Re: [arch-d] ETSI launches new group on Non-IP Networking addressing 5G new services

[John C Klensin <[e-mail]>]

--On Friday, April 17, 2020 09:17 +1200 Brian E Carpenter
<[e-mail]> wrote:

> On 17-Apr-20 05:48, Toerless Eckert wrote:
>> On Mon, Apr 13, 2020 at 02:56:30PM -0400, John C Klensin
>> wrote:
>>> It may also be worth noting that a, perhaps the, major add-on
>>> change in IPv6 --much touted in its early days-- was
>>> supposed to be ubiquitous lP-level encryption.
> 
> Not touted by the IPv6 protagonists, however.

Really?  You obviously were not at some of the IPv6 Forum events
that I got to.  Now, if you mean (as suggested below) "IETF IPv6
protagonists", then I would probably agree, but the same IPv6
Forum leadership were citing the IETF as authority for a lot of
things few, if any, IETF participants ever said.  

(Obviously agreeing with Geoff here, just writing more slowly.)

And, since we are mentioning names, Latif wasn't the only one.
Arguably "we" -- IETF, IAB, and ISOC -- said some things that
were interpreted as indicating that IPv4 address exhaustion was
going to occur really soon, that it would be the end of life as
we knew it, and that IPv6 was the only solution.  While most of
those/ "our" comments were very nuanced, they left a vacuum that
a variety of people --some very sincere and a few pushing
products that were often not quite ready -- pushed, supposedly
quoting/representing "us".

> Yes, there was
> an intention to make IPsec mandatory-to-implement, but there
> was never a claim from the IETF that IPv6 with IPsec was
> intrinsically more secure than IPv4 with IPsec.

Agreed.  But there were a lot of claims that, since it was or
soon would be mandatory to implement, it was going to be much
more widely supported under IPv6 than it had been, or would
likely ever be, under IPv4.  And the implication of many of
those claims was the IPSec over (or integrated with) IPv6 would
be far more secure, easier to implement and deploy, etc., than
what was available (as an add-on, they said) over IPv4.  See
above.

> The claim that IPv6 was intrinsically secure was indeed
> touted; if I'm not mistaken it orginated in an industry white
> paper, was picked up and exagerrated by the IPv6 Forum, and
> got into draft-ietf-iab-case-for-ipv6-00, (which led to
> draft-iab-case-for-ipv6-06 and was then scrapped). But it also
> featured in various lists of IPv6 Myths over many years.

And I am pushing on this because, at least IMO, we are still
talking about when IPv6 will dominate IPv4 on the Internet
and/or making claims about how rapidly it is deploying.  That
breaks, by far, the record of claims for "two years from now"
about a small collection of protocols unrelated to the IETF,
claims that you may remember every couple of years through the
1980s.

>From an entirely non-technical perspective, we --the IETF and
various bodies that claimed our support and involvement, with
said IPv6 Forum high on the list-- made two very fundamental
political-economic errors.  "We" claimed that it was ready, and
products that would support it were ready, and that it was/would
be easy to deploy at a time when the claims about readiness were
dubious (because the assorted dual-stack and other arrangements
at the endpoints were not quite finished or because ISPs were
not ready to deploy either the packets or the boundary routers
or equivalent).   And some of the organizations that took "our"
advice and tried to deploy got burned and became harder to
convince to try again later.  The other is that, at least IMO,
we failed to adequately consider incentives for deployment once
one moved past fear of running out of address space (which,
predictably, tended to be seen as something to be worked around
or someone else's problem).  

This is, I think, important today, not because of the IPv6
issues but because the Internet has matured enough that it may
be even more important now than it was then to include in our
thinking about major new protocols or protocol changes an
analysis of incentives and disincentives to deployment, and, if
appropriate, who benefits and who loses, not just analyses of
whether they can be implemented and will work.  And it would be
reasonable for us to share that advice with others as well as
following it ourselves.

best,
  john