Hi,
One thing I noticed not working out of the box very well is to have ports open by default that would make sense.
Like the ports used by Steam for local game transfers inside the home network (24070) or the ports used by moonlight/sunshine or even KDE Connect which isn’t accessible without opening the ports for it first.
I can understand the Sunshine/Moonlight ports being an edge case not everyone is using, but the Steam and KDE connect ones are a pretty major bug imho.
Can’t say I agree. Ports should default to being off unless you intentionally make firewall allowances in a purposeful manner.
As I said, I can see this for Sunshine/Moonlight, but for Steam, which probably everybody is using in a “gaming distro”, it’s a feature that’s just not working without any error given. Same for KDE Connect. At least when you choose KDE on install.
I can see your point, but CachyOs tries to be rather user-friendly as well, maybe a button (or several, “Open Ports for Steam Local Transfer” etc.) in Cachy Hello would be a good compromise, rather than googling which ports to open every time.
I could see that, though it still does make me shudder (security wise).
cachy isn’t a gaming distro.
that’s kind of insane. better discovery and presentation of closed ports related to service would be useful.
UFW makes it more difficult than firewalld to open up services in a readonable way by default. e.g. firewalld you can more easily tag your home network and give it different rules than when you connect elsewhere with a laptop - even if that network shares the same subnet etc. as your home net.
If you make it to difficult for “normal" Users, many of them will just disable the Firewall.
And then the Security goes down the drain.
So the idea of being more secure, may lead to less security If you make it to inconvenient.
I think the major thing is just out-of-box security. This is Arch they can load/enable any service they want…on their own dime.
I just don’t see making it ‘easy’ to do so as a selling feature (due to ignorance for one, but maybe it’s not for me to make that judgement). At least if they have to open a terminal and go do some research, they have to take a more active part in it.
if they’re behind NAT at home and just disable it at home that’s better than just opening up a port with UFW.
I appreciate the security focus by having UFW on by default and ports not strictly need closed.
If I want ports open, I will do that myself. I think it is a good thing to need to research it to understand what ports you are opening and closing to the world.
Edit: I look at CachyOS as a “performance based” distro first and “gaming friendly” distro as a bonus.
I was under the assumption that when I install the sunshine package, that the firewall rules would automatically get applied, or that at least some popup would show up that application X tries to bind to port Y and if this port should be allowed by the firewall. This at least to me would be a userfriendly way of handling things. Performance and security focused distro does not have to mean that only nerds knowing every low level feature should be able to use it.
I personally don’t consider myself a noob, but I have no idea what UFW or firewalld are, what their differences are and what not. As a regular user I also should not have to care. Sorry for bringing up Windows now, but even though it also has a firewall (no comment on how good or bad it is), but the DE is at least somewhat guiding you if an application tries to use a certain port, which IMHO is a good user experience.
And I am a 100% with @Einherier - if configuring the firewall is way to complicated and is only getting in the way, I’d rather turn it off.