Thread: Re: Firewall Locks Windows Version

Dave

"Functions like gethostbyname() are written by Microsoft, not us. If
they
don't return, there's not much we can do. I suppose we could run every
system call in a different thread so we can abort if it doesn't return,
but that would bring a whole new meaning to the term 'bloatware' and
would probably mean we would still be writing the connect code."

While you probably don't need to write a new thread for each and every
system call, PROFESSIONAL PROGRAMMING DISCIPLINE determines which
system calls could possibly hang a program and performs the appropriate
exception handling.  Any other development process that writes a widely
distributed application to be used on a particular platform (Open
source or not) is hubris (very much like Microsoft, I'll admit).


"Configure a sensible firewall policy that allows pgAdmin to perform
lookups? If your firewall doesn't allow you to do this, throw it in the
bin and get a decent one."

I was wondering if you had a constructive solution, since the
organization I work in uses Norton Anti Virus and Internet Firewall as
a standard and I can't simply just "throw it in the bin."  I hate
having to try to configure a new rule, have pgAdmin hang and then retry
a new rule.

Since, I don't need a DNS server (I'm using ip addresses rather than
names to access PostgreSQL on another server), maybe there could be an
option added that disables this "feature".

Steve McConnell


> -----Original Message-----
> From: pgadmin-support-owner ( at ) postgresql ( dot ) org 
> [mailto:pgadmin-support-owner ( at ) postgresql ( dot ) org] On
Behalf Of 
> Stephen McConnell
> Sent: 24 August 2005 03:02
> To: pgadmin-support ( at ) postgresql ( dot ) org
> Subject: [pgadmin-support] Firewall locks Windows version
> 
> I installed the Windows version of pgAdminIII. My plan is to use it
to
> administer a remote PostgreSQL instance on a Linux box on my network.
>   
> When I start it up, it hangs after Norton Internet Firewall 
> notifies me
> that pgAdminIII.exe is requesting a DNS server.  If I turn off the
> Firewall pgAdmin starts up.  When I restart the Firewall, it hangs
> again.
> 
> 1) WHY is this program requesting access to a DNS server?  It is not
> mentioned in the FAQS or in ANY documentation that your 
> progam requires
> access to a DNS server.

pgAdmin has to look up the address of the server you're trying to
connect to. It's not in the docs or any FAQs because it's such a basic
operation that almost every TCP/IP network program on the planet will
also do.

> 2) WHY does the program HANG?  Your exception handling should 
> be better
> than that, or your program should recognize that it has no access to
a
> DNS server and time out and escape from that condition .... NOT hang
> indefinitely.

Functions like gethostbyname() are written by Microsoft, not us. If
they
don't return, there's not much we can do. I suppose we could run every
system call in a different thread so we can abort if it doesn't return,
but that would bring a whole new meaning to the term 'bloatware' and
would probably mean we would still be writing the connect code.

> 3) What is the solution to this OTHER than removing the Firewall?

Configure a sensible firewall policy that allows pgAdmin to perform
lookups? If your firewall doesn't allow you to do this, throw it in the
bin and get a decent one.

Regards, Dave

Stephen McConnell schrieb:
> Dave
> 
> "Functions like gethostbyname() are written by Microsoft, not us. If
> they
> don't return, there's not much we can do. I suppose we could run every
> system call in a different thread so we can abort if it doesn't return,
> but that would bring a whole new meaning to the term 'bloatware' and
> would probably mean we would still be writing the connect code."
> 
> While you probably don't need to write a new thread for each and every
> system call, PROFESSIONAL PROGRAMMING DISCIPLINE determines which
> system calls could possibly hang a program and performs the appropriate
> exception handling.  Any other development process that writes a widely
> distributed application to be used on a particular platform (Open
> source or not) is hubris (very much like Microsoft, I'll admit).

"PROFESSIONNAL PROGRAMMING" is paid programming. So this is an
offer on sponsorship by you?

> 
> "Configure a sensible firewall policy that allows pgAdmin to perform
> lookups? If your firewall doesn't allow you to do this, throw it in the
> bin and get a decent one."
> 
> I was wondering if you had a constructive solution, since the
> organization I work in uses Norton Anti Virus and Internet Firewall as
> a standard and I can't simply just "throw it in the bin."  I hate
> having to try to configure a new rule, have pgAdmin hang and then retry
> a new rule.

The Norton Anti Virus and foobar is probably the worst "security
solution" one can buy. Maybe your company should invest in a
consultant rather then believe in false security?

You dont believe? Scan securityfocus mailinglist for further details.

> Since, I don't need a DNS server (I'm using ip addresses rather than
> names to access PostgreSQL on another server), maybe there could be an
> option added that disables this "feature".

Why? You could as well add sensible configuration - which is the whole
point of having a firewall :-) Btw, the sources are open - you
can make and submit a patch if you dont like particular implementation :-)

You can even privately patch your copy in any way you like.