Windows Vista's Firewall offers false sense of security

Immediately after launching for the first time, Firefox retrieves a Web page from the Mozilla Web site which confirms our understanding that, by default, applications are not blocked from sending information through the firewall and out to the Internet (outbound blocking would have stopped this). We think this is a bad default behavior and that the way it should behave is that everything should be blocked by default and then allowed on an exception basis.

We went back to the firewall exception list and checked off Firefox to see if that would invoke outbound blocking, but it was to no avail (leading us to believe it the exceptions list must be for inbound blocking).

For David Berlind's write-up on Vista's inadequate personal firewall, see his blog post in ZDNet's TestBed blog.