Re: [Add] Why so complex? (was Re: some background on split DNS with DNSSEC)

[Bill Woodcock <[e-mail]>]

> On Nov 9, 2021, at 5:30 PM, Paul Wouters <[e-mail]> wrote:
> The problem of a network provided solution that is not an enterprise / provisioned deployment is that the user and the network have a trust issue to solve.
> Yes it can really only cover the enterprise case or it ends up as network coercing the user with no way for the user to opt out and the term user is even confusing as we have system resolvers and application resolvers.

I think we have three common cases, into which most others can be generalized:

One in which a user is assigned a device by their employer and the employer enforces a security policy; and

One in which a user is responsible for their security policy or preferences.

One in which a user, hypothetically named Vaul Pixie, wishes to enforce a security policy upon the devices using their network.

So, in the first case, domain name resolution order could be:

    MDM-assigned
    Manually-configured
    Application-specific
    DHCP
    Local/hosts/best-guess/whatever

In the second case, resolution order could be:

    Manually-configured
    Application-specific
    DHCP
    Local/hosts/best-guess/whatever

In the third case, resolution order could be:

    DHCP
    MDM-assigned
    Manually-configured
    Application-specific
    Local/hosts/best-guess/whatever

The first two cases look alike, in the sense that if there is no MDM configuration, they act the same.  The question is when network-assigned policy should take precedence over employer or user-defined policy.  At some level, there’s the “it’s my house, you’ll follow my rules, or get out” thing… If someone wants to use a network, it’s probably reasonable for the network to be able to define terms of acceptable use, and for the user (or their employer) to be able to make an informed choice about whether those terms are compatible with their policies and preferences, or whether to forego using that network.

But I think the key here is the informed choice bit.  I think the first two cases are close enough to be compatible, in an unobtrusive UI sense… If there’s MDM-assigned configuration, good UI would inform the user, if they tried to manually configure, and tell them that their manual configuration would not take effect because it’s overridden by the MDM configuration.

Likewise, I think it’s reasonable for applications to tell users that the configuration the application is trying to do won’t take effect because of a manually-configured or MDM-assigned resolver overriding it.  If the user wishes to, they can change the former.

But there’s no obvious mechanism for the network to present terms of use to a user, to inform them that they have to change their manual configuration, or allow it to be overridden, if they want to use the network, or to inform them that the network isn’t going to be available to them because of an incompatibility in policy with their MDM-assigned policy.

Do others view this problem differently?

                                -Bill