Re: [xwt-users]Security, connection to servers

"Charles Goodwin" <[email protected]> writes:
> >  If your application is coming from the intranet (10.*
> > and 192.*) I don't see why it couldn't connect to
> > another intranet address. I realize why an internet
> > application should be limited to the internet.

> I think that the logic is something along the lines of... if one of your
> intranet machines is comrpomised, somebody could then plant an xwar on
> your intranet and everything xmlrpc is comrpomised.

You don't even need to compromise the machine -- all you need to do is
plant the file there!  You could use bugzilla to hack peoples' networks
by uploading an xwar as an attachment.

There are other situations, too: for example if you're using your
laptop at one site (say, at a customer's site) while VPN'ed into
another site (say, your home office).

You just can't assume that two machines automatically trust each other
because they're on the same subnet.  Machines with public IPs
implicitly trust anybody to connect to them.  You can't make any
assumptions at all about machines with private IPs.

  - a