Subject: RE: [seamoby] RE: Yet another Security RANT was L2 API (WAS: Ext . for FMIPv6 - comments) (SHOULD be , RE: Issue #4)

From: Nakhjiri Madjid-MNAKHJI1 <[email-masked]>
Date: Wed, 18 Jul 2001 17:41:49 -0500

Phil,

just one thing, so I have the last word (just kidding).
I think we are in agreement that we do not want to create
new security protocols and stuff them into CTP. The goal was
to rely on existing measures such IPSec, TLS or what have you.

But that does not mean we totally ignore any security issues that
CTP creates and ALSO comes to our minds.
If my neighbor wants to keep a tiger as a pet in his backyard,
he needs to put fence around his yard to not bite my leg off,
 we cannot rely on local government for that, 
if that would be the case, I would talk to a
realtor instead :)

Madjid

-----Original Message-----
From: Phillip Neumiller [mailto:[email-masked]]
Sent: Tuesday, July 17, 2001 10:53 AM
To: 'Melinda Shore'; [email-masked]; Madjid.Nakhjiri
Cc: [email-masked]
Subject: RE: [seamoby] RE: Yet another Security RANT was L2 API (WAS:
Ext. for FMIPv6 - comments) (SHOULD be , RE: Issue #4)

Hi Melinda, John, Madjid,

Hackers are very clever people in general.  Most IETF folk are
not that good at thinking about nefarious things to do with
their own creative efforts (which is the paranoid thinking
required by a security domain expert). 

Personally, I choose not to go through life worrying about every
possible attack, that's what various government agencies, the 
military, police forces, AND NOW the IETF Security WG are for! 
I do lock my doors at night and pack iron, but that has nothing
to do with the implicit trust I must place on local government
law enforcement agencies.  :-)  If WE are talking about locking
doors that is fine.  If we are talking about every WG creating
its own SWAT team, then that's where I object to the process.

REMEMBER:  The best hackers go undetected!  What you tend to do
by rolling your own security measures, is:

A).  Get rid of the amateurs: who probably won't cause much
     damage anyway, since they are quickly spotted/caught.

B).  Introduce new holes into the system by way of lax
     implementation of the security procedures themselves.  

Many cracks occur in the glue for the actual security procedures.
The IETF can not stop this, UNLESS it does things that are
systematically secure and embedded into the structure of global
Internet itself (succesively hardened by global repetitive use).

Best regards,

Phil Neumiller

> -----Original Message-----
> From: Melinda Shore [mailto:[email-masked]]
> Sent: Tuesday, July 17, 2001 11:27 AM
> To: [email-masked]; [email-masked];
> [email-masked]; [email-masked]
> Cc: [email-masked]
> Subject: Re: [seamoby] RE: Yet another Security RANT was L2 API (WAS:
> Ext. for FMIPv6 - comments) (SHOULD be , RE: Issue #4)
> 
> 
> > For Phil - I think the idea is that if you leave your front door
> > wide open, don't blame the police when you find that all of your
> > stuff has been stolen.
> 
> The way I tend to look at it is that if you create a
> security exposure that didn't exist previously, it's
> your responsibility to take care of it.
> 
> Melinda
> 
>