5 ms·

> I've met enough Linux fanboys who insisted what they don't need a firewall running on their public machines, because... Linux is safe. Why would it need a f

> I've met enough Linux fanboys who insisted what they don't need a firewall running on their public machines, because... Linux is safe. Why would it need a firewall running?

iostream25 4y ago
justsomehnguy 4y ago
The same reason you wear helmet on a bicycle or a hard cover hat on a construction site. It is an addition layer of protection (and with firewall you don't even any discomfort of wearing a helmet) which can protect you if something goes wrong. Today you setup you shiny new host and you know exactly what is running on it and what ports are open. Some months/years later? Yes, a single purpose mail server can get by with tcp/22 and tcp/25 for all it's useful life but something more complex? Or when you don't even know for sure what are defaults are and you 'move fast and break things'? Should I remind you about MongoDB fiasco? [0] Are you sure all your 'internal' services (DBs and whatever) are bound to localhost and not to 0.0.0.0? Running a firewall in the default drop/whitelist mode (at least for the inbound traffic) protects you against your own mistakes. Add to this what while you can be an exceptional localhost admin, as soon as you have more than 5 hosts and/or work with other people you can never be sure what every host is properly configured, secured, don't have anything unnecessary running. [0] https://krebsonsecurity.com/2017/01/extortionists-wipe-thousands-of-databases-victims-who-pay-up-get-stiffed/ https://krebsonsecurity.com/2017/01/extortionists-wipe-thous... >> If installed on a server with the default settings, for example, MongoDB allows anyone to browse the databases, download them, or even write over them and delete them.
- Gordonjcp 4y ago
  So about the only thing you can give an example of is an application that no-one should be running on a server exposed to the Internet, that's dangerously broken by default?
  - justsomehnguy 4y ago
    So about the only thing you can object to is what I didn't provide you a comprehensive list of a networked software with an unsafe defaults, now or ever existed? Edit: with a 'deemed safe enough by Gordonjcp@HN' column of course.
    - Gordonjcp 4y ago
      It's also unsafe to drive around with your eyes shut, but any reasonably competent person would know not to do that. Your argument is "software might have unsafe defaults, so you should rely on a piece of software that might have unsafe defaults".
      - justsomehnguy 4y ago
        > Your argument My argument is having an additional layer of protection just in case. Do you wear a helmet only on the days you fall off from your bicycle? > you should rely on a piece of software that might have unsafe defaults Well, if you just took the helmet with you but never bothered to wear it...
        Gordonjcp 4y ago
        Your analogy breaks down. It would be more accurate to say "Do you wear a helmet only on the days you plan to intentionally launch yourself off the bike into a rock?" If you cannot install a server without ensuring you're running what you expect to be running, you've no business running it at all.
        justsomehnguy 4y ago
        Tell that to all folks who have no idea but eager to have a private server/make business/whatever. It looks like you are one of those fanboys who regard their skill as a something sacrosanct to which no plebs should be allowed to even know.

> I've met enough Linux fanboys who insisted what they don't need a firewall running on their public machines, because... Linux is safe. Why would it need a firewall running?

iostream25 4y ago

justsomehnguy 4y ago

The same reason you wear helmet on a bicycle or a hard cover hat on a construction site. It is an addition layer of protection (and with firewall you don't even any discomfort of wearing a helmet) which can protect you if something goes wrong. Today you setup you shiny new host and you know exactly what is running on it and what ports are open. Some months/years later? Yes, a single purpose mail server can get by with tcp/22 and tcp/25 for all it's useful life but something more complex? Or when you don't even know for sure what are defaults are and you 'move fast and break things'? Should I remind you about MongoDB fiasco? [0] Are you sure all your 'internal' services (DBs and whatever) are bound to localhost and not to 0.0.0.0? Running a firewall in the default drop/whitelist mode (at least for the inbound traffic) protects you against your own mistakes. Add to this what while you can be an exceptional localhost admin, as soon as you have more than 5 hosts and/or work with other people you can never be sure what every host is properly configured, secured, don't have anything unnecessary running. [0] https://krebsonsecurity.com/2017/01/extortionists-wipe-thousands-of-databases-victims-who-pay-up-get-stiffed/ https://krebsonsecurity.com/2017/01/extortionists-wipe-thous... >> If installed on a server with the default settings, for example, MongoDB allows anyone to browse the databases, download them, or even write over them and delete them.

Gordonjcp 4y ago
So about the only thing you can give an example of is an application that no-one should be running on a server exposed to the Internet, that's dangerously broken by default?
- justsomehnguy 4y ago
  So about the only thing you can object to is what I didn't provide you a comprehensive list of a networked software with an unsafe defaults, now or ever existed? Edit: with a 'deemed safe enough by Gordonjcp@HN' column of course.
  - Gordonjcp 4y ago
    It's also unsafe to drive around with your eyes shut, but any reasonably competent person would know not to do that. Your argument is "software might have unsafe defaults, so you should rely on a piece of software that might have unsafe defaults".
    - justsomehnguy 4y ago
      > Your argument My argument is having an additional layer of protection just in case. Do you wear a helmet only on the days you fall off from your bicycle? > you should rely on a piece of software that might have unsafe defaults Well, if you just took the helmet with you but never bothered to wear it...
      - Gordonjcp 4y ago
        Your analogy breaks down. It would be more accurate to say "Do you wear a helmet only on the days you plan to intentionally launch yourself off the bike into a rock?" If you cannot install a server without ensuring you're running what you expect to be running, you've no business running it at all.
        justsomehnguy 4y ago
        Tell that to all folks who have no idea but eager to have a private server/make business/whatever. It looks like you are one of those fanboys who regard their skill as a something sacrosanct to which no plebs should be allowed to even know.