Re: Botnets, IRC servers and firewalls?

[Chris Blask <blask () protegonetworks com>]

At 12:35 PM 2/4/2004 -0500, Marcus J. Ranum wrote:
> Patrick M. Hausen wrote:
> >Which still leaves us with the main question: why?
> >What are their real objectives?
>
> I don't *KNOW*!!!! I wish I did - anyone on the list care to
> comment?
>
> If I had to guess, I'd guess that it's simply a reflexive
> effort to remove hassles.

Bingo!

So the question for the Network Guys (or whomever appropriate) becomes not 
so much "how and why should I do egress filtering?" but rather "how can I 
follow the lead of the Security folks without waking up in a sweat?".

Whatever the method (Good Cop, Bad Cop, threatening, ingratiating...), we 
need to package our arguments so that the Great Unwashed can unfold them 
and find what they are looking for inside - Comfort.  When they seek 
Comfort in foolishness then our wrapping job did not incline them to accept 
the contents of the package in the spirit that was intended.

It's like training a dog who just isn't the brightest in the litter (and, 
frankly, even those who are).  Loving and cuddling to make them want to be 
good is as important as wrestling them to the ground and having a little 
one-on-one to make them want to not be bad.

-woof!

-chris


_______________________________________________
firewall-wizards mailing list
firewall-wizards () honor icsalabs com
http://honor.icsalabs.com/mailman/listinfo/firewall-wizards