RE: safeweb

From: Bell, James (AZ76) (James.Bell@honeywell.com)
Date: 08/29/01 

Message-ID: <C4D4601DB346D411845F006008F60A3A04FEC5E6@az76ms02.az76.honeywell.com>
From: "Bell, James (AZ76)" <James.Bell@honeywell.com>
To: 'Michael' <ov3r@arnix.net>, gerlache@mail.swbell.net
Subject: RE: safeweb
Date: Wed, 29 Aug 2001 14:35:09 -0700

> -----Original Message-----
> From: Michael [mailto:ov3r@arnix.net]
>
> gerlache@mail.swbell.net wrote:
> > Anybody have a good idea for blocking the site
> https://www.safeweb.com and their triangle program
> altogether. Have thought about things like port redirection
> and DNS blocking safeweb altogether, but am not sure either
> would work or be effective if they do.
> >
> I would think if you have a ipchain,iptable firewall you
> would be able
> to block
> that incoming ip address from your services
>

Well, you can keep someone internally from running a Triangle Boy proxy by
making certain on your firewall/screening router that no traffic with
destination port 443 is allowed (exceptions of course for ssl capable web
servers that you actually want to be reachable).

Now, as for internal people using safeweb proxy services. It's pretty much
impossible to stop completely because of the triangle boy program. A quote
from their site:

*
Why can't Triangle Boy be blocked?
An individual Triangle Boy computer can be blocked. However, because there
are so many Triangle Boy addresses, and because many of those addresses are
dynamic and frequently updated, it will be extremely difficult for a
firewall administrator to block ALL of them simultaneously.
*

You can't even keep people from finding out about sites where triangle boy
is active. You can block inbound email from safeweb.com, and you can
url-block search engine queries for "triangle+boy" and such. This will make
it difficult to find them from the area you're trying to protect. This will
slow someone down a bit but only until the use of triangle boy gets more
widespread.