Re: [OPSEC] Request for opions on accepting draft-gont-opsec-ip-security-01 as a working group document (fwd)

Hi all,

It's my first activity on OPSEC, and I was a tad late to react - so 
initially sent unicast, but forwarding to the list now nonetheless FYI.

thanks,
andrew

---------- Forwarded message ----------
Date: Wed, 14 Jan 2009 19:54:34 +0100 (CET)
From: Andrew Yourtchenko <ayourtch@cisco.com>
To: Joel Jaeggli <joelja@bogus.com>
Cc: Fernando Gont <fernando@gont.com.ar>
Subject: Re: [OPSEC] Request for opions on accepting
     draft-gont-opsec-ip-security-01 as a working group document

Hello Joel,

I've been only reading the mails on the WG up till now, so, given my very late 
reaction - not sure if it is still OK to send the opinion now - unicasting..

In my opinion this work is definitely something that should be adopted by the 
WG for further review and discussion.

To illustrate - one point, which rose upon a quick scan of the document:

With my security hat on, the trivially incrementing IP ID is obviously a Bad 
Thing(tm).

With my digger-debugger hat on, the trivially incrementing IP ID within the 
session more than once allowed to spot a misbehaving middlebox unknown to be 
there and save some real pain to real customers.
>From this operational perspective, the incrementing ID is a good property 
because it provides an ephemeral "identity" to the endpoint besides the easily 
spoofable IP address - hence allows to detect the latter.

So I think there might be more than just black and white, and it might be 
useful to discuss.

If the document gets adopted, I volunteer to review it in more detail.

thanks,
andrew

On Thu, 1 Jan 2009, Joel Jaeggli wrote:

>  I trust everyone had a eventful new year and I hope that for the sake of
>  our industry the next six months doesn't look worse than the previous
>  six months.
>
>  Working from the the action items it's time to test consensus on accepting;
>
>  draft-gont-opsec-ip-security-01
>
>  http://tools.ietf.org/html/draft-gont-opsec-ip-security-01
>
>  as a working group document.
>
>  Commentary will be accepted through Friday January 9th.
>
>  Thanks
>  Joel
>  _______________________________________________
>  OPSEC mailing list
>  OPSEC@ietf.org
>  https://www.ietf.org/mailman/listinfo/opsec
>
_______________________________________________
OPSEC mailing list
OPSEC@ietf.org
https://www.ietf.org/mailman/listinfo/opsec