4 ms·

Please do not enable "stealth mode" in the ALF. This violates applicable standards, impedes system and network management, and provides no additional security

Please do not enable "stealth mode" in the ALF. This violates applicable standards, impedes system and network management, and provides no additional security (as anyone with nmap can readily verify). Hosts are required to respond to unicast ICMP echo requests, period [0]. No exceptions. [0] https://tools.ietf.org/html/rfc1122#page-42 https://tools.ietf.org/html/rfc1122#page-42

gress 11y ago
Many of the other recommendations on this list are similarly 'conservative'. Basically it's an attempt to reduce surface area as much as possible.
- simoncion 11y ago
  > Basically it's an attempt to reduce surface area as much as possible. Attempts to reduce surface area that fail to actually achieve their goal and impede the proper functioning of networks the affected system connects to should be avoided whenever possible, no?
tptacek 11y ago
"Impeding system and network management" is potentially a real argument (though one most OS X users, whose machines are not rightfully overseen by any network manager, might dismiss). But the appeal to IETF standards that brackets that argument, with it's "period, no exceptions" language, is a bit galling. Who cares? The IETF has made all manner of silly rules in its history. Why isn't this simply one of them?
- seanhunter 11y ago
  Totally agree. It's fair to realise that there are consequences to deviation from standards, but (like many people) I don't consider the fact that IETF makes something a standard to be a binding requirment on me to do something on my boxes. For one thing, the standard was built for an extremely different internet than the one we have today.
drdaeman 11y ago
Or at least re-enable in advance those if you call your ISP and complain about any connectivity issues. You're unlikely to know this, but some engineer will thank you in their mind. (I've used to work at ISP. ICMP echoes towards the customer's machine is a first step in diagnosing what could be wrong - and sometimes it really helps to get an image of what's going on. Sadly, a lot of machines do not respond to those.)
yardie 11y ago
While I agree this is the case for servers and workstations connected to the internet with a public IP. Wouldn't this be different for laptops and PCs that are NATed 10 ways to sunday?
- fredkbloggs 11y ago
  They're still required to respond; it's just not possible to reach them in the first place. Which also means that there cannot possibly be any meaningful security improvement to be had by not responding. Which is to say, turning this off is even more pointless than it would be otherwise.
forgotmypassw 11y ago
Except for hosts that do not wish to respond.
- fredkbloggs 11y ago
  The exception in 3.2.2.6 is for requests sent to multicast or broadcast addresses, not unicast. Or are you citing some other standard that supersedes this one?
seanhunter 11y ago
Hang on, if I'm going to be a real pedant, that section says that the host must implement an echo server that can reply to ICMP echo requests, it doesn't say that the host must reply to those requests. By that standard, OsX is compliant because it has the server. You don't have to enable the response.

gress 11y ago

Many of the other recommendations on this list are similarly 'conservative'. Basically it's an attempt to reduce surface area as much as possible.

simoncion 11y ago
> Basically it's an attempt to reduce surface area as much as possible. Attempts to reduce surface area that fail to actually achieve their goal and impede the proper functioning of networks the affected system connects to should be avoided whenever possible, no?

tptacek 11y ago

"Impeding system and network management" is potentially a real argument (though one most OS X users, whose machines are not rightfully overseen by any network manager, might dismiss). But the appeal to IETF standards that brackets that argument, with it's "period, no exceptions" language, is a bit galling. Who cares? The IETF has made all manner of silly rules in its history. Why isn't this simply one of them?

seanhunter 11y ago
Totally agree. It's fair to realise that there are consequences to deviation from standards, but (like many people) I don't consider the fact that IETF makes something a standard to be a binding requirment on me to do something on my boxes. For one thing, the standard was built for an extremely different internet than the one we have today.

drdaeman 11y ago

Or at least re-enable in advance those if you call your ISP and complain about any connectivity issues. You're unlikely to know this, but some engineer will thank you in their mind. (I've used to work at ISP. ICMP echoes towards the customer's machine is a first step in diagnosing what could be wrong - and sometimes it really helps to get an image of what's going on. Sadly, a lot of machines do not respond to those.)

yardie 11y ago

While I agree this is the case for servers and workstations connected to the internet with a public IP. Wouldn't this be different for laptops and PCs that are NATed 10 ways to sunday?

fredkbloggs 11y ago
They're still required to respond; it's just not possible to reach them in the first place. Which also means that there cannot possibly be any meaningful security improvement to be had by not responding. Which is to say, turning this off is even more pointless than it would be otherwise.

forgotmypassw 11y ago

Except for hosts that do not wish to respond.

fredkbloggs 11y ago
The exception in 3.2.2.6 is for requests sent to multicast or broadcast addresses, not unicast. Or are you citing some other standard that supersedes this one?

seanhunter 11y ago

Hang on, if I'm going to be a real pedant, that section says that the host must implement an echo server that can reply to ICMP echo requests, it doesn't say that the host must reply to those requests. By that standard, OsX is compliant because it has the server. You don't have to enable the response.