[vox-tech] xhost+: Why you should NEVER DO THAT

[Karsten M. Self]

on Fri, Mar 18, 2005 at 07:54:50AM -0500, Peter Jay Salzman (p at dirac.org) wrote:
> On Fri 18 Mar 05,  2:18 AM, Karsten M. Self <kmself at ix.netcom.com> said:
> > Mark Kim apparently insists on dispersing bad advice regarding use of
> > xhost + to allow remote X11 access.

Pete:  no need to quote 384 lines.

> If my firewall blocks tcp/udp ports 6000-6007, can you tell me how my x11
> events can be captured by someone other than my lovely wife and cat?

1.  You can never trust cats.
2.  Does your network include wireless access?
3.  Is your network radiation shielded?
4.  Is all your hard-wired network directly visually inspectable?
5.  Are foreign systems allowed on the network?

A small home LAN or an airgapped lab / classroom LAN are two of the
conditions under which I'd consider possibly allowing for non-tunneled X
access.  That said, on my own, hardwired, single-user, handful-of-nodes
LAN, on the rare cases I do run X apps remotely, I tunnel them.


The history of secure applications development is largely divided into
two groups:

 1. Those who anticipate hostile environments, design for scenarios in
    which no two components trust one another, and correctly implement
    failsafe, trust, integrity, and encryption procedures.

 2. Those who've been the source of multiple compromises.


Paranoia pays off here.  Safe practices pay off.  Even those who _are_
paranoid and cautious suffer breakins (the good ones will let you know
that this has happened).  The truely frightening are those who deny the
problem exists _and_ fail to recongize a compromise when they see it.

Mark, you listening?


Peace.

-- 
Karsten M. Self <kmself at ix.netcom.com>        http://kmself.home.netcom.com/
 What Part of "Gestalt" don't you understand?
    Why are you so paranoid, Mulder?
    Oh, I don't know. Maybe it's because I find it hard to trust anybody.
    - Scully & Mulder, The X-Files, Ascension
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: Digital signature
Url : http://ns1.livepenguin.com/pipermail/vox-tech/attachments/20050318/d2a3f22b/attachment.bin