Date: Fri, 21 Feb 2003 18:02:12 -0500 From: Garance A Drosihn <drosih@rpi.edu> To: "Jeroen C. van Gelderen" <jeroen@vangelderen.org>, Robert Watson <rwatson@FreeBSD.org> Cc: "Crist J. Clark" <cjc@FreeBSD.org>, src-committers@FreeBSD.org, cvs-src@FreeBSD.org, cvs-all@FreeBSD.org Subject: Re: cvs commit: src/sys/netinet in_pcb.c (priv ports) Message-ID: <p05200f18ba7c5e8a0f1b@[128.113.24.47]> In-Reply-To: <4B77CF28-45C2-11D7-9535-000393754B1C@vangelderen.org> References: <4B77CF28-45C2-11D7-9535-000393754B1C@vangelderen.org>
next in thread | previous in thread | raw e-mail | index | archive | help
At 6:31 PM +0100 2/21/03, Jeroen C. van Gelderen wrote: > >In the meantime however, allowing an extension of the original, >overly restrictive feature provides some relief. I do think the change as done is a fine change. I would not even suggest that it be labelled "experimental". >For a large class of well-designed network protocols (including >SSH) the associated risk is limited to mere Denial of Service; >Annoying but preferred over a potential root compromise. The one thing we need to make clear is that the admin is not opening up "just SSH -- which we can trust", they are going to open up a range of ports. I think it's good to give them a way to do that, as long as it is clearly documented what they are doing. We should not say "just type in this command to open up FTP!", when the command is opening up more than FTP. However, I have a vague feeling that I am not understanding this update quite right, as I certainly have been confused by some of the replies in this thread. I should look at it more before I say something profoundly stupid about it. >And given that they are optional *and* disabled by default, the >new sysctls fit the FreeBSD mantra of "providing tools, not policy". I do think it's a useful change. It's just not useful-enough that I (personally) would use it, even though I would take advantage of something a little more flexible. I do understand that "more flexible" implies "more work" though. -- Garance Alistair Drosehn = gad@gilead.netel.rpi.edu Senior Systems Programmer or gad@freebsd.org Rensselaer Polytechnic Institute or drosih@rpi.edu To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe cvs-src" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?p05200f18ba7c5e8a0f1b>