Re: [pntaw] New version of draft-hutton-rtcweb-nat-firewall-considerations

[Melinda Shore <[e-mail]>]

On 9/22/13 11:01 PM, Oleg Moskalenko wrote:
>     My comfort level with telling people who run networks
>     that their network access management policies and technologies
>     are behind the times and because we know better then they
>     do about these things it's fine if we punch holes in their
>     firewalls without asking is not very high, to be honest.
> This is all not about comfort.

There is not much value in standardizing technologies which
are not going to be deployed, nor is there value in telling
the people who run networks that they're morons and the IETF
knows better than they do how they should be managing their
access policies.

>     At any rate I do think it's worth understanding (yes, I
>     used the "u" word) that you're using technologies that were
>     intended to address NAT problems for firewall traversal
>     and that there are some security issues that need closer
>     scrutiny, particularly the specifics of how you protect
>     against abuse by attackers.
> I do not think that anybody would be arguing with this rather obvious
> observation.

It's hard to tell.  One thing that can help a lot is to
actually write the security considerations section of your
documents, rather than filling it in with a "TBD."  Seems to
be a common problem with rtcweb documents, and not at all
reassuring.

Melinda