RE: [fw-wiz] tunnel vs open a hole
From: Behm, Jeffrey L. (BehmJL@bvsg.com)
From: "Behm, Jeffrey L." <BehmJL@bvsg.com> To: email@example.com Date: Mon, 7 Apr 2003 15:14:50 -0500
This is one reason why a client I work for has implemented outbound http
authentication required. While certainly not perfect, this helps keeps most
that require port 80 outbound to a minimum.
The biggest problem we have seen is that app developers don't understand how
handle a response from the proxy server that says "Hey, you tried to open a
connection but did not provide any credentials, so please authenticate."
they just blindly assume its gonna work and apparently don't perform any
programming 101 error checking, and just let the app die a horrible
(but deserving :-)) death.
When will programmers begin (again) to do basic error checking?
Marcus J. Ranum spewed:
> We made a big mistake when we started building
> firewalls that
> allowed outgoing connections that were not individually
> authenticated and
> associated with a human user's request.
firewall-wizards mailing list