Todd Vierling writes:
> : Having the kernel do the right thing by default would give you a nice
> : "belt and suspenders" security feel.
> 
> That depends on what you say is Right - in the proposal, it's all-or-none,
> and I can present dozens of combinations where ipf is quick and correct and
> a full strong-end system is too restrictive.

Fine, but I rarely face that problem. Having this as an option (note,
OPTION) would be useful for me. I want it. If you don't want to use
it, don't use it, but it is good for me.

Perry