Roasting old chestnuts

William Hooper whooper@freeshell.org
Sun Jul 6 16:40:01 2003


Robert de Bath said:
> On Sun, 6 Jul 2003, William Hooper wrote:
>
>> Robert de Bath said:
>> > Please don't run away, I do seem to have a new slant on this can of
>> wormy
>> > chestnuts.
>> >
>> > The label on the can is "file transfers".
>> [snip]
>> > Just use the http server on port 5800+
>>
>> So you prepose to take the small, generally secure (only one issue that
>> I
>> remember off the top of my head), single purpose HTTP server and
>> transform
>> it into a full-fledged HTTP server, with all the security and complexity
>> issues involved with that?  Seems like a waste.  If you are forwarding
>> another port anyway, why not just setup a program that is designed to be
>> an HTTP server, or SSH, or any other number of file transfer programs.
>
> Firstly, the things that cause security problems with 'full-fledged HTTP
> server's are rarely the file transfer. The problems are the scripting
> languages, CGI programs, and the 101 other additions that appear in a
> "real" http server above the copy a file down the wire coding that
> this is.
>
> The only probable 'security issue' is the very fact that you're uploading
> files; that's why I'm suggesting a specific directory for files to arrive
> in and the authentication requirement.

Most security issues discovered recently have been related to buffer
overflows when accepting input.

> As for the 'complexity issue', I don't see it, the http server already
> has to accept a potentially infinte input and send a response. The only
> difference is that instead of thowing away a large input you store it
> in a file, if authenticated.

The http server accepts no input.  It serves exactly one thing, the java
VNC viewer.

> Secondly, using other tools. Yes that's what I tend to do now.  But it
> increases complexity, not only for the installation but also for day
> to day use.

You are suggesting using another application to do the uploads anyway. 
Why not use a server and client designed for file transfers?

This is the basis of the design of Unix.  Small tools that do their one
thing well.  VNC does remote displays well.  Many other programs do file
transfers well.

> Plus it's not the point; file transfer is one of the most requested
> features for VNC. I'm just trying to suggest a way it could be done
> without bast^H^H^H^Hmangling the RFB protocol.

Just because it is requested doesn't mean it is a good idea.  Not having
to use a username and password is the most requested thing on my work
network.  It isn't going to happen.

-- 
William Hooper