Subject: [dns-privacy] Fwd: [Doh] Resolverless DNS Side Meeting in Montreal

From: "John Dickinson" <[email-masked]>
Date: Tue, 10 Jul 2018 09:41:02 +0100

For some reason this didn’t get cc’d to the dprive list. So here it 
is!

John

John Dickinson

http://sinodun.com

Sinodun Internet Technologies Ltd.
Magdalen Centre
Oxford Science Park
Robert Robinson Avenue
Oxford OX4 4GA
U.K.

Forwarded message:

> From: Patrick McManus <[email-masked]>
> To: Ben Schwartz <[email-masked]>, Daniel Kahn Gillmor 
> <[email-masked]>, DoH WG <[email-masked]>, [email-masked], HTTP Working 
> Group <[email-masked]>, dnsop <[email-masked]>
> Subject: [Doh] Resolverless DNS Side Meeting in Montreal
> Date: Mon, 9 Jul 2018 22:49:25 -0400
>
> Hi All,
>
> I am organizing an ad-hoc Side Meeting regarding 'Resolverless DNS' in
> Montreal.
>
> We have often talked about the benefits and concerns of DNS 
> information
> obtained from sources that are, shall we say, less globally trusted 
> than a
> recursive a resolver. The central use case is DoH when pushed from an
> endpoint that isn't a recursive resolver but there have been other
> proposals.
>
> For example www.example.com pushes you a AAAA record for 
> img1.example.com.
> Should you use it? What if it is for img1.img-example.com ? Do the
> relationship between these domains matter? What kind of relationship 
> (i.e.
> it could be a domain relationship, or in the context of a browser it 
> might
> be a first-party tab like relationship, etc..)? What are the 
> implications
> of poison? Trackers? Privacy of requests never made? Speed? 
> Competitive
> shenanigans or DoS attacks?
>
> This was out of scope for DoH.
>
> *We'll do the meeting over 1 hour in the Dorchester room from 16:30 to
> 17:30 on Monday July 16th.*
>
> This is a meeting of interested folks looking to see if we can agree 
> on
> next steps - we're not going to work out the details (nor should a 
> side
> meeting try and do so). so we'll have a tight agenda that I suggest
> organizaing as follows:
>
> 1] What forms of transport could be in scope? HTTP/2 push is one such
> vector, but I've heard others. Spray paint for example.
>
> 2] What needs to be considered when using such data? (signatures? 
> scope?
> etc?)
>
> 3] Who are the stakeholders for 1 + 2?
>
> 4] Is there enough interest to explore further? Next steps as output
>
> I hope you can come!
>
> -Patrick
> _______________________________________________
> Doh mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/doh

---

From: Patrick McManus <[email-masked]>
Date: Sat, 28 Jul 2018 12:32:02 -0400

Hi All -

This is a wrap-up email for the Resolverless DNS meeting held on July 16 in
Montreal. We had, by my rough count, about 50 people and two sets of
minutes are attached. If you attended, contributed, or took minutes (Thanks
Shane and Ben!) thank you - it was, imo, a productive, professional, and
even pretty focused discussion.

We identified a next step: using an AD sponsored list (See Below!),
identify one minimal context or use case that provides value for using DNS
information without direct recursive resolver contact, and enumerate the
concerns and potential mitigations for those concerns. If we can focus on
that and make some progress then we might have a proposal for a future BoF
- if we cannot make progress then that is also telling.

Adam and Warren have setup a list for us to use. I apologize to the various
working group's cc'd on this so far (and thank them for their indulgence) -
future communications should move to the new list.

New List Info
-------------------
https://www.ietf.org/mailman/listinfo/resolverless-dns

-Patrick

On Mon, Jul 9, 2018 at 10:49 PM, Patrick McManus <[email-masked]>
wrote:

> We have often talked about the benefits and concerns of DNS information
> obtained from sources that are, shall we say, less globally trusted than a
> For example www.example.com pushes you a AAAA record for img1.example.com.
> relationship between these domains matter? What kind of relationship (i.e.
> it could be a domain relationship, or in the context of a browser it might
> be a first-party tab like relationship, etc..)? What are the implications
> of poison? Trackers? Privacy of requests never made? Speed? Competitive
> This is a meeting of interested folks looking to see if we can agree on
> next steps - we're not going to work out the details (nor should a side
> 2] What needs to be considered when using such data? (signatures? scope?
> etc?)
>