Re: [Add] [Ext] Draft Posting: CNAME Discovery of Local DoH Resolvers

[Michael Richardson <[e-mail]>]

Paul Vixie <[e-mail]> wrote:
    >> > my IoT devices hate me, because i won't let them speak directly to their
    >> > motherships, and lacking keyboards or ssh listeners, i have no way to tell
    >> > them what proxy they would have to use to be successful. if you want me to
    >> > agree that IoT is insane, i probably will. but it's our world.
    >>
    >> Secure bootstrapping methods for IoT devices are discussed both inside
    >> (e.g., BRSKI) and outside of IETF (DPP, OCF, OMA).

    > do you see that problem as specific to IoT, or disjoint from RDNS settings?
    > (i do not.)

In the IoT case, we need a good, autonomic mechanism to deploy network
configuration to devices in ways that they really understand.
(Such as your proxy-HTTP setting, which I entirely approve of).

Getting the wrong RDNS settings on an IoT device means that it probably does
not function well (or maybe at all), and it becomes very difficult to do
RFC8520.  (see my draft-richardson-opsawg-mud-iot-dns-considerations-02 )

Getting the wrong RDNS settings on a *desktop* browser is a qualitatively different
thing in my opinion.  It probably operates, but for some uses/users it may be
a problem, either because of the click-trail it leaves, or because of the
censorship that the user experiences.

I think that this is particularly acute for *desktop* browsers, as they do
not in general have the luxury of just picking a different coffee shop.
The people who use them are generally vulnerable in a variety of different
ways.

It is *important* for the browser to be able to clearly indicate what level
of privacy is being experienced.

--
Michael Richardson <[e-mail]>, Sandelman Software Works
 -= IPv6 IoT consulting =-