Subject: Re: myth of the great transition (was US Defense Department forma lly adopts IPv6)

From: Bob Braden <[email-masked]>
Date: Wed, 18 Jun 2003 12:17:05 -0700 (PDT)

*> 
  *> > If you want to address denial of service issues you need protocol
  *> > enforcement points.
  *> 
  *> NAT is a denial of service attack, not a means of policy enforcement.
  *> 
  *> 
  *> 

Keith,

I think it would be more accurate to say that a NAT contravenes
the basic Internet prnciple of universal connectivity.

Since 1980 we have believed that universal connectivity was one of the
great achievements of the Internet design.  Today, one must
unfortunately question whether universal connectivity can be sustained
(or is even the right goal) in a networking environment without
universal trust.  Maybe NATs are, in fact, a result of a very deep
problem with our architecture.  If you accept that, then there is no
point in attacking NATs until you can propose a better architectural
solution to the trust problem (hopefully, there will be one!)

Bob Braden

---

From: Keith Moore <[email-masked]>
Date: Wed, 18 Jun 2003 15:39:11 -0400

> the basic Internet prnciple of universal connectivity.

well, if we're going to try to get accurate (or even precise) I'd
venture that the basic principle being contravened is not universal
connectivity, but separation of function between the network and the
endpoints - where the network's job is to make a best effort to deliver
packets to where the endpoints want them to go.  expecting the network
to isolate insecure hosts from untrustworthy attackers, or more
generally, to enforce policy about what kinds of content are
permitted to pass, has always been a stretch.  

Keith

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Wed, 18 Jun 2003 23:16:40 +0200

On woensdag, jun 18, 2003, at 21:17 Europe/Amsterdam, Bob Braden wrote:

> universal trust.

I think we can safely say that 99.99% of all systems that run IP don't 
want to talk to 99.99% of all systems that run IP. For most people, 
with a network this large, universal connectivity isn't a goal but a 
threat. But this shouldn't be confused with universal addressability 
being undesirable, because this only gets more important as the size of 
the network increases.

> Maybe NATs are, in fact, a result of a very deep
> problem with our architecture.

Yes, that IP addresses are only 32 bits. So people decided to usurp the 
16 bit port number to create virtual 48 bit IP addresses.

> If you accept that, then there is no

What we need is a good way to limit access to systems. Firewalls look 
at addresses and port numbers, which are mostly meaningless. So people 
hide their boxes behind NATs and bastion hosts to gain some security. 
If we can solve this IPv6 will take care of the rest.

---

From: Michael Thomas <[email-masked]>
Date: Wed, 18 Jun 2003 14:32:42 -0700 (PDT)

> solution to the trust problem (hopefully, there will be one!)

I sort of wonder the same thing, but I don't draw
the major distinction with trust. In fact, NAT's
are lousy at that, unless you're talking about
NAT's qua ALG's. 

My big bugaboo here is whether the factors driving
people to want address space they control beyond
the illusion of NAT security -- mostly renumbering
immunity, IMO -- is so hard to counter with the
universal end to end model version of the world
(eg, IPv6) that addressing realms are a given and
need to be dealt with just like civil engineers
need to deal with politicians who want to put
busts of their likeness into the faces of dams,
etc.

I personally am not ready to give up on the
promise and architectural tidiness of e2e, but I
have to say as an engineer it's never a bad plan
to make certain the intertia of the world is kept
in mind. Systems which are "correct" but
undeployed are a dime a dozen in the ash heap of
history.

		Mike

---

From: Michael Thomas <[email-masked]>
Date: Wed, 18 Jun 2003 15:55:37 -0700 (PDT)

> being undesirable, because this only gets more important as the size of 

Voice challenges this assumption to a very large
degree. In fact, I not only want access to 99.99%
of the other nodes on the net willing to speak
RTP, but I most certainly don't want to be forced
to go through some forced eavesdrop-tapping,
terrorist-witchhunting intermediary that is
subject to the whims of certain fanatics from
Missouri and Utah who are convinced that peetopee
is the spawn of Satan.

	     Mike

---

From: Paul Vixie <[email-masked]>
Date: 19 Jun 2003 00:07:55 +0000

[email-masked] (Michael Thomas) writes:

> of the other nodes on the net willing to speak RTP ...

actually i think you probably don't, or rather, won't.

telemarketing by robot is illegal in some places but is
widely used to detect fax machines or voice-answered
lines for later use by other robots or by humans.  one
of the cost components for this kind of activity today
is a room full of CTI hardware and a DS1 (or better) and
a willingness to buy blocks of long distance minutes.

assuming VoIP takes off, the costs of robotic telemarketing
are going to go way way down.  in particular, it may become
popular to sweep the E164.ARPA address space looking for
endpoints, then sweep the resulting RTP endpoints looking
for live reachable instruments like humans and fax machines.

it's safe to say that the same people who call you at home
during dinner to sell you chemicals for your septic tank
are going to team up with the same people who send you spam
or who do "e-mail appending" or who spam your fax machine
with vacation offers...

...and that your RTP instrument will have to be one of the
most violently over-firewalled devices on your network in
order to remain useful for its intended (by you that is)
purpose.

maybe i should get back into the blackhole business, but for
VoIP this time, since it'll be a HUUUUGE market.
-- 
Paul Vixie

---

From: Richard Shockey <[email-masked]>
Date: Wed, 18 Jun 2003 21:35:12 -0400

>a willingness to buy blocks of long distance minutes.

Which BTW come July 1 becomes illegal in the US with the implementation of 
the Federal Trade Commission Do Not Call list.

http://www.ftc.gov/bcp/conline/edcams/donotcall/index.html

>for live reachable instruments like humans and fax machines.

I'm personally asked this all the time since I co-chair the ENUM WG. I 
think there is going to be some differences here..

A. The way the FTC DNC law was written it is transport neutral. Some of us 
are confident we can apply the law directly to ENUM enabled VoIP.

People forget that the TCPA Telephone Consumer Protection Act in the US and 
the anti junk fax laws were generally effective if a private cause of 
action was permitted. That BTW is the central issue now being debated in 
Congress in the mark up of the Burns-Wyden bill tomorrow.

http://www.spamlaws.com/federal/108s877.html

I would have loved to be able to insert into the bill a provision to make 
RFC 3261 header spoofing illegal as well.

B. The real key here in the protection of VoIP will be my ability to 
control my SIP proxy at the edge as a policy control mechanism.

Personally I would have preferred Charlie Schumers bill which would have 
had a do not spam list but it seems its not going to make it this session.

http://www.spamlaws.com/federal/108s1231.html

>VoIP this time, since it'll be a HUUUUGE market.

The Feds will beat you to market on this one...

Richard Shockey, Senior Manager, Strategic Technology Initiatives
NeuStar Inc.
46000 Center Oak Plaza  -   Sterling, VA  20166
Voice +1 571.434.5651 Cell : +1 703.593.2683,  Fax: +1 815.333.1237
<mailto:richard(at)shockey.us> or <mailto:richard.shockey(at)neustar.biz>
  <http://www.neustar.biz> ; <http://www.enum.org>
<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<

---

From: Paul Vixie <[email-masked]>
Date: Thu, 19 Jun 2003 02:45:32 +0000

> the Federal Trade Commission Do Not Call list.

which country's "federal" do you mean?

> http://www.ftc.gov/bcp/conline/edcams/donotcall/index.html

oh, that one.  i guess that means the function will have to move offshore.
THAT'll sure teach those spammers a lesson.

---

From: Vernon Schryver <[email-masked]>
Date: Wed, 18 Jun 2003 21:15:05 -0600 (MDT)

> From: Paul Vixie <[email-masked]>

> ...

The U.S. FCC wielded the TCPA with reasonable effect against the
(supposedly?) English or Canadian 21st Century "1-900 vote" junk
fax blasters.  See http://www.fcc.gov/eb/News_Releases/nrtcf.html
and http://www.fcc.gov/eb/News_Releases/nr21cen1.html

Related to what you wrote a little while ago, blackhole routes are
easier to deploy against overseas senders of junk IP packets (for most
localized notions of "overseas") than nearby spammers.  Do you get
much spam direct from China or Korea?

But what does this have to L2VPN or the IETF?

Vernon Schryver    [email-masked]

---

From: S Woodside <[email-masked]>
Date: Thu, 19 Jun 2003 00:45:53 -0400

On Wednesday, June 18, 2003, at 03:39  PM, Keith Moore wrote:

> expecting the network

So where do firewalls fit into your picture? Do they represent for the 
network or for the hosts?

simon

--
www.simonwoodside.com -- 99% Devil, 1% Angel

---

From: Einar Stefferud <[email-masked]>
Date: Wed, 18 Jun 2003 17:56:06 -0700

Hi Bob;-)...  And all;-)...

At 12:17 -0700 6/18/03, Bob Braden wrote:
>  *> Keith wrote:

Here!  Here!  Exactly --  Trust in all the people on the net all the time 
failed with the well received demise of the NSF AUP (1994) and the fact that 
misbehavior then no longer threatened loss of Internet access privileges.

This was not widely recognized as a possible at the time, much like the 
fact that the Internet has no center and hence has no place to locate a 
"Central Control Center" which is another contributor to the loss of trust, 
and which prohibits solving the trust problem with centralized enforcement 
of rules of trust, if any such rules might possibly exist.

This of course is one reason why PKIX is not able to deliver public trust, 
because PKIX requires a single Central Control Center to enforce rules of 
trust (whatever those rules might be), and we have already discussed how it 
is that PKIX CA's suffer from lack of trust induction among their users.

So, one fundamental issue in this whole situation is that the basic "Internet 
Operational Model" that underlays these aspects being discussed here is not a 
realistic model for situations with no available "Center".

I model the Internet more accurately with our present International Economy, 
where again, there is NO CENTER, and thus no place to locate a control center 
for that economy.  The decisions that drive the economy depend on interpersonal 
trust which is developed via multiple channels of information flow derived 
from many different communication paths.  

Trust is only derived from accumulated information obtained from multiple 
channels of information flow.

In the U.S. there is no central control for the National Economy.  And, I have 
been saying for years that pretty much every one that ever had a centrally 
controlled Economy, by now wishes they did not have one.  Even China is 
working its way as carefully as possible to become a free economy, trying 
to avoid the collapse that Russia experienced during such a period of change.

The Internet did it like Russia did it, without understanding that it was 
happening and not dealing with the need for new trust induction tools and 
processes.

So, I think all of you out there will agree that we do not want a return to 
a centrally controlled Internet, even if we could have one, so let's stop 
pretending that such a thing can exist, and start working on ways to induce 
trust among ourselves for all of our own private reasons to have trust among 
us in this "uncontrolled space".

Many hark back to the good old days of the trusted users of he ARPAnet, but 
those days are long gone, when we all had to worry about losing our access 
privileges.  I very well recall my efforts to retain my privileges over those 
years of serving as an independent consultant with no permanent sponsor!

Serving as the "Moderator" of MsgGroup for 11 years from 1975-1986 helped to 
carry me along until 1987 when NSFnet made it easier for me to manage.

From my management consulting experience along the way, I strongly recommend 
that we learn to live together in our "open information economy" and avoid 
attempts to apply central controls to build mutual trust.  

The Internet is a Internetwork of Internets.  It is not a network!

To repeat, it has no center, and further, does not even have any edges.

It is just a manifold of information transit pipes, each of which can be made 
to communicate with any other transmission pipe, by taking appropriate actions,
without permission from any central governing agency!  Not even ICANNic.

Cheers...\Stef;-)...

---

From: Paul Vixie <[email-masked]>
Date: 19 Jun 2003 06:09:05 +0000

> To repeat, it has no center, and further, does not even have any edges.

that's not a useful vocabulary.  try this one:

   1 - Connection Taxonomy

   1.1. The Internet is a "network of networks", where the component
   networks are called Autonomous Systems (AS), each having a unique AS
   Number (ASN).

   1.2. Connections inside an AS are called "Interior" (or sometimes
   "backbone"), and their security policies are set according to local
   needs, usually based on business or technical requirements.

   1.3. Connections between ASs are called "Border" (or sometimes
   "peering"), and their security policies are set bilaterally according to
   the joint needs of the interconnecting parties.

   1.4. Connections between an AS and its traffic sources (generators) and
   traffic sinks (consumers) are called "Edge" (or sometimes "customer"),
   and their security policies are generally, by long standing tradition,
   inconsistent.

that's from http://www.icann.org/committees/security/sac004.txt, fyi.
-- 
Paul Vixie

---

From: Paul Vixie <[email-masked]>
Date: 19 Jun 2003 06:13:53 +0000

> much spam direct from China or Korea?

before i started adding /8's to my personal mail filtering system, i used
to get a hell of a lot of direct spam from chinanet customers.  nowadays
i get very little direct spam from china or korea, just a lot of open proxy
and open relay spam.  so, i see your point.

i guess where this has to lead to is respected and enforced treaties
involving property and privacy, which is like saying everything will be
OK once we invent faster than light communications.

> But what does this have to L2VPN or the IETF?

now that, i just don't know.  i was just walking by and smelled the fire.
-- 
Paul Vixie

---

From: Keith Moore <[email-masked]>
Date: Thu, 19 Jun 2003 05:44:49 -0400

> network or for the hosts?

I believe the primary purpose of firewalls should be to protect the network,
not the hosts, from abusive or unauthorized usage.

---

From: Peter Deutsch <[email-masked]>
Date: Thu, 19 Jun 2003 08:04:51 -0700

> not the hosts, from abusive or unauthorized usage.

So for every firewall you purchase and install, you can focus its
configuration and operation on protecting the network from your users. I
trust you agree that it's appropriate for the rest of the world to be
free to make similar decisions in what they choose to be their own
perceived best interest? And I hope you'll not be *too* surprised when
the vast majority decide that protecting their own machines from the
network is more important than protecting the network from their own
machines...

				- peterd (CMBD)

---

From: Richard Shockey <[email-masked]>
Date: Thu, 19 Jun 2003 11:18:46 -0400

>THAT'll sure teach those spammers a lesson.

Remember Paul ..the issue in most of these laws is to go after the company 
offering the products, porn, whatever _via_ spam.

The spam in most cases is trying to induce you to buy something ..they have 
to give out some site that collects a credit card or phone number for 
contact or something that is clearly traceable. That the spam itself was 
sent from a open relay in Pakistan makes no difference .. if the company 
offering the stuff has a nexus in the US bank account etc it can be traced 
and prosecuted.

---

From: Keith Moore <[email-masked]>
Date: Thu, 19 Jun 2003 11:20:15 -0400

> > I believe the primary purpose of firewalls should be to protect the
> > network, not the hosts, from abusive or unauthorized usage.
> 
> perceived best interest? 

we're talking about different things.  I'm talking about architecture and
specifically what separation of function/responsibility between firewalls and
the network would allow both security and flexibility to be maximized.
you're talking about decisions that people make between products that work
with (or against) the existing architecture.

---

From: Paul Vixie <[email-masked]>
Date: Thu, 19 Jun 2003 15:33:40 +0000

> Remember Paul ..the issue in most of these laws is to go after the
> company offering the products, porn, whatever _via_ spam.

and when they are syn-scanning me from outside the us i can tell who
their client is how?

and when the robot calls back asking me to hold on the line for a human
operator, exactly what law is being broken?

here's the broken record, one more time.  if you build a worldwide
communications infrastructure, you should expect it to get Used.