Re: [v6ops] draft-ietf-v6ops-balanced-ipv6-security WGLC

[Lorenzo Colitti <[e-mail]>]

On Mon, Nov 18, 2013 at 2:25 AM, Ray Hunter <[e-mail]> wrote:

> Summary: I don't have answers to my own points below, but neither does
> this draft, so whilst I welcome the authors sharing their experiences, I
> can't support publishing it as-is as a v6ops WG document.
>
> The bottom line is that I wouldn't be happy if my own ISP adopted the
> policy exactly as-documented in the draft.
>

Would you be happier if your ISP implemented the "simple security"
recommendations in RFC 6092 and dropped all unsolicited packets to your
network except IPsec?

I think we probably need something more sophisticated. And being
> realistic, we're probably not yet ready to write it.
>

So let's not throw out the baby with the bathwater then? This group exists
to share operational experience, and that is what this draft does. It does
not make any recommendations; even the rules it presents are examples. I
can't see anyone construing this as a recommendation or endorsement of any
sort.

We published RFC 6092. Why shouldn't we publish this one? It seems to me
that there's no real difference between this document and RFC 6092;
fundamentally, they both simply describe a security profile without making
any claim about whether it is a recommended profile. If anything, at least
this one has the advantage that it was deployed before it was
standardized...

I support this document.