4 ms·
The trouble with everyone using whitelists is that the ecosystem responds to it. Widespread use of default deny causes new applications to be tunneled over HTTP
by zrm 12y ago
The trouble with everyone using whitelists is that the ecosystem responds to it. Widespread use of default deny causes new applications to be tunneled over HTTP[S] or ssh instead of using their own ports, which is in effect just default allow minus the ability to differentiate applications based on their ports.
- zokier 12y agoIn what sort of world default DROP is not a widespread practice? Quickly googling, eg both Ubuntu and CentOS wikis advice for default drop, as do lot of other guides. https://help.ubuntu.com/community/IptablesHowTo#Blocking_Traffic https://help.ubuntu.com/community/IptablesHowTo#Blocking_Tra... http://wiki.centos.org/HowTos/Network/IPTables#head-724ed81dbcd2b82b5fd3f648142796f3ce60c730 http://wiki.centos.org/HowTos/Network/IPTables#head-724ed81d...
- zrm 12y ago> In what sort of world default DROP is not a widespread practice? That's the problem. Instead of asking why you're running services you don't really want to be running, just kill anything you don't understand. It's like over-prescribing antibiotics. You grow a new crop of firewall-resistant services and then the firewall doesn't work when you really need it to.