[IP] more on Free Speech fading at UC Berkeley
Begin forwarded message:
From: "David P. Reed" <dpreed@xxxxxxxx>
Date: May 4, 2005 5:16:56 PM EDT
To: Paul Biggar <paul.biggar@xxxxxxxxx>
Cc: dave@xxxxxxxxxx
Subject: Re: [IP] Free Speech fading at UC Berkeley
Dave - no need to post this unless you think it adds to the
discussion. I am not sure.
Paul - I have in the past objected to firewalls, just in case that is
surprising to you. (for an example from 1996, see http://www.reed.com/
Thoughts%20and%20comments/CDAe2e.html) You may find that absurd, it's
your right. But in fact it breaks a fundamental principle of the
Internet, creating "walled gardens".
Now if there were a real danger, and no cost, that would be at least
reasonable. However, firewalls do NOT achieve security, and what
they do achieve is achievable other ways (as I alluded in the blog
posting, the end user can authenticate every packet, given an
appropriate operating system). The fact is that end-to-end secure
systems have been possible since 1976, whereas firewalls have been
known not to provide security ever since Bellovin and Cheswick's
first book on the subject.
Making an analogy with putting the police on every corner proves
nothing. The policemen cannot read intent - their positioning on
the corner is merely another symbol of an applicable legal
structure. If the police viewed their job as stopping and searching
everybody who enters a town (all actions forbidden unless explicitly
authorized), the analogy would be closer. Similarly, the advance
permission (whether it is asking for permission to publish a book, or
to make a speech in a public square) may be granted routinely, but
its requirement is noxious.
Berkeley CS's policy does not block only port 80, but *all* TCP and
UDP ports, 0-65535 inclusive. This means that if I send a packet
advertising a private address, which I will authenticate by a crypto
key, I *still* have to ask permission first.
The interposition of a firewall is only one possible response to
problems - as I suggested in my carefully written, but brief, piece,
in my opinion, it is the wrong one. And coming from a leading
academic CS department, including people who should know better,
choosing the wrong answer shows lack of care and verges on dangerous
as it will surely be a small precedent for others who have less
technical skill.
-------------------------------------
You are subscribed as roessler@xxxxxxxxxxxxxxxxxx
To manage your subscription, go to
http://v2.listbox.com/member/?listname=ip
Archives at: http://www.interesting-people.org/archives/interesting-people/