12 ms·

I don't think a firewall has ever protected me from anything. It's only ever caused confusing error messages, usually without actually even indicating that the

I don't think a firewall has ever protected me from anything. It's only ever caused confusing error messages, usually without actually even indicating that the firewall's the problem. That's not something I'd want to see in 'Linux for human beings'. If my mother is going to use it on her desktop, things should just work.

daveguy 10y ago
Windows has a firewall by default. The outgoing rule is open the incoming is closed/established. That is the same default firewall config for most Linux distros. This is also probably the default for OSX -- does your mom have trouble with her current system? Because it probably has a firewall configured. Ubuntu is one of the very few modern operating systems (distributions) that contains this easy to fix security flaw. Also, you probably wouldn't know if a firewall protected you unless you have a habit of poring over network logs. Your wifi router definitely has this default configuration which certainly does protect you on a regular basis.
- JupiterMoon 10y ago
  Actually OSX didn't enable it by default last time I checked. And the last windows machine I touched had about 300 exceptions to the default deny incoming rule -- that the user had not opened themselves. Ubuntu would need some kind of phone-os like permission system for default deny to be both secure and be grandma friendly.
  - daveguy 10y ago
    You're right. OSX firewall is off by default -- also a poor decision. The outgoing exceptions on Windows probably because a Windows machine default deny for both incoming and outgoing which does require exceptions. Windows doesn't phone home for additional exceptions -- it asks you. The default on Ubuntu should be like all other linux distros where where all unsolicited incoming connections are blocked. Related incoming connections are allowed and outgoing connections are allowed. This would not require any difficult configuration on the part of the average home user. It seems to me that most people who are blindly defending Ubuntu's current setup do not understand how networking and firewalls work and the better options. That or they do not understand how wide open the Ubuntu defaults are. There is certainly a more secure easy to use option that Ubuntu is ignoring, but which all of the other linux distros use by default.
    - slavik81 10y ago
      > That or they do not understand how wide open the Ubuntu defaults are. Fair enough. I'd love to learn. What threats does the firewall even defend against? > The default on Ubuntu should be like all other linux distros where where all unsolicited incoming connections are blocked. I don't understand why I should care. Evil hackers can send all they want, but the only things listening on my end should be those that I explicitly installed or enabled. The firewall seems redundant as the set of running applications and my set of firewall exceptions should match exactly.
      - spydum 10y ago
        Firewall is a component to a layered defense. One of the points about Ubuntu was starting the service immediately after install, was it not?
      - JupiterMoon 10y ago
        > Fair enough. I'd love to learn. What threats does the firewall even defend against? Many Debian/Ubuntu packages have a dependency on postfix. Even some trivial ones. Installing these packages installs postfix (which at least asks you to configure it during install). Having a firewall active means that your grandmother won't have services you didn't realise she had running listening.
    - JupiterMoon 10y ago
      I fear that if Ubuntu enabled firewall with default deny on incoming packages by default packages would start adding the allow rules in their install scripts..
- JdeBP 10y ago
  I am reminded of https://news.ycombinator.com/item?id=11667485 https://news.ycombinator.com/item?id=11667485 at this point.
  - slavik81 10y ago
    I picked my own mother for a reason. She's a very successful geological engineer and quite an intelligent woman. However, she is not a sysadmin and is definitely not going to know to configure iptables if Ubuntu software doesn't work.

daveguy 10y ago

Windows has a firewall by default. The outgoing rule is open the incoming is closed/established. That is the same default firewall config for most Linux distros. This is also probably the default for OSX -- does your mom have trouble with her current system? Because it probably has a firewall configured. Ubuntu is one of the very few modern operating systems (distributions) that contains this easy to fix security flaw. Also, you probably wouldn't know if a firewall protected you unless you have a habit of poring over network logs. Your wifi router definitely has this default configuration which certainly does protect you on a regular basis.

JupiterMoon 10y ago
Actually OSX didn't enable it by default last time I checked. And the last windows machine I touched had about 300 exceptions to the default deny incoming rule -- that the user had not opened themselves. Ubuntu would need some kind of phone-os like permission system for default deny to be both secure and be grandma friendly.
- daveguy 10y ago
  You're right. OSX firewall is off by default -- also a poor decision. The outgoing exceptions on Windows probably because a Windows machine default deny for both incoming and outgoing which does require exceptions. Windows doesn't phone home for additional exceptions -- it asks you. The default on Ubuntu should be like all other linux distros where where all unsolicited incoming connections are blocked. Related incoming connections are allowed and outgoing connections are allowed. This would not require any difficult configuration on the part of the average home user. It seems to me that most people who are blindly defending Ubuntu's current setup do not understand how networking and firewalls work and the better options. That or they do not understand how wide open the Ubuntu defaults are. There is certainly a more secure easy to use option that Ubuntu is ignoring, but which all of the other linux distros use by default.
  - slavik81 10y ago
    > That or they do not understand how wide open the Ubuntu defaults are. Fair enough. I'd love to learn. What threats does the firewall even defend against? > The default on Ubuntu should be like all other linux distros where where all unsolicited incoming connections are blocked. I don't understand why I should care. Evil hackers can send all they want, but the only things listening on my end should be those that I explicitly installed or enabled. The firewall seems redundant as the set of running applications and my set of firewall exceptions should match exactly.
    - spydum 10y ago
      Firewall is a component to a layered defense. One of the points about Ubuntu was starting the service immediately after install, was it not?
    - JupiterMoon 10y ago
      > Fair enough. I'd love to learn. What threats does the firewall even defend against? Many Debian/Ubuntu packages have a dependency on postfix. Even some trivial ones. Installing these packages installs postfix (which at least asks you to configure it during install). Having a firewall active means that your grandmother won't have services you didn't realise she had running listening.
  - JupiterMoon 10y ago
    I fear that if Ubuntu enabled firewall with default deny on incoming packages by default packages would start adding the allow rules in their install scripts..
JdeBP 10y ago
I am reminded of https://news.ycombinator.com/item?id=11667485 https://news.ycombinator.com/item?id=11667485 at this point.
- slavik81 10y ago
  I picked my own mother for a reason. She's a very successful geological engineer and quite an intelligent woman. However, she is not a sysadmin and is definitely not going to know to configure iptables if Ubuntu software doesn't work.