Re: [Add] My principles for discovery

[Michael Richardson <[e-mail]>]

Martin Thomson <[e-mail]> wrote:
    > As I raised this in the meeting, I think that it's only fair that I
    > include what I think the principles should be.

Thank you.

    > In short, I believe that any entity that you interact with should be
    > able to present their views on what resolver you should use.  Client
    > policy will then dictate which - if any - of those is used.
    > Authentication of the source of these opinions is likely a necessary
    > input for the client policy decision.

I find this a surprising suggestion.
Will I get different answers if I ask different entities the same question?
This seems to fall into MIF space, and I don't think that you mean to go there.

    > It is discussing client policy that has caused us to get into
    > unproductive discussions.  To be clear, I regard the question of
    > whether it is users or the software they choose to run that make policy
    > decisions to be firmly part of this discussion.  We might variously
    > lament the ability of software to properly reflect the wishes of users,
    > but this is not the place to debate that.

Agreed.

    > That doesn't mean that you should expect the person serving you
    > sausages at a local deli to offer an opinion on what resolver you
    > should use.  But we should look to provide ways in which entities that

Let me expand upon your scenario.

is it: "if you want mustard, you must ask at the counter"
or:    "if you ask at the counter, I'll give you (free) internet"

    > * The operating system configuration.
    > * Various "owners" or stakeholders for the endpoint, such as an employer or a government (this might not extend all the way to full control of the device MDM-style, but it might still be relevant to the client policy).
    > * Application configuration.

    > I don't personally see a lot of value in having entities other than
    > those from the first set of three stand on soapboxes to broadcast their
    > opinions about resolver choice, but there is nothing fundamentally
    > wrong with having other sources of opinions.  So while the IETF could
    > provide more protocols, it's not a good use of our time and resources
    > unless we expect that the information would be acceptable to genuine
    > client policies.

Agreed.

    > When it comes to setting policy, authentication is important.  When
    > making a decision about whether to use a particular resolver, depending
    > on the policy you have, it might be important that you know whose
    > opinion is guiding the decision.  If you want a server that doesn't
    > store logs of queries for longer than a certain time, then I'm not
    > aware of a technical mechanism for verifying that claim.

So, to be clear, there is running code for verifying the claim, and a
successful business transaction to do this.
RATS will give us open-standard was to execute the entire stack, but it can
be done in proprietary verticals today with third party auditors.

--
]               Never tell me the odds!                 | ipv6 mesh networks [
]   Michael Richardson, Sandelman Software Works        |    IoT architect   [
]     [e-mail]  http://www.sandelman.ca/        |   ruby on rails    [


--
Michael Richardson <[e-mail]>, Sandelman Software Works
 -= IPv6 IoT consulting =-