Subject: Re: harbinger, Re: [midcom] WG scope/deliverables

From: Bob Braden <[email-masked]>
Date: Sat, 3 Feb 2001 00:39:20 GMT

*> 
  *> In other words, that is why the Net never was and resists being be a homogeneous
  *> network. It would be a less efficient design.

But the lesson of the Internet is that efficiency is not the primary
consideration.  Ability to grow and adapt to changing requirements is
the primary consideration.  This makes simplicity and uniformity
very precious indeed.

Bob Braden

---

From: Ed Gerck <[email-masked]>
Date: Fri, 02 Feb 2001 21:01:02 -0800

> the primary consideration.  This makes simplicity and uniformity

Is this now a semantic discussion? Ok, if you want to go than that slope,
what I call "efficient design" of course includes "to grow and adapt to changing
requirements," "simplicity" and "uniformity".  Because "efficient" is all
these and more -- efficient is "productive without waste" (Webster).

BTW, a design that is too simple is not efficient, because it wastes resources
and does not allow what could otherwise be possible.  This is the other side of
Ockham's razor, when all possibilities are tried in order to find the best one,
not just the simplest one.

Cheers,

Ed Gerck

---

From: Keith Moore <[email-masked]>
Date: Sat, 03 Feb 2001 00:16:47 -0500

> BTW, a design that is too simple is not efficient, because it wastes 
> resources and does not allow what could otherwise be possible. 

granted that there is such a thing as too simple an answer for 
most design problems... but one can waste resources and be inflexible
much more easily by making a design too complex than by making it too 
simple.  moreover, the limitations of a too-simple design are usually
much easier to identify and correct than those of a too-complex design.

Keith

---

From: Einar Stefferud <[email-masked]>
Date: Fri, 2 Feb 2001 23:04:25 -0800

I too was a strong advocate and strongly disapproved of LANs that 
were not openly connected with full capabilities to the net, until I 
had my own home system and discovered that I had no interest in being 
totally visible and accessible at all times, especially when I was 
not always around to monitor things.

So, now I am very happy behind my little XRouter NAT box, with an ISP 
service out there where I can have a login shell  if I wish.  But I 
do not find any need for a shell account and so do not have one, as 
long as I have POP or IMAP for my EMail, and an ISP that does not 
block any of my desired DNS destinations.

Lets me sleep well!   Without hiring a security staff;-)...

But, I also note that I choose this because it is good for me 
locally, not because I cannot get an IP number for some reason.

So, much of this argument appears to be based on the simple fact that 
IP numbers are scare, and so some companies have chosen to go along 
with NATS when they have no other reason than the shortage of 
available IP numbers.

If so, then that is the problem to solve and leave those of us who 
want NATS alone in our happiness;-)...  Even with IPV6, I would stay 
the way I am.

In short, not everyone really wants their Internet to be totally homogeneous!

Cheers...\Stef

---

From: Grenville Armitage <[email-masked]>
Date: Sat, 03 Feb 2001 10:50:08 -0800

Einar Stefferud wrote:
	[..]
> service out there where I can have a login shell  if I wish.

NAT doesn't primarily provide security, a firewall does. A firewall
doesn't have to do NAT. If you dont mind the number of IP addresses
you get from your ISP, install a smart firewall and ditch the NAT
box (or twiddle some config options in your Xrouter... whatever)

	[..]
> locally, not because I cannot get an IP number for some reason.

You need a firewall. This isn't immediately relevant to a discussion
about the architectural implications of, or reasons for, NAT.

> want NATS alone in our happiness;-)...  Even with IPV6, I would stay

With IPv6 I would hope you'd still want a firewall on your home
connection. But that's not NAT.

cheers,
gja
________________________________________________________________________
Grenville Armitage                    http://members.home.net/garmitage/
Bell Labs Research Silicon Valley

---

From: Scott Brim <[email-masked]>
Date: Sat, 3 Feb 2001 15:27:52 -0500

> box (or twiddle some config options in your Xrouter... whatever)

Although address obfuscation through combining NAT with your firewall
can provide a small amount of additional security.

...Scott

---

From: Jon Crowcroft <[email-masked]>
Date: Sun, 04 Feb 2001 17:29:09 +0000

In message <[email-masked]>, Scott Brim type
 >>can provide a small amount of additional security.

against which attacks ? it doesnt provide better privacy, or non
repudation, or access control, or any normal service that one would
regard as an enhancement of security - in fact, having one address
shared by multiple host s means there are less things an attacker
needs to remember :-)

 cheers

   jon

---

From: "Scott Brim" <[email-masked]>
Date: Sun, 4 Feb 2001 12:54:07 -0500

Jon, this is a nit, two digressions off the main thread, so I'll take it
off-list.  More mail soon.

...Scott

---

From: Lloyd Wood <[email-masked]>
Date: Mon, 5 Feb 2001 13:28:19 +0000 (GMT)

> much easier to identify and correct than those of a too-complex design.

and by the time you've corrected most of the limitations of the
too-simple design, you've got your too-complex design anyway.

witness the ever-more-complex TCP, the world's most baroque
sliding-window protocol.

L.

<[email-masked]>PGP<http://www.ee.surrey.ac.uk/Personal/L.Wood/>