Subject: [dns-privacy] AD review of draft-ietf-dprive-problem-statement

From: Terry Manderson <[email-masked]>
Date: Fri, 10 Apr 2015 03:49:32 +0000

All,

I have performed my AD evaluation of draft-ietf-dprive-problem-statement.

Firstly, thank you for writing this document and clearly putting in
substantial effort!

The document is well formed, and pending the additional review from the
Internet Area Directorate, I will progress this document.

For the comments below, it would be helpful if you could consider them
along with any other IETF Last Call comments that you receive, and strive
to resolve them through discussion or by updating the draft.

Major issues:

None, and thank you for not drifting out of scope on the document!!

Minor issues:

S1, Para 2. "and often ignored or misunderstood", this begs the question
"by whom?" please consider either qualifying the statement or removing the
subjective aspect.

S1, Para 6. "currently sent in clear (unencrypted)", I think you could
probably just say "sent unencrypted" to be concise.

S1, Para 12 "(which obviously is a big privacy concern)" the tone of that
is only meaningful to a privacy expert. Perhaps you might want to make
this a sentence in its own right, and highlight _why_ it's a "big" privacy
concern.

S2.2 Para 1. "used to sort out several", suggestion: "differentiate
between"

S2.2 Para 2. "record of google-analytics.com reveals" I'm hesitant about
the 'real' domain name use here. I'd rather not see a BIS/errata occur
should Google drop the domain in favour of analytics.google. Can you
consider revising please?

S2.4 Para 1. "When other protocols will become more and more privacy-aware
and secured against surveillance, the DNS risks to become "the weakest
link" in privacy." I stumbled over this sentence. Please consider
revising. Suggested text: "When other protocols become more privacy-aware
and employ techniques against surveillance, the DNS has the propensity to
become "the weakest link" in privacy.

S2.4. For the 4 paragraphs after "By order of increasing attack surface:"
please consider indentation to aid the reader.

S2.5.2 Para 5, you might want to double check the volume of DNS queries to
L-root 
(http://hedgehog.dns.icann.org/plotcache/L-root/dns_ip_version/2015-04-09T0
0:00-2015-04-09T23:59-all.png?nocache=2015-04-10T03:10) ;) For helpful
info on RCODE volume:
http://hedgehog.dns.icann.org/plotcache/L-root/rcode/2015-03-10T00:00-2015-
04-09T23:59-all.png?nocache=2015-04-10T03:13

Noting that while the main sense of the paragraph 5 is to demonstrate that
there is significant volume to servers, errors being received up the chain
are only "junk" in the eye of the "privacy" beholder - The QNAME which
results in a NXDOMAIN could be seen as an opportunity by the entity
looking at the data. eg the typo of ieft.org instead of ietf.org.

S2.5.2 Para 6, last sentence.. I had to read this one a few times, please
consider revising.

Nits:

S1, Para 3 s/qtype/QTYPE/ as per RFC1035
S1, Para 3 s/qname/QNAME/ as per RFC1035
S1, Para 8 s/many sort/many sorts/ (although I felt this sentence was
unwieldy, you might want to consider revising)
S1, Para 8 s/an user/a user/
S2.1 Para 1. s/qname/QNAME/
S2.1 Para 1. s/qtype/QTYPE/
S2.2 para 2. s/qname/QNAME/
S3 Para 3. s/qnames/QNAMEs/ or /QNAME values/.
S3 Para 4. s/gather surreptitiously/surreptitiously gather/
S3 Para 4. s/example that the lack/example where the lack/

Cheers
Terry

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Fri, 10 Apr 2015 16:42:44 +0200

On Fri, Apr 10, 2015 at 03:49:32AM +0000,
 Terry Manderson <[email-masked]> wrote 

> draft-ietf-dprive-problem-statement.

Thanks. Most remarks have been fixed in commit
d157a63511a421f073826cfbaf84c6ac...
<https://github.com/bortzmeyer/my-IETF-work/commit/d157a63511a421f073826cfbaf84c6acd409a256>
For the others, see my comments inline.

Should I post a new version of the draft now?

> S2.2 Para 2. "record of google-analytics.com reveals" I'm hesitant
> about the 'real' domain name use here. I'd rather not see a
> BIS/errata occur should Google drop the domain in favour of
> analytics.google. Can you consider revising please?

Of course yes (there were much more actual domain names at the
beginning and they had been replaced, to guarantee stability).

> S2.5.2 Para 6, last sentence.. I had to read this one a few times,
> please consider revising.

Is it sentence "It may be surprising for an end-user that requests to
a given ccTLD may go to servers managed by organisations outside of
the country."? If so, I have no idea yet how to revise it. I'll think
about it.

---

From: Terry Manderson <[email-masked]>
Date: Wed, 15 Apr 2015 02:31:11 +0000

Hi Stephane,

>Should I post a new version of the draft now?

Please wait until the INT area directorate review is complete, as they may
have different comments.

>the country."? If so, I have no idea yet how to revise it. I'll think

Suggestion: "An end-user may be surprised that DNS requests for a ccTLD
may be answered by servers both located and managed by organisations
outside of the country"

T.