Re: ISA Server and SQL Injection

Mark,

From your tone I get the impression you've had enough discussing this! 
I'll be as brief as possible :-)

I think what we're actually disagreeing about is the meaning of 
"firewall". You're considering the practical meaning, i.e. a TCP/IP 
filtering device. I'm considering the logical meaning, i.e. a device 
that filters an interface based on rules. I think that answers your 
concerns of this being "architecturally wrong".

As for you saying "No I am saying build secure software", the essence of 
the meaning is the same as  "just get the code right". The attitude 
behind both these statements is "we must get it right". What if, 
instead, the attitude was "we must account for the fact that sometimes 
we get it wrong"? If you take this onboard, many imperfect protections 
start to look more attractive.

All the best,

Paul

--
Paul Johnston, GSEC
Internet Security Specialist
Westpoint Limited
Albion Wharf, 19 Albion Street,
Manchester, M1 5LN
England
Tel: +44 (0)161 237 1028
Fax: +44 (0)161 237 1031
email: paul@westpoint.ltd.uk
web: www.westpoint.ltd.uk