Re: [v6ops] Hmm. Interesting article...

[Fernando Gont <[e-mail]>]

On 02/02/2016 02:44 PM, Owen DeLong wrote:
> 
>> On Feb 2, 2016, at 06:33 , Fernando Gont <[e-mail]> wrote:
>>
>> On 02/02/2016 10:20 AM, Owen DeLong wrote:
>>>
>>>> On Feb 1, 2016, at 23:56, Fernando Gont <[e-mail]> wrote:
>>>>
>>>>> On 02/01/2016 07:25 PM, Owen DeLong wrote:
>>>>> [...]
>>>>>
>>>>> The thing that strikes me most about this is that a host which has an
>>>>> adequate stateful inspection firewall in front of it realy has no more issue
>>>>> from it’s IPv6 address being harvested than it does from its IPv4
>>>>> address being harvested, so I’m not seeing how this is news or how it really
>>>>> represents any sort of inherent vulnerability.
>>>>>
>>>>> Perhaps someone can enlighten me as to how this is some new security
>>>>> issue we should be concerned about, but for now, it appears to me as if
>>>>> it is much ado about nothing.
>>>>
>>>> Maybe in that in IPv4 you typically have a NAT in front of your node,
>>>> where in IPv6 you don't necessarily have a fw?
>>>>
>>>
>>> If you're running a host without any sort of filter, that's really not a problem we should be solving at the network level. That's more of an educational problem.
>>
>> There's a reason for deploying network-based firewalls:
>> <https://tools.ietf.org/html/draft-gont-opsawg-firewalls-analysis-01>
> 
> A network-based firewall is one form of filter. I’m not sure why you think my statement was antithetical to that.

I took your statement as implying that a host should run its own filters.

Looks like it was a misunderstanding on my side -- my apologies.

Thanks,

-- 
Fernando Gont
SI6 Networks
e-mail: [e-mail]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492