IETF Logo Mail Archive

Re: [v6ops] draft-ietf-v6ops-balanced-ipv6-security WGLC

Mikael Abrahamsson <swmike@swm.pp.se> Thu, 14 November 2013 05:42 UTC

Return-Path: <swmike@swm.pp.se>
X-Original-To: v6ops@ietfa.amsl.com
Delivered-To: v6ops@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 155A521E81B0 for <v6ops@ietfa.amsl.com>; Wed, 13 Nov 2013 21:42:23 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.567
X-Spam-Level:
X-Spam-Status: No, score=-2.567 tagged_above=-999 required=5 tests=[AWL=0.032, BAYES_00=-2.599]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id atS6nafMszUs for <v6ops@ietfa.amsl.com>; Wed, 13 Nov 2013 21:42:22 -0800 (PST)
Received: from uplift.swm.pp.se (ipv6.swm.pp.se [IPv6:2a00:801::f]) by ietfa.amsl.com (Postfix) with ESMTP id 7A1EB21E812F for <v6ops@ietf.org>; Wed, 13 Nov 2013 21:42:22 -0800 (PST)
Received: by uplift.swm.pp.se (Postfix, from userid 501) id C2AB79C; Thu, 14 Nov 2013 06:42:19 +0100 (CET)
Received: from localhost (localhost [127.0.0.1]) by uplift.swm.pp.se (Postfix) with ESMTP id BC7B29A; Thu, 14 Nov 2013 06:42:19 +0100 (CET)
Date: Thu, 14 Nov 2013 06:42:19 +0100
From: Mikael Abrahamsson <swmike@swm.pp.se>
To: Marc Lampo <marc.lampo.ietf@gmail.com>
In-Reply-To: <CAB0C4xOd-ryBXe4O3XoLTLDw-XuOV==X0nkRg5y3aPXCtf+Gow@mail.gmail.com>
Message-ID: <alpine.DEB.2.02.1311140639140.5805@uplift.swm.pp.se>
References: <201311101900.rAAJ0AR6025350@irp-view13.cisco.com> <CAB0C4xOfz_JAjEEJZ-Zz7MBEyZhVzrAE+8Ghf1ggC3+9pyHmNg@mail.gmail.com> <989B8ED6-273E-45D4-BFD8-66A1793A1C9F@cisco.com> <alpine.DEB.2.02.1311130329180.26054@uplift.swm.pp.se> <CAB0C4xOd-ryBXe4O3XoLTLDw-XuOV==X0nkRg5y3aPXCtf+Gow@mail.gmail.com>
User-Agent: Alpine 2.02 (DEB 1266 2009-07-14)
Organization: People's Front Against WWW
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset="US-ASCII"; format="flowed"
Cc: "v6ops@ietf.org WG" <v6ops@ietf.org>
Subject: Re: [v6ops] draft-ietf-v6ops-balanced-ipv6-security WGLC
X-BeenThere: v6ops@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: v6ops discussion list <v6ops.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/v6ops>, <mailto:v6ops-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/v6ops>
List-Post: <mailto:v6ops@ietf.org>
List-Help: <mailto:v6ops-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/v6ops>, <mailto:v6ops-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 14 Nov 2013 05:42:23 -0000

On Wed, 13 Nov 2013, Marc Lampo wrote:

> Hence, in my opinion, the security (and privacy) of IPv6 users is best 
> served by keeping unsolicited traffic out.

You and me have a very different opinion what unsolicited is. If the host 
accepts connections on a port, then it has by definition accepted to 
handle the connection. There is no reason access control can't be handled 
on the host.

I would rather see a mechanism that the host can use to say "please 
protect me, I'm helpless" and then the gateways will filter traffic to the 
device (ie if the host says nothing then default policy is open) than what 
you're proposing which is "default close".

-- 
Mikael Abrahamsson    email: swmike@swm.pp.se

v2.23.0 | Report a Bug | By Email