Re: [v6ops] draft-ietf-v6ops-balanced-ipv6-security WGLC

[Mikael Abrahamsson <[e-mail]>]

On Mon, 18 Nov 2013, Marc Lampo wrote:

> I acknowledge other contributions in this list stating that any device 
> can end up with infected/hostile neighbors in the local network, but is 
> this a reason/excuse to have a "mostly open policy for incoming traffic" 
> ?

It all comes down to "better safe than sorry" as opposed to "make things 
work without operator invention".

Do you want devices to be part of the Internet as default or not is the 
major philosophical question. Should devices have a one-way peep-hole to 
the Internet by default or should they be open and be reachable from the 
Internet by default. Gated community and don't care about locking your 
door because you trust the neighborhood, or open community and take care 
of your own security.

There is no right answer here, but I am in favour of the open variant and 
let hosts take care of their own security.

Most devices today are hardened enough to handle being exposed to the 
Internet, is my opinion. From your reasoning I guess you do not agree.

My background is that I worked for 7 years for a mobile operator that 
didn't have any filters apart from outgoing port 25 and a few other things 
(very similar to balanced security proposal). Even less for residential 
access. No bad effects from this even with millions of customers.

So I think it's up to the people who want to put filters in CPEs by 
default to prove that applications work well with this, and give advice to 
application implementers what they need to do in order to make things 
work. Do they need to do STUN-like functionality always, even though there 
is no NAT, just to make sure the stateful filtering device actually sees 
this as a wanted session?

-- 
Mikael Abrahamsson    email: [e-mail]