Subject: [hrpc] [[email-masked]: Re: I-D Action: draft-vixie-dns-rpz-04.txt]

From: Stephane Bortzmeyer <[email-masked]>
Date: Tue, 20 Dec 2016 17:08:20 +0100

I know that everyone is busy re-reading draft-irtf-hrpc-research for
the Last Call but I want to inform you about a discussion which is
relevant for HRPC, in the IETF working group dnsop. RPZ is a technique
to more easily implement lies in a DNS resolver, useful (among other
things for censorship).

The discussion in dnsop, as predictable, revolves around "people are
doing it, so they should at least do it in a technically correct way"
and "we don't standardize bad techniques, period".

Subject: Re: I-D Action: draft-vixie-dns-rpz-04.txt
From: [email-masked]
To: [email-masked]
Cc: [email-masked], [email-masked]
Date: Mon, 19 Dec 2016 09:16:28 +0100 (CET)
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>

> > So if this is the IP of a phishing site or the IP of an command and
> > control host that tells its bot to execute criminal action you still
> > valid the accuracy of the answer higher then possible damage this
> > could do to your user?
> > 
> yes. 
> 
> In your example, ethically, it is a problem that should be addressed on IP, not on DNS
> 
> It is never okay to tell lies.

Unfortunately the real world isn't that simple.

Sometimes you are required by law to tell lies. Case in point: Various
domains belonging to Pirate Bay and several other torrent providers
have been explicitly blocked in Norway - explicitly as in: The biggest
ISPs in Norway (I happen to work for one of these) have been told by
the Oslo district court to block access to a list of domains supplied
by the court, and that this is to be implemented through DNS blocking
(lies, if you will).

It doesn't matter whether I *like* this or not, and it also doesn't
matter whether the domains in question are easily available by using
OpenDNS, Google Public DNS, running your own name server, etc. ISPs
are still required to block access as long as the verdict from the
Oslo district court is valid.

Today this blocking is done without using RPZ. Having RPZ standardized
and implemented in more DNS software would make it possible to perform
the same blocking as mentioned above with fewer moving parts and thus
a simpler system less likely to have "interesting" failure modes.

Note that it makes absolutely no difference to the blocking described
above whether the RPZ draft is published as an RFC or not - in both
cases the blocking would still be performed, because it is required
by law.

Steinar Haug, AS2116

_______________________________________________
DNSOP mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/dnsop

---

From: avri doria <[email-masked]>
Date: Tue, 20 Dec 2016 12:17:21 -0500

Hi,

Have also been following that.
Would be interesting to see the guidelines tested against the RPZ.
Might be a nice draft for Copenhagen.

avri

Ps. I hope people are reading and reviewing.  The silence has been quite
noticeable.
Reminder: <https://tools.ietf.org/html/draft-irtf-hrpc-research-07> in
HRPC RG Last Call

On 20-Dec-16 11:08, Stephane Bortzmeyer wrote:
> hrpc mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/hrpc

---
This email has been checked for viruses by Avast antivirus software.
https://www.avast.com/antivirus