Re: [Add] [EXTERNAL] Re: New Version Notification for draft-reddy-add-enterprise-split-dns-01.txt

[Stephen Farrell <[e-mail]>]

Hiya,

On 12/03/2021 21:24, Tommy Jensen wrote:
> Summary, my personal dead horse: if we do want networks to be able to
> communicate policy to a client in a way that can be differentiated
> from an attacker, it should be more general than DNS and it should be
> not in ADD.
FWIW, I think the above is correct. That said, we have some
serious obstacles in the way of figuring out how to do that.
For example, I don't think we even know the potential set of
possible policies for when there's a "smart speaker" and a
house-guest involved, never mind how to possibly represent,
secure and process those in some electronic format.

There is also a danger that we encode our last decade's idea
of policy into a protocol in such a way that we make it hard
to move beyond that in the next decade. That doesn't mean we
ought ignore 2010-style policies but I think it does imply a
lot of care ought be taken before we follow the "obvious"
route for expressing those "obvious" policies.

So, I'd also argue for extreme minimalism in ADD on the
dual basis that we really don't yet know what's right for
the near future while at the same time we can be pretty
confident that the set of policies that were used in the
recent past and that are still validly used likely isn't
quite the right guide.

Cheers,
S.