Oh Holy Firewall
Please stop turning my firewall into Swiss cheese? ...Please?
Dearest Microsoft,
We've known each other for a very, very long time, and I've generally been a fan. I'm not a zealot… I use an iPhone and Apple Watch… but I cut my teeth on DOS, got into NT and those 44 3.5" floppies, jumped on the .NET Framework 1.1 bandwagon, learned C# and did a bunch of dev, and even worked for you for several years. I'd say we go pretty far back and I'd like to believe we have some rapport.
But look… We need to have a conversation. You kinda do some questionable things sometimes (Note to trolls: Okay, a lot of times). In many ways most of the annoyances come from either being too greedy (just give the damn Windows Phone OS away, already?!) to just not following through on a strategy (though the Steve-> Satya upgrade was a good one… Sorry Balmer).
From a technical perspective, I know a lot of the "compromises" you make are in the name of compatibility and just DON'T BREAK IT. I get that. Actually shipping a truly well locked down OS (considering where we came from) would pretty much break everything, though there is something to be said about forcing security into the mix and making people actually aware of the compromises they're making I their security implementation.
What I'd like to talk about though is something you did relatively well: your built-in firewall. I know… a lot of people don't think built in tools are good enough. They'll say you have to do 3rd party, you have to do open source, you have to do a lot of things, you can't trust it, blah, blah, blah. The firewall though is relatively solid. Shut it down and a Nessus or Nmap scan comes back with zilch. Perfect.
So why are you breaking it?
I'm typing this on my laptop. I'm not serving anything to anyone or running any shared/public services (at least not intentionally), so I don't need anything on my computer to somehow be accessible to anyone. Since the Windows firewall is stateful, I get all the use I need out of allowing all of those lovely outbound connections and their statefully accepted responses come through just fine. I need my computer to talk to things… I don't need things talking to it (mostly).
In theory this means that A) I don't need my laptop listening for connections from anywhere else, and B) I don't need that lovely locked down firewall destroyed with rules that let… anything… accept a connection. And I do mean ANYTHING.
Here's a screen capture of the inbound, allowed, “Public” profile. I've taken the liberty of highlighting the rules that I feel go well beyond "Uhh…" and are truly in the "WTF" category. We'll just skip the point where I don't really care about being able to stream to my laptop from… somewhere on a public network, or that it's unlikely I'll want some rando trying to connect to my Hyper-V configuration. I can see the debate… "Oh, well, those require authentication, and the services aren't even running (usually), and those aren't discoverable (liar), and really, it's okay"… but, no. Security is best implemented in layers, and having a layer just so you can poke holes through it kinda destroys the value of the layer.
I have to emphasize, these are inbound connection rules for the public profile. The firewall doesn't need these rules to allow my web browser to work… that whole outbound-stateful thingy solves that problem. These are things that can talk to my computer without me asking or knowing… and in that context, most of them make absolutely no sense.
For example:
Photos - Why does the Photos need the ability for random people to be able to talk to it? Maybe there's a "well it's to support easy sharing"… but I don't really think so. The Connected Devices, and Cast to whatever, and Proximity Sharing should all be doing that and handing off the shared thing to whatever app is appropriate. The Photos app itself shouldn't be listening for anything, should it?
Xbox Gaming Overlay - So you mean to tell me that in order to do some visual overlay you need to allow an inbound network connection? Isn't that like, a display thing and not a network or communication thing? Also, I'm not a gamer… why can't I just uninstall the Xbox gaming everything anyway?
IPHTTPS and IPv6 - Just kinda… open? Look at it… it's "All", "Allow", "Any", "Any"… Wha… I just… I'm… This… Why… *sigh*. Moving on…
Cortana - You've laid her to rest (sorry, Cortana) so hopefully this will soon go away (Nope. Uninstalled Cortana, now that I can, and the rule is still there. Good times.)… but what did she need to listen for? I'm pretty sure all of these things are listening all the time anyway (side-story about talking with a friend about who Megan Mullally was married to while watching Parks and Rec only to have it pop into my feed 30 minutes later, go figure), but I choose that kind of eavesdropping. Why do I need other people that I don't even know in a public space talking to her?
Obviously, this goes on… I don't need Edge listening publicly so that it can be discovered, I'd prefer web apps and widgets not be able to be pulled into a conversation by some stranger, your implementation of the store I find annoying when I'm actually trying to use it let alone someone I don't know trying to talk to it on my computer and cramming some rogue app down my [network] pipe.
And these are just the obvious ones! Flip to the Private profile and all kinds of neat things open up! App installers, Dolby, Sticky Notes, suddenly my computer wants to get jiggy with anybody about anything once we're on a "Private" network. Also, what does "Private" mean, anyway? Does that mean whenever I'm behind some network address translation or something? …because there's a lot of coffee shops, hair salons, airports, train stations, friend's houses (never trust a friend's network), that will show up as "Private" and I promise you I do NOT want my computer being talked to by most of those people.
I'll spare you the speech on the Domain profile. There's SOME reasonability there… but I'm really throwing you a bone on that one.
My point is, here we are again with a reasonably okay product, and you're destroying it for really, really no good reason. The clock?? The clock needs an inbound connection on the Domain profile?? WTF??
It's okay for me… I know how to just go flip the "block everything no matter what" switch (Yes, I have my firewall managed with group policy… I told you I've been a fan)… but most people don't. I might lose the ability for my living room lights to ask my computer to dance, but I'm not really interested in that meeting anyway. I'm fine making my own magic.
The point is, you're breaking it again. You're letting every little thing poke a hole in my security and it's just dumb. We're supposed to have a connection… a relationship… you're supposed to have my back… and I'm just not feeling it. I'm not seeing it. In a trusting relationship, if you can't feel something and you can't see something, is it really even there?
Thanks, Chris M.