<div dir="ltr"><div class="gmail_extra"><div class="gmail_quote">2014-03-20 20:55 GMT+01:00 Hans de Goede <span dir="ltr"><<a href="mailto:hdegoede@redhat.com" target="_blank">hdegoede@redhat.com</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Lennart says:<br>
1) It is horrible code<br>
2) It really really is horrible horrible code<br>
3) And there are other ways to achieve the same goal, so lets kill it<br>
<br>
Others say:<br>
1) There may be other ways but non so easily central managed with with<br>
a unified syntax for all services<br></blockquote><div><br></div><div>Yes. It's notable that almost every widely-used network server that doesn't use tcp_wrappers has needed to add a very similar set of options; so we shouldn't expect that tcp_wrappers were removed users would stop using or asking for that kind of functionality.<br>
<br>Centralizing the language, semantics and implementation is clearly a better UI and better design. Not only for the common case of "the same option has a different name in the other daemon", but also for the corner cases like error behavior where various independent implementations differ in surprising ways. Such surprises are great starting points for attackers looking to bypass policy.<br>
<br></div><div>From the users' POV, moving from tcp_wrappers to per-daemon configuration is a clear step backwards. If the implementers' POV differs, that's a reason to change the implementation, not to discard the feature.<br>
</div> Mirek<br></div></div></div>