From: SM [mailto:sm(_at_)resistor(_dot_)net]
It offers a fall sense of security. A person running a HTTP
server behind a NAT box usually does port redirection to that
server. The threat remains.
Arguments about false senses of security are usually wrong. We are adapted for
an environment where sabre toothed tigers are running around at night. So our
tolerance for insecurity is much higher than you might think. A sense of
security is created by familiarity, not by analysis.
The point here is not to shut off connectivity, but to shut it off by default.
If the user knows they want to run an HTTP server they can set it up
accordingly. The nice thing about NAT boxes is that a user who knows nothing
about their network can plug one in and the default state is to deny inbound
connections.
What that means is that the MYSQL server or the embedded SQL Server in their
application they didn't even know they had is shut off from external access. I
was running an unpatched version of SQL server when slammer hit without ill
effect. I have boxes that have not been booted for several years. I'll bet that
much on the code on those boxes is vulnerable too. I don't patch systems I am
not currently using.
Sure you can do much better if you 1) know what you are doing and 2) are
prepared to put in the necessary time. Most people don't meet either condition.
_______________________________________________
Ietf mailing list
Ietf(_at_)ietf(_dot_)org
https://www1.ietf.org/mailman/listinfo/ietf