Re: [dane] Network errors ARE attacks - on the end-to-end-principle

[Phillip Hallam-Baker <[e-mail]>]

No, his rather emotional account is wrong.

If Gilmore was right then Tor would also be an attack on the Internet
architecture. It isn't.

Before arguing the end to end principle, I suggest that people
actually wrote what David Clarke wrote rather than second hand lore.
It is actually an argument about complexity and the cost/benefit
tradeoffs that result from placing complexity in one place or the
other. David is a pragmatist, not an ideologue.


Without NAT, the Internet would have run out of IPv4 addresses over
ten years ago. Since the design of IPv6 was intended to prevent OSI
networking from winning the standards race rather than actually
meeting the address space crunch, a solution like NAT was inevitable.

Firewalls have an important function, one that is fully understood and
accepted in the INTER-NETWORKING protocols. The core concept of the
internet is not the end-to-end principle but the idea that the
inter-net is a network of networks. The only core principles of the
Internet are that all the systems use the DNS for naming and IP is
used to exchange messages between networks.


End-to-End IP is not and never has been a core principle of the
Internet as deployed. Until 1993 when the Web appeared there was an
expectation that it would take another decade at least before networks
all converged on using just IP. Email was not designed as an end to
end protocol, it had to contend with a dozen WAN and LAN protocols. It
was only when the Web arrived with the encyclopedia galactica online
but only if you had IP, that the tipping point was established and
there was an advantage to TCP/IP end to end.

But even the Web was designed with the concept of proxies from the start.


A border firewall delineates the boundary between the network I
control and the network that I do not control and am not responsible
for. It is an obviously necessary function. I have over 50 IP
connected devices on my home network and that will almost certainly
rise to 100 as IP enabled phones and thermostats and temperature
monitors are deployed. I do not want to spend any time worrying about
applying patches to such devices. They do not require unrestricted
network access, therefore by the principle of least privilege they
must not have it.



On Wed, May 16, 2012 at 7:55 AM, Henry Story <[e-mail]> wrote:
>
> On 16 May 2012, at 12:31, Yoav Nir wrote:
>
>>
>> On May 16, 2012, at 12:43 PM, Martin Rex wrote:
>>
>>> John Gilmore wrote:
>>>>
>>>>> But it's better then disabling TLSA at all in the face
>>>>> of DNS errors (where we assume most errors are genuine network errors
>>>>> and not attacks).
>>>>
>>>> "Genuine network errors" from buggy proxies or intentional firewalls
>>>> or intentional or accidental censorship systems ARE attacks.  They are
>>>> attacks on the fundamental end-to-end premise of the Internet.
>>>
>>> Where have you been during the last 10 years?
>>> There is no such thing an a "fundamental end-to-end premise" on the
>>> Internet.  And if it ever existed, it ceased to exist ~10 years ago.
>>
>> 15. Most networks have a NAT, including almost all home networks. Most corporate networks have some kind of firewall. If you want end-to-end, you have to roll your own through IPsec or TLS, and even then you're likely to get load balancers at the server side, and the occasional decrypting proxy on the client side.
>
> The point of John Gilmore's inspirational mail is that end-to-end is the aim of
> the architecture of the internet. It is because it was architected for end to
> end communication that it has had such positive effects. The reasons these working
> groups exist is to remove the technical reasons for this not always being possible, such
> as by for example working on ipv6.  When the technical reasons have been moved out of the
> way the network effects and political pressure can be built up to solve the deployment
> problems. Luckily the network effect works in favour of those who work for freedom.
>
> Henry
>
>>
>> Yoav
>> _______________________________________________
>> dane mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/dane
>
> Social Web Architect
> http://bblfish.net/
>
> _______________________________________________
> dane mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/dane



-- 
Website: http://hallambaker.com/