4 ms·

They also rail against firewalls, though, which do work. Also, antivirii may be a poor solution, but they don't do nothing; the antibiotic analogy is apt becau

by noamsml 17y ago

They also rail against firewalls, though, which do work. Also, antivirii may be a poor solution, but they don't do nothing; the antibiotic analogy is apt because they are not a preventative solution, and because they don't work on everything (you can't, for example, use antibiotics against the flu), BUT they can help every once in awhile.

tsally 17y ago
Personal firewalls actually don't work, and the reason is usability. iTunes has 6-12 different executables with different names that require approval. How is your average personal going to tell whether a program with a strange name is part of iTunes or malware? Existing solutions do not address this problem. Also, users get asked to approve applications so much that they start to ignore the popups. One possible solution to this problem is to crowd source program analysis. The firewall popup would contain a rating system and user comments, and the user could make a decision from there. Security companies are making too much money off of crappy solutions at the moment to switch to this though.
- sid 17y ago
  Even firewalls in the enterprise corporate environment have the same problem. Network architects (well the bad ones anyway) know what they need to do to the firewall to achieve connectivity but dont know what security side effects those changes have thus rendering the firewall put in place to have no effect at all. This equates to 1000's upon 1000's of dollars spent simply to be rendered useless by silly decisions. I guess having said this the fault is more heavily placed on the user and not the equipment in this case. I think if you look at the plight of anti-sec the equipment and the software is as much to blame as the user controlling them in many of the cases
- derefr 17y ago
  > How is your average personal going to tell whether a program with a strange name is part of iTunes or malware? Personally, I think the OS should stop asking the user to authorize programs, and start asking to authorize companies (i.e. master per-company application signing certificates). You would get asked once that "Apple Corp." or "Adobe Inc." or "The GNU Foundation" would like to install something on your computer, and then it would be okay from then on. It would be alright to accept further products from the same company without confirmation because, if you stopped trusting the company, you'd stop trusting all their programs, and would thus uninstall everything by that company (i.e. under that signing cert) at once.
SwellJoe 17y ago
Firewalls work in some situations. Saying firewalls do work, without qualifying when and how they work is problematic, I think. Just like anti-virus; they perform a useful service in a very specific set of circumstances. We see a lot of superstition about firewalls (and AV, for that matter) on world-facing servers in our support forums. Folks seem to believe that just having a firewall running on a world-facing server will somehow protect from random attacks...but, the reality is that every service you provide to the world is one that cannot be firewalled. And if you aren't providing that service, why even run something on the port? So, the majority of firewalls I've seen configured on web, mail, DNS, etc. servers are effectively a no-op. They block ports that aren't listening and leave the listening ports wide open. You can, of course, make use of stateful features to provide some protection against some types of attack (brute force, in particular; DDoS, as long as it isn't too widely distributed; etc.) Even more disconcerting is when I meet "system administrators" who believe that having more than one firewall makes them even safer, even though they don't understand enough about either of them to have them actually doing anything. This superstition is good for Cisco and the host or ISP that is renting the user the device, but really bad for security. It's worth railing against firewalls because there are firewall products being pushed by the same snake-oil industry that pushes AV and other band-aids and using the same misleading tactics, furthering the level of ignorance in the population at large about what a secure network actually looks like. So, yes, put a firewall and a router performing NAT between your local network and the world. It will dramatically reduce the number of attacks on those machines and dramatically improve the security of that network as a whole. But, don't believe that a firewall is a solution to all security problems (or even a majority of them); just like anti-virus, it's got a time and place, and the way it is often pushed by the industry as a generic security "solution" is a problem. Speaking of superstition, I've met folks running insecure PHP scripts on a Linux box that got hacked (user-level access, spambot running, etc.) who believed that it happened either because they didn't have the right firewall or the right anti-virus configuration; and they'd spent a bunch of time already on trying to figure out why those tools "didn't work"; and their questions to me were in the form of "Can you help me fix my firewall|anti-virus because we got hacked?". This is the kind of superstition I think is really harmful. Folks spend so much time fiddling with things that aren't even related to the actual security of their systems, and ignore the important stuff (don't run old crap, use strong passwords, don't run things you don't need).

by noamsml 17y ago

tsally 17y ago

Personal firewalls actually don't work, and the reason is usability. iTunes has 6-12 different executables with different names that require approval. How is your average personal going to tell whether a program with a strange name is part of iTunes or malware? Existing solutions do not address this problem. Also, users get asked to approve applications so much that they start to ignore the popups. One possible solution to this problem is to crowd source program analysis. The firewall popup would contain a rating system and user comments, and the user could make a decision from there. Security companies are making too much money off of crappy solutions at the moment to switch to this though.

sid 17y ago
Even firewalls in the enterprise corporate environment have the same problem. Network architects (well the bad ones anyway) know what they need to do to the firewall to achieve connectivity but dont know what security side effects those changes have thus rendering the firewall put in place to have no effect at all. This equates to 1000's upon 1000's of dollars spent simply to be rendered useless by silly decisions. I guess having said this the fault is more heavily placed on the user and not the equipment in this case. I think if you look at the plight of anti-sec the equipment and the software is as much to blame as the user controlling them in many of the cases
derefr 17y ago
> How is your average personal going to tell whether a program with a strange name is part of iTunes or malware? Personally, I think the OS should stop asking the user to authorize programs, and start asking to authorize companies (i.e. master per-company application signing certificates). You would get asked once that "Apple Corp." or "Adobe Inc." or "The GNU Foundation" would like to install something on your computer, and then it would be okay from then on. It would be alright to accept further products from the same company without confirmation because, if you stopped trusting the company, you'd stop trusting all their programs, and would thus uninstall everything by that company (i.e. under that signing cert) at once.

SwellJoe 17y ago

Firewalls work in some situations. Saying firewalls do work, without qualifying when and how they work is problematic, I think. Just like anti-virus; they perform a useful service in a very specific set of circumstances. We see a lot of superstition about firewalls (and AV, for that matter) on world-facing servers in our support forums. Folks seem to believe that just having a firewall running on a world-facing server will somehow protect from random attacks...but, the reality is that every service you provide to the world is one that cannot be firewalled. And if you aren't providing that service, why even run something on the port? So, the majority of firewalls I've seen configured on web, mail, DNS, etc. servers are effectively a no-op. They block ports that aren't listening and leave the listening ports wide open. You can, of course, make use of stateful features to provide some protection against some types of attack (brute force, in particular; DDoS, as long as it isn't too widely distributed; etc.) Even more disconcerting is when I meet "system administrators" who believe that having more than one firewall makes them even safer, even though they don't understand enough about either of them to have them actually doing anything. This superstition is good for Cisco and the host or ISP that is renting the user the device, but really bad for security. It's worth railing against firewalls because there are firewall products being pushed by the same snake-oil industry that pushes AV and other band-aids and using the same misleading tactics, furthering the level of ignorance in the population at large about what a secure network actually looks like. So, yes, put a firewall and a router performing NAT between your local network and the world. It will dramatically reduce the number of attacks on those machines and dramatically improve the security of that network as a whole. But, don't believe that a firewall is a solution to all security problems (or even a majority of them); just like anti-virus, it's got a time and place, and the way it is often pushed by the industry as a generic security "solution" is a problem. Speaking of superstition, I've met folks running insecure PHP scripts on a Linux box that got hacked (user-level access, spambot running, etc.) who believed that it happened either because they didn't have the right firewall or the right anti-virus configuration; and they'd spent a bunch of time already on trying to figure out why those tools "didn't work"; and their questions to me were in the form of "Can you help me fix my firewall|anti-virus because we got hacked?". This is the kind of superstition I think is really harmful. Folks spend so much time fiddling with things that aren't even related to the actual security of their systems, and ignore the important stuff (don't run old crap, use strong passwords, don't run things you don't need).