On Tue, 12 Jul 2005 02:45:00 -0400, "Karl Levinson, mvp"
Agreed. In study after study over the past four years or so, an unpatched
or otherwise vulnerable system is typically compromised or infected within
15 minutes of getting on the Internet, regardless of whether DSL versus
dial-up is used. Viruses don't check whether you're using DSL or not, and
there are millions of infected computers out there scanning every IP address
continuously. Regardless of which internet connection you're using, you're
either already protected, or you may already be infected. [If you're not
infected, you're doing something right that will still be just as right and
probably just as effective when you're on DSL.]
The part I have difficulty with, is maintaining internal firewall
status when moving from separate Internet and LAN connections, to the
same network connection for both LAN and Internet - as is the case
when one adds an ADSL NAT router as an extra network device.
Normally, I'd do that by raising the firewall on all PCs, with no
exceptions opened, and then use a different network protocol to carry
the LAN traffic (i.e. File and Print Sharing aka F&PS).
This works fine when there are no NT systems involved, i.e. a pure
Win9x LAN. All F&PS is on NetBEUI, which cannot be routed and
therefore can't "leak" outside the (wired) LAN. Firewalls are up, and
F&PS is not affected. Sweet.
But XP (in my experience) can't do NetBEUI to Win9x, even if you do
find and apply the "unsupported" NetBEUI for XP. I've been told
adding the NetBEUI files from Win2000 works, but I don't want to
version-soup a subsystem I understand as poorly as I do networking. I
also find that IPX doesn't work, between Win9x and XP.
So if I do use the software firewall, I'm forced to open it up so that
F&PS can get through. That's not as easy as it could be; the UI
varies between XP SP level, and what you see when you look at the main
page of firewall properties is not what you see if you selectively
apply settings on a per connection basis.
For example, on SP2, Control Panel Windows Firewall shows me:
Exceptions, File and Print Sharing. That's easy enough, but let's say
I want to apply different settings to FireWire than what I apply to
the LAN adapter. I go Advanced, highlight the adapter I want to
affect, and the list of things to work with bears absolutrely no
relationship to the list I saw earlier - and File and Print Sharing is
nowhere to be found. Maybe I'm supposed to "Add" something as rare
and arcane as File and Print Sharing, which I might do if I could
smell (or in my case, remember) what ports it uses.
This may not be rocket science for network gurus, but the rest of us
are going to turn the firewall off, and hope NAT stops the bullets.
-- Risk Management is the clue that asks:
"Why do I keep open buckets of petrol next to all the
ashtrays in the lounge, when I don't even have a car?"
