Re: hotmail not dealing with ECN

David Wagner
2001-01-27T04:12:40Z

Helge Hafting wrote:
>So, no reason for a firewall author to check these bits.

You don't think like a firewall designer! :-)

Practice being really, really paranoid. Think: You're designing a
firewall; you've got some reserved bits, currently unused; any future code
that uses them could behave in completely arbitrary and insecure ways,
for all you know. Now recall that anything not known to be safe should
be denied (in a good firewall) -- see Cheswick and Bellovin for why.
When you take this point of view, it is completely understandable why
firewalls designed before ECN was introduced might block it.