Subject: [OPSEC] Call for adoption of draft-gont-opsec-ip-options-filtering

From: Warren Kumari <[email-masked]>
Date: Thu, 24 May 2012 11:58:58 -0400

Dear Working Group,

This is to start a two week poll to adopt
   draft-gont-opsec-ip-options-filtering ( helpful link: http://tools.ietf.org/html/draft-gont-opsec-ip-options-filtering-04)
as an OpSec Working Group draft.

Please send your comments to the OpSec list ([email-masked]).

This adoption call closes on June 7th, 2012.

(This document was discussed in the Paris meeting, and not enough people had read the document to be able to predict consensus. Please take a moment (or 5) to read and comment. I should mention that Memorial Day is coming up in the US soon -- there is nothing quite so enjoyable as reading drafts on the beach -- try it!)

W

-- 
With Feudalism, it's your Count that votes.

---

From: Warren Kumari <[email-masked]>
Date: Thu, 31 May 2012 09:42:24 -0400

Dear Working Group,

We are now halfway through the call for adoption on this draft -- please take a moment to read and comment on if you support the adoption of this draft…

W
On May 24, 2012, at 11:58 AM, Warren Kumari wrote:

> _______________________________________________
> OPSEC mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/opsec
>

---

From: John Leslie <[email-masked]>
Date: Thu, 31 May 2012 14:11:36 -0400

Warren Kumari <[email-masked]> wrote:
> 
> We are now halfway through the call for adoption on this draft --
> please take a moment to read and comment on if you support the adoption
> of this draft?

   I have read it; and I am less than enthusiastic about adopting it.

   Fernando recommends dropping a lot of optioned packets, many of which
I see no particular reason to drop -- the security issues seem minor.

   If we adopt it, I suppose we'll have to argue all those -- I'd rather
pass...

--
John Leslie <[email-masked]>

---

From: Fernando Gont <[email-masked]>
Date: Thu, 31 May 2012 15:45:39 -0300

> I see no particular reason to drop -- the security issues seem minor.

Could you please list a few of such?

We've been very careful in not recommending dropping packets for which
there's a use case, and just recommended those that have been obsoleted.

Therefore, your comment kind of comes as a surprise... (but some have
been recommended to be dropped in error, we'd be happy to fix the document).

Thanks,
-- 
Fernando Gont
e-mail: [email-masked] || [email-masked]
PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1

---

From: Dave Dugal <[email-masked]>
Date: Thu, 31 May 2012 15:04:34 -0400

Hi Warren.

I have also read Fernando's draft and do see the value and benefit of
proposing a more granular approach to IP options filtering.  Many
times, the only mitigation for a particular attack or issue is to drop
all optioned packets, which depending on configuration and topology
can do more harm than good.  BCP'ing a more finely granular approach
is not without merit.

Should we adopt this draft, I do agree with previous comments that
perhaps more fine-tuning of recommended options, tradeoffs and caveats
is warranted, but that discussion can continue within the WG.

I support the adoption of this draft as an OPSEC working group document.

- ---
Dave Dugal
Sr. Product Security Incident Wrangler

On 5/31/2012 9:42 AM, Warren Kumari <[email-masked]> proclaimed ...
> please take a moment to read and comment on if you support the
> adoption of this draft…
> 
> W On May 24, 2012, at 11:58 AM, Warren Kumari wrote:
> 
>> Dear Working Group,
>> 
>> draft-gont-opsec-ip-options-filtering ( helpful link:
>> http://tools.ietf.org/html/draft-gont-opsec-ip-options-filtering-04)
>>
>> 
>> (This document was discussed in the Paris meeting, and not enough
>> people had read the document to be able to predict consensus.
>> Please take a moment (or 5) to read and comment. I should mention
>> that Memorial Day is coming up in the US soon -- there is nothing
>> quite so enjoyable as reading drafts on the beach -- try it!)
>> 
>> W
>> 
>> -- With Feudalism, it's your Count that votes.
>> 
>> 
>> _______________________________________________ OPSEC mailing
>> list [email-masked] https://www.ietf.org/mailman/listinfo/opsec
>> 
> 
> _______________________________________________ OPSEC mailing list 
> [email-masked] https://www.ietf.org/mailman/listinfo/opsec
>