Subject: Re: FWTK To Hard to Compile if your not a Programmer!!

From: Charles Manick Livermore <[email-masked]>
Date: Thu, 20 Apr 2000 10:15:20 -0500

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

T.Rex is not a FWTK derivative nor does it use squid as the http proxy.
It is clearly stated in the documentation that the httpd proxy is a 
derivative of the Apache web server.
Check out the web site and you will see that the contributors to the T.Rex 
security suite are documented.

Each T.Rex proxy has significantly more function and three to five times as 
much code code as any of the FWTK proxies.

 > At 11:36 AM 4/18/00 -0400, Joseph S D Yao wrote:
 > >Just be aware that not everything labelled a "firewall" is.  FWTK is
 > >one of the first.  There is something recent called T.REX, but I haven't
 > >had time to evaluate it yet - Rick has, and if I understood correctly
 > >thinks that it is about equivalent to an earlier version of FWTK.  [I
 > >know I have oversimplified, Rick.]
 > T.Rex uses smap/smapd, ftp-gw, and tn-gw from Firewall Toolkit 1.3 or so.
 > They've been mildly hacked to change the way they're managed. It also uses
 > squid as an http proxy.

__________________________________________________________________
Charles Manick Livermore
Livermore Software Laboratories
div of Freemont Avenue Software, Inc.
1830 S. Kirkwood, Suite 205
Houston, TX  77077
vox:  281-759-3274 or 800-240-5754
fax:  281-759-8558
www.lsli.com
www.opensourcefirewall.com

---

From: Martin Machacek <[email-masked]>
Date: Fri, 21 Apr 2000 10:03:37 +0200 (MET DST)

> T.Rex is not a FWTK derivative nor does it use squid as the http proxy.

I've quickly checked only ftproxy versus ftp-gw. Whether you call T.REX's
ftproxy a derivative of FWTK's ftp-gw or not depends on your definition of what
"derivative" means. They are not completely identical, neither in functionality
nor in implementation. However quite large portions of ftproxy.c are almost
identical to portions of ftp-gw.c. It's OK with me but I'm afraid that NAI's
lawyers may think otherwise . What's wrong in my opinion is that I've not
found any credit given to FWTK authors in any of ftproxy source files. Or was
it just pure coindence that portions of the code look almost identical
including variable names, order of declarations, indentation etc. ?

> much code code as any of the FWTK proxies.

So you basically admit that you've reused parts of original FWTK code, is that
correct?

        Martin 

---
[PGP KeyID F3F409C4]

---

From: "A.S.Johnson" <[email-masked]>
Date: Fri, 21 Apr 2000 10:53:13 +0100 (GMT)

More does not mean better!  So three times more code does not mean it is
better than FWTK, as they say, "One does not get diamonds as big as
bricks!"

Andrew
---
A.S.Johnson
System Security tgfslp

---

From: dreamwvr <[email-masked]>
Date: Fri, 21 Apr 2000 09:23:25 -0600

hi Andrew,
              i agree with you entirely. reason being is that a firewall by
nature of the beast 'should' be as minimalistic a system as possible. the 
code needs to be clear and self explanatory. Marcus Ranum who did 
write the FWTK mentioned that it did have some inadequacies... 
but do not see where the sheer amount of code is a good thing.
for instance one of the reasons i like linux so much is that i do not have
to lug around a laptop to get connected at any time. (the equivalent in 
nt world i would need a suitcase and a large shovel;-)) i simply
reach into my shirt pocket and plug in a floppy and voila have enough tools 'in
a pinch  to get the job done' another insight that i have noticed since coding
for  o.. about 50 k hours or so.. in various languages (9) is that i am a
intermediate coder at best:-{  Why? because i have noticed so many times 
when someone else i knew wrote code that i did 10 lines more simply in
2. :-/ now that is a very admirable trait IMHO which is why i say ..
"less is MORE" 
> better than FWTK, as they say, "One does not get diamonds as big as

_______________________________________________________________________

************** DREAMWVR.COM - TOTAL INTERNET SERVICES ****************
TOTAL DESIGN - DEVELOPMENT - INTEGRATION - SECURITY - Click Here..
<http://www.dreamwvr.com/services/MAX_SEC.html>
DREAMWVR.COM - The Console of Many... 90 Topics Covered
<http://www.dreamwvr.com/dynamicduo.html> <mailto:[email-masked]>
->> LINUX-MANDRAKE Solution Provider and North American Distributor <<-
PRODUCT OF THE YEAR!
<http://www.dreamwvr.com/mandrake/mandrake-main.html>
"===0 PGP Key Available 
*************** "As Unique as the Company You Keep." *****************
"If anyone speaks from DREAMWVR.COM its certainly not me:-)"
________________________________________________________________________

---

From: Joseph S D Yao <[email-masked]>
Date: Fri, 21 Apr 2000 13:56:56 -0400

> better than FWTK, as they say, "One does not get diamonds as big as

True.  One of the original virtues of FWTK was that the proxies were
written with as little code as possible.  Unfortunately, TIS thought
that they were then self-documenting.  ;-)

More code does not  n e c e s s a r i l y  mean worse, either.  But
more opportunitiess for bugs.

-- 
Joe Yao				[email-masked] - Joseph S. D. Yao
COSPO/OSIS Computer Support					EMT-B
-----------------------------------------------------------------------
This message is not an official statement of COSPO policies.

---

From: Joseph S D Yao <[email-masked]>
Date: Fri, 21 Apr 2000 14:32:17 -0400

> 2. :-/ now that is a very admirable trait IMHO which is why i say ..

;-)

Hey, Weaver.

Not necessarily.  I would much rather have 10 simple line that follow
Joe's First Rule of Software Engineering - "Say What You Mean" - than 2
lines that could be entered into the Obfuscated C contest or an APL
beauty contest.  ;-)

---

From: Joseph S D Yao <[email-masked]>
Date: Fri, 21 Apr 2000 15:07:59 -0400

On Fri, Apr 21, 2000 at 12:54:11PM -0600, dreamwvr wrote:
> hi Joe,
>          ..never thought of that.. often admire as mentioned below.. but really
> like heavy..heavy.. commenting when code is one liner that makes my brain
> hurt. that way i can follow and learn perhaps about optimized coding. then i can
> try it  out and maybe tighten my code considerably.. sure is amazing to see
> those  that can do in 2 lines what takes huge effort on my part lucky doing in
> 10. mind you your correct about it getting obfuscated. but then again 'usually'
> most that  can do that simply no longer use English IYKWIM. they are
> communicating on  a plane that only when i zone i ever get to.. which although
> it happens is  the exception;-{) rather than the rule:-))
> 				Best Regards,
> 				[email-masked]  

One of the rules of good coding is: let the optimizer optimize.  Let
the human just get it right.  To which end, the First Law.  If you
follow the First Law the way Joe intended it, the code will be about as
optimal as it needs to be, anyway.  ;-)

Once you've got it right, if you instrument the code and find that all
the work is being done in one place, THEN you may want to try
optimizing that one place.  but don't be surprised if your first
attempts either break the code or slow it down.

---

From: Donald J Smith <[email-masked]>
Date: Fri, 21 Apr 2000 14:01:36 -0600

>better than FWTK, as they say, "One does not get diamonds as big as
The reason FWTK is small was so it could be easily evalutated.
Every bit of the code has been looked at (by thousands of programmers!!) to
insure it doesn't have
any know security problems. Lots of minor mistakes were found. Lots of
changes have been done to eliminate possible
buffer overflows etc...
I have no knowledge about this other product. I have been working with FWTK
since the very begining.
FWTK is a FIREWALL TOOL KIT. It is intended for COMPUTER SECURITY
PROFESSIONALS with a fair amount of 
programming background. It is not intended for people who will not/ can not
read the manuals.

You want an easy to use, precompiled, GUI configured, Firewall with
Fulltime support buy one.
Sorry to rage but nearly half of the problems reported via this list now
are well known problems or
can be solved by READING the instructions.
Maybe it's time to include the full documentation with the fwtk. Last time
i looked it was a seperate download;-)

------------------------------------------------------------------------------
Don Smith                               General Dynamics Information Systems
Systems Administrator                   8005 South Chester St
                                        EngleWood, Co. 80112
Phone (303) 649-7554
FAX   (303) 649-7504			[email-masked]
Error msgs that I love: 
"Keyboard not found press F1 to continue" (pc bios)
"Harddrive controller failure insert new disk and press any key to
continue" (pc bios)
"The disk is write protected Remove the write protect or
 use another disk." (nt)
User must change his password before he logs in the first time. (nt)
------------------------------------------------------------------------------