Subject: Re: (ngtrans) Shipworm Issues

From: "Michael Cole" <[email-masked]>
Date: Tue, 1 Oct 2002 21:7:45 -0400

Said by Bill Owens: Nat ..... (boxes) break IPsec.

Ha! There is an IPsec product named Netlock that will work with NAT boxes. 
I also believe in having more than one layer of security. Did I apply all of the 
security updates for Windows 95B? Yes. Did I run the Service Pack 3 disk on my 
Windows 2000 machine? Yes, but I also would want some additional protection. The 
better firewall products are capable of linking to a sound card and calling for 
help when under attack which is useful if an Internet gateway runs unattended. 
Having to have a human there all the time is not cost efficient.

  Said by JIm Owens: I am paranoid enough to refuse to run any 
version of Windows on a network attached computer.

No single security solution is going to take care of all 
circumstances. The idea is to slow down someone enough to catch him. ANY 
security system can be broken if the attacker uses a big enough hammer. UNIX, 
BSD, or any other operating system is not immune. Windows is hacked more often 
mainly because there are more Windows systems to kill with the result that a 
hack causes more damage.

I can  agree with you that NAT needs to be avoided in IPv6, or at 
least some could use a care of \64 suffix to hide their MACs from the net. A NAT 
is essentially a retooled router. That it transmogrifies the port number into a 
16-bit extension of the IPv4 address is what is pernicious. NATs are also a 
symptom that IPv6 needed to be implemented 10 years ago.

NAT boxes ARE a fact of life. Those of you who think that they should be 
ignored because they are not pure enough are not living in the real world. NAT 
boxes are the result of an approved RFC. A lot of people are stuck with HAVING 
to use them because there are not enough IPv4 addresses for every node to have a 
global address. If you read one of my addressing proposals for Shipworm, I 
stated very clearly that it could be implemented in such a way as to take load 
off of the NAT box.

----- Original Message ----- 

From:  

To: Michael Cole 
Cc: [email-masked] 

Sent: 10/1/2002 8:07:30 PM 

Subject: Re: (ngtrans) Shipworm 
Issues

  What I should have written is that MOST people would want to have 
a

  firewall in place. I understand that you are not most people. 
Richard

  Stallman is not a believer in computer security either, but I like 
to

  know if somebody is probing my system. I am even paranoid enough 
to

  put kill_cih.exe into my autoexec.bat file. 

Richard Stallman and I would agree on relatively few things, and I am 
most

certainly a believer in computer security - just not the same 
security

that you believe in. I do not believe that firewalls add appreciably 
to

the security of a well-managed network, and I do not believe that NAT 
adds

any security to any network. Note that most NAT boxes are not pure; 
they

incorporate firewall-like features. But the NAT functionality itself 
does

not help secure the network - in fact, since it breaks IPSec, I will 
argue

that widespread use of NAT decreases overall network security.

For what it is worth, I know when people are probing me, and what 
they're

trying to do to me - but for the most part I don't care, because my

systems aren't vulnerable to their attack attempts. And I am paranoid

enough to refuse to run any version of Windows on any 
network-attached

computer because I am not aware of any way to secure them 
sufficiently,

whether or not a firewall is involved.

  If I were suddenly rich

  enough to have a DSL and a laptop, I certainly would not want a 
war

  driver to be freeloading off of me.

That would also require that you had a wireless access point either

willingly or unintentionally configured to allow open access. It is 
not

always easy to configure an AP correctly, but it is possible. And of

course the existence of a NAT box at your house would make it a great 
deal

easier for a wardriver to connect through your DSL. Had you only one

address, or a static mapping between MAC addresses and public IP

addresses, the wardriver would have much more difficulty hijacking a

connection. The ubiquitous 'cable router' NAT/firewall/DHCP server 
makes

it trivially easy, and by disguising the original host makes 
traceback

nearly impossible.

In any case, I was only trying to make two points:

- Many people, in particular many people involved in IPv6 deployment, 
do

not agree with your assertion that firewalls and NATs are either 
necessary

or desirable.

- One of the major justifications for IPv6 in my opinion, and that of 
at

least some others involved in IPv6 deployment, is that it allows us 
to

avoid NAT - something that which we believe breaks the Internet in

fundamental ways.

Please go ahead and deploy firewalls and NATs on all your networks. 
Please

do not try to deploy protocols that force me to do the same. . .

Bill.

BTW, the reason I replied to you privately (and am doing so again) is

because I don't think this is a discussion appropriate to ngtrans.

 

--- Michael Cole

--- [email-masked] 

--- EarthLink: It's your Internet.

---

From: [email-masked]
Date: Tue, 1 Oct 2002 21:19:00 -0400 (EDT)

Michael,
	Twice I replied to you in private email, the second time stating

> because I don't think this is a discussion appropriate to ngtrans.

You continue to copy my messages back to the list. Please don't do that
any more. Nobody else on the list cares about this discussion, nor do I
any longer.

Bill.