Re: [Last-Call] Last Call: <draft-gont-numeric-ids-sec-considerations-06.txt> (Security Considerations for Transient Numeric Identifiers Employed in Network Protocols) to Best Current Practice

[Fernando Gont <[e-mail]>]

On 31/12/20 14:42, Paul Wouters wrote:
[....]
>> 3) What the "controversy" is all about?
> 
> That I'm a little confused about too. I don't follow Theo de Raadt's
> reasoning of the end of the world.

I believe he has been quite explicit.

The OpenBSD crew had to figure out (and fix!) flawed numeric IDs for 
many different protocols, on their own, because the protocol 
specifications that we (IETF) shipped were flawed in that respect. Doing 
so not only has taken them a lot of time and effort, but has also been 
non-trivial. This eventually had to be done independently by developers 
of different operating systems, and in same cases, choices made to fix 
the flaws led to interoperability issues.

So it's not hard to follow Theo when, given a very long history of 
flawed numeric IDs in our specs, when there's finally some effort to 
improve that, there's push-back from some folks on the basis of:

* Objecting things that are not part of our document (!)

* Arguing that since there's a spec coming that fails to follow our
   advice, the right thing to do is to shoot down the advice, rather than
   fixing the spec that has problems.

In your email, you claimed "It is [..] a really low bar that we should 
be already meeting at the IETF in general at this point."
Clearly, that bar has not been met, and is not being met. So this 
document tries to be as explicit as possible recommending protocol specs 
authors to meet that bar, and how to do it, such that we stop repeating 
the same mistakes over and over again.

Thanks,
-- 
Fernando Gont
SI6 Networks
e-mail: [e-mail]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492