Re: [v6ops] [EXTERNAL] Re: [IPv6] [OPSEC] Why folks are blocking IPv6 extension headers? (Episode 1000 and counting) (Linux DoS)

[Tom Herbert <[e-mail]>]

On Wed, May 24, 2023 at 6:02 PM Manfredi (US), Albert E
<[e-mail]> wrote:
>
> -----Original Message-----
> From: ipv6 <[e-mail]> On Behalf Of Fernando Gont
>
> > Given the amount of things that get connected to the Net (smart bulbs, refrigerators, etc.) -- and that will super-likely never receive security updates, you may have to **rely on your own network**.
> >
> > For instance, I wouldn't have my smart TV "defend itself".
>
> Agreed, "on your own network." From the viewpoint of a household, whatever network defense has to be behind that household's router, for it to be credible, and preferably right in each host. Yeah, some IoT devices may not be updated regularly.

Bert,

It's more than a preference to have host security, it is an absolute
requirement that each host provides security for its applications and
users. This requirement applies to SmartTVs, SmartPhones, home
computers, and pretty much all the several billion end user devices
connected to the Internet. No host device would ever assume that the
network consistently provides any adequate level of security, for real
security we need to assume that the host is the first and last line of
defense (i.e. zero trust model).

Tom


>
> The ISP has to worry about protecting that ISP's own network. Households have to be responsible for protecting their household's network. (And connected TVs do get regular software updates, as a matter of fact.)
>
> No one would trust their online banking transactions on an ISP's network protections, for example.
>
> Bert
>
> _______________________________________________
> v6ops mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/v6ops