On SEND deployment (Re: Conclusion: 6MAN Adoption call on draft-rafiee-6man-ssas-07)

[Fernando Gont <[e-mail]>]

Hi, Ole,

[This is orthogonal to the consensus call from my pov, but felt like
dropping a note]

On 01/15/2014 05:03 AM, Ole Troan wrote:
> We do not believe the working group understands why SEND is not
> deployed.

My two cents:

* Use of trust anchors makes deployment painful for the general case.

* Most popular OSes do not have a real SEND implementation (not long
ago the only way to play on BSDs was a Java implementation?). When it
comes to open source ones, the fact that SEND is IPR'ed doesn't help
the situation.

* While other parts of the "system" are largely unsecured, SeND
probably does not much. (e.g, if a local attacker can spoof a DNS
response, securing the layer-2/3 mapping will not buy much in most
cases -- i.e., just spoof the DNS response, and you're done).

* SEND wasn't there for v4. And there's a tendency to try to employ
IPv6 as IPv4, focusing on the benefit of the larger address space
(i.e., for some, "I lived with this in v4 for 20+ years, so..."). Not
that I necessarily endorse this view, but just meant to spell it out.

Thanks,
-- 
Fernando Gont
e-mail: [e-mail] || [e-mail]
PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1