Hacker News Reader

Is DHCP useful to enforce network policy? What about users who manually set their DNS servers?

Wouldn't be a proxy checking the SNI of connections you open better?

Enforcement is step 2. Proxy with a blacklist of hostnames would do, but unfortunately, with encrypted SNIs on the horizon, full blown https proxy with custom CA enrolled on all machines would be necessary.

Step 1 is a mechanism for those, who do not want to fight the network policy, just want the autoconfiguration.

Reply on news.ycombinator.com