Re: Content Filtering Firewall in Linux..

-----BEGIN PGP SIGNED MESSAGE-----
Hash: RIPEMD160

Hrvoje Spoljar wrote:
> You are looking for layer7 iptables patch.
> http://l7-filter.sourceforge.net/

No, You're really not. This was made for quality of service and suffers
the same problems as Netfilter with hex string support. Think about
this: You create a pattern for l7-filter (or Netfilter with hex strings)
to look for "sex" and drop it. First You run into the "Essex" problem,
so You change it to " sex ", but that doesn't block " sex." or " sex!"
or " Sex " and so on. So You write a regular expression for it
(l7-filter seems to support this). This finally blocks what You want it
to block. It also, however, blocks interesting, security-related
articles on spam. It blocks educational information on health, AIDS, and
similar topics. It blocks sites that use the word "sex" as a replacement
for "gender". Writing regular expressions like this will also not help
You on the issue of virus filtering.

In addition, all this can really do, being a component of the firewall,
is drop or reject the connection (connections either hang or end
abruptly without receiving all of the data). This is extremely
unfriendly and will not gain user acceptance. A system that sends back a
custom error page stating that the site has been blocked due to content
issues, and that objections should be directed to (add contact
information for site administrator here) is much better.

DansGuardian, and other similar solutions, use a point system that
mitigates the false positive issue metioned above. With this system, the
word "sex" appearing on a page will not automatically mean that the page
will be blocked. However, "sex" (30 points) with "whore" (50 points) and
"pussy" (100 points) will cause the site to be blocked, because the
total number of points (180) is more than the limit You set (160). (All
point numbers are examples only.)

		-&

- --
GPG key / Schlüssel -- http://simultan.dyndns.org/~arjones/gpgkey.txt
Encrypt everything. / Alles verschlüsseln.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org

iD8DBQFDBWBcoI7tqy5bNGMRA7/vAJwMYyOhoixhDvToo6BoVD2x9Ccq3QCguRar
xZEOZljpPCCE1nIpevEFlRQ=
=noAE
-----END PGP SIGNATURE-----