[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Simple Security - Layered Filtering should be in the document
On 30 jul 2009, at 1:27, Gregory M. Lebovitz wrote:
if tunneling is the default avenue for building new protocols, then
you can bet the under ground economy attack authors are going to be
forming exploits on them. Which is why customers need tools that are
able to block them
Surprisingly, that doesn't necessarily follow.
What's needed is a mechanism to protect hosts from packets that:
1. They have no interest in receiving
2. Could harm them
Note that this is a weaker proposition than in a corporate
environment, where the local interest in receiving packets is not a
relevant factor. However, in a home environment we must allow users to
be stupid if they so choose.
As far as I know, there are no existing <something>-in-IPv6
encapsulations that mainstream OSes decapsulate by default. So any
encapsulated packets will be dropped on the floor by a typical Windows
or MacOS box, and as such there is no need to spend cycles to filter
them out.
if so desired
Of course going beyond what's in the draft is always a possibility,
but that has to require an explicit action by the user, we need to
have a standard level of permeability so the makers of peer-to-peer
applications have a standardized way in.
I know there is a school of thinking that says incoming packets of any
kind except ones explicitly desired by the host as shown by previous
outgoing packets are unacceptable, but the consequence of that line of
thought is that many classes of peer-to-peer applications become
impossible. In this situation, only a simultaneous open can work, and
these require a control channel and are notoriously hard to get right.
However, I would love to apply such a policy to my mailboxes, both the
electronic and dead tree types.