[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: On saving end-to-end transparency

On 3/23/10 4:21 PM, Mohacsi Janos wrote:
For information: the IPv6 we have here is WITHOUT any filter (confirmed by the IETF NOC). 
Does anyone report a security problem ;-) ?
Are there any possiblity to report security problems? You know, IETF folks are more technically competent than the average home users. They know what they are doing on their computers. 
You give us *way* more credit than we deserve :-)

- Mark


I think there is still some needs to hide home network devices:
- no longer supported but know to be vulnerable devices, servers
- devices without access control
- etc.





Best Regards,
        Janos Mohacsi




Le 23 mars 2010 ? 06:32, Mohacsi Janos a écrit :





On Mon, 22 Mar 2010, Gert Doering wrote:


Hi,

On Mon, Mar 22, 2010 at 08:32:38AM -0700, Fred Baker wrote:
That will have to be a working group decision. We have your opinion on the record. 

On Mar 22, 2010, at 8:25 AM, Mark Townsley wrote:
Let's err on the side of our ideals here. Publish draft-ietf-v6ops-cpe-simple-security, but do so without default-deny rules on by default. Let's not break end-to-end IPv6 before it even has a chance to grow up. 

Add another opinion to that.

- have firewalling in there
- default to "end-to-end communication permitted"
Yes to have the firewalling capabilities in CPE (reflective session state if you like) Yes to be default end-to-end communication permitted - but could be switched to default to deny by the end users, if he or she prefers NAT like behaviour. 

Best Regards,
        Janos Mohacsi