Firewalld 1.0 Released With Big Improvements

[sdack]

sdack

"Security does not come from trust.."

Ok, this comment shows clearly you have no idea what you're talking about. Of course, clearly, security at some level relies on trust. Anyone that has taken a basic course in software security at University knows this. Do you inspect the source code of the version of ssh you currently have installed before using it? Do you inspect the source code of the version of nftables you have installed before using it? If not, you are in fact relying on "trust".

And yet does security not come from trust. Security comes from control.

Take traffic lights as an example. Do you believe traffic security comes from people trusting the lights? I hope not. Security comes from control and taking action against those who break the traffic rules. This is the control we use to ensure that people follow the traffic lights. In countries where i.e. jaywalking goes unpunished do many people in fact ignore the traffic lights. People will run across streets and ignore red pedestrian lights like it was a national sport. This should tell you that control does not come from people trusting in the lights, but it comes from people knowing that they get punished when they ignore them.

It is simply wrong to assume trust would create security. If anything is it distrust that leads to security. If we could create absolute security would we not need trust, but we would have certainty instead. And only because we cannot create absolute security do we trust that in the absence of absolutely security would we still have enough relative security to keep us safe. This is what trust is. Trust is not a replacement for security.

[tomas]

sdack

"Security does not come from trust.."

Ok, this comment shows clearly you have no idea what you're talking about. Of course, clearly, security at some level relies on trust. Anyone that has taken a basic course in software security at University knows this. Do you inspect the source code of the version of ssh you currently have installed before using it? Do you inspect the source code of the version of nftables you have installed before using it? If not, you are in fact relying on "trust".

[sdack]

nobody uses assembly to implement algorithms.

So you have never seen video, audio and cryptography algorithms being implemented in assembly? Really?! Come on ...

[sdack]

not true. one can use gui or just leave it up to apps which will work without user supervision
if nftables alredy were doing what is needed, firewalld would have nothing to do

When you are using a GUI or another app then you are not really using firewalld. Or, when you do want to say so, then you also have to say you are using nftables, because firewalld is based on nftables. You cannot ride half a horse and pretend the other half had nothing to do with you.

[pal666]

especially where performance is needed are algorithms implemented in assembly instructions. It is one of the few domains where assembly programming has always ruled over compilers.

nobody uses assembly to implement algorithms. std::sort is an agorithm and it's implemented in c++ templates because that's the only way which can be optimized by compiler on the scale of full application. what you are thinking about is using special assembly instructions for codecs, it's tiny niche

[pal666]

Indeed. One has to learn about firewalld's command options and its syntax before one can use it

not true. one can use gui or just leave it up to apps which will work without user supervision

and it requires to have a good understanding of networking and how it is handled within the kernel. So for a lot of people is it indeed better to use nftables directly when it already does what they need.

if nftables alredy were doing what is needed, firewalld would have nothing to do

[pal666]

The difference is, working with nftables is not so hard.

what makes you think working with assembly is hard?

[pal666]

Wouldn't it be better to just learn how to manage nftables than learn how to manage a service that manages nftables?

you can learn both. then you'll know what benefits firewalld brings

[sdack]

It never was, and I never said that. ... A well-designed system will accomodate various levels of trust and thus various levels of security. ...

You are doing it again. You say trust was no replacement for security but you keep arguing like it was.

Security does not come from trust. Security comes from control. Without control do you have no power and trust is merely the first thing that you will lose. Trust is also not useful for starting a discussion on security, only distrust is. Trust is the fallout of good security, but also a weak substitute for not having absolute security. If there was absolute security then there would be no need for trust.

[sdack]

I stopped reading right here. Talking to you isn't worth my time anymore. Go insult someone else.

To you all I write is some form of hair splitting. You deliberately ignore the details just so you can continue to flaunt your ignorance. Why have respect for you? You deserve to be insulted and your response shows that it hit you where it needed to hit you: in your ego. Come back when you are down from your ego trip and are actually willing to talk.