Subject: [DNSOP] Alissa Cooper's No Objection on draft-ietf-dnsop-dns-capture-format-08: (with COMMENT)

From: Alissa Cooper <[email-masked]>
Date: Tue, 20 Nov 2018 17:18:23 -0800

Alissa Cooper has entered the following ballot position for
draft-ietf-dnsop-dns-capture-format-08: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-dnsop-dns-capture-format/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

I support Benjamin's first DISCUSS point. In addition to documenting the
privacy considerations, I think it's important for this document to be crystal
clear about who is meant to be doing the data collection -- namely, the server
operator. There are some statements in the document that otherwise could be
construed to be encouraging third-party passive monitoring of DNS traffic
without explaining why, which seems like a problem:

Section 1:

"There has long been a need to collect DNS queries and responses on
   authoritative and recursive name servers for monitoring and analysis."

Section 3:

"In an ideal world, it would be optimal to collect full packet
   captures of all packets going in or out of a name server."

---

From: Joe Abley <[email-masked]>
Date: Tue, 20 Nov 2018 18:01:54 -0800

Hi Alissa!

> without explaining why, which seems like a problem:

I think it may be worth exploring why that's a problem.

I think a capture format should be oblivious to the circumstances of
the capture; otherwise you're heading down a road well-trodden by such
ludicrous ideas as text format definitions putting restrictions on the
kinds of stories people can write, or scripts that are not to be used
to write particular words.

The usefulness of a capture format is not improved by putting
conditions on its use, and neither is user privacy. The way to privacy
is surely to use transports where clear text is only available where
it needs to be visible.

So I don't understand your comment. (Quite possibly I'm just being
dim; I just got home from Bangkok. I came the long way round.)

I think providing use-cases in the document to illustrate what it's
for us good, but I don't think they should be prescriptive (in any
direction).

Joe

---

From: Alissa Cooper <[email-masked]>
Date: Wed, 21 Nov 2018 05:58:43 -0500

> On Nov 20, 2018, at 9:01 PM, Joe Abley <[email-masked]> wrote:
> 
> Hi Alissa!
> 
> the capture;

Ok. This document is not at all oblivious, though (see Section 3). I read the document to be implicitly assuming the server operator to be doing (or at least in control of) the data collection, which is why the two statements I pointed out seemed so striking for their lack of declaring that limitation. If the document was meant to be oblivious, it shouldn’t make normative (in the dictionary definition sense) claims about what is ideal, optimal, or necessary. 

Alissa

> otherwise you're heading down a road well-trodden by such

---

From: Sara Dickinson <[email-masked]>
Date: Wed, 21 Nov 2018 15:11:09 +0000

> On 21 Nov 2018, at 10:58, Alissa Cooper <[email-masked]> wrote:
> 
> 
> 

Hi Alissa, 

If we update the statements as below to clarify the context would that address your concern?

Section 1:
OLD:
"There has long been a need to collect DNS queries and responses on
  authoritative and recursive name servers for monitoring and analysis.”

NEW”
“There has long been a need for server operators to collect DNS queries and responses on
  authoritative and recursive name servers for monitoring and analysis.”

Section 3:

OLD:
"In an ideal world, it would be optimal to collect full packet
  captures of all packets going in or out of a name server.”

NEW:
“From a purely server operator perspective, collecting full packet
 captures of all packets going in or out of a name server provides the 
 most comprehensive picture of network activity.”

Sara.

---

From: Alissa Cooper <[email-masked]>
Date: Wed, 21 Nov 2018 10:31:06 -0500

> On Nov 21, 2018, at 10:11 AM, Sara Dickinson <[email-masked]> wrote:
> 
> 
> 
>> On 21 Nov 2018, at 10:58, Alissa Cooper <[email-masked] <mailto:[email-masked]>> wrote:
>> 
>> 
>> 
>>> On Nov 20, 2018, at 9:01 PM, Joe Abley <[email-masked] <mailto:[email-masked]>> wrote:
>>> 
>>> Hi Alissa!
>>> 
>>> On Nov 20, 2018, at 20:18, Alissa Cooper <[email-masked] <mailto:[email-masked]>> wrote:
>>> 

Yes, thank you.
Alissa