Subject: Re: ietf hosts

From: [email-masked] (Vernon Schryver)
Date: Sun, 14 Dec 1997 22:13:56 -0700

> From: Scott Bradner <[email-masked]>                                

> > We don't necessarly need a switch port for each drop.
> 
> though it is nice to avoid some of the LAN sniffing threats

What threats are those?  It's not as if there are not plenty of attacks
that the privacy curtain of a bridge cannot protect against.  (eg. games
using ARP, ICMP redirects, Router Discovery, RIP, DHCP, or BOOTP)

It's also not as if the terminal room LAN is the only place in the path
home that you ought to be worried about sniffers, if you are doing
anything that gives justifies worrying about sniffers in the first place.

I think it's not polite for a guest to expect that the host provide
more security than can be found on the public streets.  Your data
security should be your own responsibility, along with any special
medical or dietary requirements.  If you need armed guards or secret
service agents because you are so rich, famous, or powerful, then you
should also bring them instead of relying on the host.

Vernon Schryver,  [email-masked]

P.S. the psuedo-security of bridges and FDDI encyphering concentrators
 is one of my pet peeves.  What they offer is equivalent to the privacy
 you get with one of those bedroom/bathroom locks, the kind with the
 little hole on the outside knob for overriding the lock.  They provide
 privacy like curtains instead of security like real locks.  Such
 privacy is worthwhile, but it has little to do with security.  In
 fact, privacy is useful to the bad guys for hiding their activities.

---

From: Randy Bush <[email-masked]>
Date: Sun, 14 Dec 97 21:51 PST

maybe it is not widely known, but the dc terminal room was successfully
smurfed for a number of hours until steven stuart noticed and jeff studds
put in anti-smurf on the border cisco.

randy