Re: [Anima-bootstrap] anima-bootstrap: Bootstrap proxy discovery options

["Toerless Eckert (eckert)" <[e-mail]>]

On Tue, Dec 08, 2015 at 05:37:47PM -0500, Michael Richardson wrote:
>     > Are you agreeing with Toerless??? argument that the new device should be
>     > a responder?
> 
> No. I'm saying that a new device should do as little as possible to call
> attention to itself, and should prefer to do things that all other devices
> are already doing.

My argument why it should rather do as little as possible (nothing) to call
attention to itself (which i think is different to what you're saying) is that
the attacker can also observe waht everybody else is doing and attack everybody
else. Only that everybody else will likely have stronger defenses having been already
enrolled and hopefully gotten software upgrades and hardening through intent/config/whatever.

But, this is just an optimization proposal from my side. No strong opinions.
Would just like to hear why it may not be a worthwhile enough optimization if you think it ain't.

Cheers
    Toerless

>     > Or, are you arguing that the new device should initiate the
>     > bootstrapping; but do so in a way that does not expose it is a new
>     > device?
> 
> For non-challenged (IoT) devices on non-challenged networks, the new device should
> initiate and drive the bootstrapping.
> 
> It would be best if this communication was indistinguishable from other ACP
> communication to an outsider.
> 
> 
> --
> Michael Richardson <[e-mail]>, Sandelman Software Works
>  -= IPv6 IoT consulting =-
> 
> 
> 



-- 
---
Toerless Eckert, [e-mail]