🚀 go-pugleaf

John Navas <spamfilter@navasgrp.dublin.ca.us> writes:
> Attempting entry without authorization is not innocent.
 ...
> Port scanning is attempting entry without authorization, not just
> looking.

First, let's make sure we're all talking about the same thing.  To me,
"port scanning" means attempting connections to most or all of the likely
service ports to discover which ones accept connections, not just trying
to connect to one port.

Second, port scanning in and of itself should not be illegal.  In
particular, if I go to a web site and ask it to port scan my system so that
I can see whether my security setup works, that's certainly "authorized"
and shouldn't be illegal.  If I go to that same site and ask it to port
scan somebody else's computer, is the owner of the Web site that performs
the port scan guilty?

Third, "port scanning" (as defined above) doesn't cover the case of probing
for a single trojan port (e.g., 27374).  That, however, is fairly clearly
an indication of someone trying to break in.

Lastly, how exactly are you going to define "authorized"?  If I set up an
SMTP server on port 25, who's "authorized" to connect to it?  Normally the
answer is pretty much everyone in the world except spammers from explicitly
blocked IP ranges.  :-)  A port scan or probe will find it "open".  How are
you going to claim that anyone connecting to it is NOT "authorized" to do
so?  OTOH, if someone uses that connection to send a file that exploits a
buffer overflow vulnerability and gains unintended access to the rest of
your system, that's something a little more clearly distinguishable as
"unauthorized" activity.
 -WBE
[please don't send "courtesy copies" of followups; I read the newsgroup]