Comment 22 for bug 109434

* Troy James Sobotka <email address hidden> [2009-01-20 07:24:54 CET]:
> 1) As note above, a game server can pose a potential serious security hole.

 As noted above, every server can pose a potential serious security
hole. A game server is nothing different in that respect from any other
server, and it always was the default to enable something that gets
installed for the people - otherwise they propably wouldn't install it
at first.

> 2) As noted above, some game servers report to master servers clogging up the network.

 I would highly doubt that any game server reporting to a master server
could be considered "clogging up the network", that would be a serious
defact in the network protocol used and should be addressed seperately.

> 3) As noted above, the server will use up vital system resources.

 ... just like any other application that gets installed and/or started.
By the same reasoning evolution should be banned because it uses up
vital system resources (and has quite some memory holes, as a side note
...).

> While I largely agree with Jonathan Marsden (
> https://bugs.launchpad.net/ubuntu/+source/tremulous/+bug/109434/comments/16
> ), I'd also point out that even _typical_ servers would be illogical to
> immediately run as there is generally no infrastructure in place to make
> the running of the server _immediately_ useful. Apache might be a good
> example here as you are presented with an immediately running daemon
> despite likely having zero content established. Alas, that is
> potentially another subject.

 Exactly, and I am opposed to having such an approach addressed only for
some game server packages but rather as a broader infrastructural
benefit for all servers available.

> I find _any_ server that is run by default as soon as a package is
> installed extraordinarily foolish.

 Yes, I'm with you on having this posibility, but then doing it in this
very bugreport is the absolute wrong way to address it.

 When it comes to David's claim of that tremulous having "knows security
flaws that have been bulk-exploited", is there a fix around for that,
where is the reference to that it's known? Calling something known but
not giving any references to it won't help to getting things fixed ...

 I can just repeat myself with respect to wesnoth-server: I am willing
and looking forward to adopt any framework that allows to define wether
a server should be started or not upon installation by default, I though
object to do it within this single package, I don't see the gain for
that approach and needed duplication of work for other packages, at all.

 Sorry.
Rhonda