firewall on budget ?

[Frank McCoy]

In alt.comp.hardware.pc-homebuilt "(e-mail address removed)"

Whatever Leythos was saying in resposne to you, is a good as lost,
since your posts will vanish from archives, and we don't see the
discussion in the future.

I dunno ... I archive about *everything* in the groups I visit.
I'm quite sure I'm not the only person who does.

Then there's Google Groups ....

Large hard-drives these days are CHEAP.

 

[Straight Talk]

And you seem to be trolling by picking a small item and saying that it
invalidates everything else.

LOL

 

[Leythos]

It sure can. What you seem to be missing is that I made my LUA point
in response to Leythos claiming that any program could poke holes
(open servers) in the WF. As a limited user you cannot do that, my
point being that the fault is not in the WF but in users running with
admin rights.

And you failed to understand that MOST people run as Admin level users.
Anyone smart enough to run as a limited user has a very reach chance
that they also know more about security than the zillions of ignorant
users with computers.

Additionally, as a limited user there are many things that you can't do,
and even people that run as a limited user login as an Administrator
from time to time.

So, again, for the masses of ignorant users, a NAT Router is a very good
option to protect their computer, to protect us from them, and provides
better logging and opportunity to remain clean and even to block
outbound than does Windows firewall.

--

Leythos
- Igitur qui desiderat pacem, praeparet bellum.
- Calling an illegal alien an "undocumented worker" is like calling a
drug dealer an "unlicensed pharmacist"
(e-mail address removed) (remove 999 for proper email address)

 

[Straight Talk]

Out of interest, what do you mean by bot net ?

A net of bots.

Is it a malicious server / trojan that receives a command, and then
could cause trouble to other machines, maybe acting as a client
sending spam mail through a mail server that lets anybody in ?

If it is indeed a server that receives a command, then a NAT router
would prevent it from receiving an incoming connection.

Most bots dial in themselves to receive commands from the controller.
NAT won't stop that.

 

[Straight Talk]

It sure can. What you seem to be missing is that I made my LUA point
in response to Leythos claiming that any program could poke holes
(open servers) in the WF. As a limited user you cannot do that, my
point being that the fault is not in the WF but in users running with
admin rights.

Actually, if you go back you'll see that the only topic I wanted to
discuss was Leythos' claim that the WF was a bad concept. Suddenly
Leythos brought NAT into the discussion and later firewalling
technology. And know he calls me a troll

 

[jameshanley39]

A net of bots.



Most bots dial in themselves to receive commands from the controller.
NAT won't stop that.

interesting about the bot nets. Agreed that NAT won't stop malicious
clients like that. And I guess there'd be redundant 'controllers',
and they'd be hidden behind proxies.

The windows firewall won't stop them either.

But nobody claimed that NAT would, or that it was the be all and end
all in security. However, it does stop incoming. Alot of problems
nowadays are plain malicious servers.

A NAT router is harder to take down, whereas machines with a windows
firewall are getting taken down quite often, and neatly, one may not
even notice. "At least" with PFWs, they probably put up a bit of a
fight and crash in such a situation!!

 

[Straight Talk]

And you failed to understand that MOST people run as Admin level users.

NO! - I do NOT fail to understand that! I'm just pointing my finger at
this being wrong! You're twisting things over and over to make
yourself look smart and to get the final word.

Anyone smart enough to run as a limited user has a very reach chance
that they also know more about security than the zillions of ignorant
users with computers.

Them educate those ignorant's, instead of supporting status quo by
promoting damage control and gap-stopping solutions.

Additionally, as a limited user there are many things that you can't do,
and even people that run as a limited user login as an Administrator
from time to time.

This has been discussed already.

So, again, for the masses of ignorant users, a NAT Router is a very good
option to protect their computer, to protect us from them, and provides
better logging and opportunity to remain clean and even to block
outbound than does Windows firewall.

Stated like this it makes some sense. But this is not what you stated
earlier.

 

[jameshanley39]

And you failed to understand that MOST people run as Admin level users.
Anyone smart enough to run as a limited user <snip>

I'm sure that you once said you run as an Administrative user.

&/ that you don't work from a limited account.

 

[Ansgar -59cobalt- Wiechers]

something went wrong here..

Yes. And it's you starting to crosspost this back to csf again. Stop it.
What I wrote is NOT related to firewalls.

My reply to ansgar only went to
microsoft.public.windowsxp.security_admin

Which is exactly where it belongs.

not to comp.security.firewalls.

Which is because it doesn't belong there.

I think 'cos ansgar added a 'follow-up' field, and it seems what that
did was cause my reply to only go there, and not to the newsgroup
where I read the message and clicked reply(comp.security.firewalls).
I was only looking in csf so didn't see them.

If you don't read this group, then don't crosspost to it. And don't run
discussions across several groups.

cu
59cobalt

 

[jameshanley39]

In alt.comp.hardware.pc-homebuilt "(e-mail address removed)"



I dunno ... I archive about *everything* in the groups I visit.
I'm quite sure I'm not the only person who does.

Then there's Google Groups ....

Large hard-drives these days are CHEAP.

you use forte free agent? where's the option in it to do that?
does it do it in plain text too? (though opening it in forte is cool
enough)
how many years have you done?!

 

[jameshanley39]

It sure can. What you seem to be missing is that I made my LUA point
in response to Leythos claiming that any program could poke holes
(open servers) in the WF. As a limited user you cannot do that, my
point being that the fault is not in the WF but in users running with
admin rights.

if you're a techie, it's a hassle to not run with admin rights.

Leythos has a point that in practice, although both the WF and other
PFWs can be taken down or circumvented, the WF is so far more cleanly.
It's small/simple, more common, built for programs to add exceptions
in.

 

[Leythos]

Actually, if you go back you'll see that the only topic I wanted to
discuss was Leythos' claim that the WF was a bad concept. Suddenly
Leythos brought NAT into the discussion and later firewalling
technology. And know he calls me a troll

Actually, the thread is about "Firewall on a budget" not about "Windows
Firewall". So, when you look at Budget you have to consider the flaws in
WF and the fact of how most users are using it - meaning that most users
are running as a local admin, have no idea that it has exceptions/holes,
have no idea that simple programs can created holes without their
permission, etc...

The NAT router, a non-computer controlled device, non-OS controlled
device, is a simple method that provides MORE protection than the
Windows Firewall and even offers MORE options for filtering than the
Windows firewall.

The trolling comment was because you keep going around in circles for
some reason I can't fathom. You have suggested that because of one
example, a very small example with your flawed idea, that NAT is not a
better solution. I can't really believe, unless you are Chilly, that
anyone is missing all of these points by accident.

--

Leythos
- Igitur qui desiderat pacem, praeparet bellum.
- Calling an illegal alien an "undocumented worker" is like calling a
drug dealer an "unlicensed pharmacist"
(e-mail address removed) (remove 999 for proper email address)

 

[Leythos]

Them educate those ignorant's, instead of supporting status quo by
promoting damage control and gap-stopping solutions.

If you could educate people that don't want to be educated there would
not be a problem and we would not be having this discussion - like
drugs, people are going to keep doing stupid things and ignoring
security until it bites them in the ass enough for them to take notice
of what they've been told for at least 10 years.

Until that all changes we can implement simple things that are already
available for NO COST that will provide protection better than what they
currently don't use properly.

--

Leythos
- Igitur qui desiderat pacem, praeparet bellum.
- Calling an illegal alien an "undocumented worker" is like calling a
drug dealer an "unlicensed pharmacist"
(e-mail address removed) (remove 999 for proper email address)

 

[Leythos]

I'm sure that you once said you run as an Administrative user.

&/ that you don't work from a limited account.

And even at home I sit behind $4000 of firewall and security measures,
just like the secure networks I design. Having used and designed systems
for 30 years I've never once been compromised on any network that I've
maintained, not once.

We're talking about the ignorant masses, the ones that don't want a
clue, the ones that think that P2P software has no issues, the ones that
have never looked at the Windows Firewall panel for Exceptions, the ones
that think CD/USB drives, DVD/PDA/Cell, etc.. are not a threat to their
computers....

--

Leythos
- Igitur qui desiderat pacem, praeparet bellum.
- Calling an illegal alien an "undocumented worker" is like calling a
drug dealer an "unlicensed pharmacist"
(e-mail address removed) (remove 999 for proper email address)

 

[jameshanley39]

Yes. And it's you starting to crosspost this back to csf again. Stop it.
What I wrote is NOT related to firewalls.


Which is exactly where it belongs.


Which is because it doesn't belong there.


If you don't read this group, then don't crosspost to it. And don't run
discussions across several groups.

cu
59cobalt
--

I think it gets a bit confusing if the same thread is in different
groups but the contents is a bit different. It means that if somebody
wants to see all the posts in the thread it's almost impossible.

If you really don't want to discuss this in csf as well as here, and
you only want to discuss it here, and I see why, then I'm happy to
start a new thread here, in
microsoft.public.windowsxp.security_admin.

I think that would satisfy both our sensibilities.

I might make a post there to say that we agreed that this subtopic/
outgrowth of the thread, is being discussed in a new thread of a
different name in microsoft.public.windowsxp.security_admin..

is that ok with you?

 

[Straight Talk]

Actually, the thread is about "Firewall on a budget" not about "Windows
Firewall". So, when you look at Budget you have to consider the flaws in
WF and the fact of how most users are using it - meaning that most users
are running as a local admin, have no idea that it has exceptions/holes,
have no idea that simple programs can created holes without their
permission, etc...

The NAT router, a non-computer controlled device, non-OS controlled
device, is a simple method that provides MORE protection than the
Windows Firewall and even offers MORE options for filtering than the
Windows firewall.

The trolling comment was because you keep going around in circles for
some reason I can't fathom. You have suggested that because of one
example, a very small example with your flawed idea, that NAT is not a
better solution. I can't really believe, unless you are Chilly, that
anyone is missing all of these points by accident.

Funny thing is, in this thread I never argued NAT vs. WF. I don't know
where you got that from.

 

[Leythos]

Funny thing is, in this thread I never argued NAT vs. WF. I don't know
where you got that from.

Funny thing is that I mentioned it because of the poor ability of
Windows Firewall to protect users in the default mode that MS installs
users/windows on systems.

Funny thing is that I mentioned it because it's the cheapest, already in
place on most areas, method to implement to get the most protection
against one of the largest problems with Windows systems.

--

Leythos
- Igitur qui desiderat pacem, praeparet bellum.
- Calling an illegal alien an "undocumented worker" is like calling a
drug dealer an "unlicensed pharmacist"
(e-mail address removed) (remove 999 for proper email address)

 

[Ansgar -59cobalt- Wiechers]

end users in a company don't, at home - some want it at their own
risk, and call a cheap geek if it goes wrong.

But techie users may well need it.

What do you think I am?

What do you do? Suppose you browse frequently, and do admin operations
sometimes during te day, and install programs often. Are you logging
off and on often for the admin operations?

On my local computer when I need to do admin tasks I usually start the
respective Programs via runas (the context menu, actually). And as I
already wrote below, in a case where I have to run multiple programs
with admin privileges, I start a file manager (or command prompt) with
admin privileges, and start the other programs from there.

Are you spending extra time to load up your browser, Right clicking an
icon and typing a password? Just to start your browser.
Then if you close it, you have to do it again!!!

Nope. I'm logged in as a limited user and start the browser from there.

[...]

*end users* But a techie user may well want to put a txt file on c:\ ,
for the benefit of it being a short easy path. Easy to get to from the
command line.

Maybe I wasn't clear enough: NO ONE needs to create files in C:\.
Period. Even administrators don't need to create files in C:\ (although
they have the rights to do it). It's utterly stupid to create files in
C:\.

What do you do?

For your computer.

That's simple: I don't.

what about you, a techie user ?

Like I said before: I don't create files in C:\.

I can do notepad c:\a.txt

On my systems only admins can do that. Of course I expect them to be
smart enough not to do it.

and even a LUA account allows c:\a\a.txt

Not on my systems.

Do you type
notepad c:\document...bloody long path..\

I use either tab-completion or environment variables. Because I'm smart.

In addition to that all of my systems are configured so that I can start
an Explorer instance at %CD% from a command prompt as well as a command
prompt from each directory in the Explorer.

or a load of percentages to type an environment variable?!! Don't you
ever want to type things with a brush of the hand

I want to do things the smart way.

<slightly unnecessary and eccentric elaboration>
notepad, easy.
cd \ , easy. Even easier on a uk keyboard, to do cd\
%userprofile%\desktop . Even the %s are an issue. that's not nice to
type often. You have to look where the number is.. People tend to
touchtype with the keypad.. Typing shift+ one of those top numbers
isn't so smooth.

cobalt@CARBON C:\> doskey cdd=cd "%USERPROFILE%\Desktop"
cobalt@CARBON C:\> cdd
cobalt@CARBON C:\Documents and Settings\cobalt\Desktop> _

doskey is such a nice tool ...

All you want to do is create a file on the comp. Your comp !!
So?

At the moment i'm in a room and some idiot turned the lights out. I
can still type but % are even more of a nuisance than usual 'cos I
can't see the numbers. I'd have to get out of my chair to turn the
lights on. Anyhow, besides that, one should be able to touchtype
something so simple. Those top numbers aren' so accessible without
looking beforehand.. To create a file on the computer I shouldn't have
to squint or even look, at the keyboard.

Then use your mouse. Right-click on the desktop > New > Textfile.

Could it be you're just trying to be difficult?

So you're doing runas once, but then you need you file manager's
window open all the time.

Here's a big issue. Windows xp only has preinstalled, windows explorer
as a file manager. Doing runas on that has issues.

(probably linked to the fact that in the ctrl alt delete world, it's a
shell one can end and restart, and one the windows shell has started,
explorer.exe is a file manager! well, if you double click the icon)

A Workaround I briefly read of that I hadn't tried, is to do runas on
IE, and use the address bar to access local files (though I read
something about that not working with IE7) .
A workaround I use on the rare occassions that I use a LUA, is to do
runas on cmd.exe (typing a long runas command to bring up a command
prompt with administrative priviledges)
And apparently there's a fix that can be done on a per account basis,
to allow you to do runas on explorer.exe

http://blogs.msdn.com/aaron_margosis/archive/2004/07/07/175488.aspx
http://searchwincomputing.techtarget.com/tip/0,289483,sid68_gci1251819,00.html

If you use a 3rd party file manager and get around it that way, you
have to install that + do so for all your end users.

Yeah? Then admin dust must have magically made those issues go away for
me. Or maybe it was that "Run Explorer windows in separate process"
setting in the folder options? Who knows.

However, I also do use another (two-window) file manager alongside the
Windows Explorer, just because sometimes it's handy to have one. The one
I use can be unpacked to an arbitrary directory (e.g. on a share) and
then run from there without any further installation. Very convenient.

BTW, you do realize that you can run a command prompt with admin
privileges by right-clicking the executable (or shortcut to it) and then
selecting "run as..." from the context menu, don't you?

Such a trivial thing, and nero needs special treatment.

All CD burning software needs special treatment, because they require
hardware access, which is normally prohibited by the operating system
for limited users.

Doesn't cover other cd burners though.

Read again.

At least that hassle is a one-off, ok. Though for the rare times I
burn a CD. I can deal with runas.

That's not necessary, as I described above.

That doesn't apply here.
Runas works for installing or running programs that need
administrative priviledges to install or run respectively.

But it doesn't let you make administrative amendments, e.g. to the
windows firewall. Or adding/deleting users, resetting a password.

Of course it does. Most items in the control panel can be started via
runas, and of course you can start things like the Computer Management
console just the same way.

If doing admin tasks many times a day, at any time, it'a a hassle to
close all your programs and go to administrative mode, do them. Then
to go back as LUA to browse the web. And what if you want to do an
admin task and browse the web to check something.

Well, of course you can take a hammer and apply a couple nails to your
foot. However, the resulting pain is not the fault of the hammer.

Bit Torrent does not supercede P2P in any way. It has its issues

For a start, there's playing the game of searching for torrents. It
may take searching on a few websites to find what you want, and those
websites go down often and you have to be \in the loop' as to what the
current good torrent search sites are.

They are also different communities, diferent programs are availale.
Even from one P2P app to another. One may be good for music, another
for various genre of short video clips, another for (big) movies.. I
found an old program AA - autodesk animator - on kazaa. Kazaa made it
easy to share files. Yet, te first bit torrent client (The standard
one), i didnt' 'use it much but I recall it being messy to share the
files you downloaded, I think you had to keep windows open, one per
file.. Maybe a good client like uTorrent improves that. But all these
things have issues. P2P is good. For programs, vid clips, movies,
anything.

If you can tell me a way to find torrents that doesn't involve
googling myself into a new seat in hell, i'd like to know. One website
with all the torrents, a website that doesn't go down. I sitll doubt
it'll have the array of files that P2P apps do..

Well, if you want to keep using crappy applications: that's your choice.
But don't come complaining then.

cu
59cobalt

 

[Leythos]

Yes. And it's you starting to crosspost this back to csf again. Stop it.
What I wrote is NOT related to firewalls.


Which is exactly where it belongs.


Which is because it doesn't belong there.

Actually, the thread started in csf and it's completely on topic there
and here in mpws. So it does belong there as security is a common issue
no matter how we address the solution.

--

Leythos
- Igitur qui desiderat pacem, praeparet bellum.
- Calling an illegal alien an "undocumented worker" is like calling a
drug dealer an "unlicensed pharmacist"
(e-mail address removed) (remove 999 for proper email address)

 

[Ansgar -59cobalt- Wiechers]

I think it gets a bit confusing if the same thread is in different
groups but the contents is a bit different. It means that if somebody
wants to see all the posts in the thread it's almost impossible.

If you really don't want to discuss this in csf as well as here, and
you only want to discuss it here, and I see why, then I'm happy to
start a new thread here, in
microsoft.public.windowsxp.security_admin.

I think that would satisfy both our sensibilities.

I might make a post there to say that we agreed that this subtopic/
outgrowth of the thread, is being discussed in a new thread of a
different name in microsoft.public.windowsxp.security_admin..

is that ok with you?

No.

Usenet 101:
- If you start a topic, start it in exactly ONE group (the one that is
most appropriate for the subject).
- If for some (good) reason you feel that a subject is on-topic in more
than one group, crosspost the OP to all of these groups, but set a
followup to ONE group (the one that is most appropriate for the
subject).
- Do not break a thread to start a new one about the same topic in
another (or the same) group.
- See also [1,2].

That way everyone will be able to follow the discussion, and it won't be
scattered across several groups or hierarchies.

[1] http://catb.org/~esr/faqs/smart-questions.html
[2] http://www.rfc-editor.org/rfc/rfc1855.txt

And because this is utterly off-topic here: f'up2poster (in case you're
not familiar with this: it's a request to do any further discussion in
private, by mail).

cu
59cobalt