By now, most security geeks have read up on the IPv6 flaws that became the biggest show in town at the CanSecWest conference in Canada recently.

Basically, some idiot at the IETF managed to cut and paste some very silly ideas used in IPv4 into IPv6. Vendors dutifully implemented the "feature", which needless to say, was a bad idea.

So now everyone's busy ripping the feature out of their products, and the usual band of standards fascists are jumping up and down saying the IETF (Internet Engineering Task Force) process is completely broken and heads need to roll.

However, Adam Pointon, a consultant with Assurance.com.au in Melbourne, disagrees. In essence, Pointon says that secure from design through to implementation is, obviously, the best way to do things. But, alas, this current situation... well, that's just how the cookie crumbles.

I agree.

While it would be nice to have a standards body that didn't release RFCs that, when implemented to the letter, result in a vulnerable product. That said, the sky hasn't fallen in, the guys from OpenBSD have had an opportunity to grandstand, which they love, security departments have been able to tut-tut development teams, which they love, and security firms have scared the pants of current and potential customers, which they love. In short, everybody is a winner here.

Have a listen to my interview with Pointon here.