IETF Logo Mail Archive

Re: [IPsec] Warren Kumari's Discuss on draft-ietf-ipsecme-split-dns-14: (with DISCUSS and COMMENT)

"D. Hugh Redelmeier" <hugh@mimosa.com> Wed, 21 November 2018 16:40 UTC

Return-Path: <hugh@mimosa.com>
X-Original-To: ipsec@ietfa.amsl.com
Delivered-To: ipsec@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D3467128AFB; Wed, 21 Nov 2018 08:40:45 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: 0
X-Spam-Level:
X-Spam-Status: No, score=0 tagged_above=-999 required=5 tests=[none] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SyAXe-v15oSQ; Wed, 21 Nov 2018 08:40:44 -0800 (PST)
Received: from gw-v.mimosa.com (gw-v.mimosa.com [98.158.128.23]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AC43A130DFA; Wed, 21 Nov 2018 08:40:43 -0800 (PST)
Received: from redeye.mimosa.com (redeye.mimosa.com [192.139.70.93]) by gw-v.mimosa.com (Postfix) with ESMTPS id DD2B4160153; Wed, 21 Nov 2018 11:40:42 -0500 (EST)
Date: Wed, 21 Nov 2018 11:40:42 -0500
From: "D. Hugh Redelmeier" <hugh@mimosa.com>
Reply-To: "D. Hugh Redelmeier" <hugh@mimosa.com>
To: ipsec@ietf.org, The IESG <iesg@ietf.org>
In-Reply-To: <25704.1542816043@localhost>
Message-ID: <alpine.LFD.2.21.1811211125050.8764@redeye.mimosa.com>
References: <154275299932.29937.5149382512933072864.idtracker@ietfa.amsl.com> <25704.1542816043@localhost>
User-Agent: Alpine 2.21 (LFD 202 2017-01-01)
MIME-Version: 1.0
Content-Type: text/plain; charset="US-ASCII"
Archived-At: <https://mailarchive.ietf.org/arch/msg/ipsec/kzjQ7xz1XsEuGuWynWoCd7m-FBw>
Subject: Re: [IPsec] Warren Kumari's Discuss on draft-ietf-ipsecme-split-dns-14: (with DISCUSS and COMMENT)
X-BeenThere: ipsec@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Discussion of IPsec protocols <ipsec.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ipsec>, <mailto:ipsec-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ipsec/>
List-Post: <mailto:ipsec@ietf.org>
List-Help: <mailto:ipsec-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ipsec>, <mailto:ipsec-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 21 Nov 2018 16:40:46 -0000

| From: Michael Richardson <mcr+ietf@sandelman.ca>

| In almost all cases the VPN provider is in control of the software that is
| installed on the client system, so they can hijack paypal already.

VPN providers should not provide software to their clients.  That's a
bug and should not be encouraged by the committee.

The point of a standard is that any IPSec implementation should be
able to connect with any other IPsec implementation.  The default
provider of VPN software ought to be the provider of the OS for the
client's machine.  The client should be able to choose any conformant 
implementation.  I admit that we have failed to make interop easy
and normal, but that's where we should be heading.

v2.23.0 | Report a Bug | By Email