MDM is also a red-herring given >90% of devices world-wide aren't managed so
anyone talking of MDM riding to the rescue of DoH client configuration is
walking around with blinkers on. Even inside company networks there are servers
not under MDM; locally developed applications that might in future pull in a
DoH resolver; BYOD; visitors; malware and so on. So whatever you think a
reasonable solution for client configuration has to start with unmanaged
clients. That last one malware is why the corporate response may well be 'MITM'
the traffic so we can protect the data, people and systems using our network.
What DoH discovery and presentation looks like is complex issue that will take
some discussion. Just one small example, I might want to use the local networks
DNS if and only if it provides anti-malware protection and has a reasonable
privacy policy but use a static one if not. Or perhaps on a child's device it's
okay if there is filtering in place suitable for children.
Alister
On 12/03/2019, 05:43, "dns-privacy on behalf of Konda, Tirumaleswar Reddy"
<dns-privacy-boun...@ietf.org on behalf of tirumaleswarreddy_ko...@mcafee.com>
wrote:
> -----Original Message-----
> From: Eliot Lear <l...@cisco.com>
> Sent: Monday, March 11, 2019 11:49 PM
> To: Paul Vixie <p...@redbarn.org>
> Cc: nalini elkins <nalini.elk...@e-dco.com>; Konda, Tirumaleswar Reddy
> <tirumaleswarreddy_ko...@mcafee.com>; d...@ietf.org; dnsop@ietf.org;
> Ackermann, Michael <mackerm...@bcbsm.com>; Christian Huitema
> <huit...@huitema.net>; dns-priv...@ietf.org; Vittorio Bertola
> <vittorio.bertola=40open-xchange....@dmarc.ietf.org>; Stephen Farrell
> <stephen.farr...@cs.tcd.ie>
> Subject: Re: [Doh] [dns-privacy] [DNSOP] New:
draft-bertola-bcp-doh-clients
>
> Hi Paul,
>
> > On 11 Mar 2019, at 19:12, Paul Vixie <p...@redbarn.org> wrote:
> >
> >
> >
> > nalini elkins wrote on 2019-03-11 10:26:
> >> Tiru,
> >> Thanks for your comments.
> >> > Enterprise networks are already able to block DoH services,
> > i wonder if everyone here knows that TLS 1.3 and encrypted headers is
> going to push a SOCKS agenda onto enterprises that had not previously
> needed one, and that simply blocking every external endpoint known or
> tested to support DoH will be the cheaper alternative, even if that makes
> millions of other endpoints at google, cloudflare, cisco, and ibm
unreachable
> as a side effect?
>
> That or it will require a bit more management at the MDM level. I’m
hoping
> the latter. And I hope that one output of all of these documents will be
a
> recommendation regarding MDM interfaces.
I don't think MDM is required to use the DoT/DoH servers provided by the
local network.
-Tiru
>
> Eliot
_______________________________________________
dns-privacy mailing list
dns-priv...@ietf.org
https://emea01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fdns-privacy&data=02%7C01%7Calister.winfield%40sky.uk%7Cab5faa933f374ae7b72c08d6a6ada348%7C68b865d5cf184b2b82a4a4eddb9c5237%7C0%7C0%7C636879662059337184&sdata=bba3bapIO3ffilylhoIj0x3zVkHYlNC4Gid96Ybx9Xo%3D&reserved=0
--------------------------------------------------------------------
This email is from an external source. Please do not open attachments or
click links from an unknown or suspicious origin. Phishing attempts can be
reported by sending them to phish...@sky.uk as attachments. Thank you
--------------------------------------------------------------------
Information in this email including any attachments may be privileged,
confidential and is intended exclusively for the addressee. The views expressed
may not be official policy, but the personal views of the originator. If you
have received it in error, please notify the sender by return e-mail and delete
it from your system. You should not reproduce, distribute, store, retransmit,
use or disclose its contents to anyone. Please note we reserve the right to
monitor all e-mail communication through our internal and external networks.
SKY and the SKY marks are trademarks of Sky Limited and Sky International AG
and are used under licence.
Sky UK Limited (Registration No. 2906991), Sky-In-Home Service Limited
(Registration No. 2067075), Sky Subscribers Services Limited (Registration No.
2340150) and Sky CP Limited (Registration No. 9513259) are direct or indirect
subsidiaries of Sky Limited (Registration No. 2247735). All of the companies
mentioned in this paragraph are incorporated in England and Wales and share the
same registered office at Grant Way, Isleworth, Middlesex TW7 5QD
_______________________________________________
DNSOP mailing list
DNSOP@ietf.org
https://www.ietf.org/mailman/listinfo/dnsop
