On Wed, 16 Oct 2002, Christopher Hicks wrote: > death importance, so I personally don't think the 'appliance' label > applies to any firewall or security product in existance. That battle has been lost... > > > What is not meaningless to security and function is kernel size, > > The size of the code of the whole firewall is important. People can > easily make a tiny kernel (ding, a microkernel) and push all of the > functionality out into modules. So, realistically you have to look at the > entire code size to determine if they've made it adequately simple. > Somebody should do a study of how simpler firewalls are less likely to > break, but the vendors would be reticent to admit to their code size and > it'd be hard to verify their answers if they were 'willing'. Then again, another study of how folks who rewrite their own implementations tend to recreate "solved" problems would be about as interesting. While writing an OS that's designed to host the firewall from the ground up isn't necessarily a bad thing, threading, memory management, frag handling, packet ordering, NIC drivers, sequence number handling and all the other stuff that needs doing is easy to make mistakes in. If you need to suddenly process a bunch more users because of say, an acquisition- you can't just move the software on an appliance to a larger box (granted, most IP things scale better horizontally than vertically, but some things tend to have to have vertical scale points if they're rushed into.) If you're doing proxies, and you want to add a new "cool" thing that's totally necessary to the business' moving forward, you're not going to be able to do that on a non-general purpose OS very easily. That doesn't mean "appliance" firewalls aren't really useful, but it does mean that like everything else, there are trade-offs and that's why I still think firewall selection is something that requires not limiting ones self to any particular catetory (appliance, non-appliance, SOHO, personal...) without significant analysis. As Mikael pointed out, the appliance code doesn't have to necessarily run on an appliance too, so the distinction may be arbitrary in some circumstances. Paul ----------------------------------------------------------------------------- Paul D. Robertson "My statements in this message are personal opinions probertsat_private which may have no basis whatsoever in fact." probertsonat_private Director of Risk Assessment TruSecure Corporation _______________________________________________ firewall-wizards mailing list firewall-wizardsat_private http://honor.icsalabs.com/mailman/listinfo/firewall-wizards
This archive was generated by hypermail 2b30 : Wed Oct 16 2002 - 06:36:08 PDT