Subj : Web access, false BBS ID
To : Andy Ball
From : Michel Samson
Date : Wed Oct 27 2004 11:00 pm
Hi Andy,
About "Web BBS" of October 27:
BG> Are there any web-access BBSs, other than EleWeb...
MS> Take a peek into the `FdN_SysOp.Rights' echo... ...October 13...
MS> ...the obvious lack of security is what i'd call a deterrent, in
MS> favour of plain old DialUp/~TelNet~ BBSing, i mean...
AB> How is this any more secure than an unencrypted HTTP connection?
MS> ...BBSers like me who don't know how to steal PassWords do have a
MS> way to steal identities! We're in perfect agreement over ~SSH~,
MS> not the removal of ~TelNet~. ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
AB> It was bound to happen, eventually.
I guess this event can be classified according to the laws of chaos
but other natural laws will predict that all good things come to an end!
%-)
JW> What's the hole? I don't see it. ...that's nothing new...
AB> Sysops seem pretty thin on the ground these days...
Considering the apparent lack of concern from authors/SysOps on who
the BBSers depended for their SoftWare when the whole BBS community went
thru the ~TelNet~ transition, euh... relatively to a most basic feature
of DialUp BSSing (file-transfer!), euh... Pardon my negativism but it's
not tempting to leave such people too much ground so that this adventure
is repeated in the same exclusive fashion again! Important things which
~WEB~ BBSes must address first are treated last, it seems; that's how a
stranger's name replaced mine! It never happened when using ~TelNet~...
%-o
MS> If I were to set up a BBS with Internet access, SSH is probably the
MS> approach that I would take. Web-based BBS have their place too.
I'd make the UpGrade Path INCLUSIVE. I'm thinking of a scheme like
~POP3~ before ~SMTP~ but with a twist; i'd keep ~TelNet~ but require my
LEGACY users to validate using ~SSH~ and then grant ~TelNet~ access only
after the ~IP~ address is approved... I can live with innovations since
~TelNet~ can be secure enough if combined with ~SSH~/~HTTPS~ and i might
even imagine other ways to adapt plain old ~TelNet~ sessions without any
newer protocols (via additionnal security macros/utilities, perhaps?)...
%^)
AB> Telnet clients are ubiquitous, the fact that they come as standard
AB> equipment with most operating system software, and are available for
AB> more besides (including DOS) counts in favour of telnet.
Now that we begin to get ~TelNet~ clients with decent file-transfer
support (after years of waiting) lets enjoy what's here, i would say!...
:)
AB> Whether to allow the use of an insecure protocol to access the BBS
AB> is ultimately the sysop's decision.
And a BBSer's choice, as well. I'm a relatively young BBSer but it
isn't acceptable to have multiple identities (nor aliases) on `FidoNet';
i'd know what MY option is should the matter become a major problem! My
previous reply followed this logic, in a way: we always have the option
of informing the authors/SysOps about security issues we come to notice.
Salutations, :)
Michel Samson
a/s Bicephale
http://public.sogetel.net/bicephale/
... `MS-DOS v7.10a'+`LSPPP v0.8'+`RLFossil v1.23'+`MS-Kermit v3.15 Med.'
___ MultiMail/MS-DOS v0.45 - Numbers make BBSing UNIVERSAL, not sugar...
--- Maximus/2 3.01
* Origin: COMM Port OS/2 juge.com 204.89.247.1 (281) 980-9671 (1:106/2000)
