Re: I-D.ietf-v6ops-cpe-simple-security-09

Brian E Carpenter <brian.e.carpenter@gmail.com> Sun, 21 March 2010 17:33 UTC

DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:organization:user-agent:mime-version:to:cc :subject:references:in-reply-to:content-type :content-transfer-encoding; b=Wetm5pI8oEabJoXdVBDDB0LlZKquundZVBFYJ3345o39+XY8GqhhvY6ePVQTW92QoF jcBq5lTNfcqvoZVLTIGU307XKAdEw8Lk34mW27QPzFCWbUMpP3kReSzxkT4jjlDKELfA Dj5QeoGyiHoqP3+Kk/AlppVNJjhJaPbf3LbvU=
Message-ID: <4BA6575D.7070300@gmail.com>
Date: Mon, 22 Mar 2010 06:29:01 +1300
From: Brian E Carpenter <brian.e.carpenter@gmail.com>
Organization: University of Auckland
User-Agent: Thunderbird 2.0.0.6 (Windows/20070728)
MIME-Version: 1.0
To: Gert Doering <gert@space.net>
CC: Mark Townsley <townsley@cisco.com>, james woodyatt <jhw@apple.com>, IPv6 Operations <v6ops@ops.ietf.org>
Subject: Re: I-D.ietf-v6ops-cpe-simple-security-09
References: <D6F5ACD2-EB43-477E-9F48-AC3EDB3F7EB4@apple.com> <4BA3BBCF.2090903@cisco.com> <4BA3D1B3.4010501@gmail.com> <4BA3DAAA.10000@cisco.com> <4BA40DD1.7080306@gmail.com> <6C168711-6A34-4487-9911-92766513183C@apple.com> <4BA522E8.7050504@cisco.com> <4BA56626.20606@gmail.com> <20100321133831.GL69383@Space.Net>
In-Reply-To: <20100321133831.GL69383@Space.Net>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
Sender: owner-v6ops@ops.ietf.org
Precedence: bulk

On 2010-03-22 02:38, Gert Doering wrote:
> Hi,
> 
> On Sun, Mar 21, 2010 at 01:19:50PM +1300, Brian E Carpenter wrote:
>> Indeed. But ISPs that supply CPE to their customers are going to
>> assume that their customers are running unpatched insecure operating
>> systems at high risk of catching malware. So I think they are just as
>> likely as enterprise IT departments to favour default deny approaches.
> 
> We're not.
> 
> We provide *Internet* services.  Not "walled garden" services.
> 
> If the customer wants firewall protection, we're happy to sell it to them,
> but the default package they get is "Internet".  Packets transported from
> A to B and vice versa, and we're not maing their packets unhappy unless they
> tell us so.

I applaud that and it's what I want from my ISP. My comment is that
I don't see this as a universal approach.

So, I'm wondering what's really wrong with:

  REC-41  Gateways MUST provide an easily selected configuration option
      that permits operation in a mode that forwards all unsolicited
      flows regardless of forwarding direction.

 - Brian

I-D.ietf-v6ops-cpe-simple-security-09 james woodyatt
Re: I-D.ietf-v6ops-cpe-simple-security-09 Mark Baugher
Re: I-D.ietf-v6ops-cpe-simple-security-09 james woodyatt
Re: I-D.ietf-v6ops-cpe-simple-security-09 Fred Baker
Re: I-D.ietf-v6ops-cpe-simple-security-09 Fred Baker
Re: I-D.ietf-v6ops-cpe-simple-security-09 james woodyatt
Re: I-D.ietf-v6ops-cpe-simple-security-09 Mark Baugher
Re: I-D.ietf-v6ops-cpe-simple-security-09 james woodyatt
Re: I-D.ietf-v6ops-cpe-simple-security-09 Mark Baugher
Re: I-D.ietf-v6ops-cpe-simple-security-09 Mark Baugher
Re: I-D.ietf-v6ops-cpe-simple-security-09 Ole Troan
Re: I-D.ietf-v6ops-cpe-simple-security-09 Mark Baugher
Re: I-D.ietf-v6ops-cpe-simple-security-09 Mark Baugher
RE: I-D.ietf-v6ops-cpe-simple-security-09 STARK, BARBARA H (ATTLABS)
Re: I-D.ietf-v6ops-cpe-simple-security-09 james woodyatt
Fwd: I-D.ietf-v6ops-cpe-simple-security-09 - ICMP… Rémi Després
Re: I-D.ietf-v6ops-cpe-simple-security-09 - ICMP … james woodyatt
Re: I-D.ietf-v6ops-cpe-simple-security-09 - ICMP … Rémi Després
Re: I-D.ietf-v6ops-cpe-simple-security-09 Brian E Carpenter
Re: I-D.ietf-v6ops-cpe-simple-security-09 Mark Smith
Re: I-D.ietf-v6ops-cpe-simple-security-09 Mark Townsley
Re: I-D.ietf-v6ops-cpe-simple-security-09 Brian E Carpenter
Re: I-D.ietf-v6ops-cpe-simple-security-09 Mark Townsley
Re: I-D.ietf-v6ops-cpe-simple-security-09 james woodyatt
Re: I-D.ietf-v6ops-cpe-simple-security-09 Brian E Carpenter
Re: I-D.ietf-v6ops-cpe-simple-security-09 james woodyatt
Re: I-D.ietf-v6ops-cpe-simple-security-09 Mark Townsley
Re: I-D.ietf-v6ops-cpe-simple-security-09 Mark Townsley
Re: I-D.ietf-v6ops-cpe-simple-security-09 Mark Townsley
Re: I-D.ietf-v6ops-cpe-simple-security-09 Fred Baker
Re: I-D.ietf-v6ops-cpe-simple-security-09 Fred Baker
Re: I-D.ietf-v6ops-cpe-simple-security-09 Mark Townsley
Re: I-D.ietf-v6ops-cpe-simple-security-09 Mark Townsley
Re: I-D.ietf-v6ops-cpe-simple-security-09 Fred Baker
Re: I-D.ietf-v6ops-cpe-simple-security-09 Shane Amante
Re: I-D.ietf-v6ops-cpe-simple-security-09 Mark Smith
Re: I-D.ietf-v6ops-cpe-simple-security-09 Cameron Byrne
Re: I-D.ietf-v6ops-cpe-simple-security-09 james woodyatt
Re: I-D.ietf-v6ops-cpe-simple-security-09 Mark Smith
Re: I-D.ietf-v6ops-cpe-simple-security-09 Gert Doering
Re: I-D.ietf-v6ops-cpe-simple-security-09 Mark Townsley
Re: I-D.ietf-v6ops-cpe-simple-security-09 Mark Townsley
Re: I-D.ietf-v6ops-cpe-simple-security-09 Brian E Carpenter
Re: I-D.ietf-v6ops-cpe-simple-security-09 Mark Townsley
Re: I-D.ietf-v6ops-cpe-simple-security-09 Mark Smith
Re: I-D.ietf-v6ops-cpe-simple-security-09 Mark Townsley
Re: I-D.ietf-v6ops-cpe-simple-security-09 james woodyatt
Re: I-D.ietf-v6ops-cpe-simple-security-09 Mark Townsley
Re: I-D.ietf-v6ops-cpe-simple-security-09 Mark Townsley
Re: I-D.ietf-v6ops-cpe-simple-security-09 Mark Townsley
Re: I-D.ietf-v6ops-cpe-simple-security-09 Brian E Carpenter
Re: I-D.ietf-v6ops-cpe-simple-security-09 james woodyatt
Status of RFC 4864 (was Re: I-D.ietf-v6ops-cpe-si… Mark Townsley
Re: I-D.ietf-v6ops-cpe-simple-security-09 Mark Townsley
Re: I-D.ietf-v6ops-cpe-simple-security-09 Mark Smith
Re: I-D.ietf-v6ops-cpe-simple-security-09 Mark Townsley
Re: I-D.ietf-v6ops-cpe-simple-security-09 Ole Troan
Re: I-D.ietf-v6ops-cpe-simple-security-09 Brian E Carpenter