Text 12648, 110 rader
Skriven 2010-11-28 13:40:39 av Michiel van der Vlist (2:280/5555)
     Kommentar till en text av Peter Knapper (3:772/1.0)
Ärende: Firewalls
=================
Hello Peter,

On Friday November 26 2010 01:06, you wrote to me:

 MvdV>> Analogies often fail. Nothing wrong with placing a lock on a car if
 MvdV>> the car itself is what one wants to protect.

 PK> Once the room (Windows???) has been broken into, then all bets are
 PK> off, however with an EXTERNAL F/W (from reputable company), one has an
 PK> "extra" layer that can offer better protection (IMHO).

Yes, if the lock on the room is the only protection, then indeed all bets are
off, once that is broken. But the same holds for an external firewall. If hat
is the only protection, all bets are off as well wegn that is broken. The
difference between you and me seems to be that you perceive an external
firewall as "extra", where I merely perceive it as an alternative to in
internal firewall.

 PK>> The term "Firewall", originally came from the wall between the
 PK>> Passenger bay and the Engine compartment of a Car,

 MvdV>> It is my understanding that it is older than that and comes from
 MvdV>> the entertainment industry. The firewall is a lowerable barrier in
 MvdV>> a theater that separates the audience from the stage.

 PK> Somehow I dont consider a Fire curtain from the entertainment industry
 PK> as quite as comparable as a true motor Vehicle Firewall (IMHO). There
 PK> is a similarity but the implementation is not quite the same...

A theatre is not a car, so of course it is not the same. An network also is not
a car, so of course a firewall in a network is not the same as that in a car or
in a theatre. The similarity is they all serve to separate one part from
another.

Theatres existed before cars, so it is logical that the term was first used
others. Anyway, that is what Wikipedia tells us...

 PK>> Why place that "firewall" in the users lap, and not (as the car did)
 PK>> between the 2 compartments.

 MvdV>> It does not matter where the firewall is, as long as it is between
 MvdV>> the user and the fire.

 PK> I dis-agree, it is pointless placing the Firewall in the passengers
 PK> Lap, it really needs to be external to the passenger (IMHO)...

As I wrote: analogies often fail. One would indeed not place the firewall in a
car too close to the passenger because the firewall itself gets hot and still
may not adequatly protect the passenger when to close. An ideal firewall that
stops alll heat does not have that problem and that is where the anology fails.

 PK>> If the Firewall is on the Target, then once that Firewall is Broken,
 PK>> the Client is Broken,

 MvdV>> If the firewall is broken, then it is broken, no matter where
 MvdV>> it is.

 PK> Which comes back to the Multi layer approach of using a separate
 PK> Firewall device...

Sure, multilayer protection is better, no argumant there. But that is not the
subject of this subthread. Which was about the firewall that comes with windows
XP and later, versus an external firewall.

 PK>> however what limited work I have done with Windows, shows me that
 PK>> there is so much "Secret Squirrel" work going on by MS, that I
 PK>> simply do NOT trust MS to get it right all the time.

 MvdV>> Ah, there it is. So it is not that a firewall comes with the OS
 MvdV>> that is your problem, you do not trust Microsoft  to get it right,
 MvdV>> that is your problem.

 PK> I dont consider it a "problem" at all, its simply a situation that I
 PK> prefer to not leave in the Laps of the gods (EG MS), but prefer to
 PK> manage myself.

In how far do you manage it yourself? Did you write your own friewall or do you
trust the gods of Cisko et all?

 MvdV>> Well... you may have a point. Microsoft certainly has been very
 MvdV>> sloppy regarding security in the past. But i am willing to give
 MvdV>> them the benefit of the doubt and I think they may have learned
 MvdV>> from their mistakes.

 PK> Sorry, thats a risk I prefer to not take...

Your choice of course.

 PK>> FWIW, I do not enable any "local" Firewalls, ALL my Firewalls are
 PK>> independant from the devices they protect.

 MvdV>> That is your choice, but do you have any specific knowledge about
 MvdV>> holes in Microsoft's internal firewall or is it just general
 MvdV>> distrust that keeps you from using it?

 PK> I admit to avoiding using MS products wherever possible, that is why I
 PK> have no Windows S/W on any of my Home machines......;-)

So what it boils down to is simple dislike of Microsoft.

 PK> Based on that I would say the later statement above is probably the
 PK> more correct, I find it near impossble to trust MS.......;-(

I do not want to turn this into an OS war, so I will leave it at that...


Cheers, Michiel

--- GoldED+/W32-MINGW 1.1.5-b20070503
 * Origin: http://www.vlist.org (2:280/5555)