Subject: [v6ops] Re-evaluating RFC7934 (was: Re: Implementation Status of PREF64)

From: Nick Hilliard <[email-masked]>
Date: Tue, 28 Sep 2021 10:49:53 +0100

Lorenzo Colitti wrote on 28/09/2021 06:21:
> On Tue, Sep 28, 2021 at 1:54 PM Owen DeLong <owen=[email-masked]>  wrote:
>     Sometimes the network administrator doesn’t want the host using
>     multiple IP addresses for a variety of reasons.
> 
> Ok, but that's also harmful for a variety of reasons, and for general 
> purpose devices, it's not recommended by the IETF. That's exactly what 
> RFC 7934 is about - explaining why it's harmful.

Why are we having this discussion?  DHCPv6 support IA_TA.

Separately, it would probably also be useful to re-open discussion about 
the rationales provided in rfc7934 sections 3 and 4, because a number of 
the arguments presented are either stale, irrelevant to general purpose 
networking or entirely spurious - particularly the notion of "privacy 
addressing", in the sense that it gives the false impression that 
switching IP addresses increases privacy in any true sense.

Nick

---

From: Lorenzo Colitti <[email-masked]>
Date: Tue, 28 Sep 2021 21:25:14 +0900

> Why are we having this discussion?  DHCPv6 support IA_TA.

If the administrator has decided that the host should not use multiple IP
addresses, then IA_TA obviously can't be used.

---

From: Nick Hilliard <[email-masked]>
Date: Tue, 28 Sep 2021 14:14:00 +0100

Lorenzo Colitti wrote on 28/09/2021 13:25:
> If the administrator has decided that the host should not use multiple 
> IP addresses, then IA_TA obviously can't be used.

So when someone is at work connecting to the company network, who needs 
to comply with whose policies?  Does the company abide by the employee's 
/ user's policies, or the other way around?

Or take a more general case: if I rock up to a hosting/cloud provider or 
broadband access provider and instruct them that they're a great bunch 
of people, no really, but that they're obliged to comply with my network 
access policies for the set of products that they supply and I want to 
buy, how does that work out?

Nick

---

From: Lorenzo Colitti <[email-masked]>
Date: Tue, 28 Sep 2021 23:47:11 +0900

> / user's policies, or the other way around?

I'm not sure what policy has to do with this. If the network administrator
only wants hosts to use one IP address, then they shouldn't enable IA_TA
and IA_NA at the same time, because if they do then they could give devices
more than one IP address and will be violating their own policy.

As for the more general question, I think what actually happens depends on
the implementation on both sides. If a corporate network's policy is that
communication should only use IPv6, then Windows 98 won't work. If a
corporate network's policy is that communication should only use cleartext,
and the network blocks HTTPS, then most of today's OSes and apps will not
work or refuse to use the network. If a corporate network's policy is that
communication should only use cleartext, but the network doesn't block
HTTPS, then user devices will likely use HTTPS anyway and the user will not
be able to comply with the policy unless they choose not to connect. In all
those cases I don't think the user/employee can do much to change the
outcome (or necessarily be aware of what is happening).

> buy, how does that work out?

Not sure what that has to do with this discussion, but... maybe you file a
feature request and they decide whether to prioritize it depending on
factors such as whether other customers are asking for it, how important a
customer you are, whether it fits with their product roadmap and strategic
goals, etc. etc.?

---

From: Owen DeLong <[email-masked]>
Date: Tue, 28 Sep 2021 10:17:52 -0700

> On Sep 28, 2021, at 05:25 , Lorenzo Colitti <lorenzo=[email-masked]> wrote:
> 
> On Tue, Sep 28, 2021 at 6:50 PM Nick Hilliard <[email-masked] <mailto:[email-masked]>> wrote:
> > On Tue, Sep 28, 2021 at 1:54 PM Owen DeLong <owen=[email-masked] <mailto:[email-masked]>>  wrote:
> If the administrator has decided that the host should not use multiple IP addresses, then IA_TA obviously can't be used.

Not every environment is identical.. You keep trying to defend your refusal to implement DHCPv6 based largely on
incorrect assumptions along this line.

It’s not helpful.

Owen

---

From: Owen DeLong <[email-masked]>
Date: Tue, 28 Sep 2021 10:20:02 -0700

> On Sep 28, 2021, at 06:14 , Nick Hilliard <[email-masked]> wrote:
> 
> So when someone is at work connecting to the company network, who needs to comply with whose policies?  Does the company abide by the employee's / user's policies, or the other way around?
> 
> Or take a more general case: if I rock up to a hosting/cloud provider or broadband access provider and instruct them that they're a great bunch of people, no really, but that they're obliged to comply with my network access policies for the set of products that they supply and I want to buy, how does that work out?

In my experience, it depends on how much of said product you want to buy.

For example, when Exodus was buying small Cisco devices by the dozens, Cisco didn’t really care what we had to say.

When we started ordering more than $5M/week in hardware, they started listening a lot more.

YMMV.

Owen