Hacker News Reader

Comment by Gordonjcp | Hacker News Reader

> I've met enough Linux fanboys who insisted what they don't need a firewall running on their public machines, because... Linux is safe.

Why would it need a firewall running?

View on HN

The same reason you wear helmet on a bicycle or a hard cover hat on a construction site. It is an addition layer of protection (and with firewall you don't even any discomfort of wearing a helmet) which can protect you if something goes wrong.

Today you setup you shiny new host and you know exactly what is running on it and what ports are open. Some months/years later?

Yes, a single purpose mail server can get by with tcp/22 and tcp/25 for all it's useful life but something more complex?

Or when you don't even know for sure what are defaults are and you 'move fast and break things'? Should I remind you about MongoDB fiasco? [0] Are you sure all your 'internal' services (DBs and whatever) are bound to localhost and not to 0.0.0.0?

Running a firewall in the default drop/whitelist mode (at least for the inbound traffic) protects you against your own mistakes.

Add to this what while you can be an exceptional localhost admin, as soon as you have more than 5 hosts and/or work with other people you can never be sure what every host is properly configured, secured, don't have anything unnecessary running.

[0] https://krebsonsecurity.com/2017/01/extortionists-wipe-thous...

>> If installed on a server with the default settings, for example, MongoDB allows anyone to browse the databases, download them, or even write over them and delete them.

So about the only thing you can give an example of is an application that no-one should be running on a server exposed to the Internet, that's dangerously broken by default?

So about the only thing you can object to is what I didn't provide you a comprehensive list of a networked software with an unsafe defaults, now or ever existed?

Edit: with a 'deemed safe enough by Gordonjcp@HN' column of course.

It's also unsafe to drive around with your eyes shut, but any reasonably competent person would know not to do that.

Your argument is "software might have unsafe defaults, so you should rely on a piece of software that might have unsafe defaults".

> Your argument

My argument is having an additional layer of protection just in case. Do you wear a helmet only on the days you fall off from your bicycle?

> you should rely on a piece of software that might have unsafe defaults

Well, if you just took the helmet with you but never bothered to wear it...

Your analogy breaks down. It would be more accurate to say "Do you wear a helmet only on the days you plan to intentionally launch yourself off the bike into a rock?"

If you cannot install a server without ensuring you're running what you expect to be running, you've no business running it at all.

Tell that to all folks who have no idea but eager to have a private server/make business/whatever. It looks like you are one of those fanboys who regard their skill as a something sacrosanct to which no plebs should be allowed to even know.

Not in the slightest.

It's a skill that everyone should know, if they want to run servers. It's a skill you can acquire by reading some very simple instructions.

Imagine if bridges were designed and built by the fuckwits that created (or indeed use) MongoDB.

I don't wear a helmet so I can ride my bike drunk with eyes closed.

The other way in which the analogy is flawed is that I might very well consider myself a perfect cyclist, but that still doesn't protect me from that drunk driver in a SUV shooting out a side alley where I have no chance to react.

Your analogy still doesn't work.

A firewall does nothing useful if there's nothing to firewall.

Yes? That's exactly what I'm saying.

Reply on news.ycombinator.com