[saag] QUIC-ify everything?

[Phillip Hallam-Baker <[e-mail]>]

For the first time in decades, I have embarked on a bit of network
management, setting up my personal data center running a dozen containers
under Proxmox.

This is of course a fun adventure of personal discovery ('Oh the fun you
will have') and in particular, I am discovering that things I had naively
assumed were fixed 20 years ago remain unfixed.

I have just mounted a share from my internal NAS on the proxmox host and
can view the files on it from that host and at no point did I give an
account, password or any other form of authentication. Is the state of the
art really so lame? Am I seeing this because NFS can't do encrypted
communications and relies on IP address authentication or is it just that
my vendors are not supporting a competent version?

NFS is a protocol I have avoided like the plague since the 90s. A lot of
the early Web site graffiti attacks were through manipulation of NFS mount
points.


I am not worried about my particular deployment because the only thing I
have on that mount point is Jellyfin. But surely this is a hole that should
have been plugged long since?

All it would take to create secure NFS would be to run the RPC calls over
QUIC. I see a thread from 2020 proposing just that but nothing more since.
And the NFS issue is just a symptom, we need everything secured and no,
IPSEC is not an application layer security solution.

Back in the 90s when HTTP was just emerging Jeff Schiller went on a
campaign against cleartext passwords. If we are going to get robust
security as the default, we need everything to be going over secure
transport that is being authenticated against public key credentials end to
end. We started to do this with TLS but it is tied to TCP and much stuff
goes over DNS. So that means Quick-ify all our protocols.