From: Jan van Hoek (NL) 

>> Doesn't that strike you as sounding really insecure way
>> to do things?

I only introduced the browser to illustrate the problem, in a response to
John Cuccia.

Of course, when SUS will be running within our company (some time in the
future, but not today), we won't involve a user initiated browser to
download the patches we need.

I'm not that afraid for the spoofing problem. The download process starts
on a Microsoft website with an IP-address that you have to trust anyway.
And that launching website is the source of subsequent subsidiary websites,
which you have to trust too.

If it was possible to receive a full list of IP addresses from an official
source, like MicroSoft, we are in a position to contain all website
spoofing, since everything that does not comply with our list of trusted
websites, is blocked as a rule. That is exactly when and where the
discussion started.

IOW, I don't understand you (rethorical) question.
--
-- Jan van Hoek (NL)
-- Sat 7 Feb 2004 07:50 CET

--- BBBS/NT v4.01 Flag-5