Re: I-D.ietf-v6ops-cpe-simple-security-09

[Brian E Carpenter <brian.e.carpenter@gmail.com>]

On 2010-03-22 02:38, Gert Doering wrote:
> Hi,
> 
> On Sun, Mar 21, 2010 at 01:19:50PM +1300, Brian E Carpenter wrote:
>> Indeed. But ISPs that supply CPE to their customers are going to
>> assume that their customers are running unpatched insecure operating
>> systems at high risk of catching malware. So I think they are just as
>> likely as enterprise IT departments to favour default deny approaches.
> 
> We're not.
> 
> We provide *Internet* services.  Not "walled garden" services.
> 
> If the customer wants firewall protection, we're happy to sell it to them,
> but the default package they get is "Internet".  Packets transported from
> A to B and vice versa, and we're not maing their packets unhappy unless they
> tell us so.

I applaud that and it's what I want from my ISP. My comment is that
I don't see this as a universal approach.

So, I'm wondering what's really wrong with:

  REC-41  Gateways MUST provide an easily selected configuration option
      that permits operation in a mode that forwards all unsolicited
      flows regardless of forwarding direction.

 - Brian