<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On Jan 17, 2021, at 12:00 PM, Chris Woodfield <<a href="mailto:chris@semihuman.com" class="">chris@semihuman.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><meta http-equiv="Content-Type" content="text/html; charset=utf-8" class=""><div style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Obviously this thread is going somewhat off-topic and my reply isn’t going to help matters - the idea that peer to peer is useless is a factor, but it’s more than that - it’s the fact that the vast majority of customers, service providers, and operators have come to view NAT and the use of private space as a form of security perimeter, and that allowing internal hosts/networks to be numbered from globally-routable space represents a security risk.<div class=""><br class=""></div><div class="">You, I, and most of the people reading PPML know that mindset is completely fallacious, but it’s quite pervasive and takes quite a bit of education to disabuse otherwise quite savvy operators of this notion.</div></div></div></blockquote><div><br class=""></div>Yep… I’ve done a lot of that reeducation over the years. It amazes me the number of people who have trouble separating stateful inspection from NAT and just can’t wrap their heads around the idea that you can still do stateful inspection even if you don’t mutilate the packet header in the process.</div><div><br class=""></div><div><br class=""><blockquote type="cite" class=""><div class=""><div style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div class="">It’s interesting that a lot of IPv6 evangelism that I’ve seen over the years doesn’t address this concern - IMO we should be spending quite a bit of energy fighting that mindset.</div></div></div></blockquote><div><br class=""></div>I’ve tried as best I can to address it head on each and every time it comes up. I haven’t figured out</div><div>a way to be proactive about addressing it that doesn’t come off as antagonistic, patronizing, or confrontational (sometimes I even hit all 3), so suggestions there are welcome.</div><div><br class=""></div><div>In fact, I argue that lack of address transparency is contrary to good security because it breaks the continuity of audit trails and makes it harder to identify miscreants and compromised systems.</div><div><br class=""></div><div>Owen</div><div><br class=""><blockquote type="cite" class=""><div class=""><div style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div class=""><br class=""></div><div class="">-C<br class=""><div class=""><br class=""><blockquote type="cite" class=""><div class="">On Jan 15, 2021, at 11:39 PM, Owen DeLong <<a href="mailto:owen@delong.com" class="">owen@delong.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class="">The biggest problem surrounding IPv4 is this idea that peer to peer is useless and we should all accept the idea of provider/supplicant and second class citizens.</div><br class="Apple-interchange-newline"></div></blockquote></div><br class=""></div></div></div></blockquote></div><br class=""></body></html>