3 ms·
> ufw, and by extension iptables, lacks features such as per process rules. iptables --pid-owner[1] > I think my original meaning is there is lots of teams an
by orf 10y ago
> ufw, and by extension iptables, lacks features such as per process rules.
iptables --pid-owner[1]
> I think my original meaning is there is lots of teams and not all of them are bad :-)
Sure, you find diamonds in the rough, but when their AV and their certificate teams are trash does that inspire confidence? When their antivirus software bundles a 'secure browser' that disables CORS (!!!) and infects you only by scanning a file then why is it safe to assume that they know what the fuck they are doing as a company?
That's like assuming it's safe for a doctor to operate on your kidney, despite killing all their patients when operating on other organs, because you know, it's different.
The firewall might work and have the slickest interface but if it's full of buffer overflows and written by an idiot then it's not the best, is it.
1. https://linux.die.net/man/8/iptables https://linux.die.net/man/8/iptables
- catdog 10y ago> iptables --pid-owner[1] Thats broken (only matches the exact PID, no child processes and according to the documentation does not work on SMP systems). It also got removed at some point. There is a cgroup match which may be usable instead, also network namespaces may be a good solution in some cases.
- 45h34jh53k4j 10y agotrue. but the cgroup match and namespaces require apriori configuration. I want something that will warn me when a new process is trying to dial out.