Re: [homenet] securing zone transfer

[Juliusz Chroboczek <[e-mail]>]

Dear Michael,

>> Please see my unanswered e-mail of 21 November 2018.

>> https://mailarchive.ietf.org/arch/msg/homenet/vz1kdCJISN6UPNZpj9ZD4e8EdwQ

Thank you for your detailed reply.  I'm glad we're finally having
a discussion about my objections to Daniel's proposal.

> We strongly believe that the HNA needs to know the list of names in
> order to be able to answer for those names when there is unstable (or
> no) Internet connectivity.

> Otherwise, applications and people have to know two different names for the
> service. (A public one for when away, and the .local one)

That's a good point.  While I happen to believe that it's reasonable to
have a service known as "boombox.local" from home, and
"boombox.jch.example.org" from the Internet, this might be inconvenient
for e.g. smartphone users.

>    o  the credentials for the dynamic DNS server need to be securely
>       transferred to the hosts that wish to use it.  This is not a
>       problem for a technical user to do with one or two hosts, but it
>       does not scale to multiple hosts and becomes a problem for non-
>       technical users.

I think that's our main disagreement.

For some reason, you guys seem to be assuming that the average user will
want to publish hundreds of names in the global DNS.

However, none of the end-user services that I know use incoming
connections require a name in the global DNS to function (WebRTC, Skype,
online games, BitTorrent, remote desktops, BTSync/Resilio, syncthing).
Thus, my assumption is that the typical user will want to publish exactly
0 public names, and that only the extreme geek will publish up to 3 or 4
(music server, NAS, game server, web server with family photographs).

Richard, Daniel -- please be so kind as to explain why you think my
assumption is wrong.  How many names do you envision wanting to publish in
the public DNS, and for what purpose?

-- Juliusz