Re: "uselessly listens on localhost" RC

[Luk Claes <luk@debian.org>]

Andreas Barth wrote:
> after some discussion we had today on IRC, I tend to think we should
> put a section within "security" of the release policy that says
> something like "Packages must not open listening sockets at localhost
> where usage of a unix domain socket (in the filesystem) would be
> equally sufficient".
> 
> Reasoning for this is that opening listening sockets with the network
> allows "better" ways to exploit security bugs than in the traditional
> unix filesystem.
> 
> 
> Comments?

In general that seems to be harsh unless you are talking about software
that never should listen on the network or where the use case of not
listening on the network is really important.

Unless you want to make it should not instead of must not?

Cheers

Luk