From nobody Mon Sep 7 12:49:42 2015 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7FB601A8706 for ; Mon, 7 Sep 2015 12:49:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.91 X-Spam-Level: X-Spam-Status: No, score=-1.91 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eRokUepRfSnC for ; Mon, 7 Sep 2015 12:49:40 -0700 (PDT) Received: from nagasaki.bogus.com (nagasaki.bogus.com [IPv6:2001:418:1::81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 672E21A6F67 for ; Mon, 7 Sep 2015 12:49:40 -0700 (PDT) Received: from mb.local (c-98-248-47-249.hsd1.ca.comcast.net [98.248.47.249]) (authenticated bits=0) by nagasaki.bogus.com (8.14.9/8.14.9) with ESMTP id t87JncXB001772 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES128-SHA bits=128 verify=NOT); Mon, 7 Sep 2015 19:49:39 GMT (envelope-from joelja@bogus.com) To: "opsec@ietf.org" , opsec chairs References: <55E473D2.6050503@bogus.com> From: joel jaeggli Message-ID: <55EDEA4B.4010401@bogus.com> Date: Mon, 7 Sep 2015 12:49:31 -0700 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:40.0) Gecko/20100101 Thunderbird/40.0 MIME-Version: 1.0 In-Reply-To: <55E473D2.6050503@bogus.com> Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="CvNCGdAWixPBM9M5uvuqq97Par1ChiNW7" Archived-At: Subject: Re: [OPSEC] Seeking volunteers - opsec w.g. co-chair. X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 07 Sep 2015 19:49:41 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --CvNCGdAWixPBM9M5uvuqq97Par1ChiNW7 Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: quoted-printable Thanks! I have several replies. Gunter and I will confer, and we'll be in touch over the next couple day= s. joel On 8/31/15 8:33 AM, joel jaeggli wrote: > Folks, >=20 > We have have a vacancy for the role of opsec co-chair serving alongside= > gunter. Opsec interest and involvement has varried by interest and > intensity over time. In the interest of finding someone currently > interested in the topic I figured I would solicit volunteers. If you're= > interested and have the time (opsec is a fairly low intensity wg) > please contact me offlist and we'll amke a decision in a couple of week= s. >=20 > thanks > joel >=20 >=20 >=20 > _______________________________________________ > OPSEC mailing list > OPSEC@ietf.org > https://www.ietf.org/mailman/listinfo/opsec >=20 --CvNCGdAWixPBM9M5uvuqq97Par1ChiNW7 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2 Comment: GPGTools - http://gpgtools.org iEYEARECAAYFAlXt6kwACgkQ8AA1q7Z/VrKxlQCfahB/G2LME8oVWihQG/vScB8b i2oAn2lQ2mwS/ClHKdKhl365nIxGIX5N =dJKO -----END PGP SIGNATURE----- --CvNCGdAWixPBM9M5uvuqq97Par1ChiNW7-- From nobody Wed Sep 9 12:10:31 2015 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 188671B4038; Wed, 9 Sep 2015 12:10:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ThpuzQVD9acw; Wed, 9 Sep 2015 12:10:29 -0700 (PDT) Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 19DA21B4051; Wed, 9 Sep 2015 12:10:29 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: X-Test-IDTracker: no X-IETF-IDTracker: 6.4.1 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <20150909191029.12932.74558.idtracker@ietfa.amsl.com> Date: Wed, 09 Sep 2015 12:10:29 -0700 Archived-At: Cc: opsec@ietf.org Subject: [OPSEC] I-D Action: draft-ietf-opsec-v6-07.txt X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.15 List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 09 Sep 2015 19:10:31 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Operational Security Capabilities for IP Network Infrastructure Working Group of the IETF. Title : Operational Security Considerations for IPv6 Networks Authors : Kiran K. Chittimaneni Merike Kaeo Eric Vyncke Filename : draft-ietf-opsec-v6-07.txt Pages : 43 Date : 2015-09-09 Abstract: Knowledge and experience on how to operate IPv4 securely is available: whether it is the Internet or an enterprise internal network. However, IPv6 presents some new security challenges. RFC 4942 describes the security issues in the protocol but network managers also need a more practical, operations-minded document to enumerate advantages and/or disadvantages of certain choices. This document analyzes the operational security issues in all places of a network (enterprises, service providers and residential users) and proposes technical and procedural mitigations techniques. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-opsec-v6/ There's also a htmlized version available at: https://tools.ietf.org/html/draft-ietf-opsec-v6-07 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-opsec-v6-07 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Fri Sep 11 14:38:49 2015 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 349AD1B3FB1; Fri, 11 Sep 2015 14:38:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -101.9 X-Spam-Level: X-Spam-Status: No, score=-101.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, USER_IN_WHITELIST=-100] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SMAw8MMyDYiN; Fri, 11 Sep 2015 14:38:46 -0700 (PDT) Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 74AE81B4327; Fri, 11 Sep 2015 14:38:41 -0700 (PDT) Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit From: The IESG To: "IETF-Announce" X-Test-IDTracker: no X-IETF-IDTracker: 6.4.1 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <20150911213841.24313.36257.idtracker@ietfa.amsl.com> Date: Fri, 11 Sep 2015 14:38:41 -0700 Archived-At: Cc: opsec mailing list , opsec chair , RFC Editor Subject: [OPSEC] Document Action: 'Network Reconnaissance in IPv6 Networks' to Informational RFC (draft-ietf-opsec-ipv6-host-scanning-08.txt) X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.15 List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 11 Sep 2015 21:38:47 -0000 The IESG has approved the following document: - 'Network Reconnaissance in IPv6 Networks' (draft-ietf-opsec-ipv6-host-scanning-08.txt) as Informational RFC This document is the product of the Operational Security Capabilities for IP Network Infrastructure Working Group. The IESG contact persons are Benoit Claise and Joel Jaeggli. A URL of this Internet Draft is: https://datatracker.ietf.org/doc/draft-ietf-opsec-ipv6-host-scanning/ Technical Summary IPv6 offers a much larger address space than that of its IPv4 counterpart. An IPv6 subnet of size /64 can (in theory) accommodate approximately 1.844 * 10^19 hosts, thus resulting in a much lower host density (#hosts/#addresses) than is typical in IPv4 networks, where a site typically has 65,000 or less unique addresses. As a result, it is widely assumed that it would take a tremendous effort to perform address scanning attacks against IPv6 networks, and therefore brute-force IPv6 address scanning attacks have been considered unfeasible. This document updates RFC 5157, which first discussed this assumption, by providing further analysis on how traditional address scanning techniques apply to IPv6 networks, and exploring some additional techniques that can be employed for IPv6 network reconnaissance. In doing so, this document formally obsoletes RFC 5157. Working Group Summary No controversy. Document went pretty smooth in the WG Document Quality The content is Informational experience and hence require no vendor implementation. Personnel Document Shepherd: Gunter Van de Velde Responsible Area AD: Joel Jaeggli RFC Editor Note From nobody Mon Sep 14 00:24:17 2015 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A845B1A1ABE for ; Mon, 14 Sep 2015 00:24:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id q_Qn9zYaqXeD for ; Mon, 14 Sep 2015 00:24:13 -0700 (PDT) Received: from st13p11im-asmtp004.me.com (st13p11im-asmtp004.me.com [17.164.40.219]) (using TLSv1.2 with cipher DHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 32B0C1A8766 for ; Mon, 14 Sep 2015 00:24:13 -0700 (PDT) Received: from st13p11im-spool003.me.com ([17.164.40.212]) by st13p11im-asmtp004.me.com (Oracle Communications Messaging Server 7.0.5.35.0 64bit (built Mar 31 2015)) with ESMTP id <0NUN00C4ROKBAE40@st13p11im-asmtp004.me.com> for opsec@ietf.org; Mon, 14 Sep 2015 07:24:12 +0000 (GMT) X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:,, definitions=2015-09-14_01:,, signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 kscore.is_bulkscore=0 compositescore=0.999141884866228 phishscore=0 kscore.is_spamscore=0 rbsscore=0.999141884866228 recipient_to_sender_totalscore=0 spamscore=0 urlsuspectscore=0.999141884866228 adultscore=0 kscore.compositescore=0 circleOfTrustscore=0 suspectscore=1 recipient_domain_to_sender_totalscore=0 bulkscore=0 recipient_domain_to_sender_domain_totalscore=0 recipient_to_sender_domain_totalscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1412110000 definitions=main-1509140137 MIME-version: 1.0 Content-type: multipart/alternative; boundary="Boundary_(ID_V0rByUEc1ifIeIiFGcyAQA)" Received: from localhost ([17.164.40.63]) by st13p11im-spool003.mac.com (Oracle Communications Messaging Server 7.0.5.35.0 64bit (built Mar 31 2015)) with ESMTP id <0NUN0032AOKB1I60@st13p11im-spool003.mac.com> for opsec@ietf.org; Mon, 14 Sep 2015 07:24:11 +0000 (GMT) To: opsec@ietf.org From: Gunter Van De Velde Date: Mon, 14 Sep 2015 07:24:12 +0000 (GMT) X-Mailer: iCloud MailClient15E.bfdff5b MailServer15E43.20056 X-Originating-IP: [195.207.101.112] Message-id: <21c8d05c-f355-41a4-ae5b-89dad9686a05@me.com> References: <55EE8A1B.3030903@cisco.com> Archived-At: Subject: [OPSEC] Fwd: Fwd: NomCom 2015: Call for nominations X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 14 Sep 2015 07:24:15 -0000 --Boundary_(ID_V0rByUEc1ifIeIiFGcyAQA) Content-type: text/plain; charset=utf-8; format=flowed Content-transfer-encoding: quoted-printable Hi All,=0A=0APlease find this important NOMCOM message asking for your sup= port.=0A=0ABrgds,=0AG/=0A=0ASent from iCloud=0A=0A=0A-------- Forwarded Me= ssage --------=0ASubject: =C2=A0NomCom 2015: Call for nominations=0ADate: = =C2=A0 =C2=A0 =C2=A0Wed, 26 Aug 2015 03:13:13 -0700=0AFrom: =C2=A0NomCom C= hair 2015 =0AReply-To: =C2=A0 =C2=A0 =C2=A0 =C2= =A0ietf@ietf.org, nomcom15@ietf.org=0ATo: =C2=A0 =C2=A0 =C2=A0 =C2=A0IETF = Announcement List =0ACC: =C2=A0 =C2=A0 =C2=A0ietf@= ietf.org=0A=0A=0A=0AThe 2015-16 Nominating Committee (Nomcom) is seeking n= ominations from=0Anow until October 8, 2015. The open positions being cons= idered by this=0Ayear's Nomcom can be found at the end of this email and a= lso on this=0Ayear's Nomcom website:=0A=0Ahttps://datatracker.ietf.org/nom= com/2015/=0A=0ANominations may be made by selecting the Nominate link at t= he top of=0Athe Nomcom 2015 home page, or by visiting the following URL:=0A= =0Ahttps://datatracker.ietf.org/nomcom/2015/nominate/=0A=0A{Note that nomi= nations made using the web tool require an ietf.org=0Adatatracker account.= You can create a datatracker ietf.org account=0Aif you don't have one alr= eady by visiting the following URL:=0Ahttps://datatracker.ietf.org/account= s/create/ }=0A=0AIf you are unable to use the web form, nominations may in= stead be made=0Aby email tonomcom15@ietf.org. If using email, please inclu= de the word=0A"Nominate" in the Subject and indicate in the email who is b= eing=0Anominated, their email address (to confirm acceptance of the=0Anomi= nation), and the position for which you are making the nomination.=0AIf yo= u are nominating someone other than yourself, please tell us if=0Awe may t= ell the nominee that you were the one who made the nomination.=0AIf you wi= sh to nominate someone via email for more than one position,=0Aplease use = separate emails to do so.=0A=0ASelf-nomination is welcome!=0A=0ANomCom 201= 5-16 will follow the policy for "Open Disclosure of Willing=0ANominees" de= scribed in BCP 10/RFC 7437. As stated in RFC 7437: "The=0Alist of nominees= willing to be considered for positions under review=0Ain the current Nomc= om cycle is not confidential". Willing nominees for=0Aeach position will b= e listed in a publicly accessible way - anyone=0Awith a datatracker accoun= t may access the lists. Additionally, the=0Anomination form asks if we may= share your own name with the=0Anominee. In all other ways, the confidenti= ality requirements of BCP10=0Aremain in effect. All feedback and all Nomco= m deliberations will=0Aremain confidential and will not be disclosed.=0A=0A= There is a field on the form you can mark in order to allow the Nomcom=0At= o tell the nominee that you were the one who made the=0Anomination. This i= s a new thing this year, and it defaults to =E2=80=9Cno=E2=80=9D -=0Awe wo= n=E2=80=99t tell. After the nomination cycle, we will evaluate the result=0A= of this and recommend whether the next Nomcom should do something=0Adiffer= ent.=0A=0AIn order to ensure time to collect sufficient community feedback= about=0Aeach of the willing nominees, nominations must be received by the= =0ANomcom on or before October 8, 2015.=0A=0APlease submit your nomination= s as early as possible for the sake of=0Ayour nominees. Note that nominati= ons should not wait for management=0Apermission, as it is easier to declin= e the nomination than put one in=0Alate. We have set the questionnaire sub= mission deadline for October=0A15, 2015.=0A=0AThe Nomcom appoints individu= als to fill the open slots on the IAOC,=0Athe IAB, and the IESG. The list = of people and posts whose terms end=0Awith the March 2016 IETF meeting, an= d thus the positions for which=0Athis Nomcom is responsible, follows:=0A=0A= IAB:=0A* Mary Barnes=0A* Joe Hildebrand=0A* Ted Hardie=0A* Erik Nordmark=0A= * Brian Trammell=0A* Mark Blanchet=0A=0AIESG:=0A- Alissa Cooper, ART=0A- B= arry Leiba, ART=0A- Brian Haberman, Internet (*)=0A- Benoit Claise, O&M=0A= - Alia Atlas, Routing=0A- Kathleen Moriarty, Security=0A- Martin Stiemerli= ng, Transport (*)=0A=0A*- have indicated that they do not intend to accept= a=0Arenomination. This information is always up to date on=0Ahttps://data= tracker.ietf.org/nomcom/2015/=0A=0APlease be resourceful in identifying po= ssible candidates for these=0Apositions, as developing our talent is a ver= y crucial requirement for=0Athe IETF, and also, please consider accepting = a nomination. You'll=0Afind extensive information about specific positions= , developed by the=0AIAB, IESG, and IAOC, under individual tabs at:=0A=0Ah= ttps://datatracker.ietf.org/nomcom/2015/requirements/=0A=0AIn addition to = nominations, the Nomcom seeks community input on the=0Apositions themselve= s. We need and welcome the community's views and=0Ainput on the jobs withi= n each organization. If you have ideas on the=0Apositions' responsibilitie= s (more, less, different), please let us=0Aknow.=0A=0APlease send suggesti= ons and feedback about this tonomcom15@ietf.org.=0A=0AThank you for your h= elp in identifying qualified nominees!=0A=0AHarald Alvestrand=0ANomcom Cha= ir 2015-16=0Anomcom-chair-2015@ietf.org,hta+nomcom@alvestrand.no=0A= --Boundary_(ID_V0rByUEc1ifIeIiFGcyAQA) Content-type: multipart/related; boundary="Boundary_(ID_UbJt4lklVl7+jpd56Rm+Cw)"; type="text/html" --Boundary_(ID_UbJt4lklVl7+jpd56Rm+Cw) Content-type: text/html; charset=utf-8 Content-transfer-encoding: quoted-printable
Hi All,

Please find this important NOMCOM mes= sage asking for your support.

Brgds,
G/

Sent from iCloud

<= span class=3D"body-text-content">
-------- Forwarded Message --------Subject:  NomCom 2015: Call for nominations
Date:     =  Wed, 26 Aug 2015 03:13:13 -0700
From:  NomCom Chair 2015 <= ;nomcom-chair-2015@ietf.org>
Reply-To:        ie= tf@ietf.org, nomcom15@ietf.org
To:        = ;IETF Announcement List <ietf-announce@ietf.org>
CC:    = ;  ietf@ietf.org



The 2015-16 Nominating Committee (Nom= com) is seeking nominations from
now until October 8, 2015. The open po= sitions being considered by this
year's Nomcom can be found at the end = of this email and also on this
year's Nomcom website:

https://datatracker.ietf.org/nomcom/2015/

Nominations may be made by selecting the Nominate link at the top= of
the Nomcom 2015 home page, or by visiting the following URL:
https://datatra= cker.ietf.org/nomcom/2015/nominate/

{Note that nominations mad= e using the web tool require an ietf.org
datatracker account. You can create a d= atatracker i= etf.org account
if you don't have one already by visiting the foll= owing URL:
https://dat= atracker.ietf.org/accounts/create/ }

If you are unable to use t= he web form, nominations may instead be made
by email tonomco= m15@ietf.org. If using email, please include the word
"Nominate" in= the Subject and indicate in the email who is being
nominated, their em= ail address (to confirm acceptance of the
nomination), and the position= for which you are making the nomination.
If you are nominating someone= other than yourself, please tell us if
we may tell the nominee that yo= u were the one who made the nomination.
If you wish to nominate someone= via email for more than one position,
please use separate emails to do= so.

Self-nomination is welcome!

NomCom 2015-16 will follow = the policy for "Open Disclosure of Willing
Nominees" described in BCP 1= 0/RFC 7437. As stated in RFC 7437: "The
list of nominees willing to be = considered for positions under review
in the current Nomcom cycle is no= t confidential". Willing nominees for
each position will be listed in a= publicly accessible way - anyone
with a datatracker account may access= the lists. Additionally, the
nomination form asks if we may share your= own name with the
nominee. In all other ways, the confidentiality requ= irements of BCP10
remain in effect. All feedback and all Nomcom deliber= ations will
remain confidential and will not be disclosed.

There= is a field on the form you can mark in order to allow the Nomcom
to te= ll the nominee that you were the one who made the
nomination. This is a= new thing this year, and it defaults to =E2=80=9Cno=E2=80=9D -
we won=E2= =80=99t tell. After the nomination cycle, we will evaluate the result
o= f this and recommend whether the next Nomcom should do something
differ= ent.

In order to ensure time to collect sufficient community feedba= ck about
each of the willing nominees, nominations must be received by = the
Nomcom on or before October 8, 2015.

Please submit your nomi= nations as early as possible for the sake of
your nominees. Note that n= ominations should not wait for management
permission, as it is easier t= o decline the nomination than put one in
late. We have set the question= naire submission deadline for October
15, 2015.

The Nomcom appoi= nts individuals to fill the open slots on the IAOC,
the IAB, and the IE= SG. The list of people and posts whose terms end
with the March 2016 IE= TF meeting, and thus the positions for which
this Nomcom is responsible= , follows:

IAB:
* Mary Barnes
* Joe Hildebrand
* Ted Hardi= e
* Erik Nordmark
* Brian Trammell
* Mark Blanchet

IESG:- Alissa Cooper, ART
- Barry Leiba, ART
- Brian Haberman, Internet= (*)
- Benoit Claise, O&M
- Alia Atlas, Routing
- Kathleen Mo= riarty, Security
- Martin Stiemerling, Transport (*)

*- have ind= icated that they do not intend to accept a
renomination. This informati= on is always up to date on
http= s://datatracker.ietf.org/nomcom/2015/

Please be resourceful in = identifying possible candidates for these
positions, as developing our = talent is a very crucial requirement for
the IETF, and also, please con= sider accepting a nomination. You'll
find extensive information about s= pecific positions, developed by the
IAB, IESG, and IAOC, under individu= al tabs at:

https://datatracker.ietf.org/nomcom/2015/requirements/
=
In addition to nominations, the Nomcom seeks community input on thepositions themselves. We need and welcome the community's views and
in= put on the jobs within each organization. If you have ideas on the
posi= tions' responsibilities (more, less, different), please let us
know.
Please send suggestions and feedback about this tonomcom15@= ietf.org.

Thank you for your help in identifying qualified nomi= nees!

Harald Alvestrand
Nomcom Chair 2015-16
nomcom-chair-2015@ietf.org,hta+nomcom@alvestrand.no
=
= --Boundary_(ID_UbJt4lklVl7+jpd56Rm+Cw)-- --Boundary_(ID_V0rByUEc1ifIeIiFGcyAQA)-- From nobody Mon Sep 14 18:06:29 2015 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A9EA71B3EE6; Mon, 14 Sep 2015 18:06:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.902 X-Spam-Level: X-Spam-Status: No, score=-1.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gz9c44Xi3vts; Mon, 14 Sep 2015 18:06:21 -0700 (PDT) Received: from web01.jbserver.net (web01.jbserver.net [37.72.100.182]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DF51A1B3E71; Mon, 14 Sep 2015 18:06:20 -0700 (PDT) Received: from [181.46.190.53] (helo=[172.16.17.13]) by web01.jbserver.net with esmtpsa (TLSv1.2:DHE-RSA-AES128-SHA:128) (Exim 4.85) (envelope-from ) id 1ZbegK-0007hN-RD; Tue, 15 Sep 2015 03:05:13 +0200 References: <20150915004941.13204.35415.idtracker@ietfa.amsl.com> From: Fernando Gont X-Enigmail-Draft-Status: N1110 To: opsawg@ietf.org X-Forwarded-Message-Id: <20150915004941.13204.35415.idtracker@ietfa.amsl.com> Message-ID: <55F76EA7.6090405@si6networks.com> Date: Mon, 14 Sep 2015 22:04:39 -0300 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.2.0 MIME-Version: 1.0 In-Reply-To: <20150915004941.13204.35415.idtracker@ietfa.amsl.com> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit Archived-At: Cc: Internet Area , "'opsec@ietf.org'" , TSV Area , tsvwg , IPv6 Operations Subject: [OPSEC] "On Firewalls in Internet Security" (Fwd: New Version Notification for draft-gont-opsawg-firewalls-analysis-00.txt) X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 15 Sep 2015 01:06:23 -0000 Folks, We have published an I-D entitled "On Firewalls in Internet Security". The I-D is available at: . Our I-D covers a broad range of topics (ranging from operations to internet and transport area topics) -- hence the crosspost of this announcement to multiple mailing-lists. While we (co-authors) are subscribed to most of the lists to which this announcement is being crossposted, we expect (for the sake of unifying the discussion in a single place) the discussion to happen in the opsawg@ietf.org mailing-list. Your feedback will be very welcome. Thanks! Best regards, Fernando -------- Forwarded Message -------- Subject: New Version Notification for draft-gont-opsawg-firewalls-analysis-00.txt Date: Mon, 14 Sep 2015 17:49:41 -0700 From: internet-drafts@ietf.org To: Paul E. Hoffman , Fernando Gont , Fernando Gont , Fred Baker , Fred Baker , Paul Hoffman A new version of I-D, draft-gont-opsawg-firewalls-analysis-00.txt has been successfully submitted by Fernando Gont and posted to the IETF repository. Name: draft-gont-opsawg-firewalls-analysis Revision: 00 Title: On Firewalls in Internet Security Document date: 2015-09-15 Group: Individual Submission Pages: 17 URL: https://www.ietf.org/internet-drafts/draft-gont-opsawg-firewalls-analysis-00.txt Status: https://datatracker.ietf.org/doc/draft-gont-opsawg-firewalls-analysis/ Htmlized: https://tools.ietf.org/html/draft-gont-opsawg-firewalls-analysis-00 Abstract: This document analyzes the role of firewalls in Internet security, and suggests a line of reasoning about their usage. It analyzes common kinds of firewalls and the claims made for them. Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. The IETF Secretariat From nobody Wed Sep 16 22:10:22 2015 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 974A31B31D2; Wed, 16 Sep 2015 22:10:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.511 X-Spam-Level: X-Spam-Status: No, score=-14.511 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id M2-HOwfuZoTj; Wed, 16 Sep 2015 22:10:19 -0700 (PDT) Received: from rcdn-iport-9.cisco.com (rcdn-iport-9.cisco.com [173.37.86.80]) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B53D71B31BF; Wed, 16 Sep 2015 22:10:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=3589; q=dns/txt; s=iport; t=1442466618; x=1443676218; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-transfer-encoding:mime-version; bh=Ih5EHM1FzkXl5zc7dqsQt4+CjQQP+AMUMTPUyZlltYg=; b=Loi0cz1a+F48dpxOeaATJzcYlEjkSb0FgoFBBSvodqQoFAXNvhyTAULq B97pSqz22Z/PYrViCmV7Hc3IV8nNCzCJqLO266rb/pIJTgOw1ED1dUz8+ pRHlLad917v3ovPcwtyATaa0aJdLOxpTG62bBRfe50XHLi/QYdf1eKIH7 c=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: A0AHAgA0SvpV/5BdJa1egyNUaQa9NwENgW8MhXcCgTo4FAEBAQEBAQGBCoQjAQEBBAEBATc0CQIMBAIBCA4DAwEBAQsUBQQHJwsUCQgCBAENBQiIJg3KDwEBAQEBAQEBAQEBAQEBAQEBAQEBAReGc4R9hFwxBwaDEoEUAQSHOYVBgS6EDoMoAYUPiUFGg2+DIY4Cg2wfAQFCgkOBPnEBiSSBBQEBAQ X-IronPort-AV: E=Sophos;i="5.17,544,1437436800"; d="scan'208";a="27676652" Received: from rcdn-core-8.cisco.com ([173.37.93.144]) by rcdn-iport-9.cisco.com with ESMTP; 17 Sep 2015 05:10:17 +0000 Received: from XCH-RCD-008.cisco.com (xch-rcd-008.cisco.com [173.37.102.18]) by rcdn-core-8.cisco.com (8.14.5/8.14.5) with ESMTP id t8H5AHf9030071 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Thu, 17 Sep 2015 05:10:17 GMT Received: from xch-rcd-008.cisco.com (173.37.102.18) by XCH-RCD-008.cisco.com (173.37.102.18) with Microsoft SMTP Server (TLS) id 15.0.1104.5; Thu, 17 Sep 2015 00:10:16 -0500 Received: from xhc-aln-x14.cisco.com (173.36.12.88) by xch-rcd-008.cisco.com (173.37.102.18) with Microsoft SMTP Server (TLS) id 15.0.1104.5 via Frontend Transport; Thu, 17 Sep 2015 00:10:16 -0500 Received: from xmb-rcd-x10.cisco.com ([169.254.15.53]) by xhc-aln-x14.cisco.com ([173.36.12.88]) with mapi id 14.03.0248.002; Thu, 17 Sep 2015 00:10:16 -0500 From: "Panos Kampanakis (pkampana)" To: Fernando Gont , "opsawg@ietf.org" Thread-Topic: [OPSEC] "On Firewalls in Internet Security" (Fwd: New Version Notification for draft-gont-opsawg-firewalls-analysis-00.txt) Thread-Index: AQHQ71LN9rR5ctD6dU+7SitEH+f62Z5AK1eA Date: Thu, 17 Sep 2015 05:10:15 +0000 Message-ID: <1C9F17D1873AFA47A969C4DD98F98A7526700847@xmb-rcd-x10.cisco.com> References: <20150915004941.13204.35415.idtracker@ietfa.amsl.com> <55F76EA7.6090405@si6networks.com> In-Reply-To: <55F76EA7.6090405@si6networks.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.82.220.200] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Cc: "'opsec@ietf.org'" Subject: Re: [OPSEC] "On Firewalls in Internet Security" (Fwd: New Version Notification for draft-gont-opsawg-firewalls-analysis-00.txt) X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 17 Sep 2015 05:10:20 -0000 Hi Fernando, I am struggling to understand the gap this draft fills. We read "In many cases, as a result, deployments have been underwhelming in= both quantity and quality, and the Internet is noted for its problems with= security.", but I wouldn't say firewall deployments are underwhelming in q= uality and quantity. I believe FW are very ubiquitous in today's networks. = Were you referring to something else? Also I am not sure about what the "bickering on the topic" refers to.=20 Finally, with all the "NGFW" products and features out there that section 4= could include many more kinds of fws. Same for section 5.=20 In general, I think that the draft covers legacy firewalls mostly, not all = the modern fw features that exist today and I am not sure if it tries to co= nvince readers about their need (because I don't think in today's world fir= ewalling functionality can be rejected as unnecessary by anyone) Panos -----Original Message----- From: OPSEC [mailto:opsec-bounces@ietf.org] On Behalf Of Fernando Gont Sent: Monday, September 14, 2015 9:05 PM To: opsawg@ietf.org Cc: Internet Area; 'opsec@ietf.org'; TSV Area; tsvwg; IPv6 Operations Subject: [OPSEC] "On Firewalls in Internet Security" (Fwd: New Version Noti= fication for draft-gont-opsawg-firewalls-analysis-00.txt) Folks, We have published an I-D entitled "On Firewalls in Internet Security". The I-D is available at: . Our I-D covers a broad range of topics (ranging from operations to internet= and transport area topics) -- hence the crosspost of this announcement to = multiple mailing-lists. While we (co-authors) are subscribed to most of the lists to which this ann= ouncement is being crossposted, we expect (for the sake of unifying the dis= cussion in a single place) the discussion to happen in the opsawg@ietf.org = mailing-list. Your feedback will be very welcome. Thanks! Best regards, Fernando -------- Forwarded Message -------- Subject: New Version Notification for draft-gont-opsawg-firewalls-analysis-00.txt Date: Mon, 14 Sep 2015 17:49:41 -0700 From: internet-drafts@ietf.org To: Paul E. Hoffman , Fernando Gont , Fernando Gont , Fred Baker = , Fred Baker , Paul Hoffman A new version of I-D, draft-gont-opsawg-firewalls-analysis-00.txt has been successfully submitted by Fernando Gont and posted to the IETF rep= ository. Name: draft-gont-opsawg-firewalls-analysis Revision: 00 Title: On Firewalls in Internet Security Document date: 2015-09-15 Group: Individual Submission Pages: 17 URL: https://www.ietf.org/internet-drafts/draft-gont-opsawg-firewalls-analysis-0= 0.txt Status: https://datatracker.ietf.org/doc/draft-gont-opsawg-firewalls-analysis/ Htmlized: https://tools.ietf.org/html/draft-gont-opsawg-firewalls-analysis-00 Abstract: This document analyzes the role of firewalls in Internet security, and suggests a line of reasoning about their usage. It analyzes common kinds of firewalls and the claims made for them. Please note that it may take a couple of minutes from the time of submissio= n until the htmlized version and diff are available at tools.ietf.org. The IETF Secretariat _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec From nobody Thu Sep 17 15:07:12 2015 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 830E51A8894 for ; Thu, 17 Sep 2015 15:07:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.91 X-Spam-Level: X-Spam-Status: No, score=-1.91 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bPweIk3plCii for ; Thu, 17 Sep 2015 15:07:09 -0700 (PDT) Received: from nagasaki.bogus.com (nagasaki.bogus.com [IPv6:2001:418:1::81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 52B631A8897 for ; Thu, 17 Sep 2015 15:07:09 -0700 (PDT) Received: from mb.local ([IPv6:2601:647:4200:7a31:6c98:db5:63c9:83e6]) (authenticated bits=0) by nagasaki.bogus.com (8.14.9/8.14.9) with ESMTP id t8HM73G7089646 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES128-SHA bits=128 verify=NOT); Thu, 17 Sep 2015 22:07:04 GMT (envelope-from joelja@bogus.com) To: opsec chairs , "opsec@ietf.org" , Eric Vyncke From: joel jaeggli X-Enigmail-Draft-Status: N1110 Message-ID: <55FB3986.4010200@bogus.com> Date: Thu, 17 Sep 2015 15:07:02 -0700 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:41.0) Gecko/20100101 Thunderbird/41.0 MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="maIJjVCi7OoLNeJXGBB5qEnUSSSTp1dqI" Archived-At: Subject: [OPSEC] Please Welcome comrade Eric as new co-chair. X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 17 Sep 2015 22:07:10 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --maIJjVCi7OoLNeJXGBB5qEnUSSSTp1dqI Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Eric Vynce has agreed to step on as the co-chair for the OPSEC working-group. As with many of the present and former chairs, while he has been a contributor for some time I believe that this is his first run at chairing a working group. I would thank everyone who volunteered this time around. I have a great deal of respect for those that did and it continues to impress me how deep the talent bench and interest is in supporting this community through service. Thanks Joel --maIJjVCi7OoLNeJXGBB5qEnUSSSTp1dqI Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2 Comment: GPGTools - http://gpgtools.org iEYEARECAAYFAlX7OYcACgkQ8AA1q7Z/VrL65ACfRRz3/Ifj1v6e3BjzwaB1XJeN bYkAnin19q/hBDKYIDXLAz3WOnZNzJ/O =hdvp -----END PGP SIGNATURE----- --maIJjVCi7OoLNeJXGBB5qEnUSSSTp1dqI-- From nobody Thu Sep 17 15:18:30 2015 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 688931A1B91 for ; Thu, 17 Sep 2015 15:18:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.978 X-Spam-Level: X-Spam-Status: No, score=-1.978 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FM_FORGED_GMAIL=0.622, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8Snl5GTGVaYk for ; Thu, 17 Sep 2015 15:18:28 -0700 (PDT) Received: from mail-yk0-f170.google.com (mail-yk0-f170.google.com [209.85.160.170]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F13681A1B8E for ; Thu, 17 Sep 2015 15:18:27 -0700 (PDT) Received: by ykdt18 with SMTP id t18so30779010ykd.3 for ; Thu, 17 Sep 2015 15:18:27 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=b/2ezNUUin406iOc8rb/NbiUlOI5//d76XsKaYAspbc=; b=Qbn7B9XarZK+38ew30t4SnnPG1mhDCyuNWP1XG2rX+/mqafS40jZkUyAMHp4Ic+OZp Pw8GLC6YE/gOz70l7pJsqKxvcyDO9ZQWjQaUZOHoaVjXW7bkQiArJnqCVF55Z8FG6hi9 JP1zNEko+p2vqwIVQzt1KKJRi3eIWNAhjoDog5tdnETxMnmlGftCRwZXFDHxt/AmY7H/ fmkiG18R6H7PFdEIEqvHMFs/oGXh7jhxwOuewjpipy2FUw641Euz+Z0FZBjC4l2emtzP B2JsrozuB2tHA+JcaeP+RRzykXGshQR6mwRXkaGbCOS4jnxNAyDmErirUQdJq4otIU+h NBpA== X-Gm-Message-State: ALoCoQn7mtqnZGuUrRPUzGv/qub0kjgwhzMJLWhm0odzOgWY/+FUZQwPx3ZaVPdcCoacStG0rEER MIME-Version: 1.0 X-Received: by 10.170.172.65 with SMTP id o62mr1810895ykd.85.1442528306779; Thu, 17 Sep 2015 15:18:26 -0700 (PDT) Received: by 10.37.52.135 with HTTP; Thu, 17 Sep 2015 15:18:26 -0700 (PDT) In-Reply-To: <55FB3986.4010200@bogus.com> References: <55FB3986.4010200@bogus.com> Date: Thu, 17 Sep 2015 18:18:26 -0400 Message-ID: From: Warren Kumari To: joel jaeggli Content-Type: text/plain; charset=UTF-8 Archived-At: Cc: "opsec@ietf.org" , opsec chairs Subject: Re: [OPSEC] Please Welcome comrade Eric as new co-chair. X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 17 Sep 2015 22:18:29 -0000 On Thu, Sep 17, 2015 at 6:07 PM, joel jaeggli wrote: > Eric Vynce has agreed to step on as the co-chair for the OPSEC > working-group. As with many of the present and former chairs, while he > has been a contributor for some time I believe that this is his first > run at chairing a working group. > An excellent choice. I believe Eric will make a great chair. W > I would thank everyone who volunteered this time around. I have a great > deal of respect for those that did and it continues to impress me how > deep the talent bench and interest is in supporting this community > through service. > > Thanks > Joel > > > _______________________________________________ > OPSEC mailing list > OPSEC@ietf.org > https://www.ietf.org/mailman/listinfo/opsec > -- I don't think the execution is relevant when it was obviously a bad idea in the first place. This is like putting rabid weasels in your pants, and later expressing regret at having chosen those particular rabid weasels and that pair of pants. ---maf From nobody Thu Sep 17 17:14:40 2015 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 47A081A87A0; Thu, 17 Sep 2015 17:14:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.902 X-Spam-Level: X-Spam-Status: No, score=-1.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Nv6nTY-5TP3Y; Thu, 17 Sep 2015 17:14:29 -0700 (PDT) Received: from web01.jbserver.net (web01.jbserver.net [37.72.100.182]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 960E51A885E; Thu, 17 Sep 2015 17:14:29 -0700 (PDT) Received: from [179.40.144.36] (helo=[192.168.123.127]) by web01.jbserver.net with esmtpsa (TLSv1.2:DHE-RSA-AES128-SHA:128) (Exim 4.85) (envelope-from ) id 1ZcjIk-00029M-RM; Fri, 18 Sep 2015 02:13:19 +0200 To: Linda Dunbar , "Panos Kampanakis (pkampana)" , "opsawg@ietf.org" References: <20150915004941.13204.35415.idtracker@ietfa.amsl.com> <55F76EA7.6090405@si6networks.com> <1C9F17D1873AFA47A969C4DD98F98A7526700847@xmb-rcd-x10.cisco.com> <4A95BA014132FF49AE685FAB4B9F17F657D41A0E@dfweml701-chm> From: Fernando Gont X-Enigmail-Draft-Status: N1110 Message-ID: <55FB4B88.8000606@si6networks.com> Date: Thu, 17 Sep 2015 20:23:52 -0300 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.2.0 MIME-Version: 1.0 In-Reply-To: <4A95BA014132FF49AE685FAB4B9F17F657D41A0E@dfweml701-chm> Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 8bit Archived-At: Cc: "'opsec@ietf.org'" Subject: Re: [OPSEC] "On Firewalls in Internet Security" (Fwd: New Version Notification for draft-gont-opsawg-firewalls-analysis-00.txt) X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 18 Sep 2015 00:14:35 -0000 Hi, Linda, On 09/17/2015 06:15 PM, Linda Dunbar wrote: > I am also not sure of the intent of this draft. Is the intent of the > draft to provide the guideline on configuring Firewall? Certainly not. Please see Melinda's comments. > Comment to the first paragraph in Section 10 Recommendation: > > Most deployed FWs are usually not “single purposed” as characterized as > “Zone-based” FW, or “Rule based” FW. A FW that has rules on zones can > also have rules to allow session originated from outside to some > applications. We didn't mean that firewalls are single purposed. Certinly, a given device can implement different kinds of firewalls. That doesn't make our analysis on the kinds of firewalls incorrect, though. > Comment to the second paragraph in Section 10 Recommendation: > In order to achieve the recommendation described by the second paragraph > of the Section 10 Recommendations, the router has to install all the > host routes for “Bob, Alice, etc”. It doesn’t scale. I guess that depends on a number of factors... among others, on the granularity that you talk about. > Comment to “FW SHOULD NOT attempt to perform any kind of DPI”: > Many modern FWs do perform DPIs. Are you saying they should be strip off > the network? They all had legitimate reasons to be deployed, and they > are running fine. You seem to have cut off part of the sentence. It says: firewalls of any type SHOULD NOT attempt to perform the kind of deep packet inspection and surgery that is common with Network Address Translators [RFC2993] And what we mean s not that FWs should not perform the kind of surgery that NAT devices perform (e.g., modifying the application data stream). Thanks! Cheers, -- Fernando Gont SI6 Networks e-mail: fgont@si6networks.com PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492 From nobody Thu Sep 17 17:30:58 2015 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 103F61A88C7; Thu, 17 Sep 2015 17:30:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.902 X-Spam-Level: X-Spam-Status: No, score=-1.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xN_tVahr0Gvs; Thu, 17 Sep 2015 17:30:55 -0700 (PDT) Received: from web01.jbserver.net (web01.jbserver.net [37.72.100.182]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F2AC01A88C1; Thu, 17 Sep 2015 17:30:54 -0700 (PDT) Received: from [179.40.144.36] (helo=[192.168.123.127]) by web01.jbserver.net with esmtpsa (TLSv1.2:DHE-RSA-AES128-SHA:128) (Exim 4.85) (envelope-from ) id 1ZcjZi-0002DF-Fo; Fri, 18 Sep 2015 02:30:51 +0200 From: Fernando Gont To: "Panos Kampanakis (pkampana)" , "opsawg@ietf.org" References: <20150915004941.13204.35415.idtracker@ietfa.amsl.com> <55F76EA7.6090405@si6networks.com> <1C9F17D1873AFA47A969C4DD98F98A7526700847@xmb-rcd-x10.cisco.com> X-Enigmail-Draft-Status: N1110 Message-ID: <55FB5B43.7090206@si6networks.com> Date: Thu, 17 Sep 2015 21:30:59 -0300 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.2.0 MIME-Version: 1.0 In-Reply-To: <1C9F17D1873AFA47A969C4DD98F98A7526700847@xmb-rcd-x10.cisco.com> Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit Archived-At: Cc: "'opsec@ietf.org'" Subject: Re: [OPSEC] "On Firewalls in Internet Security" (Fwd: New Version Notification for draft-gont-opsawg-firewalls-analysis-00.txt) X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 18 Sep 2015 00:30:57 -0000 Hi, Panos, Thanks so much for your feedback! Please find some responses in-line (more coming...) On 09/17/2015 02:10 AM, Panos Kampanakis (pkampana) wrote: > > I am struggling to understand the gap this draft fills. Please see Melinda's comments... > Finally, with all the "NGFW" products and features out there that > section 4 could include many more kinds of fws. Same for section 5. Would you mind elaborating on the kind of features that you're referring to? > In general, I think that the draft covers legacy firewalls mostly, > not all the modern fw features that exist today and I am not sure if > it tries to convince readers about their need (because I don't think > in today's world firewalling functionality can be rejected as > unnecessary by anyone) Please check many discussions in IETF circles. Many deem firewalls as evil. Thanks! Best regards, -- Fernando Gont SI6 Networks e-mail: fgont@si6networks.com PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492 From nobody Thu Sep 17 20:22:55 2015 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E23EB1A1A9F; Thu, 17 Sep 2015 20:22:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.511 X-Spam-Level: X-Spam-Status: No, score=-14.511 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PDYSpCx4vqnq; Thu, 17 Sep 2015 20:22:47 -0700 (PDT) Received: from alln-iport-3.cisco.com (alln-iport-3.cisco.com [173.37.142.90]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BD9121A1A68; Thu, 17 Sep 2015 20:22:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=2374; q=dns/txt; s=iport; t=1442546566; x=1443756166; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-transfer-encoding:mime-version; bh=wVfkJGksT1QTj3SHVlrA+7t9RGxVz909/U64RTsieEY=; b=M9n7KeOoTU01D4t1h9EDmJgrAQ8zvPYMK65cDwSnTCxiE36YAz4n6aKx h+2g+Tv4e9aaFySP/UApYsJXBu10rg0LU2V7NAoEbGmpY916TTAjX7wlf XSMRefpPEuISKhHDlsF3M7Tm52I8qLHg+ofhbOFLuiNApoZmON35myEG1 c=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: A0DwAQBDgvtV/4ENJK1dgyOBPQa9PwENh3ICgUY4FAEBAQEBAQGBCoQjAQEBAwE6PQIFBwQCAQgOAwQBAQEKCwkFBAcyFAkIAgQBDQUIDIgSCMsuAQEBAQEBAQEBAQEBAQEBAQEBAQEBF4ZzhH2EXDEHBgSDDoEUAQSHOoZxhA6DKAGOUoQ2hyOKB4NtHwEBQoJDgT5xiSWBBQEBAQ X-IronPort-AV: E=Sophos;i="5.17,550,1437436800"; d="scan'208";a="188860833" Received: from alln-core-9.cisco.com ([173.36.13.129]) by alln-iport-3.cisco.com with ESMTP/TLS/DHE-RSA-AES256-SHA; 18 Sep 2015 03:22:45 +0000 Received: from XCH-ALN-016.cisco.com (xch-aln-016.cisco.com [173.36.7.26]) by alln-core-9.cisco.com (8.14.5/8.14.5) with ESMTP id t8I3MjcV031102 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Fri, 18 Sep 2015 03:22:45 GMT Received: from xch-aln-016.cisco.com (173.36.7.26) by XCH-ALN-016.cisco.com (173.36.7.26) with Microsoft SMTP Server (TLS) id 15.0.1104.5; Thu, 17 Sep 2015 22:22:45 -0500 Received: from xhc-rcd-x07.cisco.com (173.37.183.81) by xch-aln-016.cisco.com (173.36.7.26) with Microsoft SMTP Server (TLS) id 15.0.1104.5 via Frontend Transport; Thu, 17 Sep 2015 22:22:45 -0500 Received: from xmb-rcd-x10.cisco.com ([169.254.15.53]) by xhc-rcd-x07.cisco.com ([173.37.183.81]) with mapi id 14.03.0248.002; Thu, 17 Sep 2015 22:22:44 -0500 From: "Panos Kampanakis (pkampana)" To: Fernando Gont , "opsawg@ietf.org" Thread-Topic: [OPSEC] "On Firewalls in Internet Security" (Fwd: New Version Notification for draft-gont-opsawg-firewalls-analysis-00.txt) Thread-Index: AQHQ8alK9rR5ctD6dU+7SitEH+f62Z5BmDAg Date: Fri, 18 Sep 2015 03:22:43 +0000 Message-ID: <1C9F17D1873AFA47A969C4DD98F98A7526704111@xmb-rcd-x10.cisco.com> References: <20150915004941.13204.35415.idtracker@ietfa.amsl.com> <55F76EA7.6090405@si6networks.com> <1C9F17D1873AFA47A969C4DD98F98A7526700847@xmb-rcd-x10.cisco.com> <55FB5B43.7090206@si6networks.com> In-Reply-To: <55FB5B43.7090206@si6networks.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.82.252.108] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Cc: "'opsec@ietf.org'" Subject: Re: [OPSEC] "On Firewalls in Internet Security" (Fwd: New Version Notification for draft-gont-opsawg-firewalls-analysis-00.txt) X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 18 Sep 2015 03:22:52 -0000 Sorry I didn't see Melinda's response. Maybe because I am not subscribed in= opsawg. > Would you mind elaborating on the kind of features that you're referring = to? Vendors have multiple. Some are: - File inspection, Application visibility and control - TLS proxying - IPS - Malware protection - DNS blackholing - Botnet protection, similar to reputation filtering - Web protection and filtering - behavioral analysis, event correlation - Vulnerability analysis - Traffic control (policing etc) - Threat protection (top talkers, DoS etc) Firewalls and their managements platforms have so many functions nowadays e= specially with so many vendors, that it is very tough to account for them i= n one document I think. > Please check many discussions in IETF circles. Many deem firewalls as evi= l. Could be, I wasn't aware. The industry doesn't seem to do so. Maybe the dra= ft serves to address some concerns of the IETF community. Panos -----Original Message----- From: Fernando Gont [mailto:fgont@si6networks.com]=20 Sent: Thursday, September 17, 2015 8:31 PM To: Panos Kampanakis (pkampana); opsawg@ietf.org Cc: 'opsec@ietf.org' Subject: Re: [OPSEC] "On Firewalls in Internet Security" (Fwd: New Version = Notification for draft-gont-opsawg-firewalls-analysis-00.txt) Hi, Panos, Thanks so much for your feedback! Please find some responses in-line (more = coming...) On 09/17/2015 02:10 AM, Panos Kampanakis (pkampana) wrote: >=20 > I am struggling to understand the gap this draft fills. Please see Melinda's comments... > Finally, with all the "NGFW" products and features out there that=20 > section 4 could include many more kinds of fws. Same for section 5. Would you mind elaborating on the kind of features that you're referring to= ? > In general, I think that the draft covers legacy firewalls mostly, not=20 > all the modern fw features that exist today and I am not sure if it=20 > tries to convince readers about their need (because I don't think in=20 > today's world firewalling functionality can be rejected as unnecessary=20 > by anyone) Please check many discussions in IETF circles. Many deem firewalls as evil. Thanks! Best regards, -- Fernando Gont SI6 Networks e-mail: fgont@si6networks.com PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492 From nobody Wed Sep 23 04:34:27 2015 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F23B41ACEDC for ; Wed, 23 Sep 2015 04:34:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5TUZQ4ltmJR8 for ; Wed, 23 Sep 2015 04:34:24 -0700 (PDT) Received: from atl4mhob08.myregisteredsite.com (atl4mhob08.myregisteredsite.com [209.17.115.46]) by ietfa.amsl.com (Postfix) with ESMTP id 2ACD51ACEDB for ; Wed, 23 Sep 2015 04:34:24 -0700 (PDT) Received: from mailpod.hostingplatform.com ([10.30.71.206]) by atl4mhob08.myregisteredsite.com (8.14.4/8.14.4) with ESMTP id t8NBYM1D016288 for ; Wed, 23 Sep 2015 07:34:22 -0400 Received: (qmail 15205 invoked by uid 0); 23 Sep 2015 11:34:22 -0000 X-TCPREMOTEIP: 69.81.157.131 X-Authenticated-UID: wes@mti-systems.com Received: from unknown (HELO ?192.168.1.103?) (wes@mti-systems.com@69.81.157.131) by 0 with ESMTPA; 23 Sep 2015 11:34:22 -0000 References: <55F857D1.1020806@mti-systems.com> To: opsec@ietf.org From: Wesley Eddy X-Enigmail-Draft-Status: N1110 Organization: MTI Systems X-Forwarded-Message-Id: <55F857D1.1020806@mti-systems.com> Message-ID: <56028E3C.2030301@mti-systems.com> Date: Wed, 23 Sep 2015 07:34:20 -0400 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:38.0) Gecko/20100101 Thunderbird/38.2.0 MIME-Version: 1.0 In-Reply-To: <55F857D1.1020806@mti-systems.com> Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit Archived-At: Cc: "gclark mti-systems.com" , Justin Dailey Subject: [OPSEC] Fwd: [Idr] flowspec enhancements X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 23 Sep 2015 11:34:26 -0000 Since DDoS mitigation may be of interest to folks on the OPSEC list, I'm sharing this draft about BGP/flowspec enhancements intended to help with DDoS. Looking forward to any comments, questions, or criticisms that you might have: -------- Forwarded Message -------- Subject: [Idr] flowspec enhancements Date: Tue, 15 Sep 2015 13:39:29 -0400 From: Wesley Eddy Organization: MTI Systems To: idr@ietf.org CC: Justin Dailey Hello, we've been working on a few enhancements to the BGP flowspec capabilities that may be of interest: https://tools.ietf.org/html/draft-eddy-idr-flowspec-exp-00 There are several ideas described in the document that could be factored out from one another, but the basic idea is to increase the power of flowspec, mainly for its DDoS mitigation purposes. Specifically, the suggested enhancements include: - add packet rate limitations as an action (not just bitrate) - add support for filtering of tunneled traffic (unencrypted) - identifying flow specifications for tracking and communication between providers - cryptographically signing flowspecs - supporting a more surgical re-route to scrubbing centers - providing feedback about flowspecs to the source If any of these are interesting to folks, we'll appreciate your feedback, comments, questions, etc. Some are more difficult than others. I'm assuming IDR is a reasonable list for this, though it also touches SIDR and OPSEC topics, but will appreciate the chairs' thoughts on this. It has been mentioned in the DOTS list, but is obviously out of scope for DOTS. -- Wes Eddy MTI Systems _______________________________________________ Idr mailing list Idr@ietf.org https://www.ietf.org/mailman/listinfo/idr