nanog mailing list archives
Re: Worms versus Bots
From: Iljitsch van Beijnum <iljitsch () muada com>
Date: Thu, 6 May 2004 11:45:23 +0200
On 5-mei-04, at 0:26, Rob Nelson wrote:
If the person doesn't continue to do acls/nat/firewalls, they'll just get infected after the next hole is discovered. And yes, there are plenty of holes that a firewall/nat box won't fix. Still, better than the user only doing Windows Update on the day of install and never having a firewall...
I object to the idea that requiring a software firewall inside a host is a reasonable thing to do. Why on earth would I want to run an insecure service and then have a filter to keep it from being used? Either I really want to run the service, and then the firewall gets in the way, or I don't need the service to be reachable, so I shouldn't run it. System services should only be available over the loopback address. Now obviously this is way too simple for some OS builders, but we shouldn't accept their ugly hacks as best current practice.
Current thread:
- Re: Worms versus Bots, (continued)
- Re: Worms versus Bots Matthew Crocker (May 05)
- Re: FW: Worms versus Bots Robert E. Seastrom (May 05)
- Re: FW: Worms versus Bots Alexei Roudnev (May 06)
- Re: FW: Worms versus Bots Chris Adams (May 07)
- Re: FW: Worms versus Bots Jeff Shultz (May 07)
- Re: FW: Worms versus Bots Alexei Roudnev (May 07)
- Message not available
- RE: FW: Worms versus Bots Daniel Senie (May 04)
- RE: FW: Worms versus Bots Rob Nelson (May 04)
- Re: Worms versus Bots Iljitsch van Beijnum (May 06)
- Re: Worms versus Bots Valdis . Kletnieks (May 06)