Subject: RE: NATs as firewalls

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Mon, 5 Mar 2007 17:51:37 -0800

> From: John C Klensin [mailto:[email-masked]] 
> --On Monday, 05 March, 2007 09:15 -0800 "Hallam-Baker, Phillip"
> <[email-masked]> wrote:

> While I have disagreed with many of the other things Phillip 
> has said in this thread, I am in complete agreement with this 
> one and taken much the same position for some time.  Indeed, 
> I have long suspected that the highest-leverage remedy for 
> many spam and malware issues would start with considering 
> ISPs who supply SOHO and, even more important, residential, 
> connections without supplying or requiring such firewalls at 
> the boundary to be liable for the damage that results.

Quite, the technical part of my proposal is essentially a generalization of the emergent principle of port 25 blocking. While people were doing this before SUBMIT was proposed the SUBMIT proposal made it possible to do so without negative impact on legitimate users.

How do we establish the political coalition necessary to act? There is clearly additional discussion necessary within the IETF community to achieve a measure of consensus. I agree that the IETF list is not the place for that.

We need more than just consensus in the IETF though. We need to convince the ISPs to act who in turn must persuade the vendors of SOHO routers. The ISPs have leverage, they write RFPs. The ISPs and others discuss this type of issue in forums such as MAAWG. The institutional issue is how to present an IETF consensus to such fora.

This need does not seem to be anticipated in the IETF constitution. The body with the closest mandate would appear to be the IAB.

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: Douglas Otis <[email-masked]>
Date: Tue, 6 Mar 2007 10:11:33 -0800

On Mar 5, 2007, at 5:51 PM, Hallam-Baker, Phillip wrote:

> Quite, the technical part of my proposal is essentially a  
> generalization of the emergent principle of port 25 blocking. While  
> people were doing this before SUBMIT was proposed the SUBMIT  
> proposal made it possible to do so without negative impact on  
> legitimate users.
>
> How do we establish the political coalition necessary to act? There  
> is clearly additional discussion necessary within the IETF  
> community to achieve a measure of consensus. I agree that the IETF  
> list is not the place for that.
>
> We need more than just consensus in the IETF though. We need to  
> convince the ISPs to act who in turn must persuade the vendors of  
> SOHO routers. The ISPs have leverage, they write RFPs. The ISPs and  
> others discuss this type of issue in forums such as MAAWG. The  
> institutional issue is how to present an IETF consensus to such fora.
>
> This need does not seem to be anticipated in the IETF constitution.  
> The body with the closest mandate would appear to be the IAB.

While outbound controls in low cost SOHO routers, NATs, DSL or cable  
modems could prove useful, there is a significant hardware  
installation base that will not be replaced anytime soon.  Unless  
ISPs are willing to invest in a centralized means of control within  
their networks and then endure the resulting support, the problem  
will persist.  Such an investment is likely to be seen as in conflict  
with maximizing revenues.

Guidelines for ISP best practices might include a recommendation for  
access device features, however it seems unlikely anything that  
requires additional support, especially those that instruct users to  
disable some feature, as being a lost cause.  It seems unlikely any  
ISP will wish to embrace this effort, regardless of need.

The scope for the NEA effort could have been broader.  The NEA  
control mechanism is lacking, and this effort will not consider  
compatibility with the Internet as a whole.  This seems like a missed  
opportunity for improving protections where ISPs could also stand to  
benefit.

-Doug

---

From: Douglas Otis <[email-masked]>
Date: Tue, 6 Mar 2007 15:13:47 -0800

On Mar 6, 2007, at 1:39 PM, Jeff Young wrote:

> For better or worse, the "centralized means of control" you mention  
> may well come in the form of the latest IPTV networks being built  
> by large telco providers.  As telco battles cable for couch  
> potatoes, they've realized that mucking with television reception  
> is perhaps the best way to overload their customer service call  
> centers.  As such, the demarc between ISP* and customer is moving  
> inside the home.  There may still be a Linksys or Netgear wirless  
> device attached to these networks but there will be an IP "router"  
> that is partially controlled by the ISP on site.
>
> Depending on your stomach for getting involved there will be,  
> according to predictions, ~40 million households worldwide on some  
> type of IPTV in the next few years alone.  We may not have the  
> opportunity to replace existing hardware, but there is the  
> opportunity to influence what goes in-line before it.

The "centralized" controls should be able to modulate connectivity.   
It seems almost every day represents a new zero day exploit of some  
sort.  In light of this, it would be helpful for connectivity to be  
limited until there is some automated acknowledgment that signals  
specifically what connectivity is required for remediation.  While it  
is possible to centrally identify threats, there is no uniform means  
to modulate connectivity during identified vulnerable transitions.

During these transitions, clicking on a link or accepting a message  
represents a genuine threat.  As it is now, compromised systems lack  
any centralized control and have placed the Internet dependability  
and related commerce at risk.  Some mechanism similar to that of the  
NEA seems needed.

-Doug

---

From: Douglas Otis <[email-masked]>
Date: Tue, 6 Mar 2007 15:13:47 -0800

-Doug

---

From: Jeff Young <[email-masked]>
Date: Tue, 6 Mar 2007 16:39:46 -0500

For better or worse, the "centralized means of control" you mention  
may well come in the form of
the latest IPTV networks being built by large telco providers.  As  
telco battles cable for couch
potatoes, they've realized that mucking with television reception is  
perhaps the best way to overload
their customer service call centers.  As such, the demarc between  
ISP* and customer is moving
inside the home.  There may still be a Linksys or Netgear wirless  
device attached to these
networks but there will be an IP "router" that is partially  
controlled by the ISP on site.

Depending on your stomach for getting involved there will be,  
according to predictions, ~40
million households worldwide on some type of IPTV in the next few  
years alone.  We may not
have the opportunity to replace existing hardware, but there is the  
opportunity to influence
what goes in-line before it.

* the term "ISP" has morphed so many times I have trouble following  
but in the modern day
progression of UUnet/iMCI >> AOL/Earthlink >> AT&T/Verizon I'm  
referring to the latter example.

jy
On Mar 6, 2007, at 1:11 PM, Douglas Otis wrote:

>> generalization of the emergent principle of port 25 blocking.  
>> While people were doing this before SUBMIT was proposed the SUBMIT  
>> How do we establish the political coalition necessary to act?  
>> There is clearly additional discussion necessary within the IETF  
>> SOHO routers. The ISPs have leverage, they write RFPs. The ISPs  
>> and others discuss this type of issue in forums such as MAAWG. The  
>> This need does not seem to be anticipated in the IETF  
>> constitution. The body with the closest mandate would appear to be  
>> the IAB.
>
> While outbound controls in low cost SOHO routers, NATs, DSL or  
> cable modems could prove useful, there is a significant hardware  
> will persist.  Such an investment is likely to be seen as in  
> conflict with maximizing revenues.
>
> Guidelines for ISP best practices might include a recommendation  
> for access device features, however it seems unlikely anything that  
> requires additional support, especially those that instruct users  
> to disable some feature, as being a lost cause.  It seems unlikely  
> any ISP will wish to embrace this effort, regardless of need.
>
> compatibility with the Internet as a whole.  This seems like a  
> missed opportunity for improving protections where ISPs could also  
> stand to benefit.
>
> -Doug
>