Re: [tsvwg] Dual-Q Pol[i]cing

[Paul Vixie <[e-mail]>]

On Monday, 25 May 2020 10:00:30 UTC Sebastian Moeller wrote:
> Hi Gory,

i'm not gory, but you asked a (thetorical) question of "everybody".

> ... Is everybody else convinced that L4S offers a sufficiently
> safe design and was tested with the to be expected level of adversarial
> traffic patterns to confirm the design's safety in the real-world?

so, no, i am not convinced, but that doesn't matter. what matters is that if 
there is an input signal marked on a flow, datagram, packet, or segment which 
would cause my routing or switching equipment to behave differently, such as 
choosing one of two "dual queues", then i will likely never enable it, and if 
i do enable it i will bleach that mark out of inbound traffic from the WAN.

networks i operate, that would operate under that constraint, have included 
home, office, enterprise, and backbone. due to principle of least privilege, 
and not because of any known or suspected flaws in L4S per se. this is not 
different from filtering some kinds of ICMP and rate limiting other kinds. all 
policy is local, and possession is 90% of the law when it comes to ownership.

o.t.:

if my supply chain offers me something i can use, i may use it. but that use 
may not be the L4S (or SCE) system, i may favour some custom logic which makes 
novel use of the supply chain's new capabilities. so while all L4S (or SCE) 
may depend on some new network input signal, not all uses of that signal will 
be by L4S (or SCE). thus my focus on possible off-label uses of new signalling 
and my estimates of maximum risks and maximum benefits and to whom and with 
what kind of symmetry.

-- 
Paul