Subject: RE: Limiting the Use of Site-Local

From: "Brian Zill" <[email-masked]>
Date: Mon, 28 Oct 2002 21:59:22 -0800

> Margaret Wasserman writes:
> 
> Private addressing does not provide any time of security that 
> cannot be obtained (and more easily, in most cases) by 
> appropriate configuration of firewalls or filters on routers.

So are you advocating that people use global addresses with a firewall
and/or filters to block outside connectivity for part of their address
space?  Doesn't that just create a weird form of private address space?
And worse (since it is not officially sanctioned) one that applications
can't recognize?

One advantage of having scoped addresses defined in the IPv6
architecture from the start is that applications can know not to pass
them outside of their scope.  If we instead suggest that people
firewall/filter off random portions of the global address space, then
apps will blindly pass those addresses around in the data stream,
mistakenly thinking that they are real global addresses.  Only having
dedicated scoped address space allows apps to do the right thing.

--Brian

--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Keith Moore <[email-masked]>
Date: Tue, 29 Oct 2002 09:15:37 -0500

> them outside of their scope. 

NO.

1. applications don't know where their scope ends.

2. expecting applications to know about network topology drastically
   increases their complexity without any recognizable benefits.

---

From: Brian Haberman <[email-masked]>
Date: Tue, 29 Oct 2002 09:38:24 -0500

>>them outside of their scope. 

I have heard this stated by several people before and I am not sure
how apps are supposed to know this.  Especially since it was stated
that each nodes view of what is a site is independent of other nodes.

> 1. applications don't know where their scope ends.

Are people assuming that a functionality similar to MZAP (RFC 2776)
is going to be used to advertise site information?

Brian