Subject: Re: LL11 Security consideration for the threat where an attacker forces address reconfiguration

From: Erik Guttman <[email-masked]>
Date: Fri, 01 Aug 2003 11:20:41 +0200

We have been over this text several times.  Each time, we reach
rough consensus that the security consideration text is adequate
and accurate.  I do not see any reason to reopen this issue for
revision.

If the considerations are in fact of too much concern for a vendor
to employ IPv4 LL autoconfiguration, they should not implement it.
Informing vendors of the security considerations involved in a
protocol so they can make an informed choice and plan is one of
our highest responsibilities.

Erik
ZEROCONF WG chair

---

From: Stuart Cheshire <[email-masked]>
Date: Sun, 31 Aug 2003 14:44:38 -0700

Robert Elz wrote:

>for my laptop ... I will instead make quite sure that it
>does not allow its address to be yanked from under it

Then, I assert, you should not be using this protocol.

Just assign your laptop a manual address the way you do today, or use a 
DHCP server.

Why would you, Robert Elz, *want* to use IPv4LL?

The whole purpose of IPv4LL is enable functional communications for 
people who have no idea now networking works, not for experts who like to 
manually configure every last detail.

Stuart Cheshire <[email-masked]>
 * Wizard Without Portfolio, Apple Computer, Inc.
 * www.stuartcheshire.org