Re: [homenet] Firewall hole punching [was: About Ted's naming architecture...]

[james woodyatt <[e-mail]>]

On Nov 23, 2016, at 08:05, Ray Bellis <[e-mail]> wrote:
> On 23/11/2016 15:49, Tim Chown wrote:
>> 
>> I have my doubts that any attempt to flesh that out further now would reach consensus,[…]

So do I, and these doubts were amplified by the recent discussion here following my objection to adopting I-D.lemon-homenet-naming-architecture on the grounds that we have no clear security architecture to provide for passive listeners on unmanaged networks receiving inbound flows from unauthenticated hosts over public Internet routes. [*] In fact, if we were to search for the consensus to write one, I suspect it would settle on strongly prohibiting all such communications. [**]

>>  Something for the chairs…?
> 
> The Chairs think it would be a fine idea.
> However we are short of volunteers to take on the work…

“Prepare to waste a lot of time accomplishing nothing,” says the little voice in my head. Maybe if my forecast for reaching consensus on the security architecture seemed less gloomy.

[*] To be pedantic, we *do* have a security architecture, but it’s far from clear and it's not recommended anywhere: RFC 6092 provides the distinguished inbound flow exception for IPsec and IKE. I doubt anyone believes that could be a feature of any security architecture that will be adopted by industrial policy, but if the chairs are interested in tilting at windmills, I might be able to find time to write a short draft to clarify how it would work.

[**] Before anyone asks, the answer is "No, I will not write a security architecture draft for HOMENET that prohibits passive listeners on unmanaged networks receiving inbound flows from unauthenticated hosts over public Internet routes. If that’s how it should unfold, then I’m confident the working group will find somebody with the necessary moral flexibility."


--james woodyatt <[e-mail] <mailto:[e-mail]>>