Re: [Users] Making FreeS/WAN harder to use, INTENTIONALLY.

-----BEGIN PGP SIGNED MESSAGE-----


On Sun, 2 Mar 2003, Michael Richardson wrote:

>   No, it is quite right.
>   It isn't for VPNs. End of story.

I'm going to have to explain how our default config breaks routing for
most SG users as we attempt to use technology (OE) they have no hope of
succeeding at (ie, there are no KEY/TXT records for our public IP, so why are
we even trying?).

We have a method of determining whether or not OE will succeed for the system
we are running on. Its the same one we use to determine whether a host is OE
capable. This would be in line with the notion of "Dogged Determination". My
notion is that we would prevent this breakage by not starting OE until we
might be able to succeed at it.

It has caveats - really, it's only appropriate to keep policy groups off if we
don't require it to implement security policy (ie, CIDRs in private or clear) 
- - and there may be other issues. But it's an intelligent use of OE, as opposed 
to blindly enabling the technology, regardless of the state of DNS.

This is a story that is considered a priority by some members of the team. I 
propose it become a greater priority for 2.01.

I'm worried that policy groups will become known amongst the VPN community as
"that thing you have to turn off so that FreeS/WAN works." This is
unfortunate, as instead of being able to convince them of its worth, their
first impression will be how it's broken.

- -- 
Sam Sgro
[email protected]


-----BEGIN PGP SIGNATURE-----
Version: 2.6.3ia
Charset: noconv
Comment: For the matching public key, finger the Reply-To: address.

iQCVAwUBPmKvCEOSC4btEQUtAQEWbQQAnxRix4vBkS7OgDHJiypKiKgWGyr4ByYr
xDGS14f0K5s5ESMNg28WZtR5/Yc65YRVDzt/jW2S+oZ1VFE3tpBlAThuk2+J4UaS
LrX6NjoKg4JGc83samPgGKrLGq8bWayT1/dQaJsSv47fwQJiarqVKXFz/q+WTsOh
Bkeb0Yl5jfY=
=H7JK
-----END PGP SIGNATURE-----