Subj : Web access, false BBS ID
To   : ANDY BALL
From : MICHEL SAMSON
Date : Thu Oct 28 2004 11:33 pm

Hi Andy,

    About "TelNet vs SSH" of October 28:

BG> Are there any web-access BBSs, other than EleWeb...
MS> ...the obvious lack of security is what i'd call a deterrent, in
MS> favour of plain old DialUp/~TelNet~ BBSing, i mean...
AB> How is this any more secure than an unencrypted HTTP connection?
MS> We're in perfect agreement over ~SSH~, not the removal of ~TelNet~.
AB> Sysops seem pretty thin on the ground these days...
MS> ...it's not tempting to leave such people too much ground...
AB> What telnet transition?

    Well, for some people, not everyone, euh...  the total disapearance
of local DialUp BBSes didn't take place without being noticed;  for some
BBSers among the others, the transition to ~TelNet~ was relatively easy.

                                 %-b,

    A couple years suffice, in absence of any help.  The real challenge
was ~OLMR~ BBSing which depended on the availability of ~TelNet~ clients
with suitable `ZMoDem' support, as far as i'm concerned.  Of course, for
some people, not everyone, euh...  SoftWare/HardWare may be an issue but
others will argue this is only marginal.  And now, for the ones who must
cope with transitions on their own, euh...  there's more to come:  ~WEB~
access (which may go unnoticed by some people but not everyone) and then
~SSH~ (idem).  Considering the increasing number of these transitions, i
shouldn't be surprized that you must happen to wonder about which it is!

                                 ;-)

AB} After reading this paragraph several times I /think/ I understand...
AB> ...use English more simply, you may end up with more readable...

    More than once!  In that case i shall make my posts *LESS* legible!

                                 8-)

MS> I'd make the UpGrade Path INCLUSIVE.  I'm thinking of a scheme like
MS> ~POP3~ before ~SMTP~...  ...i'd keep ~TelNet~ but require my LEGACY
MS> users to validate using ~SSH~ and then grant ~TelNet~ access only
MS> after the ~IP~ address is approved...
AB> Please explain...  That would not work for the many, many people who
AB> are assigned IP addresses dynamically...
                             ^^^^^^^^^^^
    Instead of "like" i should have wrote "similar" as i wouldn't agree
to depend on ~E-Mail~ myself (not before i tried some sturdier methods)!

                                  :)

    Indeed, but i haven't tried to determine on which criteria the ~IP~
address should be approved just yet.  What about Domain Names?  This was
only meant as an alternative to accomodate BBSers who must connect using
~SSH~ then ~TelNet~ *SEPARATELY*, for some reason...  The BBSer could be
requested to connect through a recognized access to retain his privilege
and, since the number of ~ISP~s increases while more BBSers quit all the
time, euh...  the likelihood that BSS hackers who got the same ~ISP~ may
try to steal my identity got slim (and French-Canadian BBSers are rare)!

MS> ...~TelNet~ can be secure enough if combined with ~SSH~/~HTTPS~...
AB> Combining them is odd.

    Combining them would accomodate BBSers who can't use file transfers
over a same ~SSH~ session but who could ~SSH~ then ~TelNet~, separately.

    To accomodate BBSers when there's only a few left isn't that "odd".

AB> Why reinvent the wheel?

    Yes, that's one question i keep asking myself all the time when the
file transfers over ~TelNet~ problem is on topic!!!  Authors/SysOps need
to play with new stuff but why break the UpGrade Path and impose on us?!

                                  :(

    Those who promote ~WEB~-based interfacing to .QWK doors help BBSing
but not when something as basic as identity is overlooked, unless it's a
world where the only users left are all SysOps who have lost control and
who just can't cut each other's feeds without hurting `FdN' to death!...

                                 %-b,

                                   Salutations,

                                   Michel Samson
                                   a/s Bicephale
                                   http://public.sogetel.net/bicephale/


... I BBS using LEGACY DOS+TCP/IP+TelNet+ZMoDem/Kermit+.QWK technologies
--- MultiMail/MS-DOS v0.45 - Trying to make TelNet OLMR BBSing UNIVERSAL
* Origin: BBS Networks @ www.bbsnets.com 808-839-6036 (1:10/345)