[83023] in North American Network Operators' Group
Re: VOIP provider
daemon@ATHENA.MIT.EDU (John Kristoff)
Wed Aug 3 12:02:58 2005
Date: Wed, 3 Aug 2005 09:17:46 -0500
From: John Kristoff <jtk@northwestern.edu>
To: nanog@merit.edu
In-Reply-To: <Pine.SOC.4.61.0508030201320.7250@paixhost.pch.net>
Errors-To: owner-nanog@merit.edu
On Wed, 3 Aug 2005 02:08:30 -0700 (PDT)
Bill Woodcock <woody@pch.net> wrote:
> What security risk does TFTP pose that isn't also shared by HTTP?
I find it disappointing that the filtering police rarely stop to think
about their decision about what and why protocols are a security risk.
Looked at in one way, TFTP could more secure than many alternatives.
A TFTP implementation (e.g. the code required) can be much simpler,
which is typically an advantage from a security perspective. If file
authenticity (or even encryption) is required, simple end system
mechanisms can be applied before and after transmitting the file.
For applications such as device bootstrapping that deploy some
additional checks on the file transferred, TFTP is probably a
perfectly reasonable option. If it weren't for the 2 byte block
code limit, it might be even more widely used for this purpose.
John
