RE: draft-ietf-opsec-infrastructure-security-01 - Infrastructure Hiding

[Tony Rall <trall@almaden.ibm.com>]

On Tuesday, 2007-05-01 at 13:41 MST, "Darrel Lewis \(darlewis\)" 
<darlewis@cisco.com> wrote:
> While I have my preferences to which of the techniques I prefer, I think
> this document would be incomplete and non-usefull if we did not present
> them.  We don't need complete consensus, just rough consensus is good
> enough.

Well, you don't have my agreement.

It's fine to hide parts of your network that are truly private.  If that 
is what section 6 is about, I don't think that was made clear at all.

But it's not fine to do so for any parts that source packets to outside 
parties.

Nor is it fine to simply not send packets (prescribed in other RFCs) that 
you should be sending.

Nor is it fine to not provide forward and reverse dns for parts of the 
public Internet.

--
Tony Rall