Re: [dane] Network errors ARE attacks - on the end-to-end-principle

[Henry Story <[e-mail]>]

On 16 May 2012, at 12:31, Yoav Nir wrote:

> 
> On May 16, 2012, at 12:43 PM, Martin Rex wrote:
> 
>> John Gilmore wrote:
>>> 
>>>> But it's better then disabling TLSA at all in the face
>>>> of DNS errors (where we assume most errors are genuine network errors
>>>> and not attacks).
>>> 
>>> "Genuine network errors" from buggy proxies or intentional firewalls
>>> or intentional or accidental censorship systems ARE attacks.  They are
>>> attacks on the fundamental end-to-end premise of the Internet.
>> 
>> Where have you been during the last 10 years?
>> There is no such thing an a "fundamental end-to-end premise" on the
>> Internet.  And if it ever existed, it ceased to exist ~10 years ago.
> 
> 15. Most networks have a NAT, including almost all home networks. Most corporate networks have some kind of firewall. If you want end-to-end, you have to roll your own through IPsec or TLS, and even then you're likely to get load balancers at the server side, and the occasional decrypting proxy on the client side.

The point of John Gilmore's inspirational mail is that end-to-end is the aim of
the architecture of the internet. It is because it was architected for end to 
end communication that it has had such positive effects. The reasons these working
groups exist is to remove the technical reasons for this not always being possible, such
as by for example working on ipv6.  When the technical reasons have been moved out of the
way the network effects and political pressure can be built up to solve the deployment
problems. Luckily the network effect works in favour of those who work for freedom.

Henry

> 
> Yoav
> _______________________________________________
> dane mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/dane

Social Web Architect
http://bblfish.net/