Re: [dnssd] Security through Obscurity

["Albrecht, Harald" <[e-mail]>]

This is also exactly my understanding, thanks for clarifying this.

Von: dnssd [mailto:[e-mail]] Im Auftrag von Tim Chown
Gesendet: Dienstag, 29. Juli 2014 10:48
An: Albrecht, Harald
Cc: Kennedy, Smith (Wireless Architect); [e-mail]; Douglas Otis; Michael Richardson
Betreff: Re: [dnssd] Security through Obscurity

Hi,

There is some interesting discussion happening here, but we do need to focus the discussion on the elements that are important to defining scalable DNS-based service discovery, as per our group's charter.  Of course if there are related topics that people think are important, those can be progressed elsewhere, such as 6man or v6ops, though we should remember that dnssd's charter is IP version agnostic.

It would be useful therefore to capture what is of direct relevance to dnssd from this discussion.

One point is that a comment was made at IETF90 that dnssd should not explictly care about stability of addresses, and it should work however frequently a device is renumbered or changes address. So if someone implements the 'press a button to renumber my home network' idea discussed elsewhere, dnnsd should be able to react, and, as per REQ13 should ensure information is up to date and not stale.

It was also said that we should note the distinction between a service running on a device being discoverable (via dnssd), reachable (dependent on ACLs etc) and usable (via authentication). We don't want to rathole here on default home network CPE firewall settings, or the merits of RFC7217, take that to v6ops.

There is some discussion of handling the scopes of discoverable devices in draft-cheshire-dnssd-hybrid-01, in Section 3.1. I suspect Stuart would be happy to receive thoughts on that text.  ULAs have been discussed for homenet (in parallel to GUAs), and RFC1918 addresses are of course in wide use for IPv4 homes and enterprises.

Tim