[BC] Radio Is Not what it Used to be

[Jeff Loughridge]

Dan,

If I could jump in with my $.02. See below.

Jeff Loughridge

----- Original Message ----- 
From: "Dan Dickey" <dldickey at ieee.org>
To: "Broadcast Radio Mailing List" <broadcast at radiolists.net>
Sent: Sunday, July 31, 2005 9:14 PM
Subject: Re: [BC] Radio Is Not what it Used to be


> Bill,
>
> I think the SBE did try to do something about this several years ago. 
> However, in today's world is it really necessary?  If all manufacturers 
> could agree that Ethernet/IP is the way to go (and most do) then it is 
> only a matter of protocols.  If manufacturers could just make their 
> devices web enabled this would provide a common interface (HTTP) to all 
> products.  The IP router manufacturers have been doing this for years.
>
> As a manufacturer I have some problems:
>
> 1) The 'everything from anywhere' presents a problem of security that 
> cannot be easily addressed by the transmitter or console manufacturer.  I 
> contend that this is a problem best left to the IP network designer.  Is 
> this right?

I believe your software should provide access control to its functions only. 
It is not your responsibility to worry about firewalls, Lan or WAN access 
control, or anything else outside the scope of your product. It is up to the 
local/corporate IT staff to protect their assets from unauthorized access by 
hackers. However, if someone gets to your interface, you should incorporate 
at a minimum a challenge/response authentication scheme. Providing the 
option for a secure (https or SSL) interface is also a good idea.

It doesn't take much to secure a site. An off the shelf Linksys router is 
all I use. I set it to ignore all inbound attempts, and it doesn't respond 
to pings. To get access, I use specific port forwarding for each 
application. For example, the Omnia remote software uses Port 23. Any 
attempt to connect to port 23 at the site is forwarded to the Omnia. Once I 
hit the Omnia, it is up to them to provide access security to it, which they 
do.

**Note for Frank et al, it would be really nice to be able to change the 
port the Omnia listens on. Telnet is impossible with an Omnia running at the 
site. This also sends the password in clear text. Encryption would be nice. 
How about SSL on port 22?**

Come to think of it, the ability to set the port a server listens to should 
be required on all servers. If all web servers had to listen to port 80, we 
could only have one running per site if we use port forwarding.

> 2) I don't think the IP interface should be inherently required for a 
> transmitter to perform its intended function.  Is this acceptable in your 
> mind?  The net result might be that the cost of the IP enabled product is 
> more than the one without it.

I think it should be included, if not required. Offer it as an option. For 
example, my BE 50T has the RTDS option. As it is now, it requires a serial 
connection for each transmitter to the computer running the software. I 
access the computer via DSL and can see all operating paramaters. It would 
be nice to just hit a web server and have the same info. This is in addition 
to AutoPilot, which I also have running on the same PC.

The cost should be minimal, though. Something like this could be a start, 
even for retrofitting existing hardware:

http://microcontrollershop.com/product_info.php?products_id=893

This is another: http://www.jkmicro.com/products/flashtcp.html

Back in 2002, I bought another brand that I can't remember right now, but I 
still have it at the office. I also bought the software development kit for 
it. My intention was to develop an interface to allow me to configure my 
Wheatstone D-5000 consoles from my desktop. They are serial, I wanted http. 
Other demands took too much time and I let it slide. I would still like to 
do that.

>
> 3) It seems impossible to get two transmitter engineers to agree on what 
> functions should be available from an IP interface.  Some want to control 
> everything, some want 64 levels of authorization all the way from no 
> access to rewriting all the firmware in the box, and some only want read 
> access. This is one area that I have been able to please no one.

I would say 3 levels should be enough: View, with no control; View, with 
control; and Administrator.

> BTW, at Continental our engineers don't usually wear suits.  Is that bad?

See, you're practically a dot com now!

>
> Best regards,
> Dan
>