Re: [Add] New Version Notification for draft-reddy-add-enterprise-split-dns-01.txt

[Paul Vixie <[e-mail]>]

On Fri, Mar 12, 2021 at 11:00:11AM -0800, Tommy Pauly wrote:
> > This is clearly a policy prescription, and is out of scope.  ...
> 
> Agreed. I think the main issue is that this ends up being an "evil bit".
> There's no reason for a client to trust or respect this value, unless they
> already have a strong MDM-style relationship, in which case this wouldn't
> be needed.

i understand why someone working at microsoft or google would confidently
assert the above positions, but the rest of the world doesn't work that way.

it's not an evil bit. it's a policy expression. as someone who operates and
secures managed private networks, the ability to detect noncompliance is
vital to _everything else_. therefore the state of compliance must be easily
expressed. there are also some non-security benefits, such as configuration
management to tell BYOD (who won't be participating in MDM) how to get reliable
service. but it's the work flows leading to anomaly detection which provide
the strongest motive for being able to express this policy.

> I am in favor of letting the network prove authority for private domains, or
> even present an identity for itself as the network operator. It's up to the
> client to use those or ignore those.

a mobile device on a public network probably needs that kind of signaling. any
device on a managed private network probably needs different signaling. can we
come up with a unified proposal that serves both situations?

> The one thing the network could do that might be useful is provide a flag
> that it will be actively hostile to any DNS traffic it detects that does not
> go to itself, with some reason text. The (minimal) value there is to allow a
> client to present a reason for things being broken if the user of the client
> device also has a strict policy to not trust this network.

not all networks are public, and not all on-path actors are authoritarian
governments or surveillance capitalists, and not all devices have users. i'd
like to see this discussion move to a broader use case that isn't smartphone
centric or web-centric or coffee-shop-wifi centric.

-- 
Paul Vixie