Re: Service location vs. careless privacy infringement

I doubt whether obscurity (open directory server, just not known
by DNS announcement) is the right way to solve the problem.

If you are determined it is rather easy to scan the hosts for an
answer on the LDAP port. If such a person is clever enough they are
not spotted that easily.

The right way is to improve the LDAP servers deploied with appropriate
configuration methods to distinguish between local and non local users.

Thomas Lenggenhager

 ___________ SWITCH - The Swiss Academic and Research Network ___________
 Thomas Lenggenhager, SWITCH, Limmatquai 138, CH-8001 Zurich, Switzerland
 [email protected]      Tel: +41 1 268 1540      Fax: +41 1 268 1568

On Thursday, 2 Jul 1998, Hallvard B Furuseth writes:
> Has anything been done to prevent service location from magnifying the
> problem of servers that carelessly ignore privacy protection?  This
> needs to be addressed, but seems woefully absent from the documents I've
> plowed through so far.
>
> There are a lot of LDAP/directory servers that ignore privacy protection
> laws.  As with WWW a few years ago, "everybody" are setting up such
> servers, and a lot of them seem to forget about privacy protection.
> Unindexed, such servers are in practice more or less local, so the
> problem ism't that severe.  However, automatic service location will
> magnify this problem enormously, at least location via the simple
> convention DNS CNAME = <service>.<domain>.  We should not do that.
>
> It may even be illegal to run a search robot in Norway which doesn't do
> a reasonable job of exluding illegal servers.  Along with NameFLOW,
> UNINETT wants to run a search robot which indexes legal LDAP servers.
> (Well, servers that *claim* to be legal, I suppose.  We are not police.)
> OTOH, we don't want to be outcompeted by a more careless robot abroad
> which indexes all servers and is immune to Norwegian law.
>
> BTW, if any of you are nearby, please give be a swift kick for not
> mentioning this a few years ago:-(
>
> --
> Hallvard B Furuseth
> UNINETT Directory Service