8AjLirflZO291VNkOAeUu+dIhecGnZeQW6htlDinlYOnXhtsY1mK9W PUu+xshDq7lXn2G0LxldYwyJYZaJtDgIKqVqwxfA34Lj27oqPuXwcvGhdCgt0SW/YcalRdAi0/AzUCu 5GSaj2kaGUSnBYYUP4szGJXjaK2psP5toQSCtx2pfSXQ6MaqPK9Zzy+D5xc6VWQRp/iRImodAcPf8fg JJvRyJ8Jla3lKWyvBBzJDg6MOf6Fts78bJSt23X0uPp93g7GgbYkuRMnFI4RGoTVkxjD/HBEJ0CNg22 hoHJondhmKnZVrHEluFuSnW0wBEIYomcPSPB+cAEQEAAYkBMQQYAQIAGwUCWEVH5QIbDAQLCQgHBhUK CQgLAgUJEswDAAAKCRCFNnB5s4/KjdO8B/wNpvWtOpLdotR/Xh4fu08Fd63nnNfbIGIETWsVi0Sbr8i E5duuGaaWIcMmUvgKe/BM0Fpj9X01Zjm90uoPrlVVuQWrf+vFlbalUYVZr51gl5UyUFHk+iAZCAA0WB rsmACKvuV1P7GuiX3UV9b59T9taYJxN3dNFuftrEuvsqHimFtlekUjUwoCekTJdncFusBhwz2OrKhHr WWrEsXkfh0+pURWYAlKlTxvXuI7gAfHEQM+6OnrWvXYtlhd0M1sBPnCjbyG63Qws7Rek9bEWKtH6dA6 dmT2FQT+g1S9Mdf0WkPTQNX0x24dm8IoHuD3KYwX7Svx43Xa17aZnXqUjtj1 Archived-At: Subject: Re: [Add] What to do in this potential working group X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 23 Aug 2019 11:55:57 -0000 > Il 23 agosto 2019 02:23 Adam Roach ha scritto: > =20 > On 8/22/19 8:53 AM, Paul Wouters wrote: > > As a non-US citizen, I strongly disagree that the argument that we are = putting all eggs in US baskets is not a strong argument. The US government = formally gives me 0 expectation of privacy and they dictate policy to US en= tities. It is worse informally as we=E2=80=99ve seen time and time again (e= chelon, Snowden etc) >=20 > Are you talking about Canada? I think that the IETF should not go down the road of making judgements abou= t specific countries and their policies, but rather stick to the basic prin= ciple of sovereignty, which has kept the world together for the last few ce= nturies: each country has the right to determine the rules for its own citi= zens, and each citizen has the right to live (and access the Internet) unde= r their own country's rules and not under some other country's ones. So it is a reasonable concern for non-US citizens to be worried about their= data going to the US, independently from whether their own laws are better= or worse than those of the US. --=20 =20 Vittorio Bertola | Head of Policy & Innovation, Open-Xchange vittorio.bertola@open-xchange.com=20 Office @ Via Treviso 12, 10144 Torino, Italy From nobody Fri Aug 23 05:25:58 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B5C9E120ACB for ; Fri, 23 Aug 2019 05:25:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bDgjDUCgAreY for ; Fri, 23 Aug 2019 05:25:54 -0700 (PDT) Received: from mail-lj1-x233.google.com (mail-lj1-x233.google.com [IPv6:2a00:1450:4864:20::233]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2D5B4120026 for ; Fri, 23 Aug 2019 05:25:54 -0700 (PDT) Received: by mail-lj1-x233.google.com with SMTP id x3so8685662lji.5 for ; Fri, 23 Aug 2019 05:25:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=kZPeh0nA5mmVvPPauYIyYvVELY4n9/y+um9nVDxGIgQ=; b=vqIS+8L9ApUYL9KFomeyKLmVnSOLRIQpHWLTdFOo2bRxlm7WIggCBBD0OskXSW0GCP mAJ7WrQA39rgHwexcxZJzmd9a2QT56ixtsc27Eg+fk4holajSwi6NGaTk0at3h8AJ76h 7/iQYHNBZ1kYhinwE7J0C1dcl1m40c9CPbS6qoL/vFcbvs7bA3gRcBkVCvpiuMJWMV3S hhDw24m+2sJYgM9xzrDqDnp8zUV+46WNbfTFFxS3e9+edPZOJH1WxYtfycjHfeJUG4Vi gP2uOeckZHUqSp+mu0PSU2ViFruBxyWwZl87ptuM5w4XzaNpXIrmYddyvIG53K4GahLn DDOw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=kZPeh0nA5mmVvPPauYIyYvVELY4n9/y+um9nVDxGIgQ=; b=fDjp9ixE3t9fIY0bW7n8oBJ1KUKD6Js7O9IHMSnsu+cYtiY5ftjz657gGzYsSxQtrF cLDeOM8GNEyZoN656pgLaJ+jfV5yLETKcHY3uE5Rly3WM6sgCGQGZ+Ro4VtVdMpWspGS zJAKofMhDnVmRHGfz81Pnrrhq5nGbvwj1IosRhjylNqbrq9lZ/IdQT1aPPvsMHDecQtF yTIK3++K2wwWXcgtPjPPKg9BMgsq3XUY3xn3WXEpvv2nWDcnu1W5AuKYddn+EZ/5ZURC 70/knCAEuVUtXoJ6kG4mcaXzdiZPT3yFr7MPH7pGt1iVdGRLk6DbHbF7WGq0FUAzdndP /KLQ== X-Gm-Message-State: APjAAAUGxFSsBa1KXlftXHsiRHhboUjo8mP3KELUJ2Jl/kb7kM19mciU GAdBJHbtZG6lDRXRnQa2it25oOHERg5Y5RGVtkNtP+I0GQs= X-Google-Smtp-Source: APXvYqybcreSla1VJtmOwj3uo5l8dDQABMm/dfqgpn/vYdgtRgfEjb9ki7O2V2CsvFKjYVOaSsHSyCBNQ2Olp/Ev/oc= X-Received: by 2002:a2e:9b0c:: with SMTP id u12mr2833867lji.239.1566563152297; Fri, 23 Aug 2019 05:25:52 -0700 (PDT) MIME-Version: 1.0 References: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> <59E0EC53-0E30-431C-8376-52C7BFC121A8@virtualized.org> <589DAFCB-1BDC-4156-A2CA-179C4559A6B2@virtualized.org> <683A176C-3CE6-4866-A736-F2A7465FA5B5@rfc1035.com> <69015C05-4AE8-4FB2-94D4-3B52018DEBA6@rfc1035.com> In-Reply-To: <69015C05-4AE8-4FB2-94D4-3B52018DEBA6@rfc1035.com> From: Eric Rescorla Date: Fri, 23 Aug 2019 13:25:16 +0100 Message-ID: To: Jim Reid Cc: ADD Mailing list Content-Type: multipart/alternative; boundary="00000000000036176a0590c7e88c" Archived-At: Subject: Re: [Add] data integrity and DNSSEC or DoH/DoT X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 23 Aug 2019 12:25:57 -0000 --00000000000036176a0590c7e88c Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Fri, Aug 23, 2019 at 9:04 AM Jim Reid wrote: > On 23 Aug 2019, at 05:39, Eric Rescorla wrote: > > > > > > > > On Thu, Aug 22, 2019 at 1:41 PM Jim Reid wrote: > > > >> > On 22 Aug 2019, at 08:00, Eric Rescorla wrote: > >> > > >> > Suppose that I receive a bogus response to my A record query, how am > I to usefully distinguish "this is malware blocking" from "this resolver = is > malicious"? > >> > >> I suppose draft-ietf-dnsop-extended-error could add another error code > for the specific case of a malicious resolver. Whatever that might mean. > Though I doubt the operators of such servers will choose to set that evil > bit on their responses. > >> > >> PS A potential problem with this I-D is these extended error codes > won=E2=80=99t be signed. So they can be spoofed by bad actors. > >> > > Yes, and for this reason I don't see how this solves the problem. It's > just "resolver blocked it and claims reason X". > > Which I thought answered your original question. Though maybe those > responses should be signed somehow. Handwave, handwave. If you have > suggestions on how to improve the security considerations of that I-D, > please supply text to dnsop. > > But now I=E2=80=99m confused. Could you please clarify what you mean by m= alicious > resolver? We seem to be using different (unwritten) definitions. > > I also don=E2=80=99t understand why it matters to distinguish between res= ponses > that say "this is malware blocking" from "this resolver is malicious=E2= =80=9D. The > end result=E2=80=99s the same - the resolver=E2=80=99s not returning the = expected DNS data > for the query. What difference does it make if the resolver=E2=80=99s giv= ing a > genuine or a bogus reason for doing that? After all, the client will almo= st > always believe what the resolver told them. It entered into an implicit o= r > explicit trust relationship with that resolver when the client sent its D= NS > queries there. Let's go back to your original message, which made the distinction between actual truth and whatever the resolver told you "DNSSEC validation means you get the truth, the whole truth and nothing but the truth regardless of your choice of resolver or the transport path between you and that resolver. DoH and DoT offer no protection at all from a lying resolver - you=E2=80=99re just guaranteed to receive precisely whatever lies or truth = that resolver sends" This distinction is only relevant if you actually aren't going to just trust whatever the resolver tells you. -Ekr --00000000000036176a0590c7e88c Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Fri, Aug 23, 2019 at 9:04 AM Jim R= eid <jim@rfc1035.com> wrote:
On 23 Aug 2019, a= t 05:39, Eric Rescorla <ekr@rtfm.com> wrote:
>
>
>
> On Thu, Aug 22, 2019 at 1:41 PM Jim Reid <jim@rfc1035.com> wrote:
>
>> > On 22 Aug 2019, at 08:00, Eric Rescorla <ekr@rtfm.com> wrote:
>> >
>> > Suppose that I receive a bogus response to my A record query,= how am I to usefully distinguish "this is malware blocking" from= "this resolver is malicious"?
>>
>> I suppose draft-ietf-dnsop-extended-error could add another error = code for the specific case of a malicious resolver. Whatever that might mea= n. Though I doubt the operators of such servers will choose to set that evi= l bit on their responses.
>>
>> PS A potential problem with this I-D is these extended error codes= won=E2=80=99t be signed. So they can be spoofed by bad actors.
>>
> Yes, and for this reason I don't see how this solves the problem. = It's just "resolver blocked it and claims reason X".

Which I thought answered your original question. Though maybe those respons= es should be signed somehow. Handwave, handwave. If you have suggestions on= how to improve the security considerations of that I-D, please supply text= to dnsop.

But now I=E2=80=99m confused. Could you please clarify what you mean by mal= icious resolver? We seem to be using different (unwritten) definitions.

I also don=E2=80=99t understand why it matters to distinguish between respo= nses that say "this is malware blocking" from "this resolver= is malicious=E2=80=9D. The end result=E2=80=99s the same - the resolver=E2= =80=99s not returning the expected DNS data for the query. What difference = does it make if the resolver=E2=80=99s giving a genuine or a bogus reason f= or doing that? After all, the client will almost always believe what the re= solver told them. It entered into an implicit or explicit trust relationshi= p with that resolver when the client sent its DNS queries there.

Let's go back to your original message, which mad= e the distinction between actual truth and whatever the resolver told you &= quot;DNSSEC validation means you get the truth, the whole truth and nothing= =20 but the truth regardless of your choice of resolver or the transport=20 path between you and that resolver. DoH and DoT offer no protection at=20 all from a lying resolver - you=E2=80=99re just guaranteed to receive preci= sely=20 whatever lies or truth that resolver sends" This distinction is only r= elevant if you actually aren't going to just trust whatever the resolve= r tells you.

-Ekr

--00000000000036176a0590c7e88c-- From nobody Fri Aug 23 07:30:00 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0EB7A1200C1 for ; Fri, 23 Aug 2019 07:29:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.996 X-Spam-Level: X-Spam-Status: No, score=-1.996 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MSkDH7QAoMpG for ; Fri, 23 Aug 2019 07:29:56 -0700 (PDT) Received: from mail-qk1-x72c.google.com (mail-qk1-x72c.google.com [IPv6:2607:f8b0:4864:20::72c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CEEB012009C for ; Fri, 23 Aug 2019 07:29:55 -0700 (PDT) Received: by mail-qk1-x72c.google.com with SMTP id u190so8353215qkh.5 for ; Fri, 23 Aug 2019 07:29:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=h0udFHXz311FjPk+jK0cfRMGDtApoi+aft4uDIxmxYw=; b=u1dGTJfTqfKfi5B//17/ea7jZghfarP2kBWlLI2JDnujzODRNaUAfcrh1twXdLfDwG 620byo/2lWq+JpXqh1w2isWubooi87eM9zf8G53XXJDTFcoYahbevqZvtuJsL9hUZQob xAk545bzSbwASX0nkPQ8/pqJbPy2IU1zb1KCQGlFSQxhtX85nllJ+2AknH1AlPs2Ng/z U2dGaCnqZOOApV7ooPPi61EpxgosAyIRkkfkPgjIO7wDzsNIBTauBw6jHUMbGr56Cq6i 3aOS/QYElU+3qhHPBmxGGCWLruhib9m76sE7yLF5o4KokIcIUl7y89sFxp1D9okm1ANL GVmQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=h0udFHXz311FjPk+jK0cfRMGDtApoi+aft4uDIxmxYw=; b=EHPf8v1olzKWBQa/rce5tE39JChMvRBnbo7Bjdy/nlyp50zrvFZTos9CCJ5OTy5oVV YH4YSF6NdhWq45yYxpbzl2b0jKuMQr3ZBVRGxIWEebuPnG+Fcrm1CzeSTbAQsznnCaCf NefNL1IP+uzFL8kATTrOGZy2/3eEIAGgdWVjSuA5lWP0P4XWiEeKVgyvOb8rFO7XBMlL LqmZnLUZRrFM3TsSv/chs+DJ5LIICP76bIdwqnICsG5CIXuHqSgcrM4lmjxXunwPEh0U 8292GUFfUfucL5/Zzdhjyuv3ujUDs9lKk28qhdLCZVo1gR0OS99E0bRGBE3kLDZZMiTg uZKQ== X-Gm-Message-State: APjAAAVu1KTSarlHkP0Zmwbfr5czC0yPzoCfBV6Jo+woryX+rf0WJ5Ig XBQC9DYKMrbcQi08Jz1R81kKz712 X-Google-Smtp-Source: APXvYqyScVq+cA49Q9XrQ2wUNFfBl0/4SMbnqW7J7zcfRUHNSQaAyr8xmtUvBTrfIuj52RtrFwsfZg== X-Received: by 2002:a37:805:: with SMTP id 5mr4230307qki.351.1566570594732; Fri, 23 Aug 2019 07:29:54 -0700 (PDT) Received: from [192.168.2.4] (cpe-76-179-66-50.maine.res.rr.com. [76.179.66.50]) by smtp.gmail.com with ESMTPSA id i8sm1482110qkm.46.2019.08.23.07.29.53 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 23 Aug 2019 07:29:53 -0700 (PDT) Content-Type: multipart/alternative; boundary=Apple-Mail-1AC752DA-E813-4518-9438-95833106670E Mime-Version: 1.0 (1.0) From: Brian Dickson X-Mailer: iPhone Mail (16G77) In-Reply-To: Date: Fri, 23 Aug 2019 10:29:52 -0400 Cc: ADD Mailing list Content-Transfer-Encoding: 7bit Message-Id: <6644AA53-6787-4F92-BEAF-C4C6FD8533BA@gmail.com> References: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> <59E0EC53-0E30-431C-8376-52C7BFC121A8@virtualized.org> <589DAFCB-1BDC-4156-A2CA-179C4559A6B2@virtualized.org> <683A176C-3CE6-4866-A736-F2A7465FA5B5@rfc1035.com> <69015C05-4AE8-4FB2-94D4-3B52018DEBA6@rfc1035.com> To: Eric Rescorla Archived-At: Subject: Re: [Add] data integrity and DNSSEC or DoH/DoT X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 23 Aug 2019 14:29:58 -0000 --Apple-Mail-1AC752DA-E813-4518-9438-95833106670E Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable > On Aug 23, 2019, at 8:25 AM, Eric Rescorla wrote: >=20 >=20 >=20 >> On Fri, Aug 23, 2019 at 9:04 AM Jim Reid wrote: >> On 23 Aug 2019, at 05:39, Eric Rescorla wrote: >> >=20 >> >=20 >> >=20 >> > On Thu, Aug 22, 2019 at 1:41 PM Jim Reid wrote: >> >=20 >> >> > On 22 Aug 2019, at 08:00, Eric Rescorla wrote: >> >> >=20 >> >> > Suppose that I receive a bogus response to my A record query, how am= I to usefully distinguish "this is malware blocking" from "this resolver is= malicious"? >> >>=20 >> >> I suppose draft-ietf-dnsop-extended-error could add another error code= for the specific case of a malicious resolver. Whatever that might mean. Th= ough I doubt the operators of such servers will choose to set that evil bit o= n their responses. >> >>=20 >> >> PS A potential problem with this I-D is these extended error codes won= =E2=80=99t be signed. So they can be spoofed by bad actors. >> >>=20 >> > Yes, and for this reason I don't see how this solves the problem. It's j= ust "resolver blocked it and claims reason X". >>=20 >> Which I thought answered your original question. Though maybe those respo= nses should be signed somehow. Handwave, handwave. If you have suggestions o= n how to improve the security considerations of that I-D, please supply text= to dnsop. >>=20 >> But now I=E2=80=99m confused. Could you please clarify what you mean by m= alicious resolver? We seem to be using different (unwritten) definitions. >>=20 >> I also don=E2=80=99t understand why it matters to distinguish between res= ponses that say "this is malware blocking" from "this resolver is malicious=E2= =80=9D. The end result=E2=80=99s the same - the resolver=E2=80=99s not retur= ning the expected DNS data for the query. What difference does it make if th= e resolver=E2=80=99s giving a genuine or a bogus reason for doing that? Afte= r all, the client will almost always believe what the resolver told them. It= entered into an implicit or explicit trust relationship with that resolver w= hen the client sent its DNS queries there. >=20 > Let's go back to your original message, which made the distinction between= actual truth and whatever the resolver told you "DNSSEC validation means yo= u get the truth, the whole truth and nothing but the truth regardless of you= r choice of resolver or the transport path between you and that resolver. Do= H and DoT offer no protection at all from a lying resolver - you=E2=80=99re= just guaranteed to receive precisely whatever lies or truth that resolver s= ends" This distinction is only relevant if you actually aren't going to just= trust whatever the resolver tells you. There are two kinds of =E2=80=9Cblocked=E2=80=9D answers that a resolver doi= ng this kind of blocking would return. All non-blocked answers would pass su= ch a check.=20 The two kinds are: 1) A non-zero response code (indicating an error) with Jim=E2=80=99s suggest= ed extended error code explaining why. This =E2=80=9Clie=E2=80=9D is meta-da= ta only. The only time this response would fail to validate is if it was an N= XDOMAIN response, which would require a signed proof of non-existence. Addin= g Jim=E2=80=99s suggested logic only blocks access, it never requires trusti= ng data in the answer. (Adding a signed proof might be possible but would re= quire adding DNSSEC trust anchors.) 2) A substitute response, typically directing the client (user) to a =E2=80=9C= walled garden=E2=80=9D explaining the blocking and possibly doing other thin= gs (like offering the user the option of reporting a false positive). There m= ay be ways to sign these substitute responses, but those would require addit= ional DNSSEC trust anchors (on the client). If the blocking is done using only the first type of response, the distincti= on is significant: the client only ever has to trust negative answers marked= as =E2=80=9Cblocked by XXX=E2=80=9D. All other answers would validate. The c= lient would never have to trust a bogus positive answer. If additional trust anchors are used, their use could be restricted to answe= rs marked with extended response codes, and highlighted by the browser as su= ch. In this case, all responses would be validated, either with the standard= trust anchor, or with an extra trust anchor used only for blocking. Brian= --Apple-Mail-1AC752DA-E813-4518-9438-95833106670E Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable

On Aug 23, 2019, a= t 8:25 AM, Eric Rescorla <ekr@rtfm.com> wrote:



On Fri, Aug 23, 2019 at 9:04 AM Jim Reid <<= a href=3D"mailto:jim@rfc1035.com">jim@rfc1035.com> wrote:
On 23 Aug 2019, at 05:39, Eri= c Rescorla <ekr@rtfm.co= m> wrote:
>
>
>
> On Thu, Aug 22, 2019 at 1:41 PM Jim Reid <jim@rfc1035.com> wrote:
>
>> > On 22 Aug 2019, at 08:00, Eric Rescorla <ekr@rtfm.com> wrote:
>> >
>> > Suppose that I receive a bogus response to my A record query, h= ow am I to usefully distinguish "this is malware blocking" from "this resolv= er is malicious"?
>>
>> I suppose draft-ietf-dnsop-extended-error could add another error c= ode for the specific case of a malicious resolver. Whatever that might mean.= Though I doubt the operators of such servers will choose to set that evil b= it on their responses.
>>
>> PS A potential problem with this I-D is these extended error codes w= on=E2=80=99t be signed. So they can be spoofed by bad actors.
>>
> Yes, and for this reason I don't see how this solves the problem. It's j= ust "resolver blocked it and claims reason X".

Which I thought answered your original question. Though maybe those response= s should be signed somehow. Handwave, handwave. If you have suggestions on h= ow to improve the security considerations of that I-D, please supply text to= dnsop.

But now I=E2=80=99m confused. Could you please clarify what you mean by mali= cious resolver? We seem to be using different (unwritten) definitions.

I also don=E2=80=99t understand why it matters to distinguish between respon= ses that say "this is malware blocking" from "this resolver is malicious=E2=80= =9D. The end result=E2=80=99s the same - the resolver=E2=80=99s not returnin= g the expected DNS data for the query. What difference does it make if the r= esolver=E2=80=99s giving a genuine or a bogus reason for doing that? After a= ll, the client will almost always believe what the resolver told them. It en= tered into an implicit or explicit trust relationship with that resolver whe= n the client sent its DNS queries there.

Let= 's go back to your original message, which made the distinction between actu= al truth and whatever the resolver told you "DNSSEC validation means you get= the truth, the whole truth and nothing=20 but the truth regardless of your choice of resolver or the transport=20 path between you and that resolver. DoH and DoT offer no protection at=20 all from a lying resolver - you=E2=80=99re just guaranteed to receive precis= ely=20 whatever lies or truth that resolver sends" This distinction is only relevan= t if you actually aren't going to just trust whatever the resolver tells you= .

There are two kinds of =E2=80= =9Cblocked=E2=80=9D answers that a resolver doing this kind of blocking woul= d return. All non-blocked answers would pass such a check. 
<= br>
The two kinds are:
1) A non-zero response code (indi= cating an error) with Jim=E2=80=99s suggested extended error code explaining= why. This =E2=80=9Clie=E2=80=9D is meta-data only. The only time this respo= nse would fail to validate is if it was an NXDOMAIN response, which would re= quire a signed proof of non-existence. Adding Jim=E2=80=99s suggested logic o= nly blocks access, it never requires trusting data in the answer. (Adding a s= igned proof might be possible but would require adding DNSSEC trust anchors.= )
2) A substitute response, typically directing the client (user) t= o a =E2=80=9Cwalled garden=E2=80=9D explaining the blocking and possibly doi= ng other things (like offering the user the option of reporting a false posi= tive). There may be ways to sign these substitute responses, but those would= require additional DNSSEC trust anchors (on the client).

If the blocking is done using only the first type of response, the di= stinction is significant: the client only ever has to trust negative answers= marked as =E2=80=9Cblocked by XXX=E2=80=9D. All other answers would validat= e. The client would never have to trust a bogus positive answer.
<= br>
If additional trust anchors are used, their use could be restr= icted to answers marked with extended response codes, and highlighted by the= browser as such. In this case, all responses would be validated, either wit= h the standard trust anchor, or with an extra trust anchor used only for blo= cking.

Brian
= --Apple-Mail-1AC752DA-E813-4518-9438-95833106670E-- From nobody Fri Aug 23 07:45:34 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 98D9A120074 for ; Fri, 23 Aug 2019 07:45:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.401 X-Spam-Level: X-Spam-Status: No, score=-1.401 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FORGED_FROMDOMAIN=0.249, FREEMAIL_FROM=0.001, HEADER_FROM_DIFFERENT_DOMAINS=0.249, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KXHQZ12MDTJx for ; Fri, 23 Aug 2019 07:45:30 -0700 (PDT) Received: from mail-io1-f42.google.com (mail-io1-f42.google.com [209.85.166.42]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C5654120073 for ; Fri, 23 Aug 2019 07:45:30 -0700 (PDT) Received: by mail-io1-f42.google.com with SMTP id s21so20725552ioa.1 for ; Fri, 23 Aug 2019 07:45:30 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=ipQDUQRJ71wQFYLdxyYpzHkgcl6dPZwen8nV6DpcchI=; b=kdei87u9dQ86PvVdOphnh4y53Gl6fpN0kmadw8fAbyaDi+p+Ve9bqmSf5SAHwmzbk3 mPPKQSp2X6PCbcUtfS5SdewXBbLcDj0B9TAvdLvAYSyDPCodrU/no0RwcZKqk1MZfg/m RoT7GxKbPu+2FiKCVy4t5CqQTuH77Xc30BfnwJxYgXu6kLaBRptYNcZTW1j09+vJ3Zv3 63avPvBWjK5vJ04RK8DQfcrXd0YnmJMNSu8dME3J79bmwv+imCDPCcOQaTADMLqIgrWA IQukNZ8nU882KhtPrId/3hISN8a342hqiI01QFOPEoyFiuq+aFF4xZboIyd/DGIm+K0L ZRPA== X-Gm-Message-State: APjAAAXnmZ+Kzul2htd0H1P1M8DAN3UUVYOpNaAvFcHESGYoCVCKIVYe oujFjdq2Ol2HKmTZmnath8Ak5FOkgKRWcUMyVsT7rw== X-Google-Smtp-Source: APXvYqwaZ+uHe0+ys9RFk9Ip/KFsKnsbMwK5aCWmaMLK4xu6C1vZgluSk0Z7C1+jEvTxmiRiVYKf8suNGkLR9Uj0ul4= X-Received: by 2002:a05:6638:691:: with SMTP id i17mr5294300jab.70.1566571529579; Fri, 23 Aug 2019 07:45:29 -0700 (PDT) MIME-Version: 1.0 From: Barry Leiba Date: Fri, 23 Aug 2019 10:45:28 -0400 Message-ID: To: add@ietf.org Content-Type: text/plain; charset="UTF-8" Archived-At: Subject: [Add] Plans for ADD going forward X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 23 Aug 2019 14:45:32 -0000 The IESG and IAB had a meeting this week to discuss possible plans going forward. We agree that there is work to do, and that it's important to get it going sooner, rather than later. We're not settled on anything yet, and we'll keep this list informed as things gel, but there will likely be chartered items for a working group (an existing one or a new one; that's not certain yet) and we're looking at the possibility of a workshop to have a longer chunk of focused time for the community to discuss what makes sense to work on here, and what might be suitable for working on elsewhere. We are making progress on plans for this, so please be patient a bit longer. One thing that we're certain about is that we all need to get to a point where we understand each other's concerns, whether or not we agree with them, and that we can discuss this calmly and respectfully. It's very clear that none of the issues we're discussing is black and white: people with different perspectives are concerned about different things, and what is a benefit to one perspective may be a drawback to another. So as we continue this discussion, let's please be careful to listen, and to accept that points of view with which we disagree are still important to those who hold them, and are valid concerns from a perspective that differs from ours. Thanks, all, for continued patience as we work this out. Barry, ART AD From nobody Fri Aug 23 07:50:35 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4839E12086C for ; Fri, 23 Aug 2019 07:50:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hhBGsNXqu-Mu for ; Fri, 23 Aug 2019 07:50:28 -0700 (PDT) Received: from relay.sandelman.ca (relay.cooperix.net [176.58.120.209]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0F18E1200CC for ; Fri, 23 Aug 2019 07:50:27 -0700 (PDT) Received: from dooku.sandelman.ca (unknown [142.169.78.41]) by relay.sandelman.ca (Postfix) with ESMTPS id E291C1F45E; Fri, 23 Aug 2019 14:50:25 +0000 (UTC) Received: by dooku.sandelman.ca (Postfix, from userid 179) id B8FBA3FB5; Fri, 23 Aug 2019 10:50:40 -0400 (EDT) From: Michael Richardson To: "add\@ietf.org" , Adam Roach In-reply-to: <11f9dfe2-ab05-2227-7643-e53da95ec717@nostrum.com> References: <1444D5E7-DEA7-437C-B12B-6C31FEA563DD@sky.uk> <11f9dfe2-ab05-2227-7643-e53da95ec717@nostrum.com> Comments: In-reply-to Adam Roach message dated "Thu, 22 Aug 2019 11:10:40 -0500." X-Mailer: MH-E 8.6; nmh 1.6; GNU Emacs 24.5.1 MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha256; protocol="application/pgp-signature" Date: Fri, 23 Aug 2019 10:50:40 -0400 Message-ID: <18798.1566571840@dooku.sandelman.ca> Archived-At: Subject: Re: [Add] A thought -- Move the policy decisions outside the application. X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 23 Aug 2019 14:50:34 -0000 --=-=-= Content-Type: text/plain {I'd like to suggest that everyone limit themselves to one reply per day} Adam Roach wrote: > The other half is exposing information to applications about the way > the OS is resolving names (encrypted vs cleartext, local-network versus > public DNS, etc), and the means by which it was configured to do so > (e.g., by the network as part of acquiring an address, by centralized > enterprise policy, by local configuration override). The applications > could then use this information to determine whether there is a policy > reason to use the local system-configured resolver; and, if so, do so > [1]. Long ago, in the early days of DNSSEC, before type-code-rollover, I suggested that we needed WAY MORE than SERVFAIL as the failure code to applications when DNSSEC did not validate. Having a full (secure) resolver inside the application makes it much easier to get better diagnostics. > The second is the "Parental Controls" feature offered by both Windows > and OS X. If Parental Controls are configured for the account running > Firefox, it will disable DoH completely, under the assumption that > there may be some kind of local DNS filtering going on as part of that > feature. That's an interesting thing to know about. > All of that said, it's pretty unclear about whether that kind of thing > is work that the IETF could usefully take on. It seems more like the > kind of thing that would need to come from OS vendors, depending on the > specific features implemented and made available by their operating > systems. So I like the approach, but it's a bit unclear whether it's > actionable in this venue. It's API work. It's often within the system. If we took the view that we needed better communication of errors for resolvers not just within the system, then maybe it's our problem. We might also find that the in-system resolvers use DNS wire format for their responses, and would like to allocate codes from IANA to keep things straight. -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEERK+9HEcJHTJ9UqTMlUzhVv38QpAFAl1f/UAACgkQlUzhVv38 QpBtAAf/aS10XBwmx0MavF9YDDzrf4pOGjSsgMM+gdxgK0vT/ogH3oc50orX+fcx trcCrVInj4KLwbGq3PG0EiAzJEXyu11MjTcIK5GzbFQXMKViVSMItjALZ4yPYYB3 E/jK5/Ug/E9Q6hge+8rjT+7deHhir0lQLjlLX7ZKi7jZUFwva7dfUUox1la5/T6s caZtHmzXy//36F/rl1zF8ePNt5Yo1X5sY8jORh5gVM/o+oWDGBG7KoGSRF0nM0I1 DBAgyvxdLTAXKmy7DKARh0aktCyFtg40YjyQeRE7+I7kX41XFyb4koAXGxvILzS1 Dh7aJbJGOdTHh4g3YzE20Ek4i8X/0w== =t0CQ -----END PGP SIGNATURE----- --=-=-=-- From nobody Fri Aug 23 08:22:12 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AC4861208A7 for ; Fri, 23 Aug 2019 08:22:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.459 X-Spam-Level: X-Spam-Status: No, score=-1.459 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, NUMERIC_HTTP_ADDR=1.242, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=bt.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZqySWwmRbi_o for ; Fri, 23 Aug 2019 08:22:08 -0700 (PDT) Received: from smtpe1.intersmtp.com (smtpe1.intersmtp.com [213.121.35.71]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6E79D1208BA for ; Fri, 23 Aug 2019 08:22:06 -0700 (PDT) Received: from tpw09926dag18g.domain1.systemhost.net (10.9.212.34) by BWP09926076.bt.com (10.36.82.107) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.1.1713.5; Fri, 23 Aug 2019 16:22:03 +0100 Received: from tpw09926dag17g.domain1.systemhost.net (10.9.212.33) by tpw09926dag18g.domain1.systemhost.net (10.9.212.34) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Fri, 23 Aug 2019 16:22:04 +0100 Received: from bwp09926076.bt.com (10.36.82.107) by tpw09926dag17g.domain1.systemhost.net (10.9.212.33) with Microsoft SMTP Server (TLS) id 15.0.1395.4 via Frontend Transport; Fri, 23 Aug 2019 16:22:04 +0100 Received: from GBR01-CWL-obe.outbound.protection.outlook.com (104.47.20.59) by smtpe1.intersmtp.com (10.36.82.107) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.1.1713.5; Fri, 23 Aug 2019 16:22:02 +0100 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=OVweormIlkM+4hPo37PaGPAmlu7piXp3ajE+9D4wYCPD6WhOvkUo+g59VAp+KnHFylQv5lJhndzN7T99k+W9N8OW0J/T+8Po4x4MrvYs86j5GSDRtYVt/fl9gUoQ47dm97II1bjiqzs77GexS5Rl2UWUuhOvBjG/xpa/+tMEEP9lsy/i1J+/0yvJJ1YsE9Qn2SjusmJXurOBJww3oT1a5Im54YvQM9+6EhuDyqEQKe5kCUCnh/e4TlPdKBM+IRFeGyuGn7eVxOA+UMh2XLtIt3+Nw3lQ1CfSrsIX5QPnrcEARXf0ggk5gzgmzppL9eeXx5L70kTILwPbAcBDg3ymVQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=SFZqq5j4s047h7PQ1/gF7956TrROywJSZazEL/qv3uk=; b=AHXY1BKDwVWL+hg55djyKrK/wrEN8X3xxsvKyf3dOmPu/OekxlLjlBn54HN2K75PUJPrE6NxVvSU2mPgSPZso+yovt2Z0yThaTPpK+5SxVnANFoy8pO5P5aTjFrn9DDabxstBieQRb5QpehXsI3lPbQgxFCLKH/vBDi+wBfuGbD/NJYmE9b+D8WODx7FG+lE1N9aOl9sSRIXStxRGocb5VzGJy67DePq8ZwZ8u/HebWetOaJVk8tZEvfByI55v8F5TvKav3f/NNxN6v42tjxGomjlphF08BoX4aFuxYQ1Go9OWCCuVRXFyYZHXCyprXB0mIY8ttSG2HHF5AuDfA8qw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=bt.com; dmarc=pass action=none header.from=bt.com; dkim=pass header.d=bt.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bt.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=SFZqq5j4s047h7PQ1/gF7956TrROywJSZazEL/qv3uk=; b=I2BTRfGmOE81y+pIj5uSURQlG6+HGALtOYrezT+izgqGgipy5RmmAvOG0KVMiQO4ebrNWnY1s2pjH9BwPNgRLm8SHqawuoiXrJzkkSLyzVlQ2Fq7+eZY9Guh6PAe6GcLlCgz6ZeMT3aXwELmDBUtUTt/64M6p87F/1+G9J870Ko= Received: from LO2P123MB2256.GBRP123.PROD.OUTLOOK.COM (20.176.158.15) by LO2P123MB1855.GBRP123.PROD.OUTLOOK.COM (20.176.157.15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2178.18; Fri, 23 Aug 2019 15:22:03 +0000 Received: from LO2P123MB2256.GBRP123.PROD.OUTLOOK.COM ([fe80::6901:b47d:a350:98f3]) by LO2P123MB2256.GBRP123.PROD.OUTLOOK.COM ([fe80::6901:b47d:a350:98f3%5]) with mapi id 15.20.2199.015; Fri, 23 Aug 2019 15:22:03 +0000 From: To: Thread-Topic: RE: [Add] Participation Thread-Index: AdVZxYsbuOjRJnuhRQeZ8pJomAbkvg== Date: Fri, 23 Aug 2019 15:22:03 +0000 Message-ID: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=chris.box@bt.com; x-originating-ip: [193.113.48.7] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 30454a57-a9eb-42be-836f-08d727dda681 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(5600166)(711020)(4605104)(1401327)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(2017052603328)(7193020); SRVR:LO2P123MB1855; x-ms-traffictypediagnostic: LO2P123MB1855: x-ms-exchange-purlcount: 2 x-microsoft-antispam-prvs: x-antispam-2: 1 x-ms-oob-tlc-oobclassifiers: OLM:8882; x-forefront-prvs: 0138CD935C x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(6019001)(4636009)(366004)(346002)(39860400002)(136003)(376002)(396003)(269900001)(189003)(199004)(316002)(53936002)(33656002)(8676002)(6246003)(229853002)(74316002)(1730700003)(25786009)(486006)(86362001)(186003)(6116002)(3846002)(26005)(102836004)(476003)(81156014)(6506007)(256004)(4744005)(71200400001)(71190400001)(55016002)(5660300002)(2906002)(7736002)(66066001)(8936002)(7696005)(99286004)(6306002)(52536014)(478600001)(305945005)(76116006)(66556008)(66446008)(2501003)(6436002)(5640700003)(66476007)(66946007)(64756008)(14454004)(9686003)(2351001)(66574012)(81166006)(6916009)(966005); DIR:OUT; SFP:1101; SCL:1; SRVR:LO2P123MB1855; H:LO2P123MB2256.GBRP123.PROD.OUTLOOK.COM; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: bt.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: FD0ZbcLLr1OKVlbsbNXdmRXm64Ocq2NxLfGKUdURzENhomC0DaD66tTYwx4/BgInIk+oeqiaTCuItY0Iz+mMrLA3nCF8WoSH4/CtfYLdtdNH7kWzqJvEk44HiZhojlf9gP0uU247hi9TFNayitaj0BPvS3HgDqxfqfD8HnXySlea8Rv4Xwj9X0zfK8VhFxA2VJnFWLqAjdVIJH79O48tSHflDSjHNoDF0KRsrpyRD65K1sVWLVgF7/ONrImrvoZdvbFowNx8BXzG7327wBGNiKNX1hqw1lcBnF6rX5q9rg0FaJzUVa3jRCTnRNUkIo6qECtsvTwSAYwUYuXit9rSYpmJZsAK2vkuVMJy2w87IvCQ3Zv7DFnA/yP9F7UxCrl9xbTw77Ax/ifyiXXwJxppwEz5uUkeC6LVZckNtZ7gcmI= x-ms-exchange-transport-forked: True Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: 30454a57-a9eb-42be-836f-08d727dda681 X-MS-Exchange-CrossTenant-originalarrivaltime: 23 Aug 2019 15:22:03.0436 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: a7f35688-9c00-4d5e-ba41-29f146377ab0 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: 4T+Xe54+1QYmsAY3zpWCEuR8d6aKCsEIEKxSgRtj3fub7J6R0ODNVERi9ILSnsEVnGBvAodbn7qD2df/mowHJA== X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO2P123MB1855 X-NAI-Spam-Flag: NO X-NAI-Spam-Level: X-NAI-Spam-Threshold: 5 X-NAI-Spam-Score: 0.2 X-NAI-Spam-Report: 5 Rules triggered * 0.1 -- GEN_SPAM_FEATRE * 0.1 -- THREAD_INDX_INVALD_VAL * 0 -- EDT_SDHA_ADR_FRG * 0 -- EDT_SDHA_DMN_FRG * 0 -- RV6619 X-NAI-Spam-Version: 2.2.0.9309 : core <6619> : inlines <7138> : streams <1830925> : uri <2888536> X-OriginatorOrg: bt.com Archived-At: Subject: Re: [Add] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 23 Aug 2019 15:22:11 -0000 After Kevin's explanation of Vodafone UK's traffic handling, I can clarify = something that Rob mentioned this week: > I also found that BT Smart Hub / Home Hub routers require installation of= root certs, > but I think it may only be for communicating with the router and one BT w= eb page, at the moment. BT hubs do not do HTTPS interception or man in the middle. BT hubs only present a self-signed cert for admin user interface connection= s to https://192.168.1.254. (Customers can also connect to http://192.168.1= .254.) Chris From nobody Fri Aug 23 08:31:50 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 02DD7120105 for ; Fri, 23 Aug 2019 08:31:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=bt.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ozMc_z_1qdyi for ; Fri, 23 Aug 2019 08:31:46 -0700 (PDT) Received: from smtpe1.intersmtp.com (smtpe1.intersmtp.com [213.121.35.76]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3D3FE12004D for ; Fri, 23 Aug 2019 08:31:46 -0700 (PDT) Received: from tpw09926dag05f.domain1.systemhost.net (10.9.202.24) by BWP09926081.bt.com (10.36.82.112) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.1.1713.5; Fri, 23 Aug 2019 16:26:59 +0100 Received: from tpw09926dag08g.domain1.systemhost.net (10.9.202.43) by tpw09926dag05f.domain1.systemhost.net (10.9.202.24) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Fri, 23 Aug 2019 16:27:19 +0100 Received: from RDW083A009ED65.bt.com (10.187.98.35) by tpw09926dag08g.domain1.systemhost.net (10.9.202.43) with Microsoft SMTP Server (TLS) id 15.0.1395.4 via Frontend Transport; Fri, 23 Aug 2019 16:27:19 +0100 Received: from GBR01-CWL-obe.outbound.protection.outlook.com (104.47.20.50) by smtpe1.intersmtp.com (62.239.224.236) with Microsoft SMTP Server (TLS) id 14.3.439.0; Fri, 23 Aug 2019 16:23:00 +0100 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=mrfa/LT+5f7QXHJkqWuEN+fXHBcU325Ac0nLCicXU0ztXi6pe5oGEmQAsIjmDf3YK+gBUGSQ8C2nmJDkruIsRbH2LikOUpEQ4jukbN2i8BQBDWEewXI3NIkt0lU2Vtj36bGD5C6UAvcKYbolUJcViWDm0z7c1fhJDqzeZ29F/aph3v1AkiaDCzOM+aEp2rr2x0DDge3Vhc3K/AJPU1ucRSya7ou7bLmGzgu7EhJE1gq26g2JnAFPZq0UwMIMubw+uCaHoY1RQ8u/UJhzsyPw10Y0NzBEDEUo1zNhRDZZ0wZ5mVGYB2+P6F26rYycTVUoMsysvFHH5M4OBEWOOf32tg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=wG7IQNty6yGZANBLAev5c73J6mTRBQljH/o8K5/mrHc=; b=Mgli2g7LLsA5nQe5d/ZDUadhWiAOS9RtMjFktdfEi/bykjVxjSQ4tJQyoiNDza0T0idnagUOmjjbvplYG2TNl6OjeTCrt04onP1/3ZmwTi1J1i79qEykxfiF72iityzr94gSixJ/NmXqr6sSKatRcLTBwSfBBmlBpPJaYSEkbxQWV9r3m2xNt6KhOtnOEWWnTuIyFtzFiWRYnZlGQckCeHW9uuwWAfS8pQ/ko7zgjzQ+B4VPSctxAJosEjrXrdmHe8/v5/gnUjoJgG05G5qB5HOTc4QwxC7dj4GjVsp8CC+iDq7s1R4z2mHDj5tzC978dLt2CpaqD4YpEoWBlSFp9g== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=bt.com; dmarc=pass action=none header.from=bt.com; dkim=pass header.d=bt.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bt.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=wG7IQNty6yGZANBLAev5c73J6mTRBQljH/o8K5/mrHc=; b=tjhwEmqQu6toG6R0SzWm1M8Fl6yKWF3I1J/GNpHb8O8N5tVjV/g8PN875FMMLkjSk/iBmIixnm5a3ED0PI/7ZseisRyiev0Bx9xXD14UuTwhTx1sK79+Wv5eTbZ0dfa0LE0QfWzw/OEJ2wgZEhlDzWxBa6xXEsuuIxiFLG8XF8A= Received: from LO2P123MB2256.GBRP123.PROD.OUTLOOK.COM (20.176.158.15) by LO2P123MB2237.GBRP123.PROD.OUTLOOK.COM (20.176.157.86) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2178.16; Fri, 23 Aug 2019 15:27:13 +0000 Received: from LO2P123MB2256.GBRP123.PROD.OUTLOOK.COM ([fe80::6901:b47d:a350:98f3]) by LO2P123MB2256.GBRP123.PROD.OUTLOOK.COM ([fe80::6901:b47d:a350:98f3%5]) with mapi id 15.20.2199.015; Fri, 23 Aug 2019 15:27:13 +0000 From: To: , Thread-Topic: [Add] Plans for ADD going forward Thread-Index: AQHVWcFy4yQJVP1EmUeWomfOV40D/KcI2Y6Q Date: Fri, 23 Aug 2019 15:27:13 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=chris.box@bt.com; x-originating-ip: [193.113.48.7] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: f19e5fd2-6378-47a7-021e-08d727de5fa6 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(5600166)(711020)(4605104)(1401327)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(2017052603328)(7193020); SRVR:LO2P123MB2237; x-ms-traffictypediagnostic: LO2P123MB2237: x-microsoft-antispam-prvs: x-antispam-2: 1 x-ms-oob-tlc-oobclassifiers: OLM:10000; x-forefront-prvs: 0138CD935C x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(4636009)(136003)(396003)(376002)(366004)(39860400002)(346002)(199004)(189003)(33656002)(476003)(14454004)(7696005)(2906002)(52536014)(316002)(5660300002)(110136005)(486006)(8936002)(66476007)(76116006)(9686003)(6436002)(66556008)(64756008)(66446008)(8676002)(81166006)(6246003)(81156014)(74316002)(66066001)(25786009)(229853002)(11346002)(53936002)(305945005)(102836004)(99286004)(7736002)(55016002)(446003)(14444005)(256004)(6506007)(66946007)(26005)(186003)(478600001)(86362001)(76176011)(71190400001)(3846002)(2501003)(71200400001)(6116002); DIR:OUT; SFP:1101; SCL:1; SRVR:LO2P123MB2237; H:LO2P123MB2256.GBRP123.PROD.OUTLOOK.COM; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: bt.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: UpH5RM2FMgYmLn5BQAk2WMjhKkZDfBhvDbxIlkP2aa0heDOQmKM2gbTypOHm9aDpYysDZEdkYcZI+xNpuY3a0Hjdu7qgg7srSCBWBdU96jLVS7gyg0zAV90X7Ht7T1gl4qna02OI4Rw0dmweE77K/fwsOFLteqCniHTha7CEihHMbR5As3BvejeFoQApr7XSFAFvwgTJoNuwYz5SgVBxf+EXjlbNNDK0GUlMwirwbMjZRan3loWObecbeCEZ+yhuW1bGfYwKZVh/TglaXNtPlKBXE3STcEvUWKfouBEm715E/jDfTWbdM5vlzINnCXLwslk8WJCyQCZkb59XjVpQ8oQK0MZeV/1gxiSNPQXcbNr631Br4uvn+4Uju+VoP42MtqbRDa+RuZ1SWfw2w9EYD2ipgDQWvqF81YjCKRhlxa4= x-ms-exchange-transport-forked: True Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: f19e5fd2-6378-47a7-021e-08d727de5fa6 X-MS-Exchange-CrossTenant-originalarrivaltime: 23 Aug 2019 15:27:13.6113 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: a7f35688-9c00-4d5e-ba41-29f146377ab0 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: 4AsZSQJBpxSumeFyDUJnQlknEwE9IS4OX7uUgRKTL87d3LrbD81FTBnjEF2V6LxumU2ZhGmw0uT8tPMh2KaDKw== X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO2P123MB2237 X-OriginatorOrg: bt.com Archived-At: Subject: Re: [Add] Plans for ADD going forward X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 23 Aug 2019 15:31:48 -0000 Barry, > there will likely be chartered items for a > working group (an existing one or a new one; that's not certain yet) and = we're > looking at the possibility of a workshop to have a longer chunk of focuse= d time > for the community to discuss what makes sense to work on here, and what > might be suitable for working on elsewhere. >=20 > We are making progress on plans for this, so please be patient a bit long= er. Thank you, and the whole IAB and IESG, for spending time thinking about thi= s. It's good that you agree there is work to do, and I'm happy to wait for = the right venue. > One thing that we're certain about is that we all need to get to a point = where we > understand each other's concerns, whether or not we agree with them, and = that > we can discuss this calmly and respectfully. > It's very clear that none of the issues we're discussing is black and > white: people with different perspectives are concerned about different t= hings, > and what is a benefit to one perspective may be a drawback to another. S= o as > we continue this discussion, let's please be careful to listen, and to ac= cept that > points of view with which we disagree are still important to those who ho= ld > them, and are valid concerns from a perspective that differs from ours. I fully support all the above. Chris From nobody Fri Aug 23 08:46:26 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1B5A912083F for ; Fri, 23 Aug 2019 08:46:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.4 X-Spam-Level: X-Spam-Status: No, score=-1.4 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FORGED_FROMDOMAIN=0.249, FREEMAIL_FROM=0.001, HEADER_FROM_DIFFERENT_DOMAINS=0.249, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3yWytBGIWGqc for ; Fri, 23 Aug 2019 08:46:23 -0700 (PDT) Received: from mail-ed1-f46.google.com (mail-ed1-f46.google.com [209.85.208.46]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8AD5E120105 for ; Fri, 23 Aug 2019 08:46:19 -0700 (PDT) Received: by mail-ed1-f46.google.com with SMTP id h8so14128513edv.7 for ; Fri, 23 Aug 2019 08:46:19 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to; bh=HS5bQGFGxu9cwzBHJAuK3IM7RXCgLKWvUPkv/tdV66w=; b=InpZWZtP9ljw3wTop0JWwqX7w1tdoSxjIiRIOc/ZpcqeCy/MMIIlz+W+Z2WO9MHgzb 4t2AC6O7xTaUPFkO6fVODo5zDfliK82tpza0neAIDawsKlR4te4JJxGfakSUTLBbOwIz ZnDdbL/OvCye35axKeQhCn4zS/GExFyOe+g/8+RjEBXoe62sksnlpfXSCz6Ji2vpN+ol hel+1pykui2HdGrqcGqO53XhHokncwNUtPxe6ObbTXQLmgAnCfZkuMe8uVxbMkpBmmY+ buo6YiTuUETlLFwnH/cM0pz3G6Nq3EMxyKvMZtT80GtG3UW+1TswncFCmzom+8wXghg8 LF/Q== X-Gm-Message-State: APjAAAUjwD6Iyw3ZBmLAp370OFh9w2EGqL4Q8X0sv/JBeI+wPPDg9u2y OsBFIO190OAFBg/kLXNk+pVgXS670JZXc9ZulLeZ1K0a X-Google-Smtp-Source: APXvYqwFNVnHEQoddhlLcHSv0YXjL7F2BTBjuA5uc2rbUz2ABGrJV+NSKtoqZC8lAWrlb0Sfv9EF1bNfMI0E+z/mj6c= X-Received: by 2002:a17:906:8313:: with SMTP id j19mr4896569ejx.276.1566575177742; Fri, 23 Aug 2019 08:46:17 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Barry Leiba Date: Fri, 23 Aug 2019 11:46:06 -0400 Message-ID: To: add@ietf.org Content-Type: text/plain; charset="UTF-8" Archived-At: Subject: Re: [Add] Plans for ADD going forward X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 23 Aug 2019 15:46:25 -0000 Clarifying one thing: > and we're looking > at the possibility of a workshop to have a longer chunk of focused > time for the community to discuss what makes sense to work on here, > and what might be suitable for working on elsewhere. This would not likely be an IAB workshop, but one organized by some other group or organization -- maybe ISOC, maybe somewhere else. Barry On Fri, Aug 23, 2019 at 10:45 AM Barry Leiba wrote: > > The IESG and IAB had a meeting this week to discuss possible plans > going forward. We agree that there is work to do, and that it's > important to get it going sooner, rather than later. We're not > settled on anything yet, and we'll keep this list informed as things > gel, but there will likely be chartered items for a working group (an > existing one or a new one; that's not certain yet) and we're looking > at the possibility of a workshop to have a longer chunk of focused > time for the community to discuss what makes sense to work on here, > and what might be suitable for working on elsewhere. > > We are making progress on plans for this, so please be patient a bit longer. > > One thing that we're certain about is that we all need to get to a > point where we understand each other's concerns, whether or not we > agree with them, and that we can discuss this calmly and respectfully. > It's very clear that none of the issues we're discussing is black and > white: people with different perspectives are concerned about > different things, and what is a benefit to one perspective may be a > drawback to another. So as we continue this discussion, let's please > be careful to listen, and to accept that points of view with which we > disagree are still important to those who hold them, and are valid > concerns from a perspective that differs from ours. > > Thanks, all, for continued patience as we work this out. > > Barry, ART AD > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add From nobody Fri Aug 23 09:16:53 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2817212006A for ; Fri, 23 Aug 2019 09:16:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=netorgft5189650.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XYIqm70MhXsA for ; Fri, 23 Aug 2019 09:16:50 -0700 (PDT) Received: from GBR01-LO2-obe.outbound.protection.outlook.com (mail-eopbgr100043.outbound.protection.outlook.com [40.107.10.43]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 36E1E120025 for ; Fri, 23 Aug 2019 09:16:50 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=M3b4PhVhtpZXKEKzkpA8mHVnoPO7VIaRlPAdPknSTY9TRtxIr57vQu18k2PDxZZ7PWXPthxX1O25jBsNkRc+YxSajld4tu+8/ptC+T0HroKdFQ2sw+fxLngqnV5r7PNljRqdauiv7FWEW/JSBU9v1bq28Tf1DzI96junF0a4IL8HQpoUMllzUaofQxKLCb92/K6G2zwpvcL1ozdl5D2F2+sxLyl17SumBdGqEYgx7mHFEU2kqZ23G4MB/Nzt3tzm+qSiqgfYiFmd3JlBGYCn3MGkmRTSCNY88cT0ATv1vB7v42JTcL/l0cycIZJcTTO959kZImH9HTQg5NrYHaO6tA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=kSV/qDF3PHC45lpYwIUaTzW9aRaeXeyiVnTuhN3wE5Q=; b=ktbLEIZVZQYRxEUILNasPZrGTKkJzerq8NFEiuMsSkxOyZ6rLLsGmIYOZ491ubULC4zq0NfSeXkjWcFGP5AJUn+7WWPfZvnYyjn81/giF5rE2Y/omPAo/54pKQbGGgPn3KXGqLlcs05oJ0XdFe2BIbb9HF1Zz3jl+U9DCCQ0zaPiVI6bU80uT9ODGemNrFDVYATmCbujCDDNkV5MwO/c9Zz/hsLdbhHKTnB6cDeF8ACaXGl+xdd7upFNXf3wjgU0jrDzO264VOdlTPzNbHvcyS/C6YOxJlk5+nvQCoDbDgepwKX/63z1UAweqXsaKLV/zTOyidijibGFOWprsx7JkA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=419.consulting; dmarc=pass action=none header.from=419.consulting; dkim=pass header.d=419.consulting; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=NETORGFT5189650.onmicrosoft.com; s=selector1-NETORGFT5189650-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=kSV/qDF3PHC45lpYwIUaTzW9aRaeXeyiVnTuhN3wE5Q=; b=p2YaC32NYKFxzf5XCQiUNiVO5D/6mFej1diSLfeMJEs+RHqyOERqi+6sqfXrQl6/8KIVMB0P+DsiPeOlUiqnFJs4QeVlw7AEd6v1RC+MlCGU40K57BiT1QqLLEU95nkrJi72s3WcblfppRqI0n8nTkc3My6ztfoMLJSxA4B+RpA= Received: from LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM (20.176.138.146) by LO2P265MB1152.GBRP265.PROD.OUTLOOK.COM (20.176.142.17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2178.16; Fri, 23 Aug 2019 16:16:48 +0000 Received: from LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM ([fe80::64e9:9b9e:59fc:26f]) by LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM ([fe80::64e9:9b9e:59fc:26f%5]) with mapi id 15.20.2178.020; Fri, 23 Aug 2019 16:16:48 +0000 From: Andrew Campling To: Barry Leiba , "add@ietf.org" Thread-Topic: [Add] Plans for ADD going forward Thread-Index: AQHVWcn1IvZr6/TPWk2obqivQJDJ1qcI54Zg Date: Fri, 23 Aug 2019 16:16:47 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=andrew.campling@419.consulting; x-originating-ip: [109.70.144.22] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: abe36933-01e9-4588-64f4-08d727e54c89 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(7021145)(8989299)(4534185)(7022145)(4603075)(4627221)(201702281549075)(8990200)(7048125)(7024125)(7027125)(7023125)(5600166)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:LO2P265MB1152; x-ms-traffictypediagnostic: LO2P265MB1152: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:5236; x-forefront-prvs: 0138CD935C x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(136003)(346002)(376002)(366004)(396003)(39830400003)(199004)(189003)(4744005)(186003)(66446008)(64756008)(256004)(66556008)(66476007)(66946007)(81166006)(81156014)(8676002)(2501003)(76116006)(52536014)(14454004)(11346002)(6506007)(25786009)(6436002)(102836004)(446003)(53546011)(316002)(66066001)(110136005)(86362001)(6116002)(7696005)(229853002)(6246003)(71200400001)(3846002)(71190400001)(33656002)(55016002)(2906002)(53936002)(76176011)(9686003)(8936002)(508600001)(486006)(26005)(476003)(5660300002)(305945005)(44832011)(74316002)(99286004)(7736002)(46492003); DIR:OUT; SFP:1101; SCL:1; SRVR:LO2P265MB1152; H:LO2P265MB1327.GBRP265.PROD.OUTLOOK.COM; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: 419.consulting does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: ncAFGPlYUjXjJcutQNxMDJ7yyl2fJuqz5ZSsYqR19V2FqLaiC+HusAkFWXH0pB6yKSUpcWHud4mX6pGDslE9kPptCvdufKzWlA5CPRRFiPdq4+p7Mj5MIP3KgfyM+rOrEVt1Zcc1wDEfx+BnnzDyhGyHr8veZmgD4bMZ7w1KBZUMjpZxBxV7J8/hx9PDSDsE3ezMGCLEQ2ycEWcHSQfEMoP+NK85w+0dOZegEMHHVSwbFXFdezPbI/zaymmimZNOQlZpyiByk1cAyL+xofCzdV2WPBaaPjVum561Jq/4rHLZHPbN/rTnbZqeW+H+uYyRfLpIUn5YfZNMPGD1SIMBsgNDhP3JimO8AjGQE306fQ+QrNnL9FLokJiJJ1S+MdFSh6lte9oM/TzRJ+dCeW8hdORYXaHlDDVSYz/UZLcGnYc= x-ms-exchange-transport-forked: True Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: 419.consulting X-MS-Exchange-CrossTenant-Network-Message-Id: abe36933-01e9-4588-64f4-08d727e54c89 X-MS-Exchange-CrossTenant-originalarrivaltime: 23 Aug 2019 16:16:48.0251 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 9c2ced3e-7522-4755-87dc-f983abc66ec3 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: xFxK6xiBLCNJ/xlague4lNsN+GrSYmJO/gaJk/ATSKHkDc0LwUzarDLMfYilEKa5SRUs+voIJamC9jJuYesmr7N/MeynePV/T31R/cKk/6A= X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO2P265MB1152 Archived-At: Subject: Re: [Add] Plans for ADD going forward X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 23 Aug 2019 16:16:52 -0000 T24gRnJpLCBBdWcgMjMsIDIwMTkgYXQgMTY6NDYgQmFycnkgTGVpYmEgPGJhcnJ5bGVpYmFAY29t cHV0ZXIub3JnPiB3cm90ZToNCg0KPiBDbGFyaWZ5aW5nIG9uZSB0aGluZzoNCg0KPiBPbiBGcmks IEF1ZyAyMywgMjAxOSBhdCAxMDo0NSBBTSBCYXJyeSBMZWliYSA8YmFycnlsZWliYUBjb21wdXRl ci5vcmc+IHdyb3RlOg0KPj4gYW5kIHdlJ3JlIGxvb2tpbmcNCj4+IGF0IHRoZSBwb3NzaWJpbGl0 eSBvZiBhIHdvcmtzaG9wIHRvIGhhdmUgYSBsb25nZXIgY2h1bmsgb2YgZm9jdXNlZCANCj4+IHRp bWUgZm9yIHRoZSBjb21tdW5pdHkgdG8gZGlzY3VzcyB3aGF0IG1ha2VzIHNlbnNlIHRvIHdvcmsg b24gaGVyZSwgDQo+PiBhbmQgd2hhdCBtaWdodCBiZSBzdWl0YWJsZSBmb3Igd29ya2luZyBvbiBl bHNld2hlcmUuDQoNCj4gVGhpcyB3b3VsZCBub3QgbGlrZWx5IGJlIGFuIElBQiB3b3Jrc2hvcCwg YnV0IG9uZSBvcmdhbml6ZWQgYnkgc29tZSANCj4gb3RoZXIgZ3JvdXAgb3Igb3JnYW5pemF0aW9u IC0tIG1heWJlIElTT0MsIG1heWJlIHNvbWV3aGVyZSBlbHNlLg0KDQpJZiB5b3UncmUgbG9va2lu ZyBmb3Igdm9sdW50ZWVycywgaGFwcHkgdG8gaGVscCwgZGlhcnkgcGVybWl0dGluZy4NCg0KDQpB bmRyZXcgDQo= From nobody Fri Aug 23 09:58:24 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 10FD1120020 for ; Fri, 23 Aug 2019 09:58:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 35tqufV274L7 for ; Fri, 23 Aug 2019 09:58:21 -0700 (PDT) Received: from mail-io1-xd35.google.com (mail-io1-xd35.google.com [IPv6:2607:f8b0:4864:20::d35]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 32B66120124 for ; Fri, 23 Aug 2019 09:58:21 -0700 (PDT) Received: by mail-io1-xd35.google.com with SMTP id l7so21652136ioj.6 for ; Fri, 23 Aug 2019 09:58:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=YODIPVJ1gYmTUiQjrDtqRpf88RRmKdc/FtBKIWZ9lCI=; b=PkYB07/nWGo0xzibxgs+DcHG0NPJwrpcQySdzAQ/O4cG72SjSUdtIIYvfx/BCsdsGC 4PWyaUDiemPok1NjOugDkxxTDy3Kp5swaYXRhIgr41g3y6QMx9UbDaDTWJVOpbkPkSph cil3UCBMBKg9NQOgiXope0I/KTFJ4P2cFBLuFKBDF6tKnkH52MQeLJyD5+g16rfZTGgL jHZlhJLDyrB4YBIqsjmCHI9DtkYk9QwGvl36lLNYaggOEC2mT+DCC3V763i/nCAxOMGC FFMXQtFtgpgIy7vfrmBtYYUrTXZP12dSLYd3ak8JmdModN76QBc34d/5+20r4wSYFTc7 EJGw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=YODIPVJ1gYmTUiQjrDtqRpf88RRmKdc/FtBKIWZ9lCI=; b=EMQPQ4jzVxZhimdieXbjOP7ldVoh8cizpBcfDl5F7LCQ/Auux+pubglib7zrJybT2x ZQ5jXDXrNCxL8e9RNuLfQ6aWOcp667kMvSdyKgb2ZDMb6dBc7Ik2fvCu6ztF+T6RXxuW UFPiU5O95YN1Khv0dCYRIq0/FKp8pdEfeCjl8rJE0z2yzr0A5AOokRZ6Z4tHI3b0WDB5 UfMthwnE39xFu1NBBthXi7370DJ9fS9hfTIVTvgaIR15kgF42sbNnIOgyAyJaucMTaR2 k3/ukHehEAVGsTD8N0KIxJ16kpIAvj/7Fd38qmhudPj6FgQYBAdOy63laU6S2wwt54k6 CBgg== X-Gm-Message-State: APjAAAXpX5gYQ1pIu2kxK2tGAklW82iQHGF9mFLgpkEpzTM0v9Qpy+IU FFOmnG5obR9EZgX2cMuuF4FSuQYFm3apaSaBWzs= X-Google-Smtp-Source: APXvYqzhh6JUaA5PmH39tX2Jfpw0Qwx9HFPf/5a1P1u91RuBz+S/xt0YWB5nHcu5nQUtb01DuPwFh1y7wcYjmV5D6cs= X-Received: by 2002:a5d:8457:: with SMTP id w23mr7616272ior.189.1566579500323; Fri, 23 Aug 2019 09:58:20 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Rob Sayre Date: Fri, 23 Aug 2019 09:58:09 -0700 Message-ID: To: chris.box@bt.com Cc: ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000a11a2e0590cbb6eb" Archived-At: Subject: Re: [Add] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 23 Aug 2019 16:58:23 -0000 --000000000000a11a2e0590cbb6eb Content-Type: text/plain; charset="UTF-8" On Fri, Aug 23, 2019 at 8:22 AM wrote: > After Kevin's explanation of Vodafone UK's traffic handling, I can clarify > something that Rob mentioned this week: > > > I also found that BT Smart Hub / Home Hub routers require installation > of root certs, > > but I think it may only be for communicating with the router and one BT > web page, at the moment. > > I think may gotten the product names wrong, or been confused about whether > this applied: I think this cert was only for EAP-TTLS to the router. I think I also found detailed instructions for installing this on Windows on the BT site, but I can't find that page now. Sorry about any confusion. thanks, Rob --000000000000a11a2e0590cbb6eb Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Fri, Aug 23, 2019 at 8:22 AM <<= a href=3D"mailto:chris.box@bt.com">chris.box@bt.com> wrote:
After Kevin's explan= ation of Vodafone UK's traffic handling, I can clarify something that R= ob mentioned this week:

> I also found that BT Smart Hub / Home Hub routers require installation= of root certs,
> but I think it may only be for communicating with the router and one B= T web page, at the moment.

I think may gotten the product names wron= g, or been confused about whether this applied:

=
<https://forum.archive.openwrt.org/viewtopic.php?id=3D73049>

I think this cert was only for EAP-TTLS to the router= . I think I also found detailed instructions for installing this on Windows= on the BT site, but I can't find that page now.

Sorry about any=C2=A0confusion.

thanks,
Rob=C2=A0
--000000000000a11a2e0590cbb6eb-- From nobody Fri Aug 23 10:03:22 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 51AE8120289 for ; Fri, 23 Aug 2019 10:03:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GdDzx71fu9V7 for ; Fri, 23 Aug 2019 10:03:12 -0700 (PDT) Received: from mail-io1-xd30.google.com (mail-io1-xd30.google.com [IPv6:2607:f8b0:4864:20::d30]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4D87512086C for ; Fri, 23 Aug 2019 10:03:10 -0700 (PDT) Received: by mail-io1-xd30.google.com with SMTP id b10so12596415ioj.2 for ; Fri, 23 Aug 2019 10:03:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=5JqZhwR4KG+memI+gMFmFU1Jo7DSv8aiqcnHERJk2vo=; b=EQRd64mYYUtqWYS2thz0uOZhoStyH50w05KnftPLG+T3Nfhxu1tFu13Jotjo/wpguW UcxZ3yGL5zFn8kLsVbIEWFkxnz5JkK+MY8oL3edWQ7hBQx2gnmXIsKqElLFb5JsInCqu A4/ta8kZVW6NYhiyw3OFcEap40FsA7HKwHHfOcYFIcBgYWoSS2VHzoNnzVclxTxu4nc9 uggEsNHYf7xiGp91bW9oiQK5pf99Tf/KBfNWNVZZoPCz9SclRZsPP2WhEAjyxj8RitVT L8lbt/3Ojai/SPamlF8CsAdZkNf5NyRHy0cce8SjelndY+GuZiLokXt3yh4EC+ebEHNO fBnQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=5JqZhwR4KG+memI+gMFmFU1Jo7DSv8aiqcnHERJk2vo=; b=p5rK5D+8znW1goFVZ/5kEnaQaXVBoE0TA6rqfcjzRt1Ykn8PuSnWVjYvM2aHZ23GDf TzDhUIvdt6pEW0LDdY+HGbcpvgqHj36BdZLJB+8T48i4pLtHutt8CLQOMNpk1AniZWMQ PpjcVQnfw2Q+5wou2FD6wEvkIWIf9XOKXvX5KQrDAtH7940tPVu5HYPPERNklPIzJwtX zdP43+s9qWbHZhg85xJSUt8RO6ekZL2HlHsTTw7cFUcun4XAujI/U1UklomYIJ1fj4eR NXGCvmqyOd4uc9RbRRND36PfpNhkbGEP7A4Lsq7YCXrs9pHB9sdtf/VYpkjF1d2CGTys y9yQ== X-Gm-Message-State: APjAAAU/J1xQ87T1DBtXDbWo/IDbdAqGnXOvX0+wuhJa5NBTb1HhhInx +e1ed1GfrwEjDGq3g0mLdhOxnwYKLvI0HE+J0L7M7Mol8l2GaQ== X-Google-Smtp-Source: APXvYqwG2m+WIJq2glqK6YJGeaGQLz9962PcfB6y7dNofCW2/IAZjYVIjczFLVLF0KglTLQY2eTet/lGlKb2cQ0ajsg= X-Received: by 2002:a6b:7e07:: with SMTP id i7mr8193520iom.254.1566579789426; Fri, 23 Aug 2019 10:03:09 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Rob Sayre Date: Fri, 23 Aug 2019 10:02:58 -0700 Message-ID: To: chris.box@bt.com Cc: ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000dc78890590cbc71f" Archived-At: Subject: Re: [Add] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 23 Aug 2019 17:03:20 -0000 --000000000000dc78890590cbc71f Content-Type: text/plain; charset="UTF-8" One other thing: A lot of sites claim that users can't change the DNS settings on various BT Hub routers. Is that true? I was surprised that OnHub TP-Link router defaulted to Google, but it did at least give me the option switching to my ISP's DNS service. thanks, Rob On Fri, Aug 23, 2019 at 9:58 AM Rob Sayre wrote: > > > On Fri, Aug 23, 2019 at 8:22 AM wrote: > >> After Kevin's explanation of Vodafone UK's traffic handling, I can >> clarify something that Rob mentioned this week: >> >> > I also found that BT Smart Hub / Home Hub routers require installation >> of root certs, >> > but I think it may only be for communicating with the router and one BT >> web page, at the moment. >> >> I think may gotten the product names wrong, or been confused about >> whether this applied: > > > > > I think this cert was only for EAP-TTLS to the router. I think I also > found detailed instructions for installing this on Windows on the BT site, > but I can't find that page now. > > Sorry about any confusion. > > thanks, > Rob > --000000000000dc78890590cbc71f Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
One other thing:

A lot of si= tes claim that users can't change the DNS settings on various BT Hub ro= uters. Is that true? I was surprised that OnHub TP-Link router defaulted to= Google, but it did at least give me the option switching to my ISP's D= NS service.

thanks,
Rob


On= Fri, Aug 23, 2019 at 9:58 AM Rob Sayre <sayrer@gmail.com> wrote:


On Fri, Aug 23, = 2019 at 8:22 AM <c= hris.box@bt.com> wrote:
After Kevin's explanation of Vodafone UK's traffic h= andling, I can clarify something that Rob mentioned this week:

> I also found that BT Smart Hub / Home Hub routers require installation= of root certs,
> but I think it may only be for communicating with the router and one B= T web page, at the moment.

I think may gotten the product names wron= g, or been confused about whether this applied:

=

I think this cert was only for EA= P-TTLS to the router. I think I also found detailed instructions for instal= ling this on Windows on the BT site, but I can't find that page now.

Sorry about any=C2=A0confusion.

=
thanks,
Rob=C2=A0
--000000000000dc78890590cbc71f-- From nobody Fri Aug 23 12:27:38 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 22E52120147 for ; Fri, 23 Aug 2019 12:27:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.459 X-Spam-Level: X-Spam-Status: No, score=-1.459 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, NUMERIC_HTTP_ADDR=1.242, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=bt.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PFhNrgHS1QLr for ; Fri, 23 Aug 2019 12:27:28 -0700 (PDT) Received: from smtpe1.intersmtp.com (smtpe1.intersmtp.com [213.121.35.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3EB241200F5 for ; Fri, 23 Aug 2019 12:27:27 -0700 (PDT) Received: from tpw09926dag10h.domain1.systemhost.net (10.9.202.49) by BWP09926085.bt.com (10.36.82.116) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.1.1713.5; Fri, 23 Aug 2019 20:27:11 +0100 Received: from tpw09926dag11g.domain1.systemhost.net (10.9.212.27) by tpw09926dag10h.domain1.systemhost.net (10.9.202.49) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Fri, 23 Aug 2019 20:27:25 +0100 Received: from RDW083A009ED65.bt.com (10.187.98.35) by tpw09926dag11g.domain1.systemhost.net (10.9.212.27) with Microsoft SMTP Server (TLS) id 15.0.1395.4 via Frontend Transport; Fri, 23 Aug 2019 20:27:25 +0100 Received: from GBR01-CWL-obe.outbound.protection.outlook.com (104.47.20.55) by smtpe1.intersmtp.com (62.239.224.236) with Microsoft SMTP Server (TLS) id 14.3.439.0; Fri, 23 Aug 2019 20:22:51 +0100 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=gRycUKkEy6+WyrYNnEaG5aF8uNtxtdvNRcR3d+85pfpwbdtEvYqGRgWLsrDP0iOfUSscayMXfeewBVH3XoKE82JM9xfeQ14jmQiM5W7tClMS3ZlEtrXxpr5j849UwEkXVMkQOGFIy8LagGUQvpHb1ajOWBbBepZTcSbIb9CVV/4b18dhIcrfoLCMUoqmnItLDvIoSvMdpgy8d/d7Aoclh9OE7S1hByvrQveU8HPRcIMRNuQvXOjCn4elDwCbqWCPZE2GFQ4FGS0Jfxn0OLIVhxjeRr3+2DoaQP+m9xxgYvRuWdiEW/shFNxMoDui8oHCg3rodnbXHdxbXzMSmxqLYg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=vLdLzieHvEktpbRLfECpo5uxe/LIHvC2sX5YeXmxx3s=; b=k3ayWFNxjV+MInil+OVed+szqkYWqBEc3N7hf9hJE/xxlzMUNG0AeTxJUHR7RVaBtI/Q7KRokbO162wNhewkTWERaV0Ek4JLGUY4YufoC1ezspw4IPx3rWwpOvJJcqJbq/JoZTu1wudfRMCmzjCgwNhUL0FQEqP100QZrahrRohb2pR0ynuhYejz5BY+DvM6xw+4q0hQkKKeIbOwLztAy+XJtS8YAtQei2W5jLi8TATIibeWBo6eayny3mXblWbi/R/+MaxIX4OzZrVUkgrQGkzB+zLEdZzk8eoXtSp0K+KBzQo67gimxTvaYLYM4Fos6RkOe1i2NMrONW/mhz3/Jw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=bt.com; dmarc=pass action=none header.from=bt.com; dkim=pass header.d=bt.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bt.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=vLdLzieHvEktpbRLfECpo5uxe/LIHvC2sX5YeXmxx3s=; b=vkRXFNzFHYl5q5kQPaQJAzSeijOpoikQ6+ja/ECMZziVZr+xEZ8Nkv45JqggyuxA7jdJimNkXZlll85wf2G0Mz9BemCwVRh/11DY65lK8Hh0bWf0b9hIbEbKzX8VdUcnnnh39JJOkLPfdM0mCBTwBpSMIrBsr+fQZrVabR/V6YE= Received: from LO2P123MB2256.GBRP123.PROD.OUTLOOK.COM (20.176.158.15) by LO2P123MB1853.GBRP123.PROD.OUTLOOK.COM (20.176.154.14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2178.16; Fri, 23 Aug 2019 19:27:05 +0000 Received: from LO2P123MB2256.GBRP123.PROD.OUTLOOK.COM ([fe80::6901:b47d:a350:98f3]) by LO2P123MB2256.GBRP123.PROD.OUTLOOK.COM ([fe80::6901:b47d:a350:98f3%5]) with mapi id 15.20.2199.015; Fri, 23 Aug 2019 19:27:05 +0000 From: To: , Thread-Topic: [Add] Participation Thread-Index: AQHVWdP6+W1rYg5TekS83XqKqMjR5acI9ZIAgAAfvaA= Date: Fri, 23 Aug 2019 19:27:05 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=chris.box@bt.com; x-originating-ip: [82.69.124.62] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 9797112a-ea79-4a48-2242-08d727ffe1b4 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(5600166)(711020)(4605104)(1401327)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(2017052603328)(7193020); SRVR:LO2P123MB1853; x-ms-traffictypediagnostic: LO2P123MB1853: x-ms-exchange-purlcount: 1 x-microsoft-antispam-prvs: x-antispam-2: 1 x-ms-oob-tlc-oobclassifiers: OLM:9508; x-forefront-prvs: 0138CD935C x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(6019001)(4636009)(376002)(346002)(39860400002)(366004)(396003)(136003)(269900001)(189003)(199004)(76116006)(25786009)(71200400001)(9686003)(53936002)(71190400001)(102836004)(186003)(6306002)(66574012)(110136005)(81156014)(8936002)(81166006)(8676002)(99286004)(55016002)(229853002)(26005)(7696005)(6436002)(76176011)(486006)(966005)(11346002)(7736002)(86362001)(446003)(33656002)(52536014)(64756008)(66476007)(66446008)(316002)(6246003)(305945005)(66066001)(66946007)(478600001)(5660300002)(256004)(2906002)(74316002)(14454004)(6506007)(3846002)(476003)(2501003)(66556008)(6116002); DIR:OUT; SFP:1101; SCL:1; SRVR:LO2P123MB1853; H:LO2P123MB2256.GBRP123.PROD.OUTLOOK.COM; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: bt.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: FfD4ydhbWyJNP9eSkS+sztnI/Wqs8bValkynorU5/WAp08ZNTXjfx76xjIBXxqWMAtvKqdBta4hqayDIuHKfJ9GEXsbpJlGq7Io/s2zKqAs/mE1SKNglgxpcXsD738QOzIe8igArsvJ+V/Kxp1QOR0K2usjkAbIyLuNGlk7chWtYqJvDSmh9lQ8JlI9PoUwQzlvlJ4O2TRmWb12h63kSEbxES93DTi+44uxUVmHul2flPWmeI/42UFIMF6QoUWuIwsgYVcu+vvfNrltUnjPxmhRJ1wouppIdk7Xeetp4r5ZnOb08bmi9N4gkgwlAY9hhU/1KucsKtZw7CEgtAXQP3tT+KQrmVFq6C7WYa0xrrYCkrx0dmzuBOYvbGlDhy9TehLzCRwHLHKDj0gyfdTWi+k/rcJpMgHU9EDgtI/M9HqY= x-ms-exchange-transport-forked: True Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: 9797112a-ea79-4a48-2242-08d727ffe1b4 X-MS-Exchange-CrossTenant-originalarrivaltime: 23 Aug 2019 19:27:05.1657 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: a7f35688-9c00-4d5e-ba41-29f146377ab0 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: 7YKz1iR852wAFOO1QWJ2u6M/RGby3QtTXU1/2V5hlsoOaDOd7Ibqz6MV5Gm5B+SKpDRcahbl9cWLBvchjRbvUg== X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO2P123MB1853 X-OriginatorOrg: bt.com Archived-At: Subject: Re: [Add] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 23 Aug 2019 19:27:31 -0000 Um9iLA0KDQo+IEEgbG90IG9mIHNpdGVzIGNsYWltIHRoYXQgdXNlcnMgY2FuJ3QgY2hhbmdlIHRo ZSBETlMgc2V0dGluZ3Mgb24gdmFyaW91cyBCVCBIdWIgcm91dGVycy4NCj4gSXMgdGhhdCB0cnVl PyBJIHdhcyBzdXJwcmlzZWQgdGhhdCBPbkh1YiBUUC1MaW5rID4gcm91dGVyIGRlZmF1bHRlZCB0 byBHb29nbGUsIGJ1dCBpdCBkaWQNCj4gYXQgbGVhc3QgZ2l2ZSBtZSB0aGUgb3B0aW9uIHN3aXRj aGluZyB0byBteSBJU1AncyBETlMgc2VydmljZS4NCg0KVGhpcyBkb2VzIGFwcGVhciB0byBiZSB0 aGUgY2FzZSBvbiBzb21lIGh1YiByb3V0ZXJzLCBhbHRob3VnaCBub3QgYWxsLiBJIGNhbiB1bmRl cnN0YW5kIHdoeSAtIGl0J2xsIGRlZmF1bHQgdG8gQlQgYmVjYXVzZSB0aGF0IHdpbGwgZW5hYmxl IHRoZSBkZWxpdmVyeSBvZiBjb250ZW50IGZyb20gbG9jYWxpc2VkIENETiBjYWNoZXMsIGFuZCBw ZXJtaXQgdGhlIG1hbHdhcmUgY29udHJvbHMgZXRjLg0KDQpJIGNvdWxkIHNwZWN1bGF0ZSB0aGF0 IHRoZSByZWFzb24gdGhlcmUncyBubyBvcHRpb24gdG8gbWFudWFsbHkgY2hhbmdlIHRoZSBkZWZh dWx0IGlzIHRvIHByZXZlbnQgYWNjaWRlbnRhbCBsb3NzIG9mIHRoZXNlIHNlcnZpY2VzLCBvciBh cyBhIGh1cmRsZSB0byBzb2NpYWwgZW5naW5lZXJpbmcgKCJNZXNzYWdlIGZyb20gQlQuIFlvdXIg aHViIGlzIGN1cnJlbnRseSBpbnNlY3VyZS4gVG8gZml4IHRoaXMsIGdvIHRvIGh0dHA6Ly8xOTIu MTY4LjEuMjU0LywgKG1vcmUgaW5zdHJ1Y3Rpb25zKSwgY2hhbmdlIHRoZSBETlMgc2VydmVyIHRv IDxJUCBvZiBhdHRhY2tlcj4gYW5kIGNsaWNrIE9LIi4pIEFub3RoZXIgdXNlIGNhc2UgaXMgdG8g Z2VuZXJhbGx5IG1ha2UgdGhlIHRhc2sgb2YgY3VzdG9tZXIgc3VwcG9ydCBhIGxpdHRsZSBzaW1w bGVyICgiV2h5IGNhbid0IEkgZ2V0IHRvIHRoZSBpbnRlcm5ldCAvIHRoaXMgc2l0ZT8iKS4NCg0K SXQgaXMgYWx3YXlzIHBvc3NpYmxlIHRvIHJlcGxhY2UgdGhlIEJUIGh1YiB3aXRoIHlvdXIgb3du IHJvdXRlciwgYnV0IGluIHRoYXQgc2NlbmFyaW8gdGhlIHVzZXIgaXMgZ2VuZXJhbGx5IHBlcmZl Y3RseSBhd2FyZSB0aGF0IHRoZXkgYXJlIHVzaW5nIGEgbm9uLXZhbmlsbGEgc2VydmljZSB0aGF0 IG1heSBoYXZlIGRpZmZlcmVudCBwcm9wZXJ0aWVzLg0KDQpDaHJpcw0KDQoNCg0KDQoNCg0KDQoN Cg== From nobody Fri Aug 23 12:44:34 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9BF471200F1 for ; Fri, 23 Aug 2019 12:44:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id q6F0lUax-vfP for ; Fri, 23 Aug 2019 12:44:31 -0700 (PDT) Received: from mail-io1-xd32.google.com (mail-io1-xd32.google.com [IPv6:2607:f8b0:4864:20::d32]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B4BFC120047 for ; Fri, 23 Aug 2019 12:44:31 -0700 (PDT) Received: by mail-io1-xd32.google.com with SMTP id t3so22634257ioj.12 for ; Fri, 23 Aug 2019 12:44:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=cvLbhEVZliNHCA7kZiLQx9PXmmRfPzVaHEf+vga9b80=; b=j5tf+V6ZZjCKvxnx+f4rXQIj3XgghYjIUqHA6nZ+p5f9HaF6/Lneqr8kRXR+aUZrv4 fOPfjWeePRs2TLGQVCfkl2yYmRwB+6u/WSnMSoV6egYLMkH2ykjQBcid601rRrizu4hI bf2f2Q1ZzaDH0zZV/g5z5kQDtRIbRaF8+wMj43uUsmA0Oh6PpL4BUKzy9qOtltHqWTH4 /Tc76MdAYzLa2vSOiilCbmHu7WGNthYEIlaTuDFMZuHFjLStnM6iv52fMEVFSH+j7RFx 0QJomDXgPOUdqybyrbxLpedbpJ35PC1B5H6LUftuqGPii/gWOTCa8Y2Ub4dU72F6WHMU jB9Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=cvLbhEVZliNHCA7kZiLQx9PXmmRfPzVaHEf+vga9b80=; b=rFF+kDWTWBBHdDA38IU10+dme86SoLQh0x3nzMEc3fnzfMy+E1QOgEGTxlQULvaEcv fIZ2GGxAlhAetltIKD9OuhzlUJGdoYKINwST/JXZs1Ixy0HCso/rQqO12uab/ZHZhiNC /KoKi2Xdwe8oWsxs0ggeZmqkk/3cZ972zcO3kXmzmlZjL3lK/yPE9SB41OLKTW3TTiEb KX+FDB+nRYSiEwi/tklQ9zA6316b+zhIX54nWsboNPdodN33zmZRX3YDTh3d+nEjEqKd 7t3XDBvptgEuvyTLfWVn71eH+YkbEQX6wizcHcsYxvS9emvar/RCv7CmFizXMBA2koYH 8/Og== X-Gm-Message-State: APjAAAWi55+lZQALvvQLBrMJT8PqBiC3DpDgy2uIfTGF7Z1hTob3NqED YefEgawqxaHaeqYojG7WSvWAlT0iw6zzSNXDfA8= X-Google-Smtp-Source: APXvYqxIrOY7dptXhJYwiNFc07UuLcgECfmld35dlkGwEYUxJJqTUIrlP+G5EJa+gJrcbshKC6R38uZTEqqjVARUT9A= X-Received: by 2002:a5e:d618:: with SMTP id w24mr9410645iom.73.1566589470857; Fri, 23 Aug 2019 12:44:30 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Rob Sayre Date: Fri, 23 Aug 2019 12:44:18 -0700 Message-ID: To: chris.box@bt.com Cc: ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000eb5d360590ce0884" Archived-At: Subject: Re: [Add] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 23 Aug 2019 19:44:34 -0000 --000000000000eb5d360590ce0884 Content-Type: text/plain; charset="UTF-8" On Fri, Aug 23, 2019 at 12:27 PM wrote: > Rob, > > > A lot of sites claim that users can't change the DNS settings on various > BT Hub routers. > > Is that true? I was surprised that OnHub TP-Link > router defaulted to > Google, but it did > > at least give me the option switching to my ISP's DNS service. > > This does appear to be the case on some hub routers, although not all. > ... > It is always possible to replace the BT hub with your own router, but in > that scenario the user is generally perfectly aware that they are using a > non-vanilla service that may have different properties. > Thanks for the direct reply. I'm only asking so we have as much data as possible when people bring up "user choice" arguments. Both BT and Google are making relatively inexpensive products that seem relevant to those arguments--and I must underline that I find the products from both companies totally acceptable. It seems like I can use DoH in Firefox to bypass decisions like that on both routers, and consult CloudFlare, or a DNS provider I specify manually. thanks, Rob --000000000000eb5d360590ce0884 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Fri, Aug 23, 2019 at 12:27 PM <chris.box@bt.com> wrote:
= Rob,

> A lot of sites claim that users can't change the DNS settings on v= arious BT Hub routers.
> Is that true? I was surprised that OnHub TP-Link > router defaulted= to Google, but it did
> at least give me the option switching to my ISP's DNS service.

This does appear to be the case on some hub routers, although not all.
<= /blockquote>
...=C2=A0
It is always possible to replace the BT hub with your own router, but in th= at scenario the user is generally perfectly aware that they are using a non= -vanilla service that may have different properties.
<= br>
Thanks for the direct reply. I'm only asking so we have a= s much data as possible when people bring up "user choice" argume= nts.

Both BT and Google are making relatively inex= pensive products that seem relevant to those arguments--and I must underlin= e that I find the products from both companies totally acceptable.

It seems like I can use DoH in Firefox to bypass decisions= like that on both routers, and consult CloudFlare, or a DNS provider I spe= cify manually.

thanks,
Rob
--000000000000eb5d360590ce0884-- From nobody Fri Aug 23 13:41:09 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2D3E11201E3 for ; Fri, 23 Aug 2019 13:41:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=comcast.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LdIsLZrNl9Xx for ; Fri, 23 Aug 2019 13:41:04 -0700 (PDT) Received: from copdcmhout02.cable.comcast.com (copdcmhout02.cable.comcast.com [96.114.158.212]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 98B7212082E for ; Fri, 23 Aug 2019 13:40:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; d=comcast.com; s=20190412; c=relaxed/simple; q=dns/txt; i=@comcast.com; t=1566592849; x=2430506449; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=5L+yNvF+dJP9Oi/USpcQp/mKd19tWsGKQyWtk8gf4VI=; b=s1Z/t4CIPdLlv6Mfo7i5xyTo904/7qoXs3MZjJ1RbRohqqiBhrGNH77dGbnQEvt/ bt/d0Qxkh+J1JLdoVvsLOCC+efuzwbZyT6Dn/gQRYGwvUI+u5znkYzVe8JsI5h7K IY3JvKfRPQSTJTMBgg2MY/T9JVE26a2dlD1AG9ZQis+0zhIsiQRHjTbLFv4Xb/U0 CTEjd9LiHM/bF6+4aSuqXxgi1ilFOg9MIImzpWnfjh6LfnGzgsBcmrwW2/UJWj20 zKTKB6S+REr5yAP+34bQmfPDQ1rlPoO0wjy0YRLiuvu66+IQ20oBPWm6Ea/Z3CzC JpIXoQnGhirDUrbuk/5M9Q==; X-AuditID: 60729ed4-7ade39e0000013e0-53-5d604f512f63 Received: from copdcexc33.cable.comcast.com (copdcmhoutvip.cable.comcast.com [96.114.156.147]) (using TLS with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (Client did not present a certificate) by copdcmhout02.cable.comcast.com (SMTP Gateway) with SMTP id 4B.04.05088.15F406D5; Fri, 23 Aug 2019 14:40:49 -0600 (MDT) Received: from COPDCEXC37.cable.comcast.com (147.191.125.136) by copdcexc33.cable.comcast.com (147.191.125.132) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1713.5; Fri, 23 Aug 2019 16:40:48 -0400 Received: from COPDCEXC37.cable.comcast.com ([fe80::3aea:a7ff:fe36:8a94]) by COPDCEXC37.cable.comcast.com ([fe80::3aea:a7ff:fe36:8a94%15]) with mapi id 15.01.1713.008; Fri, 23 Aug 2019 16:40:48 -0400 From: "Livingood, Jason" To: "chris.box@bt.com" , "sayrer@gmail.com" , "add@ietf.org" Thread-Topic: [Add] Participation Thread-Index: AdVZxYsbaQ3O+FqrgUiZC6eLnI/K5gAL+zCAAAArEAAABQiBgP//0YoA Date: Fri, 23 Aug 2019 20:40:48 +0000 Message-ID: <9F22D687-FA0E-49D4-AC0E-2BE5285D02E1@cable.comcast.com> References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.1c.0.190812 x-originating-ip: [96.115.73.254] Content-Type: text/plain; charset="utf-8" Content-ID: <6876CE19C8C3FA4B9B9BFF0D63DC9610@comcast.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-CFilter-Loop: Forward X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFlrGKsWRmVeSWpSXmKPExsWSUDRnsm6gf0KswY9ubYv/p9exWSx9vZzZ onPWBCYHZo+2L5OZPHbOusvusWTJT6YA5qgGRpuSjKLUxBKX1LTUvOJUOy4FDGCTlJqWX5Tq mliUUxmUmpOaiF0ZSGVKak5mWWqRPlZj9LGak9DFlDHn4RzGgjMsFe3b4hoY97B0MXJySAiY SNzav5m5i5GLQ0jgCJPEg84vLBBOC5PEpNlfWSGc04wSP87/YwdpYRMwk7i78AoziC0iUCjx 5eRCRhBbWEBB4t2xZqYuRg6guKLEkj5NiBI3iYebu8C2sQioSvSuP80KYvMKuEjcPTuJEWL+ biaJjr3HmEASnAIxEh8O/gGbySggJvH91BqwOLOAuMStJ/OZIM4WkFiy5zwzhC0q8fLxP7Ch ogL6Ekt+bGaFiCtK/Jp3hQ3kHmYBTYn1u/QhxlhJHH9/kRnCVpSY0v2QHeIeQYmTM59AQ0Vc 4vCRHawTGCVmIdk8C2HSLCSTZiGZNAvJpAWMrKsY+SzN9AwNTfQMTS30jAyNNjGCU8+8KzsY L0/3OMQowMGoxMPrzJEQK8SaWFZcmXuIUYKDWUmEt2xiXKwQb0piZVVqUX58UWlOavEhRmkO FiVxXtbu2FghgfTEktTs1NSC1CKYLBMHp1QDY/5JuWnvfSdWRD79Hd9Yu4qRvXbZ2uw6ppsz X3FIMygsO/jYnFvV3DDmQuXPGSo3v09aUmSzn/3erxfOh/6l1DLuZXu14PMkhuapmvdr9Gal nqhn372A/WBFyc8zgu7unEt7XfmrFxedr44Mnfz+t33gzKzjzuldsy/EPLu2/Ir6xMPlKqcs HZRYijMSDbWYi4oTAXIMF385AwAA Archived-At: Subject: Re: [Add] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 23 Aug 2019 20:41:07 -0000 T24gOC8yMy8xOSwgMzoyNyBQTSwgIkFkZCBvbiBiZWhhbGYgb2YgY2hyaXMuYm94QGJ0LmNvbSIg PGFkZC1ib3VuY2VzQGlldGYub3JnIG9uIGJlaGFsZiBvZiBjaHJpcy5ib3hAYnQuY29tPiB3cm90 ZToNCj4gICAgIFRoaXMgZG9lcyBhcHBlYXIgdG8gYmUgdGhlIGNhc2Ugb24gc29tZSBodWIgcm91 dGVycywgYWx0aG91Z2ggbm90IGFsbC4gSSBjYW4gdW5kZXJzdGFuZCB3aHkgLSBpdCdsbCBkZWZh dWx0IHRvIEJUIGJlY2F1c2UgdGhhdCB3aWxsIGVuYWJsZSB0aGUgZGVsaXZlcnkgb2YgY29udGVu dCBmcm9tIGxvY2FsaXNlZCBDRE4gY2FjaGVzLCBhbmQgcGVybWl0IHRoZSBtYWx3YXJlIGNvbnRy b2xzIGV0Yy4NCg0KW0pMXSBUaGlzIGlzIGFsc28gYSBzdGFuZGFyZCBkZWZlbnNlIGFnYWluc3Qg RE5TLWNoYW5naW5nIG1hbHdhcmUuDQogDQoNCg== From nobody Fri Aug 23 13:44:12 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 75B6E12011D for ; Fri, 23 Aug 2019 13:44:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YQlH8W1SSWAt for ; Fri, 23 Aug 2019 13:44:09 -0700 (PDT) Received: from mail-io1-xd31.google.com (mail-io1-xd31.google.com [IPv6:2607:f8b0:4864:20::d31]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7B3F7120119 for ; Fri, 23 Aug 2019 13:44:09 -0700 (PDT) Received: by mail-io1-xd31.google.com with SMTP id l7so23128879ioj.6 for ; Fri, 23 Aug 2019 13:44:09 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=4oJpEF6WFtTKBzYyC2Wsua0AxZYjPBonBD0X7uHAghs=; b=VA1Nb0CQMfH6nLM5LfOxuTRe0eTavchXkigToXqVc6uyhaXx9JHuHboAs5QX9hRlJh ng4FoacB9Abx+5qkRxUxCdod5aC/bCUaX+whV+SxYo9axj4nqnLAlJ/Pu9H+ZjON/7ij LY5ZgQEIMD5sXTc8+93MuzetAOcIfFM5QafvVdOkHvVwroEx/cqJ8QjCczYjqxHtWCKv bCn5NHsTh+4FB/HxpseeGUrnu2loo9dK0PeoG1CKi+WJ8KlTBvJd32WCD0njHs41fnLH sWxRWAY6YaZ8HqjvyBoUkqohr+bbds2uZKNesL01OUqJnsG0mF9tjcTDvWOnO82Vsf/2 5jqg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=4oJpEF6WFtTKBzYyC2Wsua0AxZYjPBonBD0X7uHAghs=; b=sVIxQ22CMS1FNX0fQd3A7aDvuty3+2plcXaQaWiaSJjz0d8857pVqSHRdf5sr/N/yo 5AJBMCQ0/Fukxr64iUCkykyk4tXYg1wIUOf8lzxUBSIsr5Ik1JPSBz+JV6b7BHqSj2LX UGIxIxfb1FGzKYh4J/9m739gNfGcrnoa74duveCmTjZsdAbokzCp0v9a0cb5gjFAMOsS CONfj2czfAH+Hno8cbcdgI/hYWUDeHYU6zPbd2vC/tv8QXRfEHKPckGgVehdN8vwI+it juc7Nx1xHIU9hf3LlW4wHXq529Prw0mxUDmi7V7epGR8DlfIiAMQVwOCNfTTWRwJHoD/ HxLA== X-Gm-Message-State: APjAAAWo04gve1wAGwcbLNDTwkNGmAcP0Ys57CIK54KHVTUX3RDzDgns /2R8PYUP2VejNlUrYYILnjgmYfF+6N89J9JtJKc= X-Google-Smtp-Source: APXvYqyOiIlUxqAHn4Lo85E6yJcwshLIcHDgh+CeCpQ4WyksDPgDGX4eISCz+bRHv87FA1Q4k+fZF3kodEyPfDd/pFU= X-Received: by 2002:a5e:9b12:: with SMTP id j18mr9156165iok.54.1566593048606; Fri, 23 Aug 2019 13:44:08 -0700 (PDT) MIME-Version: 1.0 References: <9F22D687-FA0E-49D4-AC0E-2BE5285D02E1@cable.comcast.com> In-Reply-To: <9F22D687-FA0E-49D4-AC0E-2BE5285D02E1@cable.comcast.com> From: Rob Sayre Date: Fri, 23 Aug 2019 13:43:57 -0700 Message-ID: To: "Livingood, Jason" Cc: "chris.box@bt.com" , "add@ietf.org" Content-Type: multipart/alternative; boundary="0000000000002b7e9c0590cedef4" Archived-At: Subject: Re: [Add] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 23 Aug 2019 20:44:11 -0000 --0000000000002b7e9c0590cedef4 Content-Type: text/plain; charset="UTF-8" On Fri, Aug 23, 2019 at 1:40 PM Livingood, Jason < Jason_Livingood@comcast.com> wrote: > On 8/23/19, 3:27 PM, "Add on behalf of chris.box@bt.com" < > add-bounces@ietf.org on behalf of chris.box@bt.com> wrote: > > This does appear to be the case on some hub routers, although not > all. I can understand why - it'll default to BT because that will enable > the delivery of content from localised CDN caches, and permit the malware > controls etc. > > [JL] This is also a standard defense against DNS-changing malware. > DNS-changing malware tends to exploit the router's OS, doesn't it? I would not characterize this as a very good defense against that. thanks, Rob --0000000000002b7e9c0590cedef4 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Fri, Aug 23, 2019 at 1:40 PM Livingood= , Jason <Jason_Livingood@= comcast.com> wrote:
On 8/23/19, 3:27 PM, "Add on beh= alf of chris.box@bt.c= om" <= add-bounces@ietf.org on behalf of chris.box@bt.com> wrote:
>=C2=A0 =C2=A0 =C2=A0This does appear to be the case on some hub routers= , although not all. I can understand why - it'll default to BT because = that will enable the delivery of content from localised CDN caches, and per= mit the malware controls etc.

[JL] This is also a standard defense against DNS-changing malware.

DNS-changing malware tends to exploit the route= r's OS, doesn't it? I would not characterize this as a very good de= fense against that.

thanks,
Rob
--0000000000002b7e9c0590cedef4-- From nobody Fri Aug 23 16:46:04 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 47E7A1200A1 for ; Fri, 23 Aug 2019 16:46:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9HuyNHubPN9O for ; Fri, 23 Aug 2019 16:45:59 -0700 (PDT) Received: from mail-io1-xd30.google.com (mail-io1-xd30.google.com [IPv6:2607:f8b0:4864:20::d30]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9BF06120098 for ; Fri, 23 Aug 2019 16:45:59 -0700 (PDT) Received: by mail-io1-xd30.google.com with SMTP id j4so15593121iog.11 for ; Fri, 23 Aug 2019 16:45:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=dKYOa6ObbvqjHoBinaZRhx3ssSIXR6xmnS+BLIuG4pk=; b=QxHBJU1QO09hfAyLRzVXHkPC8pwDlld3Hwa1iirq+c+co3vTPhtIeT3gFkTAA/zaZe tFocU+KzDbOIjJ/lpGxVc/0xZFRPaWdRddREUaTItKiGA2N37j8YPqA8V/34/OHfgFxz dT2uwMM9EPT/voGrgNAWSNTUmr++wIhkKgHKjWmqX/N+JjaDSeHe95im3FC7CSSPkSPF 91VkgcsR4D9m070gB2MYeLG8Qcvd7FRy988F0UBAvzRE5LVyUyxXKJ/iWnFlCgTsbRCZ LciO5ivkduu+cByZ50HTPYPXJbskVh6ncWMPdY2hkgyrs6m/SyqxQqR0OGVLrg79mYUA K6+g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=dKYOa6ObbvqjHoBinaZRhx3ssSIXR6xmnS+BLIuG4pk=; b=i8ra8V5mzo/lDpTzjUmhR+ImN0QX/GFYCFD4KW6uqFGXaDxuJeQxndrxesnHMekyeg 4M85S8a4adIYqPZ3PP/sYpC9WwGdIr3g3F/K8Gvaj7gNZMXQBEEcE5BiNfQQdY34fcnr 2XEfEeLqOWTmlNuOSYIlD51zTjSTe2F0vFAOnY+k8hY6dWG5ce5vkJZUFIs361L+ns5p 9FWjAJhDZzS9ZacgiwJj4747e2oEdtRPiI8+N16FIHxRrvXQ3TDF0yy5mUCTbMpLsxJY efW9p2hNrs2uv9IaWua8U4MFfdTtx9bTTs2hCXuA2QSmw70MMX+RiTo0P7OqF5CGYqtU T6GQ== X-Gm-Message-State: APjAAAXEvhVjQ9rB3fYdO/vQLMIQap1PwFl5p/zvTugw0j2rTlFlDe1q GFy93nLlykDh1fEnlE0TqJYjOc0zuxCJ4oJI75o= X-Google-Smtp-Source: APXvYqzSpB7bFmjZWLTsluroLu4Bz1PlpTj0YOWl8Qbu73AZvUL3VtWTmPsniz3oR2NlAAevCtT3iTdL3MLP2sqVJ5g= X-Received: by 2002:a05:6638:a09:: with SMTP id 9mr7581339jan.95.1566603958720; Fri, 23 Aug 2019 16:45:58 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Rob Sayre Date: Fri, 23 Aug 2019 16:45:47 -0700 Message-ID: To: Barry Leiba Cc: ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000769f630590d16858" Archived-At: Subject: Re: [Add] Plans for ADD going forward X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 23 Aug 2019 23:46:02 -0000 --000000000000769f630590d16858 Content-Type: text/plain; charset="UTF-8" On Fri, Aug 23, 2019 at 7:45 AM Barry Leiba wrote: > The IESG and IAB had a meeting this week to discuss possible plans > going forward. We agree that there is work to do, and that it's > important to get it going sooner, rather than later. > Hi, While I'd prefer that the IETF, IESG, and IAB do nothing, I can't stop you! :) I'd at least hope you can collectively agree that DNS traffic has been left unencrypted for 20+ years, and that is unacceptable. thanks, Rob --000000000000769f630590d16858 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
--000000000000769f630590d16858-- From nobody Fri Aug 23 18:34:53 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AE3B6120043 for ; Fri, 23 Aug 2019 18:34:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.756 X-Spam-Level: X-Spam-Status: No, score=-0.756 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, NUMERIC_HTTP_ADDR=1.242, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4AvKawajjX-r for ; Fri, 23 Aug 2019 18:34:50 -0700 (PDT) Received: from mail-io1-xd2e.google.com (mail-io1-xd2e.google.com [IPv6:2607:f8b0:4864:20::d2e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EEE7412002E for ; Fri, 23 Aug 2019 18:34:49 -0700 (PDT) Received: by mail-io1-xd2e.google.com with SMTP id b10so15254505ioj.2 for ; Fri, 23 Aug 2019 18:34:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=2eRltT61+cRoEi+4swV5Xn8fvZtB7t2QDsBYDmwfvgk=; b=EyGMl6Zdxs4Xi7Wa9c/0stjhvUqpKcQKeLigExgFZffNZfxYSBnSukkBx2oWHvjfbc Thb9uDmnYYn2U8Pw2M0/ppsUMr7XIovlS7cUroReWLIrK8x8kA9qjYFfBRMp1xspCHEh 2MnlZTqwXj35dG1o+Ud7lvrYeDYpEJhctdm/fDUDygmoNrCHcsMgUc0kFzGrQaMl7MoI 75t43zgvTDA7J3817fbLZKlirNuYxqSs1+UmHHfzunsnHzJy1i1rCBJfmwHftBIrZ6ND DfDJ9B0O7xhetupEsSQ2Xm72zMczyDnZzYo82wGLi8p3YZkBpchsVZ3CjgKfHnRV/0pE mfAQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=2eRltT61+cRoEi+4swV5Xn8fvZtB7t2QDsBYDmwfvgk=; b=oQZNZyhjbM/Sm3H9ADj3OoY3ANkcpvpnNjkmU97/Un403ZBwpzDcjWIbJcM03SNLdV 2w0LB5lxh3TxfMtdX0wPmPvIxtksZwZ7vnUon8TYU5AXDIDFnCgOin+Oy68qxHbF+Rfu ejoln4zu7WPURQvPr9KVAArKCFVPVipkVxMx80Qiih923Q/y9sb/ZApSkT75J96/6zRe oq5xf3eVdQ449XdOzKGLTIKch+IhoJo3OhwBug5Yp6pCUJ0F5V2RhMGxJsu+8SurUi74 R+GQZ0KiQfxer/IlPoZwmq22sfTcHvzB+VOsy/dfX5L4j2YW3eRQr6tdDOGfm/I0JAvE zqUQ== X-Gm-Message-State: APjAAAXolwJyg945O1ylyJLTI5OlmK7AmkwpLAnbbfHsiqoc8ra8dgC3 ESvrAic1G3iBcc40xxNscudD4mrmKTVWrzsHb+2s3/7/g4E= X-Google-Smtp-Source: APXvYqxaGLmbz2FPxCi9XyTZToTOdnLZpvMgiTHkn0vpKQPYYOpw0YibEH/5yY+bshRakNJTDGs4FdlFNwiVWEMWrLA= X-Received: by 2002:a5e:9b12:: with SMTP id j18mr10603717iok.54.1566610489046; Fri, 23 Aug 2019 18:34:49 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Rob Sayre Date: Fri, 23 Aug 2019 18:34:37 -0700 Message-ID: To: chris.box@bt.com Cc: ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000b37cb80590d2ed0c" Archived-At: Subject: [Add] Customer Service X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 24 Aug 2019 01:34:52 -0000 --000000000000b37cb80590d2ed0c Content-Type: text/plain; charset="UTF-8" On Fri, Aug 23, 2019 at 12:27 PM wrote: > I could speculate that the reason there's no option to manually change the > default is to prevent accidental loss of these services, or as a hurdle to > social engineering ("Message from BT. Your hub is currently insecure. To > fix this, go to http://192.168.1.254/, (more instructions), change the > DNS server to and click OK".) Another use case is to > generally make the task of customer support a little simpler ("Why can't I > get to the internet / this site?"). > The argument that ISP defaults are entail customer service costs has some up a few times. I think this is a disingenuous argument in cases where the ISP monetizes DNS traffic. Please object if you represent an ISP, and can also claim that you do not monetize DNS traffic. thanks, Rob --000000000000b37cb80590d2ed0c Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
I could speculate that the reason there's no option to manually change = the default is to prevent accidental loss of these services, or as a hurdle= to social engineering ("Message from BT. Your hub is currently insecu= re. To fix this, go to http://192.168.1.254/, (more instructions), change t= he DNS server to <IP of attacker> and click OK".) Another use ca= se is to generally make the task of customer support a little simpler (&quo= t;Why can't I get to the internet / this site?").
=

The argument that ISP defaults are entail customer serv= ice costs has some up a few times.

I think this is= a disingenuous argument in cases where the ISP monetizes DNS traffic. Plea= se object if you represent an ISP, and can also claim that you do not monet= ize DNS traffic.

thanks,
Rob
=
--000000000000b37cb80590d2ed0c-- From nobody Fri Aug 23 18:46:06 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B7926120099 for ; Fri, 23 Aug 2019 18:46:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.756 X-Spam-Level: X-Spam-Status: No, score=-0.756 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, NUMERIC_HTTP_ADDR=1.242, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4Z3IUWUnAIZG for ; Fri, 23 Aug 2019 18:46:01 -0700 (PDT) Received: from mail-io1-xd30.google.com (mail-io1-xd30.google.com [IPv6:2607:f8b0:4864:20::d30]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id ACC93120047 for ; Fri, 23 Aug 2019 18:46:01 -0700 (PDT) Received: by mail-io1-xd30.google.com with SMTP id b10so15290455ioj.2 for ; Fri, 23 Aug 2019 18:46:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=wbqoRHicwkvMcGUQi/8QnmY8M7wpww7FY+mvcWRfc6w=; b=nd7muzZk8ufI5a/Ks9JcTH18EG39g2e41gmDZ4Am+xQ5emx65DQ/0r+CpJBkV0TB5o 5GzoHya2WbPAIZOiwzd2SWlcT0XiweOz2xuOrYdcOh+c79NXU+7KUtwU1iZBbe6UEYrq 5Yn+pnbJnE5fCR8iVp1+P7j5HBUTB01KTc08vDaaElC+uaDeqgvxrz/8SiArDC4/Rc7C 98LK0r3kWYpBvcoY74KUT+VU2UgAOygIyqxM8nlHFJKYT348TbQVOaJahmOusgU0jDDa 7XkKgVLPCNtEujCFVuyQurK/nnCkEbO2xTOPfdSqhCLBCmcwh4Bm2bZpSTI40eTnfBQU MuZQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=wbqoRHicwkvMcGUQi/8QnmY8M7wpww7FY+mvcWRfc6w=; b=rY5HwrJV9GfxFoyTD/BF5NGPYCr5mSxReRIbOXXgTtugEsxiTLgQ/1ff3BdBbksByn JvMot0GRpnJhh+h0brrBxbnboRfO/VVqodYYjAkY5FsNEL30tgmi+tUfm19qlCVEqNMU Un3h8skPZ1zNqKWRrO+4YOjsD20xi7rGNYRXYHtJeRLODRMHG/qnpAo81FnI+eaI2/ir 5x1zPt9tQPRaG0ku/6zK0armZ7Ej3jxfYYi9SCpdcOOlhbJxvY6wOAh7lEIvWoBdQK3H 2wWxKeeR0DwqThXKoXOtDT1LVsYDgqo9iM4fPLB3bieW1c1qLyA7Bg/TMUmwmkkfYHGw OWvQ== X-Gm-Message-State: APjAAAUsu3DcS9/mgxrGIOFHqWdZVS7OjtMEq/+gU41hplIVoHXmq0fo ui3wdj3tr9bm021saQrkoRV3C2kivzwZEuDVM8ljiiBFV2FIQw== X-Google-Smtp-Source: APXvYqxbDAaswTF4RGnbnS+42Fh7G4JtNPVZvDw3Wmz3eC7BicZr7+Vro4m2zTC4dgcYJntXmUce41DHJKhB0C5dX18= X-Received: by 2002:a6b:500e:: with SMTP id e14mr3488672iob.49.1566611160910; Fri, 23 Aug 2019 18:46:00 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Rob Sayre Date: Fri, 23 Aug 2019 18:45:49 -0700 Message-ID: To: chris.box@bt.com Cc: ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000bf4f940590d31515" Archived-At: Subject: Re: [Add] Customer Service X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 24 Aug 2019 01:46:04 -0000 --000000000000bf4f940590d31515 Content-Type: text/plain; charset="UTF-8" On Fri, Aug 23, 2019 at 6:34 PM Rob Sayre wrote: > On Fri, Aug 23, 2019 at 12:27 PM wrote: > >> I could speculate that the reason there's no option to manually change >> the default is to prevent accidental loss of these services, or as a hurdle >> to social engineering ("Message from BT. Your hub is currently insecure. To >> fix this, go to http://192.168.1.254/, (more instructions), change the >> DNS server to and click OK".) Another use case is to >> generally make the task of customer support a little simpler ("Why can't I >> get to the internet / this site?"). >> > > The argument that ISP defaults are entail customer service costs has some > up a few times. > "The argument that ISP defaults are entail customer service costs has some up a few times." There are some stray words there. I was intentionally making the point that the "customer service" arguments aren't very good. thanks, Rob --000000000000bf4f940590d31515 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Fri, Aug 23, 2019 at 6:34 PM Rob S= ayre <sayrer@gmail.com> wrote= :
On Fri, Aug 23, 2019 at 12:27 PM <chris.box@bt.com> wrote:
I could speculate that the reason there's no option to manually change = the default is to prevent accidental loss of these services, or as a hurdle= to social engineering ("Message from BT. Your hub is currently insecu= re. To fix this, go to http://192.168.1.254/, (more instructions), change t= he DNS server to <IP of attacker> and click OK".) Another use ca= se is to generally make the task of customer support a little simpler (&quo= t;Why can't I get to the internet / this site?").
=

The argument that ISP defaults are entail customer serv= ice costs has some up a few times.

<= /div>"The argument that ISP defaults are entail customer service costs= has some up a few times."
=C2=A0
There are some str= ay words there.

I was intentionally making the poi= nt that the "customer service" arguments aren't very good.

thanks,
Rob
--000000000000bf4f940590d31515-- From nobody Sat Aug 24 13:01:45 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 31CF612011D for ; Sat, 24 Aug 2019 13:01:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id w_s4JOw3zUFy for ; Sat, 24 Aug 2019 13:01:37 -0700 (PDT) Received: from mail-io1-xd35.google.com (mail-io1-xd35.google.com [IPv6:2607:f8b0:4864:20::d35]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 122F3120046 for ; Sat, 24 Aug 2019 13:01:37 -0700 (PDT) Received: by mail-io1-xd35.google.com with SMTP id x4so27958503iog.13 for ; Sat, 24 Aug 2019 13:01:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to; bh=wNG5HnTtgfbP/baJgmK4JieZOJqpB6Nfp5eELW9EC/w=; b=fYIFu+pfucRaJabQw896Ym0JCaklo7Bqw6TXKLGOpJoYXfIHAlhaEL6ZntvcGaLsi1 t0Zglpdrdm1NY5SPEho/iyJOHwlH+V3GgU2rvL0izGx4rZFYOGOoP5aGsGR63cjGK+CZ iMrHWOjtEHF6tTpV7p2Mj/TXSFWHzdozn3NQswz6zWGLj+YJNwORd7wV6vk9yNE2UBYz i9Gajxc0pIYsdRVm4Vqu+CmQknaua0T8ng4G+9lj4NkwANPMWTKjpXBIEAn3fU7eaVkG LNU6tmWabvpH0vYtA6va9NMCuZy4ycs7ybpDoEwIBetWr0MqYBigxM14LL9PBakNEEUY TSvg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=wNG5HnTtgfbP/baJgmK4JieZOJqpB6Nfp5eELW9EC/w=; b=cg6mea12uSA8nzIsLrH9OWPZPwiXd26oqrVCMuM845HguY31eYyL2k3h/c0cd50C51 C1DFLZlI78BJ1DFs774rpUSrxXCo+dcWYE4dnk85gfmNFcrCASoHrQvud04FB4YtYyuR hJRsXu/MciXxyoR9kbVXQODiLszlWH37V9yhXaOfV/t6+iekRvW9tVPxXQfCsRfOSApO vD6C5+KQjjz1rCVdJwBcQk173z51bPtAohaVci9BRScJcRaRul4CGSCERuP8Uc0EZusB ApEXadEyhoZJaB+XYRKZLxi7C5EvnUYXJB4HhT7ixzjKncd6p3lgkAZlxlp1+A6w3Y2H Ie5Q== X-Gm-Message-State: APjAAAXf2B8efvMTHXNLi4c5Pdp7sbvnvYv+6SqwP9ADldqZE6ojBro6 SAwWyMO1zuZhNxwL7sFXUdMdcezL+fC2NlRmUimMfKu6Mc8g5A== X-Google-Smtp-Source: APXvYqz6K7nmVoCphIngjANxyQa9XLmdJ0gYkltr3+TUJUSUBpwKvzw7t227/sOeQDTZ66V6Lfu3DtVUa6Fy3P4xNhU= X-Received: by 2002:a05:6638:a09:: with SMTP id 9mr11101677jan.95.1566676895888; Sat, 24 Aug 2019 13:01:35 -0700 (PDT) MIME-Version: 1.0 From: Rob Sayre Date: Sat, 24 Aug 2019 13:01:24 -0700 Message-ID: To: ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000db799a0590e263a2" Archived-At: Subject: [Add] Landscape X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 24 Aug 2019 20:01:44 -0000 --000000000000db799a0590e263a2 Content-Type: text/plain; charset="UTF-8" Hi, I thought I would update that list of features of the DNS landscape I sent. Since it sounds like there will be chartered work soon enough, I thought I would collect what I and others have found, and correct a few things. I don't think it would be especially valuable to nitpick the list, but I do think it might make a good wiki page when the group has one. On the wiki, you can edit any wording or framing. thanks, Rob * ISPs use Classic DNS to fuel ad networks (they could still do this if they provided DoT/DoH) * ISPs intercept Classic DNS, and occasionally trigger certificate warnings if they return a "blocked page"[1], similar to TLS errors one might see from a captive portal. * ISPs that provide roaming WiFi sometimes instruct users to install EAP-TTLS certificates in their OS root stores, and this can cause confusion about what they are for. I found that several UK ISPs have done this. * ISPs sometimes distribute routers that prevent the user from changing DNS settings. * There are entertainment devices (Google, probably some Roku apps) hard-coding DNS services, ignoring the OS and network administrator * There are consumer routers that use centralized DNS services without user interaction, ignoring the OS and network administrator (unless the router owner counts as the admin...) * There are Android handsets that enable a VPN on certain networks by default, and all networks with user interaction, bypassing local DNS * Home routers are being exploited to hijack Classic DNS * Many ISPs simply ask Google to provide their DNS service, resulting in more centralization than might first be apparent * Browsers do tend to obey "Group Policy" and other similar administrator features * And, of course, browsers are shipping DoH, ignoring the OS and network administrator thanks, Rob [1] I want to be as dispassionate about this issue as possible. It does seem like Vodafone may have had a misguided step in their support script, where users were asked to install the certificate for the block page server. This seems like it was done to fix the error the user was seeing and display the block page, but not for anything else. --000000000000db799a0590e263a2 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi,

I thought I would update that l= ist of features of the DNS landscape I sent. Since it sounds like there wil= l be chartered work soon enough, I thought I would collect what I and other= s have found, and correct a few things.

I don'= t think it would be especially valuable to nitpick the list, but I do think= it might make a good wiki page when the group has one. On the wiki, you ca= n edit any wording or framing.

thanks,
R= ob


* ISPs use Classic DNS to fuel a= d networks (they could still do this if they provided DoT/DoH)

* ISPs intercept Classic DNS, and occasionally trigger certificate wa= rnings if they return a "blocked page"[1], similar to TLS errors = one might see from a captive portal.

* ISPs that provide = roaming WiFi sometimes instruct users to install EAP-TTLS certificates in t= heir OS root stores, and this can cause confusion about what they are for. = I found that several UK ISPs have done this.

* ISPs somet= imes distribute routers that prevent the user from changing DNS settings.
* There are entertainment devices (Google, probably some R= oku apps) hard-coding DNS services, ignoring the OS and network administrat= or

* There are consumer routers that use centralized DNS = services without user interaction, ignoring the OS and network administrato= r (unless the router owner counts as the admin...)

* Ther= e are Android handsets that enable a VPN on certain networks by default, an= d all networks with user interaction, bypassing local DNS

* Home routers are being exploited to hijack Classic DNS

* Many ISPs simply ask Google to provide their DNS service, resulting in m= ore centralization than might first be apparent

* Browser= s do tend to obey "Group Policy" and other similar administrator = features

* And, of course, browsers are shipping DoH, ign= oring the OS and network administrator

thanks,
Rob

[1] I w= ant to be as dispassionate about this issue as possible. It does seem like = Vodafone may have had a misguided step in their support script, where users= were asked to install the certificate for the block page server. This seem= s like it was done to fix the error the user was seeing and display the blo= ck page, but not for anything else.
--000000000000db799a0590e263a2-- From nobody Sun Aug 25 01:01:19 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 19DC912011D for ; Sun, 25 Aug 2019 01:01:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=mad.paris header.b=Eo5kWdp6; dkim=pass (2048-bit key) header.d=messagingengine.com header.b=uDPvg/OO Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id llXnX8VnLO6S for ; Sun, 25 Aug 2019 01:01:14 -0700 (PDT) Received: from out3-smtp.messagingengine.com (out3-smtp.messagingengine.com [66.111.4.27]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 904881200B8 for ; Sun, 25 Aug 2019 01:01:14 -0700 (PDT) Received: from compute3.internal (compute3.nyi.internal [10.202.2.43]) by mailout.nyi.internal (Postfix) with ESMTP id D6D0C21BBA for ; Sun, 25 Aug 2019 04:01:13 -0400 (EDT) Received: from imap26 ([10.202.2.76]) by compute3.internal (MEProxy); Sun, 25 Aug 2019 04:01:13 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mad.paris; h= mime-version:message-id:in-reply-to:references:date:from:to :subject:content-type; s=fm3; bh=Hj8ifFSAi3C1qu/3XG4bmaTsmCUpEER 8kz5tEtzUCSA=; b=Eo5kWdp6xBTZ2wnFZL2JlzxNsbu5knEfpz7f77myjY788m4 AUTTNnGYYsPJtRDOyh129cJIPBf5xKBfa5FxozxgjozUdwUhc8+5KJ1n69AWDkWT 3DaOPuTJAbajApY9aSV0JVJXwjSMUXZyc4kZfbZBHB8Q5gRsoIz7I4Hbtc7T3qxp 02/ICNRKEesb514xSXY5hAVaI1Sgtk1zRcQmtrSYPxmaZPpsCXY7MLH/BKZRdhF6 N77mVNQinqClkARD+bn1J9C1+gXABXU6xEqZg4O+Uaq9Lw8/CZWR0DL8qfEf5sDW Y45zlAjSYl3Y146FFYbsHcB8Evq6SqgDk5F5DiA== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to:x-me-proxy :x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm3; bh=Hj8ifF SAi3C1qu/3XG4bmaTsmCUpEER8kz5tEtzUCSA=; b=uDPvg/OOMHXI+X8fxOoT8h W7lkzTjJF8uJoHqtuyzGSnbHMx/6uf7HVwYVfWaOxD61VQFWNZac2NYCeJYhg4vd 4+YbAN1u5A6AdGmI52YWxDtrcp8zsA9Yj41ZsZQC4tBIB8kOSBF1sEZ5j8bA3QF7 Tupb062RVpLoOKkxatNv//Lc08WCifGNdkwF3iWjy8MfGlfHTUgxc7uXKMVqfhwk ibXbWLbCM3jpB/KRM8atxIy5PaeiVRSd1O1JLUecnX/s8sU8c7+/ZBjO98N5bUow zOPd0X9biWjojOPEbjPoFBIMqAbvrfaqg148sxTC1LU1qGgYUX/GFXMPKPPqu9QA == X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeduvddrudehvddgtdduucetufdoteggodetrfdotf fvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdfqfgfvpdfurfetoffkrfgpnffqhgen uceurghilhhouhhtmecufedttdenucenucfjughrpefofgggkfgjfhffhffvufgtsegrtd erreerredtnecuhfhrohhmpedfkfgrnhcuofgrugguihhsohhnfdcuoehirghnsehmrggu rdhprghrihhsqeenucffohhmrghinhepihgvthhfrdhorhhgnecurfgrrhgrmhepmhgrih hlfhhrohhmpehirghnsehmrggurdhprghrihhsnecuvehluhhsthgvrhfuihiivgeptd X-ME-Proxy: Received: by mailuser.nyi.internal (Postfix, from userid 501) id 75E6C14200A1; Sun, 25 Aug 2019 04:01:13 -0400 (EDT) X-Mailer: MessagingEngine.com Webmail Interface User-Agent: Cyrus-JMAP/3.1.6-916-g49fca03-fmstable-20190821v7 Mime-Version: 1.0 Message-Id: <89f26a46-cd99-43f2-9006-e8fdd4fa353e@www.fastmail.com> In-Reply-To: References: Date: Sun, 25 Aug 2019 10:00:40 +0200 From: "Ian Maddison" To: add@ietf.org Content-Type: multipart/alternative; boundary=52bc7a536229412faa2391134c2f2d63 Archived-At: Subject: Re: [Add] Landscape X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 25 Aug 2019 08:01:17 -0000 --52bc7a536229412faa2391134c2f2d63 Content-Type: text/plain Hi Rob, In case you hadn't noticed, 9 of the last 10 mails sent to this list appear to be written by yourself. Another type of over centralisation surely. Just Sayring ;) On Sat, 24 Aug 2019, at 22:02, Rob Sayre wrote: > Hi, > > I thought I would update that list of features of the DNS landscape I sent. Since it sounds like there will be chartered work soon enough, I thought I would collect what I and others have found, and correct a few things. > > I don't think it would be especially valuable to nitpick the list, but I do think it might make a good wiki page when the group has one. On the wiki, you can edit any wording or framing. > > thanks, > Rob > > > * ISPs use Classic DNS to fuel ad networks (they could still do this if they provided DoT/DoH) > * ISPs intercept Classic DNS, and occasionally trigger certificate warnings if they return a "blocked page"[1], similar to TLS errors one might see from a captive portal. > * ISPs that provide roaming WiFi sometimes instruct users to install EAP-TTLS certificates in their OS root stores, and this can cause confusion about what they are for. I found that several UK ISPs have done this. > * ISPs sometimes distribute routers that prevent the user from changing DNS settings. > * There are entertainment devices (Google, probably some Roku apps) hard-coding DNS services, ignoring the OS and network administrator > * There are consumer routers that use centralized DNS services without user interaction, ignoring the OS and network administrator (unless the router owner counts as the admin...) > * There are Android handsets that enable a VPN on certain networks by default, and all networks with user interaction, bypassing local DNS > * Home routers are being exploited to hijack Classic DNS > * Many ISPs simply ask Google to provide their DNS service, resulting in more centralization than might first be apparent > * Browsers do tend to obey "Group Policy" and other similar administrator features > * And, of course, browsers are shipping DoH, ignoring the OS and network administrator > > thanks, > Rob > > [1] I want to be as dispassionate about this issue as possible. It does seem like Vodafone may have had a misguided step in their support script, where users were asked to install the certificate for the block page server. This seems like it was done to fix the error the user was seeing and display the block page, but not for anything else. > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --52bc7a536229412faa2391134c2f2d63 Content-Type: text/html Content-Transfer-Encoding: quoted-printable
Hi Rob,

In case you hadn= 't noticed, 9 of the last 10 mails sent to this list appear to be writte= n by yourself. Another type of over centralisation surely.

Just Sayring ;= )

On Sat, 24 Aug 2019, at 22:02, Rob Sayre wrote:
Hi,

I thought I would update that list of features of the DNS landsc= ape I sent. Since it sounds like there will be chartered work soon enoug= h, I thought I would collect what I and others have found, and correct a= few things.

I don't think it would be espe= cially valuable to nitpick the list, but I do think it might make a good= wiki page when the group has one. On the wiki, you can edit any wording= or framing.

thanks,
Rob
<= /div>


* ISPs use Classic DNS to fuel ad networks= (they could still do this if they provided DoT/DoH)
* ISPs in= tercept Classic DNS, and occasionally trigger certificate warnings if th= ey return a "blocked page"[1], similar to TLS errors one might see from = a captive portal.
* ISPs that provide roaming WiFi sometimes i= nstruct users to install EAP-TTLS certificates in their OS root stores, = and this can cause confusion about what they are for. I found that sever= al UK ISPs have done this.
* ISPs sometimes distribute routers= that prevent the user from changing DNS settings.
<= div style=3D"font-family:verdana, sans-serif;color:#0000cd;">* There are= entertainment devices (Google, probably some Roku apps) hard-coding DNS= services, ignoring the OS and network administrator
* There a= re consumer routers that use centralized DNS services without user inter= action, ignoring the OS and network administrator (unless the router own= er counts as the admin...)
* There are Android handsets that e= nable a VPN on certain networks by default, and all networks with user i= nteraction, bypassing local DNS
* Home routers are being explo= ited to hijack Classic DNS
* Many ISPs simply ask Google to pr= ovide their DNS service, resulting in more centralization than might fir= st be apparent
* Browsers do tend to obey "Group Policy" and o= ther similar administrator features
* And, of course, browsers= are shipping DoH, ignoring the OS and network administrator

thanks,
<= /div>
Rob
[1= ] I want to be as dispassionate about this issue as possible. It does se= em like Vodafone may have had a misguided step in their support script, = where users were asked to install the certificate for the block page ser= ver. This seems like it was done to fix the error the user was seeing an= d display the block page, but not for anything else.
-- 
Add mailing list
Add@ietf.or= g
https://www.ietf.org/mailman/listinfo/add
=

--52bc7a536229412faa2391134c2f2d63-- From nobody Sun Aug 25 15:37:46 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0E844120806 for ; Sun, 25 Aug 2019 15:37:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id x4LYPjKgPytm for ; Sun, 25 Aug 2019 15:37:42 -0700 (PDT) Received: from mail-io1-xd33.google.com (mail-io1-xd33.google.com [IPv6:2607:f8b0:4864:20::d33]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7D8831207FD for ; Sun, 25 Aug 2019 15:37:42 -0700 (PDT) Received: by mail-io1-xd33.google.com with SMTP id q22so32787646iog.4 for ; Sun, 25 Aug 2019 15:37:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=T2nrC0O3QvZCWX+MY3DkW7KQaWixHYwpZnZuF9vWvCs=; b=m5sYaqMhVWRRH0GvpggDl3tAxSsB9dNTDnHEWmxfUDwGc82gqOuhzjE7ZQ6YyyFBWu h3CxsbO7+zDgwPPpD+pn0DIWVCUaayJ/tiueRk/D6GcDrQvA7/u5kArF3/HVuQig/ZbV NmKf/mrMJPhTjrfz0nXc6LPwHPv3fUAIhvyoUONCLn1tjffZiq+fJ9W4Kt8R46CMmwE9 Qga2vhZpkYfyaXi7Dnjld4bcOWh+pecIX3dOLJSILW9F4zgpZyHE+VpWmrXNaNx/POAa LSa4VVTBV8zyApLnkRXFwGuRcVGRp7/RMaxbsDa/YuPK0h7CZByojoBTgvQtfp0An0UH Qmeg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=T2nrC0O3QvZCWX+MY3DkW7KQaWixHYwpZnZuF9vWvCs=; b=Of7p4dfoe8uPWmkbP4DE3G95SGu2MoNpMdxsnzbyinYDwOkkh4+oD7r+S8U6kHUOuL qZo8Up89zCtRTsbJKu+iU7Wsr0/1BquW6oRpcqcRUEnVMGyMhwiDZwaSrrWauTiW6elY wmPwPwttcFKbxaeyTOI1zD1/hw553CnM3ykYSJ0szusScjJO5kU0gOu5wJKdlszZ7a64 VweE0h8mMfDQPd8cXMc8b12LOLzcuvGtf84GUlhK+pW+c1/hFH5QM61PxTwUO5QIAJE0 hirrSFYvcAogcr11uKjonHcdPTR4zf7InGW+6wDPbDgPwe8OLfzQWyuF/b1m2Bk476/R FOEw== X-Gm-Message-State: APjAAAVZ6T5JPRCu7z2Rb4LZMW3SuPtDFcuPHJ6mqGBy0a0IrXlaLuPv ffSmpzaBxyRVcoZcOCQX3RdzzUOdD2ew2qvJyrjbN/oyX5M= X-Google-Smtp-Source: APXvYqxEtHtrXcRqGpy8gwNDGAXpn2Ft3+kcbMI2xg7Vh+vvOGNuOD36GYBmK0J/3HS5pClHwIlOB0WBDXDgHYmeHic= X-Received: by 2002:a6b:500e:: with SMTP id e14mr13780532iob.49.1566772661592; Sun, 25 Aug 2019 15:37:41 -0700 (PDT) MIME-Version: 1.0 References: <89f26a46-cd99-43f2-9006-e8fdd4fa353e@www.fastmail.com> In-Reply-To: <89f26a46-cd99-43f2-9006-e8fdd4fa353e@www.fastmail.com> From: Rob Sayre Date: Sun, 25 Aug 2019 15:37:30 -0700 Message-ID: To: Ian Maddison Cc: ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000f027870590f8af19" Archived-At: Subject: Re: [Add] Landscape X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 25 Aug 2019 22:37:45 -0000 --000000000000f027870590f8af19 Content-Type: text/plain; charset="UTF-8" I think British people might find this kind of funny. Other parts of the world might find it trite and formulaic. But thanks for sharing. thanks, Rob On Sun, Aug 25, 2019 at 1:01 AM Ian Maddison wrote: > Hi Rob, > > In case you hadn't noticed, 9 of the last 10 mails sent to this list > appear to be written by yourself. Another type of over centralisation > surely. > > Just Sayring ;) > > On Sat, 24 Aug 2019, at 22:02, Rob Sayre wrote: > > Hi, > > I thought I would update that list of features of the DNS landscape I > sent. Since it sounds like there will be chartered work soon enough, I > thought I would collect what I and others have found, and correct a few > things. > > I don't think it would be especially valuable to nitpick the list, but I > do think it might make a good wiki page when the group has one. On the > wiki, you can edit any wording or framing. > > thanks, > Rob > > > * ISPs use Classic DNS to fuel ad networks (they could still do this if > they provided DoT/DoH) > * ISPs intercept Classic DNS, and occasionally trigger certificate > warnings if they return a "blocked page"[1], similar to TLS errors one > might see from a captive portal. > * ISPs that provide roaming WiFi sometimes instruct users to install > EAP-TTLS certificates in their OS root stores, and this can cause confusion > about what they are for. I found that several UK ISPs have done this. > * ISPs sometimes distribute routers that prevent the user from changing > DNS settings. > * There are entertainment devices (Google, probably some Roku apps) > hard-coding DNS services, ignoring the OS and network administrator > * There are consumer routers that use centralized DNS services without > user interaction, ignoring the OS and network administrator (unless the > router owner counts as the admin...) > * There are Android handsets that enable a VPN on certain networks by > default, and all networks with user interaction, bypassing local DNS > * Home routers are being exploited to hijack Classic DNS > * Many ISPs simply ask Google to provide their DNS service, resulting in > more centralization than might first be apparent > * Browsers do tend to obey "Group Policy" and other similar administrator > features > * And, of course, browsers are shipping DoH, ignoring the OS and network > administrator > > thanks, > Rob > > [1] I want to be as dispassionate about this issue as possible. It does > seem like Vodafone may have had a misguided step in their support script, > where users were asked to install the certificate for the block page > server. This seems like it was done to fix the error the user was seeing > and display the block page, but not for anything else. > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --000000000000f027870590f8af19 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
I think British people might find this kind of funny.
=
Other parts of the world might find it trite and formulaic.<= /div>

But thanks=C2=A0for sharing.

<= div>thanks,
Rob


On Sun, Aug 25, 2019 at 1:01 = AM Ian Maddison <ian@mad.paris> wrote:
Hi Rob,

In case you hadn't noticed, 9 of = the last 10 mails sent to this list appear to be written by yourself. Anoth= er type of over centralisation surely.

Just Sayring ;)

On Sat, 24 = Aug 2019, at 22:02, Rob Sayre wrote:
Hi,

I= thought I would update that list of features of the DNS landscape I sent. = Since it sounds like there will be chartered work soon enough, I thought I = would collect what I and others have found, and correct a few things.

I don't think it would be especially valuable t= o nitpick the list, but I do think it might make a good wiki page when the = group has one. On the wiki, you can edit any wording or framing.
<= div>
thanks,
Rob

<= br>
* ISPs use Classic DNS to fuel ad networks (they could still do this if= they provided DoT/DoH)
* ISPs intercept Classic DNS, and occasio= nally trigger certificate warnings if they return a "blocked page"= ;[1], similar to TLS errors one might see from a captive portal.
<= /div>
= * ISPs that provide roaming WiFi sometimes instruct users to install EAP-TT= LS certificates in their OS root stores, and this can cause confusion about= what they are for. I found that several UK ISPs have done this.
<= /div>
= * ISPs sometimes distribute routers that prevent the user from changing DNS= settings.
* There are entertainment devices (Google, probably so= me Roku apps) hard-coding DNS services, ignoring the OS and network adminis= trator
* There are consumer routers that use centralized DNS serv= ices without user interaction, ignoring the OS and network administrator (u= nless the router owner counts as the admin...)
* There are Androi= d handsets that enable a VPN on certain networks by default, and all networ= ks with user interaction, bypassing local DNS
* Home routers are = being exploited to hijack Classic DNS
* Many ISPs simply ask Goog= le to provide their DNS service, resulting in more centralization than migh= t first be apparent
* Browsers do tend to obey "Group Policy= " and other similar administrator features
* And, of course,= browsers are shipping DoH, ignoring the OS and network administrator

thanks= ,
Rob

[1] I want to be as dispassionate about this issue as possible. It does= seem like Vodafone may have had a misguided step in their support script, = where users were asked to install the certificate for the block page server= . This seems like it was done to fix the error the user was seeing and disp= lay the block page, but not for anything else.
--= =C2=A0
Add mailing list


-- <= br> Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--000000000000f027870590f8af19-- From nobody Sun Aug 25 18:51:55 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C3CD812006E for ; Sun, 25 Aug 2019 18:51:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.5 X-Spam-Level: X-Spam-Status: No, score=-17.5 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RVvpbLrSZnqh for ; Sun, 25 Aug 2019 18:51:51 -0700 (PDT) Received: from mail-lj1-x22f.google.com (mail-lj1-x22f.google.com [IPv6:2a00:1450:4864:20::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 12C8712001E for ; Sun, 25 Aug 2019 18:51:51 -0700 (PDT) Received: by mail-lj1-x22f.google.com with SMTP id x3so13560403lji.5 for ; Sun, 25 Aug 2019 18:51:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=8mgsbsuXf/AoGkKlT8e6g9U7C73/NDpUssO8vbWSGzI=; b=o7omwtW0yvM8GZWx/bBsP0qsebc5quzmK3hCxYPJYck5lp/1cHZ4gsR2qNmXVS/yHb tha6h1deMEb/c/zy9Qo72gUMOoL+nrDy7UZVRD37ToeypoN2k8dFcDtDFujqjGfZpBLE teo3IDyuqghwaK/oNkeFW8E5K+9Zfm4Ajf/piRxWKDaZOU7K7UcaR9Yd6OCsTGLIeEt+ AGNW6lUnSEGDXdn7EEs+TXDve8Nb9p4K73lqe2lDzExXotBKM9psHTf09gInMZnd0m11 aca5gBJufCFNQJaHb+lgoIizu+GKAxquIGzNalappUbbir+iCUidtceXzp4ozmXfsv8C ykYQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=8mgsbsuXf/AoGkKlT8e6g9U7C73/NDpUssO8vbWSGzI=; b=aFvLcjQegMC06zOZuui7ivtvT2xwHX0odkckvLsaKw8icnkEqJF49g/0hj0uFk9BCv clvZeJlHQ5osYFffpbXhRdB7eEj9hZd08vOlcGZ8nnCQ22meb5/08IQ0KYdd/TKXH17p cxw3GRz2a8BAaQs5bBmX52weRWPDUToYAJne50HDYO5nXKfX/LVb8qclujDwXkTCVFDg Igbxym/NWOGnqr6bugvopvVY6Q3Sx5j9ZO5GJru9hTokXNvGKiE5DTZfUwh1EEDd+sA6 JN8t1ECQZ46J29Uk0yGifgpjoBTPi3rPATBz7xunYUTTpGJUH/H1pWWm6QClpdsWG+9v FumA== X-Gm-Message-State: APjAAAUSlWhSh8Bs7zBxmM9gNvz7FJAAjMr51B0JD/vlDQ3PJtaZzLCs vtd24QFQvZQm9XyNaTBrAdVQZpREa4urNBT0TCsEzw== X-Google-Smtp-Source: APXvYqzhwNaCDV5lreJybgSCtYu0lFpWeyt2XyWFxM8a6mOx9iQS9NCKGOoukk6l/r9aGMYl82h6kMhcJtApgRmx05I= X-Received: by 2002:a05:651c:104a:: with SMTP id x10mr8688443ljm.238.1566784309077; Sun, 25 Aug 2019 18:51:49 -0700 (PDT) MIME-Version: 1.0 References: <9F22D687-FA0E-49D4-AC0E-2BE5285D02E1@cable.comcast.com> In-Reply-To: From: Kenji Baheux Date: Mon, 26 Aug 2019 10:51:38 +0900 Message-ID: To: Rob Sayre Cc: "Livingood, Jason" , "chris.box@bt.com" , "add@ietf.org" Content-Type: multipart/alternative; boundary="0000000000002efcc00590fb6608" Archived-At: Subject: Re: [Add] Participation X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 26 Aug 2019 01:51:54 -0000 --0000000000002efcc00590fb6608 Content-Type: text/plain; charset="UTF-8" There's been quite a lot of articles like this (i.e. attacking the home router's DNS settings by exploiting a flaw in their web interface) in the recent months: https://decoded.avast.io/threatintel/router-exploit-kits-an-overview-of-routercsrf-attacks-and-dns-hijacking-in-brazil/ Removing the ability to set the DNS via the web UI (which I assume is what is being referred to) does take care of this particular class of attacks but it's a bit heavy handed. On Sat, Aug 24, 2019 at 5:44 AM Rob Sayre wrote: > On Fri, Aug 23, 2019 at 1:40 PM Livingood, Jason < > Jason_Livingood@comcast.com> wrote: > >> On 8/23/19, 3:27 PM, "Add on behalf of chris.box@bt.com" < >> add-bounces@ietf.org on behalf of chris.box@bt.com> wrote: >> > This does appear to be the case on some hub routers, although not >> all. I can understand why - it'll default to BT because that will enable >> the delivery of content from localised CDN caches, and permit the malware >> controls etc. >> >> [JL] This is also a standard defense against DNS-changing malware. >> > > DNS-changing malware tends to exploit the router's OS, doesn't it? I would > not characterize this as a very good defense against that. > > thanks, > Rob > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > -- Kenji BAHEUX Product Manager - Chrome Google Japan --0000000000002efcc00590fb6608 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Sat, Aug 24, 20= 19 at 5:44 AM Rob Sayre <sayrer@gmai= l.com> wrote:
On Fri, Aug 23, 2019 at 1:40 PM Livi= ngood, Jason <Jason_Livingood@comcast.com> wrote:
On 8/23/19, 3:= 27 PM, "Add on behalf of chris.box@bt.com" <add-bounces@ietf.org on behalf of chris.box@bt.com> wrote:
>=C2=A0 =C2=A0 =C2=A0This does appear to be the case on some hub routers= , although not all. I can understand why - it'll default to BT because = that will enable the delivery of content from localised CDN caches, and per= mit the malware controls etc.

[JL] This is also a standard defense against DNS-changing malware.

DNS-changing malware tends to exploit the route= r's OS, doesn't it? I would not characterize this as a very good de= fense against that.

thanks,
Rob
--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add


--
Kenji BAHEUX
= Product Manager - Chrome
Google Japan
--0000000000002efcc00590fb6608-- From nobody Mon Aug 26 00:56:25 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E2913120119 for ; Mon, 26 Aug 2019 00:56:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.997 X-Spam-Level: X-Spam-Status: No, score=-6.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FROM_EXCESS_BASE64=0.001, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nic.cz Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4xt8_4D7RCTg for ; Mon, 26 Aug 2019 00:56:21 -0700 (PDT) Received: from mail.nic.cz (mail.nic.cz [IPv6:2001:1488:800:400::400]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3A12F120112 for ; Mon, 26 Aug 2019 00:56:20 -0700 (PDT) Received: from [IPv6:2001:1488:fffe:6:8bf1:27e3:7571:4f04] (unknown [IPv6:2001:1488:fffe:6:8bf1:27e3:7571:4f04]) by mail.nic.cz (Postfix) with ESMTPSA id C07EB140B4F; Mon, 26 Aug 2019 09:56:17 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=nic.cz; s=default; t=1566806177; bh=ZwHzcRr4oHQ3yYvwV31C7KlOMW/SuLPa1ldVxpizOks=; h=To:From:Date; b=DNHbh6mVlAEzal+DPX5YKh8/W1ZwRx1fz7kotkxk536yQbEeLZxDmBUzrUV/RcxkJ 0BFbxAl52yQLqKEKeCuwjHgXcq7hJYP9UFn1rlwxEpJe4F73JaQdM/BC+EaWswyEa0 7c7bJde8AonazD+peH/c4FVPCro4YDYzE2zjT11w= To: "add@ietf.org" References: <1444D5E7-DEA7-437C-B12B-6C31FEA563DD@sky.uk> <11f9dfe2-ab05-2227-7643-e53da95ec717@nostrum.com> <18798.1566571840@dooku.sandelman.ca> Cc: Michael Richardson From: =?UTF-8?B?VmxhZGltw61yIMSMdW7DoXQ=?= Openpgp: preference=signencrypt Autocrypt: addr=vladimir.cunat+ietf@nic.cz; prefer-encrypt=mutual; keydata= mQINBFgDknYBEADHEQwLBlfqbVCzq7qYcBFFTc1WCAFtqiKehOrsITnKusZw4nhYwlKQxcum gj01xJOhbfHBCBeGlDydYqemKg4IfY2nwSyPwZZYMJn7L7AGrCeytr4VMvDJ7o7qDZjjim4i fv+GUwdk3plXx6oMF4nctesI8aAOuLUHAn0PfrGfNhWoaglOKgdOI6DGjhI/aGkvy+jrI/+X sdMV+3f1RuEOfI+Yu4SXFjJyhAmqEOBRxxdHqKreIIpz3Lg38yWwiVGfwgQT+nFIz9BpHH3l Wg1uS8xM3ezceBmRYV8zT9PvbeZ57BlaTR6rLae5RYwV397PSLBqqLkB5H0TDRUFBnwBsUob LebYHmJCOydvyNv5AFkLmLZ7O4j2jFo1WPSMt3ThM6wRwqrnB4Gi+6onyrZfE1DnVZMqbxZ3 VXa+E4S5YwrfCLUErGEn+d40OtoRZmQXhRPVAsdjimMj9oFM9RoxSgUrDg6Ia3n0IrKFb++z HAFbqkR5g4qzXiOMEG621GYEex2sDEKz/PD4CVKlNI9eld4ToH592kAwzJmd+sAi+Rfos0NE zxuFd0ekAOeWoURo0zoYTSWPlMOmFMvcpH6LP3leJmY7x4z/b1ng/+7UnKonVALVPFbRbElO kIfAtLKcUEofwV1jr7DyYGPalJtiDJPomB041ZHCj2RxyXY/oQARAQABtDBWbGFkaW3DrXIg xIx1bsOhdCAod29yaykgPHZsYWRpbWlyLmN1bmF0QG5pYy5jej6JAlQEEwEIAD4CGyMFCQlm AYAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AWIQS2AGRgtgqA54IGJEnnR98flXWjqgUCWg3w 3gAKCRDnR98flXWjqmD6D/96U4cDZBrHQ5LhqybocZr/N2IS5Wr2SLLB4k2F5/W/wbL05gq6 Ha9/2TMqXoxRkhug+EAHFHxylPR43yN9rz0pjBXHrra87FAPHMqq/qqrOEUdhkytEqa6WIho aoEkdhaMhUyctjVjL2WZ0+MWeRjqedLQX+VCrOVPcVbLreRRhA9N3KPgNwbp9zCg6hEPi4l2 zZKedHkTNjKIAwJ0xZoMwFa1Y+vL8Em8Or+IBZuGBMP/ZMtasPOIQaT/Gvsyx1DDorwsoCdX 6zaTZy5DOWP3FIrMzus/YDbzwAYxSpWk/jF44ySbnJzdjU67EfG3UrsK+RRGw8aJqs3/4qHK ZMZZnNL+4wJpEdnZyFic/MXcw6FBszQEwrIOaM1WEfwzn2ExUYk2pM5zaBwq76OgrmGMzMEi cfMDyqLodwEQqR70PvRbkrh+R02LphwQ9c5AFXcrLjKMmeQlbQVarTUsrELcTK6rElC1ojS7 M37j0XzFE+kgNWn2fyBRgtnGDWEa7r+oDaueXJnEf0/4Ww28IwxakNc7r0N41GIBekwSxKdk epKFZgtVGGSDlFei5hb5LLWFljA1OS7CRVJKpbHafQjdPdb1vNqZAj4y2SJXvVVpI1KO5kq+ dFdYipORv0N2Iho6MNYbQUT1EBeU46G5N0viCoLS15/PxLhIAo+PzKpW97kCDQRYA5J2ARAA yHww3huLEtsdyqgjiGMhtEKOLmp7yFl450HY9oPcHS02U5BC1370ssNShrdOCi2ACDbe41Zx x85WcuaO1OVqung2umX047mj2xQsiTAFRDLZsQu8cQFoEy/DBL2bk7ThfK1Lh+NyZAs0UaPp DkGodS0De9osA+4T6Nf4POYaeavbYVFSdDKS4lUboBqApKnD/TzKFxFcpuFx6FN92lteTbOo jGMiLoZvELY86Kn9KuFZ8FM2ZSNHx1Z75KouufGrdkeCoZYVYiuzT+fnt2it4dIpIlnF+yxM t5LB/MSrmECB5CAFJtxzuMccm6yDUZQSWWi9vUgxIJwvt5w0CIBT353DGeP4WnH0r5YoBKoR bh7i4fT0lWvMXTG/V2lqyzBdClMebyHffMgba26Kj6oeDygDfC5aGsVaqw1Ue/qQ5QRqTJcJ V7xVLTtS1EamVqkfKwPS0zTfnrF1jQtnO/P4qkfgBRRG9BXGGrykHpXOyqmX6Z0wbV2P4j+p 02oSecDl5yVXplJfsXfbS/xXnaSkaN/7mCU29ul26cAVNxDkDPunztSFi9K9LM2T/XWYJQGX M71OpmONQJGF24lx7Wp/kobnHtbjGDzjDPC4eSL7MA56qtrWaLM+4ePKANct2q0q6c0uSLs0 Q2zochS64Mcg0YzL1sinWPN1rXLDk3lwpIsAEQEAAYkCJQQYAQgADwUCWAOSdgIbDAUJCWYB gAAKCRDnR98flXWjqn4yEACA0f1XBAg+WMaNPtIt0k15yFPfhdbOg9GhDcYGgvFIOxRuaFWw 9SLUt7OGuUnIpKxKRXtQJss98fHkijo70ONYWPuLhfRGK/wg9Ao6MuFw5G8m431CBS/awrie b6iPjvAARXJCPTTBZk/NC988jiKdCh8PbTCHDsl+gSDytP15QUrdqSfS2Wf4653ej7+jtuTj xZzmGgvNSi6JDlb9KNtmBQKQAgpnOQM46ItESmzHDnmdcvhPLUDsjwkpIJ6clasOzaObwxJi ba7iFPcGwcClCSwYjMNXFtneCGUnEAa5RBIx+i+LV1iqB3VRvTC6tMIUueoQ7cdTy6afNkhw QYXm4/pDmNT8UMdnzwnlTpFQ0CegDQRDWc+dIDDBHGEEEYBh2vTOE04KrmYUp1bQsNegPfvL woHib0jEvohPMJ2fJtZAd1SJElgwPbM8H7emKBiTsHwF8gL7G2jo7AoGpqYjqXkCRS0tSLTN r+qHh+7Ltrkbu/ZVTTfh4Q/qw3VaLYQh4C0tBma/YevQy1O2c3TZXXFz1QF8b9/Hj/3sq2Kg T1AcZ51E+xG+cb6cUqgkihmgm39xx24GPlNAdCRuq01+iILol+Wox6OwF6hmqx1EMSmxcmGo UREr0rkMnFVsWeAYeVoE4q689qxCPu9iCMJMJnkRe1o9oQYSN7my+S98gA== Message-ID: Date: Mon, 26 Aug 2019 09:56:17 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: <18798.1566571840@dooku.sandelman.ca> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit Content-Language: en-US X-Virus-Scanned: clamav-milter 0.100.3 at mail.nic.cz X-Virus-Status: Clean Archived-At: Subject: Re: [Add] A thought -- Move the policy decisions outside the application. X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 26 Aug 2019 07:56:24 -0000 On 8/23/19 4:50 PM, Michael Richardson wrote: > Long ago, in the early days of DNSSEC, before type-code-rollover, I suggested > that we needed WAY MORE than SERVFAIL as the failure code to applications > when DNSSEC did not validate. That's being worked on for a couple of years now: https://datatracker.ietf.org/doc/draft-ietf-dnsop-extended-error/ I generally think we should focus on the ability to pass such information inside the DNS protocol.  Pushing operating system APIs to some direction seems way much harder, and the in-DNS path sometimes provides additional advantages (e.g. for forwarding in this case). --Vladimir From nobody Mon Aug 26 03:31:02 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E99A91200EC for ; Mon, 26 Aug 2019 03:31:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.199 X-Spam-Level: X-Spam-Status: No, score=-4.199 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, MIME_HTML_ONLY=0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=open-xchange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QxiUstG-II34 for ; Mon, 26 Aug 2019 03:30:59 -0700 (PDT) Received: from mx4.open-xchange.com (alcatraz.open-xchange.com [87.191.39.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5E4F312001E for ; Mon, 26 Aug 2019 03:30:59 -0700 (PDT) Received: from open-xchange.com (imap.open-xchange.com [10.20.30.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx4.open-xchange.com (Postfix) with ESMTPS id 817636A284; Mon, 26 Aug 2019 12:30:57 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=open-xchange.com; s=201705; t=1566815457; bh=QCE2rA5TAOk9/ip5+ssdB6yTiHmApp4CqNo0CnU4J98=; h=Date:From:Reply-To:To:Cc:In-Reply-To:References:Subject:From; b=ZVk5gEWXh8OQU7iVko4uvJPKJbxbHprod4Mfh9SvK0fUkJrjKTMxocYApq4R0kj+g lMMN+hYvktchviVG0/1WoQZNXXQ+w0qKh0lC6TxanWJNix/vjbYvNUrrYg7Of5v7V1 ENuaS6G1wnpSuimssDFSDa15oRMUk3fB+e7XKCdtNWd26P4RpZKM7ElySrzioW2FKw 6RKKILdpt+WxheAwSx55zYB7Zh6pFXKG85yJaBJVKZ7iITUMN0YBQk6HqsMwaF3ueO uiVW0Tm8uuJ8xeRBiuvO+GZ6TGsZNC04yCbj5IDBVehjDAn3cPZiObc4KmornEhBtL L4GGTiZ9K8ARw== Received: from appsuite-gw2.open-xchange.com (appsuite-gw2.open-xchange.com [10.20.28.82]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by open-xchange.com (Postfix) with ESMTPSA id 74E7A3C05CE; Mon, 26 Aug 2019 12:30:57 +0200 (CEST) Date: Mon, 26 Aug 2019 12:30:57 +0200 (CEST) From: Vittorio Bertola Reply-To: Vittorio Bertola To: Rob Sayre Cc: ADD Mailing list Message-ID: <1509779459.3747.1566815457416@appsuite-gw2.open-xchange.com> In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Priority: 3 Importance: Medium X-Mailer: Open-Xchange Mailer v7.10.2-Rev11 X-Originating-Client: open-xchange-appsuite Autocrypt: addr=vittorio.bertola@open-xchange.com; prefer-encrypt=mutual; keydata= mQENBFhFR+UBCACfoywFKBRfzasiiR9/6dwY36eLePXcdScumDMR8qoXvRS55QYDjp5bs+yMq41qWV9 xp/cqryY9jnvHbeF3TsE5yEazpD1dleRbkpElUBpPwXqkrSP8uXO9KkS9KoX6gdml6M4L+F82WpqYC1 uTzOE6HPmhmQ4cGSgoia2jolxAhRpzoYN99/BwpvoZeTSLP5K6yPlMPYkMev/uZlAkMMhelli9IN6yA yxcC0AeHSnOAcNKUr13yXyMlTyi1cdMJ4sk88zIbefxwg3PAtYjkz3wgvP96cNVwAgSt4+j/ZuVaENP pgVuM512m051j9SlspWDHtzrci5pBKKFsibnTelrABEBAAG0NUJlcnRvbGEsIFZpdHRvcmlvIDx2aXR 0b3Jpby5iZXJ0b2xhQG9wZW4teGNoYW5nZS5jb20+iQFABBMBAgAqBAsJCAcGFQoJCAsCBRYCAwEAAp 4BAhsDBYkSzAMABQMAAAAABYJYRUflAAoJEIU2cHmzj8qNaG0H/ROY+suCP86hoN+9RIV66Ej8b3sb8 UgwFJOJMupZfeb9yTIJwE4VQT5lTt146CcJJ5jvxD6FZn1Htw9y4/45pPAF7xLE066jg3OqRvzeWRZ3 IDUfJJIiM5YGk1xWxDqppSwhnKcMOuI72iioWxX0nGQrWxpnWJsjt08IEEwuYucDkul1PHsrLJbTd58 fiMKLVwag+IE1SPHOwkPF6arZQZIfB5ThtOZV+36Jn8Hok9XfeXWBVyPkiWCQYVX39QsIbr0JNR9kQy 4g2ZFexOcTe8Jo12jPRL7V8OqStdDes3cje9lWFLnX05nrfLuE0l0JKWEg8akN+McFXc+oV68h7nu5A Q0EWEVH5QEIAIDKanNBe1uRfk8AjLirflZO291VNkOAeUu+dIhecGnZeQW6htlDinlYOnXhtsY1mK9W PUu+xshDq7lXn2G0LxldYwyJYZaJtDgIKqVqwxfA34Lj27oqPuXwcvGhdCgt0SW/YcalRdAi0/AzUCu 5GSaj2kaGUSnBYYUP4szGJXjaK2psP5toQSCtx2pfSXQ6MaqPK9Zzy+D5xc6VWQRp/iRImodAcPf8fg JJvRyJ8Jla3lKWyvBBzJDg6MOf6Fts78bJSt23X0uPp93g7GgbYkuRMnFI4RGoTVkxjD/HBEJ0CNg22 hoHJondhmKnZVrHEluFuSnW0wBEIYomcPSPB+cAEQEAAYkBMQQYAQIAGwUCWEVH5QIbDAQLCQgHBhUK CQgLAgUJEswDAAAKCRCFNnB5s4/KjdO8B/wNpvWtOpLdotR/Xh4fu08Fd63nnNfbIGIETWsVi0Sbr8i E5duuGaaWIcMmUvgKe/BM0Fpj9X01Zjm90uoPrlVVuQWrf+vFlbalUYVZr51gl5UyUFHk+iAZCAA0WB rsmACKvuV1P7GuiX3UV9b59T9taYJxN3dNFuftrEuvsqHimFtlekUjUwoCekTJdncFusBhwz2OrKhHr WWrEsXkfh0+pURWYAlKlTxvXuI7gAfHEQM+6OnrWvXYtlhd0M1sBPnCjbyG63Qws7Rek9bEWKtH6dA6 dmT2FQT+g1S9Mdf0WkPTQNX0x24dm8IoHuD3KYwX7Svx43Xa17aZnXqUjtj1 Archived-At: Subject: Re: [Add] Customer Service X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 26 Aug 2019 10:31:01 -0000

Il 24 agosto 2019 03:45 Rob Sayre <sayrer@gmail.com> ha scritto:

I was intentionally making the point that the "customer service" arguments aren't very good.
Well, the "customer service argument" is: changing the user's resolver from the ISP's to a third party one, without the user fully understanding this, will create "my Internet doesn't work" support calls to the ISP's customer service whenever the third party resolver malfunctions, and the customer service will be unable to solve the problem or even know what's happening.

To disprove that argument, you would have to explain why users wouldn't make those calls in that situation, or how ISPs would be able to deal with them - something that you have not done.

Anyway, this should be discussed when we'll work on a problem statement draft. At this point in time, we'd better focus on a list of work to be done.

-- 

Vittorio Bertola | Head of Policy & Innovation, Open-Xchange
vittorio.bertola@open-xchange.com 
Office @ Via Treviso 12, 10144 Torino, Italy
From nobody Mon Aug 26 07:48:18 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 194FC1201DC for ; Mon, 26 Aug 2019 07:48:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.402 X-Spam-Level: X-Spam-Status: No, score=-1.402 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FORGED_FROMDOMAIN=0.249, FREEMAIL_FROM=0.001, HEADER_FROM_DIFFERENT_DOMAINS=0.249, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4UuFmmiT3P6b for ; Mon, 26 Aug 2019 07:48:14 -0700 (PDT) Received: from mail-io1-f53.google.com (mail-io1-f53.google.com [209.85.166.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5A4EC1200C5 for ; Mon, 26 Aug 2019 07:48:14 -0700 (PDT) Received: by mail-io1-f53.google.com with SMTP id s21so37987265ioa.1 for ; Mon, 26 Aug 2019 07:48:14 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to :content-transfer-encoding; bh=HTTi596W2r8hGKZqOMvUkWcYuW/6iuvyHnagBAr2JuA=; b=SOD0jzNPNCdyi1qzqzDwczuOAM59nLMyx0bOhRo9MnhYLQQ6btLjrWQsxMy3dNIPDC 0HQ2qq0MwK4KS8u50NZcUh4vX+zjyqsU0E9Lqk38zCYP1MNfzwequ3d9J5ucqDcl0PFz SvwrZV7I3TSztmirnqW8I4NZTKy4BapYQzHvXDUQRcOY8s8jDM0Y/5k/ghXv950M5BP0 dJPQBVEOBM2m76EKQmRzi2oCy0VZnonvaneLTZrFWNJO+xE+V+wIcGza4783/NZW/pA0 2ppkdqkoqwW3IN1r0oJKtnls6rk8S620AqCe4/n8FQJQC5mA1Uj8wTQcyGgf0VOIUqbg yYiQ== X-Gm-Message-State: APjAAAWqZfZG/vmO28N/kaEJl2aTTYn74WOqaMvAJUZ/R3pZGoLMp3QB U83hnUVPPR9Py29zEEFR8YLFW7Nj7jNv+ksQOgyQf4NB X-Google-Smtp-Source: APXvYqxKOmfa+McuVVL8o0KePKdAVFejYhgPD91gySbuvBQYjSFqsYiFofhRQ79ARZbedd+ZNQzdems05j8I1yyb1VE= X-Received: by 2002:a6b:3c07:: with SMTP id k7mr12373423iob.107.1566830893204; Mon, 26 Aug 2019 07:48:13 -0700 (PDT) MIME-Version: 1.0 From: Barry Leiba Date: Mon, 26 Aug 2019 10:48:01 -0400 Message-ID: To: add@ietf.org Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Archived-At: Subject: [Add] Slowing the list traffic down a bit: listening more and saying less X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 26 Aug 2019 14:48:16 -0000 Hi, all. As we all know, the ADD mailing list is a very high-volume one, both in the sense of quantity and in the sense of =E2=80=9Cloudness=E2=80=9D. I= t=E2=80=99s clear that a lot of the discussion is productive and important to have. It=E2=80=99s also clear that a lot of it isn=E2=80=99t as productive, and d= oesn=E2=80=99t contribute to moving the conversation forward. We=E2=80=99re often talking without also listening. I think it=E2=80=99s important that we slow things down a bit listen to eac= h other, and think more about what we=E2=80=99re saying =E2=80=94 and whether= what we=E2=80=99re about to say adds value, or just repeats points that were already made. So here=E2=80=99s what I=E2=80=99m going to do: As soon as I send this, I=E2=80=99m going to put the ADD list in moderation= . That means that no posts will go directly to the list. Instead, they=E2=80=99ll come to the list moderators first, and we=E2=80=99ll have t= o release them for posting. For now, that=E2=80=99s me: I=E2=80=99m taking responsibi= lity for this. (A side note: the BoF chairs, Dave and Lars, did a great job chairing the BoF, and I thank them very much for that. But they did not sign up for managing/moderating the mailing list, and I=E2=80=99m not asking them to.) I will not be releasing posts in real time. A few times a day, I=E2=80=99l= l have a look at the queue and browse the messages. Those that are aimed at moving the conversation forward will be released to the list and posted as usual, albeit with some delay. Those that are not may be rejected. For some, where it seems there=E2=80=99s value but in my judgment the tone is snarky or insulting, or may otherwise raise hackles unnecessarily, I might contact the poster and ask that person to think about the wording and consider re-posting. I=E2=80=99m hoping that this will keep an important discussion moving, and will increase the useful content. Note that I=E2=80=99m not calling anyone inparticular out here. I=E2=80=99m looking to address the overall usefulne= ss and professionality of the discussion on the list. Note also that I=E2=80= =99m not going to be perfect in my assessment of things. Please, if I contact you (or, as might happen, reject your post) and you think I=E2=80= =99m being over-sensitive or just plain wrong=E2=80=A6 bear with me. Understand that I=E2=80=99m doing this in good faith, and try not to be upset, but to work with me on making this discussion what it needs to be. Also remember that I=E2=80=99m in the U.S. Eastern time zone (New York), an= d that I do sleep. Posts from Europe won=E2=80=99t be handled until mid-afternoon your time, and those from Asia not until late evening and the middle of the night. Perhaps one of my AD-colleagues from Europe will be willing to join me in moderating these posts. For now, it=E2=80=99s going to be just me, and time zones are that they are. Thanks, everyone, for your participation=E2=80=A6 and, in advance, for your understanding. Barry, ART AD From nobody Mon Aug 26 10:14:13 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 23BA412081A for ; Mon, 26 Aug 2019 08:37:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6MqdR-ukag2X for ; Mon, 26 Aug 2019 08:37:09 -0700 (PDT) Received: from shaun.rfc1035.com (smtp.v6.rfc1035.com [IPv6:2001:4b10:100:7::25]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CE86112080D for ; Mon, 26 Aug 2019 08:37:08 -0700 (PDT) Received: from gromit.rfc1035.com (gromit.rfc1035.com [195.54.233.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by shaun.rfc1035.com (Postfix) with ESMTPSA id EA36B242109D; Mon, 26 Aug 2019 15:37:04 +0000 (UTC) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) From: Jim Reid In-Reply-To: Date: Mon, 26 Aug 2019 16:37:04 +0100 Cc: ADD Mailing list Content-Transfer-Encoding: quoted-printable Message-Id: <6254AD2E-5A06-4327-A083-FA32746C0278@rfc1035.com> References: <766112E1-F532-4C6B-8CA8-A096671E02EE@piuha.net> <59E0EC53-0E30-431C-8376-52C7BFC121A8@virtualized.org> <589DAFCB-1BDC-4156-A2CA-179C4559A6B2@virtualized.org> <683A176C-3CE6-4866-A736-F2A7465FA5B5@rfc1035.com> <69015C05-4AE8-4FB2-94D4-3B52018DEBA6@rfc1035.com> To: Eric Rescorla X-Mailer: Apple Mail (2.3445.9.1) Archived-At: X-Mailman-Approved-At: Mon, 26 Aug 2019 10:14:12 -0700 Subject: Re: [Add] data integrity and DNSSEC or DoH/DoT X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 26 Aug 2019 15:37:10 -0000 > On 23 Aug 2019, at 13:25, Eric Rescorla wrote: >=20 > Let's go back to your original message, which made the distinction = between actual truth and whatever the resolver told you "DNSSEC = validation means you get the truth, the whole truth and nothing but the = truth regardless of your choice of resolver or the transport path = between you and that resolver. DoH and DoT offer no protection at all = from a lying resolver - you=E2=80=99re just guaranteed to receive = precisely whatever lies or truth that resolver sends" This distinction = is only relevant if you actually aren't going to just trust whatever the = resolver tells you. Indeed.=20 However I don=E2=80=99t understand how this relates to the point you = seemed to be making, namely differentiation between a resolver that=E2=80=99= s blocking malware and a malicious resolver (for some definition of that = term). Could you please apply some clue? From nobody Mon Aug 26 10:14:51 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 24EA0120A2A for ; Mon, 26 Aug 2019 10:14:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Y8tMHKuMmvnX for ; Mon, 26 Aug 2019 10:14:02 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [IPv6:2607:f0b0:f:3:216:3eff:fe7c:d1f3]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 074DC12008B for ; Mon, 26 Aug 2019 10:14:02 -0700 (PDT) Received: from sandelman.ca (obiwan.sandelman.ca [IPv6:2607:f0b0:f:2::247]) by tuna.sandelman.ca (Postfix) with ESMTP id A99023818C for ; Mon, 26 Aug 2019 13:12:54 -0400 (EDT) Received: from localhost (localhost [IPv6:::1]) by sandelman.ca (Postfix) with ESMTP id C964070F for ; Mon, 26 Aug 2019 13:14:00 -0400 (EDT) From: Michael Richardson To: "add\@ietf.org" In-Reply-To: References: <1444D5E7-DEA7-437C-B12B-6C31FEA563DD@sky.uk> <11f9dfe2-ab05-2227-7643-e53da95ec717@nostrum.com> <18798.1566571840@dooku.sandelman.ca> X-Mailer: MH-E 8.6; nmh 1.7+dev; GNU Emacs 24.5.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: X-Mailman-Approved-At: Mon, 26 Aug 2019 10:14:49 -0700 Subject: Re: [Add] A thought -- Move the policy decisions outside the application. X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 26 Aug 2019 17:14:04 -0000 --=-=-= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Vladim=C3=ADr =C4=8Cun=C3=A1t wrote: >> Long ago, in the early days of DNSSEC, before type-code-rollover, I = suggested >> that we needed WAY MORE than SERVFAIL as the failure code to applica= tions >> when DNSSEC did not validate. > That's being worked on for a couple of years now: > https://datatracker.ietf.org/doc/draft-ietf-dnsop-extended-error/ > I generally think we should focus on the ability to pass such > information inside the DNS protocol.=C2=A0 Pushing operating system A= PIs to > some direction seems way much harder, and the in-DNS path sometimes > provides additional advantages (e.g. for forwarding in this case). Ted (or was it Paul?) also mentioned that there was an effort to be able to return positive DNSSEC validation, while also saying that the name has been censored. I haven't understood that proposal well. It seems that dnsop-extended-error includes 4.17 -- Censored. I see there to be three technical things that applications doing DNS(SEC) n= eed: 1) discover "local" DoT and DoH resolvers, particularly when "public" DoT/D= oH resolvers might be blocked due to legal requirement. There are a few different proposals in dprive WG already. 2) discover anchors for DoT and DoH resolvers, and along with this, discover what the privacy and censorship policy of those resolvers is. We removed this from the next version of draft-reddy-dprive-bootstrap-dn= s-server, with the intention of having a new draft, which I have not completed, but we think it is work for DPRIVE. 3) communicate better errors concerning censorship to applications, which DNSOP WG seems to already be doing. =3D=3D=3D=3D There are some political layer things that we need to be cognizant about: a) there are significant local political forces for a wide variety of censorship, with the legal mandate to be able to enforce it. We (the IETF) prefer that they do this in ways that does not involve a belief that they can contradicts mathematical science. No nuking of h= urricanes. b) there is conversely, significant interest in making browsing private, specifically to enable open and free access to all web sites. The Mozilla approval list is unlikely to scale *geopolitically*, and there are many (IETF "objectively") freedom-loving entities that will be unable (legally) to comply to the requirements listed, but which end users and end-network administrators (i.e: "parents", "teachers") will find have value. It is important that it is possible to communicate the privacy policy to users. c) All jurisdictions are subject to NSLs, and therefore equally able to be forced to make disclosures. To paraphrase Orwell: Some jurisdictions are more equal than others. I don't think it is the IETF's business to say declare winners among (a) and (b), but rather to enable end users to be aware of what is going on. =2D- ] Never tell me the odds! | ipv6 mesh network= s [ ] Michael Richardson, Sandelman Software Works | IoT architect = [ ] mcr@sandelman.ca http://www.sandelman.ca/ | ruby on rails = [ =2D- Michael Richardson , Sandelman Software Works -=3D IPv6 IoT consulting =3D- --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAl1kE1gACgkQgItw+93Q 3WXKTggAshhiyXMog9YJKUIKqZAV/u/rgH/dNVauVveDNnSvXjYWHUIPx0SYOrT4 GVl3ZmagCZEP3Lxr7m9/U4Y1yKiRbLsOUF+nkCnhFN1LtNpuRrTikA3ysrslKZwy 0oKYUFxZWUH/6CJQf1x8zEjRQz0Ez+jstNnZfBfKYQXpSSZMwj9LlbZGxoy36PN6 aTPjKlp86c0Zngt8oOAof4kEkHcj44B863eMbEgyKXcIXTx/85GTySib46DzRvzp OcVQEq/Qj5svb1Mj8H1+KJbzepGgCNRVrgaI5J8Seb8ixkpBGMKTsY0lAe7LLWRW 50nY20hle/bvTRMeQRwvXvsFaqP/kw== =U2CJ -----END PGP SIGNATURE----- --=-=-=-- From nobody Mon Aug 26 13:29:56 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6371A120B1F for ; Mon, 26 Aug 2019 10:55:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.98 X-Spam-Level: X-Spam-Status: No, score=-1.98 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, T_SPF_HELO_PERMERROR=0.01, T_SPF_PERMERROR=0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nostrum.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Fd6T8R0AYsCM for ; Mon, 26 Aug 2019 10:55:27 -0700 (PDT) Received: from nostrum.com (raven-v6.nostrum.com [IPv6:2001:470:d:1130::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1CABE120B1A for ; Mon, 26 Aug 2019 10:55:27 -0700 (PDT) Received: from MacBook-Pro.roach.at (99-152-146-228.lightspeed.dllstx.sbcglobal.net [99.152.146.228]) (authenticated bits=0) by nostrum.com (8.15.2/8.15.2) with ESMTPSA id x7QHtN64068247 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NO); Mon, 26 Aug 2019 12:55:24 -0500 (CDT) (envelope-from adam@nostrum.com) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=nostrum.com; s=default; t=1566842125; bh=BpO62GoEKAdK8fJa5Qg30lpfqQi4ZrRqXVeBYBXKII8=; h=Subject:To:References:From:Date:In-Reply-To; b=B/3T8Wf6X2KLHPk6h5PQ20R0hP7OnL2Tf+CaJ62pD5hS2y47p/CVcyPJu72hvDsT1 U6EW2Kp7fADIaX4FPWRgZ/BQ35RyyHq8trkJcPc8WI8am2RfCjIgHzIXQxdNEEMT+v gVs1SMEPWKpvcBlHj+YcREpOLf3QvO26vKwG+OtE= X-Authentication-Warning: raven.nostrum.com: Host 99-152-146-228.lightspeed.dllstx.sbcglobal.net [99.152.146.228] claimed to be MacBook-Pro.roach.at To: Michael Richardson , "add@ietf.org" References: <1444D5E7-DEA7-437C-B12B-6C31FEA563DD@sky.uk> <11f9dfe2-ab05-2227-7643-e53da95ec717@nostrum.com> <18798.1566571840@dooku.sandelman.ca> <15520.1566839640@localhost> From: Adam Roach Message-ID: <83f1f2ed-b475-a73a-74b5-92a0de576d07@nostrum.com> Date: Mon, 26 Aug 2019 12:55:18 -0500 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: <15520.1566839640@localhost> Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Content-Language: en-US Archived-At: X-Mailman-Approved-At: Mon, 26 Aug 2019 13:29:54 -0700 Subject: Re: [Add] A thought -- Move the policy decisions outside the application. X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 26 Aug 2019 17:55:28 -0000 On 8/26/19 12:14 PM, Michael Richardson wrote: > b) there is conversely, significant interest in making browsing private, > specifically to enable open and free access to all web sites. The > Mozilla approval list is unlikely to scale *geopolitically*, and there > are many (IETF "objectively") freedom-loving entities that will be unable > (legally) to comply to the requirements listed, but which end users and > end-network administrators (i.e: "parents", "teachers") will find have > value. It is important that it is possible to communicate the privacy > policy to users. Since you're citing Mozilla's TRR policy directly, I'd like to clarify that the policy you refer to states that "Resolvers may block or filter content with the user’s explicit consent." It also allows for blocking as "specifically required by law in the jurisdiction in which the resolver operates." You may already know both of these things, but people reading your message without reading the actual policy might have inferred incorrectly that neither clause exists. /a From nobody Mon Aug 26 13:30:16 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id ED1BE120B1F for ; Mon, 26 Aug 2019 10:57:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fivmufg-3t5b for ; Mon, 26 Aug 2019 10:56:59 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [209.87.249.19]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0778A120B1A for ; Mon, 26 Aug 2019 10:56:58 -0700 (PDT) Received: from sandelman.ca (obiwan.sandelman.ca [IPv6:2607:f0b0:f:2::247]) by tuna.sandelman.ca (Postfix) with ESMTP id A26063818E for ; Mon, 26 Aug 2019 13:55:50 -0400 (EDT) Received: from localhost (localhost [IPv6:::1]) by sandelman.ca (Postfix) with ESMTP id C9F4270F for ; Mon, 26 Aug 2019 13:56:56 -0400 (EDT) From: Michael Richardson To: "add\@ietf.org" In-Reply-To: References: <1444D5E7-DEA7-437C-B12B-6C31FEA563DD@sky.uk> <11f9dfe2-ab05-2227-7643-e53da95ec717@nostrum.com> <18798.1566571840@dooku.sandelman.ca> <15520.1566839640@localhost> X-Mailer: MH-E 8.6; nmh 1.7+dev; GNU Emacs 24.5.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: X-Mailman-Approved-At: Mon, 26 Aug 2019 13:30:14 -0700 Subject: Re: [Add] A thought -- Move the policy decisions outside the application. X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 26 Aug 2019 17:57:01 -0000 --=-=-= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Ted Lemon wrote: > One thing that Dot and DoH could potentially provide is a way to > establish a level of trust for =E2=80=9Ccensored=E2=80=9D result code= s. These result > codes can in principle be used as an attack, but if it=E2=80=99s the = rule that Does this go into the dnsop document? A dprive document that references it? Or do you think that this is new work that requires a new WG? Do you think that I missed any technical work? > a censored result code is never returned by any resolver other than t= he > one that is doing the censoring, then you could have a trust > relationship with a resolver from which you want this service, and th= en > based on the PKI validation, you could trust the result code as an > indication that the entity from which you have agreed to purchase or > accept filtering service has applied a filter. I very much like this. > (BTW, I don=E2=80=99t really believe in validation on the resolver, e= xcept as a > way to avoid caching crap, so it can=E2=80=99t have been me that said= that, > although it could have been that other Ted.) Maybe it was Paul that mentioned this effort. >> Ted (or was it Paul?) also mentioned that there was an effort to be = able to >> return positive DNSSEC validation, while also saying that the name h= as been >> censored. I haven't understood that proposal well. =2D- Michael Richardson , Sandelman Software Works -=3D IPv6 IoT consulting =3D- --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAl1kHWgACgkQgItw+93Q 3WWu2gf/emKz/2uzd94XQSsvFxwkRe4UB1v4rXI/l0/OMXtSK2q2b/pbPq/ANik8 SiepVkUPrs7IvcUZygg5Dp6rzSUMaXv3JR2GJEVvKgyK0ZeiEcShiRx46zg82qeo UQKHmlJFUSfV9YPGXxf681Uj9Tt12uXtopGmkeihnYmQF1lS3WM418hg95p4X/1p Woc8evvI/yf/kv2gMcoWcoCquL5D9k2NXD5KUMcWcyYf/VCjS1fOXSOsWFpk+ZS9 bQse2MqX24c1vozfELsvhsB8suqrElWjB1lWMyTsMmM+wtAt9rmlDQel/D/sLJtP t14zmyuJx9OLgWPR5KtFSSBrzXMt+Q== =4qIJ -----END PGP SIGNATURE----- --=-=-=-- From nobody Mon Aug 26 13:30:45 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1D3E51200FF for ; Mon, 26 Aug 2019 10:20:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YKTuCsrMISQZ for ; Mon, 26 Aug 2019 10:20:06 -0700 (PDT) Received: from mail-qt1-x830.google.com (mail-qt1-x830.google.com [IPv6:2607:f8b0:4864:20::830]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BB1FE12008B for ; Mon, 26 Aug 2019 10:20:05 -0700 (PDT) Received: by mail-qt1-x830.google.com with SMTP id i4so18592896qtj.8 for ; Mon, 26 Aug 2019 10:20:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=M1UHHmtdeKncXA7gcD+a0JAVMBPy04VTwVpwx4Exiz0=; b=t3x0OsM6UE48dJwVGg5pJs43cazPa9pV7TCQwAdMM7YJCP0NML36J4QCDch6bLrLtz nxLuqjmHJLKpJmO70yHq2N/rDMHXPNs+GQ6KE1rnUOWE1qNjULo97HbO2sji9MkNYtZ5 MB5eoJtus4WX6iWvG+AQw2AxTNHRkVhGjzSyzPrj1k9vWziEqNrdQExsa5JTnDO4hhQl TCZK1sof1oIb7Oc4lSn5x8jxogXWWoKy4WKEyv1MrIexNLOvOHYKpHsCVvlvEIn1hV3j gbLv+u/ECPTb/wKKZgek7/TPFLa6C7neohouPm5TkEpW9KJJjKCbyltHl+0k8EFf4598 CS/w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=M1UHHmtdeKncXA7gcD+a0JAVMBPy04VTwVpwx4Exiz0=; b=Dmqbb2nMTHS4axnJo6Fh+M9UC9q/m60lBL051KM9gAqkmJwuyK6UMfo0oza6i53Gk4 gOtF1KwZE+hpeU6wKAtNxRs7o7auoawTpmNEBd15KYLaCbS+mYrA9JnLh+L3aLJjJeQa dyihTBLyD4dagHdgTyIWRjZBdcOcbjjqgi02g5HM2lq89dl0ez6VQmUjiUGbyyrGtLEj vtUFxOtvcTzL1Veu0hRQCRyCRfxYXvLDbDSgetXq2+oGKF/Zx2FQCk4PXkaSzSWSHdcc X/ViOJ1ihS2NttPAAZB7yGbITK2d5snbPQQCxIlytEpFqWl8WsN+5Jv4sXAbmX/WSRTP 0qGw== X-Gm-Message-State: APjAAAXF2LQcOGoGhRPvKzx/ZqWYci2cHaCwQfad2dKZJFIam+mIUIQb Bfq7bglyeMbQ6IVYYSLjCzLdwg== X-Google-Smtp-Source: APXvYqwXOq5VJiNE7IktNLO02BgDflkrh46L74f3xAhkdoMaXBlBQUEOLur1kiSKlx0ay0UwT3yk2A== X-Received: by 2002:a0c:ab49:: with SMTP id i9mr16349705qvb.142.1566840004705; Mon, 26 Aug 2019 10:20:04 -0700 (PDT) Received: from [10.0.100.59] (c-73-186-137-119.hsd1.nh.comcast.net. [73.186.137.119]) by smtp.gmail.com with ESMTPSA id o43sm11677614qto.63.2019.08.26.10.20.04 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 26 Aug 2019 10:20:04 -0700 (PDT) From: Ted Lemon Message-Id: Content-Type: multipart/alternative; boundary="Apple-Mail=_6CB06934-67F2-41D7-A546-AF8E7C977EB9" Mime-Version: 1.0 (Mac OS X Mail 13.0 \(3578.1\)) Date: Mon, 26 Aug 2019 13:20:02 -0400 In-Reply-To: <15520.1566839640@localhost> Cc: "add@ietf.org" To: Michael Richardson References: <1444D5E7-DEA7-437C-B12B-6C31FEA563DD@sky.uk> <11f9dfe2-ab05-2227-7643-e53da95ec717@nostrum.com> <18798.1566571840@dooku.sandelman.ca> <15520.1566839640@localhost> X-Mailer: Apple Mail (2.3578.1) Archived-At: X-Mailman-Approved-At: Mon, 26 Aug 2019 13:30:43 -0700 Subject: Re: [Add] A thought -- Move the policy decisions outside the application. X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 26 Aug 2019 17:20:09 -0000 --Apple-Mail=_6CB06934-67F2-41D7-A546-AF8E7C977EB9 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 One thing that Dot and DoH could potentially provide is a way to = establish a level of trust for =E2=80=9Ccensored=E2=80=9D result codes. = These result codes can in principle be used as an attack, but if it=E2=80= =99s the rule that a censored result code is never returned by any = resolver other than the one that is doing the censoring, then you could = have a trust relationship with a resolver from which you want this = service, and then based on the PKI validation, you could trust the = result code as an indication that the entity from which you have agreed = to purchase or accept filtering service has applied a filter. (BTW, I don=E2=80=99t really believe in validation on the resolver, = except as a way to avoid caching crap, so it can=E2=80=99t have been me = that said that, although it could have been that other Ted.) > On Aug 26, 2019, at 1:14 PM, Michael Richardson = wrote: >=20 >=20 > Vladim=C3=ADr =C4=8Cun=C3=A1t wrote: >>> Long ago, in the early days of DNSSEC, before type-code-rollover, I = suggested >>> that we needed WAY MORE than SERVFAIL as the failure code to = applications >>> when DNSSEC did not validate. >=20 >> That's being worked on for a couple of years now: >> https://datatracker.ietf.org/doc/draft-ietf-dnsop-extended-error/ >=20 >> I generally think we should focus on the ability to pass such >> information inside the DNS protocol. Pushing operating system APIs = to >> some direction seems way much harder, and the in-DNS path sometimes >> provides additional advantages (e.g. for forwarding in this case). >=20 > Ted (or was it Paul?) also mentioned that there was an effort to be = able to > return positive DNSSEC validation, while also saying that the name has = been > censored. I haven't understood that proposal well. >=20 > It seems that dnsop-extended-error includes 4.17 -- Censored. >=20 > I see there to be three technical things that applications doing = DNS(SEC) need: >=20 > 1) discover "local" DoT and DoH resolvers, particularly when "public" = DoT/DoH > resolvers might be blocked due to legal requirement. There are a = few > different proposals in dprive WG already. >=20 > 2) discover anchors for DoT and DoH resolvers, and along with this, = discover > what the privacy and censorship policy of those resolvers is. > We removed this from the next version of = draft-reddy-dprive-bootstrap-dns-server, > with the intention of having a new draft, which I have not = completed, but > we think it is work for DPRIVE. >=20 > 3) communicate better errors concerning censorship to applications, = which > DNSOP WG seems to already be doing. >=20 > =3D=3D=3D=3D >=20 > There are some political layer things that we need to be cognizant = about: >=20 > a) there are significant local political forces for a wide variety of > censorship, with the legal mandate to be able to enforce it. > We (the IETF) prefer that they do this in ways that does not involve > a belief that they can contradicts mathematical science. No nuking = of hurricanes. >=20 > b) there is conversely, significant interest in making browsing = private, > specifically to enable open and free access to all web sites. The > Mozilla approval list is unlikely to scale *geopolitically*, and = there > are many (IETF "objectively") freedom-loving entities that will be = unable > (legally) to comply to the requirements listed, but which end users = and > end-network administrators (i.e: "parents", "teachers") will find = have > value. It is important that it is possible to communicate the = privacy > policy to users. >=20 > c) All jurisdictions are subject to NSLs, and therefore equally able = to > be forced to make disclosures. To paraphrase Orwell: Some = jurisdictions > are more equal than others. I don't think it is the IETF's = business > to say declare winners among (a) and (b), but rather to enable end > users to be aware of what is going on. >=20 >=20 > -- > ] Never tell me the odds! | ipv6 mesh = networks [ > ] Michael Richardson, Sandelman Software Works | IoT = architect [ > ] mcr@sandelman.ca http://www.sandelman.ca/ | ruby on = rails [ >=20 >=20 >=20 >=20 > -- > Michael Richardson , Sandelman Software Works > -=3D IPv6 IoT consulting =3D- >=20 >=20 >=20 > --=20 > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add --Apple-Mail=_6CB06934-67F2-41D7-A546-AF8E7C977EB9 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 One = thing that Dot and DoH could potentially provide is a way to establish a = level of trust for =E2=80=9Ccensored=E2=80=9D result codes.   These = result codes can in principle be used as an attack, but if it=E2=80=99s = the rule that a censored result code is never returned by any resolver = other than the one that is doing the censoring, then you could have a = trust relationship with a resolver from which you want this service, and = then based on the PKI validation, you could trust the result code as an = indication that the entity from which you have agreed to purchase or = accept filtering service has applied a filter.

(BTW, I don=E2=80=99t really believe in = validation on the resolver, except as a way to avoid caching crap, so it = can=E2=80=99t have been me that said that, although it could have been = that other Ted.)

On Aug = 26, 2019, at 1:14 PM, Michael Richardson <mcr+ietf@sandelman.ca> wrote:


Vladim=C3=ADr =C4=8Cun=C3=A1t <vladimir.cunat+ietf@nic.cz> wrote:
Long ago, in the early days of DNSSEC, before = type-code-rollover, I suggested
that we needed WAY MORE = than SERVFAIL as the failure code to applications
when = DNSSEC did not validate.

That's being worked on = for a couple of years now:
https://datatracker.ietf.org/doc/draft-ietf-dnsop-extended-erro= r/

I generally think we should focus on the ability to pass = such
information inside the DNS protocol.  Pushing = operating system APIs to
some direction seems way much = harder, and the in-DNS path sometimes
provides additional = advantages (e.g. for forwarding in this case).

Ted (or was it Paul?) also = mentioned that there was an effort to be able to
return = positive DNSSEC validation, while also saying that the name has been
censored.  I haven't understood that proposal well.

It seems that dnsop-extended-error includes = 4.17 -- Censored.

I see there to be three = technical things that applications doing DNS(SEC) need:

1) discover "local" DoT and DoH resolvers, particularly when = "public" DoT/DoH
  resolvers might be blocked = due to legal requirement.  There are a few
=   different proposals in dprive WG already.

2) discover anchors for DoT and DoH resolvers, and along with = this, discover
  what the privacy and = censorship policy of those resolvers is.
  We = removed this from the next version of = draft-reddy-dprive-bootstrap-dns-server,
  with = the intention of having a new draft, which I have not completed, but
  we think it is work for DPRIVE.

3) communicate better errors concerning censorship to = applications, which
  DNSOP WG seems to already = be doing.

=3D=3D=3D=3D

There are some political layer things that we need to be = cognizant about:

a) there are significant = local political forces for a wide variety of
=   censorship, with the legal mandate to be able to enforce = it.
  We (the IETF) prefer that they do this in = ways that does not involve
  a belief that they = can contradicts mathematical science.  No nuking of hurricanes.

b) there is conversely, significant interest = in making browsing private,
  specifically to = enable open and free access to all web sites.  The
=   Mozilla approval list is unlikely to scale *geopolitically*, = and there
  are many (IETF "objectively") = freedom-loving entities that will be unable
=   (legally) to comply to the requirements listed, but which = end users and
  end-network administrators = (i.e: "parents", "teachers") will find have
=   value.   It is important that it is possible to = communicate the privacy
  policy to users.

c) All jurisdictions are subject to NSLs, and = therefore equally able to
  be forced to make = disclosures.  To paraphrase Orwell: Some jurisdictions
=   are more equal than others.    I don't think = it is the IETF's business
  to say declare = winners among (a) and (b), but rather to enable end
=   users to be aware of what is going on.


--
] =             &n= bsp; Never tell me the odds! =             &n= bsp;   | ipv6 mesh networks [
] =   Michael Richardson, Sandelman Software Works =        |    IoT = architect   [
]     mcr@sandelman.ca =  http://www.sandelman.ca/ =        |   ruby on rails =    [




--
Michael Richardson <mcr+IETF@sandelman.ca>, Sandelman Software Works
-=3D IPv6 IoT consulting =3D-


--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add

= --Apple-Mail=_6CB06934-67F2-41D7-A546-AF8E7C977EB9-- From nobody Tue Aug 27 07:56:54 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BF92F120FC5 for ; Mon, 26 Aug 2019 13:36:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BzY-1tjMg5AP for ; Mon, 26 Aug 2019 13:36:50 -0700 (PDT) Received: from mail-qk1-x72d.google.com (mail-qk1-x72d.google.com [IPv6:2607:f8b0:4864:20::72d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C43B1120FBE for ; Mon, 26 Aug 2019 13:36:50 -0700 (PDT) Received: by mail-qk1-x72d.google.com with SMTP id r21so15233389qke.2 for ; Mon, 26 Aug 2019 13:36:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=FAuTAP6O0thfQLyCgO2tnPPNnceYT9WR52zkQlvQueQ=; b=cUPZQcZKW2c5rl8oHhhsHCKjl6ov9pmEutzFHALa+kr/xbT5i6TOp+FmNz2jwlXOkF daaPWPBahCBXw1nNI+p0ZHOnO2uF7HspBePsBNBwUiQiWQeL6TZck7pNUFloWaB9hq79 FEcR4K0y11pm+W7IBOCnimYQUrnPrM4U7bxoxezRX0yyz6Dti0nN27+S4RIcU2AowCSl zSJNwe7LVVDBKuvmmah17I9pdomNxHepz0LPAtUy9hvyQJO3bFA7AtZmfnXge5ZcBf+w /pM7JGr1lB3WMtB4qqgB7z1b7JlBOY7mpcQE5g3/7UF/tDlzDxwWJt12ef+eCu9vfr81 Jqxg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=FAuTAP6O0thfQLyCgO2tnPPNnceYT9WR52zkQlvQueQ=; b=LzM2mpPyKKSvS/9px8sNw+C5KE51jHdosr/PJWF3dDr6Cdg/3MQenrwmrIq0ACU2US GN3vu+xFA/Hz1JOTdfFOKN/3jN4mCl6uihT+FPYonbDqiBAKly+OBMa/EAbzBZ5M+NYc vBlQfhFEgNX+y5ukz2+EtLYZvrBRUwOFgdmO/+dqW43W2FyhlXOXHllWV1sYrE0h/wWb P8ypyNahVx7GdTC42ffgtwCW8AmVrswq7NslYaSoMETihX2w0aGBfJmojp852Wq2P/eK FSwG14leEmwApiyc+JsXdSQAXLwiKt36Slc93klvkAPsg0+mHA+rB/xGsJ5jauozNHjB 35Yg== X-Gm-Message-State: APjAAAVL06g74dcFB961DyXen1m13RGHuQ1LW9gELvuV63B0uUttFBkx wVWEMtvwBMJflq2NQfspaY5VNQ== X-Google-Smtp-Source: APXvYqxFlWjFmiH3sDAnwOTgj35Rai9CxG1/UsregLfFKudTZFVJHJZj0iMMAHPXKh1AtIW4K72qaA== X-Received: by 2002:ae9:e856:: with SMTP id a83mr17113129qkg.321.1566851809881; Mon, 26 Aug 2019 13:36:49 -0700 (PDT) Received: from [10.0.100.59] (c-73-186-137-119.hsd1.ma.comcast.net. [73.186.137.119]) by smtp.gmail.com with ESMTPSA id o50sm8115365qtj.17.2019.08.26.13.36.49 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 26 Aug 2019 13:36:49 -0700 (PDT) From: Ted Lemon Message-Id: <299551AC-20FD-4932-B7CB-3FAEA4BA869E@fugue.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_9933772A-CB14-401C-A110-1DEBB4CD602E" Mime-Version: 1.0 (Mac OS X Mail 13.0 \(3578.1\)) Date: Mon, 26 Aug 2019 16:36:47 -0400 In-Reply-To: <26278.1566842216@localhost> Cc: "add@ietf.org" To: Michael Richardson References: <1444D5E7-DEA7-437C-B12B-6C31FEA563DD@sky.uk> <11f9dfe2-ab05-2227-7643-e53da95ec717@nostrum.com> <18798.1566571840@dooku.sandelman.ca> <15520.1566839640@localhost> <26278.1566842216@localhost> X-Mailer: Apple Mail (2.3578.1) Archived-At: X-Mailman-Approved-At: Tue, 27 Aug 2019 07:56:52 -0700 Subject: Re: [Add] A thought -- Move the policy decisions outside the application. X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 26 Aug 2019 20:36:58 -0000 --Apple-Mail=_9933772A-CB14-401C-A110-1DEBB4CD602E Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 On Aug 26, 2019, at 1:56 PM, Michael Richardson = wrote: > Does this go into the dnsop document? > A dprive document that references it? > Or do you think that this is new work that requires a new WG? >=20 > Do you think that I missed any technical work? My overall knowledge of what has been written about this is sketchy at = best=E2=80=94I=E2=80=99ve been using these documents as a reference = resource rather than implementing them. So hopefully if at some point = our fearless AD mods these posts, someone who knows more about this than = either of us will weigh in. FWIW, my opinion, independent of any knowledge of what documents = actually exist or what their status is at present, is that the document = that defines the result code should also define the trust model and the = propagation rules. That somewhat argues for not putting it in the = extended-option-codes document, but it could go there if the authors are = willing to do this work. --Apple-Mail=_9933772A-CB14-401C-A110-1DEBB4CD602E Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 On = Aug 26, 2019, at 1:56 PM, Michael Richardson <mcr+ietf@sandelman.ca> wrote:
Does this go into the dnsop document?
A dprive = document that references it?
Or do you think that this is new work that requires a new = WG?

Do you think = that I missed any technical work?

My overall knowledge of what has been written = about this is sketchy at best=E2=80=94I=E2=80=99ve been using these = documents as a reference resource rather than implementing them. =  So hopefully if at some point our fearless AD mods these posts, = someone who knows more about this than either of us will weigh = in.

FWIW, my = opinion, independent of any knowledge of what documents actually exist = or what their status is at present, is that the document that defines = the result code should also define the trust model and the propagation = rules.   That somewhat argues for not putting it in the = extended-option-codes document, but it could go there if the authors are = willing to do this work.

= --Apple-Mail=_9933772A-CB14-401C-A110-1DEBB4CD602E-- From nobody Tue Aug 27 07:57:17 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 151BC1201E5 for ; Mon, 26 Aug 2019 19:03:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nohats.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RBYvmb_guV0g for ; Mon, 26 Aug 2019 19:03:13 -0700 (PDT) Received: from mx.nohats.ca (mx.nohats.ca [IPv6:2a03:6000:1004:1::68]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9A77D120020 for ; Mon, 26 Aug 2019 19:03:12 -0700 (PDT) Received: from localhost (localhost [IPv6:::1]) by mx.nohats.ca (Postfix) with ESMTP id 46HXG60323z38G; Tue, 27 Aug 2019 04:03:10 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nohats.ca; s=default; t=1566871390; bh=8WdVitZm6Igtl0Ic3f31mLUYx/tSLr4o6277BBlZoII=; h=Date:From:To:cc:Subject:In-Reply-To:References; b=d7A5EVRqwzMfI3pTEUaGcWlOZwD5pj3MtpcbDqiYiOii9aZ62jzXktKpMOUKwQUb/ 6WBbu2uljvrnl9XqotuupUkhROl9H9xq/aFdtYGJVSFGB4whwoTP16eEc/Y6JWeidQ t5Q0HxGAFbmgAuJWEV+M3nSltCRcKw7+oaQ0uUM4= X-Virus-Scanned: amavisd-new at mx.nohats.ca Received: from mx.nohats.ca ([IPv6:::1]) by localhost (mx.nohats.ca [IPv6:::1]) (amavisd-new, port 10024) with ESMTP id OV13BZdA1rK4; Tue, 27 Aug 2019 04:03:08 +0200 (CEST) Received: from bofh.nohats.ca (bofh.nohats.ca [76.10.157.69]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx.nohats.ca (Postfix) with ESMTPS; Tue, 27 Aug 2019 04:03:07 +0200 (CEST) Received: by bofh.nohats.ca (Postfix, from userid 1000) id 415BA59D094; Mon, 26 Aug 2019 22:03:06 -0400 (EDT) DKIM-Filter: OpenDKIM Filter v2.11.0 bofh.nohats.ca 415BA59D094 Received: from localhost (localhost [127.0.0.1]) by bofh.nohats.ca (Postfix) with ESMTP id 3B1724231C4F; Mon, 26 Aug 2019 22:03:06 -0400 (EDT) Date: Mon, 26 Aug 2019 22:03:06 -0400 (EDT) From: Paul Wouters To: Michael Richardson cc: "add@ietf.org" In-Reply-To: <15520.1566839640@localhost> Message-ID: References: <1444D5E7-DEA7-437C-B12B-6C31FEA563DD@sky.uk> <11f9dfe2-ab05-2227-7643-e53da95ec717@nostrum.com> <18798.1566571840@dooku.sandelman.ca> <15520.1566839640@localhost> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8BIT Archived-At: X-Mailman-Approved-At: Tue, 27 Aug 2019 07:57:16 -0700 Subject: Re: [Add] A thought -- Move the policy decisions outside the application. X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 27 Aug 2019 02:03:15 -0000 On Mon, 26 Aug 2019, Michael Richardson wrote: > > That's being worked on for a couple of years now: > > https://datatracker.ietf.org/doc/draft-ietf-dnsop-extended-error/ > > > I generally think we should focus on the ability to pass such > > information inside the DNS protocol.  Pushing operating system APIs to > > some direction seems way much harder, and the in-DNS path sometimes > > provides additional advantages (e.g. for forwarding in this case). > > Ted (or was it Paul?) also mentioned that there was an effort to be able to > return positive DNSSEC validation, while also saying that the name has been > censored. I haven't understood that proposal well. It was my idea to change RPZ to allow it to function with DNSSEC, without losing the ability to detect malicious censorship from opted-in censorship. The idea is that if the good guy filters, it moves the Answer Section data to the Authoritative Section. Current clients will thus be censored, since these clients will not look in the Authoritatve Section. Clients supporting this new RPZ 2.0 would look in the Authoritatve Section, pick up the data for DNSSEC validation, and also withhold it from the client unless the client asks for more additional information. Clearly that would need to be signaled from the DNS library to the application. This could be done with the above references Extended Errors, eg have an "RPZ 2.0 filtered" error. The advantage of this method is also that it required user's opt-in. If filtered maliciously, the user will get a proper DNSSEC error since the validation will fail. If the filter is properly done, the user can DNSSEC validate the response and decide to 1) not use the results because it trusts the censor, or 2) ignore the censor and use it anyway. This should faciliate Enterprise or Parental censorship while preventing nation state abuse. Of course nation states can filter the answer and omit all the data, but then you get a DNSSEC validation error to confirm to the enduser that they are being censored (the best you can do with a nationstate absolute filter in your path) Paul From nobody Tue Aug 27 07:59:03 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B7F29120110 for ; Tue, 27 Aug 2019 02:07:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.198 X-Spam-Level: X-Spam-Status: No, score=-4.198 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, MIME_HTML_ONLY=0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=open-xchange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id F7B5MFZ5WVlJ for ; Tue, 27 Aug 2019 02:07:05 -0700 (PDT) Received: from mx4.open-xchange.com (alcatraz.open-xchange.com [87.191.39.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C188712007C for ; Tue, 27 Aug 2019 02:07:04 -0700 (PDT) Received: from open-xchange.com (imap.open-xchange.com [10.20.30.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx4.open-xchange.com (Postfix) with ESMTPS id C3A966A273; Tue, 27 Aug 2019 11:07:02 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=open-xchange.com; s=201705; t=1566896822; bh=Q+MQJbrz9nSQl5eDBdNo8XpMRO+cXGE6Sn6kk/6HA2M=; h=Date:From:Reply-To:To:Cc:In-Reply-To:References:Subject:From; b=hEvwUYSbP18SmocHWqG/6YrDYVGU0H8/f4ADzQZMKHcC3jUOtW6EwTxkk/WZ7cn+Y ZQb2emMGL5+bcy88J/wesCaP8dI/aCdpR5XZybdIMX5Hrl35kyPq8bV+v5AjrlH0hW HvVUtXh2rXlNo5uvH3pJmQAbn3rq40gtaN6qpnMud+So/vZ5t1LBZFL9SRGeA9/N9z 3Gvogcnw6KXOssQowTP2emc3wvdDvnW8X2y42OrmY+5JHNm0BWGTq9DQceiRZ/knXa ZV5263rIH/wzxNsvRNi3HNYWxPRLbeUjEadeMEbFnPuMJFzZ6CKt0k3kWsmoqVoNJp NnXuuuuLJ6h+A== Received: from appsuite-gw2.open-xchange.com (appsuite-gw2.open-xchange.com [10.20.28.82]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by open-xchange.com (Postfix) with ESMTPSA id B693B3C03B8; Tue, 27 Aug 2019 11:07:02 +0200 (CEST) Date: Tue, 27 Aug 2019 11:07:02 +0200 (CEST) From: Vittorio Bertola Reply-To: Vittorio Bertola To: Ted Lemon Cc: "add@ietf.org" Message-ID: <1098628263.7014.1566896822696@appsuite-gw2.open-xchange.com> In-Reply-To: References: <1444D5E7-DEA7-437C-B12B-6C31FEA563DD@sky.uk> <11f9dfe2-ab05-2227-7643-e53da95ec717@nostrum.com> <18798.1566571840@dooku.sandelman.ca> <15520.1566839640@localhost> MIME-Version: 1.0 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable X-Priority: 3 Importance: Medium X-Mailer: Open-Xchange Mailer v7.10.2-Rev11 X-Originating-Client: open-xchange-appsuite Autocrypt: addr=vittorio.bertola@open-xchange.com; prefer-encrypt=mutual; keydata= mQENBFhFR+UBCACfoywFKBRfzasiiR9/6dwY36eLePXcdScumDMR8qoXvRS55QYDjp5bs+yMq41qWV9 xp/cqryY9jnvHbeF3TsE5yEazpD1dleRbkpElUBpPwXqkrSP8uXO9KkS9KoX6gdml6M4L+F82WpqYC1 uTzOE6HPmhmQ4cGSgoia2jolxAhRpzoYN99/BwpvoZeTSLP5K6yPlMPYkMev/uZlAkMMhelli9IN6yA yxcC0AeHSnOAcNKUr13yXyMlTyi1cdMJ4sk88zIbefxwg3PAtYjkz3wgvP96cNVwAgSt4+j/ZuVaENP pgVuM512m051j9SlspWDHtzrci5pBKKFsibnTelrABEBAAG0NUJlcnRvbGEsIFZpdHRvcmlvIDx2aXR 0b3Jpby5iZXJ0b2xhQG9wZW4teGNoYW5nZS5jb20+iQFABBMBAgAqBAsJCAcGFQoJCAsCBRYCAwEAAp 4BAhsDBYkSzAMABQMAAAAABYJYRUflAAoJEIU2cHmzj8qNaG0H/ROY+suCP86hoN+9RIV66Ej8b3sb8 UgwFJOJMupZfeb9yTIJwE4VQT5lTt146CcJJ5jvxD6FZn1Htw9y4/45pPAF7xLE066jg3OqRvzeWRZ3 IDUfJJIiM5YGk1xWxDqppSwhnKcMOuI72iioWxX0nGQrWxpnWJsjt08IEEwuYucDkul1PHsrLJbTd58 fiMKLVwag+IE1SPHOwkPF6arZQZIfB5ThtOZV+36Jn8Hok9XfeXWBVyPkiWCQYVX39QsIbr0JNR9kQy 4g2ZFexOcTe8Jo12jPRL7V8OqStdDes3cje9lWFLnX05nrfLuE0l0JKWEg8akN+McFXc+oV68h7nu5A Q0EWEVH5QEIAIDKanNBe1uRfk8AjLirflZO291VNkOAeUu+dIhecGnZeQW6htlDinlYOnXhtsY1mK9W PUu+xshDq7lXn2G0LxldYwyJYZaJtDgIKqVqwxfA34Lj27oqPuXwcvGhdCgt0SW/YcalRdAi0/AzUCu 5GSaj2kaGUSnBYYUP4szGJXjaK2psP5toQSCtx2pfSXQ6MaqPK9Zzy+D5xc6VWQRp/iRImodAcPf8fg JJvRyJ8Jla3lKWyvBBzJDg6MOf6Fts78bJSt23X0uPp93g7GgbYkuRMnFI4RGoTVkxjD/HBEJ0CNg22 hoHJondhmKnZVrHEluFuSnW0wBEIYomcPSPB+cAEQEAAYkBMQQYAQIAGwUCWEVH5QIbDAQLCQgHBhUK CQgLAgUJEswDAAAKCRCFNnB5s4/KjdO8B/wNpvWtOpLdotR/Xh4fu08Fd63nnNfbIGIETWsVi0Sbr8i E5duuGaaWIcMmUvgKe/BM0Fpj9X01Zjm90uoPrlVVuQWrf+vFlbalUYVZr51gl5UyUFHk+iAZCAA0WB rsmACKvuV1P7GuiX3UV9b59T9taYJxN3dNFuftrEuvsqHimFtlekUjUwoCekTJdncFusBhwz2OrKhHr WWrEsXkfh0+pURWYAlKlTxvXuI7gAfHEQM+6OnrWvXYtlhd0M1sBPnCjbyG63Qws7Rek9bEWKtH6dA6 dmT2FQT+g1S9Mdf0WkPTQNX0x24dm8IoHuD3KYwX7Svx43Xa17aZnXqUjtj1 Archived-At: X-Mailman-Approved-At: Tue, 27 Aug 2019 07:59:01 -0700 Subject: [Add] Communicating DNS blocks (was Re: A thought -- Move the policy decisions outside the application.) X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 27 Aug 2019 09:07:07 -0000 =20 =20

Il 26 agosto 2019 19:20 Ted Lemon <mellon@fugue.com> ha scritto:


One thing that Dot and DoH could potentially provide is a way to e= stablish a level of trust for =E2=80=9Ccensored=E2=80=9D result codes. &nbs= p;
In general, while I think that the IETF will never come to consensus on = whether altering DNS replies at the resolver level is philosophically alway= s unacceptable, always acceptable or acceptable only under certain conditio= ns, I think things would be much better for everyone if we could at least i= ntroduce more transparency, security and user-friendliness to this practice= .

For example, rather than having to alter the response (and break DNSSEC)= to redirect the user to a meaningful explanation page, a filtering resolve= r could just return the "blocked" or "censored" error code and add the alte= red IP address / explanation URL somewhere in an extra field - the "extra-t= ext" of Warren's draft or something more specific - which the client could = then use to show the resolver's message to the user. This would require cli= ent support, while old clients would just get the error rather than the alt= ered response, so we'd have to think whether this could actually work in al= l use cases, but still, once widely implemented, this would provide a clean= er architecture and a better user experience in the basic "web filter" case= s.
These result codes can in principle be used as an attack, but if it=E2= =80=99s the rule that a censored result code is never returned by any resol= ver other than the one that is doing the censoring, then you could have a t= rust relationship with a resolver from which you want this service, and the= n based on the PKI validation, you could trust the result code as an indica= tion that the entity from which you have agreed to purchase or accept filte= ring service has applied a filter.
Also, even when the filtering is made against your will, at least you co= uld be sure of who exactly is doing what - and PKI certificates could even = be used to prove who is the third party that asked the resolver to apply th= e filter.

However some people might say that this would be "the IETF building infr= astructure for censorship", so we'd first need to agree that doing this is = better than doing nothing.

-- 

Vittorio Bertola | Head of Policy & Innovation, Open=
-Xchange
vittorio.b=
ertola@open-xchange.com | +39 348 7015022
Office @ Via Treviso 12, 1=
0144 Torino, Italy
=20 From nobody Tue Aug 27 07:59:43 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 30B101200E9 for ; Tue, 27 Aug 2019 02:13:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.299 X-Spam-Level: X-Spam-Status: No, score=-4.299 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=open-xchange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Rm_jmgjhK_fV for ; Tue, 27 Aug 2019 02:12:59 -0700 (PDT) Received: from mx4.open-xchange.com (alcatraz.open-xchange.com [87.191.39.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 45D3B12007C for ; Tue, 27 Aug 2019 02:12:59 -0700 (PDT) Received: from open-xchange.com (imap.open-xchange.com [10.20.30.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx4.open-xchange.com (Postfix) with ESMTPS id D746B6A273; Tue, 27 Aug 2019 11:12:55 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=open-xchange.com; s=201705; t=1566897175; bh=qZB/NPVkJDklPURXs31XoMFb1aaFzrk8hRizjITyNUk=; h=Date:From:Reply-To:To:In-Reply-To:References:Subject:From; b=3HNIoVrq1wYLCW4+t2P1bj3zR2/9DM2joMd1F+hac8PUSKfQNRm9B4By1jd0pbZ/+ ErJGn8hpGT+1j7uQBJqs8kfCeFkDConVwlmuLwetW4/8q1orhqRmi2cFmeOf3jNiu9 glVxHHH4+sp3vwbr7it26K7Iv2j5LHvNCerJ3umuBxR+N9FuNOHchzQvc7FQRusiml ojRT/TKbxF/qgRwfcNksRMYWbfVdDYGZ0VcF2D63+NQGMr/d7Y+fxC1wknkLLJMBQ5 qkqTj15S1IlxLqsOV6srQet9A3vkwaG9OMOSfwD3cbet2bLyabXMcpq6cSbjoQu8fx eC5jFdSC7PHUA== Received: from appsuite-gw2.open-xchange.com (appsuite-gw2.open-xchange.com [10.20.28.82]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by open-xchange.com (Postfix) with ESMTPSA id CA37E3C03B8; Tue, 27 Aug 2019 11:12:55 +0200 (CEST) Date: Tue, 27 Aug 2019 11:12:55 +0200 (CEST) From: Vittorio Bertola Reply-To: Vittorio Bertola To: Adam Roach , "add@ietf.org" Message-ID: <493815238.7079.1566897175778@appsuite-gw2.open-xchange.com> In-Reply-To: <83f1f2ed-b475-a73a-74b5-92a0de576d07@nostrum.com> References: <1444D5E7-DEA7-437C-B12B-6C31FEA563DD@sky.uk> <11f9dfe2-ab05-2227-7643-e53da95ec717@nostrum.com> <18798.1566571840@dooku.sandelman.ca> <15520.1566839640@localhost> <83f1f2ed-b475-a73a-74b5-92a0de576d07@nostrum.com> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable X-Priority: 3 Importance: Medium X-Mailer: Open-Xchange Mailer v7.10.2-Rev11 X-Originating-Client: open-xchange-appsuite Autocrypt: addr=vittorio.bertola@open-xchange.com; prefer-encrypt=mutual; keydata= mQENBFhFR+UBCACfoywFKBRfzasiiR9/6dwY36eLePXcdScumDMR8qoXvRS55QYDjp5bs+yMq41qWV9 xp/cqryY9jnvHbeF3TsE5yEazpD1dleRbkpElUBpPwXqkrSP8uXO9KkS9KoX6gdml6M4L+F82WpqYC1 uTzOE6HPmhmQ4cGSgoia2jolxAhRpzoYN99/BwpvoZeTSLP5K6yPlMPYkMev/uZlAkMMhelli9IN6yA yxcC0AeHSnOAcNKUr13yXyMlTyi1cdMJ4sk88zIbefxwg3PAtYjkz3wgvP96cNVwAgSt4+j/ZuVaENP pgVuM512m051j9SlspWDHtzrci5pBKKFsibnTelrABEBAAG0NUJlcnRvbGEsIFZpdHRvcmlvIDx2aXR 0b3Jpby5iZXJ0b2xhQG9wZW4teGNoYW5nZS5jb20+iQFABBMBAgAqBAsJCAcGFQoJCAsCBRYCAwEAAp 4BAhsDBYkSzAMABQMAAAAABYJYRUflAAoJEIU2cHmzj8qNaG0H/ROY+suCP86hoN+9RIV66Ej8b3sb8 UgwFJOJMupZfeb9yTIJwE4VQT5lTt146CcJJ5jvxD6FZn1Htw9y4/45pPAF7xLE066jg3OqRvzeWRZ3 IDUfJJIiM5YGk1xWxDqppSwhnKcMOuI72iioWxX0nGQrWxpnWJsjt08IEEwuYucDkul1PHsrLJbTd58 fiMKLVwag+IE1SPHOwkPF6arZQZIfB5ThtOZV+36Jn8Hok9XfeXWBVyPkiWCQYVX39QsIbr0JNR9kQy 4g2ZFexOcTe8Jo12jPRL7V8OqStdDes3cje9lWFLnX05nrfLuE0l0JKWEg8akN+McFXc+oV68h7nu5A Q0EWEVH5QEIAIDKanNBe1uRfk8AjLirflZO291VNkOAeUu+dIhecGnZeQW6htlDinlYOnXhtsY1mK9W PUu+xshDq7lXn2G0LxldYwyJYZaJtDgIKqVqwxfA34Lj27oqPuXwcvGhdCgt0SW/YcalRdAi0/AzUCu 5GSaj2kaGUSnBYYUP4szGJXjaK2psP5toQSCtx2pfSXQ6MaqPK9Zzy+D5xc6VWQRp/iRImodAcPf8fg JJvRyJ8Jla3lKWyvBBzJDg6MOf6Fts78bJSt23X0uPp93g7GgbYkuRMnFI4RGoTVkxjD/HBEJ0CNg22 hoHJondhmKnZVrHEluFuSnW0wBEIYomcPSPB+cAEQEAAYkBMQQYAQIAGwUCWEVH5QIbDAQLCQgHBhUK CQgLAgUJEswDAAAKCRCFNnB5s4/KjdO8B/wNpvWtOpLdotR/Xh4fu08Fd63nnNfbIGIETWsVi0Sbr8i E5duuGaaWIcMmUvgKe/BM0Fpj9X01Zjm90uoPrlVVuQWrf+vFlbalUYVZr51gl5UyUFHk+iAZCAA0WB rsmACKvuV1P7GuiX3UV9b59T9taYJxN3dNFuftrEuvsqHimFtlekUjUwoCekTJdncFusBhwz2OrKhHr WWrEsXkfh0+pURWYAlKlTxvXuI7gAfHEQM+6OnrWvXYtlhd0M1sBPnCjbyG63Qws7Rek9bEWKtH6dA6 dmT2FQT+g1S9Mdf0WkPTQNX0x24dm8IoHuD3KYwX7Svx43Xa17aZnXqUjtj1 Archived-At: X-Mailman-Approved-At: Tue, 27 Aug 2019 07:59:42 -0700 Subject: Re: [Add] A thought -- Move the policy decisions outside the application. X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 27 Aug 2019 09:13:01 -0000 > Il 26 agosto 2019 19:55 Adam Roach ha scritto: >=20 > Since you're citing Mozilla's TRR policy directly, I'd like to clarify=20 > that the policy you refer to states that "Resolvers may block or filter= =20 > content with the user=E2=80=99s explicit consent." It also allows for blo= cking=20 > as "specifically required by law in the jurisdiction in which the=20 > resolver operates." May I ask how do you plan to reconcile this latter clause with the objectiv= e of providing uncensored web access in countries where the law requires In= ternet censoring for political reasons? Will you have a list of countries w= here even law-mandated blocking would not be allowed to TRRs? Or will you n= ot accept TRRs from those countries? Will it be a case-by-case evaluation f= or each TRR?=20 --=20 =20 Vittorio Bertola | Head of Policy & Innovation, Open-Xchange vittorio.bertola@open-xchange.com=20 Office @ Via Treviso 12, 10144 Torino, Italy From nobody Tue Aug 27 11:20:25 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 33FBC120077 for ; Tue, 27 Aug 2019 09:41:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.199 X-Spam-Level: X-Spam-Status: No, score=-4.199 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id U7dKO4QMVJYe for ; Tue, 27 Aug 2019 09:41:34 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [209.87.249.19]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 49897120045 for ; Tue, 27 Aug 2019 09:41:33 -0700 (PDT) Received: from sandelman.ca (obiwan.sandelman.ca [209.87.249.21]) by tuna.sandelman.ca (Postfix) with ESMTP id 4311A3818E; Tue, 27 Aug 2019 12:40:25 -0400 (EDT) Received: from localhost (localhost [IPv6:::1]) by sandelman.ca (Postfix) with ESMTP id DBC5989; Tue, 27 Aug 2019 12:41:32 -0400 (EDT) From: Michael Richardson To: Paul Wouters cc: "add\@ietf.org" In-Reply-To: References: <1444D5E7-DEA7-437C-B12B-6C31FEA563DD@sky.uk> <11f9dfe2-ab05-2227-7643-e53da95ec717@nostrum.com> <18798.1566571840@dooku.sandelman.ca> <15520.1566839640@localhost> X-Mailer: MH-E 8.6; nmh 1.7+dev; GNU Emacs 24.5.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: X-Mailman-Approved-At: Tue, 27 Aug 2019 11:20:24 -0700 Subject: Re: [Add] A thought -- Move the policy decisions outside the application. X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 27 Aug 2019 16:41:36 -0000 --=-=-= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Paul Wouters wrote: > On Mon, 26 Aug 2019, Michael Richardson wrote: >> > That's being worked on for a couple of years now: > >> https://datatracker.ietf.org/doc/draft-ietf-dnsop-extended-error/ >>=20 >> > I generally think we should focus on the ability to pass such > >> information inside the DNS protocol.=C2=A0 Pushing operating system = APIs to >> > some direction seems way much harder, and the in-DNS path sometimes >> > provides additional advantages (e.g. for forwarding in this case). >>=20 >> Ted (or was it Paul?) also mentioned that there was an effort to be >> able to return positive DNSSEC validation, while also saying that the >> name has been censored. I haven't understood that proposal well. > It was my idea to change RPZ to allow it to function with DNSSEC, > without losing the ability to detect malicious censorship from opted-= in > censorship. > The idea is that if the good guy filters, it moves the Answer Section > data to the Authoritative Section. Current clients will thus be Is this in a draft yet? > This should faciliate Enterprise or Parental censorship while > preventing nation state abuse. Of course nation states can filter the > answer and omit all the data, but then you get a DNSSEC validation > error to confirm to the enduser that they are being censored (the best > you can do with a nationstate absolute filter in your path) The question is whether or not the nation states would agree that this is enough. =2D-=20 Michael Richardson , Sandelman Software Works -=3D IPv6 IoT consulting =3D- --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAl1lXTwACgkQgItw+93Q 3WVe5Qf+P9Sy2jI3VOIuyeef3X7DsFyg3TSHDOfKCfjWSUbuP6m6xzQWb7K3twI3 kF6p5MXRcXnVxBeMiJ/phpAbWDGstZmFOEWG5he6Yrq2rU7RF7hhzNYcF86CGdNs txpfkCsg+TY733dZJEYoe/z5a6Mn33KL4PKqzkdBEvUcw1atipQiDa1A6dnA2HKj ANEkLXe5hJnznVgPKBbr+Ji6q9XgIJCwvqq+nYB0a8X5/cYGpBw2D0tiho9qEjUO 4VELrV061miAvyTD+FZP6bbZRBSNhXwSA5A3eUkuDstWxSDNniMjAyYBcHsBHJuM It0xTme5s1QDcMjcmlcb2fFhGaiF7w== =vX0o -----END PGP SIGNATURE----- --=-=-=-- From nobody Wed Aug 28 06:29:37 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6C267120827 for ; Tue, 27 Aug 2019 12:25:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.978 X-Spam-Level: X-Spam-Status: No, score=-1.978 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, T_SPF_HELO_PERMERROR=0.01, T_SPF_PERMERROR=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nostrum.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xBPyZ3GDvPD3 for ; Tue, 27 Aug 2019 12:25:41 -0700 (PDT) Received: from nostrum.com (raven-v6.nostrum.com [IPv6:2001:470:d:1130::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A9673120236 for ; Tue, 27 Aug 2019 12:25:41 -0700 (PDT) Received: from MacBook-Pro.roach.at (99-152-146-228.lightspeed.dllstx.sbcglobal.net [99.152.146.228]) (authenticated bits=0) by nostrum.com (8.15.2/8.15.2) with ESMTPSA id x7RJPcsr053923 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NO); Tue, 27 Aug 2019 14:25:40 -0500 (CDT) (envelope-from adam@nostrum.com) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=nostrum.com; s=default; t=1566933941; bh=21rxaSLNZW1FKPFylyn8fLRZqf6D3Ar0I1tYNWvmPOA=; h=Subject:To:Cc:References:From:Date:In-Reply-To; b=NhuQxbN2HnF4eWU/Sdk3L/qr7L+ntV/2umSfwrxXrV+6geKKUgBcmzryrqT0F/xgu +koNg9TRC+3zwcLjxBfQ8JQ6BxMOy1A8P4wyLdZcSLYCFBZZ8IgqhwyIoiUuIoQZA4 S/9nF4zwrbwhRk/rRF+t9w0ljlSPYfoYwzuwZhiU= X-Authentication-Warning: raven.nostrum.com: Host 99-152-146-228.lightspeed.dllstx.sbcglobal.net [99.152.146.228] claimed to be MacBook-Pro.roach.at To: Michael Richardson Cc: "add@ietf.org" References: <1444D5E7-DEA7-437C-B12B-6C31FEA563DD@sky.uk> <11f9dfe2-ab05-2227-7643-e53da95ec717@nostrum.com> <18798.1566571840@dooku.sandelman.ca> <15520.1566839640@localhost> <83f1f2ed-b475-a73a-74b5-92a0de576d07@nostrum.com> <32085.1566930684@localhost> From: Adam Roach Message-ID: <22e9b6ba-f2c9-6743-d1fc-897825761e91@nostrum.com> Date: Tue, 27 Aug 2019 14:25:33 -0500 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: <32085.1566930684@localhost> Content-Type: multipart/alternative; boundary="------------BDFEC1CF1E6FFD07A7BA1805" Content-Language: en-US Archived-At: X-Mailman-Approved-At: Wed, 28 Aug 2019 06:29:36 -0700 Subject: Re: [Add] A thought -- Move the policy decisions outside the application. X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 27 Aug 2019 19:25:44 -0000 This is a multi-part message in MIME format. --------------BDFEC1CF1E6FFD07A7BA1805 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit On 8/27/19 1:31 PM, Michael Richardson wrote: > > You may already know both of these things, but people reading your > > message without reading the actual policy might have inferred > > incorrectly that neither clause exists. > > Thank you for clarifying this. > > BUT: Do you agree with my *technical* point that we need a way to communicate the > policy to the end user, so that there can be informed consent? > I think the means by which such policy information is conveyed to the user remains an open question for now. I'll note that there are a few different attempts to get policies -- both human-readable and machine-readable -- published on /.well-known/ endpoints: * Machine-readable DNT policies can be published under , which is itself a refinement of EFF's human-readable proposal described at * Email STS policies can be published as per * There's an (unregistered) effort to publish a set of URLs (some pointing to machine-processable content, others to human-readable content) that defined policy and related things for reporting security vulnerabilities at . * The format defined in leverages the link-relation registry to allow inclusion of site policy documents (e.g., copyright licensing terms and privacy-policy). I presume that you have something like this in mind? /a --------------BDFEC1CF1E6FFD07A7BA1805 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 7bit
On 8/27/19 1:31 PM, Michael Richardson wrote:
    > You may already know both of these things, but people reading your
    > message without reading the actual policy might have inferred
    > incorrectly that neither clause exists.

Thank you for clarifying this.

BUT: Do you agree with my *technical* point that we need a way to communicate the
     policy to the end user, so that there can be informed consent?


I think the means by which such policy information is conveyed to the user remains an open question for now. I'll note that there are a few different attempts to get policies -- both human-readable and machine-readable -- published on /.well-known/ endpoints:

I presume that you have something like this in mind?

/a

--------------BDFEC1CF1E6FFD07A7BA1805-- From nobody Wed Aug 28 06:30:02 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6BA6A120861 for ; Tue, 27 Aug 2019 11:31:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.199 X-Spam-Level: X-Spam-Status: No, score=-4.199 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9wPZyFoGPAt7 for ; Tue, 27 Aug 2019 11:31:25 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [209.87.249.19]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3F9B5120133 for ; Tue, 27 Aug 2019 11:31:25 -0700 (PDT) Received: from sandelman.ca (obiwan.sandelman.ca [209.87.249.21]) by tuna.sandelman.ca (Postfix) with ESMTP id B48F33818D; Tue, 27 Aug 2019 14:30:16 -0400 (EDT) Received: from localhost (localhost [IPv6:::1]) by sandelman.ca (Postfix) with ESMTP id 71C4789; Tue, 27 Aug 2019 14:31:24 -0400 (EDT) From: Michael Richardson To: Adam Roach cc: "add\@ietf.org" In-Reply-To: <83f1f2ed-b475-a73a-74b5-92a0de576d07@nostrum.com> References: <1444D5E7-DEA7-437C-B12B-6C31FEA563DD@sky.uk> <11f9dfe2-ab05-2227-7643-e53da95ec717@nostrum.com> <18798.1566571840@dooku.sandelman.ca> <15520.1566839640@localhost> <83f1f2ed-b475-a73a-74b5-92a0de576d07@nostrum.com> X-Mailer: MH-E 8.6; nmh 1.7+dev; GNU Emacs 24.5.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: X-Mailman-Approved-At: Wed, 28 Aug 2019 06:30:01 -0700 Subject: Re: [Add] A thought -- Move the policy decisions outside the application. X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 27 Aug 2019 18:31:27 -0000 --=-=-= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Adam Roach wrote: >> b) there is conversely, significant interest in making browsing >> private, specifically to enable open and free access to all web site= s. >> The Mozilla approval list is unlikely to scale *geopolitically*, and >> there are many (IETF "objectively") freedom-loving entities that will >> be unable (legally) to comply to the requirements listed, but which >> end users and end-network administrators (i.e: "parents", "teachers") >> will find have value. It is important that it is possible to >> communicate the privacy policy to users. > Since you're citing Mozilla's TRR policy directly, I'd like to clarify > that the policy you refer to states that "Resolvers may block or filt= er > content with the user=E2=80=99s explicit consent." It also allows for= blocking > as "specifically required by law in the jurisdiction in which the > resolver operates." I understood that the TRR requires the resolvers to publish their block lis= t, but that the list in many countries is very very carefully kept confidentia= l. > You may already know both of these things, but people reading your > message without reading the actual policy might have inferred > incorrectly that neither clause exists. Thank you for clarifying this. BUT: Do you agree with my *technical* point that we need a way to communica= te the policy to the end user, so that there can be informed consent? =2D-=20 ] Never tell me the odds! | ipv6 mesh network= s [ ] Michael Richardson, Sandelman Software Works | IoT architect = [ ] mcr@sandelman.ca http://www.sandelman.ca/ | ruby on rails = [ --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAl1ldvwACgkQgItw+93Q 3WVMtQf+NPgnauAezLPbMmhJ8s95rAEgyXb6GnAoy8prKTVZm4CbNHiYng3SsOyN SYfCOZJF2s2PGmMC1skORrpodUlxMxD9l2MZMocpC3B38EQvdS+PmmNQzMt5RBkF CQmoQ/OoeUzi9Uhbt1t6qvQVVRx+UBY3Vca/mVsDa0r5ywni2P6PvlTNl6Xv3BVc EiD4lfEuJeNTN2iyrCJye+AydQO7ItmsyphawwbC+BSVX3fK4JTLr69dBHw3p1uZ x75oIMk3yMAIMwWdnMIXA39IRvHMf+awNiv3qmFuWXsKiDKiO0EmDdKToxdgXUIe UEoh2plBJNSqdFIqqkytKjAkUFVX9w== =VRm7 -----END PGP SIGNATURE----- --=-=-=-- From nobody Wed Aug 28 06:30:51 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8AA511200C1 for ; Tue, 27 Aug 2019 18:26:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=mnot.net header.b=lSfLQgdM; dkim=pass (2048-bit key) header.d=messagingengine.com header.b=IYWpVazF Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vyY1vPHyxb8x for ; Tue, 27 Aug 2019 18:26:57 -0700 (PDT) Received: from wout4-smtp.messagingengine.com (wout4-smtp.messagingengine.com [64.147.123.20]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C8A1D12081D for ; Tue, 27 Aug 2019 18:26:57 -0700 (PDT) Received: from compute3.internal (compute3.nyi.internal [10.202.2.43]) by mailout.west.internal (Postfix) with ESMTP id 076A54FA; Tue, 27 Aug 2019 21:26:56 -0400 (EDT) Received: from mailfrontend1 ([10.202.2.162]) by compute3.internal (MEProxy); Tue, 27 Aug 2019 21:26:57 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mnot.net; h= content-type:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; s=fm3; bh=M fetFtmDJdISpUTjXNm63Cc8z+kfNGfssnlpAG1l/O8=; b=lSfLQgdMotVSfljo1 +8YCRwW+IZTOnP5CGn5flwHtPhxKy5FyYnBCGfFCiVmrpX7/g+YPKxFOROo7aP3l wiCphcxVH3huYMpsa7FtPwd6ohZKQxjEflXrdXQDJ7P9B6lecy2WdWy3vW2uyM4s OH208Y2TgVW6RRkUWZiOSwpmMk7WP6NBFadH5GN69zYnx778j28+BGYlBzQA8ZkV G7OFa0CfB3QeBbLvM31nwVfW8rzvOdOS6MDfEMkDuJnqtvegqG+PC/ZAejcu/phf szotYN8uxBr+NJ4en2NtpUiwIb3o4uBx7E+2piSnXCFQHa+A9/JrIKxZmfn+8Gkn f8YUw== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:content-transfer-encoding:content-type :date:from:in-reply-to:message-id:mime-version:references :subject:to:x-me-proxy:x-me-proxy:x-me-sender:x-me-sender :x-sasl-enc; s=fm3; bh=MfetFtmDJdISpUTjXNm63Cc8z+kfNGfssnlpAG1l/ O8=; b=IYWpVazF1r+rLszIFWatmwx7ynVcP17Yt3VrWTZ+Z4VkUcpHuhbFsc5cB KRKs34OgiYuNbgpo6GRPVcVDMxhQbWEPhFqul3B27YNIhlb8S1V7tHBEesNC5lCJ zWp/PQOfc0fpHrAKqtF3AOErufBvpwzDUIB40uKsIatwaI8rLRuTIkkyfqgrAnRZ lmhSWXK8/86LsM303eVZWJe7NgejxtCNwHoq6ZfFn5N+OrWz1t2M9izN2LbrerTf kTa1mSnGEpaMmwF5iH/CnUqKlVTe4zdjl3sY5GzoqFnhcm3tnl2ho4J3P73zzdbS ckGOhaifPZTj6MJt4nMhXMgGR/HTA== X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeduvddrudehledggeeiucetufdoteggodetrfdotf fvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdfqfgfvpdfurfetoffkrfgpnffqhgen uceurghilhhouhhtmecufedttdenucesvcftvggtihhpihgvnhhtshculddquddttddmne cujfgurheptggguffhrfgjfffgkfhfvffosehtqhhmtdhhtddvnecuhfhrohhmpeforghr khcupfhothhtihhnghhhrghmuceomhhnohhtsehmnhhothdrnhgvtheqnecuffhomhgrih hnpehivghtfhdrohhrghdpmhhnohhtrdhnvghtnecukfhppeegledrvdehhedrudelledr udehtdenucfrrghrrghmpehmrghilhhfrhhomhepmhhnohhtsehmnhhothdrnhgvthenuc evlhhushhtvghrufhiiigvpedt X-ME-Proxy: Received: from [172.16.8.215] (unknown [49.255.199.150]) by mail.messagingengine.com (Postfix) with ESMTPA id 83BF78005C; Tue, 27 Aug 2019 21:26:54 -0400 (EDT) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) From: Mark Nottingham X-Priority: 3 In-Reply-To: <1098628263.7014.1566896822696@appsuite-gw2.open-xchange.com> Date: Wed, 28 Aug 2019 11:26:51 +1000 Cc: Ted Lemon , "add@ietf.org" Content-Transfer-Encoding: quoted-printable Message-Id: <3B94868F-435F-4C8F-986D-C5F71D3E80AA@mnot.net> References: <1444D5E7-DEA7-437C-B12B-6C31FEA563DD@sky.uk> <11f9dfe2-ab05-2227-7643-e53da95ec717@nostrum.com> <18798.1566571840@dooku.sandelman.ca> <15520.1566839640@localhost> <1098628263.7014.1566896822696@appsuite-gw2.open-xchange.com> To: Vittorio Bertola X-Mailer: Apple Mail (2.3445.104.11) Archived-At: X-Mailman-Approved-At: Wed, 28 Aug 2019 06:30:50 -0700 Subject: Re: [Add] Communicating DNS blocks (was Re: A thought -- Move the policy decisions outside the application.) X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 28 Aug 2019 01:26:59 -0000 Hi Vittorio, > On 27 Aug 2019, at 7:07 pm, Vittorio Bertola = wrote: >=20 > For example, rather than having to alter the response (and break = DNSSEC) to redirect the user to a meaningful explanation page, a = filtering resolver could just return the "blocked" or "censored" error = code and add the altered IP address / explanation URL somewhere in an = extra field - the "extra-text" of Warren's draft or something more = specific - which the client could then use to show the resolver's = message to the user. This would require client support, while old = clients would just get the error rather than the altered response, so = we'd have to think whether this could actually work in all use cases, = but still, once widely implemented, this would provide a cleaner = architecture and a better user experience in the basic "web filter" = cases.=20 Similar things have been proposed in the past, at other layers; e.g.,=20 = https://www.ietf.org/archive/id/draft-nottingham-proxy-explanation-00.txt There's a bigger issue than figuring out how to make it = backwards-compatible. Without trying to speak for them, the impression I = got is that the browser vendors are less than enthusiastic about = exposing untrusted content to users, even if it's heavily constrained = (as is the case in the proposal above), as it's a potential attack = vector.=20 While technical people (like those on this list) might be able to = interpret such a message safely and productively, many users of the = Internet don't have that skill; for similar reasons, browsers have = substantially changed the user experience of security for TLS over the = last few years, and are continuing to do so, so that it's "safe by = default", even in the face of user ignorance / apathy.=20 Cheers, -- Mark Nottingham https://www.mnot.net/ From nobody Thu Aug 29 08:21:14 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9DDF312002F for ; Thu, 29 Aug 2019 02:40:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=open-xchange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CD04LyIQiuzz for ; Thu, 29 Aug 2019 02:40:00 -0700 (PDT) Received: from mx4.open-xchange.com (alcatraz.open-xchange.com [87.191.39.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3E4751200A4 for ; Thu, 29 Aug 2019 02:40:00 -0700 (PDT) Received: from open-xchange.com (imap.open-xchange.com [10.20.30.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx4.open-xchange.com (Postfix) with ESMTPS id 5D11D6A298; Thu, 29 Aug 2019 11:39:58 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=open-xchange.com; s=201705; t=1567071598; bh=MZs/WFvZC4YLEJDalL/S2grn4zPtqUHxtMySZaSA5us=; h=Date:From:Reply-To:To:Cc:In-Reply-To:References:Subject:From; b=CGSCLoyr4QDD+G1W8TW0hKHyifwkikML6mnlsrXRmIYM0MTx6lEqLlC1OFx/NuKD3 V5CoJY39Ad0Skx+IYtYcqUwPvea5TuQrAP+6/daZr6n7wbZejsRhF8GCIXWpBSsNxg P6Rf5VDocno9JhYHGjY5J7s6QeM+s2wiasc4+khnAuKhKny9tBwYM15vViIfrilSIK wLg/WzoGSccZQw3h0Pnx+Bhef3Bg8HoZmfOKWK3i31ZMNSafhRPt4NipEggbZIBs1e GYBG+eSRb7SK782/D6PxYqhZ67ZqsKtq9COdoSvLmIxucobXj0WPorvgLnTFacRgnG bw4LLZVn2mOtA== Received: from appsuite-gw1.open-xchange.com (appsuite-gw1.open-xchange.com [10.20.28.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by open-xchange.com (Postfix) with ESMTPSA id 50CB93C0434; Thu, 29 Aug 2019 11:39:58 +0200 (CEST) Date: Thu, 29 Aug 2019 11:39:58 +0200 (CEST) From: Vittorio Bertola Reply-To: Vittorio Bertola To: Mark Nottingham Cc: "add@ietf.org" Message-ID: <1110168181.927.1567071598280@appsuite-gw1.open-xchange.com> In-Reply-To: <3B94868F-435F-4C8F-986D-C5F71D3E80AA@mnot.net> References: <1444D5E7-DEA7-437C-B12B-6C31FEA563DD@sky.uk> <11f9dfe2-ab05-2227-7643-e53da95ec717@nostrum.com> <18798.1566571840@dooku.sandelman.ca> <15520.1566839640@localhost> <1098628263.7014.1566896822696@appsuite-gw2.open-xchange.com> <3B94868F-435F-4C8F-986D-C5F71D3E80AA@mnot.net> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Priority: 3 Importance: Medium X-Mailer: Open-Xchange Mailer v7.10.2-Rev11 X-Originating-Client: open-xchange-appsuite Autocrypt: addr=vittorio.bertola@open-xchange.com; prefer-encrypt=mutual; keydata= mQENBFhFR+UBCACfoywFKBRfzasiiR9/6dwY36eLePXcdScumDMR8qoXvRS55QYDjp5bs+yMq41qWV9 xp/cqryY9jnvHbeF3TsE5yEazpD1dleRbkpElUBpPwXqkrSP8uXO9KkS9KoX6gdml6M4L+F82WpqYC1 uTzOE6HPmhmQ4cGSgoia2jolxAhRpzoYN99/BwpvoZeTSLP5K6yPlMPYkMev/uZlAkMMhelli9IN6yA yxcC0AeHSnOAcNKUr13yXyMlTyi1cdMJ4sk88zIbefxwg3PAtYjkz3wgvP96cNVwAgSt4+j/ZuVaENP pgVuM512m051j9SlspWDHtzrci5pBKKFsibnTelrABEBAAG0NUJlcnRvbGEsIFZpdHRvcmlvIDx2aXR 0b3Jpby5iZXJ0b2xhQG9wZW4teGNoYW5nZS5jb20+iQFABBMBAgAqBAsJCAcGFQoJCAsCBRYCAwEAAp 4BAhsDBYkSzAMABQMAAAAABYJYRUflAAoJEIU2cHmzj8qNaG0H/ROY+suCP86hoN+9RIV66Ej8b3sb8 UgwFJOJMupZfeb9yTIJwE4VQT5lTt146CcJJ5jvxD6FZn1Htw9y4/45pPAF7xLE066jg3OqRvzeWRZ3 IDUfJJIiM5YGk1xWxDqppSwhnKcMOuI72iioWxX0nGQrWxpnWJsjt08IEEwuYucDkul1PHsrLJbTd58 fiMKLVwag+IE1SPHOwkPF6arZQZIfB5ThtOZV+36Jn8Hok9XfeXWBVyPkiWCQYVX39QsIbr0JNR9kQy 4g2ZFexOcTe8Jo12jPRL7V8OqStdDes3cje9lWFLnX05nrfLuE0l0JKWEg8akN+McFXc+oV68h7nu5A Q0EWEVH5QEIAIDKanNBe1uRfk8AjLirflZO291VNkOAeUu+dIhecGnZeQW6htlDinlYOnXhtsY1mK9W PUu+xshDq7lXn2G0LxldYwyJYZaJtDgIKqVqwxfA34Lj27oqPuXwcvGhdCgt0SW/YcalRdAi0/AzUCu 5GSaj2kaGUSnBYYUP4szGJXjaK2psP5toQSCtx2pfSXQ6MaqPK9Zzy+D5xc6VWQRp/iRImodAcPf8fg JJvRyJ8Jla3lKWyvBBzJDg6MOf6Fts78bJSt23X0uPp93g7GgbYkuRMnFI4RGoTVkxjD/HBEJ0CNg22 hoHJondhmKnZVrHEluFuSnW0wBEIYomcPSPB+cAEQEAAYkBMQQYAQIAGwUCWEVH5QIbDAQLCQgHBhUK CQgLAgUJEswDAAAKCRCFNnB5s4/KjdO8B/wNpvWtOpLdotR/Xh4fu08Fd63nnNfbIGIETWsVi0Sbr8i E5duuGaaWIcMmUvgKe/BM0Fpj9X01Zjm90uoPrlVVuQWrf+vFlbalUYVZr51gl5UyUFHk+iAZCAA0WB rsmACKvuV1P7GuiX3UV9b59T9taYJxN3dNFuftrEuvsqHimFtlekUjUwoCekTJdncFusBhwz2OrKhHr WWrEsXkfh0+pURWYAlKlTxvXuI7gAfHEQM+6OnrWvXYtlhd0M1sBPnCjbyG63Qws7Rek9bEWKtH6dA6 dmT2FQT+g1S9Mdf0WkPTQNX0x24dm8IoHuD3KYwX7Svx43Xa17aZnXqUjtj1 Archived-At: X-Mailman-Approved-At: Thu, 29 Aug 2019 08:21:07 -0700 Subject: Re: [Add] Communicating DNS blocks (was Re: A thought -- Move the policy decisions outside the application.) X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 29 Aug 2019 09:40:03 -0000 > Il 28 agosto 2019 03:26 Mark Nottingham ha scritto: > > Similar things have been proposed in the past, at other layers; e.g., > https://www.ietf.org/archive/id/draft-nottingham-proxy-explanation-00.txt > > There's a bigger issue than figuring out how to make it backwards-compatible. Without trying to speak for them, the impression I got is that the browser vendors are less than enthusiastic about exposing untrusted content to users, even if it's heavily constrained (as is the case in the proposal above), as it's a potential attack vector. Thanks for sharing this. It prompted some thoughts on what kind of untrusted content could come this way, as I assume that we could authenticate the resolver and keep the channel secure, and even require EV certificates so that the user could know who is sending the message on the landing page. I do see risks if you are using an untrusted resolver: for example, the resolver could reply to a request for www.mybank.example with a "blocked" error and a redirection to a phishing page. However, how is this different from an untrusted resolver today, without those extensions? It could already reply with the IP of a phishing page and even claim that it's been DNSSEC-validated. On the other hand, this kind of enhanced user experience could also be a driver for resolvers to adopt encryption and authentication and get into a "trusted resolver" status (however ascertained). -- Vittorio Bertola | Head of Policy & Innovation, Open-Xchange vittorio.bertola@open-xchange.com | +39 348 7015022 Office @ Via Treviso 12, 10144 Torino, Italy From nobody Thu Aug 29 08:22:17 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6A44F1200B2 for ; Wed, 28 Aug 2019 10:42:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.75 X-Spam-Level: X-Spam-Status: No, score=-1.75 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.249, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1536-bit key) header.d=iecc.com header.b=XXYATan1; dkim=pass (1536-bit key) header.d=taugh.com header.b=KxhjRqg+ Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fzeTFEgZt5ip for ; Wed, 28 Aug 2019 10:42:22 -0700 (PDT) Received: from gal.iecc.com (gal.iecc.com [IPv6:2001:470:1f07:1126:0:43:6f73:7461]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DDD1B120059 for ; Wed, 28 Aug 2019 10:42:21 -0700 (PDT) Received: (qmail 21108 invoked from network); 28 Aug 2019 17:42:20 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=iecc.com; h=date:message-id:from:to:cc:subject:in-reply-to:mime-version:content-type:content-transfer-encoding; s=5271.5d66bcfc.k1908; i=printer-iecc.com@submit.iecc.com; bh=VYRXcflj1/sFrTE0cUKD4W3jjcgN/uTv5akMq3vsUI4=; b=XXYATan1qpmf12dSxEHtKe5LgXvJk23Uwm6dNllaGPZ4mXXHV+vecyfkZyhdostgErCPYqBtsxEebCphGG9dsV1XFL6xlXVy0DBLXDwJ+s4tlhlZr9mvAvQtCD2xqNEPnojbf7Wzp1HsF28Wf8a1aCZ+DWrhGcNw8ms++ga7FTEL/mD+gZwerCnhJIg9C1KLi3nWfdZdwoyUB6TbB4uIqIx3n+0HOYamaWfy9MVlj2mOl7gChrvW+48YMq84K7iu DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=taugh.com; h=date:message-id:from:to:cc:subject:in-reply-to:mime-version:content-type:content-transfer-encoding; s=5271.5d66bcfc.k1908; olt=printer-iecc.com@submit.iecc.com; bh=VYRXcflj1/sFrTE0cUKD4W3jjcgN/uTv5akMq3vsUI4=; b=KxhjRqg+/RqfVujVHGSTU7U8JHCsvm+idan6BlHPvJfNwNk/F1/ydq+Lb9yWtgHHnaVWfjFSFgWWFMOPCX4UXCkWJynsyq65lnMZ90U9IoZDRm5K6zq0gkZP6VrHlhzuSVm549ZaYEoF7iS4pV4fylJOR+5X2tsjXY/Ah01YFG6L2HDisszsAkLtDW9A8enFG/NP7nj6JX59VoHPbAOhqFnysVw9PbtLvjaIoG5RJbBx6zHbG/qWRmBQzRyy0gIH Received: from ary.qy ([64.246.232.221]) by imap.iecc.com ([64.57.183.75]) with ESMTPSA (TLS1.2 ECDHE-RSA AES-256-GCM AEAD, printer@iecc.com) via TCP; 28 Aug 2019 17:42:19 -0000 Received: by ary.qy (Postfix, from userid 501) id 868DC8C67BB; Wed, 28 Aug 2019 13:42:19 -0400 (EDT) Date: 28 Aug 2019 13:42:19 -0400 Message-Id: <20190828174219.868DC8C67BB@ary.qy> From: "John Levine" To: add@ietf.org Cc: vittorio.bertola@open-xchange.com In-Reply-To: <493815238.7079.1566897175778@appsuite-gw2.open-xchange.com> Organization: Taughannock Networks X-Headerized: yes Mime-Version: 1.0 Content-type: text/plain; charset=utf-8 Content-transfer-encoding: 8bit Archived-At: X-Mailman-Approved-At: Thu, 29 Aug 2019 08:22:15 -0700 Subject: Re: [Add] policy and law, A thought -- Move the policy decisions outside the application. X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 28 Aug 2019 17:42:24 -0000 In article <493815238.7079.1566897175778@appsuite-gw2.open-xchange.com> you write: >May I ask how do you plan to reconcile this latter clause with the objective of providing uncensored web access in countries where the law requires Internet censoring for political reasons? In the UK the law effectively requires filtering of child abuse material. In parts of Canada, it requires filtering illegal offshore gambling sites. These are implemented partly or entirely as DNS filters. I am sure that Mozilla do not think of themselves as advocates of pedophilia or money laundering, or advocates of botnets and malware on networks with RPZ security filters in the resolver. But when they encourage users to use their "trusted" DNS rather than the default, that's what they're doing. Until we can admit this is a big problem, and we can't wave our hands and say "censorship" and make it go away, we're not going to make any progress. R's, John From nobody Thu Aug 29 16:44:24 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D43401209A8 for ; Thu, 29 Aug 2019 09:54:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7gEbBfFkWxS9 for ; Thu, 29 Aug 2019 09:54:12 -0700 (PDT) Received: from mail-ed1-x532.google.com (mail-ed1-x532.google.com [IPv6:2a00:1450:4864:20::532]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EBD9A1200B8 for ; Thu, 29 Aug 2019 09:54:11 -0700 (PDT) Received: by mail-ed1-x532.google.com with SMTP id z51so4745644edz.13 for ; Thu, 29 Aug 2019 09:54:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=uqFNtupTeFUcKn8Q1gY7pZa/iqmYqBL6Z7Q3ACsu4Bk=; b=lkap6puQuUl21cewk35LeFmvNfNDUGp8d6nawBRUE0LzndWsrXV0Uk4IHHBGoZu2d0 Rj9Ut9xJu+dpEFXjMOvuAg+9TVs3fWVm+U0ToFL/NRCzj0ql5kIyKy/ScUweyCWm/c5g DgJETqYsZXGoJVtZvzYWlofrBg8vwWAOBCM4p81Cyjj4nBY06yMa7EV7/XHTMxHXh6I0 JsWiryVF5dZjP39yLhG6JtFnmTYcGCudzsHq3RLuF1RTidW/CyVIlDUtOxyS7wGGGsGC /c9hn7JvjhbeVOCV6+xLLt7z0YsuUelkmq3BOaRWkWQZb6WHRhav9VVKNI/8ndpkT4PX 7EUg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=uqFNtupTeFUcKn8Q1gY7pZa/iqmYqBL6Z7Q3ACsu4Bk=; b=oOy5R+XDDdA46K6YqUFYv3ywYeYN3Y+zxAQ2nQCotKjnl0cbI0neFTY+CeFVpUBx+D nH0tk7GcyCVtqhkJfSh4DoAfeRNrHw5sIBw81PvXMIAueCYQSUyV6PgH29oel9ZROlqp glf12MKUqNYhECD2iRUwi3oBpeSU8Ahs6vrwrla2LoCe/QX9DMKjpkjmEwmb/eI8GZCN JRKRe68UcxH8Smwtwd1voHZ2YWiuX75jrgRBqaG32XoyjLt++F++DbdBSFe5vpCuw9Bo LxKTxSv0dvdKS2MOTZEd9WC4ut/bn1it3yQoyp6CMd6lMnA2x+a3dHJ9WWiVPb6XiPqA N3SQ== X-Gm-Message-State: APjAAAUnv1GgAEe5XkDU+yoq2AAnrAosci2zOJISY3t/Vwsl9RLzqjOl 6EpsqavPHF/PVWPVL+rFEa8j1j07H64eX9YX0Zs= X-Google-Smtp-Source: APXvYqw8ULdO71B3N9BPqD/flEkXNnsd+y7U3WXIm6/oozp15r2+V8YlsGqUiIwhWkVmyuW6K4im4FaW7B8aA6wgEWw= X-Received: by 2002:a17:906:6448:: with SMTP id l8mr9222474ejn.233.1567097650331; Thu, 29 Aug 2019 09:54:10 -0700 (PDT) MIME-Version: 1.0 References: <493815238.7079.1566897175778@appsuite-gw2.open-xchange.com> <20190828174219.868DC8C67BB@ary.qy> In-Reply-To: <20190828174219.868DC8C67BB@ary.qy> From: Ted Hardie Date: Thu, 29 Aug 2019 09:53:44 -0700 Message-ID: To: John Levine Cc: ADD Mailing list , Vittorio Bertola Content-Type: multipart/alternative; boundary="000000000000c6c7890591445a63" Archived-At: X-Mailman-Approved-At: Thu, 29 Aug 2019 16:44:22 -0700 Subject: Re: [Add] policy and law, A thought -- Move the policy decisions outside the application. X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 29 Aug 2019 16:54:15 -0000 --000000000000c6c7890591445a63 Content-Type: text/plain; charset="UTF-8" Hi John, On Thu, Aug 29, 2019 at 8:22 AM John Levine wrote: > In article <493815238.7079.1566897175778@appsuite-gw2.open-xchange.com> > you write: > >May I ask how do you plan to reconcile this latter clause with the > objective of providing uncensored web access in countries where the law > requires Internet censoring for political reasons? > > In the UK the law effectively requires filtering of child abuse > material. In parts of Canada, it requires filtering illegal offshore > gambling sites. These are implemented partly or entirely as DNS filters. > > I am sure that Mozilla do not think of themselves as advocates of > pedophilia or money laundering, or advocates of botnets and malware on > networks with RPZ security filters in the resolver. But when they > encourage users to use their "trusted" DNS rather than the default, > that's what they're doing. > Obviously, I don't work for Mozilla and do not speak for them. I will say, though, that I don't think this is a fair characterization of their position. At least to me, they seem to be making a very strong effort to increase the confidentiality and tamper resistance of DNS queries flowing between clients and recursive resolvers. That involves moving two parties: those that make the queries and those that respond. They are updating their own client code to accomplish the first. They are working with others to lead by example for the second. They have made very clear that the client configuration is always subject to change by whomever controls the computer, and they have made very clear in the terms of the TRR that a resolver obeying the local laws will be counted as in compliance. They are not blocking access to resolvers that follow those laws, in other words: they are waiting for them to catch up and offer service which is confidential and tamper-resistant. We are in an uncomfortable pause in the development and deployment of these technologies, and I hope we can move forward from here rapidly. But the direction of that move should be, in my personal opinion, along the path that takes us to confidential, tamper-resistant connections being the default substrate between clients and recursive resolvers. Once we are there (or closer to there), discussing how to select a recursive can go back to the usual track of balancing the other optimizations required. I suspect, without a shred of evidence to back it, that this may involve us moving to a state where a client commonly has more than one recurisve resolver to consult, in order to balance split-DNS needs with other optimizations and in order to avoid concentration. That, however, is probably a discussion for a later day. regards, Ted Hardie (as an individual contributor) > > Until we can admit this is a big problem, and we can't wave our hands > and say "censorship" and make it go away, we're not going to make any > progress. > > R's, > John > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --000000000000c6c7890591445a63 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi John,

<= div class=3D"gmail_quote">
On Thu, Aug= 29, 2019 at 8:22 AM John Levine <joh= nl@taugh.com> wrote:
In article <493815238.7079.156689717577= 8@appsuite-gw2.open-xchange.com> you write:
>May I ask how do you plan to reconcile this latter clause with the obje= ctive of providing uncensored web access in countries where the law require= s Internet censoring for political reasons?

In the UK the law effectively requires filtering of child abuse
material.=C2=A0 In parts of Canada, it requires filtering illegal offshore<= br> gambling sites.=C2=A0 These are implemented partly or entirely as DNS filte= rs.

I am sure that Mozilla do not think of themselves as advocates of
pedophilia or money laundering, or advocates of botnets and malware on
networks with RPZ security filters in the resolver.=C2=A0 But when they
encourage users to use their "trusted" DNS rather than the defaul= t,
that's what they're doing.

Obvi= ously, I don't work for Mozilla and do not speak for them.=C2=A0 I will= say, though, that I don't think this is a fair characterization of the= ir position.=C2=A0 At least to me, they seem to be making a very strong eff= ort to increase the confidentiality and tamper resistance of DNS queries fl= owing between clients and recursive resolvers.=C2=A0 That involves moving t= wo parties:=C2=A0 those that make the queries and those that respond.=C2=A0= They are updating their own client code to accomplish the first.=C2=A0 The= y are working with others to lead by example for the second.=C2=A0 They hav= e made very clear that the client configuration is always subject to change= by whomever controls the computer, and they have made very clear in the te= rms of the TRR that a resolver obeying the local laws will be counted as in= compliance.=C2=A0 They are not blocking access to resolvers that follow th= ose laws, in other words:=C2=A0 they are waiting for them to catch up and o= ffer service which is confidential and tamper-resistant.
We are in an uncomfortable pause in the development and deploym= ent of these technologies, and I hope we can move forward from here rapidly= .=C2=A0 But the direction of that move should be, in my personal opinion, a= long the path that takes us to confidential, tamper-resistant connections b= eing the default substrate between clients and recursive resolvers.=C2=A0 O= nce we are there (or closer to there), discussing how to select a recursive= can go back to the usual track of balancing the other optimizations requir= ed.=C2=A0

I suspect, without a shred of evide= nce to back it, that this may involve us moving to a state where a client c= ommonly has more than one recurisve resolver to consult, in order to balanc= e split-DNS needs with other optimizations and in order to avoid concentrat= ion.=C2=A0 That, however, is probably a discussion for a later day.

regards,

Ted Hardie
(a= s an individual contributor)
=C2=A0

Until we can admit this is a big problem, and we can't wave our hands and say "censorship" and make it go away, we're not going to = make any
progress.

R's,
John

--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--000000000000c6c7890591445a63-- From nobody Thu Aug 29 16:44:57 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 25900120803 for ; Thu, 29 Aug 2019 13:36:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.435 X-Spam-Level: X-Spam-Status: No, score=0.435 tagged_above=-999 required=5 tests=[BAYES_05=-0.5, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_SBL_CSS=3.335, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ToOTtUFdeiEg for ; Thu, 29 Aug 2019 13:36:43 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7705212001B for ; Thu, 29 Aug 2019 13:36:43 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id ACFEFBE64; Thu, 29 Aug 2019 21:36:41 +0100 (IST) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 26zhUfZf9Y-R; Thu, 29 Aug 2019 21:36:40 +0100 (IST) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 385A8BE5B; Thu, 29 Aug 2019 21:36:40 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1567111000; bh=HV2f9EdaVyLrBBFrMOruL/JIzttBU8cilrG3rE12bLg=; h=Subject:To:References:From:Date:In-Reply-To:From; b=LdwendERPbnG3T/vjaDu6DfUwih+WlQssqRSobshoJ3/y3eKWDCyAUvmqnT9xUmwp HVNEhqdSpPK+OW5zagqd7XajomndrEr+6p4XPLU403uSxVO6tz2b9HuAgrTKkKNHYm m18TLBMBkhZBL1pAGrDnOnm/3/Hx32TNYRlj6cIo= To: John Levine , add@ietf.org References: <20190828174219.868DC8C67BB@ary.qy> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: <7981858d-1fe8-b6e4-5c06-d3be2628a01f@cs.tcd.ie> Date: Thu, 29 Aug 2019 21:36:39 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: <20190828174219.868DC8C67BB@ary.qy> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="klsJZEOrhT6Ub0VTo1k9Hto36YgPswBou" Archived-At: X-Mailman-Approved-At: Thu, 29 Aug 2019 16:44:56 -0700 Subject: Re: [Add] policy and law, A thought -- Move the policy decisions outside the application. X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 29 Aug 2019 20:36:45 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --klsJZEOrhT6Ub0VTo1k9Hto36YgPswBou Content-Type: multipart/mixed; boundary="SeP8o0pZBUbmhLOq4uCq5kWk6TOCGLYqV"; protected-headers="v1" From: Stephen Farrell To: John Levine , add@ietf.org Message-ID: <7981858d-1fe8-b6e4-5c06-d3be2628a01f@cs.tcd.ie> Subject: Re: [Add] policy and law, A thought -- Move the policy decisions outside the application. References: <20190828174219.868DC8C67BB@ary.qy> In-Reply-To: <20190828174219.868DC8C67BB@ary.qy> --SeP8o0pZBUbmhLOq4uCq5kWk6TOCGLYqV Content-Type: multipart/mixed; boundary="------------2035ADAC94498C9FD6A0D1A0" Content-Language: en-GB This is a multi-part message in MIME format. --------------2035ADAC94498C9FD6A0D1A0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable John, On 28/08/2019 18:42, John Levine wrote: > Until we can admit this is a big problem, and we can't wave our hands > and say "censorship" and make it go away, we're not going to make any > progress. I think that until people discussing this resist the temptation to present totally one-sided perspectives, we are not going to make progress. I think you failed, and failed badly, in resisting that temptation in your mail. And when you go further and claim that "what they're doing" makes them "advocates of pedophilia" - that seems entirely out of order to me. Regards, S. --------------2035ADAC94498C9FD6A0D1A0 Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------2035ADAC94498C9FD6A0D1A0-- --SeP8o0pZBUbmhLOq4uCq5kWk6TOCGLYqV-- --klsJZEOrhT6Ub0VTo1k9Hto36YgPswBou Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAl1oN1cACgkQWrL68XsX K+pB5RAA0L00pyNlUYKiUvwEytrTuVvfgj0BPTt/giSOeLu/xN7fpWdFBQlki2Cp VtNQkpziYrWAcq5drAPkV7GipX90d+JAUEQLIZTccObD7geFocvAhlo3WELism/O qxt0e3owB7H3lY5Dm1yxAOogviXKv7K1/h7q/QSLyeO/PrJO+ApYlp4BPz8H5NdC XAkFDkG3jm+Gicmf7Mxvs2yTU7+xtU4jE1fI3g8mfZrQEx2AzslaEaHh8tz9a3gt WKFmroXN0nJ7c0guM5yPk9W1ZvdAlSaua5k+8aGN7L6/TZobvhPIRik0vX0i6z82 5eJrNI1AkExgNSr8TAAmJ8S73sCqpNQTTTZoXAypdLdbMnXR3epCnBQ9W5QZjX/y n2+a2kR89b3Xa/CeI1WHyULRIV0R6frWHlVRTPkb9azH0J8gu0EYw4gT30Rb+pHQ 8QMTrBcfoWHjp7jM4gWB+bRIkgxmuOaqXK8SQrH58NUi8vOfTtsdH7LhxQpOC+4e rjf3iRnUlbgB+iTTtGVN3egG6tZ13JKIf/vEfYOQbJpC+TkPRpfwRZpOMo283EvD 6CE0LOEE3YKQN9G0w8CsKGtDsnZUKtt676btni9im1i6z52pRwBDw1HVPPPSGjg5 6ZHwDe9krESTozN4k9dQGB/SDAUm4ELyhZcXhRz8UFjQLvXcC5E= =XKyr -----END PGP SIGNATURE----- --klsJZEOrhT6Ub0VTo1k9Hto36YgPswBou-- From nobody Thu Aug 29 16:46:28 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 516DD12091B for ; Thu, 29 Aug 2019 14:26:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cdt.org Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CgnWMWujCloE for ; Thu, 29 Aug 2019 14:25:58 -0700 (PDT) Received: from mail-io1-xd2e.google.com (mail-io1-xd2e.google.com [IPv6:2607:f8b0:4864:20::d2e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DBD23120073 for ; Thu, 29 Aug 2019 14:25:57 -0700 (PDT) Received: by mail-io1-xd2e.google.com with SMTP id s21so9960940ioa.1 for ; Thu, 29 Aug 2019 14:25:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cdt.org; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to; bh=g/c8sLilBcMEun9xanQnH0/Ask07EKqRgIVDt3QTIEk=; b=h6ZZf6RmWk/BG06qdpGlpu0oeHyzcB7eAaTfPQMwFPeT2V5vAAwqmKvwpwwidDB9VA nPgi1IiBc/axPBRn030DcHEOGaxIT+pHlw0GLbGucLWFWUtoKZwVgAjb09GUNOAtr2RZ rEpWcy07IHM7Gh8aKqExT8CSNieIGpofPthjQ= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to; bh=g/c8sLilBcMEun9xanQnH0/Ask07EKqRgIVDt3QTIEk=; b=L/mo+kCog5/Xjky9blkPtngGCIsiZBauwEu8A5GPdXsTnlNUmRNR/kraYucZkNTArD wdyJRwlRl6C1oN23dd8oZkXWu+Rr5cXan0S9awXO4ZiO/UFg97Wn05i9xcOGDeAYIwrY an+D7kwT2WIpZeqMfPocIpAoEn9uQCsWgywJcOY2D7iQQVUDyQI3I1S/hJ3lPiNo86OX mXLxIIfu3OoqP42DEtf2lQKMjebF/xui3yOsGkus7ZT/hPLHWYghocwJ1+ZP5Hcqotui P+DFMqOhu5PLUWW3DngX42mh5/HXqk+3b8HnM5AjAzTJ3wZdUVmlkf2LE4VxDg3bw2uH BrXg== X-Gm-Message-State: APjAAAV6Yt6iMtdSozMURMn4dvMd+FMqfba8QVZ7g5Uf4I8q+gNofC+b PC7/0w3TYXQN6t2QtAfX6H2dkMbSGihdY/34KJDaex6z9l4= X-Google-Smtp-Source: APXvYqzknWFbYivQ6jyo5NiAsgvidy1myDJWaHWdqcZ58Eq5/n3hno8mPq04NPiMSwwLr8t5omAIqMm/OxmqM4SB79k= X-Received: by 2002:a5e:c113:: with SMTP id v19mr3797405iol.219.1567113956902; Thu, 29 Aug 2019 14:25:56 -0700 (PDT) MIME-Version: 1.0 References: <493815238.7079.1566897175778@appsuite-gw2.open-xchange.com> <20190828174219.868DC8C67BB@ary.qy> In-Reply-To: <20190828174219.868DC8C67BB@ary.qy> From: Joseph Lorenzo Hall Date: Thu, 29 Aug 2019 17:25:46 -0400 Message-ID: To: ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000b956b20591482695" Archived-At: X-Mailman-Approved-At: Thu, 29 Aug 2019 16:46:27 -0700 Subject: Re: [Add] policy and law, A thought -- Move the policy decisions outside the application. X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 29 Aug 2019 21:26:00 -0000 --000000000000b956b20591482695 Content-Type: text/plain; charset="UTF-8" On Thu, Aug 29, 2019 at 11:22 AM John Levine wrote: > In article <493815238.7079.1566897175778@appsuite-gw2.open-xchange.com> > you write: > >May I ask how do you plan to reconcile this latter clause with the > objective of providing uncensored web access in countries where the law > requires Internet censoring for political reasons? > > In the UK the law effectively requires filtering of child abuse > material. In parts of Canada, it requires filtering illegal offshore > gambling sites. These are implemented partly or entirely as DNS filters. > > I am sure that Mozilla do not think of themselves as advocates of > pedophilia or money laundering, or advocates of botnets and malware on > networks with RPZ security filters in the resolver. But when they > encourage users to use their "trusted" DNS rather than the default, > that's what they're doing. > > I would think it would be obvious that building tools that resist censorship, observation, and tampering of traffic does not mean anyone doing so is aligned with the worst elements that avail themselves of those tools, nor does it mean that the tools are the solution to those problems. I think on the ADD list and others it's been made very clear that DNS is not an integral feature of networks, but a configurable one, and that any regime that relies on DNS filtering will wither in the face of people spray-painting 8.8.8.8 and 1.1.1.1 (and 9.9.9.9, if they want that RPZ filtering over some other set). I think we can admit this is a big problem but also say that DNS is not the focal point for solutions to those problems. best, Joe > Until we can admit this is a big problem, and we can't wave our hands > and say "censorship" and make it go away, we're not going to make any > progress. > > R's, > John > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > -- Joseph Lorenzo Hall Chief Technologist, Center for Democracy & Technology [https://www.cdt.org] 1401 K ST NW STE 200, Washington DC 20005-3497 e: joe@cdt.org, p: 202.407.8825, pgp: https://josephhall.org/gpg-key Fingerprint: 3CA2 8D7B 9F6D DBD3 4B10 1607 5F86 6987 40A9 A871 --000000000000b956b20591482695 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Thu, Aug 29, 2019 at 11:22 AM John= Levine <johnl@taug= h.com> wrote:
In article <493815238.7079.1566897175778@appsu= ite-gw2.open-xchange.com> you write:
>May I ask how do you plan to reconcile this latter clause with the obje= ctive of providing uncensored web access in countries where the law require= s Internet censoring for political reasons?

In the UK the law effectively requires filtering of child abuse
material.=C2=A0 In parts of Canada, it requires filtering illegal offshore<= br> gambling sites.=C2=A0 These are implemented partly or entirely as DNS filte= rs.

I am sure that Mozilla do not think of themselves as advocates of
pedophilia or money laundering, or advocates of botnets and malware on
networks with RPZ security filters in the resolver.=C2=A0 But when they
encourage users to use their "trusted" DNS rather than the defaul= t,
that's what they're doing.


I would think it would be obvious that= building tools that resist censorship, observation, and tampering of traff= ic does not mean anyone doing so is aligned with the worst elements that av= ail themselves of those tools, nor does it mean that the tools are the solu= tion to those problems.

I think on the ADD list and oth= ers it's been made very clear that DNS is not an integral feature of ne= tworks, but a configurable one, and that any regime that relies on DNS filt= ering will wither in the face of people spray-painting 8.8.8.8 and 1.1.1.1 = (and 9.9.9.9, if they want that RPZ filtering over some other set).

I think we ca= n admit this is a big problem but also say that DNS is not the focal point = for solutions to those problems. best, Joe
=C2=A0
Until we can admit this is a big problem, and we can't wave our hands and say "censorship" and make it go away, we're not going to = make any
progress.

R's,
John

--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add


--
=
Joseph Lorenzo Hall
Chief Technologist, Cente= r for Democracy & Technology [https://www.cdt.org]
1401 K ST NW STE 200, Washington DC 20= 005-3497
e: joe@cdt.org= , p: 202.407.8825, pgp: https://josephhall.org/gpg-key
Fingerprint: 3CA2 8D7B = 9F6D DBD3 4B10 =C2=A01607 5F86 6987 40A9 A871

--000000000000b956b20591482695-- From nobody Fri Aug 30 08:03:14 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E3C41120255 for ; Fri, 30 Aug 2019 03:28:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.198 X-Spam-Level: X-Spam-Status: No, score=-4.198 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, MIME_HTML_ONLY=0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=open-xchange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1QAV4fM8uxRz for ; Fri, 30 Aug 2019 03:28:36 -0700 (PDT) Received: from mx4.open-xchange.com (alcatraz.open-xchange.com [87.191.39.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 067A8120103 for ; Fri, 30 Aug 2019 03:28:36 -0700 (PDT) Received: from open-xchange.com (imap.open-xchange.com [10.20.30.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx4.open-xchange.com (Postfix) with ESMTPS id 8EE1B6A27D; Fri, 30 Aug 2019 12:28:33 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=open-xchange.com; s=201705; t=1567160913; bh=H5sNp5d1mU213KnDJq1CSBnWU9tYvR6XoKPyUCcSugg=; h=Date:From:Reply-To:To:In-Reply-To:References:Subject:From; b=KfeCAUgGgVqMzb5kLJNrNxdCtypiwAvlHIuU/sBJp+MjVahbq0hOVtdV73h2NDcr3 JV/4BF4GH09AbMMyOWxl2UB9ZIwi01gn2+lHjv8g6gRCvrpTuu9WGQNMtkDnYltuor IWzjuuwzqQ5LzjuX00+KeAqOZ1NU04kyYhblpZXESxn44bkrSwVf1cDRWqaro4Aeoh jz+izgYpf3v3ZTeZDgvFWwb2vQmEqIu1mvLVC0Dq+LclJAkiImZ2KgkSFaTCCmJxeN KZbhSRYK6SsCJJxzKtgVZciO5aJkConO/YpC2ncK6HD17IIQUDDVSLKh4ilqrR3n2L NF/m3gtpO1ZBg== Received: from appsuite-gw1.open-xchange.com (appsuite-gw1.open-xchange.com [10.20.28.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by open-xchange.com (Postfix) with ESMTPSA id 82C2F3C0269; Fri, 30 Aug 2019 12:28:33 +0200 (CEST) Date: Fri, 30 Aug 2019 12:28:33 +0200 (CEST) From: Vittorio Bertola Reply-To: Vittorio Bertola To: Joseph Lorenzo Hall , ADD Mailing list Message-ID: <115643803.6195.1567160913442@appsuite-gw1.open-xchange.com> In-Reply-To: References: <493815238.7079.1566897175778@appsuite-gw2.open-xchange.com> <20190828174219.868DC8C67BB@ary.qy> MIME-Version: 1.0 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Priority: 3 Importance: Medium X-Mailer: Open-Xchange Mailer v7.10.2-Rev11 X-Originating-Client: open-xchange-appsuite Autocrypt: addr=vittorio.bertola@open-xchange.com; prefer-encrypt=mutual; keydata= mQENBFhFR+UBCACfoywFKBRfzasiiR9/6dwY36eLePXcdScumDMR8qoXvRS55QYDjp5bs+yMq41qWV9 xp/cqryY9jnvHbeF3TsE5yEazpD1dleRbkpElUBpPwXqkrSP8uXO9KkS9KoX6gdml6M4L+F82WpqYC1 uTzOE6HPmhmQ4cGSgoia2jolxAhRpzoYN99/BwpvoZeTSLP5K6yPlMPYkMev/uZlAkMMhelli9IN6yA yxcC0AeHSnOAcNKUr13yXyMlTyi1cdMJ4sk88zIbefxwg3PAtYjkz3wgvP96cNVwAgSt4+j/ZuVaENP pgVuM512m051j9SlspWDHtzrci5pBKKFsibnTelrABEBAAG0NUJlcnRvbGEsIFZpdHRvcmlvIDx2aXR 0b3Jpby5iZXJ0b2xhQG9wZW4teGNoYW5nZS5jb20+iQFABBMBAgAqBAsJCAcGFQoJCAsCBRYCAwEAAp 4BAhsDBYkSzAMABQMAAAAABYJYRUflAAoJEIU2cHmzj8qNaG0H/ROY+suCP86hoN+9RIV66Ej8b3sb8 UgwFJOJMupZfeb9yTIJwE4VQT5lTt146CcJJ5jvxD6FZn1Htw9y4/45pPAF7xLE066jg3OqRvzeWRZ3 IDUfJJIiM5YGk1xWxDqppSwhnKcMOuI72iioWxX0nGQrWxpnWJsjt08IEEwuYucDkul1PHsrLJbTd58 fiMKLVwag+IE1SPHOwkPF6arZQZIfB5ThtOZV+36Jn8Hok9XfeXWBVyPkiWCQYVX39QsIbr0JNR9kQy 4g2ZFexOcTe8Jo12jPRL7V8OqStdDes3cje9lWFLnX05nrfLuE0l0JKWEg8akN+McFXc+oV68h7nu5A Q0EWEVH5QEIAIDKanNBe1uRfk8AjLirflZO291VNkOAeUu+dIhecGnZeQW6htlDinlYOnXhtsY1mK9W PUu+xshDq7lXn2G0LxldYwyJYZaJtDgIKqVqwxfA34Lj27oqPuXwcvGhdCgt0SW/YcalRdAi0/AzUCu 5GSaj2kaGUSnBYYUP4szGJXjaK2psP5toQSCtx2pfSXQ6MaqPK9Zzy+D5xc6VWQRp/iRImodAcPf8fg JJvRyJ8Jla3lKWyvBBzJDg6MOf6Fts78bJSt23X0uPp93g7GgbYkuRMnFI4RGoTVkxjD/HBEJ0CNg22 hoHJondhmKnZVrHEluFuSnW0wBEIYomcPSPB+cAEQEAAYkBMQQYAQIAGwUCWEVH5QIbDAQLCQgHBhUK CQgLAgUJEswDAAAKCRCFNnB5s4/KjdO8B/wNpvWtOpLdotR/Xh4fu08Fd63nnNfbIGIETWsVi0Sbr8i E5duuGaaWIcMmUvgKe/BM0Fpj9X01Zjm90uoPrlVVuQWrf+vFlbalUYVZr51gl5UyUFHk+iAZCAA0WB rsmACKvuV1P7GuiX3UV9b59T9taYJxN3dNFuftrEuvsqHimFtlekUjUwoCekTJdncFusBhwz2OrKhHr WWrEsXkfh0+pURWYAlKlTxvXuI7gAfHEQM+6OnrWvXYtlhd0M1sBPnCjbyG63Qws7Rek9bEWKtH6dA6 dmT2FQT+g1S9Mdf0WkPTQNX0x24dm8IoHuD3KYwX7Svx43Xa17aZnXqUjtj1 Archived-At: X-Mailman-Approved-At: Fri, 30 Aug 2019 08:03:13 -0700 Subject: Re: [Add] policy and law, A thought -- Move the policy decisions outside the application. X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 30 Aug 2019 10:28:38 -0000

Il 29 agosto 2019 23:25 Joseph Lorenzo Hall <joe@cdt.org> ha scritto:




On Thu, Aug 29, 2019 at 11:22 AM John Levine < johnl@taugh.com> wrote:
In article < 493815238.7079.1566897175778@appsuite-gw2.open-xchange.com> you write:
>May I ask how do you plan to reconcile this latter clause with the objective of providing uncensored web access in countries where the law requires Internet censoring for political reasons?

In the UK the law effectively requires filtering of child abuse
material.  In parts of Canada, it requires filtering illegal offshore
gambling sites.  These are implemented partly or entirely as DNS filters.

I am sure that Mozilla do not think of themselves as advocates of
pedophilia or money laundering, or advocates of botnets and malware on
networks with RPZ security filters in the resolver.  But when they
encourage users to use their "trusted" DNS rather than the default,
that's what they're doing.


I would think it would be obvious that building tools that resist censorship, observation, and tampering of traffic does not mean anyone doing so is aligned with the worst elements that avail themselves of those tools, nor does it mean that the tools are the solution to those problems.

I think on the ADD list and others it's been made very clear that DNS is not an integral feature of networks, but a configurable one, and that any regime that relies on DNS filtering will wither in the face of people spray-painting 8.8.8.8 and 1.1.1.1 (and 9.9.9.9, if they want that RPZ filtering over some other set).

I think we can admit this is a big problem but also say that DNS is not the focal point for solutions to those problems. best, Joe
I am sure that Mozilla never meant to facilitate any kind of crime, be it child pornography, money laundering or whatever.

I also think that they, in the beginning, failed to appreciate in full the complexity of the problem and of today's DNS, and based their approach on two wrong assumptions:
1. any kind of DNS-based content/access filtering is "censorship"
2. DNS should not be used as a control point for the Internet

(#1 is also in your PEARG draft, and you know I disagree with that choice of language.)

In reality, the access control capabilities of DNS resolvers are used in most cases for different objectives than what would commonly be called "censorship" (blocking content for political reasons in undemocratic regimes).

Also, DNS *is* an effective control point, and this is demonstrated by the fact that it is widely used to that effect almost everywhere on the planet with satisfaction. Claiming that "since it doesn't work 100% of the time then it doesn't work at all" is a fallacy, especially if it's not done by the people that use the system, but by other people that would like to disrupt it.

Many non-technical Internet stakeholders (public authorities, businesses, civil society and end-users) make use of that control point, and many people and companies in the DNS, ISP and networking industries cater to that need, and use it for themselves as well. I don't see any of these stakeholders willing to give up this use of the DNS, so any attempt by Mozilla, the IETF or others to disrupt the use of DNS as a control point will be seen like John did, and perceived as an attack on security, network management, business and law enforcement tools that are vital to those stakeholders.

This is why reiterating any of the two points above is also very "one sided", and not conducive to a solution.

I think we should rather work (like Mozilla has started doing with their split DNS recognition experiments) on ways to preserve the current use of the DNS as a control point, while giving users the additional privacy and security which are the stated objectives of DNS transport encryption, and a way to bypass these controls in specific use cases of actual "censorship".

-- 

Vittorio Bertola | Head of Policy & Innovation, Open-Xchange
vittorio.bertola@open-xchange.com 
Office @ Via Treviso 12, 10144 Torino, Italy
From nobody Fri Aug 30 08:03:37 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1473B1208CD for ; Fri, 30 Aug 2019 07:24:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fWGOFWcZ3qQz for ; Fri, 30 Aug 2019 07:24:03 -0700 (PDT) Received: from mail-ed1-x531.google.com (mail-ed1-x531.google.com [IPv6:2a00:1450:4864:20::531]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6BBFB1208C7 for ; Fri, 30 Aug 2019 07:24:03 -0700 (PDT) Received: by mail-ed1-x531.google.com with SMTP id r12so8208970edo.5 for ; Fri, 30 Aug 2019 07:24:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:subject:from:in-reply-to:date :content-transfer-encoding:message-id:references:to; bh=YDEz2WFL+VRrmIQpF9u3JViN+JnEmIGrEXIm8uDYx7U=; b=gXLLRL9zPp7dx6M1pRGCdzW8oV7fXLHl/YSug6cWFPcz4i5kSlVcCOBHIHn15FT46r FqjkAT+6dVR5iSgrRpVx73F33ETeRdDYAeoI1Q72mxBc0+8+6bwGXfpOgWJDLnCEbEng KQTuBuZKvYpYKk579G59CPfbTIMbnKaWe7LiQpa1x1kuvoAXgFQyuMG9GtO4hegVHHYg ttyB8Z46St3P0X7q+FwyPfFprytYrlqTZAIKBcQqOXZwIRxUKmgPK9Bh2qgHWnIOCaof mdhB1T1RJRt1Y32zgyH/zhR23GTyqLlmzNgt2lk0E/DFg4QDhl93q3zbWZSq3Gr/lUW1 b5Rw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date :content-transfer-encoding:message-id:references:to; bh=YDEz2WFL+VRrmIQpF9u3JViN+JnEmIGrEXIm8uDYx7U=; b=kD7pAUaXVZ5h/sn8hgioDG1Pk2VRxBTq9GgJOJ+KoUaLr64nEa43uprsfTIzDEtegm cX7oGkdO8YjYUNkP9Z4ZhNp6IcYcBeldlB6BZTf/dIj+RSJCKBNpMDMyeoRIt3fGjM8q nF6cm5xQ3ljvXXTnEKbj4Ra96E578Kymq3PpCRRyQzHJJZp0Zq1fb36hrXmAUgpXggz6 Avg/bkWEjjheBg80KcnV4ICiZwjMU/YvN+sjOqHH0+WoNlcLzeA1U0OsbD47hAZap2mw Rdpor/IULVeH+nur0D/PN0zk1YA47jVcrt20SlE1HPizNjp+ELGQ08TMuIh0dv4YSf07 LeRA== X-Gm-Message-State: APjAAAVw28HZxaIi9LfhyXK0mHvwKDf1GuLBCSyB1UWNgFdu5DEzpQjJ 9AtOrLlHrC8eZloSZM3ANmKzKfNe X-Google-Smtp-Source: APXvYqy82qyQ07QAS2ECNnwEnc4SsrAxI+vaWo3kIbWC30rSL6+eidqkXPCDmiQx7EsOwvH5rnxlnw== X-Received: by 2002:aa7:c306:: with SMTP id l6mr15777608edq.21.1567175042047; Fri, 30 Aug 2019 07:24:02 -0700 (PDT) Received: from [192.168.24.186] ([194.6.185.158]) by smtp.gmail.com with ESMTPSA id x42sm1032489ede.24.2019.08.30.07.24.00 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 30 Aug 2019 07:24:00 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) From: Bret Jordan X-Priority: 3 In-Reply-To: <3B94868F-435F-4C8F-986D-C5F71D3E80AA@mnot.net> Date: Fri, 30 Aug 2019 16:23:56 +0200 Content-Transfer-Encoding: quoted-printable Message-Id: References: <1444D5E7-DEA7-437C-B12B-6C31FEA563DD@sky.uk> <11f9dfe2-ab05-2227-7643-e53da95ec717@nostrum.com> <18798.1566571840@dooku.sandelman.ca> <15520.1566839640@localhost> <1098628263.7014.1566896822696@appsuite-gw2.open-xchange.com> <3B94868F-435F-4C8F-986D-C5F71D3E80AA@mnot.net> To: Mark Nottingham , "add@ietf.org" X-Mailer: Apple Mail (2.3445.104.11) Archived-At: X-Mailman-Approved-At: Fri, 30 Aug 2019 08:03:36 -0700 Subject: Re: [Add] Communicating DNS blocks (was Re: A thought -- Move the policy decisions outside the application.) X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 30 Aug 2019 14:24:11 -0000 >=20 >=20 > While technical people (like those on this list) might be able to = interpret such a message safely and productively, many users of the = Internet don't have that skill; for similar reasons, browsers have = substantially changed the user experience of security for TLS over the = last few years, and are continuing to do so, so that it's "safe by = default", even in the face of user ignorance / apathy.=20 "Safe by default=E2=80=9D is the wrong term. Just because my session or = data has not been modified in transit, does not mean it is safe.=20 Also, just because something is trusted or cryptographically verified, = does not make it safe.=20 Bret= From nobody Fri Aug 30 08:04:16 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6C43B120CA4 for ; Fri, 30 Aug 2019 02:53:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cdt.org Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Iv-nBpwcYMfV for ; Fri, 30 Aug 2019 02:53:22 -0700 (PDT) Received: from mail-io1-xd2c.google.com (mail-io1-xd2c.google.com [IPv6:2607:f8b0:4864:20::d2c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 17783120C74 for ; Fri, 30 Aug 2019 02:53:22 -0700 (PDT) Received: by mail-io1-xd2c.google.com with SMTP id n197so10805211iod.9 for ; Fri, 30 Aug 2019 02:53:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cdt.org; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=Ty5Suytb4j/8X/qYTglctHQZl4apwSNG/4CEdP6uiqA=; b=IXwoInzHkMPuR80V98QY5NNIdBUY1Rv3ul4tbLrlKVpyUyBFliusodLwe0hBDzqv1Z NUXcjXvFJ7CzcoecOGZIf2dzDFexLPzFFpiwXYF5M7/34X1NwAi4+CsFGQlD06CWmrCO yEJuNqV+GagMQ1u9wFZ3NGVU0wOKr+RbZZYV0= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=Ty5Suytb4j/8X/qYTglctHQZl4apwSNG/4CEdP6uiqA=; b=EnpVlCc+P60nXJh259NhlxM5Rr0Ys8FmWpt8H+VeUSMFfbWVZf7tQrnJJo9AFP6wu5 4SSdenoaH/lEqyX0PwQ9XAWfdtQgQUDnLCi3wTjNQzSm/n3KIcDn0jmM33WTB6AljFoI 9z2tcE7AFzD6ZxCQlV+4ckoyfOGOsuLpIB7OBbrrA//jzY5qPKRjFzh3/lFQUqNRTJDW 6ZyTa4RNkDHWVkWN/AacrHRg90/LN7mAoQtcJZJog6qnJO5BB2x33qTr2yiBZ0zlJ4nc g00YzGWkTN23ApTWeTckCqs2KMtMlL74TcEs8bqNpNQhaBdMGa8rx1xINIeSbNbQZJmz HVLg== X-Gm-Message-State: APjAAAXPTrJb4OCh91NHUeImYXbJsjii1Zx3dzj1x2u6PtrZ0VIuPLrI diLCRlVzg30LmCvJRQNUwspMPEpB1gquipp1+tVx0Q== X-Google-Smtp-Source: APXvYqxDytxM7FNJpxjwrUBnoFlur7bCSheJLeyKIgA4pHH4Yk/y6vrqZ4q5DdwwhjNEqIrMWypn/g5fivJuIm3XjNA= X-Received: by 2002:a02:8794:: with SMTP id t20mr2786720jai.24.1567158800883; Fri, 30 Aug 2019 02:53:20 -0700 (PDT) MIME-Version: 1.0 References: <493815238.7079.1566897175778@appsuite-gw2.open-xchange.com> <20190828174219.868DC8C67BB@ary.qy> In-Reply-To: From: Joseph Lorenzo Hall Date: Fri, 30 Aug 2019 05:53:09 -0400 Message-ID: To: Brian Dickson Cc: ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000a23afc05915297e2" Archived-At: X-Mailman-Approved-At: Fri, 30 Aug 2019 08:04:15 -0700 Subject: Re: [Add] policy and law, A thought -- Move the policy decisions outside the application. X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 30 Aug 2019 09:53:37 -0000 --000000000000a23afc05915297e2 Content-Type: text/plain; charset="UTF-8" On Thu, Aug 29, 2019 at 20:46 Brian Dickson wrote: > > > On Thu, Aug 29, 2019 at 4:46 PM Joseph Lorenzo Hall wrote: > >> >> >> On Thu, Aug 29, 2019 at 11:22 AM John Levine wrote: >> >>> [snip] > >> In parts of Canada, it requires filtering illegal offshore >>> gambling sites. These are implemented partly or entirely as DNS filters. >>> >> > [snip] > > >> I think on the ADD list and others it's been made very clear that DNS is >> not an integral feature of networks, but a configurable one, and that any >> regime that relies on DNS filtering will wither in the face of people >> spray-painting 8.8.8.8 and 1.1.1.1 (and 9.9.9.9, if they want that RPZ >> filtering over some other set). >> > > So, point of clarification. > When you say "any regime", are you limiting the intended scope to > countries generally considered by neutral, major newspapers to be regimes? > Or, did you just call Canada a regime? > > (Note to Barry: did the use of the term "regime" slip by you, or did you > deliberately allow this through the moderation filtering you are doing? I > thought we were trying to limit inflammatory language.) > Apologies, by regime I simply meant governing power structure. > -- Joseph Lorenzo Hall Chief Technologist, Center for Democracy & Technology [https://www.cdt.org] 1401 K ST NW STE 200, Washington DC 20005-3497 e: joe@cdt.org, p: 202.407.8825, pgp: https://josephhall.org/gpg-key Fingerprint: 3CA2 8D7B 9F6D DBD3 4B10 1607 5F86 6987 40A9 A871 --000000000000a23afc05915297e2 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


On Thu, Aug 29, 2019 at 20:46 Brian Dickson <brian.peter.dickson@gmail.com>= wrote:


On Thu, Aug 29, 2019 at 4:46 PM Joseph Lorenzo Hall <joe@cdt.org> wrote:


On Thu, Aug 29, 2019 at 11:22 AM John Levine <johnl@taugh.com> wrote= :
<= /div>
[snip]=C2=A0
In parts of Canada, it requires f= iltering illegal offshore
gambling sites.=C2=A0 These are implemented partly or entirely as DNS filte= rs.

[snip]
=C2=A0
I think on the ADD list and others it= 's been made very clear that DNS is not an integral feature of networks= , but a configurable one, and that any regime that relies on DNS filtering = will wither in the face of people spray-painting 8.8.8.8 and 1.1.1.1 (and 9= .9.9.9, if they want that RPZ filtering over some other set).

So, point of clarification.
When y= ou say "any regime", are you limiting the intended scope to count= ries generally considered by neutral, major newspapers to be regimes?
=
Or, did you just call Canada a regime?

(Note = to Barry: did the use of the term "regime" slip by you, or did yo= u deliberately allow this through the moderation filtering you are doing? I= thought we were trying to limit inflammatory language.)
<= /blockquote>

Apologies, by reg= ime I simply meant governing power structure.
--
Joseph Lorenzo Hall
Chief Technologis= t, Center for Democracy & Technology [h= ttps://www.cdt.org]
1401 K ST NW STE 200, Washington DC 20005-3497e: joe@cdt.org, p: 202.407.8825, pgp: = https://josephhall.org/gpg-key
Fingerprint: 3CA2 8D7B 9F6D DBD3 4B10=C2=A0 1607 5F86 6987 40A9 A871<= /div> --000000000000a23afc05915297e2-- From nobody Fri Aug 30 08:04:51 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A429112011F for ; Thu, 29 Aug 2019 17:46:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LzQ2dpH1Ao-W for ; Thu, 29 Aug 2019 17:46:08 -0700 (PDT) Received: from mail-ua1-x92c.google.com (mail-ua1-x92c.google.com [IPv6:2607:f8b0:4864:20::92c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D602512006A for ; Thu, 29 Aug 2019 17:46:07 -0700 (PDT) Received: by mail-ua1-x92c.google.com with SMTP id m23so1769619uaq.11 for ; Thu, 29 Aug 2019 17:46:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=CdkHgZYJd//xxsU9jsqON76MVfUTYRps4+bzpl+wMuY=; b=JPTIJneIURH2jgU4F8pynyEesvmnxwXIWQaGMp1A3Hkau7hvqNBDU0WpQlwL3erB1g v7TOccYpXidVsXnBXQow2Erg7j3ffn2IRjszCgsT1Ymqcn8JQrcUHP4ru6ofPG7tJOZD S6Ld1cOi3/jKF0Vh/Ma5wRDd8dh5nDarrPDWuYOd+udI5SOCuZwB3HmizPXtEzH5h/e+ 4a+8MZCuisu+Kov4Ku5+OcAXmoJc+qWrkpIBcoctWldPtm7I2fxwYuMHQOEEXYGBY+36 w+q37/jprkuio07Ue2lgn8OOaWE6BEtmFwuuTFQqMt0extZ3aZKBkr3SCBXZF1cY0j+x jEGQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=CdkHgZYJd//xxsU9jsqON76MVfUTYRps4+bzpl+wMuY=; b=AaJsXJYCfl3xKf24mKivX1DH9mawM2RiUsYfoKfUX0ktAwbr3mYTB18f5Uops4MZPc NlgoXftdxW0H/niDyZVs3paluMHMPuuVrdFx9d3M7VylBMu9Wvn/lBQmZPiE8UkHe01N +IVtExJpAFOMVvuCD6oL4uPnuavkPYpHOkguT+2qIOySlIb9o9HMNNIwxfuhYIs4xPi6 QF73RphbsVTBxoaJZjbKutdOSTXxmrmZaMnSE/KGjpVmVW4lAOQIW8vknK9iWGWz6KgR TKV4ElpzROJ2i3RJy/o6QA3Tj6kMcEMAzWTQ0JV0ebYtPz4JqMjjuWhSkZOTHwqs/Xjz kYQQ== X-Gm-Message-State: APjAAAWrg63leMoAVOLmoOlfXHxsme9qcjqg9ZQy6IZGRWJI/Xo26Q+w 9tGtrRQbn4LoZjZFkFz3fvdNQN7MALUPrwutwdQaBw== X-Google-Smtp-Source: APXvYqxjjacGVQsbTWNDq45pixa3l0yxjesY7x4bDZwlgTq45CGBwkfvCI8znmj0MshdyrTfsZLv2f6ngzJ/JdvjBLk= X-Received: by 2002:ab0:ed:: with SMTP id 100mr1083101uaj.48.1567125966713; Thu, 29 Aug 2019 17:46:06 -0700 (PDT) MIME-Version: 1.0 References: <493815238.7079.1566897175778@appsuite-gw2.open-xchange.com> <20190828174219.868DC8C67BB@ary.qy> In-Reply-To: From: Brian Dickson Date: Thu, 29 Aug 2019 17:45:55 -0700 Message-ID: To: Joseph Lorenzo Hall Cc: ADD Mailing list Content-Type: multipart/alternative; boundary="0000000000009075e305914af25d" Archived-At: X-Mailman-Approved-At: Fri, 30 Aug 2019 08:04:49 -0700 Subject: Re: [Add] policy and law, A thought -- Move the policy decisions outside the application. X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 30 Aug 2019 00:46:11 -0000 --0000000000009075e305914af25d Content-Type: text/plain; charset="UTF-8" On Thu, Aug 29, 2019 at 4:46 PM Joseph Lorenzo Hall wrote: > > > On Thu, Aug 29, 2019 at 11:22 AM John Levine wrote: > >> [snip] > In parts of Canada, it requires filtering illegal offshore >> gambling sites. These are implemented partly or entirely as DNS filters. >> > [snip] > I think on the ADD list and others it's been made very clear that DNS is > not an integral feature of networks, but a configurable one, and that any > regime that relies on DNS filtering will wither in the face of people > spray-painting 8.8.8.8 and 1.1.1.1 (and 9.9.9.9, if they want that RPZ > filtering over some other set). > So, point of clarification. When you say "any regime", are you limiting the intended scope to countries generally considered by neutral, major newspapers to be regimes? Or, did you just call Canada a regime? (Note to Barry: did the use of the term "regime" slip by you, or did you deliberately allow this through the moderation filtering you are doing? I thought we were trying to limit inflammatory language.) > > I think we can admit this is a big problem but also say that DNS is not > the focal point for solutions to those problems. best, Joe > The main point here, is not whether DNS is the best solution, or not, but whether it is legitimate to allow/support the use of DNS filtering where it is required by local law in democratic countries? And by "legitimate to allow", the meaning of the question is, as far as ADD context is concerned: Is it reasonable to require that software implementers comply with these local laws, either completely, or at least by default that requires informed user consent to override? (I don't think the specifics on how that is accomplished are that important. It could be having software change its behavior based on location, or different versions for different locations, or something else.) And I concur with John L, the starting point needs to be admitting it is a problem. Brian > > >> Until we can admit this is a big problem, and we can't wave our hands >> and say "censorship" and make it go away, we're not going to make any >> progress. >> >> R's, >> John >> >> -- >> Add mailing list >> Add@ietf.org >> https://www.ietf.org/mailman/listinfo/add >> > > > -- > Joseph Lorenzo Hall > Chief Technologist, Center for Democracy & Technology [https://www.cdt.org > ] > 1401 K ST NW STE 200, Washington DC 20005-3497 > e: joe@cdt.org, p: 202.407.8825, pgp: https://josephhall.org/gpg-key > Fingerprint: 3CA2 8D7B 9F6D DBD3 4B10 1607 5F86 6987 40A9 A871 > > -- > Add mailing list > Add@ietf.org > https://www.ietf.org/mailman/listinfo/add > --0000000000009075e305914af25d Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Thu, Aug 29, 2019 at 4:46 PM Josep= h Lorenzo Hall <joe@cdt.org> wrote= :


On Thu, Aug 29, 2019 at 11:22 AM John Levine <johnl@taugh.com> = wrote:
[snip]=C2=A0
In parts of Canada, it requi= res filtering illegal offshore
gambling sites.=C2=A0 These are implemented partly or entirely as DNS filte= rs.

[snip]
=C2=A0
I think on the ADD list and others it= 's been made very clear that DNS is not an integral feature of networks= , but a configurable one, and that any regime that relies on DNS filtering = will wither in the face of people spray-painting 8.8.8.8 and 1.1.1.1 (and 9= .9.9.9, if they want that RPZ filtering over some other set).

So, point of clarification.
When y= ou say "any regime", are you limiting the intended scope to count= ries generally considered by neutral, major newspapers to be regimes?
=
Or, did you just call Canada a regime?

(Note = to Barry: did the use of the term "regime" slip by you, or did yo= u deliberately allow this through the moderation filtering you are doing? I= thought we were trying to limit inflammatory language.)
=C2=A0

I think we can = admit this is a big problem but also say that DNS is not the focal point fo= r solutions to those problems. best, Joe

The main point he= re, is not whether DNS is the best solution, or not, but whether it is legi= timate to allow/support the use of DNS filtering where it is required by lo= cal law in democratic countries?

And by "legi= timate to allow", the meaning of the question is, as far as ADD contex= t is concerned:
Is it reasonable to require= that software implementers comply with these local laws, either completely= , or at least by default that requires informed user consent to override?
(I don't think the specifics on = how that is accomplished are that important. It could be having software ch= ange its behavior based on location, or different versions for different lo= cations, or something else.)

And I concur = with John L, the starting point needs to be admitting it is a problem.
=
Brian
=C2=A0
=C2=A0
Until we can admit this is a big problem, and we can't wave our hands and say "censorship" and make it go away, we're not going to = make any
progress.

R's,
John

--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add


--
Joseph Lorenzo Hall<= br>Chief Technologist, Center for Democracy & Technology [https://www.cdt.org]
1401 K ST = NW STE 200, Washington DC 20005-3497
e: joe@cdt.org, p: 202.407.8825, pgp: https://josephhall.org/gpg-key
Fingerprint: 3CA2 8D7B 9F6D DBD3 4B10 =C2=A01607 5F86 6987 40A9 A871

--
Add mailing list
Add@ietf.org
https://www.ietf.org/mailman/listinfo/add
--0000000000009075e305914af25d-- From nobody Fri Aug 30 14:00:40 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A054B1200F6 for ; Fri, 30 Aug 2019 10:00:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id O_a6z25olQR1 for ; Fri, 30 Aug 2019 10:00:35 -0700 (PDT) Received: from mail-io1-xd42.google.com (mail-io1-xd42.google.com [IPv6:2607:f8b0:4864:20::d42]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9CDB71200EC for ; Fri, 30 Aug 2019 10:00:35 -0700 (PDT) Received: by mail-io1-xd42.google.com with SMTP id d25so12885574iob.6 for ; Fri, 30 Aug 2019 10:00:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=ZSWnJ89BmDts8YWDraqjDCd3u1I/wfWgG/FCQFXzyII=; b=pDTnxEWF+Z2+hUyzqCYjRcItwiSoUsM6+mfE86q2gnpobQl2fETs+VxjpOtIktgG90 hqrO0kQDhIkkZDWH8VD+6NisGRlyyi4f2dQ9iczhSIAssMuunibfh1DFggkoA6WXG5sP 4P5Mdb0c4G8iQEiYkR8KviQqzI8wygYIC7EAM3xXo6WY76fLP/OouYwUEcnPFeOzqudz rOmsUeuAHIy9au6jp/hWgK3tOpTmG0LGQp8dd1wTMQ2t+fZgU489PghdEsOi+BuWfTIS ewbPotoTCSEfyrA8D9Ko8kdWKd/SclpebhTJhVlIAIDFtIvPo49UCgWbqaFkpYBMnw9L 6twQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=ZSWnJ89BmDts8YWDraqjDCd3u1I/wfWgG/FCQFXzyII=; b=oIeRshEhF7wQ6sBvcSR7efMZXWst6wVXP82upLjDWgaY1i3HmNSCRyPJjS27PZAPYh ya5KvLEGmXrlLJfnRzjBFKbOrwB2yGQqHzL+dljZyTNTx0hj2yirpZJLvgQN/xu2UF69 hW9tX7QM80Q1FTfZmAqzvzuAFxW6kRLBpEVBUGEBqMjrfNczXXpSL+XX3VuCWkeQ3c1/ pKpBS9zYGCMD3GhJHsP5jZoXGTFt/W2e2IfM2S7Qjph7ebRBtoKNqR8Ot75kt6Bw7tVK 8RaIa8z8CDNIM3DhBVVtFXnc3k3ECZOPioPy7hbwlSWEqjfFvlc82IdWQ2dprngqggim xwdQ== X-Gm-Message-State: APjAAAUhtgkythWJuPihP1ta7gurunSta9ltzciRdzn/kM07gCXLq9nj MAAJ2DRW6S1bdHXSYfICLewbO4zDxQ2IwSktz0vcOb7KNgbWTw== X-Google-Smtp-Source: APXvYqyqsPoNoNnaEgDN2joICM7z3QGK9hJwWPTNwaWS85nF844b93Vm6BNa13wnLmoe8aziZTefBTlk15DdDvmjqcw= X-Received: by 2002:a5d:8457:: with SMTP id w23mr8014979ior.189.1567184434807; Fri, 30 Aug 2019 10:00:34 -0700 (PDT) MIME-Version: 1.0 References: <20190828174219.868DC8C67BB@ary.qy> <7981858d-1fe8-b6e4-5c06-d3be2628a01f@cs.tcd.ie> In-Reply-To: <7981858d-1fe8-b6e4-5c06-d3be2628a01f@cs.tcd.ie> From: Rob Sayre Date: Fri, 30 Aug 2019 10:00:21 -0700 Message-ID: To: Stephen Farrell Cc: John Levine , ADD Mailing list Content-Type: multipart/alternative; boundary="00000000000088cafe0591588f28" Archived-At: X-Mailman-Approved-At: Fri, 30 Aug 2019 14:00:39 -0700 Subject: Re: [Add] policy and law, A thought -- Move the policy decisions outside the application. X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 30 Aug 2019 17:00:39 -0000 --00000000000088cafe0591588f28 Content-Type: text/plain; charset="UTF-8" On Thu, Aug 29, 2019 at 4:45 PM Stephen Farrell wrote: > On 28/08/2019 18:42, John Levine wrote: > > Until we can admit this is a big problem, and we can't wave our hands > > and say "censorship" and make it go away, we're not going to make any > > progress. > > I think that until people discussing this resist the > temptation to present totally one-sided perspectives, > It occurred to me that many of the same use cases came up in HTTP/2's adoption of TLS. The HTTP/2 spec doesn't require TLS, but I don't think many clients support its use unencrypted. . Now that TLS is so prevalent on the web, there are many proxy implementations and RFCs that are no longer relevant. I also went back to check out the mailing list, and the debate is eerily similar. < https://lists.w3.org/Archives/Public/ietf-http-wg/2013OctDec/thread.html#msg1357 > I think what's different about this discussion is that there seem to be people advocating that a client should *always* let the network decide whether to encrypt DNS, and where to send the traffic. This seems unusual for the IETF. And, as we've documented, there are already many easy-to-use products that make various choices about DNS encryption and choice of server. The issue seems contentious because DNS is one of the few remaining clear text control points, but RFC7258 does still seem to apply < https://tools.ietf.org/html/rfc7258>. thanks, Rob --00000000000088cafe0591588f28 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Thu, Aug 29, 2019 at 4:45 PM Stephen F= arrell <stephen.farrell@cs.= tcd.ie> wrote:
On 28/08/2019 18:42, John Levine wrote:
> Until we can admit this is a big problem, and we can't wave our ha= nds
> and say "censorship" and make it go away, we're not goin= g to make any
> progress.

I think that until people discussing this resist the
temptation to present totally one-sided perspectives,
=
It occurred to me that many of the same use cases came up in= HTTP/2's adoption of TLS. The HTTP/2 spec doesn't require TLS, but= I don't think many clients support its use unencrypted.
<= htt= ps://github.com/http2/http2-spec/wiki/Proxy-User-Stories>. Now that = TLS is so prevalent on the web, there are many proxy implementations and RF= Cs that are no longer relevant. I also went back to check out the mailing l= ist, and the debate is eerily similar. <https://lists.= w3.org/Archives/Public/ietf-http-wg/2013OctDec/thread.html#msg1357><= /div>

I think what's different about this discussion= is that there seem to be people advocating that a client should *always* l= et the network decide whether to encrypt DNS, and where to send the traffic= . This seems unusual for the IETF. And, as we've documented, there are = already many easy-to-use products that make various choices about DNS encry= ption and choice of server.

The issue seems conten= tious because DNS is one of the few remaining clear text control points, bu= t RFC7258 does still seem to apply <https://tools.ietf.org/html/rfc7258>.

thanks,
Rob


--00000000000088cafe0591588f28-- From nobody Fri Aug 30 18:54:54 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 15E6B1209C9 for ; Fri, 30 Aug 2019 15:12:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KwRO08a62IqP for ; Fri, 30 Aug 2019 15:12:10 -0700 (PDT) Received: from mail-io1-xd31.google.com (mail-io1-xd31.google.com [IPv6:2607:f8b0:4864:20::d31]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5E35E120B52 for ; Fri, 30 Aug 2019 15:12:10 -0700 (PDT) Received: by mail-io1-xd31.google.com with SMTP id j4so17075168iog.11 for ; Fri, 30 Aug 2019 15:12:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=Qb7m1+Hmzkft4OhgyDU3gZY19Mx+Vq8skVmJ0+PwZ5c=; b=af4Rr6zR+QGw38V8MpGf9rOWrcb2JRES0daTXBhBTGDPwksVldnT1e1p6bG1t6kASB ebDKwgC5d9Gyv+HA9mQ21PxGTSMuP4jCZESbpX0h8i0+2z7RCXzPcXOmKaCzT+qa0Bmh CDrMVtjEMHxzXWMZDX1QM4uAJolR+guNsFXPBDCKAQj+KROwJ4elW2XbTY72efpQlcWe mVWWNnqiRWjzOLIW2ldyQRE9ibKZygzpkbyGvrnDikA+EzJQdVebSDRXACN/dUmzAEoD QWIWZzdrn3yjMj2ZyegOk49g25yH38pUonxfavCsLIuN3Mnc+W6GzcMRLpBagtRgLE1y O9Fg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=Qb7m1+Hmzkft4OhgyDU3gZY19Mx+Vq8skVmJ0+PwZ5c=; b=bzrC49ZUYPh7b+BcCNM0mqmNLwtAhly/p+cT84JPuKpVW+GDmFv42cqGyYl/ys7NkZ SRdr950iN0Uc/anpfEp3ZuDXVaIn+dx1dgI2FGZcpeBhUys6q/JffyxDdx80ZJQZiJZL VLQctV7p1pRAMBLVsftaxSo+Z31vGCXcOmhGimeNhFS/i8Kf3KFQsWzFoLHgi0E+gviM jQA1nRYNsKYq4ScURE2TiiXswqwoSeFoI/WKwdcjc3i8iW7fE4HEEkkHW6MW84wf62Gr SYNsZ8C6diTGmpg5eq1TN8oGdAhbqOMydW6Coh/GIe8dABv13u0DnQnXW7EQN7LEq5ww RCYA== X-Gm-Message-State: APjAAAX3mUZiMID64E4PynV4Mo7H3BPmDf1sMOMsxNe6e0aOHuTEYvEt IEVQtiEhSfypUr0nlS8BzTtItdqQTKaiHAKvaOQ= X-Google-Smtp-Source: APXvYqx9gYvZfEEs+V5aVPhk6SdD9zUbacVKw1FsYD30LcPmmQXJxssza3CIhxcXdGTuQF/jgxnSfG45QDF8UTlsqRI= X-Received: by 2002:a5d:894a:: with SMTP id b10mr328436iot.49.1567203129614; Fri, 30 Aug 2019 15:12:09 -0700 (PDT) MIME-Version: 1.0 References: <20190828174219.868DC8C67BB@ary.qy> <7981858d-1fe8-b6e4-5c06-d3be2628a01f@cs.tcd.ie> <2D09D61DDFA73D4C884805CC7865E6114E29338C@GAALPA1MSGUSRBF.ITServices.sbc.com> In-Reply-To: <2D09D61DDFA73D4C884805CC7865E6114E29338C@GAALPA1MSGUSRBF.ITServices.sbc.com> From: Rob Sayre Date: Fri, 30 Aug 2019 15:11:55 -0700 Message-ID: To: "STARK, BARBARA H" Cc: ADD Mailing list , John Levine Content-Type: multipart/alternative; boundary="000000000000d4eab105915ce9cb" Archived-At: X-Mailman-Approved-At: Fri, 30 Aug 2019 18:54:53 -0700 Subject: Re: [Add] policy and law, A thought -- Move the policy decisions outside the application. X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 30 Aug 2019 22:12:13 -0000 --000000000000d4eab105915ce9cb Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Fri, Aug 30, 2019 at 2:42 PM STARK, BARBARA H wrote: > > > > > *From:* Add *On Behalf Of * Rob Sayre > > > > I haven=E2=80=99t seen massive outcry against encryption of DNS. Th= at=E2=80=99s not > the issue. Please stop saying it is. Many ISPs are seriously looking at > both DoT and DoH. Continuing to claim people are saying something they > aren=E2=80=99t saying is not beneficial to the discussion. > Hello, I think there are a mix of opinions. It sounds like you're saying DoT/DoH might be ok, but you're concerned about server selection. It is unusual for the IETF to dictate that--at most some set of authoritative options might be suggested. I suppose my message did not call out that specific combination, but I also didn't mention ISPs. There are other people on this list who are ok with only one of DoT or DoH. And, there are messages that mix up data integrity and message integrity in confusing ways--I can't tell what they think. Then, there are people who seem to think DNS in the clear is ok, as it does allow for a variety of middlebox software. thanks, Rob --000000000000d4eab105915ce9cb Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Fri, Aug 30, 2019 at 2:42 PM STARK, BA= RBARA H <bs7652@att.com> wrote:=

=C2=A0

=C2=A0

From: Add <add-bounces@ietf.org> On Behalf Of Rob Sayre

=C2=A0

<bhs> I haven=E2=80=99t seen massive outcry ag= ainst encryption of DNS. That=E2=80=99s not the issue. Please stop saying i= t is. Many ISPs are seriously looking at both DoT and DoH. Continuing to cl= aim people are saying something they aren=E2=80=99t saying is not beneficial to the discussion.


Hello,

I think there a= re a mix of opinions. It sounds like you're saying DoT/DoH might be ok,= but you're concerned about server selection. It is unusual for the IET= F to dictate that--at most some set of authoritative options might be sugge= sted. I suppose my message did not call out that specific combination, but = I also didn't mention ISPs.

There are other pe= ople on this list who are ok with only one of DoT or DoH.=C2=A0 And, there = are messages that mix up data integrity and message integrity in confusing = ways--I can't tell what they think. Then, there are people who seem to = think DNS in the clear is ok, as it does allow for a variety of middlebox s= oftware.

thanks,
Rob
--000000000000d4eab105915ce9cb-- From nobody Fri Aug 30 18:55:30 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6EAFE1207FC for ; Fri, 30 Aug 2019 14:25:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=portfast.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QRXKXp9_gXIv for ; Fri, 30 Aug 2019 14:25:31 -0700 (PDT) Received: from mail.portfast.net (mail.portfast.net [IPv6:2a03:9800:20:1::2]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1B41C120100 for ; Fri, 30 Aug 2019 14:25:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=portfast.net; s=dkim; h=Content-Transfer-Encoding:Content-Type:In-Reply-To: MIME-Version:Date:Message-ID:From:References:To:Subject:Sender:Reply-To:Cc: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=xWW3ckEDdlF2CwGJCTmomh0crk+OgSaXCQo/iMoAHIc=; b=JFGG+idvVFYAnO1VzVKiuqmXsz y5F45v7str+GesS4TMiA0DqN1EV5JCf04Sp7/OoIHjii85eC4qS8hvjZ3QWWrY0/ChtGxbOBq0q7u iXhm+Ek03OvAV4k1CxFFDRYR31iE+jHH7qBmGsLjU6QeVyIJ/U0cs2T5KPaNcCybqaCA=; Received: from [88.212.170.135] (port=64451 helo=Rays-MacBook-Pro.local) by mail.portfast.net ([188.246.200.9]:465) with esmtpsa (fixed_plain:ray@bellis.me.uk) (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) id 1i3oOf-0007No-5o (Exim 4.89) for add@ietf.org (return-path ); Fri, 30 Aug 2019 21:25:29 +0000 To: add@ietf.org References: <20190828174219.868DC8C67BB@ary.qy> <7981858d-1fe8-b6e4-5c06-d3be2628a01f@cs.tcd.ie> From: Ray Bellis Message-ID: <853be8d0-d301-9b53-1d26-9550aea26322@bellis.me.uk> Date: Fri, 30 Aug 2019 22:25:28 +0100 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: <7981858d-1fe8-b6e4-5c06-d3be2628a01f@cs.tcd.ie> Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-GB Content-Transfer-Encoding: 7bit Archived-At: X-Mailman-Approved-At: Fri, 30 Aug 2019 18:55:29 -0700 Subject: Re: [Add] policy and law, A thought -- Move the policy decisions outside the application. X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 30 Aug 2019 21:25:33 -0000 On 29/08/2019 21:36, Stephen Farrell wrote: > And when you go further and claim that "what they're > doing" makes them "advocates of pedophilia" - that > seems entirely out of order to me. It may be out of order, but it's exactly what has happened in the past. From September '96: "The Sunday, August 25 issue of the London Observer splashed across its front page a sensationalized account of child pornography on the Internet, falsely accusing two Internet Service Providers, Clive Feather of Demon UK (a full service site) and Johan Helsingius of anon.penet.fi (an anonymous remailer) of involvement in the distribution of child pornography. Why were these accusations made? Demon UK had refused to remove a broad range of sexually-oriented newsgroups identified by UK authorities as possible sources of child pornography, and anon.penet.fi was identified without substantiation as a source for `90% of child pornography on the Internet.'" I've also personally attended a meeting at the UK Home Office along with many other ISPs a couple of years after this happened where we were pretty much told "filter this, or we'll make sure you're the next ones on the front pages of the tabloid press". Ray From nobody Fri Aug 30 18:56:13 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A8698120108 for ; Fri, 30 Aug 2019 14:42:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.498 X-Spam-Level: X-Spam-Status: No, score=-2.498 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5pueZ7579XYI for ; Fri, 30 Aug 2019 14:42:48 -0700 (PDT) Received: from mx0a-00191d01.pphosted.com (mx0b-00191d01.pphosted.com [67.231.157.136]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1E80512001B for ; Fri, 30 Aug 2019 14:42:48 -0700 (PDT) Received: from pps.filterd (m0049462.ppops.net [127.0.0.1]) by m0049462.ppops.net-00191d01. (8.16.0.27/8.16.0.27) with SMTP id x7ULaJ8h028876; Fri, 30 Aug 2019 17:42:46 -0400 Received: from alpi154.enaf.aldc.att.com (sbcsmtp6.sbc.com [144.160.229.23]) by m0049462.ppops.net-00191d01. with ESMTP id 2uqb970xkd-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 30 Aug 2019 17:42:46 -0400 Received: from enaf.aldc.att.com (localhost [127.0.0.1]) by alpi154.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id x7ULgjQ1006491; Fri, 30 Aug 2019 17:42:45 -0400 Received: from zlp30483.vci.att.com (zlp30483.vci.att.com [135.47.91.189]) by alpi154.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id x7ULgfGm006441 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Fri, 30 Aug 2019 17:42:41 -0400 Received: from zlp30483.vci.att.com (zlp30483.vci.att.com [127.0.0.1]) by zlp30483.vci.att.com (Service) with ESMTP id 38B4B4014663; Fri, 30 Aug 2019 21:42:41 +0000 (GMT) Received: from GAALPA1MSGHUBAF.ITServices.sbc.com (unknown [130.8.218.155]) by zlp30483.vci.att.com (Service) with ESMTPS id 248384014661; Fri, 30 Aug 2019 21:42:41 +0000 (GMT) Received: from GAALPA1MSGUSRBF.ITServices.sbc.com ([169.254.5.177]) by GAALPA1MSGHUBAF.ITServices.sbc.com ([130.8.218.155]) with mapi id 14.03.0468.000; Fri, 30 Aug 2019 17:42:40 -0400 From: "STARK, BARBARA H" To: "'Rob Sayre'" CC: "'ADD Mailing list'" , "'John Levine'" Thread-Topic: [Add] policy and law, A thought -- Move the policy decisions outside the application. Thread-Index: AQHVXn2VPCyTIlDso0C6CUcvqIRRAKcS2P2AgAFV5oCAAAZCAA== Date: Fri, 30 Aug 2019 21:42:40 +0000 Message-ID: <2D09D61DDFA73D4C884805CC7865E6114E29338C@GAALPA1MSGUSRBF.ITServices.sbc.com> References: <20190828174219.868DC8C67BB@ary.qy> <7981858d-1fe8-b6e4-5c06-d3be2628a01f@cs.tcd.ie> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [130.10.201.122] Content-Type: multipart/alternative; boundary="_000_2D09D61DDFA73D4C884805CC7865E6114E29338CGAALPA1MSGUSRBF_" MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-08-30_08:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_policy_notspam policy=outbound_policy score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1011 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1906280000 definitions=main-1908300206 Archived-At: X-Mailman-Approved-At: Fri, 30 Aug 2019 18:56:11 -0700 Subject: Re: [Add] policy and law, A thought -- Move the policy decisions outside the application. X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 30 Aug 2019 21:42:51 -0000 --_000_2D09D61DDFA73D4C884805CC7865E6114E29338CGAALPA1MSGUSRBF_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 DQoNCkZyb206IEFkZCA8YWRkLWJvdW5jZXNAaWV0Zi5vcmc+IE9uIEJlaGFsZiBPZiBSb2IgU2F5 cmUNCk9uIFRodSwgQXVnIDI5LCAyMDE5IGF0IDQ6NDUgUE0gU3RlcGhlbiBGYXJyZWxsIDxzdGVw aGVuLmZhcnJlbGxAY3MudGNkLmllPG1haWx0bzpzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPj4g d3JvdGU6DQpPbiAyOC8wOC8yMDE5IDE4OjQyLCBKb2huIExldmluZSB3cm90ZToNCj4gVW50aWwg d2UgY2FuIGFkbWl0IHRoaXMgaXMgYSBiaWcgcHJvYmxlbSwgYW5kIHdlIGNhbid0IHdhdmUgb3Vy IGhhbmRzDQo+IGFuZCBzYXkgImNlbnNvcnNoaXAiIGFuZCBtYWtlIGl0IGdvIGF3YXksIHdlJ3Jl IG5vdCBnb2luZyB0byBtYWtlIGFueQ0KPiBwcm9ncmVzcy4NCg0KSSB0aGluayB0aGF0IHVudGls IHBlb3BsZSBkaXNjdXNzaW5nIHRoaXMgcmVzaXN0IHRoZQ0KdGVtcHRhdGlvbiB0byBwcmVzZW50 IHRvdGFsbHkgb25lLXNpZGVkIHBlcnNwZWN0aXZlcywNCg0KSXQgb2NjdXJyZWQgdG8gbWUgdGhh dCBtYW55IG9mIHRoZSBzYW1lIHVzZSBjYXNlcyBjYW1lIHVwIGluIEhUVFAvMidzIGFkb3B0aW9u IG9mIFRMUy4gVGhlIEhUVFAvMiBzcGVjIGRvZXNuJ3QgcmVxdWlyZSBUTFMsIGJ1dCBJIGRvbid0 IHRoaW5rIG1hbnkgY2xpZW50cyBzdXBwb3J0IGl0cyB1c2UgdW5lbmNyeXB0ZWQuDQo8aHR0cHM6 Ly9naXRodWIuY29tL2h0dHAyL2h0dHAyLXNwZWMvd2lraS9Qcm94eS1Vc2VyLVN0b3JpZXM8aHR0 cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX19naXRodWIu Y29tX2h0dHAyX2h0dHAyLTJEc3BlY193aWtpX1Byb3h5LTJEVXNlci0yRFN0b3JpZXMmZD1Ed01G YVEmYz1MRllaLW85X0hVTWVNVFNRaWN2aklnJnI9TG9HemhDLThzYzhTWThUcTR2cmZvZyZtPWc1 S2UwWXJTd0lqMmota0EwSE52ZDVqcWVPUmhaLTVJX2hBNUFjSkpXZDgmcz1fUDV1OEpHZnVlS3N1 Y09DV1ZwQm1xVllRckhPMW41X0ZLcm9yUGtYSzRJJmU9Pj4uIE5vdyB0aGF0IFRMUyBpcyBzbyBw cmV2YWxlbnQgb24gdGhlIHdlYiwgdGhlcmUgYXJlIG1hbnkgcHJveHkgaW1wbGVtZW50YXRpb25z IGFuZCBSRkNzIHRoYXQgYXJlIG5vIGxvbmdlciByZWxldmFudC4gSSBhbHNvIHdlbnQgYmFjayB0 byBjaGVjayBvdXQgdGhlIG1haWxpbmcgbGlzdCwgYW5kIHRoZSBkZWJhdGUgaXMgZWVyaWx5IHNp bWlsYXIuIDxodHRwczovL2xpc3RzLnczLm9yZy9BcmNoaXZlcy9QdWJsaWMvaWV0Zi1odHRwLXdn LzIwMTNPY3REZWMvdGhyZWFkLmh0bWwjbXNnMTM1NzxodHRwczovL3VybGRlZmVuc2UucHJvb2Zw b2ludC5jb20vdjIvdXJsP3U9aHR0cHMtM0FfX2xpc3RzLnczLm9yZ19BcmNoaXZlc19QdWJsaWNf aWV0Zi0yRGh0dHAtMkR3Z18yMDEzT2N0RGVjX3RocmVhZC5odG1sLTIzbXNnMTM1NyZkPUR3TUZh USZjPUxGWVotbzlfSFVNZU1UU1FpY3ZqSWcmcj1Mb0d6aEMtOHNjOFNZOFRxNHZyZm9nJm09ZzVL ZTBZclN3SWoyai1rQTBITnZkNWpxZU9SaFotNUlfaEE1QWNKSldkOCZzPXNoaVR4dkZXXzlSZE1R a3g2aU1abzBkdmNaYXBQSjU5TjVzV1JRUm1tRmsmZT0+Pg0KDQpJIHRoaW5rIHdoYXQncyBkaWZm ZXJlbnQgYWJvdXQgdGhpcyBkaXNjdXNzaW9uIGlzIHRoYXQgdGhlcmUgc2VlbSB0byBiZSBwZW9w bGUgYWR2b2NhdGluZyB0aGF0IGEgY2xpZW50IHNob3VsZCAqYWx3YXlzKiBsZXQgdGhlIG5ldHdv cmsgZGVjaWRlIHdoZXRoZXIgdG8gZW5jcnlwdCBETlMsIGFuZCB3aGVyZSB0byBzZW5kIHRoZSB0 cmFmZmljLi4gVGhpcyBzZWVtcyB1bnVzdWFsIGZvciB0aGUgSUVURi4gQW5kLCBhcyB3ZSd2ZSBk b2N1bWVudGVkLCB0aGVyZSBhcmUgYWxyZWFkeSBtYW55IGVhc3ktdG8tdXNlIHByb2R1Y3RzIHRo YXQgbWFrZSB2YXJpb3VzIGNob2ljZXMgYWJvdXQgRE5TIGVuY3J5cHRpb24gYW5kIGNob2ljZSBv ZiBzZXJ2ZXIuDQoNClRoZSBpc3N1ZSBzZWVtcyBjb250ZW50aW91cyBiZWNhdXNlIEROUyBpcyBv bmUgb2YgdGhlIGZldyByZW1haW5pbmcgY2xlYXIgdGV4dCBjb250cm9sIHBvaW50cywgYnV0IFJG QzcyNTggZG9lcyBzdGlsbCBzZWVtIHRvIGFwcGx5IDxodHRwczovL3Rvb2xzLmlldGYub3JnL2h0 bWwvcmZjNzI1ODxodHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0 cHMtM0FfX3Rvb2xzLmlldGYub3JnX2h0bWxfcmZjNzI1OCZkPUR3TUZhUSZjPUxGWVotbzlfSFVN ZU1UU1FpY3ZqSWcmcj1Mb0d6aEMtOHNjOFNZOFRxNHZyZm9nJm09ZzVLZTBZclN3SWoyai1rQTBI TnZkNWpxZU9SaFotNUlfaEE1QWNKSldkOCZzPTNNTS1VUDNneEtQbDZvbklQM3hvaXdUSmFUV1VW YkN2RGVxcDd4b2dRSlkmZT0+Pi4NCg0KdGhhbmtzLA0KUm9iDQoNCjxiaHM+IEkgaGF2ZW7igJl0 IHNlZW4gbWFzc2l2ZSBvdXRjcnkgYWdhaW5zdCBlbmNyeXB0aW9uIG9mIEROUy4gVGhhdOKAmXMg bm90IHRoZSBpc3N1ZS4gUGxlYXNlIHN0b3Agc2F5aW5nIGl0IGlzLiBNYW55IElTUHMgYXJlIHNl cmlvdXNseSBsb29raW5nIGF0IGJvdGggRG9UIGFuZCBEb0guIENvbnRpbnVpbmcgdG8gY2xhaW0g cGVvcGxlIGFyZSBzYXlpbmcgc29tZXRoaW5nIHRoZXkgYXJlbuKAmXQgc2F5aW5nIGlzIG5vdCBi ZW5lZmljaWFsIHRvIHRoZSBkaXNjdXNzaW9uLg0KQmFyYmFyYQ0KDQo= --_000_2D09D61DDFA73D4C884805CC7865E6114E29338CGAALPA1MSGUSRBF_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 V2luZ2RpbmdzOw0KCXBhbm9zZS0xOjUgMCAwIDAgMCAwIDAgMCAwIDA7fQ0KQGZvbnQtZmFjZQ0K CXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2IDMg MiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToyIDE1 IDUgMiAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWws IGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0 b206LjAwMDFwdDsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixz YW5zLXNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXByaW9y aXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQphOnZp c2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5 Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCnAuTXNvTGlz dFBhcmFncmFwaCwgbGkuTXNvTGlzdFBhcmFncmFwaCwgZGl2Lk1zb0xpc3RQYXJhZ3JhcGgNCgl7 bXNvLXN0eWxlLXByaW9yaXR5OjM0Ow0KCW1hcmdpbi10b3A6MGluOw0KCW1hcmdpbi1yaWdodDow aW47DQoJbWFyZ2luLWJvdHRvbTowaW47DQoJbWFyZ2luLWxlZnQ6LjVpbjsNCgltYXJnaW4tYm90 dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIs c2Fucy1zZXJpZjt9DQpwLm1zb25vcm1hbDAsIGxpLm1zb25vcm1hbDAsIGRpdi5tc29ub3JtYWww DQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCgltc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsN CgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvOw0KCW1hcmdp bi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixz YW5zLXNlcmlmO30NCnNwYW4uRW1haWxTdHlsZTE4DQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFs LXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOndpbmRv d3RleHQ7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJ Zm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJ e3NpemU6OC41aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBpbiAxLjBpbiAxLjBpbiAxLjBpbjt9DQpk aXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi8qIExpc3QgRGVmaW5pdGlv bnMgKi8NCkBsaXN0IGwwDQoJe21zby1saXN0LWlkOjE3MDcyODc1MDI7DQoJbXNvLWxpc3QtdHlw ZTpoeWJyaWQ7DQoJbXNvLWxpc3QtdGVtcGxhdGUtaWRzOjE0NjcyNTMwNTggLTEyMzkzNzcxNDIg Njc2OTg2OTEgNjc2OTg2OTMgNjc2OTg2ODkgNjc2OTg2OTEgNjc2OTg2OTMgNjc2OTg2ODkgNjc2 OTg2OTEgNjc2OTg2OTM7fQ0KQGxpc3QgbDA6bGV2ZWwxDQoJe21zby1sZXZlbC1udW1iZXItZm9y bWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDotOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25l Ow0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgltYXJnaW4tbGVmdDoyMC4yNXB0 Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJp ZjsNCgltc28tZmFyZWFzdC1mb250LWZhbWlseTpDYWxpYnJpO30NCkBsaXN0IGwwOmxldmVsMg0K CXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6bzsNCglt c28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7 DQoJbWFyZ2luLWxlZnQ6NTYuMjVwdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1p bHk6IkNvdXJpZXIgTmV3Ijt9DQpAbGlzdCBsMDpsZXZlbDMNCgl7bXNvLWxldmVsLW51bWJlci1m b3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6 bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJbWFyZ2luLWxlZnQ6OTIu MjVwdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBs aXN0IGwwOmxldmVsNA0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxl dmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1i ZXItcG9zaXRpb246bGVmdDsNCgltYXJnaW4tbGVmdDoxMjguMjVwdDsNCgl0ZXh0LWluZGVudDot LjI1aW47DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwwOmxldmVsNQ0KCXttc28tbGV2 ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6bzsNCgltc28tbGV2ZWwt dGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJbWFyZ2lu LWxlZnQ6MTY0LjI1cHQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OiJDb3Vy aWVyIE5ldyI7fQ0KQGxpc3QgbDA6bGV2ZWw2DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1 bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJ bXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCW1hcmdpbi1sZWZ0OjIwMC4yNXB0Ow0K CXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDA6 bGV2ZWw3DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4 dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3Np dGlvbjpsZWZ0Ow0KCW1hcmdpbi1sZWZ0OjIzNi4yNXB0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsN Cglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3QgbDA6bGV2ZWw4DQoJe21zby1sZXZlbC1udW1i ZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDpvOw0KCW1zby1sZXZlbC10YWItc3Rv cDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgltYXJnaW4tbGVmdDoy NzIuMjVwdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3 Ijt9DQpAbGlzdCBsMDpsZXZlbDkNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0K CW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2 ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJbWFyZ2luLWxlZnQ6MzA4LjI1cHQ7DQoJdGV4dC1p bmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpvbA0KCXttYXJnaW4tYm90 dG9tOjBpbjt9DQp1bA0KCXttYXJnaW4tYm90dG9tOjBpbjt9DQotLT48L3N0eWxlPjwhLS1baWYg Z3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVkZWZhdWx0cyB2OmV4dD0iZWRpdCIgc3BpZG1heD0i MTAyNiIgLz4NCjwveG1sPjwhW2VuZGlmXS0tPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86 c2hhcGVsYXlvdXQgdjpleHQ9ImVkaXQiPg0KPG86aWRtYXAgdjpleHQ9ImVkaXQiIGRhdGE9IjEi IC8+DQo8L286c2hhcGVsYXlvdXQ+PC94bWw+PCFbZW5kaWZdLS0+DQo8L2hlYWQ+DQo8Ym9keSBs YW5nPSJFTi1VUyIgbGluaz0iYmx1ZSIgdmxpbms9InB1cnBsZSI+DQo8ZGl2IGNsYXNzPSJXb3Jk U2VjdGlvbjEiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXYgc3R5bGU9ImJv cmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkIGJsdWUgMS41cHQ7cGFkZGluZzowaW4gMGluIDBp biA0LjBwdCI+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPkZyb206PC9i PiBBZGQgJmx0O2FkZC1ib3VuY2VzQGlldGYub3JnJmd0OyA8Yj5PbiBCZWhhbGYgT2YgPC9iPg0K Um9iIFNheXJlPGJyPg0KT24gVGh1LCBBdWcgMjksIDIwMTkgYXQgNDo0NSBQTSBTdGVwaGVuIEZh cnJlbGwgJmx0OzxhIGhyZWY9Im1haWx0bzpzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllIj5zdGVw aGVuLmZhcnJlbGxAY3MudGNkLmllPC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29s aWQgI0NDQ0NDQyAxLjBwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0O21hcmdpbi1sZWZ0OjQu OHB0O21hcmdpbi1yaWdodDowaW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+T24gMjgvMDgvMjAx OSAxODo0MiwgSm9obiBMZXZpbmUgd3JvdGU6PGJyPg0KJmd0OyBVbnRpbCB3ZSBjYW4gYWRtaXQg dGhpcyBpcyBhIGJpZyBwcm9ibGVtLCBhbmQgd2UgY2FuJ3Qgd2F2ZSBvdXIgaGFuZHM8YnI+DQom Z3Q7IGFuZCBzYXkgJnF1b3Q7Y2Vuc29yc2hpcCZxdW90OyBhbmQgbWFrZSBpdCBnbyBhd2F5LCB3 ZSdyZSBub3QgZ29pbmcgdG8gbWFrZSBhbnk8YnI+DQomZ3Q7IHByb2dyZXNzLjxicj4NCjxicj4N CkkgdGhpbmsgdGhhdCB1bnRpbCBwZW9wbGUgZGlzY3Vzc2luZyB0aGlzIHJlc2lzdCB0aGU8YnI+ DQp0ZW1wdGF0aW9uIHRvIHByZXNlbnQgdG90YWxseSBvbmUtc2lkZWQgcGVyc3BlY3RpdmVzLDxv OnA+PC9vOnA+PC9wPg0KPC9ibG9ja3F1b3RlPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+SXQgb2NjdXJyZWQgdG8gbWUgdGhhdCBtYW55IG9mIHRoZSBzYW1lIHVzZSBjYXNlcyBjYW1l IHVwIGluIEhUVFAvMidzIGFkb3B0aW9uIG9mIFRMUy4gVGhlIEhUVFAvMiBzcGVjIGRvZXNuJ3Qg cmVxdWlyZSBUTFMsIGJ1dCBJIGRvbid0IHRoaW5rIG1hbnkgY2xpZW50cyBzdXBwb3J0IGl0cyB1 c2UgdW5lbmNyeXB0ZWQuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj4mbHQ7PGEgaHJlZj0iaHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29t L3YyL3VybD91PWh0dHBzLTNBX19naXRodWIuY29tX2h0dHAyX2h0dHAyLTJEc3BlY193aWtpX1By b3h5LTJEVXNlci0yRFN0b3JpZXMmYW1wO2Q9RHdNRmFRJmFtcDtjPUxGWVotbzlfSFVNZU1UU1Fp Y3ZqSWcmYW1wO3I9TG9HemhDLThzYzhTWThUcTR2cmZvZyZhbXA7bT1nNUtlMFlyU3dJajJqLWtB MEhOdmQ1anFlT1JoWi01SV9oQTVBY0pKV2Q4JmFtcDtzPV9QNXU4SkdmdWVLc3VjT0NXVnBCbXFW WVFySE8xbjVfRktyb3JQa1hLNEkmYW1wO2U9Ij5odHRwczovL2dpdGh1Yi5jb20vaHR0cDIvaHR0 cDItc3BlYy93aWtpL1Byb3h5LVVzZXItU3RvcmllczwvYT4mZ3Q7Lg0KIE5vdyB0aGF0IFRMUyBp cyBzbyBwcmV2YWxlbnQgb24gdGhlIHdlYiwgdGhlcmUgYXJlIG1hbnkgcHJveHkgaW1wbGVtZW50 YXRpb25zIGFuZCBSRkNzIHRoYXQgYXJlIG5vIGxvbmdlciByZWxldmFudC4gSSBhbHNvIHdlbnQg YmFjayB0byBjaGVjayBvdXQgdGhlIG1haWxpbmcgbGlzdCwgYW5kIHRoZSBkZWJhdGUgaXMgZWVy aWx5IHNpbWlsYXIuICZsdDs8YSBocmVmPSJodHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5j b20vdjIvdXJsP3U9aHR0cHMtM0FfX2xpc3RzLnczLm9yZ19BcmNoaXZlc19QdWJsaWNfaWV0Zi0y RGh0dHAtMkR3Z18yMDEzT2N0RGVjX3RocmVhZC5odG1sLTIzbXNnMTM1NyZhbXA7ZD1Ed01GYVEm YW1wO2M9TEZZWi1vOV9IVU1lTVRTUWljdmpJZyZhbXA7cj1Mb0d6aEMtOHNjOFNZOFRxNHZyZm9n JmFtcDttPWc1S2UwWXJTd0lqMmota0EwSE52ZDVqcWVPUmhaLTVJX2hBNUFjSkpXZDgmYW1wO3M9 c2hpVHh2RldfOVJkTVFreDZpTVpvMGR2Y1phcFBKNTlONXNXUlFSbW1GayZhbXA7ZT0iPmh0dHBz Oi8vbGlzdHMudzMub3JnL0FyY2hpdmVzL1B1YmxpYy9pZXRmLWh0dHAtd2cvMjAxM09jdERlYy90 aHJlYWQuaHRtbCNtc2cxMzU3PC9hPiZndDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SSB0aGluayB3aGF0J3MgZGlmZmVyZW50IGFib3V0IHRo aXMgZGlzY3Vzc2lvbiBpcyB0aGF0IHRoZXJlIHNlZW0gdG8gYmUgcGVvcGxlIGFkdm9jYXRpbmcg dGhhdCBhIGNsaWVudCBzaG91bGQgKmFsd2F5cyogbGV0IHRoZSBuZXR3b3JrIGRlY2lkZSB3aGV0 aGVyIHRvIGVuY3J5cHQgRE5TLCBhbmQgd2hlcmUgdG8gc2VuZCB0aGUgdHJhZmZpYy4uIFRoaXMg c2VlbXMgdW51c3VhbCBmb3IgdGhlIElFVEYuIEFuZCwNCiBhcyB3ZSd2ZSBkb2N1bWVudGVkLCB0 aGVyZSBhcmUgYWxyZWFkeSBtYW55IGVhc3ktdG8tdXNlIHByb2R1Y3RzIHRoYXQgbWFrZSB2YXJp b3VzIGNob2ljZXMgYWJvdXQgRE5TIGVuY3J5cHRpb24gYW5kIGNob2ljZSBvZiBzZXJ2ZXIuPG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZu YnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlRoZSBp c3N1ZSBzZWVtcyBjb250ZW50aW91cyBiZWNhdXNlIEROUyBpcyBvbmUgb2YgdGhlIGZldyByZW1h aW5pbmcgY2xlYXIgdGV4dCBjb250cm9sIHBvaW50cywgYnV0IFJGQzcyNTggZG9lcyBzdGlsbCBz ZWVtIHRvIGFwcGx5ICZsdDs8YSBocmVmPSJodHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5j b20vdjIvdXJsP3U9aHR0cHMtM0FfX3Rvb2xzLmlldGYub3JnX2h0bWxfcmZjNzI1OCZhbXA7ZD1E d01GYVEmYW1wO2M9TEZZWi1vOV9IVU1lTVRTUWljdmpJZyZhbXA7cj1Mb0d6aEMtOHNjOFNZOFRx NHZyZm9nJmFtcDttPWc1S2UwWXJTd0lqMmota0EwSE52ZDVqcWVPUmhaLTVJX2hBNUFjSkpXZDgm YW1wO3M9M01NLVVQM2d4S1BsNm9uSVAzeG9pd1RKYVRXVVZiQ3ZEZXFwN3hvZ1FKWSZhbXA7ZT0i Pmh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9yZmM3MjU4PC9hPiZndDsuPG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPnRoYW5rcyw8bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlJvYjxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8 L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbHQ7YmhzJmd0 OyBJIGhhdmVu4oCZdCBzZWVuIG1hc3NpdmUgb3V0Y3J5IGFnYWluc3QgZW5jcnlwdGlvbiBvZiBE TlMuIFRoYXTigJlzIG5vdCB0aGUgaXNzdWUuIFBsZWFzZSBzdG9wIHNheWluZyBpdCBpcy4gTWFu eSBJU1BzIGFyZSBzZXJpb3VzbHkgbG9va2luZyBhdCBib3RoIERvVCBhbmQgRG9ILiBDb250aW51 aW5nIHRvIGNsYWltIHBlb3BsZSBhcmUgc2F5aW5nIHNvbWV0aGluZyB0aGV5IGFyZW7igJl0IHNh eWluZyBpcyBub3QNCiBiZW5lZmljaWFsIHRvIHRoZSBkaXNjdXNzaW9uLjxvOnA+PC9vOnA+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+QmFyYmFyYTxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+ DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ib2R5Pg0KPC9odG1sPg0K --_000_2D09D61DDFA73D4C884805CC7865E6114E29338CGAALPA1MSGUSRBF_-- From nobody Fri Aug 30 18:57:32 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 86910120091 for ; Fri, 30 Aug 2019 16:01:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.702 X-Spam-Level: X-Spam-Status: No, score=0.702 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, GUARANTEED_100_PERCENT=2.699, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gftQRnhTU8vW for ; Fri, 30 Aug 2019 16:01:08 -0700 (PDT) Received: from mail-vk1-xa44.google.com (mail-vk1-xa44.google.com [IPv6:2607:f8b0:4864:20::a44]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7853A120073 for ; Fri, 30 Aug 2019 16:01:08 -0700 (PDT) Received: by mail-vk1-xa44.google.com with SMTP id b184so1879854vkh.2 for ; Fri, 30 Aug 2019 16:01:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=5FEFNoxXnyLJ1758zu+CGxFINxnUq72WAVPZM2JWRaI=; b=mPV66zRuDJV9KhO9usLdg6iIPEt7wF7fjcprLbDcF+XnkB7tkkBZtC32Ai6qO7+xaF SzzhLC+cVEMIqDjPqawnMzj9vodkL8Bo95MXO4CsYDHXg9vDu2PGF/bHifSK2TjZ7sfO /OYnG+KRamkZXLGFe2V+zV744+9BZwI6YaS25GNRG0Y1xF3zoXQtuonFMti+Hr6Myp3z TfftFOf24d2A6m/2oq3TOnYzdq2DJgbqfnp8h9+VsWLceazG4QIOvV8mMEuZneEpnID8 ugKmDbS9m8pVVpktLttq7l1Oet0NW0EdqNZHFKyp4EAv7IG7M5dEkMZbOVxxhOipYLqm F8vQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=5FEFNoxXnyLJ1758zu+CGxFINxnUq72WAVPZM2JWRaI=; b=IWjyw37alN5uSYcRbZ/May7dmkzBqkgEO8AQtBTB69mYC0//csu5i26fhMXHo7Swbu 106aDXq6w55mVMLezOP1vAeHbi42rf5IG0Btt1GuR/mha0kqlHZsUP9wcpWSYm9ysSks Z6J2M8ORNq+fImo1yxTRw1ruaX5prixNgEsYqOcQhcldq+n0Wzzl2QgN9tnHLwXKExaD lUgo92Ty4GMc65cUb0kNFwqzmo95ZnNyvXNoL2Y265G8N4vPt6s4DX0ZaCv2y1Fnmy16 sZOpl3DLq0LeNBBYQ0cqioZj8OIPc5708xE6eWzn6z5INbDI73cVygUuFV96ySqiccav l+1A== X-Gm-Message-State: APjAAAW8ktxJcR5rQJW0hsp6dBnlZtvv8fsxPSmrnVcY2n/dsLrZ8GyV vETpXsY1EOOtO2v1/uUCaUX7X8Ish5gGSGVPxR8= X-Google-Smtp-Source: APXvYqyDb8sIZNpZSGsyc0usfI8Oxp27OXikeOLdvvtb8xeCnZ9NGwRwUfHE7Z4s8hTzRZRf+p2cbEEQucG8BxjBoD0= X-Received: by 2002:a1f:5185:: with SMTP id f127mr9443763vkb.52.1567206067549; Fri, 30 Aug 2019 16:01:07 -0700 (PDT) MIME-Version: 1.0 References: <20190828174219.868DC8C67BB@ary.qy> <7981858d-1fe8-b6e4-5c06-d3be2628a01f@cs.tcd.ie> In-Reply-To: From: Brian Dickson Date: Fri, 30 Aug 2019 16:00:55 -0700 Message-ID: To: Rob Sayre Cc: Stephen Farrell , ADD Mailing list , John Levine Content-Type: multipart/alternative; boundary="000000000000f23b5005915d98fb" Archived-At: X-Mailman-Approved-At: Fri, 30 Aug 2019 18:57:31 -0700 Subject: Re: [Add] policy and law, A thought -- Move the policy decisions outside the application. X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 30 Aug 2019 23:01:11 -0000 --000000000000f23b5005915d98fb Content-Type: text/plain; charset="UTF-8" On Fri, Aug 30, 2019 at 2:00 PM Rob Sayre wrote: > On Thu, Aug 29, 2019 at 4:45 PM Stephen Farrell > wrote: > >> On 28/08/2019 18:42, John Levine wrote: >> > Until we can admit this is a big problem, and we can't wave our hands >> > and say "censorship" and make it go away, we're not going to make any >> > progress. >> >> I think that until people discussing this resist the >> temptation to present totally one-sided perspectives, >> > > It occurred to me that many of the same use cases came up in HTTP/2's > adoption of TLS. The HTTP/2 spec doesn't require TLS, but I don't think > many clients support its use unencrypted. > . Now that > TLS is so prevalent on the web, there are many proxy implementations and > RFCs that are no longer relevant. I also went back to check out the mailing > list, and the debate is eerily similar. < > https://lists.w3.org/Archives/Public/ietf-http-wg/2013OctDec/thread.html#msg1357 > > > > I think what's different about this discussion is that there seem to be > people advocating that a client should *always* let the network decide > whether to encrypt DNS, and where to send the traffic.. > There are nuances involved in what I'm advocating. I can't speak for anyone else, but I can attempt to explain them better than I might have previously. It basically falls into a privilege model, or privilege escalation perhaps, or a permissions model at least. Here is what I'm advocating: - Networks should be able to restrict IP addresses (and possibly names), as well as port numbers, for outbound connections from hosts. - The operative phrase is "be able to". This does not mandate that they do so, only that they should have the ability to over-ride host activity that runs afoul of whatever the network's policy is. - DNS resolution (e.g. client selection of provider and transport) should abide by the network's desire to enforce any such policies. In some (many?) environments, if the network does not have a policy or is liberal in its policy, this would be compatible with hosts using whatever DNS resolver and whatever protocol they wish. I am also an advocate of a bunch of other things related to the above: - ISPs should be regulated according to "network neutrality" principles, with Internet access being treated as an essential service - Encrypted DNS should NOT be blocked to any destination where unencrypted DNS isn't also blocked ("no downgrade attacks") - The presumption that users have a choice of ISPs is no longer universally valid - The "coffee shop" is not an ISP per se, and can have Ts & Cs to that effect - The "coffee shop" experience is a take it or leave it situation, presumably where the customer can choose not to use the network offered - The regulators for a given jurisdiction should govern ISP behavior with respect to DNS in a public, transparent fashion - E.g. regulators could provide a list of IPs and ports that must NOT be blocked (e.g. DNS public recursives that comply with jurisdiction-specific policies). - Those lists should be public. - The onus would be on the regulators to keep those lists current. - ISPs should use only the same lists as publicly published. - Obviously, discovery/publication is a huge problem to achieve scalable interoperability between client OS or app software, and DNS provider selection - Generally, the scope of ISPs and regulators should be in rough alignment - Management of ISPs' DNS white-lists would likely be through provisioning systems, ideally compatible with automation - Bypassing any enforcement mechanisms in use by network operators, should only be done with informed user consent, since doing so may have consequences. > This seems unusual for the IETF. And, as we've documented, there are > already many easy-to-use products that make various choices about DNS > encryption and choice of server. > > The issue seems contentious because DNS is one of the few remaining clear > text control points, but RFC7258 does still seem to apply < > https://tools.ietf.org/html/rfc7258>. > I think this isn't as cut-and-dry as it might seem, at least when comparing DNS and HTTPS. HTTPS is end-to-end, client to (content) server. End-to-end encryption between the client (which originates the connection) and the *correct* server is strictly necessary to prevent monitoring by any third party. The only current methods of assuring the client that the *correct* server is the far end of the connection, IMHO requires the following: - Publishing A/AAAA records in DNS with a chain of trust back to the root of the DNS, protected with DNSSEC. - Use of TLS 1.2 (or above) - Publishing TLSA records to protect the TLS certificate (which requires DNSSEC) - Client validation for DNSSEC Without all of this, there exists an attack surface against the client connection, which includes the TLS certificate (e.g. rogue CA), the resolver (without regard to client-resolver encrypted transport), and the DNS data (if not DNSSEC signed). Yes, encrypted transport from the client to resolver adds privacy, but without the four elements above, the desired result (protection against pervasive monitoring) is unfortunately not 100% guaranteed. I.e. DoH/DoT may be necessary, but is definitely not sufficient by itself. Brian --000000000000f23b5005915d98fb Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Fri, Aug 30, 2019 at 2:00 PM Rob S= ayre <sayrer@gmail.com> wrote= :
On Thu, Aug 29, 2019 at 4:45 PM Stephen Farrell <stephen.farrell= @cs.tcd.ie> wrote:
On 28/08/2019 18:42, John Levine wrote:
> Until we can admit this is a big problem, and we can't wave our ha= nds
> and say "censorship" and make it go away, we're not goin= g to make any
> progress.

I think that until people discussing this resist the
temptation to present totally one-sided perspectives,
=
It occurred to me that many of the same use cases came up in= HTTP/2's adoption of TLS. The HTTP/2 spec doesn't require TLS, but= I don't think many clients support its use unencrypted.

I think what&#= 39;s different about this discussion is that there seem to be people advoca= ting that a client should *always* let the network decide whether to encryp= t DNS, and where to send the traffic..
=
There are nuances involved in what I'm advocating. I can= 't speak for anyone else, but I can attempt to explain them better than= I might have previously.

It basically falls into = a privilege model, or privilege escalation perhaps, or a permissions model = at least.

Here is what I'm advocating:
  • Networks should be able to restrict IP addresses (and possibly n= ames), as well as port numbers, for outbound connections from hosts.
    • The operative phrase is "be able to". This does not mandate tha= t they do so, only that they should have the ability to over-ride host acti= vity that runs afoul of whatever the network's policy is.
  • DNS r= esolution (e.g. client selection of provider and transport) should abide by= the network's desire to enforce any such policies.

In some (many?) environments, if the network does not have = a policy or is liberal in its policy, this would be compatible with hosts u= sing whatever DNS resolver and whatever protocol they wish.

<= /div>
I am also an advocate of a bunch of other things related to the a= bove:
  • ISPs should be regulated according to "network= neutrality" principles, with Internet access being treated as an esse= ntial service
    • Encrypted DNS should NOT be blocked to any destin= ation where unencrypted DNS isn't also blocked ("no downgrade atta= cks")
  • The presumption that users have a choice of ISPs is= no longer universally valid
  • The "coffee shop" is not an = ISP per se, and can have Ts & Cs to that effect
  • The "coffe= e shop" experience is a take it or leave it situation, presumably wher= e the customer can choose not to use the network offered
  • The regula= tors for a given jurisdiction should govern ISP behavior with respect to DN= S in a public, transparent fashion
    • E.g.=C2=A0 regulators could = provide a list of IPs and ports that must NOT be blocked (e.g. DNS public r= ecursives that comply with jurisdiction-specific policies).
      • Tho= se lists should be public.
      • The onus would be on the regulators to k= eep those lists current.
      • ISPs should use only the same lists as pub= licly published.
      • Obviously, discovery/publication is a huge problem= to achieve scalable interoperability between client OS or app software, an= d DNS provider selection
    • Generally, the scope of ISPs and regu= lators should be in rough alignment
    • Management of ISPs' DNS whi= te-lists would likely be through provisioning systems, ideally compatible w= ith automation
  • Bypassing any enforcement mechanisms in use by = network operators, should only be done with informed user consent, since do= ing so may have consequences.
=C2=A0
This seems unusual for the IETF. And, as we've documented, t= here are already many easy-to-use products that make various choices about = DNS encryption and choice of server.

The issue see= ms contentious because DNS is one of the few remaining clear text control p= oints, but RFC7258 does still seem to apply <https://tools.ietf.org/html/rfc7258<= /a>>.




--000000000000f23b5005915d98fb-- From nobody Sat Aug 31 06:42:19 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D5CB21200B4 for ; Sat, 31 Aug 2019 06:12:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=open-xchange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id srGWpAeiHpQX for ; Sat, 31 Aug 2019 06:12:09 -0700 (PDT) Received: from mx4.open-xchange.com (alcatraz.open-xchange.com [87.191.39.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4326B120018 for ; Sat, 31 Aug 2019 06:12:09 -0700 (PDT) Received: from open-xchange.com (imap.open-xchange.com [10.20.30.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx4.open-xchange.com (Postfix) with ESMTPS id C79676A268; Sat, 31 Aug 2019 15:12:06 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=open-xchange.com; s=201705; t=1567257126; bh=SqhtgCjUEXD97FCWjQiv0zwTtUXtL7m/sfhYS0NtfeI=; h=Date:From:Reply-To:To:In-Reply-To:References:Subject:From; b=1t8b0YwhPRqTQxtmZXrU8o2t7tUaSKQMOBWbVZhIuFluXyhMdhb/rlDkQTxDhOWHV jKwLlDarTxfoTM38ejnx5vDTzd8iesR3VUlvm6A7q2nFCuegSy43a3tRLD8uoy3ixF YmBl1bsgWEm8H03GvntXdG3ySAO7Vz4MlNnKDnq4EH5IpCmhxk0Wm8yYYnBi+Hjydj g8IdKPDxPlAk1Z8oZWxLAP6z3ZDvvXXfdIfG+YQTocZfJOuHnGYpUTJc2WweVpQR78 NhWTav86AsLrierCdchDLUxfj204ZKFThqrYaFgSigp6wxEO8krMKy9gMzl8vhm5SR HITla0cpD9hZw== Received: from appsuite-gw2.open-xchange.com (appsuite-gw2.open-xchange.com [10.20.28.82]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by open-xchange.com (Postfix) with ESMTPSA id AB5CA3C0345; Sat, 31 Aug 2019 15:12:06 +0200 (CEST) Date: Sat, 31 Aug 2019 15:12:06 +0200 (CEST) From: Vittorio Bertola Reply-To: Vittorio Bertola To: John Levine , add@ietf.org Message-ID: <647893686.5009.1567257126604@appsuite-gw2.open-xchange.com> In-Reply-To: <20190831033727.F3339914582@ary.qy> References: <115643803.6195.1567160913442@appsuite-gw1.open-xchange.com> <20190831033727.F3339914582@ary.qy> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Priority: 3 Importance: Medium X-Mailer: Open-Xchange Mailer v7.10.2-Rev11 X-Originating-Client: open-xchange-appsuite Autocrypt: addr=vittorio.bertola@open-xchange.com; prefer-encrypt=mutual; keydata= mQENBFhFR+UBCACfoywFKBRfzasiiR9/6dwY36eLePXcdScumDMR8qoXvRS55QYDjp5bs+yMq41qWV9 xp/cqryY9jnvHbeF3TsE5yEazpD1dleRbkpElUBpPwXqkrSP8uXO9KkS9KoX6gdml6M4L+F82WpqYC1 uTzOE6HPmhmQ4cGSgoia2jolxAhRpzoYN99/BwpvoZeTSLP5K6yPlMPYkMev/uZlAkMMhelli9IN6yA yxcC0AeHSnOAcNKUr13yXyMlTyi1cdMJ4sk88zIbefxwg3PAtYjkz3wgvP96cNVwAgSt4+j/ZuVaENP pgVuM512m051j9SlspWDHtzrci5pBKKFsibnTelrABEBAAG0NUJlcnRvbGEsIFZpdHRvcmlvIDx2aXR 0b3Jpby5iZXJ0b2xhQG9wZW4teGNoYW5nZS5jb20+iQFABBMBAgAqBAsJCAcGFQoJCAsCBRYCAwEAAp 4BAhsDBYkSzAMABQMAAAAABYJYRUflAAoJEIU2cHmzj8qNaG0H/ROY+suCP86hoN+9RIV66Ej8b3sb8 UgwFJOJMupZfeb9yTIJwE4VQT5lTt146CcJJ5jvxD6FZn1Htw9y4/45pPAF7xLE066jg3OqRvzeWRZ3 IDUfJJIiM5YGk1xWxDqppSwhnKcMOuI72iioWxX0nGQrWxpnWJsjt08IEEwuYucDkul1PHsrLJbTd58 fiMKLVwag+IE1SPHOwkPF6arZQZIfB5ThtOZV+36Jn8Hok9XfeXWBVyPkiWCQYVX39QsIbr0JNR9kQy 4g2ZFexOcTe8Jo12jPRL7V8OqStdDes3cje9lWFLnX05nrfLuE0l0JKWEg8akN+McFXc+oV68h7nu5A Q0EWEVH5QEIAIDKanNBe1uRfk8AjLirflZO291VNkOAeUu+dIhecGnZeQW6htlDinlYOnXhtsY1mK9W PUu+xshDq7lXn2G0LxldYwyJYZaJtDgIKqVqwxfA34Lj27oqPuXwcvGhdCgt0SW/YcalRdAi0/AzUCu 5GSaj2kaGUSnBYYUP4szGJXjaK2psP5toQSCtx2pfSXQ6MaqPK9Zzy+D5xc6VWQRp/iRImodAcPf8fg JJvRyJ8Jla3lKWyvBBzJDg6MOf6Fts78bJSt23X0uPp93g7GgbYkuRMnFI4RGoTVkxjD/HBEJ0CNg22 hoHJondhmKnZVrHEluFuSnW0wBEIYomcPSPB+cAEQEAAYkBMQQYAQIAGwUCWEVH5QIbDAQLCQgHBhUK CQgLAgUJEswDAAAKCRCFNnB5s4/KjdO8B/wNpvWtOpLdotR/Xh4fu08Fd63nnNfbIGIETWsVi0Sbr8i E5duuGaaWIcMmUvgKe/BM0Fpj9X01Zjm90uoPrlVVuQWrf+vFlbalUYVZr51gl5UyUFHk+iAZCAA0WB rsmACKvuV1P7GuiX3UV9b59T9taYJxN3dNFuftrEuvsqHimFtlekUjUwoCekTJdncFusBhwz2OrKhHr WWrEsXkfh0+pURWYAlKlTxvXuI7gAfHEQM+6OnrWvXYtlhd0M1sBPnCjbyG63Qws7Rek9bEWKtH6dA6 dmT2FQT+g1S9Mdf0WkPTQNX0x24dm8IoHuD3KYwX7Svx43Xa17aZnXqUjtj1 Archived-At: X-Mailman-Approved-At: Sat, 31 Aug 2019 06:42:17 -0700 Subject: Re: [Add] policy and law, A thought -- Move the policy decisions outside the application. X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 31 Aug 2019 13:12:11 -0000 > Il 31 agosto 2019 05:37 John Levine ha scritto: > > I was with you until that last clause. The modern Internet is > unusable without content filtering, the distinction between filtering > and censorship is a purely political one, and the IETF is terrible at > politics. (I say this as someone who spent a decade in political > elective office, long enough to get elected many times and to realize > I wasn't very good at it.) +1 for "the IETF is terrible at politics", and even at understanding basic Internet governance principles such as "stakeholder groups" and "sovereignty". (I'm trying to hide from posterity my past role in the ascent of the current populist ruling party in Italy, but it was a very instructive experience as well, though it ended in disaster.) > It's fine to design a system that can cooperate with controls, or can > not cooperate with controls, but it is asking for trouble to actively > circumvent controls. That's setting us up for a largely political > battle against people who are much better at it than we are, fought on > turf we do not control. I agree, but I sympathize with people trying to fight for their rights in oppressive regimes, and since Mozilla and others seem so attached to the idea of fighting that battle, I don't think we should be telling them that they shouldn't. So it's fine if they want to work on instruments to circumvent censorship, but of course only if they don't break the rest of the Internet in the meantime, including circumventing other controls. Moreover, they bear any legal consequence of their actions, and it's on them to find how to tell "censorship" from normal content control; if you remember, this thread started exactly because I asked Adam Roach how do they plan to do that, and it was not a rhetorical question. However, I'd still advise them that changing politics and law in a country (which is an entirely inappropriate objective for the IETF, but not for a private organization like Mozilla, if they so want) is not a technical problem, but a cultural one. Government arrangements, even the most authoritarian ones, are largely a consequence of the mindset and culture of their societies; many places that in the West are called "undemocratic" simply never had an illuminist revolution that made certain concepts popular, and have been governed by a supreme ruler since history exists, just changing the title from "Emperor" to "Party Secretary" or "President". Trying to force political changes through technology is an attractive shortcut, but it does not lead to true results; a change of culture inside society is necessary for that. -- Vittorio Bertola | Head of Policy & Innovation, Open-Xchange vittorio.bertola@open-xchange.com Office @ Via Treviso 12, 10144 Torino, Italy From nobody Sat Aug 31 06:42:48 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 18D93120044 for ; Fri, 30 Aug 2019 20:37:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.751 X-Spam-Level: X-Spam-Status: No, score=-1.751 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.249, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1536-bit key) header.d=iecc.com header.b=pSDiMH8u; dkim=pass (1536-bit key) header.d=taugh.com header.b=A6PljfuC Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Fuz45uXNM0CU for ; Fri, 30 Aug 2019 20:37:32 -0700 (PDT) Received: from gal.iecc.com (gal.iecc.com [IPv6:2001:470:1f07:1126:0:43:6f73:7461]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5A7B812002E for ; Fri, 30 Aug 2019 20:37:32 -0700 (PDT) Received: (qmail 85945 invoked from network); 31 Aug 2019 03:37:28 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=iecc.com; h=date:message-id:from:to:cc:subject:in-reply-to:mime-version:content-type:content-transfer-encoding; s=14fb7.5d69eb78.k1908; i=printer-iecc.com@submit.iecc.com; bh=teOJWcE7YM5+KbVuwu1O1K1UA2QQg+K/WeZjIl6HIKk=; b=pSDiMH8uCSLkQQqGIvK64dhtNxt/tIsu4IAVoQyOF5fCsDIMgVm+Gsd8GMnoQW9CV9fBEBrSFFJmsIJTk3P2BOUgVR22gMjaUMO4rFqo+9rVSqJf5dYc7r78t7HXHxPqUK4ocm9kDwThrI9L3YGaWT/tA15ucykk2MTmKxNDtMh3Zeg740pAxZN0ENXQbjrEmZHS3g99wzIGAvy8x0agKRtz6iYjs/4kWXaRR3jz0bDz46Jho0s1vg3PSaioRdPF DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=taugh.com; h=date:message-id:from:to:cc:subject:in-reply-to:mime-version:content-type:content-transfer-encoding; s=14fb7.5d69eb78.k1908; olt=printer-iecc.com@submit.iecc.com; bh=teOJWcE7YM5+KbVuwu1O1K1UA2QQg+K/WeZjIl6HIKk=; b=A6PljfuCb8UHeOXUqfFxSLflPQOwBObB5LWx3co5l9OJPWStUjxGzBlEEqk7mElVGvJKbc8wKA9Mluso2wl9pxyC2G/PTY6Tmvy5Yaf0GzEvWoi+JTL8kvuKv2KfaZQaPEb6FnK8jp1nytLj1TdZI/2KwdLu+KT+ImNi4rL1ZB45FD4sl1qtkiArt3tPAZd+i2n8sQBxKfT/kt8KlzCz8fodkFfmI3uxf8TWoEGpT9j0OGvHmO09sCzoWVy0eQh4 Received: from ary.qy ([64.246.232.221]) by imap.iecc.com ([64.57.183.75]) with ESMTPSA (TLS1.2 ECDHE-RSA AES-256-GCM AEAD, printer@iecc.com) via TCP; 31 Aug 2019 03:37:28 -0000 Received: by ary.qy (Postfix, from userid 501) id F3339914582; Fri, 30 Aug 2019 23:37:27 -0400 (EDT) Date: 30 Aug 2019 23:37:27 -0400 Message-Id: <20190831033727.F3339914582@ary.qy> From: "John Levine" To: add@ietf.org Cc: vittorio.bertola@open-xchange.com In-Reply-To: <115643803.6195.1567160913442@appsuite-gw1.open-xchange.com> Organization: Taughannock Networks X-Headerized: yes Mime-Version: 1.0 Content-type: text/plain; charset=utf-8 Content-transfer-encoding: 8bit Archived-At: X-Mailman-Approved-At: Sat, 31 Aug 2019 06:42:46 -0700 Subject: Re: [Add] policy and law, A thought -- Move the policy decisions outside the application. X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 31 Aug 2019 03:37:35 -0000 In article <115643803.6195.1567160913442@appsuite-gw1.open-xchange.com> you write: >I am sure that Mozilla never meant to facilitate any kind of crime, be it child pornography, money laundering or whatever. > >I also think that they, in the beginning, failed to appreciate in full the complexity of the problem and of today's DNS, >and based their approach on two wrong assumptions: >1. any kind of DNS-based content/access filtering is "censorship" >2. DNS should not be used as a control point for the Internet > >(#1 is also in your PEARG draft, and you know I disagree with that choice of language.) >In reality, the access control capabilities of DNS resolvers are used in most cases for different objectives than what >would commonly be called "censorship" (blocking content for political reasons in undemocratic regimes). > >Also, DNS *is* an effective control point, and this is demonstrated by the fact that it is widely used to that effect >almost everywhere on the planet with satisfaction. Claiming that "since it doesn't work 100% of the time then it doesn't >work at all" is a fallacy, especially if it's not done by the people that use the system, but by other people that would >like to disrupt it. Thank you, all very well said. >I think we should rather work (like Mozilla has started doing with their split DNS recognition experiments) on ways to >preserve the current use of the DNS as a control point, while giving users the additional privacy and security which are >the stated objectives of DNS transport encryption, and a way to bypass these controls in specific use cases of actual >"censorship". I was with you until that last clause. The modern Internet is unusable without content filtering, the distinction between filtering and censorship is a purely political one, and the IETF is terrible at politics. (I say this as someone who spent a decade in political elective office, long enough to get elected many times and to realize I wasn't very good at it.) I also observe that unless you are one of the tiny minority of people who run their own mail server, it is unlikely you have much control over the spam filters that manage your mail, but our mail systems seem usable anyway. Absolute control over "censorship" is not something that users expect, nor that providers offer. It's fine to design a system that can cooperate with controls, or can not cooperate with controls, but it is asking for trouble to actively circumvent controls. That's setting us up for a largely political battle against people who are much better at it than we are, fought on turf we do not control. From nobody Sat Aug 31 06:43:12 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 13C151200E7 for ; Sat, 31 Aug 2019 01:03:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ouuteNVFZFDU for ; Sat, 31 Aug 2019 01:03:34 -0700 (PDT) Received: from mail-ot1-x330.google.com (mail-ot1-x330.google.com [IPv6:2607:f8b0:4864:20::330]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 339431200E5 for ; Sat, 31 Aug 2019 01:03:34 -0700 (PDT) Received: by mail-ot1-x330.google.com with SMTP id 90so5253113otg.10 for ; Sat, 31 Aug 2019 01:03:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:content-transfer-encoding:mime-version:date:subject:message-id :to; bh=HFccph1D/aJfWI8hdiXEwjCVrQz4qz/uzs7MH/sqP0c=; b=nQw/+nPtx+RU869DioPO7cj+RvAjtSumNVksupOUVDaVebqdwKRxIJqwQgQS9aA9IW IGHd4gVf8LNF1mvthfsRiP0AHSa1cNqQuSBYKHlFKG371rCrilqSo2pvbH9D/RtrYpQA jQClQCXe1+M3U6OvdYxM/W1usQah77cFBt9tfDxAZvnqivK2O/7cDBvjfNceQRadGp5F 86cnmO7zuB2WofwROteErtWC8oOLPnmXu1cyeDGIBsTp6ISCswcFIZuzux4mh+rz9xu/ a0/rr9Q3WDC+gzu6FFHiyP5a0Ai5US8zJNEYuni99UR9T6D3Vsn3Mhf1RzPsBi7ZjhUt 7Ebg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:content-transfer-encoding:mime-version:date :subject:message-id:to; bh=HFccph1D/aJfWI8hdiXEwjCVrQz4qz/uzs7MH/sqP0c=; b=VcWRDPZ+fZdWvkfGWWdYOS/iBTJJEKYIVGusBcOn2DBGSBau2NQmxV6o7r+F5d16RP ZjWzdHeRC5GCV7abfOMy+aFCdKRhT3RLubh6wv8nE8f0qs0qApMdRqTiWiXVnLh1CgIo S/8kToYassIwiqBC03pIlSUXbvpqQAZ+m6abQhscezg1ah6pbZ85qp4TunGm4FEBWMor vPa++JlCWWJX7nn7PUdEzONYzr0MoZ3wksi9jwT7ZY5ZNRHHmN9I12yBe01XESOmoju1 bvTbEtgcVY0nHSFCKIbyfA/Lhl9PHTIgqx8VAsx8qsN2sArcot65H0MTr9WxaHIpw5pF WETA== X-Gm-Message-State: APjAAAWenaIPjJLVc4S6H4H7z3PpEXw28Z+1zcCSqyPKRmJ6j3rUL98h 5HWutlSOra6Q6Sse7ZAPAzYee1qS X-Google-Smtp-Source: APXvYqxBTpkbXGcToJrjfZdWkamMY+I5U0Tec+mviQCASlyoSA7eOYhrGx1I2tnDs+0Helik79b9Pw== X-Received: by 2002:a05:6830:10c2:: with SMTP id z2mr14731334oto.27.1567238613320; Sat, 31 Aug 2019 01:03:33 -0700 (PDT) Received: from [100.67.11.208] (181.sub-174-206-4.myvzw.com. [174.206.4.181]) by smtp.gmail.com with ESMTPSA id c5sm2758646otl.29.2019.08.31.01.03.31 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Sat, 31 Aug 2019 01:03:32 -0700 (PDT) From: Bret Jordan Content-Type: multipart/alternative; boundary=Apple-Mail-725FF923-7CA8-4DDA-AE40-CF4029848F58 Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (1.0) Date: Sat, 31 Aug 2019 10:03:29 +0200 Message-Id: To: add@ietf.org X-Mailer: iPhone Mail (16G77) Archived-At: X-Mailman-Approved-At: Sat, 31 Aug 2019 06:43:09 -0700 Subject: [Add] Using DoH for C2 X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 31 Aug 2019 08:03:36 -0000 --Apple-Mail-725FF923-7CA8-4DDA-AE40-CF4029848F58 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Just making sure people here have seen this. https://iwantmore.pizza/posts/dnscat2-over-doh.html Bret Sent from my Commodore 128D PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 --Apple-Mail-725FF923-7CA8-4DDA-AE40-CF4029848F58 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable Just making sure people here have seen this= .

<= br>
Bret 

<= span style=3D"background-color: rgba(255, 255, 255, 0);">Sent from my Commod= ore 128D
PGP Fingerprint= : 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050
= --Apple-Mail-725FF923-7CA8-4DDA-AE40-CF4029848F58-- From nobody Sat Aug 31 06:43:45 2019 Return-Path: X-Original-To: add@ietfa.amsl.com Delivered-To: add@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2ABFB120044 for ; Fri, 30 Aug 2019 21:08:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qgEw9XUnbsVZ for ; Fri, 30 Aug 2019 21:08:57 -0700 (PDT) Received: from mail-io1-xd34.google.com (mail-io1-xd34.google.com [IPv6:2607:f8b0:4864:20::d34]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 767D012002E for ; Fri, 30 Aug 2019 21:08:57 -0700 (PDT) Received: by mail-io1-xd34.google.com with SMTP id d25so15698238iob.6 for ; Fri, 30 Aug 2019 21:08:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=mXGBPtJvohv60auWFGDG9K18sjxeXZJ0vkcOPhmUtCo=; b=I+ZQvTJ3xO+MLXEkrHugY/axwtdt/TeeRO26EwUhDy+Xa/dYwwa32IGF4F/UOcgF7X ZCiNFqFNXmqCiMXOxuDnDnyMcSUHnqLnXuMFwgQCB2EUuQ4qtfw0hOc6g5gtX2Treuus vdFZBTWefZvQWlTB3r0yrKp8zBdCmIlC08tTM+052GVN8Hh6nTHLjQHM/rQW++Dmyk9+ +6ZnkOHZ9QCSb7zTQzyaqLymR61EkFYBunKm9S9M/4Xf+PFdFVUtqRFwXN5bxUNVRLZ4 4W9FzUZguJX/dYGD8Wsb+aoEDHonLa61tSQYZRGc7K5p4Bk4RrdWcpWdAVCmlsqeZ6Pe Z+JA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=mXGBPtJvohv60auWFGDG9K18sjxeXZJ0vkcOPhmUtCo=; b=m8TxNxB0d8HpXxSBxTvM1y9QyIgpQeesbZ/zwtxweApst1FayddWIxUpdLwjzIwLoB sN/j5H4rk/LdEPeX7OfeqkoT9s+b2zxJpu34lwhoNBWsDXpvZBPW3aJMLEbfDYsnrpb9 vRoKLa2+y/1RkCN47jcz+5SYeXm0EpzrNke+tDwulGBRvKg/JLHaVIoRwh7T/oP5ap4F GFeUN+GGTYXcQp7mnxejwXhmcoTX144Pll+7MffEMMlMDr9abSB1nElGgOjgbUhwJ2fm Q1ceyIgkDFM0dRnkpF2h8HgTPYE3BrtXYdk/KA+TdykZFYIxvNSE1fGE5SgVKBXCCnTD Sz9A== X-Gm-Message-State: APjAAAUZf9gMXU2+A9+PG6iAe/Z91QrpzfjBqXo0Dbvtd2va3NQ5ixMk jk5yb0WjLBnaHibZcqGNBwT7JTVwCUtAo9x0yGaXSGPv5rw= X-Google-Smtp-Source: APXvYqwdMX+hIrLBTAn/zKcHhfv3GdE3zfTOW+FokZtMO9H9oHs2dPhkg2t9TmMXNxkxccK2tB0LNmBRwzqdIIxyG8Y= X-Received: by 2002:a02:9a0b:: with SMTP id b11mr8972683jal.106.1567224536651; Fri, 30 Aug 2019 21:08:56 -0700 (PDT) MIME-Version: 1.0 References: <20190828174219.868DC8C67BB@ary.qy> <7981858d-1fe8-b6e4-5c06-d3be2628a01f@cs.tcd.ie> <853be8d0-d301-9b53-1d26-9550aea26322@bellis.me.uk> In-Reply-To: <853be8d0-d301-9b53-1d26-9550aea26322@bellis.me.uk> From: Rob Sayre Date: Fri, 30 Aug 2019 21:08:45 -0700 Message-ID: To: Ray Bellis Cc: ADD Mailing list Content-Type: multipart/alternative; boundary="000000000000ca5b66059161e5f7" Archived-At: X-Mailman-Approved-At: Sat, 31 Aug 2019 06:43:43 -0700 Subject: Re: [Add] policy and law, A thought -- Move the policy decisions outside the application. X-BeenThere: add@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Applications Doing DNS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 31 Aug 2019 04:09:00 -0000 --000000000000ca5b66059161e5f7 Content-Type: text/plain; charset="UTF-8" On Fri, Aug 30, 2019 at 6:55 PM Ray Bellis wrote: > > I've also personally attended a meeting at the UK Home Office > Why should greater internet care about this? The UK has some well-meaning regulations here, but they don't seem to be very effective or well-specified. thanks, Rob --000000000000ca5b66059161e5f7 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Fri, Aug 30, 2019 at 6:55 PM Ray Belli= s <ray@bellis.me.uk> wrote:

I've also personally attended a meeting at the UK Home Office=C2=A0
=

Why should greater internet care about thi= s? The UK has some well-meaning regulations here, but they don't seem t= o be very effective or well-specified.

thanks,
Rob

--000000000000ca5b66059161e5f7--