4 ms·

When you say firewall, do you mean a firewall on the edge of a home LAN? Because I still see a firewall on each individual networked machine as being extremely

When you say firewall, do you mean a firewall on the edge of a home LAN? Because I still see a firewall on each individual networked machine as being extremely important.

JoshTriplett 11y ago
You don't need a firewall on individual machines either; just don't run network-facing services in the first place. At most, as a belt-and-braces security measure, you might want a system-wide prohibition preventing programs from listening on non-localhost (with exceptions for intentional servers, which should almost never happen on a client system). But that prohibition should primarily exist to catch programs misconfigured to listen on non-localhost, rather than leaving those programs running and just using a firewall to block them.
- nitrogen 11y ago
  These days it's just as important to monitor and filter outgoing traffic to detect trojans and unfriendly devices trying to phone home.
- Cartwright2 11y ago
  > You don't need a firewall on individual machines either; just don't run network-facing services in the first place I disagree. Firewalls fail closed under user error. The solution you proposed (we'll call it conscientious-wall) fails open under user error. That's to say, once a firewall is set up it will protect me from outside intruders unless I specifically tell it not to. A "conscientious-wall" will not protect me from outside intruders unless I specifically remember to apply it whenever I install an application or download a software update. I'm still firmly in the camp of having at least an inbound firewall on every machine.
  - mavhc 11y ago
    Sounds like we need a firewall in the switch/AP
- Someone 11y ago
  "with exceptions for intentional servers, which should almost never happen on a client system" But these light bulbs _are_ servers. With IoT, everything becomes a server. Your home system will have to be able to query your couch and your smart watch whether someone still is there and awake, and control the tv, the lights, the curtains, your fridge/microwave/phone (to call emergency services, if needed) accordingly.
  - noselasd 11y ago
    The current thought is that IoT devices should only be clients, mainly for security reasons. If your fridge needs to talk to your TV, both should be clients with a secure connection to a, often cloud based, server. (In the wild, things are less well though through...)
    - dboreham 11y ago
      This sounds wonderful for a) people who want to run said service and charge you money for something you don't need and b) people engaged in mass surveillance.
      - TheOtherHobbes 11y ago
        And for people who get paid to hack cloud-based servers so they can control the domestic appliances of entire countries. Sounds comical, but turning up a few million fridge or aircon thermostats would cause serious load issues on most local and/or national power grids.
        api 11y ago
        ... or flush every toilet in New York at once. Barrels of fun.
    - jessaustin 11y ago
      Maybe if your fridge has a touchscreen that will work. But how on earth can the user configure a client light bulb? (More realistically, a client light fixture, but TFA seems focused on bulbs...) Don't tell me that the bulb will just connect to the bulb company's server, because then I have to choose between buying bulbs from only one company or having to deal with nine different light bulb servers. My choice will be bulbs from a different light bulb company.

When you say firewall, do you mean a firewall on the edge of a home LAN? Because I still see a firewall on each individual networked machine as being extremely important.

JoshTriplett 11y ago

You don't need a firewall on individual machines either; just don't run network-facing services in the first place. At most, as a belt-and-braces security measure, you might want a system-wide prohibition preventing programs from listening on non-localhost (with exceptions for intentional servers, which should almost never happen on a client system). But that prohibition should primarily exist to catch programs misconfigured to listen on non-localhost, rather than leaving those programs running and just using a firewall to block them.

nitrogen 11y ago
These days it's just as important to monitor and filter outgoing traffic to detect trojans and unfriendly devices trying to phone home.
Cartwright2 11y ago
> You don't need a firewall on individual machines either; just don't run network-facing services in the first place I disagree. Firewalls fail closed under user error. The solution you proposed (we'll call it conscientious-wall) fails open under user error. That's to say, once a firewall is set up it will protect me from outside intruders unless I specifically tell it not to. A "conscientious-wall" will not protect me from outside intruders unless I specifically remember to apply it whenever I install an application or download a software update. I'm still firmly in the camp of having at least an inbound firewall on every machine.
- mavhc 11y ago
  Sounds like we need a firewall in the switch/AP
Someone 11y ago
"with exceptions for intentional servers, which should almost never happen on a client system" But these light bulbs _are_ servers. With IoT, everything becomes a server. Your home system will have to be able to query your couch and your smart watch whether someone still is there and awake, and control the tv, the lights, the curtains, your fridge/microwave/phone (to call emergency services, if needed) accordingly.
- noselasd 11y ago
  The current thought is that IoT devices should only be clients, mainly for security reasons. If your fridge needs to talk to your TV, both should be clients with a secure connection to a, often cloud based, server. (In the wild, things are less well though through...)
  - dboreham 11y ago
    This sounds wonderful for a) people who want to run said service and charge you money for something you don't need and b) people engaged in mass surveillance.
    - TheOtherHobbes 11y ago
      And for people who get paid to hack cloud-based servers so they can control the domestic appliances of entire countries. Sounds comical, but turning up a few million fridge or aircon thermostats would cause serious load issues on most local and/or national power grids.
      - api 11y ago
        ... or flush every toilet in New York at once. Barrels of fun.
  - jessaustin 11y ago
    Maybe if your fridge has a touchscreen that will work. But how on earth can the user configure a client light bulb? (More realistically, a client light fixture, but TFA seems focused on bulbs...) Don't tell me that the bulb will just connect to the bulb company's server, because then I have to choose between buying bulbs from only one company or having to deal with nine different light bulb servers. My choice will be bulbs from a different light bulb company.