Hacker News Reader

Comment by harry8 | Hacker News Reader

Follow up question, maybe even dumber:

Why the actual F%$K haven't they been deprecated and packets using them dropped by literally every tcp/ip stack if their only function is to get you f%$king pwned?

That might be a very dumb question for all I know. Maybe i shouldn't be cranky. It all seems like there are some very blase attitudes to this kind of thing, that should not even exist anymore, creating massive security holes, with zero upside tradeoff.

The seeming asymmetry offends me.

On the one hand it increases the attack surface and so the security risk. On the other, nothing. Yeah, let's take /that/ tradeoff on behalf of the entire internet.

View on HN

Because TCP/IP is used for more than just the internet. For pretty much all of these weird features someone is using them somewhere on their own networks. (And these things are frequently blocked on the internet or on firewalls).

> Because TCP/IP is used for more than just the internet.

So I'm so stupid & ignorant of security I think I would define "Internet tcp/ip" which conformant stacks block this rubbish by default like they do any other non-conforming packet. Thus reducing the attack surface essentially with no tradeoff. Weird uses can use customised lwip or whatever for these uses where we don't know the who, the what or the why (or perhaps even the IF).

Seems like nobody is shipping these firewall rules by default on internet routers. We get the vulnerability and as a tradeoff we get nothing of any value to us. Who do we thank for that?

What is the rationale, the justification for not paring away the garbage that does nothing but create vulnerabilities?

The internet is a loose connection of people and organisations that is very difficult to coordinate. A lot of people do block these packets, which is why they're basically vestigial, but it's not something that's really worth spending co-ordination effort on when it's something that's easily implementable by those who want to and there still isn't universal support for things like standards that prevent BGP hijacking.

Why? See the story we’re commenting on maybe?

Obvious and sensible engineering at a protocol level seems very worthwhile to me.

I agree new releases of TCP/IP stacks could ship with IP options disabled by default, and allow the system owner to turn on the ones they really need.

Reply on news.ycombinator.com