Worms versus Bots

Iljitsch van Beijnum iljitsch at muada.com
Thu May 6 09:45:23 UTC 2004


On 5-mei-04, at 0:26, Rob Nelson wrote:

> If the person doesn't continue to do acls/nat/firewalls, they'll just 
> get infected after the next hole is discovered. And yes, there are 
> plenty of holes that a firewall/nat box won't fix. Still, better than 
> the user only doing Windows Update on the day of install and never 
> having a firewall...

I object to the idea that requiring a software firewall inside a host 
is a reasonable thing to do. Why on earth would I want to run an 
insecure service and then have a filter to keep it from being used? 
Either I really want to run the service, and then the firewall gets in 
the way, or I don't need the service to be reachable, so I shouldn't 
run it. System services should only be available over the loopback 
address. Now obviously this is way too simple for some OS builders, but 
we shouldn't accept their ugly hacks as best current practice.




More information about the NANOG mailing list