3 ms·

Of course you can use netstat and ss or iptstate and of course I use these. I don't even have cups installed. I'm not talking about a user who has full control

Of course you can use netstat and ss or iptstate and of course I use these. I don't even have cups installed. I'm not talking about a user who has full control and awareness over their system already. What I'm proposing is a backwards compatible "sane default" for people who may not understand. They should get a pop up which has them confirm that the service they are starting will be open to the network they are currently in. macOS has pop ups like this for many things and it seems to mostly work, it shouldn't be that hard. I don't fully understand your point about firewalls being a valid way for administrating networks themselves (only). Linux ships with netfilter by default, nothing stands in the way of better defaults.

ho_schi 2y ago
Thanks for your response. Desktop Linux ships with sane defaults, other then Windows. Most of us will not have cups-browsed installed. The notifications/permissions you mention are good proposal! Actually we want permissions and it happens already with Flatpak. And the operating-system should even ask for it outside of Flatpak. It doesn’t need a Firewall and therefore creating wrong[1] (i.e. DROP) responses. What system-monitors still lack is showing network connections like they show processes. The should all come with a tab which displays something like ss -tulpen. * Less code, less issues * Overview about what is actually used. * Permissions prevent undesired changes to this state. We don’t want to block a dangerous application with a firewall. We want to turn it off. Update it or remove it? I want to be a step ahead and keep the port closed. So I desire correct network responses, minimum code acting to reduce error probability. That is already the case. But I want more, permissions and overview of current state for all kinds of users. Not the case, ss is and netstat are good but for professional users and even for professional not the best. The difference in the firewalls in networks is, that admins care about a network, cannot control all systems, lack historical overview and (sadly) know that various network services aren’t save. Then, use Firewall. Maybe it is just tape around a problem but it is intended for that problem. PS: A nice article on Ubuntuusers (German) explains why Ubuntu doesn’t use a Firewall despite Netfilter is integrated: https://wiki.ubuntuusers.de/Personal_Firewalls/ https://wiki.ubuntuusers.de/Personal_Firewalls/ The background is that Windows users keep asking again and again why Ubuntu ships without a Firewall. Linux ships with one but it is not supposed to be used as „Desktop Firewall“. The Chaos Computer Club finally made fun of commercially available Desktop Firewalls with a lot of stupid extra code[2] (Don’t compare them to Netfilter!) twenty years ago: https://ulm.ccc.de/ccc/chaosseminar/2004_12_personal_firewalls/ https://ulm.ccc.de/ccc/chaosseminar/2004_12_personal_firewal... Fake message from DNS1. Fake message from DNS2. The Desktop Firewall removes Windows from network because it blocks now the real DNS. It is old but even today the same things happen again and again. [1] Bad. This is not what we want in a proper network. [2] It is not a mere firewall. It is not integrated into the system like Netfilter. It just a lot of extra code and tries to be smart. Which fails.

ho_schi 2y ago

Thanks for your response. Desktop Linux ships with sane defaults, other then Windows. Most of us will not have cups-browsed installed. The notifications/permissions you mention are good proposal! Actually we want permissions and it happens already with Flatpak. And the operating-system should even ask for it outside of Flatpak. It doesn’t need a Firewall and therefore creating wrong[1] (i.e. DROP) responses. What system-monitors still lack is showing network connections like they show processes. The should all come with a tab which displays something like ss -tulpen. * Less code, less issues * Overview about what is actually used. * Permissions prevent undesired changes to this state. We don’t want to block a dangerous application with a firewall. We want to turn it off. Update it or remove it? I want to be a step ahead and keep the port closed. So I desire correct network responses, minimum code acting to reduce error probability. That is already the case. But I want more, permissions and overview of current state for all kinds of users. Not the case, ss is and netstat are good but for professional users and even for professional not the best. The difference in the firewalls in networks is, that admins care about a network, cannot control all systems, lack historical overview and (sadly) know that various network services aren’t save. Then, use Firewall. Maybe it is just tape around a problem but it is intended for that problem. PS: A nice article on Ubuntuusers (German) explains why Ubuntu doesn’t use a Firewall despite Netfilter is integrated: https://wiki.ubuntuusers.de/Personal_Firewalls/ https://wiki.ubuntuusers.de/Personal_Firewalls/ The background is that Windows users keep asking again and again why Ubuntu ships without a Firewall. Linux ships with one but it is not supposed to be used as „Desktop Firewall“. The Chaos Computer Club finally made fun of commercially available Desktop Firewalls with a lot of stupid extra code[2] (Don’t compare them to Netfilter!) twenty years ago: https://ulm.ccc.de/ccc/chaosseminar/2004_12_personal_firewalls/ https://ulm.ccc.de/ccc/chaosseminar/2004_12_personal_firewal... Fake message from DNS1. Fake message from DNS2. The Desktop Firewall removes Windows from network because it blocks now the real DNS. It is old but even today the same things happen again and again. [1] Bad. This is not what we want in a proper network. [2] It is not a mere firewall. It is not integrated into the system like Netfilter. It just a lot of extra code and tries to be smart. Which fails.