Subject: Re: Addresses and ports and taxes -- oh my!

From: [email-masked]
Date: Thu, 3 Aug 2000 10:38:50 -0700

Such a product is available already, check out :

www.maxgate.net/product_3200.htm

I believe the device does use NAT ( :-< ) but there are other devices in the
family, that do IPSEC. I am still waiting for mine to be delivered, sorry if I
am a little wooly about it, I haven't had chance to play with it yet, but it
looks promising.

At the moment the cost is about $300 USD, but as Andre points out the price will
drop eventually. Also I had believed that IPv6 had enough addresses for every
person on planet Earth and then some.

But here is an intresting question,

Would the address be assigned to a person or a property, on the basis that if
the person moved would the address go with them or stay with the house ?

What happened if the house was destroyed or the person died, would the address
be returned to the registry, from where it was issued, to be re-allocated to a
new property or person ?

Will we eventually get to the point where we are all as unique as our IPv6
addresses, and new born children are assigned an address automatically, when
they are born ?

Maybe george orwell and aldous huxley got it right ;->

Jim

**************************************************************************************************************************************************
This is my personal opinion only and does not represent the technical direction
of 3Com or any subsidury.
**************************************************************************************************************************************************

Andre-John Mas <[email-masked]> on 03/08/2000 15:41:52

Sent by:  Andre-John Mas <[email-masked]>

To:   "Rakers, Jason" <jrakers @ALLEGHENYENERGY.COM>
cc:   "'Dennis Glatting'" <dennis.glatting @SOFTWARE-MUNITIONS.COM>,
      [email-masked] (Jim Stephenson-Dunn/C/HQ/3Com)
Subject:  Re: Addresses and ports and taxes -- oh my!

"Rakers, Jason" wrote:
>
> When household appliances begin becoming IP addressable, I think we will see
> a move towards assigning an Internet IP address per household (much like
> today's street address).  The household will perform NAT for all devices
> within (one street address can house many people, not just one).

The factor in all this is cheap firewalls/routers. With these coming
down in price they will be installed standard when asking for a cable
internet connection, or such. Also these boxes, probably being the size
of a phoneset would probably also include a DHCP server for addressing
the
various devices in the home, much like what is done for Sun's SunRay
line
of devices. If this does happen I just hope that they offer the option
for expert users to configure the devices themselves. The price factor
that will make these an option is arounf USD 100.

Andre

---

From: Keith Moore <[email-masked]>
Date: Thu, 03 Aug 2000 17:48:04 -0400

The various proposals to burn IP addresses into devices are naive.

IP addresses identify points in the network topology.  Hence they 
need to be assigned according to topology.  If you try to assign
IP addresses in some other fashion, you immediately need something
else to replace the IP address which is assigned according to network
topology.  And for various reasons that new thing will have a very 
similar structure to an IP address. 

(for reasons of efficiency, IP addresses are also sometimes used to name, 
or as parts of names for, lots of other things - including interfaces, 
hosts, and connection endpoints.  but it's the use of an IP address
to name a point in the network topology that drives their assignment.)

yes, you can add a layer of indirection to the network so that a
device has a constant 'virtual' IP address which gets forwarded to
the 'real' IP address which indicates the current location of the
device.  mobile-ip does this, for example, and it's quite useful
to be able to have a mobile device with a stable IP address.
but then you still need a 'current location' address.  you also need a 
home agent which sits on the net at the location corresponding to
your stable IP address, and either forwards your traffic to the
'current location' address or issues a redirect to that address.

if my toaster is going to be on the net, the last thing I want is for 
all of the traffic for that toaster to go to the toaster manufacturer's 
home agent just so it can get forwarded to my house.   I don't want the
toaster manufacturer to be able to see how often I'm checking on the
status of my toast.  nor do I want to have to pay the toaster manufacturer 
to get it to continue to route packets to my toaster.

burning IP addresses into devices is a good way to give vendors the 
ability to control those devices, monitor their usage, and to lock
their customers in to particular services.  not my idea of a desirable state.

personally, I'd rather have the address registries.

Keith

---

From: Dennis Glatting <[email-masked]>
Date: Thu, 3 Aug 2000 17:57:54 -0700 (PDT)

On Thu, 3 Aug 2000, Keith Moore wrote:

	[snip]

> their customers in to particular services.  not my idea of a desirable

It might also be a good way for script kiddies to efficiently scan the
Internet looking for a particular manufacturer's device to exploit a
discovered security flaw, such as turning off a stove's gas pilot and
turning on all burners. If that doesn't sound realistic, how about a
cracker inside a manufacturer's systems doing the same; or how about a
terrorist?

It is reasonable to assume that HVAC systems will someday soon be
controlled over the Internet by a maintenance firm (video surveillance
systems already are controlled and monitored over the Internet). It may
become possible, for example, to raise building temperatures across the
lower Manhattan area and shut down most financial centers, at least for a
short while.

---

From: "vinton g. cerf" <[email-masked]>
Date: Fri, 04 Aug 2000 01:52:49 -0400

>The various proposals to burn IP addresses into devices are naive.
for the record, I was assuming that only a lower order unique end-id
was burned in and that the high order bits would be dynamically assigned
based on connectivity to the global Internet.
=================================================================
I moved to a new MCI WorldCom facility on Nov 11, 1999

MCI WorldCom
22001 Loudoun County Parkway
Building F2, Room 4115, ATTN: Vint Cerf
Ashburn, VA 20147
Telephone (703) 886-1690
FAX (703) 886-0047

"INTERNET IS FOR EVERYONE!" 
INET 2001: Internet Global Summit 
5-8 June 2001 
Sweden International Fairs 
Stockholm, Sweden 
http://www.isoc.org/inet2001

---

From: Mahadevan Iyer <[email-masked]>
Date: Fri, 4 Aug 2000 01:26:55 -0700 (PDT)

At first glance, it seems sheer idiocy to use an open network like the
Internet to control critical matter-of-life-and-death public
infrastructure like power systems. What do you think?

Or do you think, it is possible to build ultra-reliable secure real-time
communication channels in the Internet? Maybe..

---

From: Andre-John Mas <[email-masked]>
Date: Fri, 04 Aug 2000 10:04:58 -0400

> cracker inside a manufacturer's systems doing the same; or how about a

Though if the devices already use ethernet, then each device would
already
have its own MAC address, and the IP address would be DHCP assignable.
As
stated earlier once firewall/routers/DHCP server combos come down in
price,
preferbly below $200, you will probably see these devices as becoming
standard.
These devices would provide a level of intrusion security and would be
able
to assign address to the devices in the home, as is already done in most
LANs.

Andre

---

From: Dennis Glatting <[email-masked]>
Date: Fri, 4 Aug 2000 07:23:20 -0700 (PDT)

> infrastructure like power systems. What do you think?

I believe:

 * Engineers will build any possible feature into a
   product, install back doors, and not adequately 
   test their code. Of course complexity (IPsec, 
   policies, etc.) will probably not make adequate
   testing possible.
 * Marketing to demand all kinds of crazy features
   and convince the public at large they need them.
 * Lawyers to write liability limitations and 
   unintelligible wording into warrantee and 
   purchase contracts.
 * Consumers and providers to not properly configure
   devices and maintain them.
 * Congress (USA) to pass liability limiting laws.
 * Crackers to find holes and post cracking scripts.

Today we have remote control (not over the Internet, AFAIK) of alarm
systems and HVAC systems. The Internet provides a far greater reach and a
more cost effective model of managing these and other systems. So, I
believe these and many other systems will eventually find themselves
connected to the Internet. Additionally, there have been several articles
in the popular press in the past few years of the advertising community
salivating at the idea of displaying advertisements on home appliances
via the Internet -- imagine the "free Internet" equivalent of a "free
dishwasher."

> Or do you think, it is possible to build ultra-reliable secure
> real-time communication channels in the Internet? Maybe..
> 

No I do not believe so, but not so much for technological reasons; rather
for the reasons I previously listed.

---

From: Dennis Glatting <[email-masked]>
Date: Fri, 4 Aug 2000 07:36:49 -0700 (PDT)

On Fri, 4 Aug 2000, Andre-John Mas wrote:

> already have its own MAC address, and the IP address would be DHCP
> assignable. As stated earlier once firewall/routers/DHCP server combos
> come down in price, preferbly below $200, you will probably see these
> devices as becoming standard. These devices would provide a level of
> intrusion security and would be able to assign address to the devices
> in the home, as is already done in most LANs.
> 

Firewalls do indeed provide a level of security but they are also
vulnerable to attack and code and configuration entropy -- there are many
examples of this. Also, if you have a trusted party managing your HVAC
system and that trusted part is cracked, a firewall will probably provide
no defense.

---

From: "Anthony Atkielski" <[email-masked]>
Date: Fri, 4 Aug 2000 17:06:33 +0200

Mahadevan Iyer writes:

> At first glance, it seems sheer idiocy to use an open
> network like the Internet to control critical matter=
> of-life-and-death public infrastructure like power
> systems. What do you think?

I think there are lots of idiots out there preparing to do exactly this.

---

From: Andre-John Mas <[email-masked]>
Date: Fri, 04 Aug 2000 11:41:10 -0400

> On Fri, 4 Aug 2000, Andre-John Mas wrote:
[SNIP]
> system and that trusted part is cracked, a firewall will probably provide

I suppose what's needed here is some sort of EPROM, that stores an image
of
the system, and re-copies that image to main memory every day. The EPROM
could only be written to by pressing a hardware switch, otherwise it is
read-only. Since there are Linux based firewall solutions that fit on a
floppy, this sort of approach shouldn't be too difficult.

Andre

---

From: "Brijesh Kumar" <[email-masked]>
Date: Fri, 4 Aug 2000 12:29:43 -0400

> -----Original Message-----
> From: Anthony Atkielski [mailto:[email-masked]]
>
> Mahadevan Iyer writes:
>

My logics have failed me due to the above text: which of the following
you mean.

  1) Any one who is preparing to do above will belong to a set called
"Idiots",
  2) Only people who already belong to a set called "Idiots" are
preparing to do it.

Hey - don't take it seriously it is friday.

On a change note, what about the use of secure tunnels using IPSEC?
Won't that solve problem. Perhaps not in all cases.

I think you need - security, performance guarantee, network path
reliability and ability to control restoration paths. Security is only
one dimension to the issue of who controls the end to end delivery
system in critical applications. It is hard to be sure of an event
outcome if you are not in control of all variables that can affect the
system. Basic control theory. Do you think people who design these
systems flunked their control theory course (may be they concentrated
too much on computer science :-))?

Cheers,

--brijesh
Ennovate Networks Inc.

---

From: [email-masked]
Date: Fri, 04 Aug 2000 12:34:49 -0400

> infrastructure like power systems. What do you think?

At first glance, it seems sheer idiocy to use something like a telco switch
to control critical matter-of-life-and-death public infrastructure like the
US 911 system.

Telco switches are hackable.  And I submit to you that the 911 system is
as life-and-death critical as it gets.  Hasn't seemed to have been a
problem so far, even though 911 systems *have* been hacked, subjected
to denial of service attacks, and all the other problems they are subject to.

> communication channels in the Internet? Maybe..

It may be impossible to build ultra-reliable secure systems.  On the other
hand, remember that it's about *risk management*.  Nuclear launch codes
are one of the *very* few "zero failures acceptable" things we have.

We accept that on the order of 1 out of every million airplane takeoffs
ends badly.  We accept that the power grid fails in scattered areas
during the summer.  We accept that doctors, drug interactions,  and
hospitals accidentally kill a number of patients every year.  I don't
see the whole class of Aleve/Naprosyn painkillers being pulled off the
market, even though an amazing number of people die every year from
gastric bleeding.

We actually know almost all of what we need to build such systems. Now
all we need is programmers that remember to actually CHECK that string
lengths are in bounds. ;)

				Valdis Kletnieks
				Operating Systems Analyst
				Virginia Tech

---

From: "Stephen Sprunk" <[email-masked]>
Date: Fri, 4 Aug 2000 12:57:41 -0500

Thus spake "Mahadevan Iyer" <[email-masked]>
> infrastructure like power systems. What do you think?

Public power systems are not life-and-death.  Anywhere that AC service
is even moderately important, the people responsible (assuming they're
competent) will have contingencies for power loss.  Consider the ISPs
that *voluntarily* go off-grid when there's a power crisis in the SF
Bay.  Hospitals also make an interesting study.

Additionally, just because two IP hosts are both connected to the Net
doesn't mean that they must use the Net to communicate.  Not all IP
networks are public.

> Or do you think, it is possible to build ultra-reliable secure
real-time
> communication channels in the Internet? Maybe..

A reasonable degree of cynicism tells us that this will be impossible;
"secure" and "real-time" I might buy, but the state of inter-provider
cooperation will need to advance significantly before I'll believe any
Net-based service will even approach "reliable".

S

     |          |         Stephen Sprunk, K5SSS, CCIE #3723
    :|:        :|:        Network Design Consultant, GSE
   :|||:      :|||:       14875 Landmark Blvd #400; Dallas, TX
.:|||||||:..:|||||||:.    Email: [email-masked]

---

From: Dennis Glatting <[email-masked]>
Date: Sat, 5 Aug 2000 15:51:22 -0700 (PDT)

> Bay.  Hospitals also make an interesting study.

Food for thought (copied from Risks):

------------------------------

Date: Wed, 12 Jul 2000 18:18:53 -0500
From: Bill Higgins-- Beam Jockey <[email-masked]>
Subject: Illinois man dies after utility cuts power

I found the following story at the *Chicago Sun-Times*. 
<http://www.suntimes.com:80/output/news/vent12.html>

> Man dies after ComEd cuts power 
> 
> July 12, 2000
> 
> BY DAN ROZEK AND STEVE WARMBIR SUBURBAN REPORTERS 
> 
> An elderly Aurora man who used an electrically powered oxygen system
> to help him breathe died in his home several hours after ComEd shut
> off the power because he was behind in his bills.

In Aurora, Illinois, Eric Shackelford, an 81-year-old man, used oxygen 24
hours a day to help him breathe; he suffered from "severe heart disease."
His daughter, Renia Thomas of Chicago, claims that the power cutoff shut
his oxygen down, and may bring a wrongful-death lawsuit against the power
company, Commonwealth Edison.

The story reports, however, that a roommate says Shackelford had two
oxygen systems, one of which did not depend on electrical power.

The RISKS relevance is in the dispute over record-keeping.  The family
says that Shackelford's doctor had sent at least two letters to ComEd
asking that power not be shut off.

> A ComEd spokesman, however, said the utility had never received enough
> information to determine that Shackelford was entitled to be added to
> a list of about 1,000 customers who needed continuous electric power
> for medical equipment. ComEd files contain only one letter from a
> doctor regarding Shackelford, ComEd spokesman Don Kirchoffner said.
> 
> "We would never, ever cut the power to anyone we thought was on life
> support," Kirchoffner said.  [...]
> A final notice sent in June said
> Shackelford should notify ComEd if he had medical equipment that
> required electricity, and there's no record anyone contacted the
> utility, Kirchoffner said.  [...]
> Kane County Coroner David Moore said it was unclear whether the power
> shutdown caused or contributed to Shackelford's death.

It would be interesting to know more about the process by which a power
company keeps track of customers who are dependent on power.  How do you
make such a process fail-safe?

Bill Higgins  Fermi National Accelerator Laboratory  <[email-masked]>

------------------------------