Re: [IPsec] IPsec Digest, Vol 123, Issue 21

Les Leposo <leposo@gmail.com> Tue, 19 August 2014 17:42 UTC

Content-Type: text/plain; charset="us-ascii"
Mime-Version: 1.0 (Mac OS X Mail 7.3 \(1878.6\))
From: Les Leposo <leposo@gmail.com>
In-Reply-To: <alpine.LFD.2.10.1408191042460.19423@bofh.nohats.ca>
Date: Tue, 19 Aug 2014 20:42:09 +0300
Content-Transfer-Encoding: quoted-printable
Message-Id: <B368071B-C01A-476F-803D-8BC22C4D5C6E@gmail.com>
References: <mailman.4236.1406823571.13632.ipsec@ietf.org> <A0463391-0BB4-408F-874B-A6B91ED6D102@gmail.com> <21490.4420.127387.489490@fireball.kivinen.iki.fi> <alpine.LFD.2.10.1408181229340.25715@bofh.nohats.ca> <50B02F3B-2DA2-42D1-865E-9635A4D928BA@gmail.com> <alpine.LFD.2.10.1408181351270.27621@bofh.nohats.ca> <EA6BA2C5-112E-431A-B128-B9E856641DB8@gmail.com> <alpine.LFD.2.10.1408191042460.19423@bofh.nohats.ca>
To: Paul Wouters <paul@nohats.ca>
Archived-At: http://mailarchive.ietf.org/arch/msg/ipsec/X5lEkvCFh8b1-TGGFzmCBunYrjE
Cc: "ipsec@ietf.org WG" <ipsec@ietf.org>
Subject: Re: [IPsec] IPsec Digest, Vol 123, Issue 21
Precedence: list

On Aug 19, 2014, at 5:43 PM, Paul Wouters <paul@nohats.ca> wrote:

> On Tue, 19 Aug 2014, Les Leposo wrote:
> 
>>> the entire ipsec system is brought down/up, eg racoon is completely
>>> killed and restarted all the time.
>> Sounds like a totally reproducible crash/signal.
>> 
>> I'm sure if you file a radar with the procedure of how to reproduce (including connection duration & user activity), may be even a test account on your server, a developer on that end can gdb their way to the fix.
>> 
>> You would also have to indicate how long this problem has been happening e.g. years/months, ios versions (to identify regressions).
> 
> Years ago I tried to file bug reports for IPsec to Apple. No feedback
> ever, and lots of "developer" spam email.
> 
> If Apple cares, they can contact me to convince me the process changed.
> But from what I'm hearing, if you're not doing millions in revenue, you
> don't really get their attention whatsoever.
> 
That's an interesting take.

Imho, generally, part of the issue with ikev2 (circa 2011-2012), no one really knew where ike/ipsec it was going in enterprise (aside from the 3GPP area which was considered niche and not worthy of the attention it deserved).

Back then, SSL VPN was the shiny toy that dev managers & customers wanted, especially because it was easy to develop, a new opportunity for revenue stream, and the enterprise server vendors had made it so easy to deploy (e.g. you install the app and go to a webpage to log in and download your configs); completely overlooking significant weaknesses (and those of its library implementations).

> Paul

Re: [IPsec] IPsec Digest, Vol 123, Issue 21 Les Leposo
Re: [IPsec] IPsec Digest, Vol 123, Issue 21 Yoav Nir
Re: [IPsec] IPsec Digest, Vol 123, Issue 21 Les Leposo
Re: [IPsec] IPsec Digest, Vol 123, Issue 21 Tero Kivinen
Re: [IPsec] IPsec Digest, Vol 123, Issue 21 Paul Wouters
Re: [IPsec] IPsec Digest, Vol 123, Issue 21 Les Leposo
Re: [IPsec] IPsec Digest, Vol 123, Issue 21 Les Leposo
Re: [IPsec] IPsec Digest, Vol 123, Issue 21 Paul Wouters
Re: [IPsec] IPsec Digest, Vol 123, Issue 21 Les Leposo
Re: [IPsec] IPsec Digest, Vol 123, Issue 21 Tero Kivinen
Re: [IPsec] IPsec Digest, Vol 123, Issue 21 Tero Kivinen
Re: [IPsec] IPsec Digest, Vol 123, Issue 21 Les Leposo
Re: [IPsec] IPsec Digest, Vol 123, Issue 21 Yoav Nir
Re: [IPsec] IPsec Digest, Vol 123, Issue 21 Paul Wouters
Re: [IPsec] IPsec Digest, Vol 123, Issue 21 Paul Wouters
Re: [IPsec] IPsec Digest, Vol 123, Issue 21 Les Leposo
Re: [IPsec] IPsec Digest, Vol 123, Issue 21 Les Leposo
Re: [IPsec] IPsec Digest, Vol 123, Issue 21 Yoav Nir
Re: [IPsec] IPsec Digest, Vol 123, Issue 21 Les Leposo
Re: [IPsec] IPsec Digest, Vol 123, Issue 21 Tero Kivinen
Re: [IPsec] IPsec Digest, Vol 123, Issue 21 Les Leposo