Re: [Doh] A question of trust (was Re: Draft -09 and WGLC #2)

[Patrick McManus <[e-mail]>]

Hi Sara,

On Tue, May 29, 2018 at 5:27 AM, Sara Dickinson <[e-mail]> wrote:

>
>
> I much prefer the approach of just discussing configuration but I don’t
> think this goes far enough in answering Andrews question or helping
> implementors work out exactly what to to. So….
>
> What does ‘configuration’ cover?
> - Just direct configuration e.g. via a client API or config file
> - Or also dynamic configuration e.g. via DHCP, assuming a future option
> for this (which raises the question of trust again….)?
>
> I support only specifying direct configuration in this document but either
> way making it more explicit.
>

I would describe [in]direct (or not) as one aspect of discovery, and the
working group has chosen to stay away from discovery in this document.

OTOH as I understand it discovery is the core topic of the DRIU bof, and is
also on topic for this WG in a different document should someone propose
such a thing.

DoH isn't trying to solve that problem with the text under discussion - its
just trying to say that the server(s) need to be bootstrapped and not
discovered via linking and pushing during unrelated HTTP activities. Using
the word "untrusted" was a mistake because it indicated more than that.

-Patrick