Subject: [Add] Landscape

From: Rob Sayre <[email-masked]>
Date: Sat, 24 Aug 2019 13:01:24 -0700

Hi,

I thought I would update that list of features of the DNS landscape I sent.
Since it sounds like there will be chartered work soon enough, I thought I
would collect what I and others have found, and correct a few things.

I don't think it would be especially valuable to nitpick the list, but I do
think it might make a good wiki page when the group has one. On the wiki,
you can edit any wording or framing.

thanks,
Rob

* ISPs use Classic DNS to fuel ad networks (they could still do this if
they provided DoT/DoH)

* ISPs intercept Classic DNS, and occasionally trigger certificate warnings
if they return a "blocked page"[1], similar to TLS errors one might see
from a captive portal.

* ISPs that provide roaming WiFi sometimes instruct users to install
EAP-TTLS certificates in their OS root stores, and this can cause confusion
about what they are for. I found that several UK ISPs have done this.

* ISPs sometimes distribute routers that prevent the user from changing DNS
settings.

* There are entertainment devices (Google, probably some Roku apps)
hard-coding DNS services, ignoring the OS and network administrator

* There are consumer routers that use centralized DNS services without user
interaction, ignoring the OS and network administrator (unless the router
owner counts as the admin...)

* There are Android handsets that enable a VPN on certain networks by
default, and all networks with user interaction, bypassing local DNS

* Home routers are being exploited to hijack Classic DNS

* Many ISPs simply ask Google to provide their DNS service, resulting in
more centralization than might first be apparent

* Browsers do tend to obey "Group Policy" and other similar administrator
features

* And, of course, browsers are shipping DoH, ignoring the OS and network
administrator

thanks,
Rob

[1] I want to be as dispassionate about this issue as possible. It does
seem like Vodafone may have had a misguided step in their support script,
where users were asked to install the certificate for the block page
server. This seems like it was done to fix the error the user was seeing
and display the block page, but not for anything else.

---

From: "Ian Maddison" <[email-masked]>
Date: Sun, 25 Aug 2019 10:00:40 +0200

Hi Rob,

In case you hadn't noticed, 9 of the last 10 mails sent to this list appear to be written by yourself. Another type of over centralisation surely.

Just Sayring ;)

On Sat, 24 Aug 2019, at 22:02, Rob Sayre wrote:
> Hi,
> 
> I thought I would update that list of features of the DNS landscape I sent. Since it sounds like there will be chartered work soon enough, I thought I would collect what I and others have found, and correct a few things.
> 
> I don't think it would be especially valuable to nitpick the list, but I do think it might make a good wiki page when the group has one. On the wiki, you can edit any wording or framing.
> 
> thanks,
> Rob
> 
> 
> * ISPs use Classic DNS to fuel ad networks (they could still do this if they provided DoT/DoH)
> * ISPs intercept Classic DNS, and occasionally trigger certificate warnings if they return a "blocked page"[1], similar to TLS errors one might see from a captive portal.
> * ISPs that provide roaming WiFi sometimes instruct users to install EAP-TTLS certificates in their OS root stores, and this can cause confusion about what they are for. I found that several UK ISPs have done this.
> * ISPs sometimes distribute routers that prevent the user from changing DNS settings.
> * There are entertainment devices (Google, probably some Roku apps) hard-coding DNS services, ignoring the OS and network administrator
> * There are consumer routers that use centralized DNS services without user interaction, ignoring the OS and network administrator (unless the router owner counts as the admin...)
> * There are Android handsets that enable a VPN on certain networks by default, and all networks with user interaction, bypassing local DNS
> * Many ISPs simply ask Google to provide their DNS service, resulting in more centralization than might first be apparent
> * Browsers do tend to obey "Group Policy" and other similar administrator features
> * And, of course, browsers are shipping DoH, ignoring the OS and network administrator
> 
> thanks,
> Rob
> 
> [1] I want to be as dispassionate about this issue as possible. It does seem like Vodafone may have had a misguided step in their support script, where users were asked to install the certificate for the block page server. This seems like it was done to fix the error the user was seeing and display the block page, but not for anything else.
> -- 
> Add mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/add
>

---

From: Rob Sayre <[email-masked]>
Date: Sun, 25 Aug 2019 15:37:30 -0700

I think British people might find this kind of funny.

Other parts of the world might find it trite and formulaic.

But thanks for sharing.

thanks,
Rob

On Sun, Aug 25, 2019 at 1:01 AM Ian Maddison <[email-masked]> wrote:

> Hi Rob,
>
> In case you hadn't noticed, 9 of the last 10 mails sent to this list
> appear to be written by yourself. Another type of over centralisation
> surely.
>
> Just Sayring ;)
>
> I thought I would update that list of features of the DNS landscape I
> sent. Since it sounds like there will be chartered work soon enough, I
> thought I would collect what I and others have found, and correct a few
> things.
>
> I don't think it would be especially valuable to nitpick the list, but I
> do think it might make a good wiki page when the group has one. On the
> wiki, you can edit any wording or framing.
>
> thanks,
> Rob
>
>
> * ISPs intercept Classic DNS, and occasionally trigger certificate
> warnings if they return a "blocked page"[1], similar to TLS errors one
> might see from a captive portal.
> * There are consumer routers that use centralized DNS services without
> user interaction, ignoring the OS and network administrator (unless the
> router owner counts as the admin...)