3 ms·

Ping of death has happened before. You do not serve any purpose by opening ports that you do not intend to use. Closing all unneeded port is called minimizing a

Ping of death has happened before. You do not serve any purpose by opening ports that you do not intend to use. Closing all unneeded port is called minimizing attack surface. Ports may not be inherently secure or insecure, but the history of their usage give them bias towards likely being secure or insecure. Chrome does the right thing by blocking these ports as an overwhelmingly large percentage of their users will probably hit this port under "insecure" situations. Those who need to use these ports can and will find alternate ways to do it.

Afforess 11y ago
What "attack surface"? Almost all your ports, no applications listen to. Closing them serves no useful purpose. If an application has problems accepting input on a port it is listening to, that is an application bug. Closing your ports doesn't solve this, it just hides the problem under the rug, and breaks the Internet in the process.
- simoncion 11y ago
  > Closing your ports doesn't solve this, it just hides the problem under the rug, and breaks the Internet in the process. To be fair, if you don't listen to tin-foil-hatters like GRC and configure your firewalls to REJECT non-invalid [0] traffic, rather than DROP, the only thing you'll break is the ability for others outside your network to connect to services on those ports. [0] In the iptables CONNTRACK sense of "invalid".
- Pharaoh2 11y ago
  The firewalls you mentioned were NAT/Enterprise level. They do not generally have absolute control of what programs are running on one of their internal computers. May be that port left open is used by a C&C client installed on one of the user's computer inside LAN, hereby possibly compromising the whole internal network. There is a reason why DMZs exist.
  - simoncion 11y ago
    Corporate security is a different sort of beast from almost every other security environment. What's acceptable in that arena is almost always an unacceptable management practice for someone who is designing and operating what is supposed to be a network of peers.

Afforess 11y ago

What "attack surface"? Almost all your ports, no applications listen to. Closing them serves no useful purpose. If an application has problems accepting input on a port it is listening to, that is an application bug. Closing your ports doesn't solve this, it just hides the problem under the rug, and breaks the Internet in the process.

simoncion 11y ago
> Closing your ports doesn't solve this, it just hides the problem under the rug, and breaks the Internet in the process. To be fair, if you don't listen to tin-foil-hatters like GRC and configure your firewalls to REJECT non-invalid [0] traffic, rather than DROP, the only thing you'll break is the ability for others outside your network to connect to services on those ports. [0] In the iptables CONNTRACK sense of "invalid".
Pharaoh2 11y ago
The firewalls you mentioned were NAT/Enterprise level. They do not generally have absolute control of what programs are running on one of their internal computers. May be that port left open is used by a C&C client installed on one of the user's computer inside LAN, hereby possibly compromising the whole internal network. There is a reason why DMZs exist.
- simoncion 11y ago
  Corporate security is a different sort of beast from almost every other security environment. What's acceptable in that arena is almost always an unacceptable management practice for someone who is designing and operating what is supposed to be a network of peers.