RE: Need for security model

Well, it is just an example deployment. It's impossible to give full justice
in just 1 diagram if it still has to be easy to read and understand.

> The build system I had in mind was more peer-to-peer, with the work
> distributed among all (suitable) nodes.

I disagree with that. It's a package manager and not a render farm. I can't
really see any compelling reason to do so, but the disadvantages are
numerous: A vast number of toolchains scattered all over enterprise is an
admin nightmare, it allows for bypassing Xeta, and decreases manageability
all over and opens for possibility to install rogue unauthorized software.
Also, as you know, if someone is dead set to not use a central build server
it is free for them to do so, if they configure Xeta for it and install the
needed components on the nodes in their network. A corporate network needs
to be in the hands and under the control of the administrators. Else it just
will not work.

> 
> The Xeta build and install services, if available over the Internet,
> would greatly assist remote administration.
> 
> And let's not forget that some company's networks are as global and
> distrustable as the Internet.
> 

Indeed, which is why I put the XBuild repository in the DMZ in the example.
But you are right. There is a struggle going on. First there were mainframes
and everything was nice and manageable, then came client/server computing
and it met the needs for business better but at the cost of being less
manageable. Now today we stand with full blown distributed applications and
web services and grids and what have you. Probably that's even better for
business, but we can all see what it means for manageability. We have to
constantly remind ourselves that we are here to fight the complexity and not
add to it. 

> We should also try to avoid the DHCP-on-LAN-compromises-rebooting-Macs
> type debacles by providing paranoia affirmation services even on local
> networks.

Do you mean rogue servers? If so, that is why we need service authentication
as stated in notes about security model. It's also partly the reason why
I've been talking about single sign-on and security boundaries/realms.
Either way, Kerberos v5 can potentially take care of all this for us so it's
an option to consider.

Kind Regards
Frantz Dhin