[XML-DEV Mailing List Archive Home] [By Thread] [By Date] [Recent Entries] [Reply To This Message]

Re: SOAP-RPC and REST and security

• To: Zach Kenyon <zkenyon@s...>, xml-dev@l...
• Subject: Re: SOAP-RPC and REST and security
• From: amyzing@t... (Amy Lewis )
• Date: Wed, 20 Feb 2002 22:42:02 -0500
• In-reply-to: <3C7410F1.18761.16A216F@localhost>
• References: <3C7441CA.8D2B3408@p...> <3C7410F1.18761.16A216F@localhost>
• User-agent: Mutt/1.3.27i

On Wed, Feb 20, 2002 at 09:11:13PM -0600, Zach Kenyon wrote:
>On 20 Feb 2002, at 21:58, Amy Lewis wrote:
>> On your *desktop*?  Does your network admin let you run web services
>> exposed to the internet?  Shouldn't he be looking into "would you like
>> fries with that" training, if so?
>
>Umm.  If you run Windows, you by definition run DCOM.  Is your desktop not 
>connected to the internet?  Did you not send this email via SMTP?

I sure did.  The SMTP daemon doesn't accept incoming connections; the
MUA is mutt, running on Debian Linux (testing).  I do have Windows
boxen on the network.  The firewall suppresses any attempt to contact
them, and they aren't allowed to start any conversations unless I
approve of the protocol.

Exposing any consumer-class OS to the internet without taking serious
steps to secure it is asking for trouble, with a near guarantee of
getting it.

The windows box I use at work is highly insecure.  But it isn't
connected to the internet, except through the firewall.  My admin
certainly isn't planning on allowing me to run IIS (or apache, for that
matter) for public consumption.

>> Refuse access, of course.  Just as HTTP doesn't go through to your
>> probably-insecure desktop web server.  Duh.
>
>How, then, does one connect to one's probably insecure desktop web 
>server?  String and tin cans?

Don't.

There's a reason that recent corporate practice places all machines
offering public services (including HTTP and SMTP) in the DMZ.  Those
machines are under threat, and may not be securable.  I've never worked
for a corp that allowed internal desktop machines to offer public
services.  I don't see that having SOAP on the desktop has any chance
of changing that.

Amy!
-- 
Amelia A. Lewis	        amyzing@t...           alicorn@m...
Igne natura renovatur integra.

• References:
  • Re: SOAP-RPC and REST and security
    • From: Paul Prescod <paul@p...>
  • Re: SOAP-RPC and REST and security
    • From: "Zach Kenyon" <zkenyon@s...>

• Prev by Date: RE: Two sides of SOAP (was RE: SOAP-RPC and REST and security)
• Next by Date: Re: SOAP-RPC and REST and security
• Previous by thread: Re: SOAP-RPC and REST and security
• Next by thread: Re: SOAP-RPC and REST and security
• Index(es):
  • Date
  • Thread