[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: I-D.ietf-v6ops-cpe-simple-security-09
On Mon, 22 Mar 2010 06:29:01 +1300
Brian E Carpenter <brian.e.carpenter@gmail.com> wrote:
> On 2010-03-22 02:38, Gert Doering wrote:
> > Hi,
> >
> > On Sun, Mar 21, 2010 at 01:19:50PM +1300, Brian E Carpenter wrote:
> >> Indeed. But ISPs that supply CPE to their customers are going to
> >> assume that their customers are running unpatched insecure operating
> >> systems at high risk of catching malware. So I think they are just as
> >> likely as enterprise IT departments to favour default deny approaches.
> >
> > We're not.
> >
> > We provide *Internet* services. Not "walled garden" services.
> >
> > If the customer wants firewall protection, we're happy to sell it to them,
> > but the default package they get is "Internet". Packets transported from
> > A to B and vice versa, and we're not maing their packets unhappy unless they
> > tell us so.
>
> I applaud that and it's what I want from my ISP. My comment is that
> I don't see this as a universal approach.
>
> So, I'm wondering what's really wrong with:
>
> REC-41 Gateways MUST provide an easily selected configuration option
> that permits operation in a mode that forwards all unsolicited
> flows regardless of forwarding direction.
>
I don't see anything wrong with it. That the "Vanilla Router"
checkbox. In some respects is equivalent to bridge mode on ADSL
routers today, which allow end-hosts to terminate the PPPoE/PPP
sessions, rather than have the upstream ADSL router do it.
Regards,
Mark.