4 ms·

Isnt this is the same company that produced a 'secure' browser that disabled CORS? Doesn't surprise me.

by orf 10y ago

45h34jh53k4j 10y ago
They also make the best free application firewall software for Windows. Its unrivalled for features in this space. Nothing exists like this for linux (however https://github.com/subgraph/fw-daemon https://github.com/subgraph/fw-daemon is getting close). The quality of the software both good and bad doesnt' apply here.
- orf 10y ago
  Is this sarcastic? I can't tell. How is it unrivalled, and why would you trust it coming from a company with an abysmal track record of security? Just Google 'Comodo Project Zero' for a taste. Or read this[1], one of the bad ones. Also whats wrong with ufw? Github is down so I can't view that link. > The quality of the software both good and bad doesnt' apply here. Well I clearly does, because this post is about how their software did some crazy roundabout stuff to validate domains that didn't work. 1. https://bugs.chromium.org/p/project-zero/issues/detail?id=769 https://bugs.chromium.org/p/project-zero/issues/detail?id=76...
  - 45h34jh53k4j 10y ago
    ufw, and by extension iptables, lacks features such as per process rules. You have to do hacks like assign rules to users, and run the processes under different users. Tails does this to isolate the Tor Browser process. When you check out the link, see that nothing like this exists on linux. The closest thing on OSX would be little snitch. github isnt down, flush your dns, its left over cached NXDOMAINS from this mornings outage. you can also clear your browser dns cache with chrome://net-internals/#dns I think my original meaning is there is lots of teams and not all of them are bad :-)
    - orf 10y ago
      > ufw, and by extension iptables, lacks features such as per process rules. iptables --pid-owner[1] > I think my original meaning is there is lots of teams and not all of them are bad :-) Sure, you find diamonds in the rough, but when their AV and their certificate teams are trash does that inspire confidence? When their antivirus software bundles a 'secure browser' that disables CORS (!!!) and infects you only by scanning a file then why is it safe to assume that they know what the fuck they are doing as a company? That's like assuming it's safe for a doctor to operate on your kidney, despite killing all their patients when operating on other organs, because you know, it's different. The firewall might work and have the slickest interface but if it's full of buffer overflows and written by an idiot then it's not the best, is it. 1. https://linux.die.net/man/8/iptables https://linux.die.net/man/8/iptables
      - catdog 10y ago
        > iptables --pid-owner[1] Thats broken (only matches the exact PID, no child processes and according to the documentation does not work on SMP systems). It also got removed at some point. There is a cgroup match which may be usable instead, also network namespaces may be a good solution in some cases.
        45h34jh53k4j 10y ago
        true. but the cgroup match and namespaces require apriori configuration. I want something that will warn me when a new process is trying to dial out.
    - jb613 10y ago
      > lacks features such as per process rules. You have to do hacks like assign rules to users From a practical standpoint, I find it hard to imagine that the cost of added complexity for configuring application rules per user would outweigh the benefits of simply configuring them system wide. I remember the days of terminal clients logging into mainframes but all I see are single user desktops. Things like location on the network matter more in an application firewall than which user is accessing the desktop.
- jb613 10y ago
  Why are the default rules not provided? fw-daemon/rules.go references "/var/lib/sgfw/sgfw_rules" yet nowhere to be found.
minitech 10y ago
Do you mean SOP?

Isnt this is the same company that produced a 'secure' browser that disabled CORS? Doesn't surprise me.

by orf 10y ago

Isnt this is the same company that produced a 'secure' browser that disabled CORS? Doesn't surprise me.

They also make the best free application firewall software for Windows. Its unrivalled for features in this space. Nothing exists like this for linux (however https://github.com/subgraph/fw-daemon https://github.com/subgraph/fw-daemon is getting close). The quality of the software both good and bad doesnt' apply here.

orf 10y ago
Is this sarcastic? I can't tell. How is it unrivalled, and why would you trust it coming from a company with an abysmal track record of security? Just Google 'Comodo Project Zero' for a taste. Or read this[1], one of the bad ones. Also whats wrong with ufw? Github is down so I can't view that link. > The quality of the software both good and bad doesnt' apply here. Well I clearly does, because this post is about how their software did some crazy roundabout stuff to validate domains that didn't work. 1. https://bugs.chromium.org/p/project-zero/issues/detail?id=769 https://bugs.chromium.org/p/project-zero/issues/detail?id=76...
- 45h34jh53k4j 10y ago
  ufw, and by extension iptables, lacks features such as per process rules. You have to do hacks like assign rules to users, and run the processes under different users. Tails does this to isolate the Tor Browser process. When you check out the link, see that nothing like this exists on linux. The closest thing on OSX would be little snitch. github isnt down, flush your dns, its left over cached NXDOMAINS from this mornings outage. you can also clear your browser dns cache with chrome://net-internals/#dns I think my original meaning is there is lots of teams and not all of them are bad :-)
  - orf 10y ago
    > ufw, and by extension iptables, lacks features such as per process rules. iptables --pid-owner[1] > I think my original meaning is there is lots of teams and not all of them are bad :-) Sure, you find diamonds in the rough, but when their AV and their certificate teams are trash does that inspire confidence? When their antivirus software bundles a 'secure browser' that disables CORS (!!!) and infects you only by scanning a file then why is it safe to assume that they know what the fuck they are doing as a company? That's like assuming it's safe for a doctor to operate on your kidney, despite killing all their patients when operating on other organs, because you know, it's different. The firewall might work and have the slickest interface but if it's full of buffer overflows and written by an idiot then it's not the best, is it. 1. https://linux.die.net/man/8/iptables https://linux.die.net/man/8/iptables
    - catdog 10y ago
      > iptables --pid-owner[1] Thats broken (only matches the exact PID, no child processes and according to the documentation does not work on SMP systems). It also got removed at some point. There is a cgroup match which may be usable instead, also network namespaces may be a good solution in some cases.
      - 45h34jh53k4j 10y ago
        true. but the cgroup match and namespaces require apriori configuration. I want something that will warn me when a new process is trying to dial out.
  - jb613 10y ago
    > lacks features such as per process rules. You have to do hacks like assign rules to users From a practical standpoint, I find it hard to imagine that the cost of added complexity for configuring application rules per user would outweigh the benefits of simply configuring them system wide. I remember the days of terminal clients logging into mainframes but all I see are single user desktops. Things like location on the network matter more in an application firewall than which user is accessing the desktop.
jb613 10y ago
Why are the default rules not provided? fw-daemon/rules.go references "/var/lib/sgfw/sgfw_rules" yet nowhere to be found.

minitech 10y ago

Do you mean SOP?