> What is the purpose of an "application firewall" in an open source world? Aside from the problems with trying to read the source code for every application o

> What is the purpose of an "application firewall" in an open source world? Aside from the problems with trying to read the source code for every application on your machine (which I guarantee you have not done), security is all about depth. If an application is compromised or contains network functionality that doesn't do what you would like (and assuming you don't want to have to patch it and rebuild it) then something like this is incredibly useful. Not to mention that (unfortunately) we don't live in a completely free software world, so something like this is very useful if you're forced to run a proprietary program. > But truthfully in most cases controlling DNS catches most if not all of today's applications' attempts contact the mothership. Okay, but what if the application hard-codes the IP address? For an example of a normal project that does this, look at Tor. And even if it doesn't hard-code the IP address how do you dynamically add entries to /etc/hosts? Are you tracing every process on your system and adding entries to /etc/host as soon as the process tries to gethostbyname(2) -- how do you deal with the fact that this will slow down your programs significantly? And what if you want to handle different applications differently? There definitely is utility in a tool that can do all of this dynamically, per-process and also has full support in the Linux kernel already built in without the need to generate /etc/hosts in a horrifically racy way. > IMHO a "firewall" operates on incoming packets from other computers, Yes, and an "application-level firewall" operates on packets from applications. The term firewall is used to describe the "operates on packets" part, not on the "from applications" part of the definition.