Re: I-D.ietf-v6ops-cpe-simple-security-09

[Mark Townsley <[e-mail]>]

On 3/21/10 6:29 PM, Brian E Carpenter wrote:
> On 2010-03-22 02:38, Gert Doering wrote:
>    
>> Hi,
>>
>> On Sun, Mar 21, 2010 at 01:19:50PM +1300, Brian E Carpenter wrote:
>>      
>>> Indeed. But ISPs that supply CPE to their customers are going to
>>> assume that their customers are running unpatched insecure operating
>>> systems at high risk of catching malware. So I think they are just as
>>> likely as enterprise IT departments to favour default deny approaches.
>>>        
>> We're not.
>>
>> We provide *Internet* services.  Not "walled garden" services.
>>
>> If the customer wants firewall protection, we're happy to sell it to them,
>> but the default package they get is "Internet".  Packets transported from
>> A to B and vice versa, and we're not maing their packets unhappy unless they
>> tell us so.
>>      
> I applaud that and it's what I want from my ISP. My comment is that
> I don't see this as a universal approach.
>
> So, I'm wondering what's really wrong with:
>
>    REC-41  Gateways MUST provide an easily selected configuration option
>        that permits operation in a mode that forwards all unsolicited
>        flows regardless of forwarding direction.
>    
The problem is the default, which is not to permit this.

- Mark
>   - Brian
>
>