Re: [tcpm] AD Review: draft-ietf-tcpm-icmp-attacks-09

[Fernando Gont <[e-mail]>]

Eddy, Wesley M. (GRC-MS00)[ASRC AEROSPACE CORP] wrote:

> I would appreciate less posturing about representing vendors
> and maintaining relevancy to them, and more focus on what
> potential action we can take to resolve the DISCUSSes.

FWIW, I'm not claiming to represent vendors. However, I do chat with
vendors from different fronts very often, and there is a general
agreement on each of the issues I mentioned (specifications being
outdated, the impossibility to produce a real-world TCP implementation
from the IETF specs, the unnecessarily huge amount of energy that is
spent on non-real issues, etc.).

At this point in time, I just want to get this document published. But
the points I have raised are very general issues that affect not only
this I-D, but many other I-Ds that this WG is working on.



> I think one way to proceed is, for instance, to reword:
> """
>    Section 7.3 shows the proposed counter-measure in action.
>    Section 7.4 shows the proposed counter-measure in pseudo-code.
> 
>    This behavior has been implemented in NetBSD [NetBSD] and OpenBSD
>    [OpenBSD] since 2005.
> """
> into:
> """
>   Sections 7.3 and 7.4 show the behavior and psuedocode for the
>   mitigation implemented in NetBSD and OpenBSD.
> """
> and do a find-replace of the word "proposed" as appropriate in the
> rest of the section in order to convey what we really mean: that
> this is what's being done, not what TCPM necessarily says people
> need to do.

Will do.



>>> I'd be interested to hear the WG's thoughts esp. on this issue, but
>>> of course also on the rest of my comments below.
>> Are we kinda going back to WGLC?
> 
> I think Lars is just asking to quickly confirm consensus in this area
> and make sure the exact text represents that consensus.

I have not problem with that, but... isn't this what the WGLC is for?



>> That said, why it's not a formal IETF recommendation... that's a very
>> good question, that not only me, but also vendors would like to know the
>> answer.
> 
> They are very much welcome to approach with a proposal to
> standardize it ... however, they haven't so the topic is moot.
> None of us need to try to channel them and speak for them here;
> the list is open, and last I checked, there were hundreds of
> addresses of the form "vendor.com" subscribed.

This has been discussed in other threads and posts, so... in the hope of
keeping a good signal/noise ratio, I will not respond. :-)

Thanks,
-- 
Fernando Gont
e-mail: [e-mail] || [e-mail]
PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1