RE: direct tunneling vs site's control [RE: POLL: Consensus for moving forward with Teredo?]

["Christian Huitema" <huitema@windows.microsoft.com>]

> That is the end result (loss of manageability) but the root cause was
> permitting hard coded prefixes in the network.

I believe the root cause is using unmanaged hosts in a context where
secure behavior is expected. If you want to assert security properties
of the hosts, then you absolutely need to manage them and control what
kind of software they run. Otherwise, even without Teredo and 6to4, it
is pretty trivial to set up an IPv6 tunnel to some random place.

-- Christian Huitema