Text 12575, 71 rader
Skriven 2010-11-24 13:53:54 av Michiel van der Vlist (2:280/5555)
  Kommentar till text 12565 av Peter Knapper (3:772/1.0)
Ärende: Firewalls
=================
Hello Peter,

On Wednesday November 24 2010 17:38, you wrote to me:

 MvdV>> From XP onwards, Windows comes with a firewall. When installing XP,
 MvdV>> you automatically pass the button that enables it in default
 MvdV>> configuration. Which is "block all unsollicited incoming packets".
 MvdV>> I do not know about other OS's.

 PK> The "issue" that I have with this, is that - - One usually places a
 PK> lock on the door that allows ENTRY to a room, not on the room itself.
 PK> If the door is locked, then one needs to worry less about the room
 PK> itself.

Analogies often fail. Nothing wrong with placing a lock on a car if the car
itself is what one wants to protect.

 PK>  The term "Firewall", originally came from the wall between the
 PK> Passenger bay and the Engine compartment of a Car,

It is my understanding that it is older than that and comes from the
entertainment industry. The firewall is a lowerable barrier in a theater that
separates the audience from the stage.

 PK> Why place that "firewall" in the users lap, and not (as the car did)
 PK> between the 2 compartments.

It does not matter where the firewall is, as long as it is between the user and
the fire.

 PK> If the Firewall is on the Target, then once that Firewall is Broken,
 PK> the Client is Broken,

If the firewall is broken, then it is broken, no matter where it is.

 PK>  - To effectively use a Firewall, the USER needs to know as much about
 PK> that Firewall as possible. Now I don't use Windows myself, however
 PK> what limited work I have done with Windows, shows me that there is so
 PK> much "Secret Squirrel" work going on by MS, that I simply do NOT trust
 PK> MS to get it right all the time.

Ah, there it is. So it is not that a firewall comes with the OS that is your
problem, you do not trust Microsoft  to get it right, that is your problem.

Well... you may have a point. Microsoft certainly has been very sloppy
regarding security in the past. But i am willing to give them the benefit of
the doubt and I think they may have learned from their mistakes.

 PK> Any Professional Firewall company fully documents their product so
 PK> that the end user can find out exactly what they need to know about
 PK> it, However (IMHO) MS provide the bare essentials.

A well written documentation is no guarantee that the product has no holes.
Admitted, a company specialised in firewalls might provide a better product
than a general software company.

 PK> ALL Windows environments that I work with use an EXTERNAL Firewall
 PK> Product to secure them, and does NOT rely on the internal MS Product
 PK> to do this. And this applies to PRIVATE Networks, not just Public.

 PK> FWIW, I do not enable any "local" Firewalls, ALL my Firewalls are
 PK> independant from the devices they protect.

That is your choice, but do you have any specific knowledge about holes in
Microsoft's internal firewall or is it just general distrust that keeps you
from using it?

Cheers, Michiel

--- GoldED+/W32-MINGW 1.1.5-b20070503
 * Origin: http://www.vlist.org (2:280/5555)