Subject: [dns-privacy] Barry Leiba's No Objection on draft-ietf-dprive-rfc7626-bis-06: (with COMMENT)

From: Barry Leiba via Datatracker <[email-masked]>
Date: Wed, 07 Oct 2020 21:16:00 -0700

Barry Leiba has entered the following ballot position for
draft-ietf-dprive-rfc7626-bis-06: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-dprive-rfc7626-bis/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

I have comments on the DISCUSS positions of Alissa and Warren, both of which I
support to some extent:

On Warren’s point, which I wouldn’t have made it a DISCUSS myself, I agree that
editorial changes are warranted so as to make the point more clearly and with
less baggage.  I think we all know what the document means here, but not all
readers will, and there’s sufficient FUD in this area that it behooves us to be
very careful about how we say things.  Avoiding things such as “alleged” and
“it has long been claimed” is easy, would go a long way toward clarity and
avoidance of feeding the FUD, and is worth a brief editing pass.  I leave it to
Warren to work the details out with the working group.

On Alissa’s first point — why publish this update now, rather than waiting
until more things shake out and settle down — I basically agree, though I’m
torn between thinking that waiting is better... and, on the other hand,
acknowledging that enough has already changed that it’s important to get the
update out there, and that it can be updated again later.

On her second point, I’ll go in a different direction: it’s bordering on silly
to think that any real end user can be said to “be aware of and have the
ability to control” anything related to DNS settings and resolution options. 
If “users” refers to those of us writing these specs, sure.  But when we’re
talking about our siblings and cousins and parents, who are doctors and nurses,
chefs and bakers, bank tellers and car mechanics, there is no hope of awareness
and understanding of the choices and their consequences, nor that any form of
“communicate clearly” will really accomplish anything.  I see little to
recommend pretending that it will.

So I, too, am not sure what this text is really meant to convey.

---

From: Rob Sayre <[email-masked]>
Date: Wed, 7 Oct 2020 21:26:21 -0700

> update out there, and that it can be updated again later.

It's possible to leave things in an I-D state, and license it such that the
IESG never has a say again.

thanks,
Rob

---

From: Vittorio Bertola <[email-masked]>
Date: Thu, 8 Oct 2020 11:42:54 +0200 (CEST)

> Il 08/10/2020 06:16 Barry Leiba via Datatracker <[email-masked]> ha scritto:
> 

I see your point, but then, this clashes with the picture of "8.8.8.8" painted on a wall in Istanbul that has been abundantly circulated as evidence in favour of encrypted DNS, to support the importance of letting average users control their choice of DNS resolvers when they do not trust their government and their Internet access provider.

As another example, a few days ago I was checking online discussion forums for user reviews of a new fiber provider, and one of the most often noted points was that their CPE doesn't let users change the DNS settings that are then broadcast to devices via DHCP(*). It was not a minor issue; several messages in the thread were discussing it, with some people even saying "this is the reason why I am not choosing them". Of course only smarter users go to an online forum and discuss fiber providers, yet these were in no way DNS professionals or even Internet professionals.

So I think the truth lies somewhere in the middle - most users do not care or even understand what DNS is, but lots of them do, especially when one of the two following motivations comes up:
1. "the Internet" doesn't work because the resolvers don't work, or
2. changing DNS resolvers allows access to previously forbidden content (for multiple, differently desirable cases of "forbidden").

IMHO there is enough of these two cases to warrant preserving the user's ability to control the choice of resolvers if they want (except that, in my opinion, in democratic countries they should never be allowed to use this ability to circumvent their own national laws and policies, but I know that some people disagree).

(*) which, by the way, made me think that those recommendations should not only apply to "applications".

-- 
Vittorio Bertola | Head of Policy & Innovation, Open-Xchange
[email-masked] 
Office @ Via Treviso 12, 10144 Torino, Italy

---

From: Alissa Cooper <[email-masked]>
Date: Thu, 8 Oct 2020 08:50:02 -0400

> On Oct 8, 2020, at 5:42 AM, Vittorio Bertola <vittorio.bertola=[email-masked]> wrote:
> 
> 
> 

As far as the text in the document goes, I think it’s fine to say that the best practice is to provide configuration controls for users who want to use them. But recommending some level of awareness for users in general does not seem actionable or realistic.

Alissa