Re: R41 in draft-ietf-v6ops-cpe-simple-security-07

[Rémi Denis-Courmont <remi@remlab.net>]

On Wed, 29 Jul 2009 11:36:58 +0200, james woodyatt <jhw@apple.com> wrote:

> On Jul 29, 2009, at 11:21, Iljitsch van Beijnum wrote:

>> On 29 jul 2009, at 10:22, james woodyatt wrote:

>>

>>> As long as the current treatment of IPsec AH, ESP and IKE remains

>>> in the draft as is, I have no objection as an individual

>>> contributor to removing recommendation R41.

>>

>> I do. Using IPsec may be a viable solution for a vendor who controls

>> both ends of the connection, but if I simply want to run a web

>> server in my home or be able to ssh into my systems that's not a

>> very good solution. A solution that allows applications to receive

>> incoming sessions in some automated way is much better.

> 

> Anybody want to second Iljitsch's comment?  If so, and no one objects,

> then I'll drop the proposal to remove R41 from the draft.



Either we have a way to push holes programmatically, or we have a way to

configure IPsec programmatically, or both. Currently we have neither of

them.



Just think about it. SSL/TLS is a wide success because any application can

use it. IPsec is a failure because, not only because of firewall/NATs, but

also because it is not "programmable"?



-- 

Rémi Denis-Courmont