> On 2 Dec 2020, at 11:37, Peter Gutmann <pgut...@cs.auckland.ac.nz> wrote: > > Eliot Lear <l...@cisco.com> writes: > >> If a device can be at all critical (and even if it isn’t), then it should be >> upgraded or replaced. > > The fact that many of these devices are extremely critical is precisely why > they're never replaced or upgraded, because they can't be taken out of > production.
I am well aware of vast amounts of insecure systems being out in the wild, up to and including pace makers. Being critical doesn’t make them any more secure, and we shouldn’t say otherwise. They are at risk, and we should say so, and not excuse them. If we want to have operational guidance around how to handle insecure devices, I am ok with that. Those might include secure facilities, application aware proxies, and other aspects, but I am not sure that is this document. Eliot
signature.asc
Description: Message signed with OpenPGP
_______________________________________________ TLS mailing list TLS@ietf.org https://www.ietf.org/mailman/listinfo/tls
