[v6ops] Re: Traffic control protocols (PCP and UPnP IGD)

[Gert Doering <[e-mail]>]

Hi,

On Sat, Jul 27, 2024 at 04:56:44PM -0700, Ted Lemon wrote:
> Gert, this is /precisely/ what PCP is for: to tell the firewall which ports
> to allow through. My speaker doesn???t tell PCP to allow anyone on the
> outside to play music to my speakers because that wouldn???t make sense. My
> ssh server isn???t very useful if I can???t get to it from the outside. But
> only that one ssh server???there are other ssh servers on my network that
> would not make sense to expose.
> 
> This is what PCP enables: fine-grained control over ingress.

I totally understand the *idea* behind it.

Implementors of, say, "speakers" might not get that their device is not
supposed to be accessible by, say, their nice cloud service and still do
add PCP to their speakers.  Because someone thinks it's a good idea.

Which is exactly my point that you try to not see - PCP, as a protocol,
used for exactly those services that are a) intended to be reachable, and
b) securely so, is a nice tool.  PCP as a default action for "everything
that opens a listening socket" contradicts having a firewall by default.

I expect implementors to do "PCP as a default action for everything", 
because that's much easier than adding a config knob to let the informed
user do the right thing.

Also, of course, all software developers that add a listen socket will
assume that their software is the most important you run, will need to
be talked to, AND is totally secure.

Real life vs. protocol design.

Gert Doering
        -- NetMaster
-- 
have you enabled IPv6 on something today...?

SpaceNet AG                      Vorstand: Sebastian v. Bomhard, Ingo Lalla,
                                           Karin Schuler, Sebastian Cler
Joseph-Dollinger-Bogen 14        Aufsichtsratsvors.: A. Grundner-Culemann
D-80807 Muenchen                 HRB: 136055 (AG Muenchen)
Tel: [phone]         USt-IdNr.: DE813185279