Zone Alarm 5 Beta Review

An anonymous reader writes "ZoneAlarm is getting ready to announce version 5 of its security software firewall, ZoneAlarm. Though there are a few changes that are presently available on the new beta, this review mentions that there are still many security issues to resolve. Grc.com scan reveals that ZoneAlarm Beta 5 failed to close port 25 and fails to give useful information to the user about possible security services being shut off."

Comments

Wait, do we respect Gibson now?

[WereTiger]

IIRC GRC.com was the haven of a sanctimonious blow-hard, why would anyone go so far as to use tools provided by him as a defacto security test of a new firewall?

Just my 2 cents.

Wonder if Zonealarm has addressed the issue that was brought forth about version 4, which is that it's hook into the tcp/ip stack could be hijacked by malware.

Re:Wait, do we respect Gibson now?

[Captain Splendid]

He might be a little strident, but he's willing to educate and help people. Contrast this with AV and Firewall companies who are simply content to ram their products down your throat.

IMO, we need more guys like him.

Re:Wait, do we respect Gibson now?

[phaze3000]

Wouldn't say this was a troll at all, just a fair comment about a man with a massively over-inflated opinion of his capabilities:

Remember the time he 'invented' TCP SYNcookies six years after they were actually created?. To be fair to him, his SYNcookies proposal wasn't the same as what had already been suggested - his had some pretty major omissions that made it unworkable.

Or the time he predicted the end of the Internet with the introduction of raw sockets into Windows XP, or earlier because of Code Red?

If one is supposed to be doing a firewall test then a *proper* port scanning utility such as the excellent nmap should be used, rather than a tool on the website of a known netkook.

Re:Wait, do we respect Gibson now?

[Spoing]

I've always had respect for Steve Gibson, though I can understand why he gets such flack from technically knowledgeable people.

He is one of those people who you have to adjust for, and if you don't you'll just miss the point of what he's trying to say. Once you do, what he says makes a whole lot of sense and he does not come off as a light-weight tech by any means.

His main focus, for many years, seems to be this;

1. Explain technical issues to moderately technical people so that they do not consider themselves idiots.

2. Hype it up a bit for effect.

   Important: Tell the nit-pickers to #uck off.

The hype rubs many geeks the wrong way since we want to know the real details and with those details we can figure out for ourselves if something is important or not.

When his errors or lack of total completeness is brought up, he drops into #uck off mode. Yep, he is a bit arrogant, though most techies are. He does have an ego and will snipe back if sniped...so?

I have friends who I don't agree with, who do things I don't like, though if it's in character I let it pass; "Jack is being Jack".

Hammer Steve Gibson when he deserves it, though consider that most of the time he's not so horribly off the mark when you consider his audience and basic attitude.

Kerio

[kayen_telva]

I have found that Zone Alarm (in past versions) would sometimes block ALL traffic on a whim.
No explanation from the software, no warning, and damned difficult to figure out what to to correct it.

There were other odd issues that resolved themselves after uninstalling.
I tried Kerio because they took over an awesome product (TinyPF 4) .

I was pleasantly surprised to find that Kerio is the nicest firewall software I have ever used.
Includes pop-up blocking, application level permissions with MD5, and is very configurable. Nice looking (very important to style conscious surfers;). Low resource usage.

ZoneAlarm is gonna have to knock my socks off to get me to switch.

p.s. Has anyone tried TinyPF 5 ?? Im wondering how it compares.

Re:Kerio

[NexusTw1n]

Tiny 5 is excellent. Applications are MD5'd on full path plus file size, it contains a full sandbox mode, as well as registry protection. ("Spyware.exe is trying to write to HKLM.SYSTEM do you want to allow this?")

The application level firewall is completely configurable, you can control which TCP & UDP ports each individual application can use and which it can't.

It can be complicated if you want to dig into it, but the default setup is perfectly acceptable if you just want to install and forget about it.

ZoneAlarm trashed the TCP/IP stack on my home network, preventing Internet Connection Sharing, which is inexcusable. Disabling or uninstalling ZA does not resolve the problem you have to hack the registry and reset the stack (NETSH IP RESET) to recover the damage.

If you google you'll find hundreds of people with hosed machines thanks to ZA. Firewalls and virus scanners are products I do expect to behave 100% reliably and when you lose that trust you are going to have a hard time winning me back. So despite a few quality versions in the early days, ZA have more than likely lost me as a customer for life.

Sky is falling attitude

[bangular]

I wouldn't exactly say what he does is education. Many times he just scares users by taking a security situtation and blowing it out of proportion. For example, the XP raw sockets fiasco, or syn flooding routers with a spoofed source address of the host being attacked. Both of those are problems, but the way he talked about them, he acted like they would bring the internet to a stand still.

Re:This is an example from GRC.com

[LostCluster]

A good example of how Gibson entirely missed the point. Raw Sockets are restricted to Administrator users. The real issue is that XP gives users Admin access by default, not that it has raw sockets.

If he had flamed MS for their poor out-of-box user configuration, he would have had 100% of the techie world behind him.

He is constantly harping on Microsoft's poor-out-of-the-box configuration, it's just the way he goes about it that seems a bit Tabloid-ish.

For example, his tool called "Shoot The Messenger" simply turns the Messenger Service off, which should be its default setting on XP Home since the average user doesn't need it and it only gets used to annoy. By comparison, TechTV hosts just regularly remind people how to turn off the service by going through the Control Panel. Same net result, the same flags in the registry get changed no matter what way you attack it in the GUI.

Instead of calling on Microsoft to make changes, he writes assembly-coded programs to do the changes and convinces people that there's such a gaping hole in their systems that need to be fixed by his magic bullets. For him, security is a side interest... his real business is built around SpinRite, the definitive hard-drive testing tool.

So, really, he's in line with the main stream community in his beliefs on security, it's just that he has an unusual way to promote them which is more aimed at the "dumb public" than the secuirity elite.