2014-03-04 13:51 GMT+01:00 Reindl Harald <h.reindl@thelounge.net>:
second:
third:
(lots snipped).
 
Those are cases I have also numbered 2) and 3) earlier in the thread :)  I agree that a firewall by default, for all services, makes sense in these situations.

The email you are quoting is my objections to having the default differ between roles.  I think that our cases 2) and 3) either apply across the whole computer, or not at all; so having the firewall allow access to some roles by default and not to others doesn't make sense.

fourth:
"to run arbitrary code really that frequent" define that - any scripting language
with commands like exec(), system() and so on is in danger to run code if it is
not perfectly secured what a default installation is unable to do

I think that's addressed by my case 4): a firewall that only blocks incoming connections is not all that useful in this situation.

and so finally: now, in the past and in any future you have to block any incoming
connection in whatever operating system by default or nobody with security knowledge
will install that "product" because he is aware about the wrong security attitude
of it's creators and that it is not worth the time for a second look

I'm not at all insisting on having no firewall by default, but my interest in appeasing cargo-culting requests like "you must run a firewall and antivirus and antispyware" is really limited.  Not exactly zero, but fairly close to zero.  Why do we need to block incoming connections?  If we have a reason, are we actually deploying the firewall in a way that does handle that reason?

I see having a firewall running by default, but punching holes in it by default, without explicit user involvement, as such a case: the underlying reason to have a firewall seems to be defeated by the way the firewall is being used.
    Mirek