On Fri, Aug 22, 2014 at 2:50 PM, Thomas Woerner <twoerner@redhat.com> wrote:
<snip>
So that means that server application developers without the firewall configuration tool would have to either use the command line or even completely disable the firewall in order to develop networked services that use privileged ports, right?

And that would in my humble opinion be a really bad user experience for server application developers trying to use Fedora Workstation.

I assume that most developers will run on high ports: it's a standard practice for python and ruby web developers, for example.
If we convey (in the release notes and documentation) the fact that the high ports are open by default and that people who need other ports can install the configuration tool then I don't see anything wrong with removing it.
 
In fact, the tool as we have now is not helpful for most developers - Many developers don't understand much about ports, firewalls, protocols and such, and they usually shouldn't because on production they have IT teams to handle this sort of thing. Add to that confusing firewalld-specific terminology (zones, for example) and you get a tool that is only useful for people who have researched the subject. Including a tool that is unhelpful and frustrating is worse than not including a tool at all (I really hope the UI / UX of this tool could be improved in the future).


Searching for a firewall configuration tool and the need to install it over the network would not be a good user experience in my opinion. Additionally it would not be possible for the user to configure the firewall with a graphical configuration tool according to the security requirements of the environment before going on line.


Can you give an example of a security policy that requires the *user* to configure their own firewall before going online? Seems weird to me.
Organizations which require strict firewall configuration wouldn't trust users to do so, they would install from a kickstart file with the firewall cIonfiguration already in place and the user having no root access - otherwise how would they know if the users don't simply disable their firewalls?

And if the organization is not the one who deployed Fedora, but rather the user installed it themselves on their computer, this surely would violate the security policy (if the organization even cares about that - I assume that those who allow you to install a custom OS on your company laptop do not have such strict policy).

Other than organizational security policy I can't imagine any other "security requirement of the environment" that would be affected by weather or not you can configure your own firewall.

 

To have a system without being able to configure it before actively searching for configuration tools is hopefully not the goal.

 
If it works out of the box, there's no *need* for a specialized configuration tool.
Web developers who want to run a local test machine on port 80, for example (from my experience most of them don't) will need to manually install and configure a webserver anyway - they could configure the firewall as an extra step there.
 
Would you mind if we continue this discussion on fedora-devel as I strongly believe that the broader community should give more input to this decision.

I would rather if we didn't. In fact, I will not participate in any discussion going on in fedora-devel, as I think that list is mostly counter-productive flamewars. Let's keep this discussion where it belongs: in the Workstation/Desktop and the firewalld mailing lists.
 

--
-Elad Alfassa.