Re: [gentoo-hardened] Adding ipv6 USE flag by default

[Aaron W. Swenson]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On 02/19/2011 12:02 PM, Anthony G. Basile wrote:
> On 02/15/2011 02:12 PM, Chris Frederick wrote:
>> Hi everyone,
>>
>> I'll chime in on this one.  I want to clarify what is being asked, and add my two cents.
>
> Okay, I don't think there was a consensus on this issue, so I'm sure to
> make someone unhappy.  I think for now, we'll leave the status quo, ie
> ipv6 off by default.
>
> If it had been a question of whether or not ipv6 would be included in
> hardened, then the issue would have been obvious.  We must have ipv6.
> But the question was, do we enable or disable it *by default*.  Those
> that wish can always switch it on so nothing is ultimately lost.
>
> The question came up because of the latest news about ipv4 address space
> being depleted, so we know ipv6 is coming.  When ipv6 use becomes
> significant, we'll revisit the issue.
>
> (And please don't ask me what significant mean!  I'm not even sure myself :)
>

How about we shoot for World IPv6 Day? [1] Since everyone else will be
doing their test runs that day I think we should, too.

Additionally, amongst all the shouting of insecurity, the potential for
the improved security offered by IPv6 has been ignored, such as IPsec.
[2] The specification for 'link-local' (fe80::/16) pretty much behaves
in the same manner as 192.168.0.0/16 and 10.0.0.0/8 because of its built
in Hop Limit restriction and requirement that routers never forward an
fe80::/16 packet. [3] Additionally, the potential for improved
performance through jumbograms [4] and PMTU Discovery. [5] Not to
mention reduced hardware requirements to calculate checksums, which are
no longer necessary.

As some have pointed out, all that's really required to disable IPv6
support is to just not include the IPv6 stack in the kernel. Somebody
accidentally including it is unlikely for business production, so I
don't understand the concern there. (And those who aren't so security
conscious probably aren't running servers anyway.) Additionally, the
greater percentage of people who have Internet access must still wait
for the support to come or have to specifically request IPv6 support.
(My ISP, Verizon, has only now really begun working on offering IPv6 and
they say it'll take 18 months to implement.) Finally, the primary
Internet router must support IPv6. There's a lot of intentional setup
that goes into making IPv6 not only work but be viable on a network. A
simple flip of a USE flag isn't going to magically turn everything on
its ear and expose everyone to great risk.

Lastly, let's not forget the fact that a good portion of the stable
software packages available in the Portage tree, and run by a good
portion of the Gentoo user base, already incorporate IPv6 support with
no means other than less than trivial modifications of the source code
to disable it. (e.g., PostgreSQL, Apache and Firefox) Optional support
of IPv6 is rapidly disappearing from the tree as it is anyway. We might
as well expect it to come regardless of our wishes for a different time
frame. Indeed, it is here already in some of the more important and
popular packages.

Sincerely,
Mr. Aaron W. Swenson

[1] http://isoc.org/wp/worldipv6day/
[2] http://tools.ietf.org/html/rfc2460
[3] http://tools.ietf.org/html/rfc4291#section-2.5.6
[4] http://tools.ietf.org/html/rfc2675
[5] http://tools.ietf.org/html/rfc1981
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.16 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iF4EAREIAAYFAk1hsGUACgkQCOhwUhu5AEmiIgD+Nx1EGin9Xdej0ELMue7Jwqg9
H47cjKCGZnbI3dQmmP8A/jEp9q313ESxEk0cuo1WwfkJDoi4h6lbi4aKwpcq8LRx
=NxgI
-----END PGP SIGNATURE-----