Subject: [Add] Applications Doing DNS...

From: Brian Dickson <[email-masked]>
Date: Mon, 8 Apr 2019 15:43:12 -0700

Greetings, everyone.

So, here are my thoughts on "Applications Doing DNS".

First, the mailing list ("add") is a fantastic idea.

Second, the subject matter, "applications doing DNS", is a not such a great
idea, IMHO, at least as far as each application doing its own DNS.

As I see it, there are several things that are largely orthogonal:

   - Transport used for carrying DNS queries (UDP 53, TCP 53, DoT, DoH,
   DoX, etc.)
   - Choice of resolver
   - Place(s) where resolver choice(s) are (or can be) implemented and
   configured.
   - Standardization of the cross-transport and cross-application elements
   (where the common denominator is, obviously, DNS).

The privacy issues involved can be addressed by the transport(s).

However, there is nothing in the protocols for those transports that
mandates the integration of those transports into the respective
applications, and that is where a frank conversation should probably
happen, and that conversation should be on this list.

There are two or more security issues that sometimes get mixed together, to
the detriment of the conversation. One is host security. The other is
network security (for some value of "network").

One observation is that as a general rule, on most hosts, the very
existence of a stub resolver of some flavor (or possibly a recursive or
forwarder) is required if it is a general purpose host. Along with that is
that historically, managing that component has been done independently from
any applications using that resolver.

The next observation is that separating the management of applications from
resolver provides a degree of benefit from the security model, akin to
separation of duties, or role based access, in the way the respective
components are managed. (Hosts without proper role based user/admin
separation would be the exception that proves the wisdom of doing so.)

Here's my suggestion/proposal:
Please, let us give some consideration to maintaining that separation, even
as the transport and/or resolver choices get augmented and/or changed.

The benefits from improved privacy would be improved, at little to no cost
to the initial application whose requirement for privacy has motivated
transport improvements.
The two additional benefits are providing more control and security over
any needed configuration to support the new and improved transport, and the
avoidance of fragmenting or balkanizing the set of resolvers and
configurations, as more and more applications see the value in such privacy
improvements.

I see the value in a separate discussion on those orthogonal issues, such
as transport choice and its impact on network security. Let us please keep
those issues out of this discussion.

Again, the reasons I'm suggesting this is (longer list than all of the
above):

   - Maintaining the status quo on host security (keeping DNS resolver
   software and configuration separate from applications)
   - Making the resolver management scale (one resolver rather than many)
   - Limit the potential attack surface on hosts
   - Potential for exposing more DNS results through common API (e.g.
   getdns) regardless of the transport used
   - Potential for better integrated resolver/transport (single drop-in
   replacement for whatever is used currently on a host, which would
   facilitate any/all transports that are developed)

Sincerely,
Brian Dickson

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 9 Apr 2019 00:00:49 +0100

> First, the mailing list ("add") is a fantastic idea.

Partly agree with that, disagree with a lot (but not all)
of the rest of your mail.

*A* mailing list is a good idea, and this one will do.

The list name is off-base a bit. I think that the privacy
and control issues related to Do53 or DoT or DoH, whether
or not the OS' resolver is used, all need to be in scope
for any putative WG or else we'll not be analysing the
right problems.

S.

---

From: Vittorio Bertola <[email-masked]>
Date: Tue, 9 Apr 2019 15:07:27 +0200 (CEST)

>     Il 9 aprile 2019 alle 1.00 Stephen Farrell < [email-masked] mailto:[email-masked] > ha scritto:
> 
Speaking of a broader discussion, I am increasingly convinced that we have a basic problem of lack of clarity, or even of consensus, on what the requirements for "modern" DNS service are.

The DNS was conceived as a public distributed database that would always give back the same reply to the same query, that would only serve universal names, that would be provided locally as an integral part of the Internet access service, and that had no need for customized replies, for privacy protection or for control points of any kind. This has changed over time, in a stretch of almost 30 years, and now the DNS looks more like a directory service that orchestrates traffic across the Internet as well as on private networks, and customizes the directions it gives according to a broad set of factors.

This was done by piling new specs and new practices over and over onto the original basic idea, and so, IMHO, it is also the root of the "camel" problem that was so successfully exposed by Bert Hubert at IETF 101.

Now, attempting to rethink the requirements for the DNS from scratch could be futile, but any system coming out of the present discussions would be much better if it were the result of systematic planning, rather than of one patch after another, fixing one problem while creating others (and DoH is just the last instance of this).

On the other hand, I would be concerned if this discussion became broader in scope and time, while in the meantime DoH gets deployed as per today's plans and "good night to the bucket" (which, translated, is a typically Roman way of saying that time's up and the current status quo will last forever). That would make any effort useless.

Ciao,

--

Vittorio Bertola | Head of Policy & Innovation, Open-Xchange
[email-masked] mailto:[email-masked] 
Office @ Via Treviso 12, 10144 Torino, Italy

---

From: Melinda Shore <[email-masked]>
Date: Tue, 9 Apr 2019 09:29:23 -0800

On 4/9/19 5:07 AM, Vittorio Bertola wrote:
> This
> has changed over time, in a stretch of almost 30 years, and now the DNS
> looks more like a directory service that orchestrates traffic across the
> Internet as well as on private networks, and customizes the directions
> it gives according to a broad set of factors.

I was going to say that the DNS is used to do those things rather
than it does those things itself, but in thinking about it that
distinction really isn't a clear one and I think it's part of
what makes these discussions so challenging.

I don't think I've ever seen a taxonomy of DNS functions in
the real world and I think it might be useful in mitigating
the discussion's tendency to spin.

Melinda

-- 
Melinda Shore
[email-masked]

Software longa, hardware brevis