AD to send chairs on remedial Meetecho training? ;-)
", "time": "2022-11-08T13:05:08Z"}, {"author": "\u00c9ric Vyncke", "text": "Good idea !
", "time": "2022-11-08T13:05:20Z"}, {"author": "\u00c9ric Vyncke", "text": ";-)
", "time": "2022-11-08T13:05:24Z"}, {"author": "Peter van Dijk", "text": "PowerDNS, as mentioned in our blog post about the implementation, also is more to the spirit than to the letter of the draft
", "time": "2022-11-08T13:08:28Z"}, {"author": "Tim Wicinski", "text": "thanks Peter
", "time": "2022-11-08T13:10:28Z"}, {"author": "Peter van Dijk", "text": "( https://blog.powerdns.com/2022/06/13/probing-dot-support-of-authoritative-servers-just-try-it/ )
", "time": "2022-11-08T13:11:11Z"}, {"author": "Tommy Pauly", "text": "Why is doh-sydney a DoT server? =)
", "time": "2022-11-08T13:32:27Z"}, {"author": "\u00c9ric Vyncke", "text": "I was wondering the same ;-)
", "time": "2022-11-08T13:32:39Z"}, {"author": "Chris Box", "text": "I'm more wondering why the server feels so sure about the geolocation of the client
", "time": "2022-11-08T13:32:46Z"}, {"author": "David Lawrence", "text": ":)
", "time": "2022-11-08T13:32:54Z"}, {"author": "Ray Bellis", "text": ".arpa is signed - doesn't this need an unsigned delegation to a name one level below resolver.arpa?
", "time": "2022-11-08T13:35:28Z"}, {"author": "Hazel Smith", "text": "Ben Schwartz - your audio is better now, but was very loud at first, and is still occasionally clipping a little
", "time": "2022-11-08T13:36:55Z"}, {"author": "Vicky Risk", "text": "Maybe it was intentional that the DOT server in Sydney is redirected to a DOH server in Paris????
", "time": "2022-11-08T13:37:09Z"}, {"author": "Vicky Risk", "text": "oh forget it, looks like a typo
", "time": "2022-11-08T13:37:44Z"}, {"author": "Jim Reid", "text": "Or a test to see who's paying attention. :-)
", "time": "2022-11-08T13:38:18Z"}, {"author": "Vicky Risk", "text": "presumably it is clear in the actual draft
", "time": "2022-11-08T13:40:59Z"}, {"author": "Benjamin Schwartz", "text": "Unstable meetecho connection :(
", "time": "2022-11-08T13:42:38Z"}, {"author": "Ray Bellis", "text": "w.r.t. .arpa, I'd also like to remind people of draft-jabley-sink-arpa and draft-bellis-dns-recursive-discovery, both from 2009. I'd rather see an unsigned delegation to a subdomain of .arpa (with a registry of the entries therein) than a proliferation of \"special\" entries directly inside .arpa
", "time": "2022-11-08T13:43:40Z"}, {"author": "David Lawrence", "text": "Load shedding was the other example given. That's a server decision
", "time": "2022-11-08T13:44:05Z"}, {"author": "Ted Hardie", "text": "@David agree with load shedding as a different reason, but a message from the server to re-seek accomplishes the same thing if there an alternate, without the same control surface. Think Go_Away or enhance your calm.
", "time": "2022-11-08T13:48:45Z"}, {"author": "Benjamin Schwartz", "text": "+1 to Tommy Pauly
", "time": "2022-11-08T13:49:03Z"}, {"author": "Benjamin Schwartz", "text": "The difference is that it doesn't change the TLS SNI
", "time": "2022-11-08T13:49:35Z"}, {"author": "David Lawrence", "text": "What would trigger a new lookup?
", "time": "2022-11-08T13:50:29Z"}, {"author": "David Lawrence", "text": "Oh I see, nm
", "time": "2022-11-08T13:51:11Z"}, {"author": "Ray Bellis", "text": "ok, I see the draft does actually specify _dns.resolver.arpa, per the DDR spec.
", "time": "2022-11-08T13:51:17Z"}, {"author": "Vicky Risk", "text": "I think John is addressing what I was wondering about - whether the filtering policy of the new server might be different
", "time": "2022-11-08T13:52:11Z"}, {"author": "Andrew Campling", "text": "Good point from Vittorio about needing to consider whether the query is being moved outside of the client's jurisdiction
", "time": "2022-11-08T13:52:19Z"}, {"author": "Ted Hardie", "text": "I'll also point out that if you just message to the client to re-run their config process, that they are not going to have any risk of looping.
", "time": "2022-11-08T13:53:19Z"}, {"author": "Jim Reid", "text": "Redirection would be for the resolving server. Which might well be in a very different location from the originating stub resolver.
", "time": "2022-11-08T13:53:59Z"}, {"author": "Erik Nygren", "text": "Different SVCB-based drafts handling SNI and TLS certs/validation differently is going to be an interesting challenge to keep an eye on, especially in libraries for SVCB.
", "time": "2022-11-08T13:56:21Z"}, {"author": "Peter Lowe", "text": "Are there going to be different types of redirects? Like with HTTP redirects, where there's 301 and 302? Are permanent redirects going to be used for decommissioned servers, that sort of thing?
", "time": "2022-11-08T13:56:27Z"}, {"author": "Erik Nygren", "text": "(Although I think we have that, being different SNI/cert usage, already for some other SVBC cases.)
", "time": "2022-11-08T13:57:31Z"}, {"author": "Chris Box", "text": "Agree with Ben we should document bootstrap
", "time": "2022-11-08T13:58:51Z"}, {"author": "Tommy Pauly", "text": "Also +1 that we should talk about bootstrap
", "time": "2022-11-08T13:59:05Z"}, {"author": "Chris Box", "text": "In a secure way, of course
", "time": "2022-11-08T13:59:20Z"}, {"author": "David Lawrence", "text": "That message is encrypted tho, right?
", "time": "2022-11-08T13:59:56Z"}, {"author": "Daniel Migault", "text": "This is my impression and I also have the impression doh-sydney is trusted.
", "time": "2022-11-08T14:02:19Z"}, {"author": "Benjamin Schwartz", "text": "@Tommy Jensen: The difference is that in DDR Section 5, the attacker can't change the validation name, so TLS still defeats the attack.
", "time": "2022-11-08T14:03:37Z"}, {"author": "Daniel Migault", "text": "@ben Th edifference I see is that with DDR we do have an untrusted DNS exchange, but in Toiommy's case the server is trusted as per DDR's procedure. Am I missing anything ?
", "time": "2022-11-08T14:05:57Z"}, {"author": "David Schinazi", "text": "Can someone post the draft name for this presentation please?
", "time": "2022-11-08T14:06:14Z"}, {"author": "Benjamin Schwartz", "text": "It's at the bottom of the slide...
", "time": "2022-11-08T14:06:30Z"}, {"author": "David Schinazi", "text": "That's not visible in the room
", "time": "2022-11-08T14:06:41Z"}, {"author": "Anthony Somerset", "text": "draft-wing-opsawg-authenticating-network-01
", "time": "2022-11-08T14:06:56Z"}, {"author": "David Schinazi", "text": "Thank you!
", "time": "2022-11-08T14:07:04Z"}, {"author": "Tommy Jensen", "text": "That's fair, Ben. So then this really turns into \"enabling multi-name redirection\" versus \"must stay on same name for security\" trade-off. Would love more server operators to weigh in on that as they're the ones who have to deploy the many-to-many name claims for that to work.
", "time": "2022-11-08T14:07:29Z"}, {"author": "Benjamin Schwartz", "text": "Tommy: There are a lot of \"names\" involved here though. You can use lots of DNS names to hold various RRsets, but changing the authentication name used for TLS is a different story.
", "time": "2022-11-08T14:08:46Z"}, {"author": "Tommy Jensen", "text": "David, yes this only ever starts from an existing encrypted DNS connection, so a transient attack is far less common than in the plain-text bootstrap case DDR tackles. I think Erik pointed out (or someone else) that this makes it comparable to HTTPS redirects and could learn from them
", "time": "2022-11-08T14:08:52Z"}, {"author": "Daniel Migault", "text": "agree with the similarity of HTTPS redirect.
", "time": "2022-11-08T14:10:19Z"}, {"author": "Ted Hardie", "text": "unless my memory fails me that actual ssid is 2-32 characters long, so you'd have to link the SSID to the local network name to try to match it to the SAN.
", "time": "2022-11-08T14:11:01Z"}, {"author": "Tommy Jensen", "text": "Ben, I think there's a different of POV here. The auth name used for TLS isn't changing for the destination server. Remember: this isn't intended to be a black-box-identical replacement for a server, it's a disclosed redirection _to another server_ much like HTTPS redirection. Checking for anything other than the name of the destination seems weird to me.
", "time": "2022-11-08T14:11:02Z"}, {"author": "Ted Hardie", "text": "(Slide 7)
", "time": "2022-11-08T14:11:08Z"}, {"author": "Benjamin Schwartz", "text": "Tommy: A disclosed redirect is definitely a different story ... but I'm not excited about writing the UI to notify the user whether about a suggested change to the DNS server. (Change the what?)
", "time": "2022-11-08T14:13:13Z"}, {"author": "Tommy Jensen", "text": "I'm not either, but I think if we don't allow that we rule out any case for redirection from one server to another hosted on different infra. Again, that's where we need operators to say whether that's a real challenge or not (my understanding is that it is).
", "time": "2022-11-08T14:14:38Z"}, {"author": "David Schinazi", "text": "I disagree that experimental RFCs cost nothing, as our esteemed and honored IESG members only have so much time to review our illustrious documents :-)
", "time": "2022-11-08T14:16:11Z"}, {"author": "\u00c9ric Vyncke", "text": "+1
", "time": "2022-11-08T14:16:24Z"}, {"author": "Tommy Jensen", "text": "+1 to David, gaining a lot of appreciation for that trying to publish DDR/DNR
", "time": "2022-11-08T14:16:35Z"}, {"author": "Tommy Jensen", "text": "that = IESG support
", "time": "2022-11-08T14:16:54Z"}, {"author": "David Schinazi", "text": "Yeah I learned it the hard way, repeatedly :-)
", "time": "2022-11-08T14:17:06Z"}, {"author": "Andrew Campling", "text": "@David It does avoid boredom, keep them out of mischief :-)
", "time": "2022-11-08T14:17:26Z"}, {"author": "\u00c9ric Vyncke", "text": "thanks to the chairs and everyone for participating !
", "time": "2022-11-08T14:17:55Z"}, {"author": "\u00c9ric Vyncke", "text": "@andrew -1 ;-)
", "time": "2022-11-08T14:18:02Z"}, {"author": "Hazel Smith", "text": "Do remote attendees need to do anything special to have our attendance counted?
", "time": "2022-11-08T14:18:42Z"}, {"author": "Hazel Smith", "text": "or is being in this Meetecho call enough?
", "time": "2022-11-08T14:18:55Z"}, {"author": "Chris Box", "text": "It's enough. You're counted.
", "time": "2022-11-08T14:19:05Z"}, {"author": "Hazel Smith", "text": "Super, thanks! :)
", "time": "2022-11-08T14:19:13Z"}, {"author": "Jim Reid", "text": "No Hazel. Being in meetecho is all you have to do.
", "time": "2022-11-08T14:19:19Z"}, {"author": "Hazel Smith", "text": "Great, thanks, I just wasn't sure if I'd missed something
", "time": "2022-11-08T14:19:37Z"}]