Subject: Re: [Add] A proposed charter for ABCD

From: Christian Huitema <[email-masked]>
Date: Wed, 1 Jan 2020 10:45:29 -1000

On 12/30/2019 4:08 PM, Rob Sayre wrote:
>
>
> On Mon, Dec 30, 2019 at 6:01 PM John Levine <[email-masked]
> <mailto:[email-masked]>> wrote:
>
>     In article
>     <CAChr6Sxm2GuHFTqOjtq=[email-masked]..com
>     <mailto:[email-masked]>> you write:
>     >Here is a lobbying letter from an industry association:
>     >https://www.ncta.com/sites/default/files/2019-09/Final%20DOH%20LETTER%209-19-19.pdf
>     >
>     >It is from September 19th, 2019. It mentions advertising
>     explicitly. There
>     >are numerous press articles about this letter, so I won't delve
>     further
>     >into its contents.
>
>     The letter you linked to is two pages of FUD accusing Google of
>     planning to do all sorts of terrible things without a shred of
>     evidence.  It is flatly contradicted by Google's own statements about
>     their DoH deployment plans.
>
>
> I can't say I disagree with your assessment.
>
> But, the letter does mention that encrypted DNS might harm competition
> in the advertising space. The actual text is:
>
> "This could inhibit competitors and possibly foreclose competition in
> advertising and other industries."
>
> How could encrypted DNS harm competition in advertising if unencrypted
> DNS weren't being used for advertising?

The NCTA letter is obviously framed by telco lawyers attempting to sue
Google for some alledged potential antitrust violation. The argument
appears to be that by blocking the leakage of private information to
network providers, Google is allegedly attempting to prevent these
network providers to capture the personal data required to "build better
advertisements" and thus compete with Google.

Or, put it another way, leakage of personal data is a goldmine that is
making Google and Facebook rich, and these telco lawyers are furious at
anything that would prevent them from also digging the mine. That
includes being furious not just at Google, but also at any other attempt
to plug the leaks, including the relatively feeble attempts of the IETF.

I have zero sympathy for the argument of the telco's lawyers. I believe
all this trafficking in personal data should stop. But I also believe
that deployments should be carefully engineered to actually reduce
leakage, not merely move the leaks around.

-- Christian Huitema

---

From: Rob Sayre <[email-masked]>
Date: Wed, 1 Jan 2020 14:17:06 -0800

On Wed, Jan 1, 2020 at 12:45 PM Christian Huitema <[email-masked]>
wrote:

> On Mon, Dec 30, 2019 at 6:01 PM John Levine <[email-masked]> wrote:
>
>> In article <CAChr6Sxm2GuHFTqOjtq=
>> [email-masked]..com
>> <[email-masked]>> you write:
>> >It is from September 19th, 2019. It mentions advertising explicitly.
>> There
>> >are numerous press articles about this letter, so I won't delve further
>> >into its contents.
>>
> But, the letter does mention that encrypted DNS might harm competition in
> the advertising space. The actual text is:
>
> How could encrypted DNS harm competition in advertising if unencrypted DNS
> weren't being used for advertising?
>
>
> network providers, Google is allegedly attempting to prevent these network
> providers to capture the personal data required to "build better
> anything that would prevent them from also digging the mine. That includes
> being furious not just at Google, but also at any other attempt to plug the
> leaks, including the relatively feeble attempts of the IETF.
>
> all this trafficking in personal data should stop. But I also believe that
> deployments should be carefully engineered to actually reduce leakage, not
> merely move the leaks around.
>

I don't disagree with that, I was only responding to the claim that ideas
about ISP use of DNS data are misinformed (there are many ISPs, and they
have many different policies).

Certainly the responses to that telco letter indicate the topic is actively
debated:
https://www.vice.com/en_us/article/zmj5p9/mozilla-firefox-asks-congress-to-investigate-internet-service-providers-data-selling-collection

Here is a web page about an experiment to detect query data sharing,
including in Europe:
https://blog.benjojo.co.uk/post/ISPs-sharing-DNS-query-data

thanks,
Rob

---

From: "Ralf Weber" <[email-masked]>
Date: Thu, 02 Jan 2020 10:33:34 +0100

Moin!

> https://blog.benjojo.co.uk/post/ISPs-sharing-DNS-query-data
That is just a usual open resolver tool and looking for zombie queries.
It tells you nothing about if the ISP is actually sharing that data as
within the AS range of an ISP there might be lots of different resolvers
used especially if the ISP also serves business and enterprise customers.

Also open resolvers are often operated as or on honeypots and thus it
somehow is expected that this data shows up at security companies that
might replay/look at it.

This fact that the ISP might not sell the data is even mentioned at the
bottom of the report, but of course not in the headline as this wouldn’t
generate clicks.

So long
-Ralf
—--
Ralf Weber

---

From: "Winfield, Alister" <[email-masked]>
Date: Thu, 2 Jan 2020 09:49:58 +0000

I also note that some resolver software implementations improve customer resolution times by pre-fetching near cache expiry without any associated user request. Just something to remember when looking at request patterns.

Alister

On 02/01/2020, 09:34, "Add on behalf of Ralf Weber" <[email-masked] on behalf of [email-masked]> wrote:

    Moin!

    On 1 Jan 2020, at 23:17, Rob Sayre wrote:
    > https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fblog.benjojo.co.uk%2Fpost%2FISPs-sharing-DNS-query-data&amp;data=02%7C01%7Calister.winfield%40sky.uk%7C7760a222dc7a4d27bbc608d78f66e42a%7C68b865d5cf184b2b82a4a4eddb9c5237%7C0%7C0%7C637135544398450561&amp;sdata=M2gB8%2FUpbuSGjst5Ouopj0SCJosIxILEa6ikPEx7%2Bi4%3D&amp;reserved=0

    So long
    -Ralf
    —--
    Ralf Weber

    --
    Add mailing list
    [email-masked]
    https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fadd&amp;data=02%7C01%7Calister.winfield%40sky.uk%7C7760a222dc7a4d27bbc608d78f66e42a%7C68b865d5cf184b2b82a4a4eddb9c5237%7C0%7C0%7C637135544398450561&amp;sdata=lNdqa0jd8422ZYgq1Tspvu2pJRn3Ynl2QKSV5dTt5kc%3D&amp;reserved=0
    --------------------------------------------------------------------
    This email is from an external source. Please do not open attachments or click links from an unknown or suspicious origin. Phishing attempts can be reported by sending them to [email-masked] as attachments. Thank you
    --------------------------------------------------------------------

Information in this email including any attachments may be privileged, confidential and is intended exclusively for the addressee. The views expressed may not be official policy, but the personal views of the originator. If you have received it in error, please notify the sender by return e-mail and delete it from your system. You should not reproduce, distribute, store, retransmit, use or disclose its contents to anyone. Please note we reserve the right to monitor all e-mail communication through our internal and external networks. SKY and the SKY marks are trademarks of Sky Limited and Sky International AG and are used under licence.

Sky UK Limited (Registration No. 2906991), Sky-In-Home Service Limited (Registration No. 2067075), Sky Subscribers Services Limited (Registration No. 2340150) and Sky CP Limited (Registration No. 9513259) are direct or indirect subsidiaries of Sky Limited (Registration No. 2247735). All of the companies mentioned in this paragraph are incorporated in England and Wales and share the same registered office at Grant Way, Isleworth, Middlesex TW7 5QD

---

From: Rob Sayre <[email-masked]>
Date: Thu, 2 Jan 2020 12:58:27 -0800

> bottom of the report, but of course not in the headline as this wouldn’t

Sure, but the fact that data "shows up" at other companies (whether they
are doing security, advertising, or something else) is what efforts like
the TRR program are trying to prevent.

Whether they actually sold the data is of course not obvious from the
experiment.

thanks,
Rob

---

From: Brian Dickson <[email-masked]>
Date: Thu, 2 Jan 2020 13:24:37 -0800

> the TRR program are trying to prevent.

Actually, IMHO, no, this is exactly what TRR programs are *not* trying to
prevent, and the fact that these honeypots get adversely affected is the
"poster child" of the problem with TRRs being substituted for resolvers in
use.

Honeypot DNS servers listen on arbitrary ranges of IP addresses, which are
either known to not operate "real" resolvers, or are known to operate
resolvers used by malware operators (think C&C related servers).

Traffic to the real DNS servers on those ranges of IPs, by definition is
abnormal, and likely malicious, or at a minimum suspicious.

That traffic may be seen as the result of network-level redirection by
network operators (including enterprises), and may not necessarily occur as
the result of "natural routing" on a destination IP address alone.

If you think that TRR programs are trying to prevent that particular
traffic, maybe you could explain why you believe that, or what that would
actually do for anyone's benefit?

Brian

---

From: "Ralf Weber" <[email-masked]>
Date: Fri, 03 Jan 2020 07:44:51 +0100

Moin!

Changing topics to not derail the thread that started this.

> the TRR program are trying to prevent.
Well the first TRR Cloudflare is sharing its data with APNIC for 
research.
And as shown by others switching DNS resolution to a central provider
does not actually take away information from the network provicder, but
merly adds another party that now also has your data:
	https://blog.powerdns.com/2019/09/25/centralised-doh-is-bad-for-privacy-in-2019-and-beyond/

> Whether they actually sold the data is of course not obvious from the
Wether they actually had anything to with the data sharing is not 
obvivous.
Thus the experiment is moot.

So long
-Ralf
—--
Ralf Weber

---

From: Rob Sayre <[email-masked]>
Date: Thu, 2 Jan 2020 23:47:55 -0800

> Well the first TRR Cloudflare is sharing its data with APNIC for

Hi,

There are some old references to a deal about 1.1.1.1 research data sharing
with APNIC, but that would seem to straightforwardly cross the newer
Mozilla TRR terms:

"2. The resolver must not retain, sell, or transfer to any third party
(except as may be required by law) any personal information, IP addresses
or other user identifiers, or user query patterns from the DNS queries sent
from the Firefox browser."
https://wiki.mozilla.org/Security/DOH-resolver-policy

Do you have a reference showing that Mozilla DoH traffic under that TRR
policy is being shared with APNIC?

> https://blog.powerdns.com/2019/09/25/centralised-doh-is-bad-for-privacy-in-2019-and-beyond/

Not sure about "as shown". Concerns about governmental jurisdiction seem
fair, but what's stopping a European company from agreeing to a TRR policy?
(from anyone they trust, not only Mozilla)

The other concerns in that post might be accurate for the moment (e.g.,
those about SNI), but they don't really make a compelling case to preserve
the status quo. It's not clear that it makes sense to continue delegating
DNS to the local network by default, especially since we're only talking
about the case where the network operator does not control the devices.

> Thus the experiment is moot.

It's fair to say it's not clear how the data got shared, and it's
definitely not clear that it was sold.

However, the data did get shared, something you termed "expected".

thanks,
Rob

---

From: [email-masked]
Date: Fri, 03 Jan 2020 10:31:19 +0100 (CET)

> (from anyone they trust, not only Mozilla)

Referring to https://wiki.mozilla.org/Security/DOH-resolver-policy
specifically "Blocking & Modification Prohibitions":

1. "should not by default block or filter domains unless specifically
required by law" - this covers a number of domains we are required to
block by the courts (for copyright reasons). So no problem here.

However, we also block "child porn" domains. This is a voluntary
agreement and as such is not covered by "required by law". This is
done by all large Norwegian providers, see

  https://en.wikipedia.org/wiki/CIRCAMP#Evaluating_sites_for_CSAADF
  https://no.wikipedia.org/wiki/Kripos%27_barnepornofilter

Since this is not directly "required by law", we (AS 2116) could not
agree to the current Mozilla TRR policy.

(For those who wonder - why don't we simply drop this filtering:

- The minister of justice at the time when this was introduced, Knut
Storberget, explicitly threatened to make the filter compulsory if
the ISPs didn't sign up on the "voluntary" use. See for instance
this article from 2008, in Norwegian:
https://www.nrk.no/norge/--ta-ansvar-mot-barneporno_-1.6203962

- Management wants us to keep the filtering - possibly because this
makes it look like "we are doing something" regarding child porn.
Yes, we have told them multiple times that it is easy to evade such
filtering.)

Steinar Haug, AS 2116

---

From: [email-masked]
Date: Fri, 03 Jan 2020 10:35:20 +0100 (CET)

> For those who wonder - why don't we simply drop this filtering:
> 

The actual letter is available here:

https://file.wikileaks.org/file/norway-knut-storberget-censorship-2009.pdf

Steinar Haug, AS 2116

---

From: "John R Levine" <[email-masked]>
Date: 3 Jan 2020 10:14:20 -0500

> (For those who wonder - why don't we simply drop this filtering:

Thanks.  This is a good example of why a lot of formulations of the 
"policy" problem are hopelessly naive.  I gather that your situation is 
the norm in most of Europe.

Regards,
John Levine, [email-masked], Taughannock Networks, Trumansburg NY
Please consider the environment before reading this e-mail. https://jl.ly

---

From: [email-masked]
Date: Fri, 03 Jan 2020 17:12:32 +0100 (CET)

> "policy" problem are hopelessly naive.  I gather that your situation
> is the norm in most of Europe.

I don't know if it's the norm. I *do* know that Norway is certainly
not alone in using such child porn filtering.

Steinar Haug, AS 2116

---

From: Eric Rescorla <[email-masked]>
Date: Fri, 3 Jan 2020 08:15:52 -0800

On Thu, Jan 2, 2020 at 11:48 PM Rob Sayre <[email-masked]> wrote:

> On Thu, Jan 2, 2020 at 10:44 PM Ralf Weber <[email-masked]> wrote
>
>
> the status quo.

The SNI argument seems a little odd here, given that (1) we are actively
working on encrypting SNI and (2) concealing the DNS queries is essential
to making ESNI work.

-Ekr

---

From: Ted Lemon <[email-masked]>
Date: Fri, 3 Jan 2020 11:28:18 -0500

> done by all large Norwegian providers, see

This problem is easily solved: stop blocking the domains voluntarily and encourage your government to enact the law.  Why should this be done on a pseudo-voluntary basis?   If there is a public policy benefit to doing it, why not have an actual public policy?

---

From: Vittorio Bertola <[email-masked]>
Date: Fri, 3 Jan 2020 17:43:23 +0100 (CET)

> Il 03/01/2020 17:12 [email-masked] ha scritto:
> 

The UK has basically the same approach as Norway; in other European countries (the ones within the EU) there often are actual laws and/or public authority orders, though.

In fact, in the EU this is the subject of an ongoing policy debate, as the European network neutrality regulation requires that any "in-network" filtering by ISPs happens because of a national law (or of network security), but it is arguable whether DNS filtering happens at the network layer or at the application layer, so the regulatory body tasked with interpreting the regulation has recently put out a proposal that says that DNS filtering is allowed on "secondary DNS resolvers" but not on "primary DNS resolvers", so there were plenty of comments, half of which suggested that it would be really bad to allow filtering on "secondary DNS resolvers", while the other half suggested that it would be really bad to disallow filtering on "primary DNS resolvers", though in the end no one really understands what they are and how to tell a "primary DNS resolver" from a "secondary DNS resolver".

So yes, a lot of fun (and a lot of unclear liabilities for ISPs, no matter what they do).

(And to Ted's objection: I agree with you, governments should just pass laws, but it takes time and effort and it is subject to political risks, so it's just easier for them to rely on self-regulation; and in the end, no operator, except maybe very small "militant" ones, would ever want to favour child abuse in any way, or even just to pass publicly for the one that does not want to block child abuse.)

-- 
 
Vittorio Bertola | Head of Policy & Innovation, Open-Xchange
[email-masked] 
Office @ Via Treviso 12, 10144 Torino, Italy

---

From: Jim Reid <[email-masked]>
Date: Fri, 3 Jan 2020 17:02:46 +0000

> On 3 Jan 2020, at 16:28, Ted Lemon <[email-masked]> wrote:
> 
> This problem is easily solved: stop blocking the domains voluntarily and encourage your government to enact the law.

Comments like this are unhelpful. They can result in governments passing legislation that has even worse implications for privacy and security. [Remember the Australian politician who said crypto in that country would be determined by the laws of Australia and not those of mathematics?] And FWIW you might as well be telling criminals to stop breaking the law for all the good that would do too.

> Why should this be done on a pseudo-voluntary basis?

Because the legislative cycle can take too long and can't keep up with technology. You might recall legislators were still trying to figure out how to deal with Napster long after the IPR lawyers got those sorts of services shut down.

>   If there is a public policy benefit to doing it, why not have an actual public policy?

The policy is generally publicised as "block child abuse imagery" and ISPs are left to sort out the implementation details. Sometimes they choose DNS-based approaches. Sometimes they don't. And from an ISP's perspective, voluntarily adopting some blocklist means they have less exposure to prosecution or other forms of court action. Or spending money to develop and maintain their own blocklists with all the risks that that brings.

The public policy benefit is having a mechanism that, while not foolproof, is "good enough". It stops the stupidest criminals accessing illegal content so that law enforcement can concentrate their resources on the more sophisticated offenders who are using VPNs or P2P or whatever. The politicians can also show to their voters that Something Has Been Done about the problem.

---

From: Rob Sayre <[email-masked]>
Date: Fri, 3 Jan 2020 12:54:16 -0800

On Fri, Jan 3, 2020 at 9:03 AM Jim Reid <[email-masked]> wrote:

>
> The public policy benefit is having a mechanism that, while not foolproof,
> is "good enough".
>

Another person on this thread used the term "easy to evade". I agree that
the public policy concern is valid, but doubt the effectiveness of
DNS-based solutions, and don't think the IETF /can/ design protocols around
unstated policies.

Again, it's probably better to focus on concrete use cases. While some of
what's quoted below is not controversial functionality, other parts could
clearly raise concerns, and lead a user to prefer an alternate DNS provider
(even as a default).

Here are some quotes:

"CSPs don't need to invest in big data platforms or systems to get this
type of knowledge about subscribers--they already have access to the data
through DNS. Because it powers virtually every web site, service and
application request made, DNS is perfectly suited to gain granular insights
about subscribers and other members of their households..."

https://blogs.akamai.com/2016/06/whats-in-a-name-leveraging-dns-to-personalize-services.html

"In fact, the use of DNS--which already exists in CSP networks--has over 70
different business use cases that have been identified by Nominum, now part
of Akamai.
...
DNS: not just for domain lookups anymore
The areas where we've identified use cases span organizations and
functions. They include:
- cybersecurity defense
- value-added services
- customer experience management
- marketing and promotions
- billing and revenue management
- legal and regulatory compliance"

https://blogs.akamai.com/201/05/cross-organizational-use-cases-show-value-of-dns-in-digital-transformation.html

thanks,
Rob

---

From: "Livingood, Jason" <[email-masked]>
Date: Mon, 6 Jan 2020 15:07:47 +0000

> This is a voluntary agreement and as such is not covered by "required by law".

[JL] In many legal venues, this is why contracts often have the clause "as required by or authorized under the law" rather than just "as required by law". But for ISPs, usually the concern is specific to a particular law (e.g. Statute XYZ, Section 1, Part 7) and so an alternative to the exclusive language (required by) is to add in specific laws with which an organization may need to comply. But its complicated...