On 3/4/21 4:37 PM, Keith Moore wrote:
Glad we agree on that. I only wrote it because lots of IETF people who might respond to this thread seem to insist that part of the right solution is for all of these networks to connect to the public Internet, perhaps through a firewall, so that they can query the public DNS, and get firmware updates and root cert updates along with those, perhaps CRLs also.
Not sure who this strawman is aimed at, but if it's me you're way off the mark. Having services inside an air-gapped network is not the same as requiring public internet connectivity. That is a completely separate argument. And has nothing to do with anything I've been saying either.
Mike
