[Xitami] Windows client: opening non-standard ports

[Brian {Hamilton Kelly}]

In message <5.1.0.14.2.20030626182525.00a91820@verfaillie4.verfaillie.local>
   Marc Doigny writes:
> At 15:24 26/06/03, you ["you" being Thomas] wrote:
> >At 10:27 AM 6/26/2003 +0200, Marc Doigny writeth:
> > >Hello !
> > >
> > >I know port 119 is used for news.
> >
> >If you know this, why are you using that port?  I made specific note of it
> >and suggested using a different port altogether...but that seems
> >unacceptable to you for some reason that I'd like to know.
> 
> Our ISP only makes the standard internet ports available.
> That is: 25, 80, 119, ...
> Only 119 is left over.

It's NOT left over; it's there in case you want to run a newsserver
(although judging by your apparent lack of competence, I'd hate to see
you inflicting an insecure server on the world).

Do you not understand the concept of "Well-Known Services"?  They've been
enshrined in the 'net for about two decades or more.  I'd suggest reading
through the services file (that will be somewhere on your computer, even
if it's *not* a Unix box).  You MUST NOT use any of the ports listed
therein to provide any other service than the one allocated by IANA.

> Port 80 is used for our normal webserver, port 119 is used for a limited 
> group of users.

Why not get yourself a less restrictive (and more knowledgable) ISP?

> >Your assumption that, at the firewall level, packets are not affected is an
> >incorrect assumption.  Firewalls can and _DO_ interfere depending on
> >whether they are passive or not.
> 
> I'm not a firewall specialist, but how could a request from Netscape be let 
> through, and a request by IE blocked? (Using the same computer)
> After upgrading from IE 4.0 to IE 6.0 the request was also blocked.
> So i assume it's a Internet explorer thing.

So it may be; the problem is that /most/ browsers attempt to be helpful
to lazy users.  In particular, to those users that fail to specify a
transfer schema in their URLS.  Netscape automatically assume that
"http://" has been prepended to anything that doesn't start with
"<something>://", as does IE.  IMHO, ideally, a browser should reject any
such URL as being malformed.

However, it would appear that more recent versions of IE take into
account any port number, if it's for one of the WKS, and therefore
prepends "news://" if there's a ":119" on the end of the URL.

Will IE6 not work if provided with a FULL URL, including schema, host,
and port?  If it does work, then make sure you always publish links in
full like that.

> Having to use port 119 is a good thing (no virus of other malevolent user 
> is actually trying to connect)...

Now you really ARE displaying incredible ignorance and naivety.  Ask
anyone that really IS running a news server on port 119; most get upwards
of a hundred or more connections per day from people looking for open
servers.

-- 
Brian {Hamilton Kelly}                                          bhk@dsl.co.uk
    "We can no longer stand apart from Europe if we would.  Yet we are
    untrained to mix with our neighbours, or even talk to them".
                                              George Macaulay Trevelyan, 1919