4 ms·
I've been saying for several years that, eventually, we will all end up having to put in "default deny" rules for our outgoing traffic, just as we do today for
by jlgaddis 7y ago
I've been saying for several years that, eventually, we will all end up having to put in "default deny" rules for our outgoing traffic, just as we do today for incoming traffic.
(Either that, or hosts will have to be configured without a default route and will need to use a proxy server for all outgoing connections.)
When every piece of hardware and software you use is spying on you, blocking everything by default and only allowing explicitly whitelisted traffic will be your only option to stop it.
- Wowfunhappy 7y agoOn the level of the individual machine (as opposed to your router), this is basically what Little Snitch does.
- daedalus_j 7y agoI think we're already there. Site I manage run separate VLANS for admin (switches, APs, etc) and Internet-of-Things, and both of those VLANS are default deny on outbound. That rule blocks a fair amount of traffic. I wonder if part of the answer is better tools in firewalls for this sort of thing. Easily tagging "unstrusted device" or something perhaps.
- lostlogin 7y agoPihole, a router that forces anything on port 53 back to the Pihole and careful device selection seems to be very much required already.
- matheusmoreira 7y agoWe need to start intercepting their traffic and redacting the information we don't want them to have. Just like how corporations basically MITM everyone in order to inspect outgoing traffic and prevent data leaks. If the thing needs the internet to work, we should be able to whitelist just the data that's essential to its function and have the firewall automatically strip the remaining data from the packet.
- MrMorden 7y agoMy privileged-access work laptop does that today—whitelisted applications and whitelisted network access.