Subject: [Add] charter feedback: the network operator

From: Rob Sayre <[email-masked]>
Date: Wed, 16 Oct 2019 12:58:33 -0700

"various application providers have been exploring having the application
configure its own DNS services rather than using DNS services configured
by the network operator. (The working group considers a network operator
to include Internet service providers, enterprises, and any businesses
that provide network access.)"

I have some specific feedback on this section of the charter. First, I like
its attempt to define "network operator". It makes a well-intentioned
attempt to rule out tedious "My home is my castle" arguments [0].

However, this space is subtle. One problem is that many "network operators"
under the BoF's definition deploy devices in homes that make choices, can
get exploited, etc. Some text that explains the untrusted path that
unencrypted DNS takes might help.

The text about "various application providers have been exploring having
the application
configure its own DNS services" seems wrong. They already do it in many
ways, from VPNs to DoH/DoT and centralized DNS services.

thanks,
Rob

[0]
https://github.com/http2/http2-spec/wiki/Proxy-User-Stories#my-home-is-my-castle

---

From: Erik Kline <[email-masked]>
Date: Wed, 16 Oct 2019 14:02:46 -0700

How about just saying "provisioned by the network (e.g. DHCP, RDNSS, ...)"?

On Wed, 16 Oct 2019 at 12:59, Rob Sayre <[email-masked]> wrote:

> I have some specific feedback on this section of the charter. First, I
> like its attempt to define "network operator". It makes a well-intentioned
> However, this space is subtle. One problem is that many "network
> operators" under the BoF's definition deploy devices in homes that make
> choices, can get exploited, etc. Some text that explains the untrusted path
> that unencrypted DNS takes might help.
>
> --
> Add mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/add
>

---

From: Joe Abley <[email-masked]>
Date: Wed, 16 Oct 2019 15:53:39 -0700

On Oct 16, 2019, at 21:58, Rob Sayre <[email-masked]> wrote:

> The text about "various application providers have been exploring having the application
> configure its own DNS services" seems wrong. They already do it in many ways, from VPNs to DoH/DoT and centralized DNS services.

It seems reasonable to me that to explore a place you have to spend
time there. I don't think the text is at odds with your observation.

Joe