4 ms·

I wonder how much improvement can be had by installing an application firewall and restricting everything that doesn't need networking for its primary functiona

I wonder how much improvement can be had by installing an application firewall and restricting everything that doesn't need networking for its primary functionality.

vladvasiliu 4y ago
Wouldn't that make things worse? Those applications usually expect to be able to make these calls. So now, instead of lagging once in a while when the home base is having troubles, it will lag all the time.
- tablespoon 4y ago
  > Wouldn't that make things worse? Those applications usually expect to be able to make these calls. So now, instead of lagging once in a while when the home base is having troubles, it will lag all the time. Not necessarily. The lag may be waiting for the remote server to respond to a request, and the app may move on quickly if it can't open a connection at all. It's not totally uncommon to work totally offline (e.g. on an airplane), so there's a decent chance the test that scenario.
  - tdrgabi 4y ago
    In my experience, each time a firewall is blocking a connection, you experience it as a timeout, so the app tries to connect and finally times out. Which would take longer. I haven't tried though
    - iforgotpassword 4y ago
      No, it usually results in an immediate connection refused.
    - tsukurimashou 4y ago
      it won't wait for a timeout if the connection is explicitly dropped by a blocking rule
    - happymellon 4y ago
      It depends entirely on how the firewall is set up. If you are getting timeouts then the folks who set up the firewall hate you.
- yjftsjthsd-h 4y ago
  It can be the case that an immediate, explicit failure is faster than waiting for success (or worse, timing out).
- grishka 4y ago
  It shouldn't, because any network requests would fail early and instantly, somewhere around opening the socket.
roel_v 4y ago
Not much. A lot of this sort of functionality is offloaded onto opaquely named services. So now you have decide if some access should or should not be allowed; but with very little information as to what process will in the end use that access. I used Glasswire for a long time, and when you install it on a new machine you get a lot of allow/block notifications; but then if you go back and look at the 'rule set' that was build up that way some months later, it's really hard to see what was blocked for what reason and if you actually should be blocking it. One example is embedded IE/Edge views. It seems that those are a process of its own (sometimes), likely out-of-process COM instances. But if you want to allow one program to access the network that way but not another one, well there is (to my knowledge, and I haven't really looked into this) no way to do that. Same for the 'background download' service, the search service mentioned in the OP (although that's only used internally by Windows afaik, but by several sub-components), etc. Not to mention, there isn't a whole lot of software left that doesn't need at least some networking for its 'primary' functionality. Whether that's by design I don't know. I blame engineers and marketing/product people equally for not showing enough restraint (i.e. the trope of 'just because they could... asked if they should...' etc). But nobody cares about my opinion on this, and the majority of users don't realize or care - and even if they do, they're as powerless as I am, individually.
- grishka 4y ago
  It's been a while since I used Windows with any kind of seriousness (and the last version I did was 7), so I wasn't aware that this kind of thing is offloaded to separate, shared processes like that. > Not to mention, there isn't a whole lot of software left that doesn't need at least some networking for its 'primary' functionality. Case in point, Microsoft Office has no good reason to be aware of the existence of the internet. Its job is to open, view, edit, and save local files. No one I know uses any of the cloud crap they added in the latest versions. The only use case when networking might be needed in Word/Excel/Powerpoint — and even then, it's most probably handled by a system service — is printing to a networked printer. (when working with a file stored on a remote server, shared over SMB or something similar, that's definitely handled by the system and appears as a local file to applications, albeit on a very slow disk)

I wonder how much improvement can be had by installing an application firewall and restricting everything that doesn't need networking for its primary functionality.

vladvasiliu 4y ago

Wouldn't that make things worse? Those applications usually expect to be able to make these calls. So now, instead of lagging once in a while when the home base is having troubles, it will lag all the time.

tablespoon 4y ago
> Wouldn't that make things worse? Those applications usually expect to be able to make these calls. So now, instead of lagging once in a while when the home base is having troubles, it will lag all the time. Not necessarily. The lag may be waiting for the remote server to respond to a request, and the app may move on quickly if it can't open a connection at all. It's not totally uncommon to work totally offline (e.g. on an airplane), so there's a decent chance the test that scenario.
- tdrgabi 4y ago
  In my experience, each time a firewall is blocking a connection, you experience it as a timeout, so the app tries to connect and finally times out. Which would take longer. I haven't tried though
  - iforgotpassword 4y ago
    No, it usually results in an immediate connection refused.
  - tsukurimashou 4y ago
    it won't wait for a timeout if the connection is explicitly dropped by a blocking rule
  - happymellon 4y ago
    It depends entirely on how the firewall is set up. If you are getting timeouts then the folks who set up the firewall hate you.
yjftsjthsd-h 4y ago
It can be the case that an immediate, explicit failure is faster than waiting for success (or worse, timing out).
grishka 4y ago
It shouldn't, because any network requests would fail early and instantly, somewhere around opening the socket.

roel_v 4y ago

Not much. A lot of this sort of functionality is offloaded onto opaquely named services. So now you have decide if some access should or should not be allowed; but with very little information as to what process will in the end use that access. I used Glasswire for a long time, and when you install it on a new machine you get a lot of allow/block notifications; but then if you go back and look at the 'rule set' that was build up that way some months later, it's really hard to see what was blocked for what reason and if you actually should be blocking it. One example is embedded IE/Edge views. It seems that those are a process of its own (sometimes), likely out-of-process COM instances. But if you want to allow one program to access the network that way but not another one, well there is (to my knowledge, and I haven't really looked into this) no way to do that. Same for the 'background download' service, the search service mentioned in the OP (although that's only used internally by Windows afaik, but by several sub-components), etc. Not to mention, there isn't a whole lot of software left that doesn't need at least some networking for its 'primary' functionality. Whether that's by design I don't know. I blame engineers and marketing/product people equally for not showing enough restraint (i.e. the trope of 'just because they could... asked if they should...' etc). But nobody cares about my opinion on this, and the majority of users don't realize or care - and even if they do, they're as powerless as I am, individually.

grishka 4y ago
It's been a while since I used Windows with any kind of seriousness (and the last version I did was 7), so I wasn't aware that this kind of thing is offloaded to separate, shared processes like that. > Not to mention, there isn't a whole lot of software left that doesn't need at least some networking for its 'primary' functionality. Case in point, Microsoft Office has no good reason to be aware of the existence of the internet. Its job is to open, view, edit, and save local files. No one I know uses any of the cloud crap they added in the latest versions. The only use case when networking might be needed in Word/Excel/Powerpoint — and even then, it's most probably handled by a system service — is printing to a networked printer. (when working with a file stored on a remote server, shared over SMB or something similar, that's definitely handled by the system and appears as a local file to applications, albeit on a very slow disk)