2) red hat and all the other Linux systems don't seem to have a problem with this simple additional step. Ubuntu even built a wrapper to make it easy to configure iptables firewalls (ufw) -- but it isn't enabled by default.
3) Better that maintainers are adding the additional step (that will remain correct) than have each administrator do it (unless needed). That requires maintainers to at least give a passing consideration to security. Without it you set it up and yay it works! No thinking required! No thinking that you may have just left a system wide open to an untested system. I would much prefer an extra step to default insecurity.
Even Microsoft gets the default firewall thing.
That's not something I'd want to see in 'Linux for human beings'. If my mother is going to use it on her desktop, things should just work.
Ubuntu is one of the very few modern operating systems (distributions) that contains this easy to fix security flaw.
Also, you probably wouldn't know if a firewall protected you unless you have a habit of poring over network logs.
Your wifi router definitely has this default configuration which certainly does protect you on a regular basis.
The outgoing exceptions on Windows probably because a Windows machine default deny for both incoming and outgoing which does require exceptions. Windows doesn't phone home for additional exceptions -- it asks you.
The default on Ubuntu should be like all other linux distros where where all unsolicited incoming connections are blocked. Related incoming connections are allowed and outgoing connections are allowed.
This would not require any difficult configuration on the part of the average home user.
It seems to me that most people who are blindly defending Ubuntu's current setup do not understand how networking and firewalls work and the better options. That or they do not understand how wide open the Ubuntu defaults are.
There is certainly a more secure easy to use option that Ubuntu is ignoring, but which all of the other linux distros use by default.
Fair enough. I'd love to learn. What threats does the firewall even defend against?
> The default on Ubuntu should be like all other linux distros where where all unsolicited incoming connections are blocked.
I don't understand why I should care. Evil hackers can send all they want, but the only things listening on my end should be those that I explicitly installed or enabled. The firewall seems redundant as the set of running applications and my set of firewall exceptions should match exactly.
Many Debian/Ubuntu packages have a dependency on postfix. Even some trivial ones. Installing these packages installs postfix (which at least asks you to configure it during install). Having a firewall active means that your grandmother won't have services you didn't realise she had running listening.
Please share with us what magic you have that prevents human error locally, but is defeated by human error in packaging.