Subject: RE: IPP> review of IPP documents

From: Paul Moore <[email-masked]>
Date: Fri, 29 May 1998 17:41:07 -0700

You miss the point - I agree totally about the penetration issue. I think
this is a bad reason for doing anything.

The proxy issue is quite different - the most common scenario in commercial
networks is that the users are not connected to the Internet at all (hence
firewalls dont enter the debate). Proxies enable these users to access
internet resources. (this is not a terminology issue - they are
fundamentally differnt things). By making IPP use http:80 then IPP printer
become another Internet resource accessible via my proxy.

Punching a hole in the firewall is missing the point - they can do whatever
they like to the firewall - it does not change what I can access from my
desktop. My PC can only reach those things that my proxy knows how to deal
with. If I took the proxy away I could not reach anything. This is the
inverse case from the case where my desktop is connected to the internet via
a firewall - I you take the firewall out of the loop I would be able to do
anything.

I cannot ping your machine from my desktop, this has nothing to do with the
MS firewall settings.

> -----Original Message-----
> From:	Keith Moore [SMTP:[email-masked]]
> Sent:	Friday, May 29, 1998 5:31 PM
> To:	Paul Moore
> Cc:	'Keith Moore'; [email-masked]; [email-masked]
> Subject:	Re: IPP> review of IPP documents 
> 
> > Typically (take MS for example). The firewall and the proxy are quite
> > differnt things. The proxy is an enabler and the firewall is a
> protector.
> 
> okay...slightly different use of terminology.
> 
> insisting on IPP using port 80 just to be able to tunnel through 
> firewalls/proxies simply will not fly ...it leads to an arms race.
> (not to mention that everybody will want to use port 80, which 
> is clearly unworkable)
> 
> if your employer wants you to be able to use external printers,
> they can punch a hole in their firewall, or add a proxy, to 
> allow you to talk to the default IPP port. 
> 
> we can't let the existence of NAT boxes dictate the whole architecture.
> 
> Keith

---

From: Keith Moore <[email-masked]>
Date: Fri, 29 May 1998 20:52:20 -0400

You miss the point.  The fact that people already have port 80 proxies
installed doesn't matter.  There's no way that we're going to standardize
IPP on port 80 - HTTP already has that port, and IPP is a different
service than HTTP.

Once upon a time, a lot of people had email only access to the Internet.
That wasn't an good reason for forcing every service to run over email.

Keith

---

From: Ned Freed <[email-masked]>
Date: Fri, 29 May 1998 18:49:12 -0700 (PDT)

> That wasn't an good reason for forcing every service to run over email.

My favorite example is email over FTP. We'd still be doing email that way
if we hadn't deployed a new email service on a separate port.

				Ned