Subject: [OPSAWG] making opsawg-mud-iot-dns-considerations more enterprise compatible

From: Michael Richardson <[email-masked]>
Date: Sun, 21 Feb 2021 18:21:12 -0500

Qin Wu <[email-masked]> wrote:
    > Support adoption of this document, agree with Eliot.  A few quick
    > comments:

    > 1. I want to make sure these recommendation and guidelines of
    > using DNS are not only applicable to home network but also enterprise
    > network as well.

I'm open to suggestions as to where it is enterprise hostile.
   Are there such things?  I'd surely like to remove them.

But, I think that better explanation of enterprise problems are what you are seeking.

    > 2. Section 4.2 lack examples of non-deterministic CDN
    > content.

How specific an example do you think we need?
This is partly hampered by being unable to see into the intial firmware
update query.

For instance, I observed this with my Brother MFC printer, where it makes a clear
query to update.brother.co.jp (itself hosted by Cloudfront) over HTTPS,
followed, when there is an update available, to an IP associated with a
(seemingly) random Amazon S3 bucket.

Would you like a packet capture of this?  Or would the above paragraph
(changed to example.com) suffice?

    > 3. Section 4.2 describe control protocol to connect to a
    > known HTTP end point, can you provide an example of such control
    > protocol, HTTP protocol, SUIT protocol, or any firmware update
    > protocol.

So SUIT does not define any transports :-)
(I think that is now a bug that should be fixed with new documents, but...)
Alas, to date, most of these interactions are not standardized.

--
Michael Richardson <[email-masked]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide