<html><head><meta http-equiv="Content-Type" content="text/html charset=iso-8859-1"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><br><div><div>On 29 Oct 2013, at 12:36, Charles Chance <<a href="mailto:charles.chance@sipcentric.com">charles.chance@sipcentric.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div dir="ltr"><br><div><div class="gmail_quote">On 29 October 2013 11:24, Alex Balashov <span dir="ltr"><<a href="mailto:abalashov@evaristesys.com" target="_blank">abalashov@evaristesys.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
It's not my decision, but personally, I'd leave this to the user to secure, just like everything else that is kind of IPC in nature (database connections, HTTP queries, etc originating from script).<br><br></blockquote>
</div><div dir="ltr"><br></div><div>I'm inclined to agree. The DMQ module is indeed IPC in nature, so by default I would expect to be responsible for securing that communication at network layer. But still I question myself, is this the correct approach.</div>
<div><br></div></div></div></blockquote><br></div><div>Well, that's the common attitude - "let the users shoot themselves in the foot if they want to". I think we can do better and not assume they know better than shooting themselves in the foot. Experiences in the Asterisk community tells me that they will hurt themselves badly. Asterisk manager should NOT function without TLS, a user account with the same name as the password should not be configurable at all etc etc.</div><div><br></div><div>The Kamailio XML-RPC over HTTP interface should propably require TLS by default and not work without it. As DMQ (in a working mode) is a pretty new functionality I would like to see a change in attitude so that we help users and enable security by default. IPC messages should not be unprotected. TLS is not rocket science.</div><div><br></div><div>Just my 5 cent.</div><div>/O</div><br></body></html>