|
Grex > Coop13 > #239: Should port 443 (https) be open for outbound connections? | |
|
| Author |
Message |
gelinas
|
|
Should port 443 (https) be open for outbound connections?
| 
Jan 30 20:56 UTC 2005 |
It is the policy of Cyberspace Communications, Incorporated, to not let
unauthenticated (in practice, non-member) users loose on the greater
Internet. To that end, most outbound connections are blocked. The open
outbound ports are:
Port Number Protocol Use
43 TCP whois
53 TCP,UDP DNS
70 TCP gopher #obsolete, but still open
79 TCP finger
80 TCP world-wide web, http
113 TCP ident
517 UDP talk
518 UDP ntalk
Recently, the staff has received requests to allow outbound access to https,
TCP port 443. Should this port be opened to all users, or should it remain
available only to members?
To facilitate a decision after discussion, I offer the following proposal to
the membership:
Resolved: Outbound Secure HTTP shall be added to the list of services which
are restricted to VERIFIED GREX MEMBERS in good standing. The TCP
port 443 will otherwise be closed.
|
| 56 responses total. |
naftee
|
|
response 1 of 56:
|
Jan 30 21:27 UTC 2005 |
I vote no.
|
cross
|
|
response 2 of 56:
|
Jan 30 21:29 UTC 2005 |
I vote yes.
|
dpc
|
|
response 3 of 56:
|
Jan 30 22:25 UTC 2005 |
I vote yes.
|
naftee
|
|
response 4 of 56:
|
Jan 30 22:29 UTC 2005 |
Wait! Don't you guys have to endorse this pro-(more like against)-posal
before you can vote on it ?
|
jep
|
|
response 5 of 56:
|
Jan 31 02:21 UTC 2005 |
Why should or shouldn't it be allowed? This would just allow outbound
access to some WWW sites, right? Grexers could use lynx to connect to
M-Net, their bank, eBay, and many other sites which use authentication.
|
keesan
|
|
response 6 of 56:
|
Jan 31 04:21 UTC 2005 |
Could such access be restricted only to dial-in users, since anyone else who
is telnetting to grex ought to have some other way to access https sites, or
is there some advantage (such as a faster connection) to doing it from grex?
My bank website won'twork with any of the grex browsers, in fact even with
Opera it shows up as a blank page. Lynx at least provides a few words.
Do you need https to use backtalk?
|
scholar
|
|
response 7 of 56:
|
Jan 31 04:51 UTC 2005 |
First of all, this proposal needs to be endorsed BEFORE votes are made.
That's the way the by-laws work, as naftee correctly pointed out.
Second of all, https is already open.
|
naftee
|
|
response 8 of 56:
|
Jan 31 05:10 UTC 2005 |
What! I can't make outgoing https connections from GreX.
|
scholar
|
|
response 9 of 56:
|
Jan 31 14:18 UTC 2005 |
Sure you can!
Everyone can!
|
janc
|
|
response 10 of 56:
|
Jan 31 17:02 UTC 2005 |
If I had noticed that https wasn't open, then I would have opened it, without
ever having thought of raising the question for public discussion. I mean
if "http" is allowed, why would we not want to allow "https" as well?
The current policy was (kind of) set by by a member vote, however, so maybe
changes in it need to be set by member vote. Here's (rather quaint) previous
vote from 1994:
http://www.grex.org/grexdoc/archives/votes/vote02
You'll notice that it doesn't refer "http" at all, but to "lynx". Well,
"lynx" these days does https as well as http. Note that "outgoing lynx" is
supposed to be restricted to members, but there is language suggesting that
that can be loosened, which I guess it was at some point or another. On the
whole, I don't see that previous policy binds us so tightly that we need to
have a member vote to add "https" service. We should just add it and get on
with life.
|
keesan
|
|
response 11 of 56:
|
Jan 31 18:52 UTC 2005 |
Before taking the time to open https to non-members, could someone please get
lynx working again first?
|
scholar
|
|
response 12 of 56:
|
Jan 31 20:04 UTC 2005 |
(https is already open to non-members.)
|
naftee
|
|
response 13 of 56:
|
Jan 31 21:27 UTC 2005 |
Lynx is UNLUCKY
|
cross
|
|
response 14 of 56:
|
Feb 1 00:59 UTC 2005 |
I vote yes to what Jan proposed.
I only vote in a metaphorical sense, anyway.
|
janc
|
|
response 15 of 56:
|
Feb 1 04:28 UTC 2005 |
I think lynx broke because we moved Grex but not the proxy. Gryps is the
proxy server and also the tftp server for the terminal servers. I think we
left it at the pumpkin so it could be near the terminal servers. Might have
been the wrong choice. We didn't think it over very hard. Probably the thing
to do is to get the phone lines moved to provide.net, so that gryps and the
terminal server can both move there too.
|
cross
|
|
response 16 of 56:
|
Feb 1 05:04 UTC 2005 |
Why do we need the terminal server if we only have two modems, again?
|
janc
|
|
response 17 of 56:
|
Feb 1 15:29 UTC 2005 |
Habit. Do we have two serial ports?
|
scholar
|
|
response 18 of 56:
|
Feb 1 15:49 UTC 2005 |
Whoa.
Hey, folks!
I ate some delicious breakfast!
And now I want to go to class!
But first I have to wait till class starts!
|
naftee
|
|
response 19 of 56:
|
Feb 1 21:23 UTC 2005 |
Whoa! I never eat breakfast !
|
cross
|
|
response 20 of 56:
|
Feb 2 01:40 UTC 2005 |
I'm not sure if we have two serial ports, but if we have two USB ports,
we can plug in USB to Serial converters that will do the trick quite
nicely indeed. I'd say that'd be a better general solution than a terminal
server; why make things more complicated than they need to be?
|
keesan
|
|
response 21 of 56:
|
Feb 2 01:49 UTC 2005 |
Are there slots where you can add serial ports?
|
janc
|
|
response 22 of 56:
|
Feb 2 05:13 UTC 2005 |
There are a bunch of USB ports on the machine. I'm not sure how many of them
I configured into the kernel, or what the state of OpenBSD USB support is.
|
remmers
|
|
response 23 of 56:
|
Feb 2 13:33 UTC 2005 |
(Just catching up on this conference after a couple days' absence...)
I agree with Jan - open https is consistent with previously enacted
policy. So in the absence of any policy change, I think it should be
open and that this doesn't require a member vote.
Offhand I don't see a reason to close https if http is open. What would
be the reasons for doing so?
(Voteadm note: As noted previously, under the current bylaws 10% of the
members must endorse bringing it to a vote. So if you feel this should
be voted on, you should explicitly indicate that you "endorse" moving it
to a vote rather than indicating how you'd vote on it.)
|
albaugh
|
|
response 24 of 56:
|
Feb 2 18:50 UTC 2005 |
I'll add my support for bringing this to a vote, should it be deemed necessary
in the end.
|