Subject: RE: myth of the great transition (was US Defense Department forma lly adopts IPv6)

From: "Michel Py" <[email-masked]>
Date: Thu, 19 Jun 2003 18:51:39 -0700

Keith,

>> Michel Py wrote:
>> IMHO, here is the deal: IPv4 NAT does suck, but there is
>> nothing we can do to remove it; so the only worthy
>> efforts are 1) maybe try to make it less worse (I will
>> not go as far as  saying better) and 2) let's not make
>> the same mistake with IPv6.

> Keith Moore wrote:
> that's it in a nutshell.

I'm glad we could find something to agree on.

> I believe the primary purpose of firewalls should be to
> protect the network, not the hosts, from abusive or
> unauthorized usage.

I do not agree with this. The primary purpose of firewalls is to protect
BOTH the network and the hosts.

> the firewall without the NAT would be even more useful.

No argument here, but the way it is going to happen is not by bashing at
NAT but by developing the missing piece, namely a scalable solution for
portable identifiers.

> an intermediary MUST NOT alter the source or destination
> field in an IP header.

There is nothing wrong with this if another intermediary puts it back
the way it was originally, preserving end-to-end traffic.

Michel.

---

From: Keith Moore <[email-masked]>
Date: Thu, 19 Jun 2003 22:00:48 -0400

> BOTH the network and the hosts.

the reason I disagree is that fundamentally, there's no way that a firewall
can reliably distinguish legitimate traffic from illegitimate traffic, and
there's no way that a firewall can exclude all (or in many cases even most)
threats.  to do that it would have to be smarter than the application.  a
firewall can thwart some subset of threats, or a firewall can block legitimate
traffic.  what it cannot do is remove the burden from hosts and applications
to implement reliable security.

OTOH, the network cannot expect hosts to protect it; it must protect itself.
that's why I say that the primary purpose of firewalls is to protect the
network. if the firewall can also provide security in depth for hosts, that's
useful, but that's just a backup - there's no way to have confidence in the
security of a host that relies on firewalls as its primary means of
protection. 

> the way it was originally, preserving end-to-end traffic.

if you're talking about RSIP, I don't think that's true, because IIRC it still
requires hosts and apps to be aware of addressing realms.

---

From: Harald Tveit Alvestrand <[email-masked]>
Date: Fri, 20 Jun 2003 10:39:19 +0200

--On torsdag, juni 19, 2003 22:00:48 -0400 Keith Moore <[email-masked]> 
wrote:

> the reason I disagree is that fundamentally, there's no way that a
> firewall can reliably distinguish legitimate traffic from illegitimate
> traffic, and there's no way that a firewall can exclude all (or in many
> cases even most) threats.  to do that it would have to be smarter than
> the application.

I actually agree with both of the statements that are double-quoted above...

- the primary purpose of firewalls SHOULD BE to protect the network
- the primary purpose of firewalls IS to protect the hosts

The reasoning is that I think most hosts SHOULD be hardened enough to do 
their job while standing "naked" on the network, while in the current state 
of affairs, the proportion of hosts that are capable of standing up to 
serious attacks from the Internet without the firewalls' comfort blankets 
is probably better measured as parts per million than as a percentage.

(the proportion of hosts that are able to survive serious attacks WITH the 
firewalls' help may be all the way up into single digit percentages....)

                Harald

---

From: Michael Richardson <[email-masked]>
Date: Sat, 21 Jun 2003 17:30:24 -0400

-----BEGIN PGP SIGNED MESSAGE-----

>>>>> "Keith" == Keith Moore <[email-masked]> writes:
    Keith> OTOH, the network cannot expect hosts to protect it; it must
    Keith> protect itself. that's why I say that the primary purpose of
    Keith> firewalls is to protect the network. if the firewall can also
    Keith> provide security in depth for hosts, that's useful, but that's
    Keith> just a backup - there's no way to have confidence in the 
    Keith> security of a host that relies on firewalls as its primary means of
    Keith> protection. 

  As former lead developer at an early firewall company, who made lots of
money selling firewalls before the age of the LookOut-Virus, I concur with
Keith. 

  Firewalls are about *belt and suspenders*
  They can provide auditing functions as well (and I still think that
this is the main argument for them), but firewall vendors have screwed that
up so badly, that this is now better done by dedicated IDS. 

]       ON HUMILITY: to err is human. To moo, bovine.           |  firewalls  [
]   Michael Richardson, Sandelman Software Works, Ottawa, ON    |net architect[
] [email-masked] http://www.sandelman.ottawa.on.ca/ |device driver[
] panic("Just another Debian GNU/Linux using, kernel hacking, security guy"); [