Firewall blocking desktop features

[Alec Leamas]

On 2013-09-11 15:20, Ralf Corsepius wrote:
> On 09/11/2013 02:46 PM, Daniel J Walsh wrote:
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA1
>>
>> On 09/11/2013 06:35 AM, Heiko Adams wrote:
>>> Am 11.09.2013 12:30, schrieb Alec Leamas:
>>>>
>>>> That said, I see your point.  Seems to boil down to that only the
>>>> application knows which port(s)  to open and why, whereas only the
>>>> firewall can guarantee  that it actually opens the ports requested by
>>>> user instead of something else.
>>>>
>>> So the application needs to ask the firewall to open one or more 
>>> ports and
>>> the firewall has to ask the user for permission to do so. In this 
>>> szenario
>>> the firewall knows what application wants which port(s) to be open. 
>>> Letting
>>> the application directly ask for permission to punch holes in the 
>>> firewall
>>> is IMHO the worst case of all and a securiry nightmare.
>>>
>>>
>>>
>>
>> Asking my wife if she intends to open port 2345 is a waste of time.  
>> She has
>> no idea whether or not this is required.  And will quickly learn to 
>> answer ok.
>>
>> Asking her "Do you want to make security changes to share directory
>> /home/phyllis/Share?"  Or
>>
>> Do you want to make security changes to share Printer XYZ?
>>
>> Would make sense.
> My marriage would be facing serious troubles, if my wife opens any 
> port on our shared machines ;)
>
> Seriously, I think you guys are forgetting Linux isn't a 
> Single-User-Single-Seat OSes.
>
> Ralf
>
>
Well, it is. Also. And hat's really the core here. It's so damned 
different in these two cases.

--alec