<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">On 13/05/19 08:55, Antonio Prado via
itnog wrote:<br>
</div>
<blockquote type="cite"
cite="mid:6d6015e2-4e35-ea6a-5b11-07b3ddb6cabd@prado.it">
<pre class="moz-quote-pre" wrap="">ciao,
a proposito del breve dibattito durante ITNOG5 su DoH, segnalo questo
recente tweet
<a class="moz-txt-link-freetext" href="https://twitter.com/latour_jacques/status/1127469595072258049">https://twitter.com/latour_jacques/status/1127469595072258049</a></pre>
</blockquote>
<p>...dove leggo (la "riformattazione e' la mia): <br>
</p>
<p>----------------------------------------------------</p>
<p>Q: How to block #DNS #DoH from an enterprise point of view?</p>
<p>A: <font color="#ff0000"><b>Decrypt all outbound SSL/TLS</b></font>
[...and...] filter out http-req-headers = application/dns-message.
<br>
</p>
<p>We implemented this on our Palo FW. <br>
</p>
<p>Note: Each DoH message is 4K</p>
<p>----------------------------------------------------</p>
<p>Non mi e' chiaro come sia possibile "Decrypt all outbound
SSL/TLS" senza interventi "invasivi" e "indolori" per l'utenza
finale (nel mio caso: un Ateneo).</p>
<p>Saluti,<br>
DV<br>
</p>
<p><br>
</p>
<p>-- </p>
<pre class="moz-signature" cols="75">Damiano Verzulli
e-mail: <a class="moz-txt-link-abbreviated" href="mailto:damiano@verzulli.it">damiano@verzulli.it</a>
---
possible?ok:while(!possible){open_mindedness++}
---
"Technical people tend to fall into two categories: Specialists
and Generalists. The Specialist learns more and more about a
narrower and narrower field, until he eventually, in the limit,
knows everything about nothing. The Generalist learns less and
less about a wider and wider field, until eventually he knows
nothing about everything." - William Stucke - AfrISPA
<a class="moz-txt-link-freetext" href="http://elists.isoc.org/mailman/private/pubsoft/2007-December/001935.html">http://elists.isoc.org/mailman/private/pubsoft/2007-December/001935.html</a>
</pre>
</body>
</html>