On 16 Nov 2007, at 11:03, Radoslav DejanoviÄ? wrote:

> Mark Senior wrote:
>>
>> But, they've missed the big possibility for improvement here - they
>> have an application-aware firewall - why on earth would they not
>> apply it to outbound connections? No interesting malware requires
>> inbound connections anymore; it's already written to get past home
>> routers that allow all outbound and deny all inbound connections.
>> Ah well.
>>
>
> That's an interesting point, but it's got its own set of problems.
> How would you know what all the different applications need to
> communicate with? You should be aware that mail reader has to have
> access to POP (and|or) IMAP and SMTP, maybe even newsgroups, and
> you have to know that for every single application out there, if you
> do not want to bother user with questions.

I think Mark was thinking along the lines of just allowing an
application wholesale, rather than allowing specific ports. I.e. just
like the application firewall can allow inbound requests to an
application [irrespective of what ports it uses] we could allow or
deny the application to make [any] outbound connections.

[ reply ]