Re: [homenet] New version draft-mglt-homenet-naming-architecture-dhc-options-02.txt

Markus Stenberg <markus.stenberg@iki.fi> Tue, 15 July 2014 06:47 UTC

Return-Path: <markus.stenberg@iki.fi>
X-Original-To: homenet@ietfa.amsl.com
Delivered-To: homenet@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 995251B2822 for <homenet@ietfa.amsl.com>; Mon, 14 Jul 2014 23:47:43 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: 0.778
X-Spam-Level:
X-Spam-Status: No, score=0.778 tagged_above=-999 required=5 tests=[BAYES_20=-0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_NEUTRAL=0.779] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id O62xoYzsc2iW for <homenet@ietfa.amsl.com>; Mon, 14 Jul 2014 23:47:42 -0700 (PDT)
Received: from kirsi1.inet.fi (mta-out1.inet.fi [62.71.2.199]) by ietfa.amsl.com (Postfix) with ESMTP id C5B491B2824 for <homenet@ietf.org>; Mon, 14 Jul 2014 23:47:41 -0700 (PDT)
Received: from poro.lan (84.248.80.109) by kirsi1.inet.fi (8.5.142.08) (authenticated as stenma-47) id 53B153320128A3BA; Tue, 15 Jul 2014 09:47:36 +0300
Content-Type: text/plain; charset=windows-1252
Mime-Version: 1.0 (Mac OS X Mail 7.3 \(1878.6\))
From: Markus Stenberg <markus.stenberg@iki.fi>
In-Reply-To: <87vbr6mv8t.wl-jch@pps.univ-paris-diderot.fr>
Date: Tue, 15 Jul 2014 09:47:35 +0300
Content-Transfer-Encoding: quoted-printable
Message-Id: <7EEF5CD0-C3B8-4559-A75D-E55931F94F61@iki.fi>
References: <CADZyTkk6rUuFJ5Wds2hioBBQa9-kXDJxyg_gBGQ1R6u5CHF2Ww@mail.gmail.com> <87fvij5wdw.wl.jch@pps.univ-paris-diderot.fr> <CADZyTkk2bv7T-Bs_ckG4i2MpXVDRqLA2R1dQgrMVrPSckOy-GQ@mail.gmail.com> <87k37uy703.wl.jch@pps.univ-paris-diderot.fr> <CADZyTk=YgD=JtyDpEz8TXOQmHxKzBoiEZbbW0LhZQy2GaKLqZQ@mail.gmail.com> <87vbrcydr9.wl.jch@pps.univ-paris-diderot.fr> <CADZyTk=kST4zPaPzz4DsAcCOtmYbQo-s2du+nEvJv0MSrneEMg@mail.gmail.com> <CADZyTkmZ+rC99qeC7gFEwc4JBoX9sHBUpo7p89+VC6zY7Z8drQ@mail.gmail.com> <87d2dfb98w.wl-jch@pps.univ-paris-diderot.fr> <CADZyTk=U25=Yck8BL5nrzGAR7mPk5HWp0r0h2wYy5ruSOf6rsQ@mail.gmail.com> <87vbr6mv8t.wl-jch@pps.univ-paris-diderot.fr>
To: Juliusz Chroboczek <jch@pps.univ-paris-diderot.fr>
X-Mailer: Apple Mail (2.1878.6)
Archived-At: http://mailarchive.ietf.org/arch/msg/homenet/CnCCu3zaIfftIkacwmevKl3QnAE
Cc: "homenet@ietf.org" <homenet@ietf.org>, Markus Stenberg <markus.stenberg@iki.fi>, Daniel Migault <mglt.ietf@gmail.com>
Subject: Re: [homenet] New version draft-mglt-homenet-naming-architecture-dhc-options-02.txt
X-BeenThere: homenet@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: <homenet.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/homenet>, <mailto:homenet-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/homenet/>
List-Post: <mailto:homenet@ietf.org>
List-Help: <mailto:homenet-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/homenet>, <mailto:homenet-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 15 Jul 2014 06:47:43 -0000

On 9.7.2014, at 18.01, Juliusz Chroboczek <jch@pps.univ-paris-diderot.fr>; wrote:
> There's still something I don't understand.  If I'm understanding Steve's
> and Markus' work correctly, HNCP performs prefix delegation to internal
> routers over HNCP, and the internal routers don't proxy stateful DHCPv6 to
> the CPE.  How does your protocol work in the presence of multiple links?
> Or are you assuming that only nodes directly connected to the IHAS/CPE can
> be advertised over your protocol?

Or even more weirdly, what if you don’t want stateful DHCPv6? SLAAC + temporary addresses?

> Finally, what happens when there are multiple CPEs, which HNCP explicitly
> supports?  Are you assuming that only one acts as IHAS?

.. and how do the zones map to multiple uplinks ..

Personally, I don’t believe in auto-exported ~full DNS information from home because current service discovery schemes (mdns, dns-sd, upnp) or even host-name discovery schemes (dhcp*) do not really lend themselves to the external visibility being _opt in_. I don’t really want to publish my home zone, and if I even did, anything that’s firewalled (= everything except few ports on few addresses) is not useful outside the home in any case.

Getting security right on ‘all devices’ so you can leave your firewall open by default is a nice dream, but I think I stopped dreaming sometime in the 90s on that front :p Default deny + clued allow is much, much better than the default allow + ISP doing filtering for you after your home is owned.

Cheers,

-Markus

P.S. I am amused by recent WeMo/that other IoT light security woes. I’m sure publishing _their_ names on my home zone would help me, somehow, to get remote controlled home disco if nothing else.. at least, if they weren’t on a separate, L3-firewalled link that has no outside connectivity outside my home.