Re: [Add] [Ext] My single use case

Hi Eric,

Please see inline

On Fri, 11 Sep 2020 at 20:57, Eric Rescorla <ekr@rtfm.com> wrote:

>
>
> On Fri, Sep 11, 2020 at 8:18 AM tirumal reddy <kondtir@gmail.com> wrote:
>
>> On Fri, 11 Sep 2020 at 20:21, Paul Hoffman <paul.hoffman@icann.org>
>> wrote:
>>
>>> On Sep 11, 2020, at 5:06 AM, tirumal reddy <kondtir@gmail.com> wrote:
>>> >
>>> > On Fri, 11 Sep 2020 at 16:45, Eric Rescorla <ekr@rtfm.com> wrote:
>>> >
>>> >> For wired network you plug into the wall.
>>> >> For a wireless network, someone gives you an SSID and a (common)
>>> password.
>>> >>
>>> > You seem to be referring to home/coffee shop use cases and not
>>> relevant to on-boarding devices in an enterprise network.
>>>
>>> It is wrong to say that Ekr's model "is not relevant" to enterprise
>>> networks.
>>
>>
>> I only meant common password is "not relevent" to an Enterprise network.
>>
>>
>>> Some enterprise networks use extra configuration for handing out
>>> resolver information,
>>
>> many enterprise networks (including the one I'm using at the moment) do
>>> not.
>>>
>>
>> Yes, it depends on the enterprise network. In addtion, whether it is a
>> IT-owned devices, BYOD with MDM or configuration profile or a BYOD with
>> unique credentails. The use case should consider all the above type devices
>> including IoT devices.
>>
>
> I disagree with this. In particular, I do not think it should include
> anything that is managed (MDM, enterprise config, etc.) because those
> entities can just directly configure the DNS provider. It might still be
> useful in some way to have a signaling protocol, but it is a far lower
> priority.
>

If the discovery protocol works for unmanaged BYOD, it would also work for
other types of devices.
I understand device management tools can be used to provision managed
devices with network provided encrypted resolver but it is not yet fully
supported, for example (1) configuration profile (provisioned using OTA)
does not yet support configuring the encrypted DNS resolver and the
configuration profile is specific to Apple (3) I see policies (GPO) can be
set on Chrome/Firefox and OS like Windows to use a DoH server but not sure
about other OS/Browsers. (3) I don't think MDM (from several vendors)
supports encrypted DNS server configuration yet.

-Tiru

>
> -Ekr
>
>
>>> It's fine to say that Martin's use case is not the use case you
>>> personally are interested in; please don't dismiss it as "not relevant".
>>>
>>
>> I am interested in the use case :)  I would like to understand whether
>> the use case is for a Home or Enterprise network.
>>
>> Cheers,
>> -Tiru
>>
>>
>>>
>>> --Paul Hoffman
>>>
>>> --
>> Add mailing list
>> Add@ietf.org
>> https://www.ietf.org/mailman/listinfo/add
>>
>