Re: FW-1 technical strength

[jgalvin () cs loyola edu]

I agree that these settings should be known by knowledgeable
administrators, but to issue a security advisory against them is too
strong; these settings are useful in some environments.  They are also
documented as capabilities of the machine, not as bugs.

The point that I was trying to make was that maybe the mail on Rule 0
should have been made an fyi, certainly not an advisory.

Regards,
Jenn

> In some email I received from Ryan Russell, sie wrote:
> > Ok, so what's wrong with it?
>
> In some ways you could compare the default FW-1 settings with those for
> SunOS4 and /etc/hosts.equiv.  It's the first thing that "anyone in the
> know" changes, but there's more units sold than "people in the know".
> Everyone knows they're insecure but the vendor still ships it that way
> to everyone's disbelief.
>
> Darren