Subject: [dns-privacy] [Errata Held for Document Update] RFC7858 (5375)

From: RFC Errata System <[email-masked]>
Date: Thu, 19 Dec 2019 05:08:36 -0800 (PST)

The following errata report has been held for document update 
for RFC7858, "Specification for DNS over Transport Layer Security (TLS)". 

--------------------------------------
You may review the report below and at:
https://www.rfc-editor.org/errata/eid5375

--------------------------------------
Status: Held for Document Update
Type: Editorial

Reported by: Jelte Jansen <[email-masked]>
Date Reported: 2018-06-01
Held by: Éric Vyncke (IESG)

Section: 9.2

Original Text
-------------
   [DNSCRYPT-WEBSITE]
              Denis, F., "DNSCrypt", December 2015,
              <https://www.dnscrypt.org/>.

Corrected Text
--------------
   [DNSCRYPT-WEBSITE]
              Denis, F., "DNSCrypt", December 2015,
              <https://www.dnscrypt.info/>.

Notes
-----
Not sure if an informative reference to a website is worth an erratum, but www.dnscrypt.org leads to a parking page. The official website is now at www.dnscrypt.info.

--------------------------------------
RFC7858 (draft-ietf-dprive-dns-over-tls-09)
--------------------------------------
Title               : Specification for DNS over Transport Layer Security (TLS)
Publication Date    : May 2016
Author(s)           : Z. Hu, L. Zhu, J. Heidemann, A. Mankin, D. Wessels, P. Hoffman
Category            : PROPOSED STANDARD
Source              : DNS PRIVate Exchange
Area                : Internet
Stream              : IETF
Verifying Party     : IESG

---

From: Vladimír Čunát <[email-masked]>
Date: Fri, 20 Dec 2019 11:11:58 +0100

On 12/19/19 2:08 PM, RFC Errata System wrote:
> [...] www.dnscrypt.org leads to a parking page. The official website is now at www.dnscrypt.info.

The site *does* work for me ATM and looks reasonable at a quick glance,
but I haven't checked who controls it etc.

---

From: Warren Kumari <[email-masked]>
Date: Mon, 23 Dec 2019 12:54:52 -0500

[no-hats]

So, this all raises an interesting question -- both dnscrypt.org and
dnscrypt.info resolve, and work for me.... but:
1: "Errata are meant to fix "bugs" in the specification and should not
be used to change what the community meant when it approved the RFC."
- https://www.ietf.org/about/groups/iesg/statements/processing-rfc-errata/
. Clearly, the community "meant" https://www.dnscrypt.org/ when this
was published --- or did they? I'd posit that they actually meant "the
webpage which talks about DNScrypt".
2: The same "how to verify" page says: "Common sense and good judgment
should be used by the IESG to decide what is the right thing to do."

but, more importantly, for the general case, how should the IETF /
IESG verify that example.com and example.net are the "same"? I did the
obvious "let me go look at the whois, and make an educated guess from
that" - but, the scourge of whois proxy registrations makes that
impossible.
As a general rule, it seems like having the site owner publish a
(provided) token on both would work, assuming both sites still
"exist". Luckily, in this case it's not my errata, so I'll run away,
leaving the problem to Eric :-P

W
p.s: if it were mine, I'd probably mark it hold for update with a note
of "someone should validate this..."

On Fri, Dec 20, 2019 at 5:10 AM Vladimír Čunát
<[email-masked]> wrote:
> _______________________________________________
> dns-privacy mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dns-privacy

-- 
I don't think the execution is relevant when it was obviously a bad
idea in the first place.
This is like putting rabid weasels in your pants, and later expressing
regret at having chosen those particular rabid weasels and that pair
of pants.
   ---maf

---

From: Patrick Mevzek <[email-masked]>
Date: Mon, 23 Dec 2019 13:01:05 -0500

> of "someone should validate this..."

In May 2018, I also reported that the correct one was probably more the
.info one than the .org one, because at that time both dnscrypt.org and
www.dnscrypt.org replied with wrong X.509 certificates.

At least right now both resolves correctly but with different content.

Maybe, people behind DNScrypt project/tools/implemnentations should
voice which website is the correct one...

-- 
Patrick Mevzek

---

From: Tim Wicinski <[email-masked]>
Date: Mon, 23 Dec 2019 15:44:24 -0500

I agree with Patrick's comment that the folks from DNScrypt should be the
ones giving us the
guidance here.

Tim
(wearing the hat today, so Warren doesn't have to)

On Mon, Dec 23, 2019 at 1:01 PM Patrick Mevzek <[email-masked]>
wrote:

> ..info one than the .org one, because at that time both dnscrypt.org and