Re: [xwt-users]Security, connection to servers

On Fri, Jul 11, 2003 at 09:20:36AM -0700, Adam Megacz wrote:

> You don't even need to compromise the machine -- all you need to do is
> plant the file there!  You could use bugzilla to hack peoples' networks
> by uploading an xwar as an attachment.
> 
> There are other situations, too: for example if you're using your
> laptop at one site (say, at a customer's site) while VPN'ed into
> another site (say, your home office).
> 
> You just can't assume that two machines automatically trust each other
> because they're on the same subnet.  Machines with public IPs
> implicitly trust anybody to connect to them.  You can't make any
> assumptions at all about machines with private IPs.

This does in turn assume that 192.168.*.* et al are intranets, and all
others aren't. I know at least two organisations that have intranets
that are inaccesible from the outside yet use what would be considered
'public' addresses byt he XWT engine.

-- 
Emiliano