On Tue, Dec 9, 2014 at 2:08 AM, Nikos Mavrogiannopoulos <nmav@xxxxxxxxxx> wrote: > On Tue, 2014-12-09 at 17:29 +1030, William B wrote: >> > > I just happened to look at the firewalld default settings, and I >> > > was not amused when I noticed this: >> > > http://pkgs.fedoraproject.org/cgit/firewalld.git/tree/FedoraWorkstation.xml >> > > > <port protocol="udp" port="1025-65535"/> >> > > > <port protocol="tcp" port="1025-65535"/> >> > > This "firewall" is a joke! ALL higher ports are wide open! >> >> I want to point out that for many home users, going into the future >> this is worse than it seems. Many of us are just thinking about the >> local network. Firewalld implements these rules not just for ipv4, but >> ipv6 too. If you have a low quality home router, that just lets ipv6 >> traffic in, you aren't just exposed to the whole network, but the whole >> internet. While ipv6 relies somewhat on well configured router >> firewalls, we cannot guarantee this. > > That is compromise. Of course there are untrustworthy LANs. However we > shouldn't cripple functionality for users on their trusted lan because > there may be few users in a LAN they don't trust. If you are in such a > lan, then I'd expect to switch your firewall's zone. If the installer > could do that automatically, it would be even better. If the join wifi UI were to accept one piece of additional metadata about the connection it's storing: home, work, friend, public, each connection could be associated with an appropriate firewall zone automatically. And if the AP is insecure, a rule could set the zone to public by default. Typical users don't manually switch firewall zones. They can't even do this on tablet and mobile devices. -- Chris Murphy -- devel mailing list devel@xxxxxxxxxxxxxxxxxxxxxxx https://admin.fedoraproject.org/mailman/listinfo/devel Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct
