Re:Six Dumbest Ideas in Computer Security
by graemep on Monday July 15, 2024 @10:44AM
(#40968318)
The biggest problem I can see with default deny is that it makes if far harder to get uptake for new protocols once you get "we only allow ports 80 and 443 through the firewall".
[ Parent
| on HN ]
Re:Six Dumbest Ideas in Computer Security
by account42 on Tuesday July 16, 2024 @07:24AM
(#40975505)
Wich also makes the security benefit moot as now all malware also knows to use ports 80 and 443.
Yes, I think blocking outgoing connections by port is not the most useful approach, especially for default deny. Blocking incoming makes more sense, and should be default deny with allow for specific ports on specific servers.