RE: What features shall be handled by SLiMP3 andwhat features shouldn't?

> >
> > Specifically about your password protection feature, I'd certainly 
> > consider it for inclusion in the main server if it didn't make it 
> > harder to set up and use, increased the security of the product and
> > wasn't going to be a burden for us to maintain.
> >
> But this is a big deal. Right now you've provided a server that's 
> impossible to secure, which means that anyone with a port scanner can 
> find it if it's not blocked by a firewall. Even basic HTTP 
> authorization as an option would prevent people from browsing your 
> library, changing your player settings, and finding your music files 
> and downloading them. Providing some level of basic authentication, 
> at least as an option, is vital. I'm not saying you need to create a 
> users-and-groups interface or an IP range restriction or anything, 
> but even my TiVo Web hack (tivo.lightn.org) has the ability to do 
> basic authentication.
> 
One of the first articles I posted here was about access control lists,
based on a list of "trusted" IP addresses, and I said that I would post
some patches.  Of course, I promptly forgot all about it as the machine
that runs my SLIMP3 server is well protected anyway.

HTTP Basic Authentication sends the username and password in the
clear, so you only get the illusion of security, rather than an actual
secure setup.  Pretending to be connecting from one of the IP addresses
in a "trusted" list is a lot trickier, especially if those IP addresses
are all in one of the private address ranges.

If I get some time this week, I'll look into this and may propose some
patches.

-- 
   _/   _/  _/_/_/_/  _/    _/  _/_/_/  _/    _/
  _/_/_/   _/_/      _/    _/    _/    _/_/  _/   K e v i n   W a l s h
 _/ _/    _/          _/ _/     _/    _/  _/_/    [email protected]
_/   _/  _/_/_/_/      _/    _/_/_/  _/    _/


------------------------ Yahoo! Groups Sponsor ---------------------~-->
Get 128 Bit SSL Encryption!
http://us.click.yahoo.com/FpY02D/vN2EAA/xGHJAA/rIp0lB/TM
---------------------------------------------------------------------~->

To unsubscribe from this group, send an email to:
[email protected]

 

Your use of Yahoo! Groups is subject to http://docs.yahoo.com/info/terms/