Subject: Re: [Add] measuring the size of the canary

From: Moritz Muller <[email-masked]>
Date: Mon, 16 Dec 2019 10:46:33 +0000

A bit late to the party but I’m running similar measurements and I also dug a bit deeper into the data a few days ago:

https://twitter.com/moritzcm_/status/1202881258772152321

> On 21 Nov 2019, at 01:49, Michael Richardson <[email-masked]> wrote:
> 
> Signed PGP part
> 
> Tommy Pauly <tpauly=[email-masked]> wrote:
>> Not sure if the data can show this, but I'd be curious to know if we
>> see patterns in the kinds of networks that are using the canary: School
>> Wi-Fi, home Wi-Fi, enterprise, etc.
> 
> I believe that we will get self-selection bias because few of those places
> will have Atlas probes.
> 
>> I also wonder what we think the overall marking rate will be. The fact
>> that the percentage is already 7% is pretty high, considering that the
>> use of the canary is still quite nascent.
> 
> I was also surprised, and sent Wes a clarification question, and now realize
> that he said most of that was timeouts, not intentional configuration of the
> canary domain.  i.e. the local DNS was maybe just broken :-)
> 
> If only 7/1000 recursive DNS servers are broken, that's a pretty good DNS story :-)
> 
> 
> --
> Michael Richardson <[email-masked]>, Sandelman Software Works
> -= IPv6 IoT consulting =-
> 
> 
> 
> 
>

---

From: Rob Sayre <[email-masked]>
Date: Mon, 16 Dec 2019 08:33:03 -0800

This is interesting. Does anyone know whether the ISPs that are very
prevalent (CenturyLink, Orange, etc) are doing this only with opt-in
parental control DNS features?

"This canary domain is intended for use in cases where users have opted in
to parental controls. We plan to revisit the use of this heuristic over
time, and we will be paying close attention to how the canary domain is
adopted. If we find that it is being abused to disable DoH in situations
where users have not explicitly opted in, we will revisit our approach."

https://blog.mozilla.org/futurereleases/2019/09/06/whats-next-in-making-dns-over-https-the-default/

thanks,
Rob

On Mon, Dec 16, 2019 at 2:46 AM Moritz Muller <moritz.muller=
[email-masked]> wrote:

> A bit late to the party but I’m running similar measurements and I also
> dug a bit deeper into the data a few days ago:
>
> Add mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/add
>

---

From: "STARK, BARBARA H" <[email-masked]>
Date: Mon, 16 Dec 2019 16:55:55 +0000

I thought the canary domain was also intended to be used by enterprises? But I see from the quote that enterprises aren’t included after all. Interesting.
Note that some users have agreed to use specific DNS services subsequent to a DMCA infraction. This also isn’t listed as a valid reason for using the canary domain – but I would expect it will be used in this case, anyway, since DMCA is a legal obligation. The quote doesn’t include broadband subscribers’ consciously-selected-for-legal-reasons DNS server as a legitimate use of the canary domain. That will be interesting if apps decide to override such subscribers’ legal choices.
Ultimately, all companies will have to make decisions they consider “right”.
Barbara

From: Add <[email-masked]> On Behalf Of Rob Sayre
Sent: Monday, December 16, 2019 11:33 AM
To: Moritz Muller <moritz.muller=[email-masked]>
Cc: Michael Richardson <[email-masked]>; [email-masked]
Subject: Re: [Add] measuring the size of the canary

This is interesting. Does anyone know whether the ISPs that are very prevalent (CenturyLink, Orange, etc) are doing this only with opt-in parental control DNS features?

"This canary domain is intended for use in cases where users have opted in to parental controls. We plan to revisit the use of this heuristic over time, and we will be paying close attention to how the canary domain is adopted. If we find that it is being abused to disable DoH in situations where users have not explicitly opted in, we will revisit our approach."

https://blog.mozilla.org/futurereleases/2019/09/06/whats-next-in-making-dns-over-https-the-default/<https://urldefense.proofpoint.com/v2/url?u=https-3A__blog.mozilla.org_futurereleases_2019_09_06_whats-2Dnext-2Din-2Dmaking-2Ddns-2Dover-2Dhttps-2Dthe-2Ddefault_&d=DwMFaQ&c=LFYZ-o9_HUMeMTSQicvjIg&r=LoGzhC-8sc8SY8Tq4vrfog&m=EWDcsK73jQJ14xNG7eoWsnOrqPqVSo7Ar8o2ZOgdsTI&s=Ye6hh2Hu-J1FoZSw_0FZglO1d-fxmFeBkRm7jEItTS8&e=>

thanks,
Rob

On Mon, Dec 16, 2019 at 2:46 AM Moritz Muller <moritz.muller=[email-masked]<mailto:[email-masked]>> wrote:
A bit late to the party but I’m running similar measurements and I also dug a bit deeper into the data a few days ago:

https://twitter.com/moritzcm_/status/1202881258772152321<https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_moritzcm-5F_status_1202881258772152321&d=DwMFaQ&c=LFYZ-o9_HUMeMTSQicvjIg&r=LoGzhC-8sc8SY8Tq4vrfog&m=EWDcsK73jQJ14xNG7eoWsnOrqPqVSo7Ar8o2ZOgdsTI&s=3BsugvwAi3e8tiu8-ErHQNuywqaYIq9N88ZCHGTivcY&e=>

> On 21 Nov 2019, at 01:49, Michael Richardson <[email-masked]<mailto:[email-masked]>> wrote:
>
> Signed PGP part
>
> Tommy Pauly <tpauly=[email-masked]<mailto:[email-masked]>> wrote:
> Michael Richardson <[email-masked]<mailto:[email-masked]>>, Sandelman Software Works

--
Add mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/add<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_add&d=DwMFaQ&c=LFYZ-o9_HUMeMTSQicvjIg&r=LoGzhC-8sc8SY8Tq4vrfog&m=EWDcsK73jQJ14xNG7eoWsnOrqPqVSo7Ar8o2ZOgdsTI&s=pMj0kqxQRM1QKcam1HGUcywpK9SjnWmy2pQUBqLEM_w&e=>

---

From: Rob Sayre <[email-masked]>
Date: Mon, 16 Dec 2019 09:05:21 -0800

On Mon, Dec 16, 2019 at 8:56 AM STARK, BARBARA H <[email-masked]> wrote:

> I thought the canary domain was also intended to be used by enterprises?
> But I see from the quote that enterprises aren’t included after all.
> Interesting.
>

I think that's covered elsewhere:
https://support.mozilla.org/en-US/kb/configuring-networks-disable-dns-over-https

I believe the quote I selected was meant to apply to consumer ISPs, but of
course Mozilla has the final word on that. :)

thanks,
Rob

> Note that some users have agreed to use specific DNS services subsequent
> to a DMCA infraction. This also isn’t listed as a valid reason for using
> the canary domain – but I would expect it will be used in this case,
> anyway, since DMCA is a legal obligation. The quote doesn’t include
> broadband subscribers’ consciously-selected-for-legal-reasons DNS server as
> a legitimate use of the canary domain. That will be interesting if apps
> decide to override such subscribers’ legal choices.
>
> *From:* Add <[email-masked]> *On Behalf Of * Rob Sayre
> *Sent:* Monday, December 16, 2019 11:33 AM
> *To:* Moritz Muller <moritz.muller=[email-masked]>
> *Cc:* Michael Richardson <[email-masked]>; [email-masked]
> *Subject:* Re: [Add] measuring the size of the canary
>
>
>
> <https://urldefense.proofpoint.com/v2/url?u=https-3A__blog.mozilla.org_futurereleases_2019_09_06_whats-2Dnext-2Din-2Dmaking-2Ddns-2Dover-2Dhttps-2Dthe-2Ddefault_&d=DwMFaQ&c=LFYZ-o9_HUMeMTSQicvjIg&r=LoGzhC-8sc8SY8Tq4vrfog&m=EWDcsK73jQJ14xNG7eoWsnOrqPqVSo7Ar8o2ZOgdsTI&s=Ye6hh2Hu-J1FoZSw_0FZglO1d-fxmFeBkRm7jEItTS8&e=>
>
>
>
> thanks,
>
> Rob
>
>
>
>
>
> <https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_moritzcm-5F_status_1202881258772152321&d=DwMFaQ&c=LFYZ-o9_HUMeMTSQicvjIg&r=LoGzhC-8sc8SY8Tq4vrfog&m=EWDcsK73jQJ14xNG7eoWsnOrqPqVSo7Ar8o2ZOgdsTI&s=3BsugvwAi3e8tiu8-ErHQNuywqaYIq9N88ZCHGTivcY&e=>
>
> <https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_add&d=DwMFaQ&c=LFYZ-o9_HUMeMTSQicvjIg&r=LoGzhC-8sc8SY8Tq4vrfog&m=EWDcsK73jQJ14xNG7eoWsnOrqPqVSo7Ar8o2ZOgdsTI&s=pMj0kqxQRM1QKcam1HGUcywpK9SjnWmy2pQUBqLEM_w&e=>
>
>