Re: Why admin's do not trust daemons to do their own packet filtering (was Re: Resuming the great cleanup)

[Jason Azze via devel]

On Tue, May 29, 2018, at 4:28 PM, Richard Laager via devel wrote:

> Choosing _which_ interfaces to listen() on at all is not userspace
> packet filtering.

This is my instinct as well. I suspect I don't understand what we're talking 
about, so I am hesitant to comment.

Are you suggesting removing the feature that makes ntpd configurable to listen 
on a specified interface so that it will instead listen on all interfaces 
(including docker0, vibr0, etc.) with the idea that -- if a sysadmin wanted 
ntpd to use only one interface, they "shoulda used Netfilter"?

I'd be pretty pissed off if, let's say, the Postfix or MySQL people took this 
attitude. That's why I think I'm misunderstanding. 
_______________________________________________
devel mailing list
devel@ntpsec.org
http://lists.ntpsec.org/mailman/listinfo/devel