On Sat, 13 Nov 2004, Iljitsch van Beijnum wrote: > On 13-nov-04, at 10:02, Henning Brauer wrote: > > Filtering based on IP addresses is a broken concept. > > I'm not a huge fan of sprinkling crypto over everything, but if you > want certain people to have access to some stuff and not others, > IPsec/SSL are the way to go.
there are things putting random packets over the network today, trying to exploit services you might be using, or your customers might be using. IPSEC everywhere is 'nice' but not horribly practical. SSL is nice, until your SSL libraries have remotely exploitable DoS or root vulnerabilities... how many times over the last 12 months has openssl been upgraded due to 'security' issues?
