4 ms·

> devices should maintain their own firewalls This is insane. I don't want to have to learn, document, configure, and patch a different firewall on every inte

> devices should maintain their own firewalls This is insane. I don't want to have to learn, document, configure, and patch a different firewall on every internet connected device I own. That's a total nightmare. Computers can have their firewalls managed at the domain level. How is that support to work for bluray players, game consoles, light bulbs, phones, echo devices, door cams, thermostats, and kitchen appliances? Nope. At a minimum everyone should have a stateful firewall at their edge making their devices impossible to reach/scan from the internet at large. Home routers that defaulted to using NAT made that dead simple. On the rare occasion you really need something open to the entire internet it can sit in your DMZ. If I ever do make the move to using IPv6 on my network I'll likely continue to use NAT

collegeburner 4y ago
do you have to "learn, document, configure, and patch" a firewall on ur home router? most ppl just plug it in bc it's configured to work.
- autoexec 4y ago
  Yes? My configuration isn't complex enough at home to require my own documentation, but I absolutely had to read what the manufacturer provided, configure the firewall for my needs, and update the firmware. I don't think anyone should just throw a router in front of their network and think "This will just work!" - I mean, it might "work", but what is it leaving open? What is it logging? Who can access it? Home routers have gotten pretty good about sane defaults these days, but at a minimum I'd be disabling UPnP and looking over what those defaults are before trusting it to protect my network.
  - collegeburner 4y ago
    which is literally the same situation as if you had a device local firewall? sensible defaults and you learn to configure for stuff you want to change.
    - autoexec 4y ago
      Except that I have to check defaults and configure my home router once and I'm done (for a while at least). If every single device on my network had it's own firewall, each with their own settings, capabilities, and defaults, I'd have to configure and check the defaults for every device on my network. You could argue that having one edge device running a checked and configured firewall means that you don't have to worry about the firewalls installed on every other device on the network, but anyone who has networking experience will know better. Problems are bound to come up on the internal network if nothing else and troubleshooting issues becomes a lot more complicated! Also, if we're counting on every IoT product to come with its own embedded firewall you can be sure many of those are going to be so poorly thrown together that they introduce more security problems than they solve. This is a class of products that has earned a horrible reputation in terms of security.

collegeburner 4y ago

do you have to "learn, document, configure, and patch" a firewall on ur home router? most ppl just plug it in bc it's configured to work.

autoexec 4y ago
Yes? My configuration isn't complex enough at home to require my own documentation, but I absolutely had to read what the manufacturer provided, configure the firewall for my needs, and update the firmware. I don't think anyone should just throw a router in front of their network and think "This will just work!" - I mean, it might "work", but what is it leaving open? What is it logging? Who can access it? Home routers have gotten pretty good about sane defaults these days, but at a minimum I'd be disabling UPnP and looking over what those defaults are before trusting it to protect my network.
- collegeburner 4y ago
  which is literally the same situation as if you had a device local firewall? sensible defaults and you learn to configure for stuff you want to change.
  - autoexec 4y ago
    Except that I have to check defaults and configure my home router once and I'm done (for a while at least). If every single device on my network had it's own firewall, each with their own settings, capabilities, and defaults, I'd have to configure and check the defaults for every device on my network. You could argue that having one edge device running a checked and configured firewall means that you don't have to worry about the firewalls installed on every other device on the network, but anyone who has networking experience will know better. Problems are bound to come up on the internal network if nothing else and troubleshooting issues becomes a lot more complicated! Also, if we're counting on every IoT product to come with its own embedded firewall you can be sure many of those are going to be so poorly thrown together that they introduce more security problems than they solve. This is a class of products that has earned a horrible reputation in terms of security.