Subject: Re: [OPSEC] Request for opions on accepting draft-gont-opsec-ip-security-01 as a working group document (fwd)

From: Andrew Yourtchenko <[email-masked]>
Date: Thu, 15 Jan 2009 13:04:03 +0100 (CET)

Hi all,

It's my first activity on OPSEC, and I was a tad late to react - so 
initially sent unicast, but forwarding to the list now nonetheless FYI.

thanks,
andrew

---------- Forwarded message ----------
Date: Wed, 14 Jan 2009 19:54:34 +0100 (CET)
From: Andrew Yourtchenko <[email-masked]>
To: Joel Jaeggli <[email-masked]>
Cc: Fernando Gont <[email-masked]>
Subject: Re: [OPSEC] Request for opions on accepting
     draft-gont-opsec-ip-security-01 as a working group document

Hello Joel,

I've been only reading the mails on the WG up till now, so, given my very late 
reaction - not sure if it is still OK to send the opinion now - unicasting..

In my opinion this work is definitely something that should be adopted by the 
WG for further review and discussion.

To illustrate - one point, which rose upon a quick scan of the document:

With my security hat on, the trivially incrementing IP ID is obviously a Bad 
Thing(tm).

With my digger-debugger hat on, the trivially incrementing IP ID within the 
session more than once allowed to spot a misbehaving middlebox unknown to be 
there and save some real pain to real customers.
>From this operational perspective, the incrementing ID is a good property 
because it provides an ephemeral "identity" to the endpoint besides the easily 
spoofable IP address - hence allows to detect the latter.

So I think there might be more than just black and white, and it might be 
useful to discuss.

If the document gets adopted, I volunteer to review it in more detail.

thanks,
andrew

On Thu, 1 Jan 2009, Joel Jaeggli wrote:

>  I trust everyone had a eventful new year and I hope that for the sake of
>  our industry the next six months doesn't look worse than the previous
>  six months.
>
>  Working from the the action items it's time to test consensus on accepting;
>
>  draft-gont-opsec-ip-security-01
>
>  http://tools.ietf.org/html/draft-gont-opsec-ip-security-01
>
>  as a working group document.
>
>  Commentary will be accepted through Friday January 9th.
>
>  Thanks
>  Joel
>  _______________________________________________
>  OPSEC mailing list
>  [email-masked]
>  https://www.ietf.org/mailman/listinfo/opsec
>
_______________________________________________
OPSEC mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/opsec