Re: [tcpm] Feedback request on draft-ietf-tcpm-tcp-security

[Fernando Gont <[e-mail]>]

Lars Eggert wrote:

>> Do you really not want to realize that so many folks do not
>> contribute any more to TCPM because work in this WG is continually
>> obstructed?
> 
> Please back this statement up. Who are the "many folks" who have
> stopped to contribute because the WG is "obstructed"?

Some of them have made statements on the mailing-list. See, e.g., this
note by OpenBSD's Theo de Raadt, circa 2005
(http://www.ietf.org/mail-archive/web/tcpm/current/msg01233.html)

>> And maybe by the time we get anywhere, no one will care about the resulting 
>> document, because they will have already solved them (with a "draft", 
>> unfortunately): people want their problems to be solved. They don't care 
>> about labelling their products with "RFC-compliance".
> 
> OpenBSD's tcp-ip stack is not RFC compliant.
> 
> And we are very proud that it is not RFC compliant.
> 
> Beause if it was RFC compliant it would be so vulnerable to so many
> well known attacks.
> 
> IETF is so misguided these days.  Attempts at quality have been thrown
> out the window, and a couple of old farts (mostly with corporate ties)
> run the show to the detriment of a society which needs this stuff to
> work as well as possible.
> 
> Joe, it is people like you keeping TCP broken.


And this other e-mail by Theo de Raadt
(http://www.ietf.org/mail-archive/web/tcpm/current/msg01232.html)

>> For the connection-reset attack, the proposed attack-specific fix is to 
>> treat hard errors as soft errors.
>> BTW, TCP SHOULD (*not* "MUST") abort the connections.
> 
> This is just so ridicilous.
> 
> Any network stack that follows your advice is busted.
> 
> Why do you persist in being so behind the times?


P.S: This last statement by Theo was a response to Joe Touch in one of
the endless threads about the ICMP attacks draft.

Thanks,
-- 
Fernando Gont
e-mail: [e-mail] || [e-mail]
PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1