Re: [OPSEC] Call for adoption of draft-gont-opsec-ip-options-filtering

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi Warren.

I have also read Fernando's draft and do see the value and benefit of
proposing a more granular approach to IP options filtering.  Many
times, the only mitigation for a particular attack or issue is to drop
all optioned packets, which depending on configuration and topology
can do more harm than good.  BCP'ing a more finely granular approach
is not without merit.

Should we adopt this draft, I do agree with previous comments that
perhaps more fine-tuning of recommended options, tradeoffs and caveats
is warranted, but that discussion can continue within the WG.

I support the adoption of this draft as an OPSEC working group document.

- ---
Dave Dugal
Sr. Product Security Incident Wrangler

On 5/31/2012 9:42 AM, Warren Kumari <warren@kumari.net> proclaimed ...
> Dear Working Group,
> 
> We are now halfway through the call for adoption on this draft --
> please take a moment to read and comment on if you support the
> adoption of this draft…
> 
> W On May 24, 2012, at 11:58 AM, Warren Kumari wrote:
> 
>> Dear Working Group,
>> 
>> This is to start a two week poll to adopt 
>> draft-gont-opsec-ip-options-filtering ( helpful link:
>> http://tools.ietf.org/html/draft-gont-opsec-ip-options-filtering-04)
>>
>> 
as an OpSec Working Group draft.
>> 
>> Please send your comments to the OpSec list (opsec@ietf.org).
>> 
>> This adoption call closes on June 7th, 2012.
>> 
>> (This document was discussed in the Paris meeting, and not enough
>> people had read the document to be able to predict consensus.
>> Please take a moment (or 5) to read and comment. I should mention
>> that Memorial Day is coming up in the US soon -- there is nothing
>> quite so enjoyable as reading drafts on the beach -- try it!)
>> 
>> W
>> 
>> -- With Feudalism, it's your Count that votes.
>> 
>> 
>> _______________________________________________ OPSEC mailing
>> list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec
>> 
> 
> _______________________________________________ OPSEC mailing list 
> OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec
> 
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (MingW32)

iEYEARECAAYFAk/HwMIACgkQh59lzatuAqXiuwCgtXDacC7wSx0gtdfC41JRXcJN
03MAoPf9m5FVlWOrHlOJzsPrRI117UqR
=lEqG
-----END PGP SIGNATURE-----