On 29 Oct 2013, at 12:36, Charles Chance <[email protected]> wrote:
> > On 29 October 2013 11:24, Alex Balashov <[email protected]> wrote: > It's not my decision, but personally, I'd leave this to the user to secure, > just like everything else that is kind of IPC in nature (database > connections, HTTP queries, etc originating from script). > > > I'm inclined to agree. The DMQ module is indeed IPC in nature, so by default > I would expect to be responsible for securing that communication at network > layer. But still I question myself, is this the correct approach. > Well, that's the common attitude - "let the users shoot themselves in the foot if they want to". I think we can do better and not assume they know better than shooting themselves in the foot. Experiences in the Asterisk community tells me that they will hurt themselves badly. Asterisk manager should NOT function without TLS, a user account with the same name as the password should not be configurable at all etc etc. The Kamailio XML-RPC over HTTP interface should propably require TLS by default and not work without it. As DMQ (in a working mode) is a pretty new functionality I would like to see a change in attitude so that we help users and enable security by default. IPC messages should not be unprotected. TLS is not rocket science. Just my 5 cent. /O
smime.p7s
Description: S/MIME cryptographic signature
_______________________________________________ sr-dev mailing list [email protected] http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-dev
