Smith's Statements on Stuff

During the design phase on an R8 upgrade project a "Design Goal" of "Anywhere access to mail" was created.

Given that this should be available to everyone - whenever they want - and there are 1000s of users, my solution was to use reverse proxies in the DMZ and pinhole through the firewall to the mail servers. All SSL'd, optionally could use RSA to authenticate on the proxy etc. The security guys, on the other hand, apparently get very stressed about "pin holing" and favor holding replicas of mail on DMZ servers.

To my mind this is worse - all the mail is permanently held in the DMZ (shurely a security risk) and you basically need to double your mail storage and servers to ensure everyone could use it - (most won't and the mobile and powerful have Berrys).

While everyone has their own position on these matters (like the endless "run design / don't run design" conversation), it made me laugh because on the other hand the same security team allow internal BES servers to run happliy in the same manner I want the iNotes to work!