QUIC is now RFC 9000

Re:QUIC is now RFC 9000 by throwawaaarrgh on Sunday May 30, 2021 @02:25PM (#27335291)

I think we're sort of agreeing on the same things. NAT protects devices, and stateful firewalls protect devices, and if you have neither, you're not protected. My point was that more devices exist behind NAT than come bundled with a stateful firewall, hence NAT protects more devices. The NAT devices/routers might additionally have a stateful firewall (which really only protects the router, not the other devices), but I wouldn't trust it as much as the security of a non-routable network.

[ Parent | on HN ]

Re:QUIC is now RFC 9000 by throw0101a on Sunday May 30, 2021 @05:37PM (#27337087)

> My point was that more devices exist behind NAT than come bundled with a stateful firewall, hence NAT protects more devices.

The popularity of a mechanism does not necessarily correlate with the effectiveness of its security. The fact that we're using IPv4 with NAT+SPI versus IPv6 with SPI is simply an accident of history.

If IPv4 had been designed with 64-bit addresses, or even 48-bit ones (like Ethernet MACs, which we still haven't run out of), then NAT probably would not have been invented, and we'd be using 'simple' (SPI) firewalls (see Cheswick 1994).

> […] but I wouldn't trust it as much as the security of a non-routable network.

Non-routable networks are not more secure than routable ones with SPI; at best the two are equal IMHO. Non-routable networks may actually be worse because of a false sense of security: all it may take is one end-point compromise and the enemy is one the other side of the moat.

[ Parent | on HN ]