Subject: RE: New version, when ?

From: [email-masked]
Date: Wed, 18 Apr 2001 15:39:55 +0400

[To be removed from this list send the message "unsubscrFrom fwtk-archive Wed Apr 18 23:45 EDT 2001
Date: Wed, 18 Apr 2001 23:45:04 -0400 (EDT)
From: Archive of fwtk-users <fwtk-archive>
To: fwtk-archive
Subject: Output from "cron" command
Content-Length: 128

Your "cron" job

/usr/local/home/fwtk-archive/sweep

produced the following output:

cat: write error: No space left on device

---

From: "Tony Gale" <[email-masked]>
Date: Thu, 19 Apr 2001 11:56:33 +0100

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

I have looked at squid-gw, but not in any great depth. A fork() vs
multithread model does not necessarily map to simplicity vs complexity, and
neither map directly to any level of security. The http-gw is fork()ed and
simple, but it isn't exactly well written or bug free. Look at the 'net
flags' issue as an example.

Here's my favourite comment from the FWTK code:

        the object of this program is to allow us to present an SMTP service
        for people to talk to, which is unprivileged, and runs in a chrooted
        directory. a secondary requirement is that the code be as simple as
        possible, to permit manual review. this code, therefore, contains
        no comments other than this one - comments being an indication that
        code is too complex to be trusted.

        ....

        mjr. 1993

Makes me laugh everytime I read it.

Anyway, back to the point. Yes my code it GPL'ed, but I haven't released it
yet as there is one more feature I need to add before I do so. I works fine
in it's current state, but I don't want to prejudice it by releasing before
I've re-implemented the resolver, which is currently using a pre-forked
process pool as a temporary measure.

-tony

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]On
Behalf Of [email-masked]
Sent: 18 April 2001 12:40
To: [email-masked]
Cc: [email-masked]
Subject: RE: New version, when ?

[To be removed from this list send the message "unsubscribe fwtk-users" in
the
BODY of a mail message to [email-masked].]

-----BEGIN PGP SIGNED MESSAGE-----

nuqneH,

Can't call it `simply wrong'. Not the best, but acceptable.

Have you seen squid-gw? It hadles pretty high load well. Acutally in-depth
content analysis gives more overhead than fork()s so there is (almost) no
reason
to implement sophisticated pre-forked or multithreaded model. Code
simplicity and
readabilty are more important for security applications than performance
hacks.

Your proxy may be useful too in some environments, though. Is it public
code?

"Tony Gale" <[email-masked]> said :

> The trouble is the model is simply wrong for anything approaching high
> request rates.
>
> I should, at this point, declare that I have been developing a replacement
> for the http-gw for a while. It's not feature complete yet, and a couple
of
> areas need work, but it's getting there.
>
> The FWTK design uses a fork()-per-request model, which has the advantage
of
> simplicity and being very forgiving of coding errors, but suffers some
> serious performance issues.
>
> The http-gw content checking is a performance killer, and offers very
little
> in return, as it's easy to bypass.
>
> -tony
>
> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]On
> Behalf Of [email-masked]
> Sent: 17 April 2001 22:20
> To: Darren Reed
> Cc: Antuan Avdioukhine; [email-masked]; [email-masked]
> Subject: Re: New version, when ?
>
>
> [To be removed from this list send the message "unsubscribe fwtk-users" in
> the
> BODY of a mail message to [email-masked].]
>
> nuqneH,
>
> What's wrong with fwtk api and ideology? I always loved it..
> Though it needs some work, i know.
>
> >
> >
> > bah, someone should just develop a *NEW* set of proxy tools and scrap
> these
> > ancient ones.

                                     _     _  _  _  _      _  _
 {::} {::} {::}  CU in Hell          _| o |_ | | _|| |   / _||_|   |_ |_ |_
 (##) (##) (##)        /Arkan#iD    |_  o  _||_| _||_| /   _|  | o |_||_||_|
 [||] [||] [||]            Do i believe in Bible? Hell,man,i've seen one!

---

From: Joseph S D Yao <[email-masked]>
Date: Fri, 20 Apr 2001 08:55:17 -0400

On Thu, Apr 19, 2001 at 11:56:33AM +0100, Tony Gale wrote:
...
> Makes me laugh everytime I read it.
...

;-)

Marcus is no stranger to hubris.  ;-)

In contrast, see my patches to 'smap'.  I contributed more comment than
code!

-- 
Joe Yao				[email-masked] - Joseph S. D. Yao
COSPO/OSIS Computer Support					EMT-B
-----------------------------------------------------------------------
This message is not an official statement of COSPO policies.

---

From: Ted Keller <[email-masked]>
Date: Fri, 20 Apr 2001 09:49:17 -0400 (EDT)

Likewise - mine version also added much comments.  I'm not ready to
throw smap out in the bath water.  I find it quite stable and performing a
very good job here.

Just my two cents.

tek

---

From: "Tony Gale" <[email-masked]>
Date: Thu, 19 Apr 2001 11:56:33 +0100

....

        mjr. 1993

-tony

-----BEGIN PGP SIGNED MESSAGE-----

nuqneH,

of
of
little

                                     _     _  _  _  _      _  _