Text 12424, 118 rader
Skriven 2010-11-22 10:52:20 av Peter Knapper (3:772/1.0)
  Kommentar till text 12416 av Robert Bashe (2:2448/44)
Ärende: Mailboxes
=================
Hi Bob,

 RB> He wrote 
 RB> nothing else but that the URLs in emails he received 
 RB> could not be accessed when clicked on in the message, 

This is what I was trying to describe, a combination of Function and a Target,
which is a URL. A URL consists of 2 main parts, The Function being performed
(usually some type of IP Data transfer such a HTTP:// or STMP://) and the
Target of that Function. To totally block the use of a URL at a point in a
machine, I would target the FUNCTION, rather than the specific URL Target.
HOWEVER, if I wish to block the TARGET, then I would look to use some form of
Dynamic URL management within the Firewall. The reason that people don't talk
about this much is because there are so many different ways of doing it, to
block that URL would vary greatly depending on what tools you used to apply
this management. That plus the security leak complications may be why people
are reluctant to talk about it in a Public forum. I dont blame them at all.

Blocking 1 Target of a URL is probably the most complex form, but it IS
possible depending on what H/W and S/W you use to do this. Knowing the H/W and
S/W being used is the hackers FIRST point of entry into a System, which is why
it usually not discussed in public.

 RB> nor even when they were cut-and-pasted into the 
 RB> browser. That was the message.

So did the Paste itself not work or did the PASTE work, but the URL simply did
not work? There is a big difference as to WHY this may be the case.

 RB> Such URLs are not known in advance, not even by the 
 RB> recipient, and they are very definitely _specific_ URLs 
 RB> - what else would they be?

This is the part that seems to vary, in one place you say that ALL URLS' fail
and in another you say that only one URL needs to fail, so I am unsure exactly
what you are refering to here. Also one needs to consider WHERE the blocking
takes place. 

You have a Source, and Destination and a PATH between those 2 points. My
prefered approach is to block traffic on the PATH, as that has the biggest
effect of what it ebig attempted, however I do acknowledge that 1 of the other
2 places could be better for a SPECIFIC blocking attempt. 

 RB> At the same time, I gained the impression that other 
 RB> URLs entered into the browser could be accessed 
 RB> normally. 

A URL is just that a "UNIFORM Resource Locator". Thats why it consists of 2
parts, and each URL TYPE has different properties. This is so the application
using that URL knows WHAT they are dealing with. A URL that starfts with
        http://
is different to a URL that starts
        https://
or even
        smtp://

Its the TYPE of URL that your browser needs to know how to handle, and probably
why the URL can be blocked in some places, but not in others.

 RB> Granted, that is an assumption, but in a 
 RB> library computer set up for use by patrons, a 
 RB> reasonable one.

Without more detail of what they are doing, we are only just trying to guess,
so here I disagree, you appear to be basing your theory on what I consider is
an UNReasonable assumption. My experience in the industry says I would solve
the problem in a very different way to what you appear to be thinking of...

 RB> So my question/position has always been, and remains - 
 RB> assuming Bob's description is 100% accurate and he 
 RB> didn't simply have operating problems with the computer 
 RB> or browser/mail client - HOW it would be possible to 
 RB> block access to specific, previously unknown URLs?

Simple, because of the TYPE of URL each form uses. Also consider that this
blocking is almost 100% guaranteed to be external to the machine that is being
used, IF that blocking needs to be secure.

Please note that all this is just a guess on my part because I have no
knowledge of the specific setup, HOWEVER it is how I would look at the
"problem"...

So without knowledge of the specific environment you are talking about, I would
simply say that yes, it is possible, but some knowledge of the environment is
required before expressing HOW it could be done. When it comes down to talking
Firewall Specifics, poeple are usually very wary of discussing details of this
in Public, as a potential issue may be released.


 RB> To me, the situation is easy to understand, but I have 
 RB> no explanation for what Bob described. I've asked for 
 RB> and wanted a reasonable explanation, but have gotten 
 RB> nothing but blabla, twisted interpretations and insults 
 RB> from the self-styled experts.

Perhaps a more personal approach might elicit more detail, rather than in
Public. Firewalls are not a Black art, but they are always being updated with
more capability.

 RB> So why didn't you, and why don't you tell me what URL I 
 RB> was thinking of that you blocked? 

Because I don't need to know, the Firewall does, so I would let IT decide what
to do. Its the one that works that out depending on how one implements the
function within the Firewall.

One of the basic "rules" used in a Firewall is HOW to identify the target, and
setting this up correctly makes or breaks the Firewall. EACH Firewall may use a
different approach, so describing HOW this is done on one Firewall may not work
on 99 other Firewalls. The more info released about a specific Firewall,
decreases that Firewalls effectiveness. I think you need to consider the other
persons point of view in your queries.

Cheers.............pk.


--- Maximus/2 3.01
 * Origin: === Maxie BBS.  Ak, NZ +64 9 444-0989 === (3:772/1)