Subject: RE: [nemo] More comments on the RO problem statement draft

From: "Pascal Thubert \(pthubert\)" <[email-masked]>
Date: Wed, 7 Sep 2005 13:40:55 +0200

>-----Original Message-----
>From: [email-masked] [mailto:[email-masked]] On Behalf Of
Jari Arkko
>Sent: Wednesday, September 07, 2005 1:11 PM
>To: Alexandru Petrescu
>Cc: IETF NEMO WG
>Subject: Re: [nemo] More comments on the RO problem statement draft
>
>Alexandru Petrescu wrote:
>
>>Maybe it would be easier to say something along the lines of this: if
>>NEMO uses RO then there is more probability that moving networks will
be
>>allowed (policy-wise) to connect to each other.  Does this follow?
>>
>>
>Not necessarily. Firstly, there might be networks
>that want to have all traffic inspected to begin with,
>even with their own nodes. Secondly, you would
>need an RO solution that does not need the home network
>at all, as otherwise this does not alleviate the home
>network admin's fear that bad packets will be routed
>to it.
[
[<PT>] I really like those words a lot. I believe we should add them to
the text in the draft almost as is...

 Finally, you would assume that someone who
>deploys nemo routers designs their network in
>a manner that matches the desired user population,
>e.g. own users -> their internal network, any users ->
>only the external network.
>
>But I do agree that it sounds somewhat dangerous
>to let in anyone and route the traffic through your
>home network, even if its only the external side. Any
>spam/illegal content etc. problems would first be
>blamed on you, not the unauthenticated users.
>
>There's also the question of whether its NEMO or
>something else that solves this problem. Presumably
>if you worry about this then you could also require
>network access authentication.
>

[<PT>] What we tried to point out in that chapter was that an RO
solution might enable the MR to forward blindly the packets in the hot
potato fashion (anonymously and innocuously). If such an RO is devised,
then it might alleviate some fears about letting some "external network"
opened for tit4tat. Same reason we went for RH2, thinking that maybe
that would help devising firewall policies.

Pascal