«

Another note, XP's firewall will not stop MSWord from going to the
internet. The free ZoneAlarm will. If you are pasting something to your
browser ZA will ask if word can go to the internet, accept it in that
case. In other case if ZA asks don't allow it. It is not rocket
science, but does need some presences of mind.

Satya


Sebastian Gottschalk wrote:
> Zak wrote:
>
> > Seb, I'm new to your view on firewalls but you seem to have in mind a
> > rather different thing than what many people would call a software
> > fireall on their PCs.
>
> A firewall is a concept to separate network segments on a perimeter.
> Running a packet filter on the host that's supposed to be protected doesn't
> leave any way to do such a separation, the packets always arrive the host.
>
> > Can you say a bit more about what sort of preferred solution I could use
> > which is as economical as possible. (I can't afford lots of sexy super-
> > specification hardware if there is a cheaper and effective equivalent).
>
> For home users? Simply no packet filter or firewall at all. Obviously,
> since you can't achieve any security trough such measures without in-depth
> knowledge of TCP/IP and networking - which home users usually don't
> possess.
>
> Against malware there's very simple solution: Don't run it in first place.
> Don't use any software that automagically runs untrusted code. Make
> reasonable judgments about the trustworthyness of software vendors.
>
> Anyway, nothing will help against MS Word being a totally broken piece of
> software.

Sy wrote:

> If you are using a Microsoft machine that is XP with SP 2, PC mag and
> Computer World both say it gets the job done

At least until the user experiences more and more problems due to many
Windows games requiring access to some ports.

> as far as ingress filtering,

Don't you mean "inbound"? Windows Firewall doesn't do any ingress filtering
by default.

> and after going into the firewall utility>advanced and closing the port
> of my printer

You didn't close it, you just blocked it. Once Windows Firewall fails for
some reason (random or user-inducted), it'll show up again.

> Otherwise there is the free ZoneAlarm firewall that just takes a little
> figuring out.

And makes the computer insecure, ****s up all network functionality, gives
a major slowdown...

Sy wrote:

> Another note, XP's firewall will not stop MSWord from going to the
> internet. The free ZoneAlarm will.

Wow, what a use. Expect that MSWord only goes to the internet when you
explicitly want it.

> If you are pasting something to your
> browser ZA will ask if word can go to the internet, accept it in that
> case. In other case if ZA asks don't allow it. It is not rocket
> science, but does need some presences of mind.

Well, for malware it won't ask. Security purpose failed.

on 11/6/2006 4:18 PM Sebastian Gottschalk said the following:
> Sy wrote:
>

>
>> as far as ingress filtering,
>
> Don't you mean "inbound"? Windows Firewall doesn't do any ingress filtering
> by default.
>

One of those language things
ingress = inbound
egress = outbound

More accurately, ingress and egress refer to the act of entry and act of
exit respectively. (also, right of entry / exit or place of entry / exit)

Pedantically yours,
JH

John Hyde wrote:

> on 11/6/2006 4:18 PM Sebastian Gottschalk said the following:
>> Sy wrote:
>>
>
>>
>>> as far as ingress filtering,
>>
>> Don't you mean "inbound"? Windows Firewall doesn't do any ingress filtering
>> by default.
>>
>
> One of those language things
> ingress = inbound
> egress = outbound
>
> More accurately, ingress and egress refer to the act of entry and act of
> exit respectively. (also, right of entry / exit or place of entry / exit)
>
> Pedantically yours,
> JH

But "ingress filtering" is the common term for spoof filters applied to
incoming traffic, to filter out traffic with a source/destination IP
address from a private netrange. Sometimes this also includes the inbound
filtering from generic spoof filters, e.g. with a source address being the
actual target or with destination address unequal to the actual
destination. Respectively egress filtering.

on 11/6/2006 6:53 PM Sebastian Gottschalk said the following:
> John Hyde wrote:
>
>> on 11/6/2006 4:18 PM Sebastian Gottschalk said the following:
>>> Sy wrote:
>>>
>>>> as far as ingress filtering,
>>> Don't you mean "inbound"? Windows Firewall doesn't do any ingress filtering
>>> by default.
>>>

Ok, I thought I understood you to say that "ingress" filtering was
different from "inbound" filtering. Is that right . . .?

>> One of those language things
>> ingress = inbound
>> egress = outbound
>>
>> More accurately, ingress and egress refer to the act of entry and act of
>> exit respectively. (also, right of entry / exit or place of entry / exit)
>>
>> Pedantically yours,
>> JH
>
> But "ingress filtering" is the common term for spoof filters applied to
> incoming traffic, to filter out traffic with a source/destination IP
> address from a private netrange. Sometimes this also includes the inbound
> filtering from generic spoof filters, e.g. with a source address being the
> actual target or with destination address unequal to the actual
> destination. Respectively egress filtering.

Or are "inbound" and "ingress" filtering basically the same thing?

Thanks,
JH

John Hyde wrote:

> Ok, I thought I understood you to say that "ingress" filtering was
> different from "inbound" filtering. Is that right . . .?
> [...]
> Or are "inbound" and "ingress" filtering basically the same thing?

ingress == inbound, but "ingress filtering" has a special meaning wrt. to
firewalls.

on 11/6/2006 7:28 PM Sebastian Gottschalk said the following:
> John Hyde wrote:
>
>> Ok, I thought I understood you to say that "ingress" filtering was
>> different from "inbound" filtering. Is that right . . .?
>> [...]
>> Or are "inbound" and "ingress" filtering basically the same thing?
>
> ingress == inbound, but "ingress filtering" has a special meaning wrt. to
> firewalls.

Ok, txs