Re: [Danish] Proposed WG Charter

[Michael Richardson <[e-mail]>]

Thanks Ash for doing such a good job on this charter.
{I appologize for being rather lame in responding to the charter discussions
in the past few weeks... some kind of COVID induced mid-life depression
around turning 50, and being unable to stay up all night writing code}

The charter feels a bit long/detailed I think, with content that maybe
belongs in a problem statement draft.... But, if the IESG doesn't mind that,
I don't.

Some thoughts as I read it again:

> but has also
> shown that reliance on DNSSEC is a significant barrier to adoption.

also:
> The greatest barrier to DANE adoption has been the DNSSEC requirement.

Reading this, I wonder if we really understand why DNSSEC has been so hard to
get deployed among Enterprise entities.  TLDs have done it, because ICANN
forced them to.
As evidence, we don't need DLV anymore (I was involved in running it, and
decommissioning it).  What I'm trying to say/ask: if there in fact some work
in understanding this?   An increasing number of DNS Registrars support DS
records, and CDS is supposed to make this even easier.

Adding DNSSEC to a DNS server seems (to me), *significantly* easier than
operating a private CA, but its also apples vs oranges.


> This allows for a gradual DANE
> adoption where DNSSEC is not in the initial set of requirements.

It seems that if we make something that makes DNSSEC less important, that
DNSSEC will never become important.

> In response to the challenges related to ambiguity between identities
> issued by different CAs, application owners frequently choose to onboard
> IoT devices to a single CA. This process of credential issuance can be
> time-consuming, which is further exacerbated by the sheer number of
> entities participating in large-scale IoT deployments.

So I understand why a single CA solves the potential identity confusion.
I don't understand why the scale matters here.  That sentence seems almost
a non-sequitor.

I think that the charter needs to introduce the message use case.
Or maybe delegate that more clearly.

--
Michael Richardson <[e-mail]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide