Subject: [Ohttp] Robert Wilton's Block on charter-ietf-ohttp-00-00: (with BLOCK and COMMENT)

From: Robert Wilton via Datatracker <[email-masked]>
Date: Wed, 16 Jun 2021 07:58:05 -0700

Robert Wilton has entered the following ballot position for
charter-ietf-ohttp-00-00: Block

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/charter-ietf-ohttp/

----------------------------------------------------------------------
BLOCK:
----------------------------------------------------------------------

I support Eric's discuss position that it would be helpful to hold a BOF before
chartering the WG to ensure that opinions have been heard and considered from
all areas.

I also find the scope of the charter to be somewhat unclear.  Specifically, it
isn't really clear to me whether the aim of this work is really for a generic
oblivious HTTP mechanism to hide clients from servers, or whether it is really
intended to be a point solution to support oblivious DNS over DoH?

Some other points that a BOF could consider (particularly if this work is
mostly focused on Oblivious DNS over DoH):

- What it the latency performance overhead of introducing the proxies given the
large number of DNS queries and given that they are performance sensitive to
the end user experience?

- Who is creating/managing these proxies and what trust relationship does the
end user have to these proxies?

- Do proxies impact the ability to do "malware detection as a service"?  I.e.,
are there scenarios where the profiling of DNS requests coming from a
particular source address is helpful for clients.

- Is this technology encouraging more centralization of Internet services?

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Should a discovery mechanism be in scope, if not in the initial work for this
working group, as a secondary objective?

---

From: Eric Rescorla <[email-masked]>
Date: Wed, 16 Jun 2021 08:16:06 -0700

> intended to be a point solution to support oblivious DNS over DoH?

Not just ODoH, but other things of that flavor.

> large number of DNS queries and given that they are performance sensitive
to

I would assume quite low, as there is essentially no processing
by the proxy. Presumably approximately the same as a DND recursive
resolver. Perhaps Apple has some data from their initial ODoH
deployments.

> end user have to these proxies?

See my response to Eric.

> particular source address is helpful for clients.

Maybe? But clients who want that service can not use this service.

> - Is this technology encouraging more centralization of Internet services?

No.

-Ekr

On Wed, Jun 16, 2021 at 7:58 AM Robert Wilton via Datatracker <
[email-masked]> wrote:

> --
> Ohttp mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ohttp
>

---

From: "Christopher Wood" <[email-masked]>
Date: Wed, 16 Jun 2021 16:30:42 -0700

> resolver. Perhaps Apple has some data from their initial ODoH

There is a paper being presented at PETS 2021 [1] describing some preliminary experimental results for DoH. (I hope the camera ready version will be available soon.) The results suggest minimal overhead once client<>proxy and proxy<>target connections are established. Certainly more experiments are warranted, but the initial results look promising.

Best,
Chris

[1] https://petsymposium.org/2021/paperlist.php

> On Wed, Jun 16, 2021 at 7:58 AM Robert Wilton via Datatracker 
> <[email-masked]> wrote:
> [email-masked] <mailto:Ohttp%40ietf.org>