3 ms·

I wouldn't/don't mind better research/work into better permission systems for OS's/processes; allowing the user control over what gets exposed to incoming conne

I wouldn't/don't mind better research/work into better permission systems for OS's/processes; allowing the user control over what gets exposed to incoming connections and what is allowed to make outgoing connections is fine and good. NAT, and uPnP, is not that. In the case of uPnP: if uPnP was SOP, wouldn't the camera (needing to be "remotely accessible" because the Internet of Crap) just make the requisite uPnP calls, likely making everything accessible? NAT, in particular, is terrible. Trying to explain to a normal user how to establish NAT port-forwarding for devices or applications is a UX nightmare. NAT, in particular, kills off entire classes of protocol design, necessitating hacking around NAT by routing traffic through untrustable third-party servers. NAT is further not a firewall: one anything inside your NAT gets remotely exploited, and everything else is wide open. (And that's at best; depending on the protocol in use, you might not even need remote code execution.) (And uPnP's support in my experience has been utterly pathetic.)

nat4ever 10y ago
Of course, I'm being a little cheeky, but ah, my sentiment of digging a moat around a house with an unlocked door is an idea I'll always keep in my back pocket, and show no hesitation in applying a ridiculous solution to a ridiculous problem. Obscurity and inscrutability certainly will never supplant the Objective Ideological Truth that "Security" tries to be, but it's often useful as a source of leverage when all other leverage would be denied to you. You could never ever claim to endorse obscurity for its own sake during a daily stand-up or a conference call, because people woud rip you to shreds for any number of valid reasons, but when push comes to shove, and you find yourself on the losing side of someone else's moral hazard, being able to throw a smoke screen up, where a brick wall would be preferred, is sometimes all you can do.

nat4ever 10y ago

Of course, I'm being a little cheeky, but ah, my sentiment of digging a moat around a house with an unlocked door is an idea I'll always keep in my back pocket, and show no hesitation in applying a ridiculous solution to a ridiculous problem. Obscurity and inscrutability certainly will never supplant the Objective Ideological Truth that "Security" tries to be, but it's often useful as a source of leverage when all other leverage would be denied to you. You could never ever claim to endorse obscurity for its own sake during a daily stand-up or a conference call, because people woud rip you to shreds for any number of valid reasons, but when push comes to shove, and you find yourself on the losing side of someone else's moral hazard, being able to throw a smoke screen up, where a brick wall would be preferred, is sometimes all you can do.