[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: IPSEC WORKING GROUP LAST CALL
Rob Adams writes:
> So, I need this. A bunch of us need this. If you aren't
> comfortable agreeing to a standards document, then provide a number
> and a method for negotiating down to stupid. I think that is
> reasonable.
May I ask you why you would want to sell snake oil to customers? I
mean, you know that 40 bit keys are worthless for practical
purposes. You wouldn't sell a customer a "latency server" that slowed
their packets down by 20ms and did nothing else for them. Why would
you sell them a box that probably has just about as much use to them?
> That gives you a way to say you don't endorse it and allows those of
> us that do have to depend on exporting products to stay in
> business or out of jail..
Why do you want to stay in this business in the first place?
If your customers need IPsec products, let them buy them from folks in
Finland or New Zealand. They don't need to buy junk from you when they
could buy full strength crypto from other countries.
> Righteous indignation aside, this really is critical for some of us.
You are telling me that the crypto regulations have caused you pain,
and that jobs might be lost because of them. True enough.
You work for a giant company. Tell them to go and lobby the Congress
to get rid of the stupidity before you lose more jobs. Don't pretend
that if you sell clear polyethelene bags for your customers to walk
around in that people can't still see their genitalia or that they are
going to stay warm in the things in the winter.
This is, in essense, a political problem. You are losing business to
companies overseas, and you don't want to, so you are asking us to
make it possible for you to sell something that we will pretend is
"IPsec" even though it isn't really useful, so that your customers
won't go to Tatu Ylonen or Eric Leay or someone else in a free country
to get their crypto. Are you doing those customers a service by
distracting them from products that would actually solve their
security problems so that you can make another sale? Is that the
ethical way to go about your business? Sure, you are losing
jobs. Solve the political problem with politics, not with playing with
the standards docs.
Above all, I don't want naive systems managers who barely know which
end of the connector to plug in to be distracted by fake
cryptography. If the choice is between just having offshore vendors
selling conformant products to offshore customers, or having onshore
vendors selling fake security products to those offshore customers
instead of the offshore vendors selling them real ones, I'd rather
have the U.S. lose jobs.
Perry
References: