From mboxrd@z Thu Jan 1 00:00:00 1970 X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on polar.synack.me X-Spam-Level: X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00 autolearn=ham autolearn_force=no version=3.4.4 X-Google-Thread: 103376,b95a522100671708 X-Google-Attributes: gid103376,public X-Google-Language: ENGLISH,ASCII-7-bit Path: g2news1.google.com!news3.google.com!newshub.sdsu.edu!border1.nntp.dca.giganews.com!nntp.giganews.com!nf3.bellglobal.com!nf1.bellglobal.com!nf2.bellglobal.com!news20.bellglobal.com.POSTED!not-for-mail From: "Warren W. Gay VE3WWG" User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7.2) Gecko/20040804 Netscape/7.2 (ax) X-Accept-Language: en-us, en MIME-Version: 1.0 Newsgroups: comp.lang.ada Subject: Re: For the AdaOS folks References: <1PTAd.1218$0y4.421@read1.cgocable.net> <1vemlj8wqr9ea$.qyecszhsmtqa$.dlg@40tude.net> <1b48kdfqsk3mw.7gajq12fsa82.dlg@40tude.net> <52fBd.42256$nV.1324414@news20.bellglobal.com> <_gHBd.14666$0y4.10314@read1.cgocable.net> <8rz51zshvp8k$.gvir0kpiedzk.dlg@40tude.net> <1cza5d5x7snmd.lr7wfm9fdsvd.dlg@40tude.net> <1hwsfqc0hx63i$.1dl0hkengaf6i$.dlg@40tude.net> <1klgtuv6sbypt.1wlc9u1ixz7ua$.dlg@40tude.net> <24hf82mgtexu$.c07xlxejxm1c$.dlg@40tude.net> In-Reply-To: Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Message-ID: Date: Tue, 04 Jan 2005 14:57:39 -0500 NNTP-Posting-Host: 198.96.223.163 X-Complaints-To: abuse@sympatico.ca X-Trace: news20.bellglobal.com 1104868587 198.96.223.163 (Tue, 04 Jan 2005 14:56:27 EST) NNTP-Posting-Date: Tue, 04 Jan 2005 14:56:27 EST Organization: Bell Sympatico Xref: g2news1.google.com comp.lang.ada:7440 Date: 2005-01-04T14:57:39-05:00 List-Id: Dmitry A. Kazakov wrote: > On Tue, 04 Jan 2005 13:00:04 -0500, Warren W. Gay VE3WWG wrote: >>Dmitry A. Kazakov wrote: >> >>You're not a practical man. > > Nor you are. We both stick to Ada! (:-)) OK. > But the only need in firewall is the policy of trusting behind it. That is all I need to keep you from messing with my files ;-) > Any > program may read your address book. Why your address book allows that? The > problem of the firewall approach is that the firewall has to know all > possible ways of misusing all possible system resources. Everything in me > cries that this is a wrong design, per definition wrong. The firewall is one cog in the security plan. It is like the root directory, that is quite capable of preventing people from gaining access to subdirectories and files. It is like the first "wall" that you hit (hence the name). >>Not a problem. I can determine who accesses the floppy >>when it is mounted (look up the mount command). > > Yes, but once mounted it is accessible for all. Actually it is the file > system with its access rights to the files, that makes access safe, not > only the mount command. You didn't do your homework on this one: Mount options for fat uid=value and gid=value Set the owner and group of all files. (Default: the uid and gid of the current process.) >>>>>The problem is that network protocols do not >>>>>have safety of a file system. >>>> >>>>A file system is confined. >>> >>>Come on, there were multi-user OSes before Windows. Even UNIX pretended to >>>be one. >> >>So? Who gets an account? (approved folk). >> >>Who is on the internet? (everyone, including hackers, nobody excluded) > > > Stop, the definition of a true multi-user system is that ideally you should > be unable to observe any effects of actions of other people (if you do not > want to, of course.) If a hacker cannot influence your work, do you care > whether he has an account or not? I forget how we got here, but I do agree that a secure O/S should permit "hostile user accounts". This is one my goals actually. But even if I had such a secure system, I would not dispense with the firewall. If you disagree, then fine - we'll leave at that. > The real difference is that in the > internet everybody is "root". I think I understand the point you are making, but to be fair, even this is not quite equivalent. Having root means having access to the account. On the net, you are hoping to acquire access (usually to root, directly or indirectly), by observation. > One my colleague adamantly refused to replace Windows NT 4.0 with XP on his > box. He argued that though MS does not plan any new service packs for NT, > neither do viruses developers! (:-)) You are lucky if you can install Win98, and get the service packs/updates before it gets riddled with viruses. Without a firewall, you might be good for 10 minutes, if you're lucky. Picture a Clint Eastwood dialog box saying "Do you feel lucky punk!?" ;-) -- Warren W. Gay VE3WWG http://home.cogeco.ca/~ve3wwg