|
North American Network Operators Group Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical Re: dsl providers that will route /24
On Wed, Mar 28, 2001, David Schwartz wrote: > > > > No, no, no. You are erring on the side of openness, rather than on the > > side of security. > > Exactly! And that's the crux of the issue here. > > We are not talking about a firewall. We are not talking about a military > installation. We are talking about our customers, and we should be taking an > 'innocent until proven guilty' approach with them whenever it is reasonably > possible to do so. .. on todays internet? Right. You've never been hit by a DoS. That you can't trace. My cable modem provider filters. Good on them. It means that when I set up my tunnel for my "portable /24", I had to think hard for 5 minutes to convince FreeBSD's ipfw that it wanted to stuff all packets from my /24 out the tunnel, rather than just defaulting. <irony> It was really hard. Really. </irony> > What I also oppose is advocacy of filtering that claims that filtering > fixes the problem. It doesn't, it just minimizes the damage. Hiding the fact > that a misconfigured firewall is leaking packets with inside IPs or the fact > that a machine has been root compromised (or worse, that the actual admin > likes to launch DoS attacks) ultimately harms everyone. The internet is misconfigured. The internet is designed around a trusted non-authenticated layer 3, and this layer can be used for good *AND* evil. Now if only responsible people were allowed on said internet, then the lack of protection wouldn't be an issue. Do you remember the Great SMTP Relay Closing a few years ago? The relays were open, until people started using them for increasing amounts of spam. Now, us Responsible People(tm) knew that open relays were great for when you were roaming or your outgoing relay was broken, but now ..? > Another problem with the belief that ingress source address filtering is > the ultimate solution to the problem of spoofed packets is that it makes it > too easy to ignore the fact that there really is a problem. After all, if > filtering solves the problem perfectly, there's no need to work on a > solution, all you have to do is militantly insist that everyone filter. On > the other hand, if there's a general understanding that filtering is only > one possible solution that has problems of its own, perhaps they'll continue > to work on much better solutions. Enforce filtering, or replace the internet infrastructure with something better? Guess whats a better choice technically, guess whats got a better choice of happening[0] ? Adrian [0] With the attitude people have for filtering, I guess neither. ;-) -- Adrian Chadd "The fact you can download a 100 megabyte file <[email protected]> from half way around the world should be viewed as an accident and not a right." -- Adrian Chadd and Bill Fumerola
|