akita said:
Jesper's and Alun's insistence that the user doesn't need to know about
outbound traffic and preferably shouldn't even bother, let alone be
allowed
to play with its apparently secret settings, makes we wonder, wonder a
lot,
actually!
I applaud your ability to misconstrue what I'm saying in this thread. I am
saying this:
Outbound filtering firewalls do not protect you from attack.
That's all.
I have no problem with you using outbound filtering to learn what your
applications are doing. Education is a fine thing, and you would do well to
increase your own.
Why should I trust Microsoft all of a sudden?
If you're running Windows, you already trust Microsoft - to the hilt. Every
application you run under Windows, every piece of data you store on a
Windows machine, is already given over to Microsoft's code. If you distrust
Microsoft, you should not run code from them - the same goes for any third
party that you distrust. Do not run code from untrusted individuals, groups,
organisations or companies.
Hell, Redmond's previous
attitude to security has been somewhat lacking in more than just one area.
And yet now they've had a "road to Damascus" conversion, and they're leading
the field, particularly in regards to development practices and processes
that are designed to produce secure code and protect privacy.
How are other companies doing on this track? What company has a better
process than Microsoft for securing their code?
And I haven't even mentioned Redmond's past snooping attempts. Now that
Microsoft is tackling the issue, granted an applaudable attempt, they
still
continue looking at users like children that need to be kept under strict
and
ruthless parental control - all of the time, no questions answered,
fullstop!
Microsoft makes a lot of money out of making operating systems that any
idiot can use. As a result, of course, many idiots use their operating
system, along with others who have better understanding of what they are
doing. The defaults are set for the majority of Microsoft's users to remain
safe and secure for the most part; advanced users can modify the defaults or
use third-party utilities to get the extra capabilities that they feel they
need.
Do I want to be able to filter outbound traffic just like inbound traffic?
Hell yes! Agnitum Outpost Pro kept me safe (and sane) over the years, and
looking at its rather detailed logs (another thing completely and utterly
missing from Vista's so-called out-of-the-box security experience) Agnitum
Outpost Pro not only has warned me about a fair few suspicious outbound
traffic attempts, but also has saved me from numerous attacks that could
have
been potentially disastrous!
It may have saved you from attacks, but not by outbound filtering - once you
see the outbound filtering messages, you're already attacked - you're
already running untrusted third-party code.
"The calls are coming from inside the house." - your computer is owned.
So much for Jesper's and Alun's claims that outbound filtering, the use of
and the knowledge of how to configure it, is useless for the user. What a
load of claptrap!!
Jesper's claims are subtly, but distinctly, different from my own. My claim
is simply that the use of outbound filtering does not prevent attacks; it
may be useful as a policy filter within an organisation (disallow outbound
traffic on ports commonly associated with chat applications, stolen file
sharing and so on, for instance), but adding it to your firewall sticks
unnecessary complexity into what should be a simple enough application that
you can prove its security.
Granted, some users may not want it, and indeed might find it annoying to
say the least. However, perhaps Microsoft in its utter graciousness
accepts
that not all users are automated morons contend with using what and how
Microsoft allows them to. An inbuilt option for advanced users to
configure
the firewall, would not only be very much in order, but even more
appreciated
by many, I'm sure!
"netsh firewall" along with the GUI should provide you with most of what you
want. After that, as you've pointed out, there are numerous third-party
tools.
Besides, now that Microsoft has finally gone the security way and seen the
light by offering something that approaches a half usable firewall, why
not
go the whole hog, admit to the well documented fact that there are
numerous
users out there more than capable of setting up / using correctly a fully
blown software firewall, and offer us the same. Rather than giving us a
half-hearted attempt of a firewall, crippled on purpose simply to keep
some
sort of control over the user. It stinks.
You have been party to the conversations inside of Microsoft when they were
designing the firewall? You know that this was "crippled on purpose simply
to keep some sort of control over the user"? Is this information first hand,
second hand, or merely supposition on your part?
From my perspective, I'm guessing that outbound filtering was added on the
basis that there were too many self-labeled "security experts" saying that
"outbound filtering is where it's at, man, if you don't have that, you're
not a secure firewall" - it's a marketing feature to me.
Every feature you add to a firewall makes it more complex, and more likely
that there's a bug that can be exploited to bring down the firewall. I like
my firewalls simple and strong, rather than complex knitting.
Like voidcoder, I will definitely continue paying for a decent third-party
firewall as soon as it becomes available for Vista - can't wait, in fact!
That's for you to decide, and it's up to you as to whether you feel it's
necessary. But don't be saying that outbound filtering prevents your system
from being attacked without expecting people like me to jump up and tell you
that you're wrong.
In fact, given the pluggable nature of Windows Vista's firewall stack, it
should even be _easy_ for a firewall vendor to produce an outbound filter
for Vista. All you have to do is write a device driver, following the sample
code that's already in the DDK. If you're a developer, try it - it's
insanely easy.
One more tool to consider, voidcoder: Ad Muncher - great utility to stop
them annoying on-line ads, including Microsoft's petty banners on hotmail
et
al.
Or, you could actually pay for your email, and not have to worry about
advertising that subsidises the free service you're using. Eventually, the
free service providers will find a way to guarantee that their adverts are
tied to their email in a way that you aren't ready to extract.
Alun.
~~~~
It was