A friend and I worked at a major law firm (we have both since left there). He left before I did. About 6 months before he left, the firm decided to do a marketing brochure to show how ethnically diverse we were. They located one of each ethnicity they could find (about 7 lawyers as I recall), and did a photo shoot.

He left voluntarily (was not fired), but I recall that coming in the morning after he left, there was a photocopy picture of the 7 ethnically diverse lawyers at the firm, and he (or someone) had cut himself out of the picture. No note - this was years before email, the web etc.

I thought it a poignant statement, made without words, which of course to my knowledge not a single senior partner understood (or accepted). It would be hard to do that so anonymously today via an email - no one really knew whether he did it or someone else did.

This lawyer today is very, very successful and has a very important position in internet law policy making at the federal level.

The cited article fails to either list the tested firewall software, list the tests performed, or even link to some place where that information is available. It is a statement of the obvious, well known facts that: (i) some software fails to perform even its designed function, and (ii) correctly designed software is often misconfigured to the point where it cannot perform as designed.

The article further makes suggested solutions we have heard a thousand times, nothing new.

To meaningfully talk about security on a the average Joe's winbox, the focus has to come off average joe and be placed on the OS software companies, and on laws and rules (at least in the US) that utterly fail to require any software publisher to be responsible for either designing securable software, or providing adequate notice of the risks associated with installing or using software (or a website). Of course, malware and greyware writers will not follow those requirements ... but if average joe wanders down some dark internet alley without a condom on, its his own fault, whereas when average joe is going to a regular business site or using regular business software, the onus really should be on the publisher to disclose fully the risk, and to provide some tools to allow the user to understand what is going out.

With respect to malware that attaches without user intervention, IMO, all outbound traffic ought to be opt in, not opt out by default on OS install, and turning that off ought to be as hard as cancelling AOL (i.e. next to impossible).

I don't have a sig line, sorry.