Re: [v6ops] draft-ietf-v6ops-balanced-ipv6-security WGLC

[Ray Hunter <[e-mail]>]

> Lorenzo Colitti <mailto:[e-mail]>
> 20 November 2013 07:50
> On Mon, Nov 18, 2013 at 2:25 AM, Ray Hunter <[e-mail]> wrote:
>
>> Summary: I don't have answers to my own points below, but neither does
>> this draft, so whilst I welcome the authors sharing their experiences, I
>> can't support publishing it as-is as a v6ops WG document.
>>
>> The bottom line is that I wouldn't be happy if my own ISP adopted the
>> policy exactly as-documented in the draft.
>>
>
> Would you be happier if your ISP implemented the "simple security"
> recommendations in RFC 6092 and dropped all unsolicited packets to your
> network except IPsec?

Yes.

Provided the ISP gave me the ability to override that default setting
(either via a web site, PCP, UPnP, or some other mechanism)

At least I'd know for certain what ISP settings I needed to override.

They could even ask me to sign in blood in advance that all risks to my
equipment were my risk.

Whereas with this draft, we're going to have to merge two
vaguely-defined and time-variant security policies (my policy and the
ISP's policy).
If I open port 25 and the ISP closes it, which setting takes precedence?
And if the order that the requests arrive is different?
>
> I think we probably need something more sophisticated. And being
>> realistic, we're probably not yet ready to write it.
>>
>
> So let's not throw out the baby with the bathwater then? This group exists
> to share operational experience, and that is what this draft does. It does
> not make any recommendations; even the rules it presents are examples. I
> can't see anyone construing this as a recommendation or endorsement of any
> sort.
>
> We published RFC 6092. Why shouldn't we publish this one? It seems to me
> that there's no real difference between this document and RFC 6092;
> fundamentally, they both simply describe a security profile without making
> any claim about whether it is a recommended profile. If anything, at least
> this one has the advantage that it was deployed before it was
> standardized...
>
> I support this document.
>
>
> ------------------------------------------------------------------------


-- 
Regards,
RayH