Re: ALL: PARANOID from /etc/hosts.deny Should be Commented by d
>> We already ask people for local networks during installation.
>> How hard would it to add an extra question or two?
>> "Do you want to only allow connections from these local networks?"
>> "Do you want to add more allowed networks?"
> I'm not sure that it will be a good idea to add more questions
> to the installation proccess.
well, seeing the gigantic troll that followed the ALL: PARANOID
case, it seems that there is no commonly agreed practice, and the
choice SHOULD be left to the user.
if somebody isn't able to say whether or not she will receive
incoming connexions, she SHOULD NOT be running any network services
("a backdoor ? what is that ? that sounds neat, let's install it").
that may seem a bit harsh, but read that little story :
in my university, some psyschotic sysadmin installed mandrake
boxes for us students. bad luck : by default, some brain-damaged
X session script does "xhost +localhost", thus allowing every
nasty things you can think about (spawning every X client you want
on people who forgot "xhost -localhost" in their .xession ...).
why did mandrake do that ? so that "ignorant" users can easily
login as "jrandom", then "su", then launch their favourite graphic
mode tools without having to bother typing "xhost +localhost", or
better, "export XAUTHORITY=~jrandom/.Xauthority". It seemed so
impossible to me, that I had to massively grep the filesystem to
find this f***ing "xhost +localhost" line, I could not believe
a sensible person would have put that in default scripts ...
OK, the comparison is a bit rude, but beginners tend to activate
everything blindly ("oh, sure the server version is better than
the workstation version, lets install all those services I don't
even know what they are for!"), and having them read a bit of
doc (at least /usr/share/doc/someservice/README.Debian) can never
be wrong. We want to make their life easy, but we tend to forget
that "dummy" users are, err, dummy as well as users. No offense
intended, but when you want to drive a car, you have to get a
driving license, or you're gonna kill people ... if you want to
run network services, you just have to read some docs. is that
such a big tradeoff ?
And while we are doing gross comparisons, here's my 2 cents
about the DNS problem : sure, it's not our job to enforce DNS
consistency. but remember the AOL/HTTP case (AOL deliberately
violated the HTTP specs in its client, and when Apache refused
to do any compromise, AOL had to fix its client). Another closer
example : many commercial programs nowadays use MSIE5 (the infamous
browser), and won't work with NS4 or mozilla. Many sites have to
switch to MSIE5 if they want to be able to run these apps. If
many sites refused to install MSIE5, vendors would have to
write their HTML more cleanly. Would not that be nice ?
Back to DNS : if everybody had a clean DNS, it would enforce
those with broken setups to fix it. We don't rely on DNS, but
broken DNS really sucks sometimes (how many times did you have
to wait for a DNS timeout because some moron did not have a
correct reverse DNS setup?).
--------------------------------------------
Being a BALD HERO is almost as FESTIVE as a TATTOOED KNOCKWURST.
Reply to: