Subject: RE: [Nea] UPDATED: WG Review: Network Endpoint Assessment (nea)

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Tue, 24 Oct 2006 08:05:09 -0700

> From: Keith Moore [mailto:[email-masked]] 
 
> > My network, my rules. If you don't like them go to the 
> nearest Panera and use their free WiFi.
> > 
> > If you want to connect to my network, my rules apply. 
> That's not arbitrary, that's my right and my choice.
> 
> perhaps.  but I don't see why the IETF should provide tools 
> to help you impose those rules - especially if to do so harms 
> the flexibility of the Internet.

Because the architecture you propose is failed and unworkable.

You are still stuck in the Internet of 1980, you are like the hippie who turns up at Aldermaston for the Ban the Bomb march with a sign saying 'ban the Gattlin Gun', possibly a relevant concern if the march was being held in 1910 but utterly irrelevant to the issue of the day.

The Internet has a billion users and in the future it will be common for houses to have over a hundred network connected devices.

Very few of those hundred network connected devices will or should be Internet connected. I do not care what you think I might need but I do not want to spend my time worrying whether Mr Coffee is hacking into the fridge or the microwave is hosting a kiddie porn site.

The best way to stop such nonsense is to recognize what every mainstream security specialist working in the field recognized long ago - there is a difference between the network and the inter-network and connection to either is a privilege that should only be granted on the basis of need.

Your political strategy is naïve and fragile. You mistake a tactic for a strategy. Insisting that every component that connects to any network be absolutely unrestricted in its capabilities is unworkable, unsustainable and violates the security principle of least privilege. It is a tactic that is doomed to failure.

Your goal appears to be to ensure that individual Internet subscribers have unrestricted connectivity to the Internet. The appropriate strategy for that goal is a consumer reports type strategy, measure what is delivered, award seals of approval accordingly.

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: "Marcus Leech" <[email-masked]>
Date: Tue, 24 Oct 2006 12:04:16 -0400

> Your political strategy is naïve and fragile. You mistake a tactic for a strategy. Insisting that every component that connects to any network be absolutely unrestricted in its capabilities is unwo…
I think the problem that Keith is talking about is the problem of 
"unreasonable" policies, which will instantly create
  a "criminal" subculture in any networks that have such "unreasonable" 
policies.   For example, if the only ISPs that
  are available to me insist that the machine I connect to their 
precious network run Windows XP SP > foo, but I'm actually
  a Linux user, then techniques will emerge that allow me to fool the 
ISP into thinking that I'm a Windows XP SP > foo
  machine.

Trying to enforce that a Turing-complete machine have capabilities "no 
greater than X" might seem to an IT senior manager
  to be a really good idea, but in practical terms, it can't be done.  
And if you try to do this in any but the most tightly-purposed
  networks, rebellion will be the inevitable result.

Some companies have an emerging draconian policy about users running 
only "authorized" software on their machines, with
  a cumbersome "approvals" process for any new software that someone 
might want to run on their machine.  Which includes
  software written by the user themselves.  That type of policy might be 
"reasonable" in a call-center, or some other
  tightly-purposed network, but it fails in the general case, and true 
enforcement is impossible.  This emerging draconian
  policy is subtly re-defining that which constitutes "useful work" in 
many places such that the only authorized things
  you can do with your machine are to shuffle Word, PowerPoint, and 
Excel documents around, surf the Web,
  and e-mail  your co-workers.  If you want to do "real work", you 
necessarily have to violate policy, or do your
  "real work" on a machine not subject to the policy.

---

From: Keith Moore <[email-masked]>
Date: Tue, 24 Oct 2006 12:44:49 -0400

> Because the architecture you propose is failed and unworkable.

I didn't propose anything resembling an architecture.  and the proposal 
at hand is an anti-architecture - it's something that destroys the 
possibility of a unifying theme.

> You are still stuck in the Internet of 1980, you are like the hippie who turns up at Aldermaston for the Ban the Bomb march with a sign saying 'ban the Gattlin Gun', possibly a relevant concern if…

Phill, you are not in a very good position to be judging my character or 
trying to extrapolate what I've said into a model of how my mind works. 
  You are too stuck in your own little world to understand mine.

Keith