Subject: [homenet] one IAB quotation on walled gardens

From: Erik Kline <[email-masked]>
Date: Wed, 28 Mar 2012 07:41:51 +0000

Mark,

For the record, the walled garden citation I quoted was from:

    http://tools.ietf.org/html/rfc3002#section-4.2

(really section 4.2.1)

"""
   It was strongly recommended that independent of the ubiquity of the
   "walled garden" deployment scenario that protocols and architectural
   decisions should not target this model.  To continue the success of
   Internet protocols at operating across a highly diverse and
   heterogeneous environment the IETF must continue to foster the
   adoption of an "open model".  IETF protocol design must address
   seamless, secure, and scalable access."
"""

I read this as: don't design for walled gardens.  If they can be made
to work so be it, but they can't really serve as a valid motivation.

This was the closest IAB statement I could find on walled gardens.
Maybe there's another IAB comment someone can find/make.

-Erik

---

From: Michael Richardson <[email-masked]>
Date: Wed, 28 Mar 2012 14:01:16 +0200

>>>>> "Erik" == Erik Kline <[email-masked]> writes:
    Erik> Mark,

    Erik> For the record, the walled garden citation I quoted was from:

    Erik>     http://tools.ietf.org/html/rfc3002#section-4.2

yes, I found it during the meeting.
I think you are taking it out of context of:
  - the time before 2000 
  - when "wireless carriers" were not running IP at all, but providing
    access to email/etc. via application layer gateways!!!!

and it was a summary of an IAB workshop, not an IAB recommendation.

I much prefer to engineer for walled gardens using globally unique
addresses GUA (not globally reachable) ("GUAnGR"?), than for NAT66.

I also want to point out that the experience with IPv4 "walled gardens"
usually involves either operators squatting on "unallocated" address
spaces, or enterprises running non-unique RFC1918 networks with
VPNs/Remote-Access.    None of these things are going away.

The example of "Joe's web cam", and whether we should use:
    - ULA/GUA in DNS with views (what about caches and DNSSEC?)
or  - ULA+GUA in DNS (multiple AAAA) plus Happy Eyeballs

is pertinent.  Because the ULA is a walled garden.  And if it's really
"Joes' office webcam via VPN", then the Enterprise is a walled garden.

-- 
]       He who is tired of Weird Al is tired of life!           |  firewalls  [
]   Michael Richardson, Sandelman Software Works, Ottawa, ON    |net architect[
] [email-masked] http://www.sandelman.ottawa.on.ca/ |device driver[
   Kyoto Plus: watch the video <http://www.youtube.com/watch?v=kzx1ycLXQSE>
	               then sign the petition.

---

From: Brian E Carpenter <[email-masked]>
Date: Thu, 29 Mar 2012 08:38:42 +1300

>     access to email/etc. via application layer gateways!!!!

Certainly we were worried about WAP at the time, but the language was
careflly written to be more generic than that (I had something to do
with drafting it).

> and it was a summary of an IAB workshop, not an IAB recommendation.

At that time we were less strict about the formality or otherwise of
IAB documents, but iirc there was pretty strong consensus behind
the "musts" in the text Erik quoted.

> "Joes' office webcam via VPN", then the Enterprise is a walled garden.

But neither of those are "captive customers" in the sense that WAP
threatened or that some carriers still seem to be hoping for.

   Brian

---

From: Michael Richardson <[email-masked]>
Date: Thu, 29 Mar 2012 13:48:05 +0200

>>>>> "Brian" == Brian E Carpenter <Brian> writes:
    >> I much prefer to engineer for walled gardens using globally
    >> unique addresses GUA (not globally reachable) ("GUAnGR"?), than
    >> for NAT66.
    >> 
    >> I also want to point out that the experience with IPv4 "walled
    >> gardens" usually involves either operators squatting on
    >> "unallocated" address spaces, or enterprises running non-unique
    >> RFC1918 networks with VPNs/Remote-Access.  None of these things
    >> are going away.
    >> 
    >> The example of "Joe's web cam", and whether we should use: -
    >> ULA/GUA in DNS with views (what about caches and DNSSEC?)  or -
    >> ULA+GUA in DNS (multiple AAAA) plus Happy Eyeballs
    >> 
    >> is pertinent.  Because the ULA is a walled garden.  And if it's
    >> really "Joes' office webcam via VPN", then the Enterprise is a
    >> walled garden.

    Brian> But neither of those are "captive customers" in the sense
    Brian> that WAP threatened or that some carriers still seem to be
    Brian> hoping for.

So, is the term "walled garden" inappropriate then, and we are arguing
about nothing?

We aren't talking about captive customers.  The specific *technical*
requirement is actually:
         You can't *there* if you start with that source IP.
or:      If you want to go *there*, you must start from *here*
or:      Ingress filtering rules

(with allusions to: http://c2.com/cgi/wiki?WouldntStartFromHere )

---

From: Brian E Carpenter <[email-masked]>
Date: Fri, 30 Mar 2012 08:18:58 +1300

Front posting: I think we are using "walled garden" to mean several
things and that is confusing.

In my mind it refers to a captive customer scenario where a service
provider is intentionally limiting a customer's access to the global
Internet or (by playing DNS and/or HTTP proxy tricks) presenting a
distorted view of the the global Internet.

This becomes especially obnoxious if the customer has multiple
providers that attempt to enforce different walled gardens. But
that's a MIF issue, I think.

That is quite different from stating that a customer network should
be separated from the Internet by a security fence of some kind and
may also need a local namespace. I thought that was normally called
an intranet.

Regards
   Brian Carpenter

On 2012-03-30 00:48, Michael Richardson wrote:
> ------------------------------------------------------------------------
> 
> _______________________________________________
> homenet mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/homenet

---

From: Joel jaeggli <[email-masked]>
Date: Fri, 30 Mar 2012 09:27:21 +0200

> may also need a local namespace. I thought that was normally called

when you have two default routes, but the graph exposed by each has an
overlapping but incomplete set of vertices you don't have enough
information to to determine which one to select for a given destination.
flipping a coin works fine (in general) for the overlapping set.

---

From: Michael Richardson <[email-masked]>
Date: Fri, 30 Mar 2012 09:35:27 +0200

>>>>> "Brian" == Brian E Carpenter <Brian> writes:
    Brian> Front posting: I think we are using "walled garden" to mean
    Brian> several things and that is confusing.

    Brian> In my mind it refers to a captive customer scenario where a
    Brian> service provider is intentionally limiting a customer's
    Brian> access to the global Internet or (by playing DNS and/or HTTP
    Brian> proxy tricks) presenting a distorted view of the the global
    Brian> Internet.

    Brian> This becomes especially obnoxious if the customer has
    Brian> multiple providers that attempt to enforce different walled
    Brian> gardens. But that's a MIF issue, I think.

    Brian> That is quite different from stating that a customer network
    Brian> should be separated from the Internet by a security fence of
    Brian> some kind and may also need a local namespace. I thought that
    Brian> was normally called an intranet.

I actually can't see a technical difference.
Most intranets work by:
     1) intentionally limiting a customer's access to the global Internet
     2) playing DNS tricks
     3) HTTP proxy tricks
     4) having a local name space.

I think that walled-gardens are the political NAT44 of IPv6.

We can, if we want, stick our head in the sand like we did for NAT44,
letting the marketplace produce create an arms race between network
operators and application creators.  Or, we can do like we finally did
with BEHAVE and specify something.

I'm here in homenet because I care about e2e, I want to avoid NAT66, and
I see great utility in having globably unique addresses everywhere, even
if they are not globally routable/accessible.

(ps: I shipped NAT44 products in 1994. I hate myself for helping kill
e2e. I shipped it with split-horizon DNS standard.  It was all stupid. )

---

From: Brian E Carpenter <[email-masked]>
Date: Sun, 01 Apr 2012 14:13:59 +1200

> I actually can't see a technical difference.

In an enterprise intranet, it's (supposedly) a fact that all routing,
firewalling, etc. is administered by the same IT management. Also,
multihoming takes place outside the intranet - the "walled garden"
boundary is also the multihoming boundary.

In a customer/provider scenario, there is split management, and furthermore
the multihoming boundary is inside more than one walled garden at the
same time. That's why it's messy, IMHO.

> I think that walled-gardens are the political NAT44 of IPv6.

IPv6 makes more walled garden tricks possible, but both intranets and
walled gardens abound in IPv4.

> with BEHAVE and specify something.

Good luck balancing on that third rail ;-)

   Brian