5 ms·

> Why does everything have to be built on top of HTTP? Port 80 is already open.

wmf 14y ago
All ports should be open between servers. (Edit: Ports should be open if you want. I'm not saying you should run without a firewall, but on a server the firewall is under your control, not your ISP's.) A few of the DiSo protocols were based on XMPP instead of HTTP.
- tptacek 14y ago
  That's not true either. The best practices for running services on EC2, for instance, don't leave anything but port 80 open by default. That's a good thing, because if the best practices were anything else, people would routinely lose their databases to people guessing "admin/mysql" over the Internet.
- MatthewPhillips 14y ago
  Maybe your servers, not mine.
- keypusher 14y ago
  > All ports should be open between servers. No thanks.
  - unixnoob 14y ago
    How about an "open" port with nothing listening on it? What does "open" mean? I think his point is that two nodes should be able to open and then connect on any port they choose, not just TCP 80. Please correct me if I'm wrong. Are we saying that a user should not even be _allowed_ to have an application listen on any port except a known few? Isn't the more important issue whether an application/process is actually listening on a port? I mean you can send me all the nasty bits you want but unless I'm prepared to receive them, what difference does it make? And I thought the whole premise here is that the only people on this social network are ones you know. They shouldn't be deliberately sending you nasty bits anyway. I am a unixnoob. Please go easy on me for my ignorance.
    - keypusher 14y ago
      I think it is true that if nothing is listening on the port, then the packets will be dropped by the OS. However, you may have services you are unaware of running, or malicious software which has snuck in, or a running application which would be listening on the port if it was open. Perhaps you want to run a webserver on localhost for testing, and by keeping the ports closed you block remote access. For these reasons it is generally regarded as bad practice to leave all ports on a server open to the public.
joshaidan 14y ago
Maybe this is another part of the problem. Limiting ourselves to port 80 limits the types of services we can create. But on the other hand, if we really wanted to run a service, then we would just open up the port. But yes, NAT does complicate things, particularly for home users, but I guess that's a limitation of the universe.
- kordless 14y ago
  Good luck with that and fanatical ops guys.

wmf 14y ago

All ports should be open between servers. (Edit: Ports should be open if you want. I'm not saying you should run without a firewall, but on a server the firewall is under your control, not your ISP's.) A few of the DiSo protocols were based on XMPP instead of HTTP.

tptacek 14y ago
That's not true either. The best practices for running services on EC2, for instance, don't leave anything but port 80 open by default. That's a good thing, because if the best practices were anything else, people would routinely lose their databases to people guessing "admin/mysql" over the Internet.
MatthewPhillips 14y ago
Maybe your servers, not mine.
keypusher 14y ago
> All ports should be open between servers. No thanks.
- unixnoob 14y ago
  How about an "open" port with nothing listening on it? What does "open" mean? I think his point is that two nodes should be able to open and then connect on any port they choose, not just TCP 80. Please correct me if I'm wrong. Are we saying that a user should not even be _allowed_ to have an application listen on any port except a known few? Isn't the more important issue whether an application/process is actually listening on a port? I mean you can send me all the nasty bits you want but unless I'm prepared to receive them, what difference does it make? And I thought the whole premise here is that the only people on this social network are ones you know. They shouldn't be deliberately sending you nasty bits anyway. I am a unixnoob. Please go easy on me for my ignorance.
  - keypusher 14y ago
    I think it is true that if nothing is listening on the port, then the packets will be dropped by the OS. However, you may have services you are unaware of running, or malicious software which has snuck in, or a running application which would be listening on the port if it was open. Perhaps you want to run a webserver on localhost for testing, and by keeping the ports closed you block remote access. For these reasons it is generally regarded as bad practice to leave all ports on a server open to the public.

joshaidan 14y ago

Maybe this is another part of the problem. Limiting ourselves to port 80 limits the types of services we can create. But on the other hand, if we really wanted to run a service, then we would just open up the port. But yes, NAT does complicate things, particularly for home users, but I guess that's a limitation of the universe.

kordless 14y ago
Good luck with that and fanatical ops guys.