Messages in this thread | | | Subject | Re: RFC: disablenetwork facility. (v4) | From | Valdis.Kletnieks@vt ... | Date | Wed, 30 Dec 2009 11:26:20 -0500 |
| |
On Wed, 30 Dec 2009 07:24:11 GMT, David Wagner said: > So while I certainly can't rule out the possibility that disablenetwork > might introduce minor issues, I think there are fundamental reasons to > be skeptical that disablenetwork will introduce serious new security > problems.
I have to agree with David here - although there's many failure modes if a security-relevant program wants to talk to the network, they're all already prone to stuffage by an attacker.
Biggest danger is probably programs that rashly assume that 127.0.0.1 is reachable. Seen a lot of *that* in my day (no, don't ask how I found out ;)
[unhandled content-type:application/pgp-signature] | |