Re: [Ntp] NTS IANA request

[Daniel Franke <[e-mail]>]

On Fri, Jun 7, 2019 at 4:08 PM Majdi S. Abbas <[e-mail]> wrote:
>         I'm not sure where this came from, but it hasn't been my
> experience.  In fact even the folks who came in with pretty heavy
> handed filters a few years ago, have backed off quite a bit as users
> have corrected their configurations.

It's been ours. We've encountered such filtering issues in all three
NTS hackathons. At any rate, as Watson said, data is coming. We should
rely on that rather than anecdotes.

>         I don't believe there's much of a firewall issue at all,
> since I haven't seen a blanket "lt 1024" permit in.... years.  Either
> specific services are permitted, or application level proxies are
> employed... but nobody magically "trusts" system ports any more, and
> has not in a very long time.

This isn't an issue of system ports (< 1024) vs. user ports, it's an
issue of a single IANA-registered port vs. everyone who runs a server
being told to choose their own (and advertise it via NTS-KE port
negotiation). In the latter case it becomes both harder to block if
you have a default-allow policy like an ISP would, and harder to allow
if you have a default-deny policy like a corporate firewall would.