Re: [Pppext] Future of the PPP WG

[Vernon Schryver <[e-mail]>]

> From: Glen Zorn <[e-mail]>

> > http://www.freesound.org/people/Jlew/sounds/16475/
>
> Well, this is all good fun, in a US/Euro-centric kind of way, but it
> would be good to remember that in a very large part of the world our
> "theme song" is a still a vital part of the Internet & is likely to
> remain so for a considerable period of time.  This email will make the
> first hop of its journey over (the much maligned) PPPoE, for example;
> not everybody lives in advanced countries such as S. Korea (the
> connectivity of which should make both the French and Americans hang
> their heads in shame).  In short, PPP is far from obsolete.

I don't think the thrust of that claim is entirely accurate.  Do people
outside advanced countries use dialup modems or wireless?  Have you
noticed the lack of modems and serial ports on modern portable computers?
That you can still buy a USB modem doesn't make PPP less obsolete than
floppy disks.  Last month I bought a USB modem so that I can dial with
my new portable, but that is mostly sign of my failure to move with
the times.  The salesman wasn't clear about what I wanted, and I didn't
find a lot of choices.  Somewhere I also have a USB floppy drive.

How would reissuing PPP RFCs with new security boilerplate help
anyone except the authors of the new RFCs?  What would people working
on PPP code do differently if the PPP RFCs had modern security
sections?  How many people are working on implementations of PPPoE
or any other flavor of PPP code?

If moving the never deployed PPP RFCs to Historic and reissuing the
rest with new security sections were all that would happen, it would
be only a dubious effort.  But there would be irresistible pressures
to to fix CHAP, MP, and even IPCP.  The replacements, delivered after
years of wrangling (and no implementations), would be as ill considered
as PAP, PPPoE, and the recently proposed IS-IS security fix.  If against
all likelihood they were eventually deployed, they'd be discovered to
be as insecure as many of the wireless security schemes and cause
interoperabilty problems as the PPPoE MTU still does.

The primary defense against those "improvements" would the fact
that no one (especially not the new RFC authors) would implement
them and fewer would deploy them.

Once upon a time, the IETF produced protocols to fill clear and
present user needs and demands.  Ostensibly fixing PPP with new
security words is the sort of idle hands standards committee
exercise that destroyed the ISO OSI protocol suite.


Vernon Schryver    [e-mail]