3 ms·
Schneier recommends use of a firewall: http://www.schneier.com/blog/archives/2004/12/safe_personal_c.html http://www.schneier.com/blog/archives/2004/12/safe_per
by oconnore 14y ago
Schneier recommends use of a firewall: http://www.schneier.com/blog/archives/2004/12/safe_personal_c.html http://www.schneier.com/blog/archives/2004/12/safe_personal_...
You are correct that a firewall will not magically solve all your problems, but it does help to protect against programs that open ports you didn't know about.
Recommending against them doesn't make sense, and implying that they are only useful to prevent TCP/IP zero day vulnerabilities is silly (especially since the firewall likely wouldn't protect against that anyway).
- cbr 14y agoThat's from 2004 and is about firewalls on desktops, not servers.
- oconnore 14y agoIP hasn't changed much since then, and I'm not sure server vs desktop is a relevant distinction here.
- belorn 14y agoSchneier talks about NAT and 2004 windows laptops (ie, with winxp). I actually asked Peter Gutmann during an IETF meeting around 2005, and he confirmed that nat had improved the situation around and win98/win2k/winxp windows machines and bot nets. If I recall right, the gist of it was that windows machines needed something, and while nat is wrong and bad, it "worked" in this aspect. This is about as far from a server installed with ubuntu in 2012 that one can get. You are not going to find any such article by Schneier promoting default firewall installations. I suggest here to check out Secrets and Lies by Schneier, as it is rather clear that a firewall need to be configured against the specific threats one can identify. If you fail at identifying threats, the firewall is likely not be useful at all, or will simply work identical to NAT. At worst, it will give a sense of false security.