RE: [EME] progress on EME

...
> 2.  Broadly there is an interesting issue about how to define ACLs
>     (both in firewalls and endhosts).  The NUTSS paper assumes a
>     3-tuple of <user,domain,application>, where domain is meant to
>     be a DNS name, and can be wildcarded, application is meant to be
>     globally unique, user can be NULL (and doesn't have to represent
>     a human per se), and where all three are user friendly.  The
>     main question, in my mind at least, is whether domain is the
>     best basis for ACLs, or whether certificates, for instance, is
>     better (or, at least, has some better properties).  I personally
>     want to use domain names, given their ubiquity, but the question
>     is nevertheless interesting, and we should know what we are
>     giving up, both in terms of security and in terms of
>     flexibility, by using them.  Beyond this, there are questions of
>     who creates ACLs and where, and what to do when there are
>     conflicts.  This is something the ID doesn't explore, but which
>     we are beginning to understand is central to the problem.

A "HIP ACL" (for lack of a better term) seems perfect.  Consider,
for example, if I'm trying to establish communications with you --
I know you're francis@cs.cornell.edu, and I'd like to only have
communications with you.  I'd like some way to tickle my firewall
to only allow your communication (and not everyone else on the
Internet).  

So, however that flow is identified as coming from you would be
very useful.  Doesn't seem to matter much if it's a certificate
or a HIP identifier or what.  Just that you tell me what that
identifier is so that I can tell my firewall(s).  IP address
isn't adequate due to IP address spoofing and due to NATs
which rewrite addresses willy nilly and we don't know which
address realm I'm in or you're in or the relationship between
those address realms.

...
> 5.  There was one suggestion that EME be stopped, because 
> we should be discouraging middleboxes, not making them 
> easier to deploy.

Do share with us the home IP address of whoever made that
suggestion so they might be sent a few thousand pps to
saturate their access link.  (I'm only half joking.)

-d

_______________________________________________
EME mailing list
EME@irtf.org
https://www1.ietf.org/mailman/listinfo/eme