Re: Should we drop the fully qualified server name requirement?

tor 2008-12-11 klockan 12:53 -0700 skrev Alex Rousskov:

> Would removing the requirement open more doors for malicious attacks via
> "looking like normal" URLs? For example, is it easier for somebody with
> local access to change the name resolution for "citi" than for
> "citi.com"?

I don't see how it's related.

My question is on Squid's requirements on the hostname of the server
where Squid runs, not proxied hostnames.

Currently Squid insists very hard on that the servers hostname MUST be
properly configured, enabling it to find a FQDN of the server where
Squid runs.

I propose that we drop this requirement, only warn if we can't figure
out the local hostname FQDN.

The local server FQDN is used for

 - Via headers, as a unique identifier. used for loop prevention.

 - Absolute URLs pointing to the server. I.e. icons if use of absolute
URLs have been enabled. (default shortnames without host).

 - Absolute URLs for digest & netdb exchanges.

Regards
Henrik
Received on Thu Dec 11 2008 - 20:11:19 MST