Re: [Doh] [Ext] A question of trust (was Re: Draft -09 and WGLC #2)

[Andrew Sullivan <[e-mail]>]

Hi,

On Thu, May 31, 2018 at 01:46:21PM +0000, Paul Hoffman wrote:
> 
> Without a discussion here on proposed text about what either of you
> think configuration is,

I just think it needs to be clear about what is and isn't covered by
configuration: is autoconf in or out?  One possibility is that it's
supposed to be out, and then something like "explicit configuration,
excluding any autoconfiguration" would be ok.  But I think some people
aren't going to like that.  I suspect that we haven't made up our
minds about this; but it won't do to leave an ambiguity just because
we can't make up our minds.  Readers of this document will need to
know whether only a user may on purpose set up the use of some URI, or
whether the user may configure the system to get stuff automatically
and thereby learn about (and subsequently use) a DNS API server.

The reason I'm on about this is because I can't tell what the
consequences are of the configuration being out of band.  If it just
means, "A user needed to go into their system and directly configure
some URI," then it seems plain the user gets to make an explicit
decision.  But if you can autoconfigure, then that has different
consequences (e.g. maybe you got the URI from your hotspot signon
portal, and now a random hotspot can partly alter your resolution
settings even after you've changed networks).  It's ok with me that we
might want to punt this to DRIU or something, but it needs to be
crystal clear what meaning of "configuration" is intended.

Does this make my concern clearer?

Best regards,

A
-- 
Andrew Sullivan
[e-mail]