Subject: Re: [Add] A proposed charter for ABCD

From: "Deen, Glenn (NBCUniversal)" <[email-masked]>
Date: Thu, 9 Jan 2020 20:26:47 +0000

On 1/8/20, 5:21 AM, "Add on behalf of Mirja Kuehlewind" <[email-masked] on behalf of [email-masked]> wrote:

    Hi Vittorio,
    
    The charter proposed by Tommy (see [1]) is exactly focusing on discovery and selection. What are you missing there?
    
    Mirja
    
    [1] https://urldefense.com/v3/__https://mailarchive.ietf.org/arch/msg/add/XudG5id0wwdRndR5za4G9ZbCo_w__;!!PIZeeW5wscynRQ!6VIda-Wm9zHc9cCrA2f6rb2CA7zSCfoqa3zme2EVesMB9ZvvbVPXkaMOefrKLp5_$ 
    
While I agree that it is focused on D&S it includes text at the end pulling in draft-pauly-drive-adaptive-dns-privacy as a starting point. That takes is beyond just D & S and into more advanced behavior of resolvers as draft-pauly-drive-adaptive-dns-privacy goes beyond just D&S.

As I said in my other note, I think it's the adding of these starting points that maybe causing a lot of the issues coming to closure.   Tommy's proposal does give the WG the option as he says it is subject to the WG's design choices.  A concern could be if the text about it being an option disappeared and it became a requirement to take on the material in that draft that goes beyond D&S and into resolver behavior.

-glenn

---

From: Ted Lemon <[email-masked]>
Date: Thu, 9 Jan 2020 12:37:24 -0800

> As I said in my other note, I think it's the adding of these starting points that maybe causing a lot of the issues coming to closure.   Tommy's proposal does give the WG the option as he says it i…

Another way to look at this is that some of us would really like to work on that proposal of Tommy’s, and this could be where we do it.   We could also do it in dprive, perhaps.   Some people want to work on this, some don’t.  But if this work were chartered, it would definitely get worked on, which is kind of the point of charter items in a working group’s charter.

Separately, there is a wish to be able to publish information about locally available private resolvers for cases where something like what Tommy is proposing is not configured, and for devices where what Tommy is proposing simply wouldn’t make sense.

However, the text at the end of Tommy’s proposed charter is constraining what would be an acceptable solution to this problem, not requiring adaptive DNS as a solution to all problems.  The constraint is simply that, like other IETF protocols, whatever the WG comes up with should document and address security and privacy concerns.   A solution that doesn’t do this would be out of scope for Tommy’s charter, and I think that’s desirable.

---

From: Tommy Pauly <[email-masked]>
Date: Thu, 09 Jan 2020 12:37:47 -0800

> While I agree that it is focused on D&S it includes text at the end pulling in draft-pauly-drive-adaptive-dns-privacy as a starting point. That takes is beyond just D & S and into more advanced beh…

I'm very happy to remove this line—that was mainly there to respond to people who had asked what a charter would look like that was based on this draft.

> As I said in my other note, I think it's the adding of these starting points that maybe causing a lot of the issues coming to closure.   Tommy's proposal does give the WG the option as he says it i…

I think if we can agree on the set of deliverables and work areas, we can forego specifying any particular draft. That certainly can and should be the work of the WG to decide.

Apart from that starting place, what other changes would be appropriate?

Best,
Tommy
> 
> -glenn
> 
> -- 
> Add mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/add

---

From: Rob Sayre <[email-masked]>
Date: Thu, 9 Jan 2020 12:43:17 -0800

On Thu, Jan 9, 2020 at 12:38 PM Tommy Pauly <tpauly=
[email-masked]> wrote:

> > On 1/8/20, 5:21 AM, "Add on behalf of Mirja Kuehlewind" <
> [email-masked] on behalf of [email-masked]> wrote:
> >
> >    Hi Vittorio,
> >
> >    The charter proposed by Tommy (see [1]) is exactly focusing on
> discovery and selection. What are you missing there?
> >
> >    Mirja
> >
> >    [1]
> https://urldefense.com/v3/__https://mailarchive.ietf.org/arch/msg/add/XudG5id0wwdRndR5za4G9ZbCo_w__;!!PIZeeW5wscynRQ!6VIda-Wm9zHc9cCrA2f6rb2CA7zSCfoqa3zme2EVesMB9ZvvbVPXkaMOefrKLp5_$
> >
> > While I agree that it is focused on D&S it includes text at the end
> pulling in draft-pauly-drive-adaptive-dns-privacy as a starting point. That
> takes is beyond just D & S and into more advanced behavior of resolvers as
> draft-pauly-drive-adaptive-dns-privacy goes beyond just D&S.
>
> I'm very happy to remove this line—that was mainly there to respond to
> people who had asked what a charter would look like that was based on this
> draft.
>
> >
> > As I said in my other note, I think it's the adding of these starting
> points that maybe causing a lot of the issues coming to closure.   Tommy's
> proposal does give the WG the option as he says it is subject to the WG's
> design choices.  A concern could be if the text about it being an option
> disappeared and it became a requirement to take on the material in that
> draft that goes beyond D&S and into resolver behavior.
>
> I think if we can agree on the set of deliverables and work areas, we can
> forego specifying any particular draft. That certainly can and should be
> the work of the WG to decide.
>

I'm not sure what Glenn means by "resolver behavior". Does that mean client
behavior? I looked at the draft again and didn't find any requirements on
servers that would be incompatible with existing implementations, though of
course there are some new capabilities around discovery and selection.

I'd work on the Adaptive DNS draft, but if people are allergic to adopting
it and iterating, perhaps a bulleted list of the problems it aims to solve
would do.

thanks,
Rob

---

From: "Deen, Glenn (NBCUniversal)" <[email-masked]>
Date: Thu, 9 Jan 2020 23:05:23 +0000

HI Rob

On 1/9/20, 12:44 PM, "Rob Sayre" <[email-masked]<mailto:[email-masked]>> wrote:
On Thu, Jan 9, 2020 at 12:38 PM Tommy Pauly <tpauly=[email-masked]<mailto:[email-masked]>> wrote:
> On Jan 9, 2020, at 12:26 PM, Deen, Glenn (NBCUniversal) <[email-masked]<mailto:[email-masked]>> wrote:
> On 1/8/20, 5:21 AM, "Add on behalf of Mirja Kuehlewind" <[email-masked]<mailto:[email-masked]> on behalf of [email-masked]<mailto:[email-masked]>> wrote:
>
>    Hi Vittorio,
>
>    [1] https://urldefense.com/v3/__https://mailarchive.ietf.org/arch/msg/add/XudG5id0wwdRndR5za4G9ZbCo_w__;!!PIZeeW5wscynRQ!6VIda-Wm9zHc9cCrA2f6rb2CA7zSCfoqa3zme2EVesMB9ZvvbVPXkaMOefrKLp5_$<https://urldefense.com/v3/__https:/mailarchive.ietf.org/arch/msg/add/XudG5id0wwdRndR5za4G9ZbCo_w__;!!PIZeeW5wscynRQ!6VIda-Wm9zHc9cCrA2f6rb2CA7zSCfoqa3zme2EVesMB9ZvvbVPXkaMOefrKLp5_$>
>

I'm not sure what Glenn means by "resolver behavior". Does that mean client behavior? I looked at the draft again and didn't find any requirements on servers that would be incompatible with existing implementations, though of course there are some new capabilities around discovery and selection.

[GD] I was referring to the section on server behavior in section 4 of the draft.  https://tools.ietf.org/html/draft-pauly-dprive-adaptive-dns-privacy-01

My objection being that it’s out of scope for a WG focused on D&S, it is an interesting discussion but I think fits into DPRIV.

There are other aspects of the draft that I think would work if broken out into a client D&S draft that would be appropriate for a D&S WG.

-glenn

---

From: Rob Sayre <[email-masked]>
Date: Thu, 9 Jan 2020 15:48:09 -0800

On Thu, Jan 9, 2020 at 3:05 PM Deen, Glenn (NBCUniversal) <
[email-masked]> wrote:

> On 1/9/20, 12:44 PM, "Rob Sayre" <[email-masked]> wrote:
>
> I'm not sure what Glenn means by "resolver behavior". Does that mean
> client behavior? I looked at the draft again and didn't find any
> requirements on servers that would be incompatible with existing
> implementations, though of course there are some new capabilities around
> discovery and selection.
>
>
>
> [GD] I was referring to the section on server behavior in section 4 of the
> draft.
> https://tools.ietf.org/html/draft-pauly-dprive-adaptive-dns-privacy-01
>
>
>
> My objection being that it’s out of scope for a WG focused on D&S, it is
> an interesting discussion but I think fits into DPRIV.
>

I see. Some parts of Section 4 are straightforwardly about discovery and
selection (for example: "Clients can use this list to optimize lookups for
common names.").

Perhaps the issue is Oblivious DoH? It seems to me that support for that
could be an important part of resolver selection for some clients, and it
will change the DNS ecosystem. However, it also seems to me that it's not a
protocol that can be prevented now that DoH is deployed.

thanks,
Rob

---

From: Glenn Deen <[email-masked]>
Date: Thu, 9 Jan 2020 15:58:17 -0800

On Thu, Jan 9, 2020 at 3:48 PM Rob Sayre <[email-masked]> wrote:

>> [GD] I was referring to the section on server behavior in section 4 of
>> the draft.

My objection here is about adding it to a wg focused on D&S by clients;
 isn’t helpful to keeping the D&S focused and on track.

Sure there maybe information to convey to clients that they can use in
their selection choice.   That would be in scope.   It’s the part where it
gets into specifying the behavior of the resolvers that gets to be too far
from D&S.

This new potential group we are discussing isn’t a broad group about dns
privacy , we already have Dpriv for that stuff.

-glenn deen

---

From: Rob Sayre <[email-masked]>
Date: Thu, 9 Jan 2020 16:02:53 -0800

> privacy , we already have Dpriv for that stuff.

Only the charter you proposed is that narrow, and I agree with other
messages that say it's too narrow. The other two proposals, from Tommy
Pauly and Ben Schwartz, are more broad.

thanks,
Rob

---

From: "Glenn Deen" <[email-masked]>
Date: Thu, 09 Jan 2020 18:58:54 -0800

> Pauly and Ben Schwartz, are more broad.

That’s only somewhat true.  All three focus on Discovery and Selection 
and even the one I proposed isn’t actually all that narrow since it 
defers to the WG and the ADs on where they need to go.

Several comments on other proposals were concerned that they were 
opening up potential ratholes in their scope and already there is a 
whole thread going on here on ADD about what Trust means in a variety of 
contexts. A lot of that is because the Tommy Paul and Ben Schwartz 
proposals pulled in work beyond D&S and got into some discussion about 
resolver behavior and even policy via the drafts they mentioned.

I’m not trying to curtailing any of these other discussions if people 
want to have them, but these ever ongoing postings on the ADD list have 
made very little progress to no progress toward resolution. Meanwhile we 
have Encrypted DNS deployments going on that have a critical need for 
scalable and practical discovery and selection.  Pulling too much of 
that into the WG just adds to the quicksand the group needs to wade 
through. This whole area is such a broad topic area with no shortage of 
opinions, vision, or creativity - but at some point there is a need to 
do triage and get busy on highest priority need.

My proposal was simply to break the log jam and get some real work 
started.   If the ADs want to expand the WG scope at anytime either day 
1 or day 100 of the WG’s life, as  Ted L. pointed out earlier today, 
they  can.

All 3 proposals have good bones in my opinion, but I believe that the 
group will be primed for a higher chance of success if it can start by 
not trying to bite off too big a first bite. Whatever proposal is 
REV’d to produce a workable charter is fine.  I even posted an edited 
version of the Pauly proposal a little earlier in response to Ted’s 
question of how I would edit that proposal.

As for comments received: I’ll note that while there have been posts 
asserting that they’d like X or Y included, or in one case that 
they’d want to see DHCP excluded, there have also been a couple of 
posts in support of what I wrote and while some said it may not include 
everything they might want - they could live with it as a start.

Being realistic, even limiting the work to Discovery and Selection gives 
the WG a lot of work to do, and hard work at that.  We already have 
different D&S approaches being put on the table that when you dig into 
them are pretty far apart and the WG hasn’t even opened its door for 
draft submissions.  Proposals range from the client getting the info 
from the network; from a domain communicating  what the DNS services it 
recommends; clever applications of DNSSEC; some advocating applications 
of DHCP; and others.  We also already have a client deployed in the wild 
that comes with the list built into the client which then combines that 
with the clients current DNS/53 settings to make its decision. So no 
shortage of approaches.  This isn’t about being narrow so as to 
sidestep interesting proposals on how to evolve DNS, it is instead about 
taking a first bite that has an actual chance of progress in a 
reasonable time frame.

Glenn

---

From: Rob Sayre <[email-masked]>
Date: Thu, 9 Jan 2020 19:20:59 -0800

On Thu, Jan 9, 2020 at 6:59 PM Glenn Deen <[email-masked]> wrote:

> That’s only somewhat true.

...

It is definitely true, since the other proposals include the Adaptive DNS
draft .

My sense is that the charter debate isn't too important, and folks have
moved on to implementation centered around Adaptive DNS. I'm going to do
that too. If I come up with anything useful, it will be Apache 2 licensed.

thanks,
Rob

---

From: Mirja Kuehlewind <[email-masked]>
Date: Fri, 10 Jan 2020 11:18:28 +0100

> On 9. Jan 2020, at 21:43, Rob Sayre <[email-masked]> wrote:
> 
> I'd work on the Adaptive DNS draft, but if people are allergic to adopting it and iterating, perhaps a bulleted list of the problems it aims to solve would do.

I don’t think people are allergic to adopting the draft. I think people want to make sure that when adopted the scope of the current draft can still be changed if agreed. 

If it males people feel better about this charter, I think it would be okay to remove the last sentence in the proposed charter, given that the scope of draft-pauly-dprive-adaptive-dns-privacy is covered by the rest of the charter text. However, I would understand “as a starting point” such that is the current content does not constrain the scope of the charter and therefore, I also don’t see a problem to leave it in.

I think the important part is that there are people who want to work on draft-pauly-dprive-adaptive-dns-privacy and I assume that the authors will ask soon for adoption of this draft if this groups gets charter. So when we talk about this charter, people should be aware of that.

One more practical question: Currently draft-pauly-dprive-adaptive-dns-privacy also proposed the use of pauly-dprive-oblivious-doh. However, I assume that pauly-dprive-oblivious-doh would actually stay in dprive as it seems already in scope for that group; is that correct?

---

From: Andrew Campling <[email-masked]>
Date: Fri, 10 Jan 2020 11:17:41 +0000

I think Glenn's proposal provides the best basis on which to build a WG charter.

Andrew

-----Original Message-----
From: Glenn Deen <[email-masked]>
Sent: 10 January 2020 02:59
To: ADD Mailing list <[email-masked]>
Subject: Re: [Add] A proposed charter for ABCD

On 9 Jan 2020, at 16:02, Rob Sayre wrote:

> On Thu, Jan 9, 2020 at 3:58 PM Glenn Deen <[email-masked]<mailto:[email-masked]>> wrote:
>
>>
>>
>> On Thu, Jan 9, 2020 at 3:48 PM Rob Sayre <[email-masked]<mailto:[email-masked]>> wrote:
>>
>>> [email-masked]<mailto:[email-masked]>> wrote:
>>>
>>>> I'm not sure what Glenn means by "resolver behavior". Does that
>>>> mean client behavior? I looked at the draft again and didn't find
>>>> any requirements on servers that would be incompatible with
>>>> existing implementations, though of course there are some new
>>>> capabilities around discovery and selection.
>>>>
>>>>
>>>>
>>>> [GD] I was referring to the section on server behavior in section 4
>>>> of the draft.
>>>> My objection being that it’s out of scope for a WG focused on D&S,
>>>> it is an interesting discussion but I think fits into DPRIV.
>>>>
>>>
>>> I see. Some parts of Section 4 are straightforwardly about discovery
>>> and selection (for example: "Clients can use this list to optimize
>>> lookups for common names.").
>>>
>>> Perhaps the issue is Oblivious DoH? It seems to me that support for
>>> that could be an important part of resolver selection for some
>>> clients, and it will change the DNS ecosystem. However, it also
>>> seems to me that it's not a protocol that can be prevented now that
>>> DoH is deployed.
>>>
>>
>>
>> My objection here is about adding it to a wg focused on D&S by
>> clients;  isn’t helpful to keeping the D&S focused and on track.
>>
>> gets into specifying the behavior of the resolvers that gets to be
>> too far from D&S.
>>
>> This new potential group we are discussing isn’t a broad group about
>> dns privacy , we already have Dpriv for that stuff.
>>
>

That’s only somewhat true.  All three focus on Discovery and Selection and even the one I proposed isn’t actually all that narrow since it defers to the WG and the ADs on where they need to go.

Several comments on other proposals were concerned that they were opening up potential ratholes in their scope and already there is a whole thread going on here on ADD about what Trust means in a variety of contexts. A lot of that is because the Tommy Paul and Ben Schwartz proposals pulled in work beyond D&S and got into some discussion about resolver behavior and even policy via the drafts they mentioned.

I’m not trying to curtailing any of these other discussions if people want to have them, but these ever ongoing postings on the ADD list have made very little progress to no progress toward resolution. Meanwhile we have Encrypted DNS deployments going on that have a critical need for scalable and practical discovery and selection.  Pulling too much of that into the WG just adds to the quicksand the group needs to wade through. This whole area is such a broad topic area with no shortage of opinions, vision, or creativity - but at some point there is a need to do triage and get busy on highest priority need.

My proposal was simply to break the log jam and get some real work
started.   If the ADs want to expand the WG scope at anytime either day
1 or day 100 of the WG’s life, as  Ted L. pointed out earlier today, they  can.

All 3 proposals have good bones in my opinion, but I believe that the group will be primed for a higher chance of success if it can start by not trying to bite off too big a first bite. Whatever proposal is REV’d to produce a workable charter is fine.  I even posted an edited version of the Pauly proposal a little earlier in response to Ted’s question of how I would edit that proposal.

As for comments received: I’ll note that while there have been posts asserting that they’d like X or Y included, or in one case that they’d want to see DHCP excluded, there have also been a couple of posts in support of what I wrote and while some said it may not include everything they might want - they could live with it as a start.

Being realistic, even limiting the work to Discovery and Selection gives the WG a lot of work to do, and hard work at that.  We already have different D&S approaches being put on the table that when you dig into them are pretty far apart and the WG hasn’t even opened its door for draft submissions.  Proposals range from the client getting the info from the network; from a domain communicating  what the DNS services it recommends; clever applications of DNSSEC; some advocating applications of DHCP; and others.  We also already have a client deployed in the wild that comes with the list built into the client which then combines that with the clients current DNS/53 settings to make its decision. So no shortage of approaches.  This isn’t about being narrow so as to sidestep interesting proposals on how to evolve DNS, it is instead about taking a first bite that has an actual chance of progress in a reasonable time frame.

Glenn