[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: I-D.ietf-v6ops-cpe-simple-security-09

On 3/21/10 6:29 PM, Brian E Carpenter wrote:

On 2010-03-22 02:38, Gert Doering wrote:

Hi,

On Sun, Mar 21, 2010 at 01:19:50PM +1300, Brian E Carpenter wrote:

Indeed. But ISPs that supply CPE to their customers are going to
assume that their customers are running unpatched insecure operating
systems at high risk of catching malware. So I think they are just as
likely as enterprise IT departments to favour default deny approaches.

We're not.

We provide *Internet* services.  Not "walled garden" services.

If the customer wants firewall protection, we're happy to sell it to them,
but the default package they get is "Internet".  Packets transported from
A to B and vice versa, and we're not maing their packets unhappy unless they
tell us so.

I applaud that and it's what I want from my ISP. My comment is that
I don't see this as a universal approach.

So, I'm wondering what's really wrong with:

   REC-41  Gateways MUST provide an easily selected configuration option
       that permits operation in a mode that forwards all unsolicited
       flows regardless of forwarding direction.

The problem is the default, which is not to permit this.

- Mark

  - Brian