Subject: RE: Port numbers and IPv6(was: I-D ACTION:draft-klensin-iana-reg-policy-00.txt)

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Tue, 19 Jul 2005 19:12:17 -0700

> >  Most people think that carriers
> >should not be allowing people to inject bogons.
> >
> >Modern security architectures do not rely exclusively on application 
> >security. If you want to connect up to a state of the art corporate 
> >network the machine has to authenticate.
> 
> the notion that one has to "log into the net" is a quaint one, 
> perhaps inspired by Windows and the registry. as a mac user, I can't 
> relate to this notion, nor can most Unix users, I bet.

Boy are you in for a shock when you try to connect to an ethernet with
802.1x.

Authentication is being built into the NIC cards. At some point in the
future it will not be possible for any device to connect to an Intranet
without first authenticating itself.

And it will all have to be 100% transparent to the user.

> if folks rely on such distributed enforcement, they will get 
> what they deserve.

You are behind the times, single point of failure approaches to security
are out. 

What people are looking to do is to contain attacks from within their
networks. Most large companies now have networks that are large enough
for what is inside the firewall to be at least as worrying as what is
outside.

> why not just propose rigorous enforcement of setting the evil bit by 
> all network attachment devices, etc?

Sarcasm is not a particularly useful mode of debate, particularly when
you are defending a dogma that has little practical success to recommend
it.

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: Stephen Kent <[email-masked]>
Date: Wed, 20 Jul 2005 11:25:56 -0400

Phil,

>...

I have yet to do so. I do have the facility on my Mac, but I've never 
had to turn it on.

>without first authenticating itself.

It could happen, but then too it might not.

>And it will all have to be 100% transparent to the user.

only when it works :-)

>You are behind the times, single point of failure approaches to security

layered defenses are a good notion, but mostly when the layers are 
under the same administrative control. all too often people forget 
that relying on the security provided by someone else is a risky 
proposition, as in your example of ISPs providing ingress filtering.

>for what is inside the firewall to be at least as worrying as what is

fair statement

>you are defending a dogma that has little practical success to recommend

If it weren't a good analogy I don't think I would have received so 
many private responses congratulating me for it :-)

Steve

---

From: "Stephen Sprunk" <[email-masked]>
Date: Fri, 22 Jul 2005 12:56:21 -0500

Thus spake "Stephen Kent" <[email-masked]>
> I have yet to do so. I do have the facility on my Mac, but I've never had 
> to turn it on.

You need to get out more.

> It could happen, but then too it might not.

It's already happening.  There is a large (and growing) number of corporate 
networks where 802.1x is mandatory -- if you don't do it, you simply can't 
connect.  I've also run into a fair number that require registering MAC 
addresses (default is to deny or sandbox) due to vendors who don't yet do 
802.1x.

End-to-end is a great goal, but it doesn't reflect the real world today. 
Not that it's an excuse to _require_ middleware in protocols, but we need to 
design with the knowledge that they _may_ exist.

S

Stephen Sprunk      "Those people who think they know everything
CCIE #3723         are a great annoyance to those of us who do."
K5SSS                                             --Isaac Asimov

---

From: Philip Guenther <[email-masked]>
Date: Fri, 22 Jul 2005 11:56:28 -0700

Stephen Sprunk <[email-masked]> writes:
...
>design with the knowledge that they _may_ exist.

Maybe I'm just slow, but I fail to see the connection between those two
paragraphs.  How does authentication of network access serve as a
counter example to the end-to-end principle?  As far as I can tell,
they're completely orthogonal, just as e2e isn't refuted by the
existence of DHCP.  Or did I miss a discussion about how DHCP is a
middleware protocol?

Philip Guenther