Subject: RE: myth of the great transition (was US Defense Department forma lly adopts IPv6)

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Wed, 18 Jun 2003 15:02:29 -0700

That is how we got here. Ignore it, hope it will go away.

What I am suggesting is that there is no reason nat had to reusult in being
on the interNOT rather than the internet.

Further folk are going to buy these and put them at the border of their home
networks. 

Trying to secure end point computers is futile. There will always be holes,
the attackers only need to own one percent of the internet to be able to
create havoc.

I note also that even though linux boxes are not a large percentage of net
they are prime targets for hackers. I suspect because they tend to be
connected to unrestircted dsl lines more often than capability limited cable
modems.

If I dot run a local mail server why should I let a machine have
unrestricted net access if it does not need it? Why allow one of my machines
to syn flood? Present a smaller prize to the hackers and you are less likely
to have severe problems.

End to end only security dogma is like saying buildings should be fireproof
and sprikler systems are evil and unnecessary

 -----Original Message-----
From: 	Putzolu, David
Sent:	Wed Jun 18 13:59:43 2003
To:	'Keith Moore'; Hallam-Baker, Phillip
Cc:	[email-masked]; [email-masked]; [email-masked];
[email-masked]
Subject:	RE: myth of the great transition (was US Defense Department
forma lly adopts IPv6)

> NAT is a denial of service attack, not a means of policy enforcement.

I wonder if NAT is to ietf discussions as Nazis was 
to Usenet discussions.

That is, will every heated IETF debate eventually lead to
invoking the NAT bogyman?

And if that where to be true, would the corollary apply
that the discussion is no longer fruitful?

Cheers,
David

---

From: Keith Moore <[email-masked]>
Date: Wed, 18 Jun 2003 18:37:10 -0400

> What I am suggesting is that there is no reason nat had to reusult in
> being on the interNOT rather than the internet.

you're simply wrong about that, at least for anything resembling today's
NATs.   except for a shortage of IPv4 addresses, NATs would not be
needed at all.  (yes, they're sold for other purposes, but they're
not needed for those purposes)  and there's no way to fix that shortage
in a sane fashion (or as you put it, without producing the interNOT)
that does not require changes to the endpoints - and in many cases, the
applications - to make them work. once you do that you're within epsilon
of the deployment barrier to IPv6.  (had IPv6 been designed
differently we might have been able to avoid having those changes affect
the network core, but not leaf networks or endpoints.)

> Further folk are going to buy these and put them at the border of
> their home networks. 

yup, and there will continue to be vendors selling snake oil.  it's not
our problem.

> Trying to secure end point computers is futile.

it's even more futile to expect the network to do it.  firewalls can
raise the bar for some kinds of threats, but they can't make your
insecure systems secure.

> unrestricted net access if it does not need it? 

no reason that I know of.  but the relevant question for this dicussion
is, why do you need a NAT to impose access control?  answer: you don't.

---

From: "Eric A. Hall" <[email-masked]>
Date: Wed, 18 Jun 2003 19:57:35 -0500

on 6/18/2003 5:37 PM Keith Moore wrote:

> you're simply wrong about that, at least for anything resembling
> today's NATs.  except for a shortage of IPv4 addresses, NATs would not
> be needed at all.

...and a routing grid that could handle a squared table size. No use in
opening allocations to everybody that can justify ~/29 if filters are
still going to be dropping everything after /20.

-- 
Eric A. Hall                                        http://www.ehsco.com/
Internet Core Protocols          http://www.oreilly.com/catalog/coreprot/