Re: TS2900 access via browser

What's really going on is that browser makers are having a war with self
signed certificates. And there's a raging debate which occasionally pops
up in which someone will try to say there's nothing wrong with self signed
certificates, especially with an internal site and it's just 'big
internet' trying to get you to buy a certificate. And there's others
which say a man-in-the-middle attack can easily take your dns and route it
externally and use a self signed certificate and route you to a nefarious
site.
And the debate can rage on infinitely but the browser manufacturers will
simply say "fascinating, but take your arguments and self signed
certificates and dispose of them - and get a certificate from a trusted
authority".

Point is:
- Use a certificate from a trusted authority.
- Keep your firmware on your tape drive/library up to a current level.
This may not matter for the trusted authority issue but it WILL matter
when the browsers no longer accept the old ciphers from older levels of
firmware.

Using $1,000 of your time to argue against purchasing a $20 certificate
from a trusted authority is a stupid waste of resources.

Submitting to a network scan to pass a SOX audit and having either a self
signed certificate issue, or, even worse, the old cipher issues, will not
fare well. Again, spending $1,000 of your time trying to convince an
auditor versus updating your firmware to a better cipher and getting a
certificate from a trusted authority is a stupid waste of resources.

You know how often I get emails from IBM telling me that certain levels of
tape firmware are subject to security breaches? Pretty darned often
actually.

Rob Berendt