- NANOG - lists.nanog.org

RE: Microsoft to ship new versions with firewall enabled
by Drew Weaver 14 Aug '03

14 Aug '03

> John Neiberger wrote: > > > > Hmm...I didn't even know XP had a built-in firewall. Any bets on how > > long it is before other companies with software firewall products bring > > suit against Microsoft for bundling a firewall in the OS? > > -- > > No clue, but I can tell you how long it will last before ISP helpdesks > disable the firewall. About 30 seconds, for my customers. In fact, when you configure a dialup connection, the firewall *is* enabled by default, until walk them through turning it off? Why? Because after anywhere from 2 days to 2 months, suddenly things just stop working...usually POP3, but often SMTP, HTTP or HTTPS. Like many things MS, it's broken. --- Is that what causes the random stoppage? I never thought of that, why would it prevent outgoing connections on only some ports though. Seems fishy, thanks for the tip though :-) BTW: I've seen this too. -Drew

1 0

firewall == network diaper, ranting in HTML
by neal rauhauser 402-301-9555 14 Aug '03

14 Aug '03

I've got to wonder about someone who posts a rant to nanog to begin with and I'll give you kudos for having the balls to format it in HTML as well. Below I included the text of the message sans large aqua font & other HTML 'enhancements'. I think you rather missed my point - machines with incontinent TCP/IP stacks or incontinent applications should not be plugged in to the internet for server duty. It is just that simple. Unix has its occasional dribbles, Microsoft needs to be restrained and catheterized. Cisco could make one giant leap for mankind by simply renaming the PIX Firewall to the PIX Network Diaper. Its a more truthful description of what those things do and it might just get the people who sign checks asking why applications straight out of preschool are being placed in the field with a MCWN+N(Microsoft Certified Wet Nurse + Nanny) to watch over them, when perfectly functional adult alternatives exist. I'd really like to get down and roll in the muck with you guys, but I'm busying replacing M$ systems with FreeBSD 4.8 ... ----- Original Message ----- From: neal rauhauser 402-301-9555 To: Måns Nilsson ; nanog(a)merit.edu Sent: Wednesday, August 13, 2003 11:48 PM Subject: Re: Port blocking last resort in fight against virus Måns Nilsson wrote: > > Firewalls are a patch to broken network application architechture. If > > your applications would have been properly designed, you would not have > > the need for firewalls. They are for perimeter defence only anyway. Right on - if you can't plug a machine directly in to the internet and rely on its own defenses & well written code to keep it safe, why are you plugging it in at all? Oh come ON! Let's be a little real about this. How many millions of "don't have a clue, don't want a clue" people do you know who want to get online and see porn or nice pictures in other countries on "THE" Internet as the clueless call internet? How many businesses do you suppose there are that connect through a "disk from an internet service provider" and have the ISP set up a web site FOR them from where they get emails through a mailto link? There are literally MILLIONS of machines that want to be on internet without a clue about protecting at all. If they all knew how to protect, YOU would be working in something else! Lord help me what an attitude! When I was 17 and got my first car, I learned some about keeping it on the road but I found it didn't interest me too much and times and cars have changed since then. So, I get a mechanic to keep my car on the road and pay him. Don't tell me that anything you want to do even outside of computers at all you CAN do? Surely you rely on a mechanic to keep your car on the road. Maybe that mechanic is saying "If you cant keep your car on the road why are you driving at all?" Honestly the attitude of some people in I.T. gives me the shits. I know a LOT of businesses that USE computers but don't make money out of selling or servicing them. Get real - we are the "mechanics" of the computer world and it is up to US to let our customers know the truth. Don't forget, there are a lot of people about who are OLDER than 40 and use computers. Those people can REMEMBER being frustrated with computers even though some of them know as much as YOU do now. 20 something year olds are too young to remember that frustration and they end up with YOUR attitude as a result! There will come a day when the attitude of I.T. security people needs to be friendly to earn money. Learn to be friendly now ahead of time! Greg.

1 0

analysis of msblast
by Steve Bellovin 14 Aug '03

14 Aug '03

There's a disassembly at http://www.securityfocus.com/archive/1/333208/2003-08-11/2003-08-17/0 --Steve Bellovin, http://www.research.att.com/~smb

1 0

Re: How much longer..
by Scott Francis 14 Aug '03

14 Aug '03

On Wed, Aug 13, 2003 at 04:09:05PM -0700, dr(a)kyx.net said: > These kinds of inflated damages estimates are dubious at best. > If you've lost that much productivity, odds are you should be pointing > fingers at inapropriate redundancy and planning/procedures in your > computing facilities and not blaming some toy programs written by kids > with too much time. This kind of financial loss hype/fear-mongering is best > left to politicians, and not technical discussions. indeed - and yet companies claim these kind of damages, at least publicly, whenever these worms come along (every month or two, it seems). Two questions spring to mind: 1) where are these figures coming from, and 2) if they're accurate, why in the world would a company make the same mistake that cost them a million bucks last month, again next month? That's the kind of stuff that gets executives fired (you'd think) ... (note: the figures I posted were just gathered from publicly available news sources. We all know how accurate reporters tend to be when covering technical issues, so take them with a grain of salt. The point of the post was, there are a great many companies out there throwing good money after bad, month after month, without seeming to realize it.) -- Scott Francis || darkuncle (at) darkuncle (dot) net illum oportet crescere me autem minui

1 0

Re: Microsoft to ship new versions with firewall enabled
by Steven M. Bellovin 14 Aug '03

14 Aug '03

In message <9BF6F06C4BC90746ADD6806746492A332AED57(a)msmmail01.msmgmt.com>, "McBu rnett, Jim" writes: > > >From: Scott McGrath [mailto:mcgrath@fas.harvard.edu] >>No answer on that one, However Mac OS X also includes a built in firewall. > >>On the configuration angle, the Microsoft ICF (Internet Connection >>Firewall) blocks everything by default. > > I just worked on a friends computer last night. >The XP ICF firewall was on, and it did not stop >the bug.. >I want to test that in a lab environment though... > The Wall Street Journal noted that Microsoft is testing a variety of other security products, including one from Tiny Software because (according to Microsoft itself) "it's more advanced". --Steve Bellovin, http://www.research.att.com/~smb

1 0

Re: [Microsoft to ship new versions with firewall enabled]
by Joshua Sahala 14 Aug '03

14 Aug '03

Sean Donelan <sean(a)donelan.com> wrote: > > John Markoff reports in the New York Times that Microsoft plans to change > how it ships Windows XP due to the worm. In the future Microsoft will > ship both business and consumer verisons of Windows XP with the included > firewall enabled by default. > while i think many of us will welcome this, i am skeptical of what the firewall will be 'enabled' to block, and how easy it will be for the user to set-up rules (and hopefully there will be a sanity check included so that 'permit in any' is not a valid option, but then 'permit out any' should not be one either) but still, it is a step... my $0.02 "Walk with me through the Universe, And along the way see how all of us are Connected. Feast the eyes of your Soul, On the Love that abounds. In all places at once, seemingly endless, Like your own existence." - Stephen Hawking -

3 2

RE: [Microsoft to ship new versions with firewall enabled]
by Vachon, Scott 14 Aug '03

14 Aug '03

> while i think many of us will welcome this, i am skeptical of what > the firewall will be 'enabled' to block, and how easy it will be > for the user to set-up rules (and hopefully there will be a sanity > check included so that 'permit in any' is not a valid option, but > then 'permit out any' should not be one either) > but still, it is a step... Perhaps the better idea would be to ship a stripped down, basic OS for about $25.00 a license. Then offer up all the bells and whistles on a pay per download option. I think this one simple step alone would aid in reducing security issues on the OS. I would hazard a guess that a majority of users will NEVER use (or need) all the built in functionality currently included with the OS. ~S~ Disclaimer: My own two cents. Learn more about Paymentech's payment processing services at www.paymentech.com THIS MESSAGE IS CONFIDENTIAL. This e-mail message and any attachments are proprietary and confidential information intended only for the use of the recipient(s) named above. If you are not the intended recipient, you may not print, distribute, or copy this message or any attachments. If you have received this communication in error, please notify the sender by return e-mail and delete this message and any attachments from your computer.

1 0

RE: Microsoft to ship new versions with firewall enabled
by McBurnett, Jim 14 Aug '03

14 Aug '03

From: Scott McGrath [mailto:mcgrath@fas.harvard.edu] >No answer on that one, However Mac OS X also includes a built in firewall. >On the configuration angle, the Microsoft ICF (Internet Connection >Firewall) blocks everything by default. I just worked on a friends computer last night. The XP ICF firewall was on, and it did not stop the bug.. I want to test that in a lab environment though...

1 0

RE: How much longer..
by St. Clair, James 14 Aug '03

14 Aug '03

>Users, both corporate and at home, need to be taught that there is no >such thing as plug and play. For as much as I agree with the philosophy here, we must realize it is the wrong approach. Cars did not become more popular because owners had to learn how to swap more parts. Wireless phones don't require a contract and setting up your own frequency band. Computers are becoming a utility, and with greater sophistication more and more embedded. Back to cars, remember when a mechanic could fix a problem in a day? How many cars do we all own that now start a service check with a CPU diagnostic? This is not a trend that will be reversed. The emphasis must be placed on other market forces to correct things, like liability for failure and greater R&D for secure systems. Forcing the consumer to learn more has never worked in the market before, and won't here. Jim

4 3

RE: How much longer..
by Drew Weaver 14 Aug '03

14 Aug '03

I've been considering lobbying for the imposition of an Internet license for years now. I could think of a few people that need theirs yanked. -Bob ----- Even if you are kidding -- which I hope you are, then the Internet would turn into a pretty meaningless endeavor the entire point of the Internet is that anyone can use it, from anywhere in the world. Who would enforce these licenses? The US? What about the people in Korea, do they need to come to the US to receive an Internet license? This idea made my stomach turn ;-) -Drew

1 0