PIX sux? (was Re: Start watching your logfiles folks!)

["Ryan Russell" <Ryan.Russell () sybase com>]

> Since PIX is a network level firewall, there are quite
> a few OSI levels that can be used to attack you...

...The PIX can't really touch layer 1, is that what you meant?

> Although your site is under attack PIX will not report
> any errors or stop the unauthorized activity.

My FW-1 firewall (which is the same basic technology
as the PIX) reports on and protects from quite
a few things.

I can't personally make any claims about the correctness
of the PIX code, but there are no problems with it's design
from a theoretical standpoint.

If you've got some specific information, I'm sure we'd like to
hear it.  If not, it sounds rather like you're making unfounded
statements, and want to start the SPF vs. Proxy debate again.
(Which I'll stay out of this round... I've got a brand new baby
keeping me from sleeping.  MJR, you let the flamebait
through, so don't complain at me. :) )

                    Ryan