RE: [tcpm] tcpsecure: how strong to recommend?

["Anantha Ramaiah \(ananth\)" <[e-mail]>]

> 
> 
> Hat off ... 
> 
> This is a lot of hang wringing mumbo-jumbo, I think.  It 
> seems to me ...
> 
>   + If a standards track document says "a TCP SHOULD do X" then as a
>     particular TCP evolves it really ought to do X unless the
>     implementers have a very good reason not to do X.

Since, all these discussions about started due to TCP secure, let me use
the same as an example. There is nothing wrong in making all mitigations
SHOULD since the "very good reason" can be one of :-

- I don't care about security/robustness of TCP connections and hence my
products don't need to implement these.
- well I do care about security but I always use additional protection
like MD5 or IPsec and hence implementing this is optional. I'll think
about it.
- I like the mitigations in the draft and I see them lightweight and
I'll go ahead and implement them, but since these are tagged SHOULD I
may have a knob to control this behaviour.
- I definetely would want to implement these. Even though it is a
SHOULD, to me it is like a MUST.

So what I am tryng to say is: it is upto the implementers to interpret
and implement it if they wish to do so. Saying SHOULD is not an issue
since it gives enough leeway for all of the above scenarios.

But I am open to the idea of adding a generic applicability statement
like : "these mitigations are useful in blah blah... Conditions etc., "
Already if I remember correctly we do have some text to that effect in
the draft, but we can polish it further or formalize it.

-Anantha

_______________________________________________
tcpm mailing list
[e-mail]
https://www1.ietf.org/mailman/listinfo/tcpm