Re: you have running code ... I-D Action: draft-ietf-6man-ipv6only-flag-03.txt

[Brian E Carpenter <[e-mail]>]

On 2018-11-06 00:15, Nick Hilliard wrote:
> Brian E Carpenter wrote on 05/11/2018 07:38:
>> And yes, a host MAY ignore it (that's the complement to the SHOULD
>> in the draft). We've never said anything else.
> 
> yes, but you have stated "On an IPv6-Only link, IPv4 might be used for 
> malicious purposes and pass unnoticed by IPv6-Only monitoring mechanisms".
> 
> If you want ipv6only-flag to be advisory, then you need to remove this 
> bullet-point from the document because the presence or absence of an RA 
> with ipv6only-flag set will not have any effect on malicious use of ipv4 
> on an otherwise "ipv6-only" network.

Yes, you're correct. There is a slight mitigation effect - hosts that *do*
use the flag to shut down IPv4 operations will not see any malicious IPv4
traffic.

Some rewording is needed.

> You cannot use security to justify something unless the proposal 
> provides a mechanism for enforcement; if you have no means of 
> enforcement, it's fluff, not security.
> 
> Nick

Thanks
   Brian