05-11-2004, 06:05 PM
Some may be less secure than others, but all "personal firewalls" (= software packet filters) are a security hole by design. I recommend to not use them at all.
Plus: many of them are very annoying. Administrating a network where users have these programs running can be a major PITA. People don't realize that, while providing very little extra security, these programs often break many undangerous but useful applications.
What PFWs do is:
Make the uninformed user think that perfectly legal and undangerous traffic is an evil hacker attack so he feels threatened, then spit out a useless message so he feels protected (if the firewall has succesfully "blocked" the "attack" *cough*, there is no need to inform you about it, is there ?)
"I have just blocked access to your computer !!!". What the damn program blocked was a ping from the local DHCP server who wanted to know wether the leased IP address is still in use: Result: Address conflict, broken network..
What PFWs cannot do is:
Protect you from evil hacker attacks. An attacker who manages to make you run his code on your computer can easily disable or cheat *any* personal firewall. The other scenario are incoming connections. For that scenario, you do not need any firewall at all. It is absolutely sufficient (and easier, and more secure) to not run any insecure services. If you consciously decide to run an insecure service, you will also decide to allow access to that service via the firewall. If you don't, why run the service in the first place ? If the service does not run, there is no need to "protect" it with a firewall. Usefulness of the firewall ? Zero.
For whom are PFWs useful ? For the companies that produce them.
Plus: many of them are very annoying. Administrating a network where users have these programs running can be a major PITA. People don't realize that, while providing very little extra security, these programs often break many undangerous but useful applications.
What PFWs do is:
Make the uninformed user think that perfectly legal and undangerous traffic is an evil hacker attack so he feels threatened, then spit out a useless message so he feels protected (if the firewall has succesfully "blocked" the "attack" *cough*, there is no need to inform you about it, is there ?)
"I have just blocked access to your computer !!!". What the damn program blocked was a ping from the local DHCP server who wanted to know wether the leased IP address is still in use: Result: Address conflict, broken network..
What PFWs cannot do is:
Protect you from evil hacker attacks. An attacker who manages to make you run his code on your computer can easily disable or cheat *any* personal firewall. The other scenario are incoming connections. For that scenario, you do not need any firewall at all. It is absolutely sufficient (and easier, and more secure) to not run any insecure services. If you consciously decide to run an insecure service, you will also decide to allow access to that service via the firewall. If you don't, why run the service in the first place ? If the service does not run, there is no need to "protect" it with a firewall. Usefulness of the firewall ? Zero.
For whom are PFWs useful ? For the companies that produce them.