Sophos Anti Virus and Firewall

The windows built-in firewall is better (for most uses) than any third-party firewall, because it is relatively simple. Third-party firewalls and "security suites" for windows tend to be so complicated that they have been known to have their own security holes that attackers can use. The also have a tendency to have so many pop-ups to confirm or deny things that users end up clicking "Yes" to everything automatically - or find that their everyday programs no longer work.

No firewall on windows will do the job of a proper external firewall, but assuming you at least have a cheapo NAT router between you and the bad guys, then the Windows built-in firewall is as good as it gets on Windows.

I think the problem for *any* firewall is simply how to set it up. Over the years I have found it easy to set up the Sophos firewall... until now. How would an external firewall be any better and how would it be set up?

The usual setup for an external firewall is that anything inside can go out, anything outside is blocked from getting in. Dead simple, and covers the great majority of what is needed. If you need to let something in, such as to run a server with external access, you open that particular port and direct it to the particular server machine.

An external firewall device does not limit traffic from any particular program - that requires a firewall on the Windows machine itself (the built-in firewall is sufficient, even if the interface is not particularly pretty). But usually you only want to do that if you are running suspicious software (or running legitimate software in a suspicious way, such as to avoid licence checks) - and you would then be better sandboxing the program inside a virtual machine where you have full control and can block all network traffic.

Isn't a browser by definition a "suspect" program? You can't know what a web site is going to do until you visit it.

Use Linux and a browser with no plug-ins and everything turned off.

Then, YOU decide what to "send" to them.

Essentially, you won't be visiting many sites as most will get culled by you once you see what they are scraping.

iPad and Android "apps" are worse criminals in this regard, btw.

And yes, I do feel it should be banned and deemed criminal.

The machine USER should be the ONE person deciding what EXACTLY goes OUT on his pipe(s).

Just like the stupid "fashion industry", smart phones and the web on PCs as well, have made the world utter idiots as we allowed this cookie s*it and java and all the other invasive horseshit IN, and our personal info OUT.

Besides... with the huge amount of data bandwidth we would get back, the NSA would have less to sift through, and what they did look at would be far more pertinent to their cause. Right? (evil grin)