[113698] in North American Network Operators' Group
Re: IXP
daemon@ATHENA.MIT.EDU (Paul Vixie)
Sat Apr 18 17:12:29 2009
From: Paul Vixie <vixie@isc.org>
To: "nanog@merit.edu nanog@merit.edu" <nanog@merit.edu>
In-Reply-To: Your message of "Sat, 18 Apr 2009 13:17:11 -0400."
<20090418131711.4ebce8af@cs.columbia.edu>
Date: Sat, 18 Apr 2009 21:12:24 +0000
Errors-To: nanog-bounces@nanog.org
> Date: Sat, 18 Apr 2009 13:17:11 -0400
> From: "Steven M. Bellovin" <smb@cs.columbia.edu>
>
> On Sat, 18 Apr 2009 16:58:24 +0000
> bmanning@vacation.karoshi.com wrote:
>
> > i make the claim that simple, clean design and execution is
> > best. even the security goofs will agree.
>
> "Even"? *Especially* -- or they're not competent at doing security.
wouldn't a security person also know about
http://en.wikipedia.org/wiki/ARP_spoofing
and know that many colo facilities now use one customer per vlan due
to this concern? (i remember florian weimer being surprised that we
didn't have such a policy on the ISC guest network.)
if we maximize for simplicity we get a DELNI. oops that's not fast
enough we need a switch not a hub and it has to go 10Gbit/sec/port.
looks like we traded away some simplicity in order to reach our goals.
