On Sun, 13 Jul 2008 18:03:01 -0700, Paul (Bornival) wrote:
> Hi, everyone,
>
> This thread has seen a very "active" discusssion about the mutual
> responsibilities of MS and ZA for the "loss of Internet access" disaster
> linked to the issue of KB951748.
>
> For sure, the DNS issue was known by the main software manufacturerers much
> before July 8th, and ZA could have been more proactive.
Quite right! And this really should be the end of the story!
> However, the argument that MS can change its software "ex abrubto" and put
> the culprit on 3d party software in case of problems (because, for ZA, the 3d
> party has modified a core component of its system) needs to be re-examined.
> Indeed,
ZA had sufficient time to address this issue.
> - the main reason why people adopted ZA firewall (or other 3d party
> firewalls) is because neither Win95/98/ME or WinXP (before SP2) had any
> protection in this context (more about that on
> http://en.wikipedia.org/wiki/Windows_Firewall). The firewall introduced with
> WinXP SP2 was only directed against attacks from outside but did not block
> anything from inside (this was considered as unecessary, and claimed as such
> on this forum, ... untill, eventually, Vista introduced it, which
> demonstrates its usefulness...)
It was essential to utilize a 3rd party firewall application prior
WindowsNT (which incidentally applies also to Registry Cleaners). After the
introduction of NT the in-build firewall made 3rd party applications
superfluous, which obviously wasn't well received by the makers of these
software.
> - as a result, mots of us had to use 3d party firewalls to prortect our
> computers (I did so after seeing my unprotected WinXP computers so easily
> attacked ...).
A 3rd party apps. wouldn't have saved you; Especially ZA!
> I submit that MS should recognize that, because it introduced a decent
> firewall only recently, it has to respect those users who installed a 3d
> party firewal ... and have remained faithful to it.
The decent firewall was introduced by MSFT with the introduction of NT. It
is, compared to the existing 3rd party apps., a "more honest" and superior
and product. The reason for most users chosing 3rd party applications is
the relentless hype and scare mongering tactics created by the makers of
these software. In terms of security 'outbound control' is utter nonsense!
> Although, stricto sensu, MS is not obliged to take into consideration all 3d
> party sofware when thay make chnages that may affect the users of such
> software, they could have been more prudent in this case.
Again, ZA had sufficient time to act accordingly. Others did, didn't they?
> In a broader context,
Educational reading re outbound control:
PFW Criticism.
http://en.wikipedia.org/wiki/Personal_firewall#Criticisms
Why your firewall sucks.
http://tooleaky.zensoft.com/
"But I quickly realized the truth: The added protection provided by
outbound filtering is entirely illusory."
At Least This Snake Oil Is Free.
http://msinfluentials.com/blogs/jesper/arc...il-is-free.aspx
Deconstructing Common Security Myths.
http://www.microsoft.com/technet/technetma...hs/default.aspx
Scroll down to:
"Myth: Host-Based Firewalls Must Filter Outbound Traffic to be Safe."
Exploring the windows Firewall.
http://www.microsoft.com/technet/technetma...ll/default.aspx
"Outbound protection is security theater¡Xit¡¦s a gimmick that only gives the
impression of improving your security without doing anything that actually
does improve your security."
Read in its entirety:
Managing the Windows Vista Firewall
http://technet.microsoft.com/en-us/magazine/cc510323.aspx
Apropos hype:
Go to...
http://www.sunbelt-software.com/Home-Home-...sonal-Firewall/
....and follow all the hype created by Sunbelt's *Marketing Department*.
Still use the free Windows XP firewall?
Unfortunately, this gives you a false sense of security. It only protects
incoming traffic. But outgoing traffic, with your credit card info, social
security number, bank accounts, passwords and other confidential
information is not protected. The WinXP firewall will let it all go out.
But... SPF will block that data if you buy the FULL version! You absolutely
need a better, commercial-grade firewall.
Then read in...
Windows Personal Firewall Analysis
http://www.matousec.com/projects/windows-p...rewalls-ratings
....a more realistic view which obviously was drafted by the head of
Sunbelt's *Operations department*.
Sunbelt Software - the vendor of Sunbelt Kerio Personal Firewall
2007-08-07: Here is the response we have received from this vendor:
Sunbelt Software is committed to providing the strongest possible security
products to its customers, and we will be working to correct demonstrable
issues in the Sunbelt Personal Firewall. Users can expect these and other
continuing enhancements for the Sunbelt Personal Firewall in the near
future.
However, we have some reservations about personal firewall "leak testing"
in general. While we appreciate and support the unique value of independent
security testing, we are admittedly skeptical as to just how meaningful
these leak tests really are, especially as they reflect real-world
environments.
The key assumption of "leak testing" -- namely, that it is somehow useful
to measure the outbound protection provided by personal firewalls in cases
where malware has already executed on the test box -- strikes us as a
questionable basis on which to build a security assessment. Today's malware
is so malicious and cleverly designed that it is often safest to regard PCs
as so thoroughly compromised that nothing on the box can be trusted once
the malware executes. In short, "leak testing" starts after the game is
already lost, as the malware has already gotten past the inbound firewall
protection.
Moreover, "leak testing" is predicated on the further assumption that
personal firewalls should warn users about outbound connections even when
the involved code components are not demonstrably malicious or suspicious
(as is the case with the simulator programs used for "leak testing"). In
fact, this kind of program design risks pop-up fatigue in users,
effectively lowering the overall security of the system -- the reason
developers are increasingly shunning this design for security applications.
Finally, leak testing typically relies on simulator programs, the use of
which is widely discredited among respected anti-malware researchers -- and
for good reason. Simulators simply cannot approximate the actual behavior
of real malware in real world conditions. Furthermore, when simulators are
used for anti-malware testing, the testing process is almost unavoidably
tailored to fit the limitations of simulator instead of the complexity of
real world conditions. What gets lost is a sense for how the tested
products actually perform against live, kicking malware that exhibits
behavior too complex to be captured in narrowly designed simulators.
This is pretty eye-opening as well:
Firewall LeakTesting.
Excerpts:
Leo Laporte: "So the leaktest is kind of pointless."
Steve Gibson: "Well,yes,...
Leo: "So are you saying that there's no point in doing a leaktest anymore?"
Steve: "Well, it's why I have not taken the trouble to update mine, because
you..."
Leo: "You can't test enough".
Steve: "Well, yeah.
Leo: "Right. Very interesting stuff. I guess that - my sense is, if you
can't test for leaks, a software-based firewall is kind of essentially
worthless."
Read and/or listen to the entire conversation here:
http://www.grc.com/sn/SN-105.htm