Hacker News Reader

Comment by MatthewPhillips | Hacker News Reader

> Why does everything have to be built on top of HTTP?

Port 80 is already open.

All ports should be open between servers. (Edit: Ports should be open if you want. I'm not saying you should run without a firewall, but on a server the firewall is under your control, not your ISP's.)

A few of the DiSo protocols were based on XMPP instead of HTTP.

That's not true either. The best practices for running services on EC2, for instance, don't leave anything but port 80 open by default. That's a good thing, because if the best practices were anything else, people would routinely lose their databases to people guessing "admin/mysql" over the Internet.

> All ports should be open between servers.

No thanks.

How about an "open" port with nothing listening on it? What does "open" mean?

I think his point is that two nodes should be able to open and then connect on any port they choose, not just TCP 80. Please correct me if I'm wrong.

Are we saying that a user should not even be _allowed_ to have an application listen on any port except a known few?

Isn't the more important issue whether an application/process is actually listening on a port? I mean you can send me all the nasty bits you want but unless I'm prepared to receive them, what difference does it make? And I thought the whole premise here is that the only people on this social network are ones you know. They shouldn't be deliberately sending you nasty bits anyway.

I am a unixnoob. Please go easy on me for my ignorance.

I think it is true that if nothing is listening on the port, then the packets will be dropped by the OS. However, you may have services you are unaware of running, or malicious software which has snuck in, or a running application which would be listening on the port if it was open. Perhaps you want to run a webserver on localhost for testing, and by keeping the ports closed you block remote access. For these reasons it is generally regarded as bad practice to leave all ports on a server open to the public.

Maybe your servers, not mine.

Maybe this is another part of the problem. Limiting ourselves to port 80 limits the types of services we can create. But on the other hand, if we really wanted to run a service, then we would just open up the port.

But yes, NAT does complicate things, particularly for home users, but I guess that's a limitation of the universe.

Good luck with that and fanatical ops guys.

Reply on news.ycombinator.com