3 ms·

> So, I really think we need to start shipping some kind of client side firewall with a good UX by default (something like little snitch?). This is not a solut

> So, I really think we need to start shipping some kind of client side firewall with a good UX by default (something like little snitch?). This is not a solution but makes it worse. Adding more vulnerable code widens the attack surface. The history of so called security software (aka snakeoil) has shown that it doesn’t protects but causes more harm. A Linux system shall show with “# ss -lpn” [1] only ports and process which are known and reachable. It easy to use and that the functions people want - knowing who is doing what. And that’s the path Linux and BSD have taken successfully in the past. Firewalls are a valid way for administrating networks itself. And while firewalls come lean and integrated on Linux, they should be used carefully. I think system-monitor tools should show open sockets and ports, like they show processes itself, in a list. [1] https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/ https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems... -> The author use the old netstat. And recommends to just turn the service off. That ensures that CUPS doesn’t make other mistakes. A thing a firewall will not do. PS: At least the Wiki of Archlinux recommends for quite some time not to install `cups-browsed` because it isn't usually need for printer discovery (IPP-Everywhere/AirPrint). At least since December 2022.

sureglymop 2y ago
Of course you can use netstat and ss or iptstate and of course I use these. I don't even have cups installed. I'm not talking about a user who has full control and awareness over their system already. What I'm proposing is a backwards compatible "sane default" for people who may not understand. They should get a pop up which has them confirm that the service they are starting will be open to the network they are currently in. macOS has pop ups like this for many things and it seems to mostly work, it shouldn't be that hard. I don't fully understand your point about firewalls being a valid way for administrating networks themselves (only). Linux ships with netfilter by default, nothing stands in the way of better defaults.
- ho_schi 2y ago
  Thanks for your response. Desktop Linux ships with sane defaults, other then Windows. Most of us will not have cups-browsed installed. The notifications/permissions you mention are good proposal! Actually we want permissions and it happens already with Flatpak. And the operating-system should even ask for it outside of Flatpak. It doesn’t need a Firewall and therefore creating wrong[1] (i.e. DROP) responses. What system-monitors still lack is showing network connections like they show processes. The should all come with a tab which displays something like ss -tulpen. * Less code, less issues * Overview about what is actually used. * Permissions prevent undesired changes to this state. We don’t want to block a dangerous application with a firewall. We want to turn it off. Update it or remove it? I want to be a step ahead and keep the port closed. So I desire correct network responses, minimum code acting to reduce error probability. That is already the case. But I want more, permissions and overview of current state for all kinds of users. Not the case, ss is and netstat are good but for professional users and even for professional not the best. The difference in the firewalls in networks is, that admins care about a network, cannot control all systems, lack historical overview and (sadly) know that various network services aren’t save. Then, use Firewall. Maybe it is just tape around a problem but it is intended for that problem. PS: A nice article on Ubuntuusers (German) explains why Ubuntu doesn’t use a Firewall despite Netfilter is integrated: https://wiki.ubuntuusers.de/Personal_Firewalls/ https://wiki.ubuntuusers.de/Personal_Firewalls/ The background is that Windows users keep asking again and again why Ubuntu ships without a Firewall. Linux ships with one but it is not supposed to be used as „Desktop Firewall“. The Chaos Computer Club finally made fun of commercially available Desktop Firewalls with a lot of stupid extra code[2] (Don’t compare them to Netfilter!) twenty years ago: https://ulm.ccc.de/ccc/chaosseminar/2004_12_personal_firewalls/ https://ulm.ccc.de/ccc/chaosseminar/2004_12_personal_firewal... Fake message from DNS1. Fake message from DNS2. The Desktop Firewall removes Windows from network because it blocks now the real DNS. It is old but even today the same things happen again and again. [1] Bad. This is not what we want in a proper network. [2] It is not a mere firewall. It is not integrated into the system like Netfilter. It just a lot of extra code and tries to be smart. Which fails.

sureglymop 2y ago

Of course you can use netstat and ss or iptstate and of course I use these. I don't even have cups installed. I'm not talking about a user who has full control and awareness over their system already. What I'm proposing is a backwards compatible "sane default" for people who may not understand. They should get a pop up which has them confirm that the service they are starting will be open to the network they are currently in. macOS has pop ups like this for many things and it seems to mostly work, it shouldn't be that hard. I don't fully understand your point about firewalls being a valid way for administrating networks themselves (only). Linux ships with netfilter by default, nothing stands in the way of better defaults.

ho_schi 2y ago
Thanks for your response. Desktop Linux ships with sane defaults, other then Windows. Most of us will not have cups-browsed installed. The notifications/permissions you mention are good proposal! Actually we want permissions and it happens already with Flatpak. And the operating-system should even ask for it outside of Flatpak. It doesn’t need a Firewall and therefore creating wrong[1] (i.e. DROP) responses. What system-monitors still lack is showing network connections like they show processes. The should all come with a tab which displays something like ss -tulpen. * Less code, less issues * Overview about what is actually used. * Permissions prevent undesired changes to this state. We don’t want to block a dangerous application with a firewall. We want to turn it off. Update it or remove it? I want to be a step ahead and keep the port closed. So I desire correct network responses, minimum code acting to reduce error probability. That is already the case. But I want more, permissions and overview of current state for all kinds of users. Not the case, ss is and netstat are good but for professional users and even for professional not the best. The difference in the firewalls in networks is, that admins care about a network, cannot control all systems, lack historical overview and (sadly) know that various network services aren’t save. Then, use Firewall. Maybe it is just tape around a problem but it is intended for that problem. PS: A nice article on Ubuntuusers (German) explains why Ubuntu doesn’t use a Firewall despite Netfilter is integrated: https://wiki.ubuntuusers.de/Personal_Firewalls/ https://wiki.ubuntuusers.de/Personal_Firewalls/ The background is that Windows users keep asking again and again why Ubuntu ships without a Firewall. Linux ships with one but it is not supposed to be used as „Desktop Firewall“. The Chaos Computer Club finally made fun of commercially available Desktop Firewalls with a lot of stupid extra code[2] (Don’t compare them to Netfilter!) twenty years ago: https://ulm.ccc.de/ccc/chaosseminar/2004_12_personal_firewalls/ https://ulm.ccc.de/ccc/chaosseminar/2004_12_personal_firewal... Fake message from DNS1. Fake message from DNS2. The Desktop Firewall removes Windows from network because it blocks now the real DNS. It is old but even today the same things happen again and again. [1] Bad. This is not what we want in a proper network. [2] It is not a mere firewall. It is not integrated into the system like Netfilter. It just a lot of extra code and tries to be smart. Which fails.