[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: On saving end-to-end transparency






For information: the IPv6 we have here is WITHOUT any filter (confirmed by the IETF NOC).
Does anyone report a security problem ;-) ?
Are there any possiblity to report security problems? You know, IETF folks are more technically competent than the average home users. They know what they are doing on their computers. 

I think there is still some needs to hide home network devices:
- no longer supported but know to be vulnerable devices, servers
- devices without access control
- etc.


Best Regards,
		Janos Mohacsi




Le 23 mars 2010 ? 06:32, Mohacsi Janos a écrit :





On Mon, 22 Mar 2010, Gert Doering wrote:


Hi,

On Mon, Mar 22, 2010 at 08:32:38AM -0700, Fred Baker wrote:

That will have to be a working group decision. We have your opinion on the record.

On Mar 22, 2010, at 8:25 AM, Mark Townsley wrote:


Let's err on the side of our ideals here. Publish draft-ietf-v6ops-cpe-simple-security, but do so without default-deny rules on by default. Let's not break end-to-end IPv6 before it even has a chance to grow up.


Add another opinion to that.

- have firewalling in there
- default to "end-to-end communication permitted"


Yes to have the firewalling capabilities in CPE (reflective session state if you like)
Yes to be default end-to-end communication permitted - but could be switched to default to deny by the end users, if he or she prefers NAT like behaviour.

Best Regards,
		Janos Mohacsi