Subject: Re: [Add] My longer list of questions [from partial distribution at the MIC]

From: "Livingood, Jason" <[email-masked]>
Date: Wed, 31 Jul 2019 12:26:08 +0000

From: Add <[email-masked]> on behalf of Eric Rescorla <[email-masked]>
> As I said in Montreal, it's not like the user was consulted regarding the use of the network provided resolver.

DNS resolver IPs have always been assigned by DHCP or other network bootstrapping method. This is what users expect and require in order to have working Internet access. ISPs – and other network operators - take the perspective that providing DNS is a key part of providing Internet services, they provide user support for this, have FAQs, are bound by applicable policies and legal agreements with users, bound by local regulation/law, etc. Mozilla takes a different perspective that these are separable, and that matter has arisen in interesting ways in the Mozilla v. FCC case which is currently on-going (see Section 2 of https://blog.mozilla.org/wp-content/uploads/2018/11/as-filed-Mozilla-v-FCC-Joint-Reply-Brief-16Nov2018.pdf). It seems totally fine to me that there are different perspectives here as in all things in life, and it is completely normal for there to be tension between different technical approaches. Perhaps we can acknowledge there are different perspectives here and move on – this certainly won’t be solved on this list, in one court case, at the IETF, etc.

> As a general matter, users aren't aware of DNS at all.

Which is as it perhaps should be. Users know when DNS breaks – they describe it as the Internet not working. This is perhaps an argument that it is inextricably linked in the mind of users (not IETF’ers) with Internet access services. But as I said above, it seems unlikely the many different perspectives expressed on the list will soon converge and everyone agree. Not sure where to go from here – other than for us all to take a step back, acknowledge & respect our differing viewpoints, and move on to something more productive. :-)

---

From: Eric Rescorla <[email-masked]>
Date: Wed, 31 Jul 2019 06:48:06 -0700

On Wed, Jul 31, 2019 at 5:26 AM Livingood, Jason <
[email-masked]> wrote:

> *From: *Add <[email-masked]> on behalf of Eric Rescorla <
> [email-masked]>
> > As I said in Montreal, it's not like the user was consulted regarding
> the use of the network provided resolver.
>
>
>
> DNS resolver IPs have always been assigned by DHCP or other network
> bootstrapping method.
>

Well, at least recently. For quite some time, people got their IP addresses
manually or via ARP and then manually configured their resolvers. But I
agree that for a long time it's been via DHCP.

This is what users expect and require in order to have working Internet
> access.

I don't agree with this in two respects. First, the users don't expect it
because they don't  know about DHCP at all. Second, I think the evidence is
pretty strong that they don't require it, given that plenty of people have
their resolver configured to 8.8.8.8 or 1.1.1.1. Indeed, if it weren't the
case that users could get working Internet access without their ISP
providing it, then the present debate wouldn't be happening.

-Ekr

---

From: Paul Ebersman <[email-masked]>
Date: Wed, 31 Jul 2019 08:01:06 -0600

ekr> I don't agree with this in two respects. First, the users don't
ekr> expect it because they don't know about DHCP at all. Second, I
ekr> think the evidence is pretty strong that they don't require it,
ekr> given that plenty of people have their resolver configured to
ekr> 8.8.8.8 or 1.1.1.1. Indeed, if it weren't the case that users could
ekr> get working Internet access without their ISP providing it, then
ekr> the present debate wouldn't be happening.

Many users of 8.8.8.8 do so because they get it via DHCP. I'm seeing
this much more often in captive portals, where said operator has decided
not to do DNS themselves. Many local ISPs do the same. I seem to recall
Vietnam being over 80% google for this reason? (Geoff Huston has done a
couple of presos about this).

---

From: Eric Rescorla <[email-masked]>
Date: Wed, 31 Jul 2019 07:02:12 -0700

On Wed, Jul 31, 2019 at 7:01 AM Paul Ebersman <[email-masked]> wrote:

> Many users of 8.8.8.8 do so because they get it via DHCP.

Absolutely true, but I'm not sure why that matters. The fact is that many
also manually configure it, and no matter how it is configured, it's not
the ISP providing the service.

-Ekr

I'm seeing

---

From: Paul Ebersman <[email-masked]>
Date: Wed, 31 Jul 2019 08:08:20 -0600

ebersman> Many users of 8.8.8.8 do so because they get it via DHCP.

ekr> Absolutely true, but I'm not sure why that matters. The fact is
ekr> that many also manually configure it, and no matter how it is
ekr> configured, it's not the ISP providing the service.

In some cases, like Vietnam, it is the ISP who chose 8.8.8.8 and the
users just use it like any other DCHP supplied resolvers.

I think the point is that while the quadX services are a measurable
percentage of users, it's still not how the majority of the internet
gets their resolvers, i.e. that the majority still don't knowingly
choose their resolver or even know there are choices.

---

From: "Deen, Glenn (NBCUniversal)" <[email-masked]>
Date: Wed, 31 Jul 2019 14:09:14 +0000

> On Jul 31, 2019, at 8:01 AM, Paul Ebersman <[email-masked]> wrote:
> 

Also worth noting it’s hardcoded into chromecast devices as I recall. 

Which also bumps up the numbers even on households/users that use the dhcp provided dns. 

Glenn

---

From: Jim Reid <[email-masked]>
Date: Wed, 31 Jul 2019 15:11:48 +0100

> On 31 Jul 2019, at 14:48, Eric Rescorla <[email-masked]> wrote:
> 
> given that plenty of people have their resolver configured to 8.8.8.8 or 1.1.1.1

While I'm sure that’s true, what data does Mozilla (or anyone else) have to quantify just how big “many people” actually is? Or for bonus points, how many of those many people made a deliberate decision to use these resolvers instead of them being chosen for them (DHCP, captive portal, browser confguration, etc)?

Apologies too for a meaningful and relevant Subject: header. :-)

---

From: Eric Rescorla <[email-masked]>
Date: Wed, 31 Jul 2019 07:25:42 -0700

> choose their resolver or even know there are choices.

Yes, I agree that the majority of users don't knowingly choose their
resolver.

-Ekr

---

From: Paul Hoffman <[email-masked]>
Date: Wed, 31 Jul 2019 14:49:05 +0000

> Also worth noting it’s hardcoded into chromecast devices as I recall. 

Attribution, please? I had heard that, and had also heard it was debunked, that the calls to 8.8.8.8 were for bootstrapping only and then not used again. However, I never heard anyone say either definitively, and did not go look at the source code.

--Paul Hoffman

---

From: Joe Abley <[email-masked]>
Date: Wed, 31 Jul 2019 10:53:25 -0400

> Attribution, please?

Paul Vixie's findings have been widely reported, e.g.

https://www.businessinsider.com/paul-vixie-blasts-google-chromecast-2019-2 <https://www.businessinsider.com/paul-vixie-blasts-google-chromecast-2019-2>

Joe

---

From: Paul Hoffman <[email-masked]>
Date: Wed, 31 Jul 2019 14:57:01 +0000

On Jul 31, 2019, at 7:53 AM, Joe Abley <[email-masked]> wrote:
> https://www.businessinsider.com/paul-vixie-blasts-google-chromecast-2019-2

That article does not say more than that Paul saw at least one query go to 8.8.8.8 from his Chromecast. I asked for more detail:

> I had heard that, and had also heard it was debunked, that the calls to 8.8.8.8 were for bootstrapping only and then not used again. However, I never heard anyone say either definitively, and did not go look at the source code.

This is a technical mailing list, and asking for technical detail on claims seems appropriate. For all I know, PaulV already has such detail, but I have not seen it published anywhere.

--Paul Hoffman

---

From: Joe Abley <[email-masked]>
Date: Wed, 31 Jul 2019 10:58:04 -0400

> This is a technical mailing list, and asking for technical detail on claims seems appropriate. For all I know, PaulV already has such detail, but I have not seen it published anywhere.

Perhaps you could ask him directly instead of asking a list he's not subscribed to :-)

Joe

---

From: "Deen, Glenn (NBCUniversal)" <[email-masked]>
Date: Wed, 31 Jul 2019 15:22:14 +0000

On 7/31/19, 8:49 AM, "Paul Hoffman" <[email-masked]> wrote:

    > Also worth noting it’s hardcoded into chromecast devices as I recall. 
    
|    Attribution, please? I had heard that, and had also heard it was debunked, that the calls to 8.8.8.8 were for bootstrapping only and then not used again. However, I never heard anyone say either |definitively, and did not go look at the source code.
    
|    --Paul Hoffman

[gd] https://urldefense.proofpoint.com/v2/url?u=https-3A__forum.netgate.com_topic_59709_force-2Da-2Dchromecast-2Dto-2Duse-2Drouter-2Ddns&d=DwIGaQ&c=LO_8KzsOlAGvgA6hdGI4v02U_XLiES0sR51Zca0yIy4&r=wydU3q1Yp1BqA26aKLU0jQ&m=jRVT6FPOVY2i8C0LG7kLNsD1Ig4bqvjsNGc1mIzuwcw&s=HBO6-0jkBu7k7s76Kbhrb0cDIjEBrKTx7ehNpwGQRp4&e= 

[gd] Then there was the Vixie report

[gd]  https://urldefense.proofpoint.com/v2/url?u=https-3A__www.businessinsider.com_paul-2Dvixie-2Dblasts-2Dgoogle-2Dchromecast-2D2019-2D2-3Futm-5Fsource-3Dreddit.com&d=DwIGaQ&c=LO_8KzsOlAGvgA6hdGI4v02U_XLiES0sR51Zca0yIy4&r=wydU3q1Yp1BqA26aKLU0jQ&m=jRVT6FPOVY2i8C0LG7kLNsD1Ig4bqvjsNGc1mIzuwcw&s=OHAjANWjScv-BmwJKE910mr3G0kW6hD8-xCzHLo4zOg&e= 

[gd] -glenn

---

From: "Deen, Glenn (NBCUniversal)" <[email-masked]>
Date: Wed, 31 Jul 2019 15:22:14 +0000

On 7/31/19, 8:57 AM, "Add on behalf of Paul Hoffman" <[email-masked] on behalf of [email-masked]> wrote:

    --Paul Hoffman

[GD] Totally legitimate point.  In a quick search I easily found numerous posts from people dealing with trying to change the chromecast settings, so this seems to be a pervasive observation beyond just PaulV.    

[GD]  I'm at a conference without access to a chromecast or lab network, but it seems it would be simple enough for someone on this list with access to a  chromecast and some network monitoring to verify the behavior. 

-glenn

---

From: Eric Rescorla <[email-masked]>
Date: Wed, 31 Jul 2019 08:55:26 -0700

On Wed, Jul 31, 2019 at 7:11 AM Jim Reid <[email-masked]> wrote:

> While I'm sure that’s true, what data does Mozilla (or anyone else) have
> to quantify just how big “many people” actually is?

 I seem to remember seeing something, but I don't have it to hand.

Or for bonus points, how many of those many people made a deliberate
> decision to use these resolvers instead of them being chosen for them
> (DHCP, captive portal, browser confguration, etc)?
>

I agree that very few did, but I'm not sure what point you think that
makes. The reason I mentioned the broad use of alternate resolvers was to
point out that ISP-provided DNS service is not an essential part of
Internet connectivity.

-Ekr

---

From: Rob Sayre <[email-masked]>
Date: Wed, 31 Jul 2019 10:27:44 -0700

On Wed, Jul 31, 2019 at 8:57 AM Eric Rescorla <[email-masked]> wrote:

>> > On 31 Jul 2019, at 14:48, Eric Rescorla <[email-masked] <ekr@rtfm..com>>
>> wrote:
>> >

https://blog.apnic.net/2019/03/14/the-state-of-dnssec-validation/

"Google’s Public DNS service (8.8.8.8) is undoubtedly the most popular DNS
resolution service in the Internet — some 15% of the world’s users pass
their queries through this service."

thanks,
Rob

---

From: Andrew Campling <[email-masked]>
Date: Wed, 31 Jul 2019 21:51:55 +0000

> On Wed, Jul 31, 2019 at 15:02 Eric Rescorla <[email-masked]> wrote:

>> On Wed, Jul 31, 2019 at 7:01 AM Paul Ebersman <[email-masked]<mailto:[email-masked]>> wrote:

> Absolutely true, but I'm not sure why that matters. The fact is that many also manually configure it, and no matter how it is configured, it's not the ISP providing the service.

In the markets that I’m most familiar with, the split of users opting to obtain DNS from a source other than their ISP is around ten percent.  In those markets the above statement that “… many also manually configure …” would be more accurately rewritten as “a small minority manually configure”.

In reality behaviour varies significantly between markets so we shouldn’t assume that, for example, the behaviours that apply in the US, or indeed the very different behaviours in Vietnam, are generally true elsewhere.