full-disclosure - UTTER HORSESHIT: [was January 15 is Personal Firewall Day, help the cause]

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

From: cmh at nmi.net (Chris Harrington)
Subject: UTTER HORSESHIT: [was January 15 is Personal Firewall Day, help the cause]

>(much like building a wall in front of your house because your doors
>and Windows(TM) have broken locks).

So do you expect Annie to fix these broken locks or doors??  What you are
saying is that you would not need a wall if the locks worked properly??
This translates to not needing a firewall if the OS flaws are fixed. I
always believed that some protection was better than none. If I had to
guess I would say your home machine is Linux or BSD and most likely
properly patched with no vulnerabilities. Do you still use iptables? I bet
you would if your PC was directly connected to the Internet without a
Hardware FW in front of it. But according to your logic it would be
un-necessary to put a firewall in front of an OS whose locks worked
properly.

Windows, Linux, BSD all have services / ports listening by default...many
of which do not need to be open to the world. It's no easier for a home
user like Annie to edit the inetd.conf file to comment out services than
it would be for her to stop Windows services. The point is the PFW makes
it possible for the home user to limit their exposure without having a
great deal of technical expertise. Is it perfect? No. But it is an
improvement over having nothing between Annie and the Internet.

--Chris

-----Original Message-----
From: full-disclosure-admin@...ts.netsys.com
[mailto:full-disclosure-admin@...ts.netsys.com] On Behalf Of Erik van
Straten
Sent: Thursday, January 15, 2004 7:55 AM
To: full-disclosure@...ts.netsys.com
Subject: Re: [Full-Disclosure] UTTER HORSESHIT: [was January 15 is
Personal Firewall Day, help the cause]

"http-equiv@...ite.com" <1@...ware.com>:
> We hereby reject this utter horseshit unreservedly.

Agreed - when it's intended to "protect" aunt Annie's Xmas present.

It just makes NO SENSE to have PC's listening on lots of ports, by
default on any interface, and then add a PFW to prevent anyone from
accessing them.

(much like building a wall in front of your house because your doors
and Windows(TM) have broken locks).

In particular because most Annie's have no clue what IP is, and
undesired egress traffic easily bypasses PFW's (if the malware hasn't
shut down the darn thing right away).

Classic PFW = Snake Oil: http://www.samspade.org/d/firewalls.html

If Annie's weren't members of Administrators, and members of
Administrators would not have access to apps like IE and OE, and
WindowsUpdate would not require admin privs to download, and there
wouldn't be so many privesc sploitz, and the FS and registry would
have much tighter perms by default, PFW's *would* make sense - for
blocking undesired egress traffic.

That is, provided that the PFW reliably starts before net I/O is
possible, runs in "Safe Mode With Networking", and is not crowded
with bugs itself.

Cheers,
Erik

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3736 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20040115/f4c471fd/smime.bin