Re: [Spud] SPUD's open/close are unconvincing

This thread seems to gone far afield. To the original question, I still
don't see clear value in SPUD open/close bits, but it is clear to me how
these can both turn into trivial DoS vectors. Specifically, as I see it
even now,
- An OPEN bit carries redundant information.
- An ACK to the OPEN is a thing apps are likely to do, and we can expect
this to be normal behavior. But we don't yet know why a middlebox may need
this information to be explicitly present on the wire, or what it may do
with it.
- A CLOSE bit is unreliable from the middlebox's point of view, since apps
may not send it, and unauthenticated CLOSE bits are DoS vectors.

If these bits are not authenticated, they are all trivially spoof-able, and
they will be exploited for various sorts of DoS attacks.

On Thu, Apr 9, 2015 at 1:36 PM, Yoav Nir <ynir.ietf@gmail.com> wrote:

>
> > On Apr 9, 2015, at 9:40 PM, Tom Herbert <tom@herbertland.com> wrote:
> >
> > On Thu, Apr 9, 2015 at 10:46 AM, Toerless Eckert <eckert@cisco.com>
> wrote:
> >> Glad you didn't ask how SPUD can solve world peace, because i am
> >> still researching that aspect.
> >>
> >> There is a lot of work going on wit security models of device
> deployment,
> >> you may want to look at 6LO, 6TISCH, ACE, DICE, ANIMA and there is a
> >> lot more outside the IETF. I would see that work as prerequisites
> >> to move forward.
> >>
> >> IN general, i think there is one good and sane device operations method,
> >> in IoT which is to NOT upgrade the OS after initial device deployment,
> >> but just upgrade/modify applications. And with SPUD, that means you
> >> now can upgrade/fix/improve transport layer.
> >>
> > Well, there's already over a billion smartphones in the world which
> > are already regularly updating their OS and this hasn't yet led to
> > mass anarchy. You can certainly make avoiding OS updates and avoiding
> > OS in general a design point for your products, but this is not a
> > relevant design point or requirement for a networking protocol. As I
> > said, it's a red herring wrt SPUD.
>
> There are also over a billion smartphones stuck in an old version of the
> OS. Android 2.6 is very popular as is the latest iOS version your phone
> supports (lots of iPhone 4 out there, and they’re not getting iOS 8).
>
> And don’t get me started on desktop operating systems. By NetApp’s numbers
> just under 17% of desktop and laptop systems are running Windows XP. The
> majority are running the already outdated Windows 7.
>
> And those phones and desktops are things people are always looking at.
> Lots of people do upgrade the OS on their phones and computers when given a
> choice. How many people are going to want to upgrade the OS on their
> refrigerator, car fuel-injection system, air conditioner, or industrial
> sensor? Those things are deep into “if it works - don’t fix it” territory.
>
> Yoav
> _______________________________________________
> Spud mailing list
> Spud@ietf.org
> https://www.ietf.org/mailman/listinfo/spud
>