Subject: RE: [Pana] issue54: Client cookie mandatory

From: [email-masked]
Date: Mon, 9 Feb 2004 14:22:44 +0200

I tend to agree on this.
- Dan

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]On Behalf Of ext
> Jari Arkko
> Sent: 07 February, 2004 03:40
> To: Alper Yegin
> Cc: [email-masked]
> Subject: Re: [Pana] issue54: Client cookie mandatory
> 
> 
> Alper Yegin wrote:
> >>>From Jari Arkko:
> >>>     - "Cookie mandatory"
> >>>
> >>>       I would like the inclusion of the cookie to in the start
> >>>       exchange to be mandatory.
> > 
> > 
> > JARI: (Substantial) Great, but why a MAY? There does not appear to
> >       be any performance of complexity penalty of calculating
> >       such simple cookies. Why not do it every time?
> > 
> > In some environments, such as physically secured DSL 
> networks, use of
> > cookies is not necessary. If a PaC launches a DoS attack, 
> it'd be really
> > easy to detect and disable it. This is why we had made it a 
> MAY. It is left
> > to the operator to decide. Even though it is a low-cost 
> operation, we
> > thought operators might mind it given that they have 
> alternative means.
> > Maybe we should provide such explanations around it.
> 
> I understand, but I think the tradeoff is not good enough. It
> costs very little, but making it optional implies another type
> of cost in terms of configuration knobs, interop testing, danger
> of the configuration knob being set wrong, and so forth.
> 
> The less moving parts, the better...
> 
> --Jari
> 
> 
> 
> _______________________________________________
> Pana mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/pana
> 

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: [email-masked]
Date: Mon, 9 Feb 2004 14:22:44 +0200

I tend to agree on this.
- Dan