Subject: [Add] Narrowed-down proposal

From: Jari Arkko <[email-masked]>
Date: Tue, 19 Nov 2019 15:11:11 +0800

Since most people on the mic line commented on the proposed scope being too wide, I’d like to offer one initial thought on a more narrow proposal:

* write a specification that allows the discovery of and the use of DNS servers, with something like adaptive DNS as a starting point
  - including general security analysis, privacy impacts analysis, and resistance to pervasive surveillance analysis regarding this proposal
* use standard IETF WG process

This is one topic from the long list of proposals. If there are more that are feasible to be pursued, another working group(s), or sequential working groups. 

Jari

---

From: "Diego R. Lopez" <[email-masked]>
Date: Tue, 19 Nov 2019 07:23:14 +0000

I strongly support Jari's view and proposal

(actually, something like this is what I put on my notes as a possible way forward)

--
"Esta vez no fallaremos, Doctor Infierno"

Dr Diego R. Lopez
Telefonica I+D
https://www.linkedin.com/in/dr2lopez/

e-mail: [email-masked]
Tel:         +34 913 129 041
Mobile:  +34 682 051 091
----------------------------------

On 19/11/2019, 15:11, "Add on behalf of Jari Arkko" <[email-masked] on behalf of [email-masked]> wrote:

    Jari

    --
    Add mailing list
    [email-masked]
    https://www.ietf.org/mailman/listinfo/add

________________________________

Este mensaje y sus adjuntos se dirigen exclusivamente a su destinatario, puede contener información privilegiada o confidencial y es para uso exclusivo de la persona o entidad de destino. Si no es usted. el destinatario indicado, queda notificado de que la lectura, utilización, divulgación y/o copia sin autorización puede estar prohibida en virtud de la legislación vigente. Si ha recibido este mensaje por error, le rogamos que nos lo comunique inmediatamente por esta misma vía y proceda a su destrucción.

The information contained in this transmission is privileged and confidential information intended only for the use of the individual or entity named above. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this transmission in error, do not read it. Please immediately reply to the sender that you have received this communication in error and then delete it.

Esta mensagem e seus anexos se dirigem exclusivamente ao seu destinatário, pode conter informação privilegiada ou confidencial e é para uso exclusivo da pessoa ou entidade de destino. Se não é vossa senhoria o destinatário indicado, fica notificado de que a leitura, utilização, divulgação e/ou cópia sem autorização pode estar proibida em virtude da legislação vigente. Se recebeu esta mensagem por erro, rogamos-lhe que nos o comunique imediatamente por esta mesma via e proceda a sua destruição

---

From: Tommy Jensen <[email-masked]>
Date: Tue, 19 Nov 2019 07:23:34 +0000

I agree with this. Common concerns seem to be too wide of a scope and too non-standard a WG process. Using (the other) Tommy's proposal as a framework also seems like a great way to keep us all focused on concrete discussion as opposed to philosophical discussions regarding DNS.

I would support a WG chartered with exploring Adaptive DNS for 1) security impact, 2) privacy impact, 3) resistance to pervasive surveillance, and 4) maintenance and debug-ability (that was a great point, Melanie! (sp?)) using standard IETF mechanisms for consensus and the like.

Either we find Tommy's proposal works well with tweaks, and that's great, or we find fundamental flaws and those flaws inform our concrete requirements for another solution. Either way we get concrete results with some established text already in place from which to get to working code sooner rather than later.

Thanks,
The Microsoft Tommy
________________________________
From: Add <[email-masked]> on behalf of Jari Arkko <[email-masked]>
Sent: Monday, November 18, 2019 11:11 PM
To: ADD Mailing list <[email-masked]>
Subject: [Add] Narrowed-down proposal

Jari

--
Add mailing list
[email-masked]
https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fadd&amp;data=02%7C01%7CJensen.Thomas%40microsoft.com%7C29ef0eabc57843f8585e08d76cbfb3c9%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637097442926214777&amp;sdata=6K8P%2FAvJps7nrDnlAwh9%2Bq4MXhlJtcPRBqXnC%2FidZzs%3D&amp;reserved=0

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 19 Nov 2019 08:14:24 +0000

Hiya,

On 19/11/2019 07:11, Jari Arkko wrote:
> Since most people on the mic line commented on the proposed scope
> being too wide, I’d like to offer one initial thought on a more
> narrow proposal:
> 
> * write a specification that allows the discovery of and the use of
> DNS servers, with something like adaptive DNS as a starting point -

If there were sufficient interest in the above from
multiple implementers and operators, then I'd be in
agreement with Jari. I don't think we know if that
is or is not the case. (Well, I don't know anyway.)

That said, I'm not clear if the "designated resolver"
idea would actually work out, but maybe it could. (I
don't see how it works without co-ordination of
complex DNSSEC-signed content in multiple zones, which
seems a bit of a stretch.)

> including general security analysis, privacy impacts analysis, and
> resistance to pervasive surveillance analysis regarding this
> proposal * use standard IETF WG process

Strong +1 to that. A non-standard process or treating security or
privacy as somehow out of scope are both,
for me, showstoppers.

Cheers,
S.

> 
> This is one topic from the long list of proposals. If there are more
> that are feasible to be pursued, another working group(s), or
> sequential working groups.
> 
> Jari
>

---

From: <[email-masked]>
Date: Tue, 19 Nov 2019 08:23:14 +0000

> From: Add <[email-masked]> On Behalf Of Stephen Farrell
> 
> If there were sufficient interest in the above from multiple implementers and
> operators, then I'd be in agreement with Jari. I don't think we know if that is or is
> not the case. (Well, I don't know anyway.)

I'm happy to work on Adaptive DNS, and in fact already have.

> idea would actually work out, but maybe it could. (I don't see how it works
> without co-ordination of complex DNSSEC-signed content in multiple zones,
> which seems a bit of a stretch.)

It feels feasible to me, and has the benefit of encouraging more deployment of DNSSEC signing.

Chris

---

From: Rob Sayre <[email-masked]>
Date: Tue, 19 Nov 2019 00:37:25 -0800

> deployment of DNSSEC signing.

That's been encouraged for about 20 years, right?

"Though Domain Name System Security Extensions (DNSSEC) offers a means of
ensuring that results are accurate, the protocol is not thoroughly
implemented and deployed. Even where DNSSEC is deployed, many Internet
users rely on their DNS resolver to perform validation."

https://www.iab.org/documents/correspondence-reports-documents/2019-2/avoiding-unintended-harm-to-internet-infrastructure/

thanks,
Rob

---

From: Brian Dickson <[email-masked]>
Date: Tue, 19 Nov 2019 17:09:47 +0800

> > not the case. (Well, I don't know anyway.)

I'm very much interested in working on the "Discovery of resolvers and
their capabilities and behaviors" item and the "Support for debugging and
analysis".

I have some ideas that might combine those two through mechanisms that
support both use cases, so it might be possible to reduce the list of items
by one.
(This may lead to an actual "DNS traceroute", BTW.)

I'd prefer to work with 2-3 co-authors to ensure progress and good
collaboration, not more and not fewer. Please contact me off-list if you
are interested, presuming (a) WG formation, and (b) WG chair approval.

I'm willing to contribute ideas and review the item "Local DNS caches (e.g.
partitioning, use of stale records)". (I think that one is particularly
important, and important to get right.)

Brian

---

From: "Smith, Kevin, Vodafone Group" <[email-masked]>
Date: Wed, 20 Nov 2019 11:58:16 +0000

> I'm very much interested in working on the "Discovery of resolvers and their capabilities and behaviors" item

+1, so adding 'discovery and communication of resolver policy' to Jari's original proposal.

> and the "Support for debugging and analysis".

Yes, notwithstanding the privacy and security analysis as Stephen says.

All best,
Kevin

From: Brian Dickson <[email-masked]>
Sent: 19 November 2019 09:10
Cc: Jari Arkko <[email-masked]>; ADD Mailing list <[email-masked]>; [email-masked]
Subject: Re: [Add] Narrowed-down proposal

On Tue, Nov 19, 2019 at 4:23 PM <[email-masked]<mailto:[email-masked]>> wrote:
> From: Add <[email-masked]<mailto:[email-masked]>> On Behalf Of Stephen Farrell
>

I'm very much interested in working on the "Discovery of resolvers and their capabilities and behaviors" item and the "Support for debugging and analysis".

I have some ideas that might combine those two through mechanisms that support both use cases, so it might be possible to reduce the list of items by one.
(This may lead to an actual "DNS traceroute", BTW.)

I'd prefer to work with 2-3 co-authors to ensure progress and good collaboration, not more and not fewer. Please contact me off-list if you are interested, presuming (a) WG formation, and (b) WG chair approval.

I'm willing to contribute ideas and review the item "Local DNS caches (e.g. partitioning, use of stale records)". (I think that one is particularly important, and important to get right.)

Brian

C2 General