Re: [tcpm] tcpsecure: how strong to recommend?

[Joe Touch <[e-mail]>]

Anantha Ramaiah (ananth) wrote:
>> Anantha Ramaiah (ananth) wrote:
>> ...
>>> If we have to fix multiple layers, lets fix it, I have no problems. 
>>> You can do all at once or piecemeal, as simple as that. It doesn't 
>>> matter whether spoofing is standalone or not, it is about 
>> how well you 
>>> can make your TCP stack respond to such malicious attacks, 
>> if you care to do so.
>>
>> TCP is not a secure protocol. It's not intended for 
>> protection from malicious attacks per se; 'fixing' it is to 
>> assert your solution on everyone, as below.
> 
> I see what you are saying except the "asserting your solution part". 
...
> Anyways, I don't want to side-track this discussion from it's original
> intent viz., "strength of mitigations"

OK, so let's get back to that. If you believe that it's appropriate to
let people decide what mitigations they want to deploy, then why isn't
tcpsecure a MAY?

I.e., you MAY deploy it if you want the mitigations.

There's no MUST in that logic, any more than 'you MUST deploy
IPsec/BTNS/TCP-MD5++'.

I think we're all agreeing that "let the user decide" is appropriate.
What we disagree upon appears to be what that implies.

Joe

_______________________________________________
tcpm mailing list
[e-mail]
https://www1.ietf.org/mailman/listinfo/tcpm