Re: [Add] [Ext] My single use case

On Sun, Sep 13, 2020 at 11:47 PM tirumal reddy <kondtir@gmail.com> wrote:

> Hi Eric,
>
> Please see inline
>
> On Fri, 11 Sep 2020 at 20:57, Eric Rescorla <ekr@rtfm.com> wrote:
>
>>
>>
>> On Fri, Sep 11, 2020 at 8:18 AM tirumal reddy <kondtir@gmail.com> wrote:
>>
>>> On Fri, 11 Sep 2020 at 20:21, Paul Hoffman <paul.hoffman@icann.org>
>>> wrote:
>>>
>>>> On Sep 11, 2020, at 5:06 AM, tirumal reddy <kondtir@gmail.com> wrote:
>>>> >
>>>> > On Fri, 11 Sep 2020 at 16:45, Eric Rescorla <ekr@rtfm.com> wrote:
>>>> >
>>>> >> For wired network you plug into the wall.
>>>> >> For a wireless network, someone gives you an SSID and a (common)
>>>> password.
>>>> >>
>>>> > You seem to be referring to home/coffee shop use cases and not
>>>> relevant to on-boarding devices in an enterprise network.
>>>>
>>>> It is wrong to say that Ekr's model "is not relevant" to enterprise
>>>> networks.
>>>
>>>
>>> I only meant common password is "not relevent" to an Enterprise network.
>>>
>>>
>>>> Some enterprise networks use extra configuration for handing out
>>>> resolver information,
>>>
>>> many enterprise networks (including the one I'm using at the moment) do
>>>> not.
>>>>
>>>
>>> Yes, it depends on the enterprise network. In addtion, whether it is a
>>> IT-owned devices, BYOD with MDM or configuration profile or a BYOD with
>>> unique credentails. The use case should consider all the above type devices
>>> including IoT devices.
>>>
>>
>> I disagree with this. In particular, I do not think it should include
>> anything that is managed (MDM, enterprise config, etc.) because those
>> entities can just directly configure the DNS provider. It might still be
>> useful in some way to have a signaling protocol, but it is a far lower
>> priority.
>>
>
> If the discovery protocol works for unmanaged BYOD, it would also work for
> other types of devices.
> I understand device management tools can be used to provision managed
> devices with network provided encrypted resolver but it is not yet fully
> supported, for example (1) configuration profile (provisioned using OTA)
> does not yet support configuring the encrypted DNS resolver and the
> configuration profile is specific to Apple (3) I see policies (GPO) can be
> set on Chrome/Firefox and OS like Windows to use a DoH server but not sure
> about other OS/Browsers. (3) I don't think MDM (from several vendors)
> supports encrypted DNS server configuration yet.
>

So? Any of this would require something to change on the endpoints. The
question is what the appropriate change would be in this setting (if any),
and what I'm saying is that the appropriate change is to use the existing
device management.

-Ekr

> -Tiru
>
>
>>
>> -Ekr
>>
>>
>>>> It's fine to say that Martin's use case is not the use case you
>>>> personally are interested in; please don't dismiss it as "not relevant".
>>>>
>>>
>>> I am interested in the use case :)  I would like to understand whether
>>> the use case is for a Home or Enterprise network.
>>>
>>> Cheers,
>>> -Tiru
>>>
>>>
>>>>
>>>> --Paul Hoffman
>>>>
>>>> --
>>> Add mailing list
>>> Add@ietf.org
>>> https://www.ietf.org/mailman/listinfo/add
>>>
>>