Subject: [anonsec] Connection latching by default?

From: Nicolas Williams <[email-masked]>
Date: Thu, 10 Jan 2008 17:45:05 -0600

Solaris creates connection latches for all connected sockets by default,
whether the application requested it or not.

The just-submitted draft-ietf-btns-connection-latching-05.txt says:

                        Implementations MAY create IPsec channels
   automatically by default when the application does not request an
   IPsec channel.

But I see no reason not to make that a SHOULD.  Dan thinks it should be
a SHOULD.

Others, however, may disagree.

Comments?

Nico
-- 
_______________________________________________

---

From: Sam Hartman <[email-masked]>
Date: Mon, 14 Jan 2008 17:18:52 -0500

>>>>> "Nicolas" == Nicolas Williams <[email-masked]> writes:

    Nicolas> Solaris creates connection latches for all connected
    Nicolas> sockets by default, whether the application requested it
    Nicolas> or not.

    Nicolas> The just-submitted
    Nicolas> draft-ietf-btns-connection-latching-05.txt says:

    Nicolas>                         Implementations MAY create IPsec
    Nicolas> channels automatically by default when the application
    Nicolas> does not request an IPsec channel.

    Nicolas> But I see no reason not to make that a SHOULD.  Dan
    Nicolas> thinks it should be a SHOULD.

    Nicolas> Others, however, may disagree.

I think you need to have strong support for making it a should;
silence is not enough on this point.

---

From: Nicolas Williams <[email-masked]>
Date: Mon, 14 Jan 2008 16:46:26 -0600

> I think you need to have strong support for making it a should;

I'm asking who does support it (I know Dan does strongly support this,
and there is one implementation that does this _today_, namely Solaris).

> silence is not enough on this point.

I'm not sure that I understand what you mean by "silence is not enough
on this point" -- did I say something that indicated that silence would
be taken to denote consent?

Nico

---

From: Sam Hartman <[email-masked]>
Date: Mon, 14 Jan 2008 18:05:53 -0500

>> silence is not enough on this point.

    Nicolas> I'm not sure that I understand what you mean by "silence
    Nicolas> is not enough on this point" -- did I say something that
    Nicolas> indicated that silence would be taken to denote consent?

I mean that if you get no objections and it is just you and Dan in
favor, that's not enough to make the change in this instance.

---

From: Nicolas Williams <[email-masked]>
Date: Tue, 15 Jan 2008 01:34:36 -0600

> favor, that's not enough to make the change in this instance.

I asked for a reason :)

I don't know how many opinions we'll get.  Also, recommending that
connection latching be on by default can always be done later.

Nico