Re: [Add] [EXTERNAL] Re: New Version Notification for draft-reddy-add-enterprise-split-dns-01.txt

["Deen, Glenn (NBCUniversal)" <[e-mail]>]

- No hat -

One Q inline.

On 3/12/21, 3:50 PM, "Add on behalf of Tommy Pauly" <[e-mail] on behalf of tpauly=[e-mail]> wrote:



    > On Mar 12, 2021, at 11:18 AM, Paul Vixie <[e-mail]> wrote:
    > 
    > On Fri, Mar 12, 2021 at 11:00:11AM -0800, Tommy Pauly wrote:
    >>> This is clearly a policy prescription, and is out of scope.  ...
    >> 
    >> Agreed. I think the main issue is that this ends up being an "evil bit".
    >> There's no reason for a client to trust or respect this value, unless they
    >> already have a strong MDM-style relationship, in which case this wouldn't
    >> be needed.
    > 
    > i understand why someone working at microsoft or google would confidently
    > assert the above positions, but the rest of the world doesn't work that way.
    > 
    > it's not an evil bit. it's a policy expression. as someone who operates and
    > secures managed private networks, the ability to detect noncompliance is
    > vital to _everything else_. therefore the state of compliance must be easily
    > expressed. there are also some non-security benefits, such as configuration
    > management to tell BYOD (who won't be participating in MDM) how to get reliable
    > service. but it's the work flows leading to anomaly detection which provide
    > the strongest motive for being able to express this policy.

    I think this leans towards a bit that says that the network will try to block DNS to other entities. That might make sense, but it’s different from a bit that says “please voluntarily disable your device security policy”.

[Glenn] Who is setting this bit? And where in the interaction is it set?     What I mean here is there is the VPN client on the device - is it setting this bit or is it the VPN itself that is setting this bit?  If it's the VPN client wouldn’t a on device communication be both better and more trustworthy as it isn't being touched by anything on the wire?

[Glenn]. Perhaps I'm not understanding the split between the VPN client on the device and the perspective of the "network".

-glenn