Re: [v6ops] Hmm. Interesting article...

[Owen DeLong <[e-mail]>]

> On Feb 2, 2016, at 06:33 , Fernando Gont <[e-mail]> wrote:
> 
> On 02/02/2016 10:20 AM, Owen DeLong wrote:
>> 
>>> On Feb 1, 2016, at 23:56, Fernando Gont <[e-mail]> wrote:
>>> 
>>>> On 02/01/2016 07:25 PM, Owen DeLong wrote:
>>>> [...]
>>>> 
>>>> The thing that strikes me most about this is that a host which has an
>>>> adequate stateful inspection firewall in front of it realy has no more issue
>>>> from it’s IPv6 address being harvested than it does from its IPv4
>>>> address being harvested, so I’m not seeing how this is news or how it really
>>>> represents any sort of inherent vulnerability.
>>>> 
>>>> Perhaps someone can enlighten me as to how this is some new security
>>>> issue we should be concerned about, but for now, it appears to me as if
>>>> it is much ado about nothing.
>>> 
>>> Maybe in that in IPv4 you typically have a NAT in front of your node,
>>> where in IPv6 you don't necessarily have a fw?
>>> 
>> 
>> If you're running a host without any sort of filter, that's really not a problem we should be solving at the network level. That's more of an educational problem.
> 
> There's a reason for deploying network-based firewalls:
> <https://tools.ietf.org/html/draft-gont-opsawg-firewalls-analysis-01>

A network-based firewall is one form of filter. I’m not sure why you think my statement was antithetical to that.

Owen