[{"author": "Richard Barnes", "text": "

happy last session of the day to people dialing in from non-Asian time zones :yawning_face:

", "time": "2023-03-28T08:00:00Z"}, {"author": "Benjamin Schwartz", "text": "

@Richard Barnes Actually I think this is only the last session of the day if you _are_ in Asian time zones. (4 AM here.)

", "time": "2023-03-28T08:01:02Z"}, {"author": "Richard Barnes", "text": "

fair point.

", "time": "2023-03-28T08:01:50Z"}, {"author": "Richard Barnes", "text": "

i was operating on logical asian days

", "time": "2023-03-28T08:02:03Z"}, {"author": "Andrew Campling", "text": "

Don\u2019t forget the evening side meetings

", "time": "2023-03-28T08:03:34Z"}, {"author": "Shivan Sahib", "text": "

sorry forgot to thank our amazing AD as well!

", "time": "2023-03-28T08:04:14Z"}, {"author": "Francesca Palombini", "text": "

No need :) but thanks

", "time": "2023-03-28T08:05:26Z"}, {"author": "Shivan Sahib", "text": "

baby shark

", "time": "2023-03-28T08:07:50Z"}, {"author": "Richard Barnes", "text": "

:notes::notes::notes::notes::notes::notes:

", "time": "2023-03-28T08:08:09Z"}, {"author": "Brian Trammell", "text": "

\"duo\" would be dns over udp over ohttp.

", "time": "2023-03-28T08:08:17Z"}, {"author": "Richard Barnes", "text": "

how is DoOH different from ODoH?

", "time": "2023-03-28T08:08:40Z"}, {"author": "Benjamin Schwartz", "text": "

@Richard Barnes Emphasizing that this is \"Oblivious HTTP\", not \"Oblivious DNS\" (the research project from Nick Feamster's lab that started this ball rolling a few years ago).

", "time": "2023-03-28T08:09:45Z"}, {"author": "Richard Barnes", "text": "

Thanks @Benjamin

", "time": "2023-03-28T08:10:00Z"}, {"author": "Christopher Wood", "text": "

@Benjamin Schwartz can you elaborate on why \"dohpath\" consistency is different here? In my view, we just need consistency across (key, path) pairs, which is not much different from consistency across key values, or consistency across (key, path, protocol, pizza topping) tuples?

", "time": "2023-03-28T08:15:02Z"}, {"author": "Richard Barnes", "text": "

@Wood - to mic?

", "time": "2023-03-28T08:15:45Z"}, {"author": "Yoav Nir", "text": "

ACME challenges are not static metadata (and they go in .well-known

", "time": "2023-03-28T08:16:38Z"}, {"author": "Benjamin Schwartz", "text": "

@Christopher Wood dohpath isn't specified in an HTTP resource, so a consistency protocol that is based on HTTP resources can't help us.

", "time": "2023-03-28T08:16:51Z"}, {"author": "Christopher Wood", "text": "

I don't see why that matters. It's just a blob like a key, no?

", "time": "2023-03-28T08:17:17Z"}, {"author": "Benjamin Schwartz", "text": "

As an example, DoubleCheck could not be used to verify dohpath, because DoubleCheck only applies to HTTP resources.

", "time": "2023-03-28T08:17:58Z"}, {"author": "Christopher Wood", "text": "

Hmm, that seems like an implementation detail to me.

", "time": "2023-03-28T08:18:18Z"}, {"author": "Benjamin Schwartz", "text": "

DNS and HTTP being not the same protocol is an aspect of implementation, but I wouldn't call it a detail.

", "time": "2023-03-28T08:18:50Z"}, {"author": "Christopher Wood", "text": "

Sure, sure. But I don't think it would be incredibly difficult to use the same protocol to address both.

", "time": "2023-03-28T08:19:40Z"}, {"author": "Matthew Finkel", "text": "

Most of the designs could be protocol agnostic if you have a proxy that can handle the target protocol

", "time": "2023-03-28T08:21:08Z"}, {"author": "Benjamin Schwartz", "text": "

I'm not sure the designs can be protocol agnostic even in an abstract sense, because DNS and HTTP have very different expectations about authenticity.

", "time": "2023-03-28T08:23:34Z"}, {"author": "Benjamin Schwartz", "text": "

But certainly as a concrete matter, I can't use an HTTP cache (as in DoubleCheck) to verify the consistency of a DNS record.

", "time": "2023-03-28T08:24:16Z"}, {"author": "Christopher Wood", "text": "

(I think Matt is saying what I was trying to say better)

", "time": "2023-03-28T08:24:41Z"}, {"author": "Benjamin Schwartz", "text": "

FWIW, DNS is _normally_ accessed through a shared caching \"proxy\" (the recursive resolver), so depending on your threat model it may be possible to convince yourself of reasonable consistency there without really defining anything new.

", "time": "2023-03-28T08:27:36Z"}, {"author": "Matthew Finkel", "text": "

I think Ben disagrees :) but I do agree that HTTP and DNS have different expectations and practical levels of authentication. If you move everything into a HTTP substrate and limit DNS to DoH, then we have different constraints and it might be okay. If you want Do53, then you'll need some other proxy/caching resolver that can provide a similar mechanism.

", "time": "2023-03-28T08:27:44Z"}, {"author": "Andrew Campling", "text": "

Is the lack of a current perceived need to rate limits a reason not to do this now to preempt a potential future requirement?

", "time": "2023-03-28T08:28:35Z"}, {"author": "Andrew Campling", "text": "

In other words, is there any harm in doing this work?

", "time": "2023-03-28T08:29:56Z"}, {"author": "Ted Hardie", "text": "

@Andrew I think the point he's making is that we may need to see the attack before crafting the right response.

", "time": "2023-03-28T08:31:01Z"}, {"author": "Christopher Wood", "text": "

@Benjamin Schwartz shame you're not here so we can hash it out in person!

", "time": "2023-03-28T08:31:49Z"}, {"author": "Christopher Wood", "text": "

(We're missing you.)

", "time": "2023-03-28T08:31:57Z"}, {"author": "David Schinazi", "text": "

Doing the adoption call SGTM

", "time": "2023-03-28T08:37:18Z"}, {"author": "Christopher Wood", "text": "

If the adoption call fails, it wouldn't prohibit another adoption call in the future, would it?

", "time": "2023-03-28T08:37:24Z"}, {"author": "Ted Hardie", "text": "

@Christopher I never heard of such a one-strike-and-you're-out principle for adoption calls.

", "time": "2023-03-28T08:38:04Z"}, {"author": "Richard Barnes", "text": "

@chris not necessarily, no

", "time": "2023-03-28T08:38:09Z"}, {"author": "Shivan Sahib", "text": "

yes

", "time": "2023-03-28T08:38:11Z"}, {"author": "Francesca Palombini", "text": "

Thank you! Bye

", "time": "2023-03-28T08:38:11Z"}, {"author": "Shivan Sahib", "text": "

it would not*, I mean

", "time": "2023-03-28T08:38:19Z"}]