Hardware Firewall On a USB Key

An anonymous reader writes "An Israeli startup has squeezed a complete hardware firewall into a USB key. The 'Yoggie Pico' from Yoggie Systems runs Linux 2.6 along with 13 security applications on a 520MHz PXA270, an Intel processor typically used in high-end smartphones. The Pico works in conjunction with Windows XP or Vista drivers that hijack traffic at network layers 2-3, below the TCP/IP stack, and route it to USB, where the Yoggie analyzes and filters traffic at close-to-100Mbps wireline speeds. The device will hit big-box retailers in the US this month at a price of $180." Linux and Mac drivers are planned, according to the article.

Comments

Not really a hardware firewall

[dreamchaser]

A true hardware firewall wouldn't have to hijack traffic via a driver. It would have it's own ethernet port and would inspect data before it even touches the network stack on the host OS.

A bit hyped up if you ask me.

Re:Not really a hardware firewall

[nine-times]

Yeah, that was my thought. If you're plugging the ethernet into your computer and relying on software to route traffic to this device in the first place, how is this better than software firewalls?

Re:Not really a hardware firewall

[Dancindan84]

Agreed. The way it does it would, I believe (and I -know- I'll get corrected if I'm wrong), still leave your system vulnerable to attacks that affect layer 2. The traffic has to reach your network card before it can be routed to the key.

Re:Not really a hardware firewall

[bobo mahoney]

It might not offer better protection than a software firewall, but it will offload the work to it's own processor freeing up cycles on your computer. If you are pushing your machine this could be a fairly inexpensive way to squeeze a little more life out of an older /underpowered box.

Re:Not really a hardware firewall

[TheRaven64]

Why not just put an ethernet controller into it, and use it as a USB network adaptor?

Re:Not really a hardware firewall

[larkost]

Except that all of your traffic is now going over your USB port twice... and the USB port is your most processor-intensive I/O. I have no idea how the numbers will work out... but there is a good chance that this will eat a lot of processor time.

Re:Not really a hardware firewall

[MattskEE]

That is why Yoggie also offers the Gatekeeper, which does exactly what you want.

The new device was created because a USB interface is less cumbersome and less expensive, while still offering a similar feature set and only somewhat reduced security.

Re:Not really a hardware firewall

[kasperd]

Why not just put an ethernet controller into it, and use it as a USB network adaptor?

I think that is exactly the point the grandparent was trying to make. If it had an actual ethernet interface you would only have to transfer the packets over the USB interface once, thus you'd reduce the load on the machine. You'd also get better security since the machine would no longer be connected to the network without going through the firewall. You'd avoid hacking the network stack, and the result would be something working on more systems without the need for special drivers. And you'd free up the ethernet port on the machine, so it could also be used in situations where the machine did not have exactly as many ethernet connections as you'd want. Basically adding a real ethernet interface to this gadget would have increased its value by at least a factor of two.

Re:Not really a hardware firewall

[LWATCDR]

It does. If you look at the device it has an Ethernet port on one end and a USB on the other. The driver is probably makes it look like USB network adapter plus allows for configuring the firewall.
I see this as being handy for anyone that plugs into foreign networks like at some Hotels. Good little road warrior tool.

Re:Not really a hardware firewall

[dmsuperman]

Or just spend the $180 on a better processor. Look, better performance, and far better than the USB key provides.

Re:Not really a hardware firewall

[ehrichweiss]

Are you talking about the Pico or the Gatekeeper? I don't see an RJ45 on the Pico at all. The presence of one would make a lot more sense than relying on the host computer's enet to handle the WAN traffic as well.

Re:Not really a hardware firewall

[PAjamian]

I don't see an Ethernet port on it. Where are you looking?

Re:Not really a hardware firewall

[hattig]

This is a USB version of their already existing ethernet based products.

However this product works with all types of connection on the computer - modem, wireless, ethernet, GPRS, and so on, anything that TCP/IP runs over.

It's also dead useful when you have a laptop user that you really don't want to get compromised on their travels. Stick this in their machine, and you'll be doing a lot more to secure the traffic into and out of their system. So whilst you think it is hyped up, I'm thinking it is small enough and powerful enough to be of serious real world use for mobile users.

Re:Not really a hardware firewall

[Anonymous Coward]

Wi-Fi

Re:Not really a hardware firewall

[hattig]

Basically adding a real ethernet interface to this gadget would have increased its value by at least a factor of two.

and useless when the laptop user connects to the internet via their GPRS card, or their Bluetooth enabled phone, or via wireless ...

This device works with all of them, it could only be better if they made it in an ExpressCard format, which I'm sure is in their plans.

Re:Not really a hardware firewall

[cheater512]

Plus it works on *everything*, not only wired networks.

Re:Not really a hardware firewall

[Anonymous Coward]

Most processor intense? I don't suppose you haven't tried printing photos on a parallel-connected printer lately, eh? It's a real harkening back to the good ol' i486 days. :~)

Re:Not really a hardware firewall

[yahooadam]

exactly what i was thinking

the packets have already been introduced into your PC by the time their routed, which leaves you open to an attack

i wouldn't exactly call this a "hardware" firewall - yes the USB key does the processing, but it requires the PC and software to transfer the network data to the USB key, whats the difference between routing it to hardware, or routing it to your process ? except now you have an added layer of crap in the way

And for reference, you can install an "entire" firewall on a USB stick, there are many Linux firewalls - IPCop, Smoothwall ... etc - although it requires a little work to get them on USB sticks, its not impossible, and then you actually have a true hardware Linux firewall

Re:Not really a hardware firewall

[LWATCDR]

your right. I read the diagram wrong. Two bad they could do it the way I described.

Re:Not really a hardware firewall

[TheRaven64]

USB WiFi and bluetooth interfaces are under $20. I'm fairly sure they could have put wired, 802.11, and Bluetooth on the device without increasing its price by more than 10%, and they would have dramatically increased its usefulness.

Re:Not really a hardware firewall

[Anonymous Coward]

Then use a light VM and filter the packets within it. No hardware access, good enough security and no gadgets needed.
Oops.. I forgot that the product is for windows, then it's obvious that the hardware is more of a dongle to prevent pirates to copy the software than a firewall itself.

Re:Not really a hardware firewall

[Anonymous Coward]

...but does this newfangled usb-key offer Intrusion Perversion like the Gatekeeper ?

Re:Not really a hardware firewall

[smart_ass]

Anyone even RTFA ...
They had a previous with ethernet ports. This thing is a (FORWARD-thinking) change from this to reduce physical size.
For a large percentage of the real world, having drivers that allow it to work on Windows only is sufficient.

Re:Not really a hardware firewall

[bitserf]

I suggest reading the article - Their first iteration did *exactly* that.

Re:Not really a hardware firewall

[larytet]

i also wonder how they transfer 100 Mbits/s full duplex over USB (2.0 i guess) and still have reasonable performance on the host CPU. Even 20-50 Mbits/s WiFi dongle can degrade overall system performance quite meaningfully

Another problem I see is declared Linux performance running on the ARM (core of the Intel PXA family). In my measurements of performance of netfilter on 200MHz CPU i could not break 10Mbits/s. Do they have integrated network processor to accelerate packet forwarding ? Let's do some calculations. Assuming 64 bytes packets (line rate) we should handle approximately 200K packets/s or a packet every 5 micro. The system running at 500MHz executes an opcode (from cache) every 2 nano. We have approximately 2K opcodes locked in the cache to do the job of TCP/IP filtering, state full NAT and firewall and so on. Sounds like solvable, but far from trivial problem.

Re:Not really a hardware firewall

[dreamchaser]

I read it before I posted at all, thank you. Your are correct about their *older* product, but this discussion about their *new* product. It's a step backwards and I still maintain it's overhyped overpriced garbage that nobody really needs.

Re:Not really a hardware firewall

[pete.com]

I thought of Nigel from Spinal Tap.

Nigel, if you're plugging the ethernet into your computer and relying on software to route traffic to this device in the first place, how is this better than software firewalls?

Nigel - "It plugs into the USB port so it is a hardware firewall"

"Yes but the only reason it works is software."

".... but its hardware..."

Re:Not really a hardware firewall

[SST]

Hi Pete: some light to shed on why Yoggie provides more security: First, it is routing the traffic to Yoggie *before* it leaves the Windows NDIS, meaning before it gets to TCP/IP (see my posting 20 minutes ago with details). The traffic is rerouted to Yoggie on USB 2.0 (up to 480Mbps) with effective 425Mbps. Yoggie is the computer that handling the security by running: Firewall, NAT (yes - it hides the IP address of the external world from the internal - something *no software firewall is doing or capable doing*), hides IP and MAC, DHCP, running SNORT (with VRT soon and with IPS active!!!), runs 4 proxies (HTTP, FTP, SMTP and POP3), unzipping compressed files!, and send atom files to Anti Virus, Anti Spyware, Anti SPAM and Phishing (having one "leg" on HTTP and one on SMTP.POP3 allows unique capabilities here), URL Cat and parental control (using SurfControl) Layer 8 security (see my posting 35 mins ago) and unique MLA (i will post later details on this unique module). Now the clean and screened content returns to NDIS. Should hacker try to attack your PC, the attack lands on Yoggie PICO and not on your PC! Why the Yoggie don't care much - as it has a special shield that other PC don't have: To stop the Pico itself becoming infected, the operating system is contained on two Flash memories. Flash A contains the operating system. When the device is booted, a clean copy of the operating system is transferred to Flash B, and access to Flash A is disabled. The security applications then run on Flash B, which is wiped when the device is turned off. If you have any more questions, please ask, Cheers.

Re:Not really a hardware firewall

[Anonymous Coward]

Or you could just run Linux or *BSD on your PC and forget about lame attacks and trojans that can only infect the obsolete, useless and incompatible Microsoft Piece of Shit system.

Glass

Why?

[csnydermvpsoft]

As another poster has suggested, this isn't truly a hardware firewall - it hijacks the network traffic from the host OS, after all. Since the network traffic is already in the network stack, how is this any better than a software firewall? Software firewalls are hardly performance hogs.

Re:Why?

[rickkas7]

Software firewalls are hardly performance hogs.

You've obviously never used Norton Internet Security 2007 or McAfee Internet Security Suite 2007.

Re:Why?

[jafiwam]

There is a niche for this tool, but it is a small one and not one that will pay $180 for this thing.

For example, I run no firewalls whatsoever on my home network, instead relying on my NAT router to keep inbound traffic out, and configuration / backups to keep risk to acceptable levels elsewhere.

Taking a laptop to a cafe or hotel or something, or a gaming machine to a LAN party means I'd have to muck around with a Firewall before (or just go without) going.

So I would use this thing there. But, probably not pay $180 for it.

I don't get why they would use USB. Why not an ethernet USB combination? (Where it is a network card too.) You still need to install a driver anyway for it to work, so why not a USB driver for a network card with a little firewall in it?

Maybe the hardware is just that expensive... I see little point in the size though. Why not make it like a small USB hub size and charge less. Or better yet just take an ordinary router and miniaturize with USB power supply over regular ethernet or something... Taking all the configuration options of a Linksys home router with a firewall built in a small USB package and I would pay $180 for that in a hearbeat.

Re:Why?

[Terrasque]

Comparing those products to a firewall?

That's like comparing a normal handgun to an ED-209 on a rampage.

Re:Why?

[VagaStorm]

It's not mainly the fire wall in those that chugs em down....

Re:Why?

[Deadplant]

of course I haven't...
jeez, why would do something like that to myself?

Re:Why?

[rapidweather]

Those programs come with Dell Vista computers, usually with a 30 day trial, or one can go ahead and order the PC with a year or so of "coverage". You pay upfront, then pay Per PC for continued protection. And yes, there is a performance hit, but in the day of dual core processors, 2 GB of RAM, one may not notice. My Knoppix-based linux (see screenshots, below) uses the Guarddog firewall, preconfigured and enabled by default. The user does not have to start up the Guarddog interface, and switch the firewall on, it's already working by the time the desktop appears. No annual fee or cost. Not much of a problem with viruses on a livecd linux. We have two different avenues of protection here, the "firewalls" and the "virus scanners". Back to the Vista computers, I have this question: "Are the owners of these boxes going to keep their Norton or McAfee subscriptions in force?" Microsoft's answer to this problem is to make Vista more secure, even more so than XP (in comparison to older versions of Windows). If Vista is secure, then why do Vista computers need Norton or McAfee?

Re:Why?

[Anonymous Coward]

Software firewalls are hardly performance hogs.

You've obviously never used Norton Internet Security 2007 or McAfee Internet Security Suite 2007.

That's why I use iptables :P

Re:Why?

[Anonymous Coward]

True, but if you RTFA (or even just the OP), you'll note that this USB key incldes 13 different applications, including anti-virus and such. That's why Norton is a hog, and that's why this will not be much better.

Re:Why?

[Quasar1999]

He said software firewalls, not protection from viruses, data-loss and identity theft and a firewall. The McAfee firewall for instance uses around 4mb of memory and barely registers for CPU load, the whole suite however is obviously larger. Norton's is harder to isolate since it's more tightly bundled with all their other 'services'. Heck even the Vista advanced firewall isn't resource intense...

Re:Why?

[Anonymous Coward]

For user error, and software exploits that Microsoft has no control over. There's an awful lot of people who really will open everything they get in the email, and there are often holes found in software that doesn't get automatically updated. The virus scanner gets updated at least daily, while that little update icon for Java can sit in the corner for months before somebody actually clicks on it.

Still, I wouldn't say they specifically need Norton or McAfee, though - they're more likely to cause more problems than prevent. It's just a generally good idea for most folks to use a virus scanner when they run Windows.

Re:Why?

[larytet]

before switching to Linux about two years ago I used Kerio firewall on Windows and I did not experience performance issues. But Kerio is just a firewall. Norton and McAfee are both antivirus software with enterprise oriented features. They indeed slow the system down to the point when the box is not usable anymore. In the co i work now they use NOD32 (firewall and antivirus ?) to protect Windows desktops. May be this one is better.

Re:Why?

[haus]

I too am a little unclear as to what the advantage of this would be. It does not seem to be a hardware firewall, but a software firewall running (somewhat) independently from your computer.

Personally I prefer my set up where I normally run behind my ASUS WL-500g, that is running PacketProtector, which is a handy one stop shop for Linux (OpenWRT) and a suite of security tools (firewall, VPN, IPS, AV and more), plus given that it is running Linux, if there is something else that you want or need you can run other Linux applications to meet those needs, or if you are more adventurous, build your own...

What?

[Anonymous Coward]

From the brief I have no idea what this is talking about. How am I supposed to know if I even want to RTFA?

odd

[otacon]

Did anyone else find it odd that it runs linux, but doesn't actually work with a linux box, but only with a windows one?

Re:odd

[BosstonesOwn]

Odd or ironic ?

I find it Ironic personally that the linux device can easily hijack packets from a windows stack but the driver to hijack the traffic from the mac or linux boxes are still not ready.

The true question at this point is who can't steal hijack packets from a windows box.

Re:odd

[Josiah_Bradley]

If it's running Linux then you can probably get the same apps it's running and install them on your Linux machine. And if your already running Linux you probably don't need a firewall for windows anyway...

Re:odd

[zappepcs]

Apparently just about anyone... ergo the need for such a device? :-/

Re:odd

[jcgf]

It's not as odd as you think. There have been several routers and such which either require you run a config program on a windows box or access them using a browser which had to be IE, despite the router itself running Linux.

Re:odd

[fohat]

oops, here. You dropped your tin-foil hat on the way to making that comment. Why buy anything from anywhere that has a government that might do questionable things? Doesn't all government do questionable things?

Re:odd

[towsonu2003]

The true question at this point is who can't steal hijack packets from a windows box.

Or, whether the linux kernel developers will (correctly) perceive the driver for Linux as a bug in the kernel and fix it.

Re:odd

[Anonymous Coward]

Propably because you would need *BSD if you really wanted greater protection than you allready have in Linux...

Re:odd

[Deadplant]

Perhaps, but the US, Israel, Russia and China together manage to do a startling amount of shady shit.
Their efforts really do put the rest of the world to shame (er, maybe i mean the opposite of that)

That being said; the fact that this product was developed in Israel is not a reason to avoid it.
*That* being said; the fact that this security product relies on closed-source binary drivers and runs on XP *IS* a reason to avoid it.

I would trust this product about as much I would trust Norton or Mcafee.

Re:odd

[RealGrouchy]

Did anyone else find it odd that it runs linux, but doesn't actually work with a linux box, but only with a windows one? Maybe the programmers didn't have enough experience with Linux or Mac viruses?

- RG>

Re:odd

[Ant P.]

Not odd at all. Windows is the only desktop OS in use today that needs a device like this.

Re:odd

[Anonymous Coward]

Who's talking about the government? Israel is a fanatical 'state'. Anyone who lives in Israel is suspicious as far as I'm concerned - tech businesses doubly so.

Why would I want this?

[morgan_greywolf]

I mean, increasingly, firewalls are being combined into multipurpose devices that provide NAT, Web serving, DMZ, VPN, media streaming, wireless access, etc. I mean even the lowly Linksys WRT54G, available for ~$50 USD almost anywhere, supports VPN, provides NAT, DMZ, UPnP capabilities, rudimentary web filtering, and has a built-in wireless access point. I mean, this thing doesn't even support wireless, which would make it useful for laptops, etc.

IOW, someone tell me why I should care?

Re:Why would I want this?

[toleraen]

Because you can plug it into your laptop if you're at a local hotspot? Think mobility + offloading processing. Not exactly the most useful of devices, but for someone who's constantly at the mercy of free/public wifi it could be convenient.

Re:Why would I want this?

[richardtallent]

Just like software firewalls, this is just snake oil for feeble-minded people who don't realize that firewalls are for blocking access *between* networks, not for closing ports that shouldn't be open in the first place on individual machines.

Re:Why would I want this?

[dreamchaser]

A software firewall is more than enough for those situations. Heck, for half that price you could buy a little router and carry it with you! I'm being a bit facetious here, but I really don't see a good niche for this product as you can tell from my previous posts in this thread.

Re:Why would I want this?

[fishybell]

According to their nifty flowchart it supports whatever windows supports. It takes the inbound traffic after the hardware receives it, but before the TCP/IP stack. It sits in the same place as a software firewall, but offloads the calculations and filtering to the dongle's cpu.

Why would anyone want this? Well, a router that combines firewall, nat, vpn, etc. is fine for home use, but what about the coffee shop? For a mobile computer having a on-computer firewall is a must. As far as why anybody would choose to use this over any software firewall... I can only assume it's for people who don't want yet another piece of software hogging their cpu. Most software firewalls aren't that intensive, but if you're looking to free up that 3-5% of your resources, hardware is the way to do it. Of course, without a benchmark showing a difference, the actual performance increase is lost in the market speak.

Re:Why would I want this?

[Vicegrip]

I suspect the main appeal would be for laptop owners on public networks where they don't own the router or control them-- rather than just trust their Windows firewall to protect them. It'd be like having your own private router protecting your laptop on a public network. Not be a bad idea.

The device has sex appeal in terms of form factor accomplishments. But the OS level filter driver requirement turns me off.
A device like this needs to be totally independent of the OS to be attractive.

I won't be buying this product.

Re:Why would I want this?

[StarfishOne]

My laptop IS a local hot spot! ;XD

(sorry, could not resist)

Re:Why would I want this?

[Odiumjunkie]

If anyone is looking for a free (as in beer) software firewall for Windows with a very small footprint, Ghostwall is a great choice for the not-afraid-of-configuration. The setup file is less than a MiB.

Re:Why would I want this?

[leather_helmet]

For a mobile computer having a on-computer firewall is a must...

Very much agreed - At first glance I dismissed the product but then realized that it would be great for the laptop that I am typing away on now. Yes, there are software solutions etc. but having a dongle that I can take from one machine to another would be awesome - Potentially I no longer have to install firewalls on each and every computer that I use

Re:Why would I want this?

[Kam Solusar]

Heck, for half that price you could buy a little router and carry it with you! And in many parts of the world you could even get a little guy to carry it for you too!

Re:Why would I want this?

[morgan_greywolf]

But it uses software to re-direct Layer 2/3 to the dongle. Which means basically makes it a software firewall.

Re:Why would I want this?

[racermd]

You should have returned your Sony laptop battery when it was still a part of the recall, then.

(I'm wearing my asbestos underwear for this)

Re:Why would I want this?

[jimicus]

You ever tried closing everything on a Windows machine then making the machine vaguely useful in real-world scenarios?

It's not just Unix software which is guilty of gratuitously using the TCP/IP stack for IPC.

Re:Why would I want this?

[slamb]

Why would anyone want this? Well, a router that combines firewall, nat, vpn, etc. is fine for home use, but what about the coffee shop? For a mobile computer having a on-computer firewall is a must. As far as why anybody would choose to use this over any software firewall... I can only assume it's for people who don't want yet another piece of software hogging their cpu. Most software firewalls aren't that intensive, but if you're looking to free up that 3-5% of your resources, hardware is the way to do it. Of course, without a benchmark showing a difference, the actual performance increase is lost in the market speak.

In a coffee shop, you're going to be transferring stuff exclusively over their crappy (maybe 512 kbps) Internet connection. I would be shocked if any software firewall were so inefficient as to take more than 1% CPU in that situation on a modern machine. Even the device's maximum speed (100 Mbps) isn't that intensive (I use gigabit Ethernet), and firewalling's not the most CPU-intensive part of networking unless most of your inbound packets are getting dropped by the firewall.

leather_helmet suggested another reason:

Yes, there are software solutions etc. but having a dongle that I can take from one machine to another would be awesome - Potentially I no longer have to install firewalls on each and every computer that I use

Well, that's not true either. You need to install the driver for this machine onto each machine or it does nothing. That differentiates it from their earlier product, which actually had a pair of Ethernet ports - no driver required. (No wireless support, though.)

This device is useless:

• mobile/coffee shop use - it costs $180 instead of $0, can save maybe 1% CPU, is no more secure than a software firewall, and is less convenient (driver setup, custom configuration software, and physically you have to keep plugging the dongle in every time you pull your laptop out of the case)
• fixed use - costs $180 instead of $40 for a much more capable dedicated machine, not as convenient (driver setup - ergh)

Re:Why would I want this?

[slamb]

In a coffee shop, you're going to be transferring stuff exclusively over their crappy (maybe 512 kbps) Internet connection. I would be shocked if any software firewall were so inefficient as to take more than 1% CPU in that situation on a modern machine

Somehow I missed the middle of the article. They don't just do the normal firewall things - they also do a bunch of higher-level things (snort, HTTP antivirus proxy, etc.) which are more CPU-intensive. So I guess it might save significant CPU usage over doing this on the host processor. It's debatable whether it's worth doing on any processor...

Re:Why would I want this?

[Vellmont]

this is just snake oil for feeble-minded people who don't realize that firewalls are for blocking access *between* networks not for closing ports that shouldn't be open in the first place on individual machines.

I guess I'm "feeble-minded" because I believe security should at best be layered, and also realize that protecting the inside of a network is important as well. Maybe you never thought that firewalls can restrict port access to only certain IP addresses that simply closing a port wouldn't allow?

There's nothing wrong with the concept of software firewalls. I use the built in ones on linux all the time. The problem with software firewalls is more the implementation. I'd never install McAffee or some other crappy 3rd party firewall on one of my Windows machines. It causes more problems than it solves.

Re:Why would I want this?

[StikyPad]

Ghostwall doesn't do application control, which is the only particular purpose I have for a software firewall.

Re:Why would I want this?

[Crackez]

A) It's a tiny computer running Linux. Rock on.

2. Drivers will be out for other OS's

III- How much you want to bet they use the TUN/TAP driver on there?

So, if I get this right they have a small boot flash of some sort, RAM, and a processor, powered by a USB port, and able to perform IO over this bus. What would be really cool would be to hook this up to a powered USB hub, add USB peripherals, and build a custom appliance...

Re:Why would I want this?

[morgan_greywolf]

That's the best response I've seen so far! Bravo! A generic Linux box that one could turn into almost anything... hmmm...

Re:Why would I want this?

[radicalnerd]

Forget the WRT54G. Even the lowly Etherkiller does a better job. Sure, it doesn't provide NAT, DMZ, VPN, port forwarding, or even wireless card support, but once you plug one of these babies into your Ethernet card, it will "physically keep threats away from your PC"... at a fraction of the cost! You don't even need to keep it plugged in!

Re:Why would I want this?

[mysidia]

In terms of I/O it is potentially worse than a software firewall.

Imagine your NIC receives a packet stream related to a large file download. If you have a software firewall, what happens is your OS decodes the packets, and data is filtered through the software firewall to make an acceptance decision, then if the packet is not dropped, straight to your application memory. No data needs to pass through your USB or PCI bus a second time.

If you use this USB firewall device -- the data must pass the data bus a second time after you receive it from the network, to go out to the USB device for acceptance. There will be a tiny delay overhead incurred as the device decodes, processes the stream -- then, presumably, the accepted are re-encoded by the device and must go back through the USB bus again to finally be delivered to the windows TCP/IP stack.

Now there will potentially be a bottleneck, especially if you utilize other high-speed USB devices. Imagine you want to download a 10GB file from a FTP server onto an external hard drive.

The excessive consumption of I/O time on the USB bus may degrade network performance to the point where you can't even get close to 100 megabits per second transfer rate, even using gigabit ethernet.

But truth be told, i'm more concerned about the vulnerability of a USB dongle. The thing can accidentally be unplugged or knocked out of the port too easily, either disconnecting you unexpectedly or leaving you wide open (both are bad)

Re:Why would I want this?

[larytet]

i never see anything above 0% when running software firewall. I think that the main catch is their dual FLASH system. They copy Linux image from read only FLASH to another one where Linux actually runs from. I am not sure about CPU performance savings, because they still need additional driver and USB 2.0 does not come cheap either.

They potentially can sell their chip to the producers of mother boards or even to the chip makers. But again small on board network processor and patch in TCP/IP will do the trick just the same and probably for less money

Not too bad

[NickisGod.com]

My favorite is the "Layer-8" security engine (Patent pending).

That's where all of my clients' problems come from.

-Nick

Re:Not too bad

[Tuoqui]

Oh Yeah! Well I patent Layer-42 ultra security engine! (Patent Pending).

Layer-42 is available under GPLv3.

Re:Not too bad

[Bill Dog]

GP is referring to the "peripheral in front of the computer", the user, as the new last/top-most layer of the "network stack", where probably the greatest number of security vulnerabilities in network applications are based.

Re:Not too bad

[sec-minded]

Patent Pending?!? Since I started in IT, "Layer-8" has been the "Political Layer" and "Layer-9" is the "Financial Layer". Everyone knows that. Patent pending. Noobs.

Re:Not too bad

[GiMP]

You're probably joking, but there is actually an ISP of that name... I suspect the 42 in their name comes from 42U racks, or maybe just the HHGTG.

100Mbps on USB?

[cravey]

I keep wondering how they put such a fast processor on a usb stick and then squirt bidirectional 100Mbps over the USB port. Sounds a lot like my former boss trying to convince me that our building would give us 100Mbps internet for only $50/month. I dislike misleading articles and I dislike misleading product descriptions even more.

It seems much more likely that there's an app on the USB stick tht is run by the windows machine making the USB stick just a different delivery mechanism than a CD/DVD. Probably way cheaper to produce, update and ship.

Re:100Mbps on USB?

[Anonymous Coward]

They don't need to filter and route 100Mbps through the device, the driver hooks into the Windows IP stack. That's the point. For most filtering operations I doubt they're sending more than the TCP/UDP header (or maybe just a few particular fields) to the software on the device and offloading the filtering/decision making to that hardware.

Re:100Mbps on USB?

[weeb0]

Do you know the Gumstix http://www.gumstix.com/ they are embedded linux platform which run on that pxa270. With 64mb of ram and I can't remember the flash size, it's smaller than a juicy fruit stix...

Re:100Mbps on USB?

[pyrrhonist]

Do you know the Gumstix http://www.gumstix.com/ they are embedded linux platform which run on that pxa270. With 64mb of ram and I can't remember the flash size, it's smaller than a juicy fruit stix...

But does the taste move you when you pop it in your mouth? It's just not the same unless the taste - the taste - the taste - the taste is gonna move ya.

Marketing Gimmick

[dreamchaser]

It's a marketing gimmick. At the very best it's a software firewall with a (not really needed) co-processor to do packet inspection.

Personally it looks like a waste of money to me.

Re:Marketing Gimmick

[DaveWick79]

Exactly. Why would you be stupid enough to spend $180 on this, when $50 buys you a decent hardware firewall. And it has to hijack your driver stack to do it. At least when you have problems with software firewalls you can disable them or uninstall them - if this driver got messed up you'd be screwed.

Re:Marketing Gimmick

[Anonymous Coward]

Looks like it's been done before and posted online for everyone's perusal:

http://seniord.ece.iastate.edu/may0710/index.shtml

from the article

[MarcoAtWork]

Once running, the Pico establishes an SSL (secure sockets layer) http connection to Yoggie's central servers, where it checks for updated firewall policies and rule sets, Touboul said. It subsequently checks every every five minutes, by default.

so basically this means allowing a black box to hijack completely my IP stack, a black box which phones home every 5 minute and arbitrarily downloads software updates... just think if this company's server was compromised even for an hour, given that all of the devices update every 5 minutes you could compromise pretty much all of them at the same time.

Not to mention that if this device can insert a 'low level driver' that hijacks the IP stack, I'm sure a virus will come up sooner or later that will re-hijack this and compromise it. The only really 'safe' hardware firewall is, guess what, a completely separate hardware firewall (like my custom LEAF install on my old p3-500), this sounds like those 'one time pad, guaranteed!' crypto products we often lambast here on /.

Re:from the article

[Anonymous Coward]

I recall reading about this a year or so ago. This same company was trying to get PC manufacturers to build this product into laptops, desktops etc. Obviously, these companies said - no fucking way, it's added cost would be passed to the consumer, and frankly it's not needed.
The tin foil hat wearing part of me, also really distrusts an israeli (err mossad) company usurping my network stack.

Re:from the article

[racermd]

I hate to nit-pick (okay, I love it, really) but the only 'safe' hardware firewall is to have absolutely no connection at all. Better yet, turn the computer off. That's the only way to be sure.

And, in all seriousness, there may very well be unforseen vulnerabilities in the device in question. However, that's certainly no reason to write it off as a completely useless product. Like everything else relating to security, the question is one of balance. More specifically, how to balance access to those that should have it while denying those that shouldn't. Many factors contribute to that equation. Knowing that, this software firewall on steroids sounds like it has promise if implemented correctly and/or slightly differently. I'd need to evaluate the product before I can determine if and how I'd want to use it. For $180, I'll probably pass, though.

Personally, I don't like software firewalls all that much for a number of reasons. Mostly, it's that I don't trust a program to protect the computer it's running on, especially any Windows computer. There's a reason that programs run at a higher level than the OS and other components, and a software firewall is really a hack into that lower level. If that program is compromised, how can I trust anything it does?

It is my opinion that all network ports should have their own lightweight firewall built-in. I haven't researched such a product so it may already exist. It would be better if embedded network interfaces had this sort of functionality as a requirement. At a minimum, all laptops should have an embedded firewall independent of the host OS for each network connection offered. All wireless cards - PCI, PCIe, PC-Card, Cardbus, ExpressCard, etc - should have it, as well. Note that the requirement is that it be turned on by default, just that it be made available.

Given the choice, I'd run an external, independent firewall first. Then, if that weren't an option (such as roaming about), I'd have to pick a software firewall of some type. If the network environment is overly hostile, I'll just go without that connection. When I go to LAN parties and such, I typically re-load my OS of choice and protect it the best I can knowing I can blow it all away when I get home. When hosting a LAN party, I have an alternate network segment off my firewall to run on and treat it as if I were on someone else's LAN.

Re:from the article

[the_fat_kid]

No, no, no, no, no. I don't think that I'm ready to sign up for a free 90 day trial of Sky-Net.
The idea of a firewall that calls "home" every 5 min. is just plain crackers. And one that "inserts" it's self into a low level of any part of my OS?
Give me a true hardware firewall some where down the stream of ether-net, thank you.

Re:from the article

[Anonymous Coward]

The Killer nick is what you want, its a bassicaly this product, but pci. Not only will it offload the tcp/ip stck but it also does firewall, torrents, and other things.

Re:from the article

[GiMP]

Software firewalls have an edge on hardware firewalls in that they can filter according to users and executables on the system. This can go hand in hand with system ACLs.

For instance, you can prevent the 'bind' user, as well as the named binary from accessing port 25, which would prevent a hole in bind from allowing emails to be sent. With hardware-only solutions, to provide this level of security, you would need to setup a separate machine on its own network segment and subnet, running bind, and then block destination traffic to port 25 originating from its IP address.

In comparison, your hardware only solution has just required another machine, which will require additional maintenance and a more complicated/advanced network architecture. What if you wanted to provide this same level of segmentation on a single machine, or more importantly, your laptop? Do you see why software firewalls are useful yet? Of course, hardware firewalls have their place too, for instance, when you have a large number of machines to protect and the network segmentation and segmenting are minor factors.

This product is interesting because it combines a hardware firewall with a software firewall, as well as including some additional features like anti-virus which can be fairly processor-intensive and might very well benefit from cpu offloading. Another thing that wasn't mentioned was the potential battery benefit for laptop users. Benchmarks would have to be performed, but such a usb key *might* be able to reduce battery usage; on the other hand, it *might* also increase battery usage. It would be worth investigating.

Re:from the article

[Anonymous Coward]

"The tin foil hat wearing part of me, also really distrusts an israeli (err mossad) company usurping my network stack."

Israeli corp is not necc. Mossad, you fucking Nazi.

Re:from the article

[racermd]

I do see the benefits a software firewall can have. As I noted, I simply have a preference to an external firewall appliance over a software-based solution installed to each of the hosts on my private LAN. Given the choice, I will continue to run my external firewall as my primary line of defense. If, for some reason, I couldn't have that device at my disposal, I would need to rely on a software-based solution on my hosts instead. In some environments, like when I want to host a LAN party at my home, it makes sense to use both (although I would still run a segment off the firewall independent of my private LAN for such a purpose).

Re:from the article

[gabboo]

The whole idea looks arse-about tit to me, the USB will do as a source of power, and at a pinch, the drivers for the device could be used to produce a 'fake' nic, with a real nic on the USB dongle. The firewall dongle could be controlled by special packets over the USB, sort of an equivalent of a console port, it could then filter the packets and pass them to the fake nic created by the driver. It would behave (to the user) like a USB wifi dongle (in fact, building wifi into it might be a clever way to go) but would have a seperate packet inspector before the packets go anywhere near the potentially vulnerable windoze TCP stack / mac interface. *That* would work. This looks more like the crafty marketing has had more thought applied to it than to the workings device itself. Ne'er mind, nice idea, just needs thinking through properly. Dave (aka Gabbboo)

You shouldn't

[dreamchaser]

It's a hyped up device that nobody really needs. We're posting in a Slashvertisment thread after all.

Huh? That's not a hardware firewall!

[gnuman99]

It is just another type of a software firewall. A hardware firewall has at least one input and one output jack (unless it is some weird VLAN firewall). The firewall then checks the packets *before* they get to the hardware that processes them.

Here we have a software layers shunting packets for filtering to another "device" and then they are probably reinjected. The software layer that does this shunting and re-injecting of packets makes this not a hardware firewall.

Or are we saying that iptables is a hardware firewall as well?

Re:Huh? That's not a hardware firewall!

[Anonymous Coward]

Most "hardware firewalls" are simply microcontrollers running a software firewall. They do the same thing as a Linux box with iptables.

Re:Huh? That's not a hardware firewall!

[gnuman99]

Well, so? A normal computer can be a hardware firewall, or a software firewall. Depends on usage. The point is that the hardware firewall is a separate device that allows one to *physically* separate the outside from the inside. If all you do is a software firewall like iptables on the client or the windows firewall, then a virus can alter or disable said firewall. But a hardware or separate physical filtering device that has wires going in and out can't be altered even if a virus exists inside the firewall.

The story is clearly about a software solution, even if the filtering is run on a separate device. The firewall's "driver" can be altered to by-pass it.

Re:Huh? That's not a hardware firewall!

[Anonymous Coward]

a hardware or separate physical filtering device that has wires going in and out can't be altered even if a virus exists inside the firewall

But it can, when a bug exists in the software running on the "hardware firewall" that allows an exploit.
People seem to think that software firewalls are worth nothing and vulnerable all over the place, and "hardware firewalls" are perfect because there cannot be vulnerabilities in them. I'd call that naive. There have been buffer overrun vulnerabilities in iptables, so I would not know why there cannot be any in a Draytek, Linksys, ZyXEL, Cisco or whatever-have-you "hardware" firewall box.

Re:Huh? That's not a hardware firewall!

[powerlord]

This sort of reminds me of the old WinModems.

Yeah, its not exactly the same thing, but its neither a pure hardware or a pure software solution.

In the case of the WinModems the drivers used some of the system CPU in place of a dedicated processor, in the case of this "WinFirewall" the drivers are using the ethernet jack and the USB port to route the network traffic to/from the dongle. I'd imagine you would see some sort of performance hit, in terms of CPU, and BUS speed issues (depending on how much data is going through the network).

something similar but better...

[i.r.id10t]

I read (here on /. IIRC) a few years ago about a gumstick sized machine that had 2 ethernet ports on it. Possible to use Linux on it (or other embedded OS), have a dhcp client on one port and a dhcp server (or just static addy on "real" machine) with gateway/NAT/etc. on the other port. Would allow you to plug into any ethernet connection and then provide NAT, etc. (and some degree of protection and trust) to your laptop, etc.

Anyone remember this, maybe have a link?

Re:something similar but better...

[Dan Ost]

http://www.gumstix.com/ might be what you're thinking about.

Intel?

[TheRaven64]

Intel sold the XScale line to Marvell Technology Group in June 2006. It was only a year ago, so it probably counts as news by Slashdot standards, but can we try to keep the summaries slightly accurate please?

Wait

[Tarlus]

But does it run Li... oh, sweet.

Compare this USB device to a software firewall such as Zonealarm. It costs $180 whereas you can get free versions of Zonealarm. It routes your network traffic via USB, which makes me shudder. That would be a nightmare on older pre-USB2.0 machines. It requires software drivers in order for network traffic to be directed through it. That's more "moving parts" than should be necessary. Because, of course, the more moving parts there are, the more there is that can break.

Now if this were a dongle that attached to the end of a network cable, then plugged into the PC's NIC, we might have something.

a Linux driver?!

[Anonymous Coward]

Um, why not just run the apps directly on your Linux box instead of strangling network throughput with a USB dongle running Linux...

Hardware firewall definition

[sverrehu]

Eh, could someone please define the term "hardware firewall"?

Re:Hardware firewall definition

[griffjon]

RTFA - it's obviously any doohicky that plugs in to your computer-thingamajig.

I mean, it's a cool idea/system, but... uh, not really a "hardware" firewall if it needs client system software to route to it..

Re:Hardware firewall definition

[Anonymous Coward]

A hardware firewall is a firewall that runs on separate hardware from the hosts that it protects. In other words, it's a software firewall on a dedicated machine, which may or may not have specialized packet-filtering hardware. The "hardware/software" distinction made by marketeers isn't really important; more significant is the distinction between "network firewalls" and "host firewalls". Network firewalls are separate devices that are capable of filtering all traffic entering or leaving a network of multiple computers; host firewalls are limited to the traffic entering or leaving a single host, and are normally tightly integrated with that host's operating system.

This gimmick consists of a coprocessor and some low level operating system drivers, and appears to be primarily designed as a host firewall. It might be useful in a network firewall, it the operating system components could be ported to an operating system adequate to the task.

Re:Hardware firewall definition

[qwijibo]

A piece of hardware that plugs in between your computer and your internet connection. Ie, not this product.

Re:Hardware firewall definition

[GweeDo]

A firewall that runs on hardware :)

Re:Hardware firewall definition

[sverrehu]

Thanks, mate. I find the term quite stupid, and you explained why in a way that most geeks can understand. Again, thanks.

Re:Hardware firewall definition

[Organic User]

Why not? This would be an unconventional hardware firewall. Actually, a first of its kind. It is still hardware. Just doesn't work in your conventional way.

Re:Hardware firewall definition

[jimicus]

Right. But seeing as practically every hardware firewall in existence today is essentially a general-purpose computer with a specialised OS (be it Cisco IOS, VXWorks or a custom-built Linux) with, if you're lucky or pay a lot of money, some sort of acceleration hardware for things like VPNs, where do you draw the line?

I could sell you a box which boots off CompactFlash, runs one of the common Linux firewalls such as Astaro or Smoothwall, but it would technically be a software firewall. If I customised the user interface, you'd probably never know the difference.

Re:Hardware firewall definition

[gorrepati]

On non-native hardware.

hey BooBoo...

[insanius]

somebody tried to pwn our picinic basket...

Software/Hardware Hybrid

[BodyCount07]

Not really a true hardware firewall, since it requires drivers to make it work. Still pretty neat though.

USB2, yes.

[RingDev]

Uhh, USB2 runs at 480Mbps and in practice can push 40MBps (320Mbps) for bulk transfer (ie USB Hard drives).

So for them to claim that this device can push 100Mbps really isn't that surprising. So long as the little processor can burn through the logic checks fast enough, the bus can definitely handle the load.

-Rick

Re:USB2, yes.

[theRiallatar]

Assuming there isn't one or more of the following also attached to the same USB Bus. Wired/Wireless Mouse Printer Keyboard Digital Camera USB Flash Drive etc

Re:USB2, yes.

[larytet]

400Mb/s theoretically speaking. I think that PXA270 has a 64 bytes incoming and outgoing buffers for USB, so they need interrupt every 2 micro to handle incoming packets. Bulk mode is low priority and just any device connected to the same hub will have higher priority or share that 400Mb/s.

Re:USB2, yes.

[larytet]

...according to Vyatta 1.5GHz CPU can fill 45% of 100Mbits/s link assuming packet size 64 bytes. It means that likely performance of this USB firewall is well under 20Mbits/s

Re:USB2, yes.

[cravey]

I suppose if it's pushing data from /dev/null, but their claiming it can do it with stateful packet inspection and protocol analysis. I wonder what kind of latency it adds. Either way, the odds it can accept data, analyze it and push it back out at anywhere near 100mbps is close to 0;

sorry, needs to be ENTIRELY outside the pc

[TheGratefulNet]

else its NOT a hardware firewall. ..no matter what the slash-vertisement tries to say.

now, take that neat usb form factor, put 2 rj45 jacks on it and THEN we'll talk.

Re:sorry, needs to be ENTIRELY outside the pc

[griffjon]

Now, this is interesting for GPRS and wifi connections on a laptop. It is nice (tho not worth $180) to have a separate system that reboots "pristinely" that deals with GPRS and wifi. It's convenient for the mobile user. agree that it's not a true hw fw, but hey.

Re:sorry, needs to be ENTIRELY outside the pc

[Gordonjcp]

now, take that neat usb form factor, put 2 rj45 jacks on it and THEN we'll talk

Stick a single RJ45 on it, and use it as an extra ethernet interface. Come to that, stick 802.11a/b/g wireless on it and make something incredibly useful.

Re:sorry, needs to be ENTIRELY outside the pc

[hypermike]

This USB model works entirely in redirect mode, packet inspection. If you want their older model get the Yoggie Gatekeeper that DOES have 2 RJ45 ports.

Close but no cigar

[PHPfanboy]

Funny, a good friend of mine almost worked there.... Anyway, I thought this device would only be any good if: 1) it had a wifi chip in the device and 2) connected via ethernet port as a mini and compact external network element that 3) would do encryption for SMB non-VPN customers 4) in unencrypted hotspots. 5) to prevent snort wifi sniffer attacks But it doesn't. Still, from what I understood they're trialling at some large enterprise IT departments who think it's super, so maybe I missed something. Nice to see that their All-in-one security includes "Parental Content Control" - I'm sure that's a killer feature for all those pre-pubescent road warriors.

Re:Troll!

[Pojut]

They are like you in every way, except for one thing: They remember to actually click "Post Anonymously"

Re:Troll!

[Anonymous Coward]

pwnd!

meh

[pak9rabid]

Pretty gheyz. A pass-thru hardware firewall that has incoming/outgoing ethernet ports would be way better..yano, something that is completely OS independent.

why not make it fire wire or pci / pci-e based

[Joe The Dragon]

that would be better and it will have less system cpu over head.
also some chipsets like the nvidia ones have build in firewalls

Re:why not make it fire wire or pci / pci-e based

[ergean]

I still can't believe that even today I can't even use that. And I tried it on a dozen of motherboards and on every instance I had to remove it. Now I just skip it in the setup.

I was a nice idea...

Forget about the firewall, just give me Linux!

[tbcpp]

What would love to see on this is a bit more storage, and just plain old linux. Kindof like project BlackDog Linux project.

100 mbps "Wire Speed"?

[Autonin]

Uhm... USB 2.0 bandwidth is 54 mbps. In order to filter traffic going through it, you'd have to use the bus twice - once to send a packet to it, and once to get the packet (provided it was permitted) back from it.

I'm sure *internally* it'd handle it at wirespeed, but... otherwise, I can't see how even 50% of wirespeed is possible. Possibly closer to 20%, which, incidentally, is still faster than most home user's bandwidth.

And yes, this gadget's a total gimmick.

Re:100 mbps "Wire Speed"?

[cicadia]

Uhm... USB 2.0 bandwidth is 54 mbps. In order to filter traffic going through it, you'd have to use the bus twice - once to send a packet to it, and once to get the packet (provided it was permitted) back from it.

As far as I know, the USB 2.0 fast transfer rate is 480Mbps. A rough 25% overhead rule of thumb yields a rate of 384Mbps, or 48MBps, easily enough to handle a 100Mbps ethernet connection.

Also, you don't necessarily have to send each packet over the USB twice, if you are not doing any packet shaping, or address translation. A 1-bit response to each packet (pass / fail) is enough for a simple packet filter. The software drivers that intercepted the packet in the first place would then send the original packet out over the physical network (or not.)

Possibly closer to 20%, which, incidentally, is still faster than most home user's bandwidth.

A good point, from a practical perspective -- if the home user's upstream connection is at 5Mbps, then there's not necessarily any need to be able to keep up with a saturated fast ethernet connection.

And yes, this gadget's a total gimmick.

Agreed.

Re:100 mbps "Wire Speed"?

[Anonymous Coward]

802.11g is 54Mbps

USB 2.0 is 480Mpbs. Even if you factor in the half duplex nature + overheads, you have still > 100Mbps both ways.

Re:100 mbps "Wire Speed"?

[Anonymous Coward]

USB 2.0 does not necessarily imply an USB Hi-Speed interface. There are plenty of USB 2.0 Full Speed (theoretical max 12 Mbit/s) out there.
Also, Hi-Speed doesn't actually reach 480 Mbit/s, that value is grossly inflated.

Re:100 mbps "Wire Speed"?

[Anonymous Coward]

No, Full Speed USB is USB 1.1, though you are right about it's max of 12 Mbps. Yes USB 2.0 doesn't reach the 480Mbps speed in practice, but they are only claiming that the device will handle a 100Mbps connection so the device will only need 200Mbps bandwidth (100 each way) which is well within what USB 2.0 can handle.

holy hackable hardware, batman!

[radarsat1]

firewall schmirewall, I can't wait to see what "wrong" things people do with this.. a Linux machine on a USB stick? For 180$? Awesome.

Re:holy hackable hardware, batman!

[dfries]

I should get one of these. It would be great. I have this 486DX-133 playing ogg vorbis audio files and it isn't fast enough for the highest quality music. It does have a PCI USB 2.0 card in it, it would just be awesome having a 520MHz USB key doing the decoding. It would just be so backward nobody would believe me having the USB key being the CPU and the computer being storage and I/O. Goofy.

Re:holy hackable hardware, batman!

[adolf]

Better idea: Just rescue a Pentium-class machine from the curb and be done with it. I know it's so obvious that it hurts, but *come on*, man.

And then, if you still need/want extra points, remove as many of the critical moving parts from the box as you can to enhance reliability. Think undervolting, big heatsinks, and solid-state storage.

But $180 is too much to spend just for geek cred alone.

If that's your whole goal, then look not toward needless complication. Far better (and cheaper) results would come cheaper from a $50 WRT54G-ish router and running the audio over the network or perhaps out through an attached USB sound card. 216MHz of 32-bit ARM should decode OGG mightily, I'd guess, based on the fair job my old Riovolt does with OGG with its much slower 75MHz chip.

Sorry guys,

[Slithe]

it will take more than that to keep out the Palestinians.

I think I could buy an N Router

[Nom du Keyboard]

I think I could buy an 802.11n router w/firewall for less to protect all my home systems. Since I'm not using a portable system on the road, it would seem like a better buy.

Re:I think I could buy an N Router

[SST]

Your router will not stop a virus within ZIP file while Yoggie will. You probably need Yoggie Gatekeeper PRO that comes with 2 network ports and can protect 5 comouters without any software install on these machines. Simply plug it to your router and get them all secured by far better than router/w FW as it includes Snort, Anti Spyware, Anti Phishing, Anti SPAM, SurfControl, 4 proxies, Layer 8 security etc. Have a deeper look :-)

Lotsa useless negativity

[ushering05401]

There is a niche for this thing... a very small one, but it is there.

I, for one, might look into owning one of these. After all, I spend a shitload of time working on client machines trying to isolate and diagnose problems. Being able to plug in a USB key to emulate the hardware firewall the client *should* have would be helpful. Notice, I said emulate, not duplicate.

Just because it is on the front page of /. does not mean it is supposed to save the world.

Regards.

Re:Lotsa useless negativity

[mikelieman]

Boot Knoppix. It's up, and working? The diagnosis is a blown Windows install.

While in Knoppix, grab the Documents and Settings folder and copy to a USB drive.

Reformat HD, reload windows, copy over Document and Settings.

very cool

[Deadplant]

that is really quite cool but it is clearly not a 'complete hardware firewall' as it lacks the key component of a hardware firewall.... physically separate hardware.

Re:very cool

[SST]

There are two versions of Yoggie: Yoggie Gatekeeper with 2 ports Yoggie PICO with USB only working at 480 Mbps (effective 425 Mbps) Find more on the comparision in my posting today.

Apparently we all didn't actually RTFA

[Anonymous Coward]

Because if we had, then we might have noticed that this little device incorporates anti-virus software. Why do you care? I'll tell you why: because that eliminates one of the biggest annoyances for windows users since Clippy.

Anti-virus software always slows down your PC. No matter what. It has to because it scans each and every file as its accessed (assuming resident scanner operations).

This little gem allows me to not bother with installing any anti-virus software and just offload that function to a little firewall thingy that plugs into my laptop.

To me, this is huge.

Re:Apparently we all didn't actually RTFA

[Anonymous Coward]

How effective is it? How does it compare with other anti-virus software? How often does the mfgr. update their virus definitions? How can it possibly duplicate the functionality of regular AV software that has hooks in the file system and email clients? It can't possibly do all that.

I don't run AV. Never got a virus

Re:Apparently we all didn't actually RTFA

[Mr. Roadkill]

How can it possibly duplicate the functionality of regular AV software that has hooks in the file system and email clients? It can't possibly do all that.

You're quite correct about the filesystem checks... it can't do those.

For email, though, it could be quite decent - provided the signatures are kept current, and/or are broad enough to pick up new variants of some of the more common varieties. Many AV products set up POP, IMAP and SMTP proxies (although this looks like it only does SMTP and POP)... your mail client talks to a proxy, which scans inbound and outbound traffic and works the appropriate voodoo in the event of something nasty being discovered. It looks like it also checks web traffic too. This offloads the scanning to a dedicated piece of hardware, which is less likely to get subverted if or when something nasty makes its way onto John Q. Shouldshowermore's computer - you know, the guy who doesn't really know what he's doing and goes out looking for warez or b00b13zp1cs and gets a nasty case of the Russian Mafia from a dodgy website? Um, your neighbour? Yeah, him.

Of course, I'd probably still recommend using at least a free AV product on the machine... belt AND braces AND duct tape are better than belt alone, and there's always a window of opportunity between when new malware is released and when it's picked up by various scanner... and it makes sense to have something on the machine that can clean up after something nasty gets in. Sure, it's a terrific idea, but I wouldn't recommend it INSTEAD of AV software on the PC... it'll be great at offloading mail and web traffic scanning, and providing anti-phishing functionality, but it can't replace the basic "Whoops, caught something nasty after looking at something I shouldn't have - clean it for me" functionality of desktop AV software.

That said... it's cool, and there's a niche. I can't wait for some Chinese manufacturer to start including that kind of functionality in network cards. Filtering in your router, filtering in your NIC, desktop AV software (with the mailscanning turned off) - sounds like a combination made in heaven for people who just want their stuff to work without having to think about it too much.

Re:Apparently we all didn't actually RTFA

[KevReedUK]

Maybe I'm missing something, but if the driver is only transferring packets for scanning from the network path, how is this going to capture a virus that is brought in on CD/DVD/USB/Whatever??? If the virus comes in over something other than the network, I can't see this device doing much good, short of every single file you open being accessed over a mapped drive on \\localhost...

Having said this, I haven't got round to reading TFA yet, so this may be handled via an alternative filter driver in place that was omitted from the summary.

Having said this, this could be something to consider for a pure AV solution. IO Filter driver redirects all files on opening via this device to scan for viruses??? Might already be a viable solution already in production, but haven't seen it as yet, but off-loading the cpu-intensive virus-scanning onto dedicated, optimised processing hardware could be a noticeable performance boost...

It's just Killer.NIC on USB

[DrYak]

They just basically just invented the USB equivalent of the Killer.NIC :
a small embed router + a driver that directly taps into the WinXP TCP/IP stack (instead of having the packets go through the whole stack then over a short "virtual" network link to the router then up to TCP/IP again, then routing, then back to Ethernet then on the "actual" cable).

My only though : Is it programmable ? Could it be reflashed to function as something else more creative and be powered from a wall-socket USB 5v power brick ?

Could be a nice source of Gum-Stick-PC grade board for building fun gadgets.

(I, for one, welcome our USB-thumb-drive-sized newest electronic gizmo).

Re:It's just Killer.NIC on USB

[megaditto]

That's not very efficient, powering "fun gadgets" with a $180 CPU.

Go get some microcontrollers that will work much better and faster, and for $5-10 tops.

Try hobbyengineering (they sell reasonably priced newbie microcontroller kits) or if read up on what you need you can order the parts directly from Mouser or someplace (much cheaper and flat shipping, but you are on your own there).

Re:It's just Killer.NIC on USB

[PAjamian]

My only though : Is it programmable ? Could it be reflashed to function as something else more creative and be powered from a wall-socket USB 5v power brick ?

Could be a nice source of Gum-Stick-PC grade board for building fun gadgets.

Considering (1) it runs Linux (debian based according to TFA), (2) there will be regular updates available (from TFA), (3) it has 128 MB flash RAM (in two chips of 64 megs each) possibly expandable in the future plus two chips of SD RAM of unstated size (again, from TFA), I'm sure we'll see all sorts of neat stuff that can be done with it. They will be obligated to share the source code, so it should be possible to modify it to turn it into nearly anything. Considering, though, that the USB interface is its only interface to the outside world, I doubt it would be very useful if you just plugged it into a power brick.

Passthrough TAP IDS/IPS

[Twillerror]

I'd rather see a device like this that is a tap based IDS or IPS system.

You can buy taps and redirect copies of network traffic into a snort or other IDS, but I'd rather have a small all encompassing device I could take on the road.

Wouldn't work for wireless, but I'd rather hop on a wired connection at a hotel anyways. Half the time wireless is shotty or the signal is weak.

If I just plug the ethernet into one port and then plug my laptop into the other that would be great. It could then block traffic on non standard ports, and look for signatures and block that traffic and/or the orginating IP all together.

Re:Why? - your wish is granted - Yoggie Gatekeeper

[AYeomans]

Yoggie already make the Yoggie Gatekeeper, a full hardware firewall with two ethernet ports, just as you suggest. This also has a USB port for power. Using ethernet means this is completely OS-neutral, and can be used with Linux or OS X.

The Yoggie Gatekeeper can also be used like the Yoggie Pico in USB-only connection mode, with a Windows driver. You might want to do this to connect with built-in laptop wireless hardware, or with USB ADSL "modems".

USB Ethernet

[mistralol]

People have USB Ethernet for some time now whats new about this ? It just seems even more expensive.
I will just insert the virus in 1 of the following ways

a) before its used
b) fresh exploit
c) though IE
d) though a bug in its driver straight into kernel mode

I wish people would stop trying to fight security like they try to fight big fires with water when what you really need todo is remove all the oxygen.

If you sit in the OS and the OS gets exploited this little bit of hardware is really useless and i can think of even getting better hardware for £180 that would perform the same function but actually function !

Meanwhile i have though about getting 1 of these and modifying it to use it as a remote boot manager for dedicated servers in data centers. Now that would be a useful utility ;)

I think the real question is ask is why is there so many ameatures in the security profession ?
After all nobody seems to have actually "fixed" any of the serious issues for at least 5 years now. I think its time to swap some high paid idiots out of the job ....

Also ZoneAlarm freeware version.

[Anonymous Coward]

If anyone is looking for a free (as in beer) software firewall for Windows with a very small footprint, Ghostwall is a great choice for the not-afraid-of-configuration.

Not quite as small of a footprint as Ghostwall, but ZoneAlarm's free-for-personal-use version is excellent, and a very well-respected Winblows software firewall. It's one of the first things I installed on my new laptop (XP partition, I don't need no steenking extra firewall software for the OpenSuSE 10.2 dual-boot partition) before taking it online, and ZA has found and stopped several nasty malwares I otherwise would've picked up just by visiting some websites with IE that tried to install crap to my laptop.

Re:Also ZoneAlarm freeware version.

[eggoeater]

...just by visiting some websites with IE that tried to install crap to my laptop. I think I see where your problem is....

makes sense

[bussdriver]

Only a windows user would have any need for a stable secure firewall (based on linux) where ironically, it depends upon a windows driver to properly function.

Mod up.

[Ayanami Rei]

(*eyeroll*)
The point of the article (if anyone bothered to read it) was the miniaturization feat... 12 LAYER PCB!

Firewall is a small part of the product.

[Ayanami Rei]

It runs content scanners, checks attachments (including peeking inside ZIP files), blocks phishing sites, blocks viruses and malware, and so on. It automatically downloads updates every few minutes, and comes with a year of support. That's pretty comprehensive for the price.
Or you could just read the article.

What a STUPID IDEA!

[TavisJohn]

Why even use the USB port at all??? That still ties it to an OS by drivers!!!

Want to make a hardware firewall that will impress me? Simple. Make a hardware firewall that has an ethernet on BOTH ends. One end goes to the wall, the other end goes to my ethernet port. Think of it as a 1 port ROUTER! You can get POWER fro the USB port, but I would leave it at that.

Oh want a hardware firewall for your wifi? No Problem! Make a WiFi version that is powered off of the USB port. Give the little box 2 wifi transcivers. One is the WAN transciver that connects to the internet, the other one is a LAN transciver that connects to your laptop!

With either of the above solutions you KNOW you are secure because it is OUTSIDE of whatever OS you choose! The above solutions would work with ALL Operating Systems! And only the WIFI one would need to really be configured.

Yes, what I described is basucally a 1 port router. But it would WORK and would be SECURE!

Re:What a STUPID IDEA!

[hypermike]

WHy dont you check their site before flaming. They made exactly what you described 2 years or more ago. It has a passthrough 2 RJ45 for all OS's and a USB redirect mode for wifi. The speed of the USB was 1.1 with that model which is why these new models are much better. However, I don't give a $hit about the passthrough for corporate use, 99% of the time users with laptops will be using wireless in redirect mode. So now I can keep my Cisco network and also only allow internet access remotely with the use of a PICO. If they unplug it, no internet. This is perfect for corporate use.

I am from Yoggie: Critial information disclosed

[SST]

Dear All, Yes, I am from Yoggie and its a pleasure and honor for me to provide some "internal" information: Some of you mentioned that you need 2 network ports to make a "real" Firewall. True, please refer to our web site: www.yoggie.com and find the Yoggie Gatekeeper. This product released few months ago comes with two network ports running same processor, same memory, OS and 13 application. Some of you, view Yoggie as a Firewall and compare it to Routers and access points: Please note that Yoggie is by far more than just a Firewall and in fact its like a set of enterprise security appliances packed in a miniature computer. Lets see what's in there: 1. FireWall, NAT, DHCP Server and client 2. Full snort implementation including IPS on top. VRT updates will come soon. 3. 4 transparent proxies: 2 for web: HTTP, FTP and 2 for email: SMTP and POP3 4. True File-Type detection agent so file type are detected by content analysis and not based on MIME or file extension! Compressed file - are uncompressed in real time before scanning!!! 5. Anti Virus agent - Kasperski! 6. Anti Spyware agent - both signature based and behavior based! 7. Anti Phishing - since it sees the web and email traffic - it can "close the phissing loop" and verify content/url. 8. anti SPAM - based on Mailshell engine. 9. URL CAT and parental control - based on SurfControl. 10. Layer 8 agent - performs content scanning to "above layer 7" applications, AJAX, VBS, JS, etc. to detect new and unknown virus (not based on signature). 11. MLA - Multi Layer Security agent - a new invention - event correlation in REAL TIME for all event from all other modules - to drastically reduce false positive of IPS and Layer 8 agent. 12. VPN Client. These applications take 35% - 45% of PC Windows CPU. More, one cannot find a commercial implementation of all these applications in one security appliance, even when it comes to a 1U, 2U or 4U appliance. Simply, no one yet managed to integrate layer 2/3 security with layer 7 and above layer 7 content analysis. Yoggie is a unique combination of 7-8 commercial different security appliances. Why did we come with the Yoggie PICO? and why after Gatekeeper: First, we wanted to provide the experts with a 2 network ports solution: we launched the Yoggie Gatekeeper. After we came with this great invention that one can implement an *almost* identical solution using *s-route driver* at the lowest level that still NAT (yes, this is the first NAT and DHCP service inside a protected driver and in between network layers) IP address so external IP address is different from IP addresses Windows application gets. This unique implementation is the only one capable stopping attacks such as "ARP cache poisoning" - something only hardware based firewalls can do. (will go via software firewalls). We absolutely agree that Yoggie Gatekeeper using two network interfaces provides the ultimate separation and isolation but we also know that Yoggie PICO unique "S-Route driver" is by far better than software firewall. Why we didn't add network port to PICO ? - we let this choice with the Gatekeeper (for people that absolutely requires two ports) and made an alternative with almost same security level but with a much smaller form factor (easy to carry)and using the existing network port in the laptop. Your comments and suggestions are welcome. SST.

Professional Product.

[hattig]

I think I could buy an 802.11n router w/firewall for less to protect all my home systems. Since I'm not using a portable system on the road, it would seem like a better buy.

You don't say! Duh!

This is a product for mobile professionals. The IT department can stick this cheap (for a multinational) dongle into their laptops and guarantee that the professional person, who probably isn't too bright in terms of IT, won't get owned on their round the world trips with their various different types of connectivity that they will employ. I'm only surprised that it isn't also available in ExpressCard and PCMCIA formats.

I find it astonishing that we have a tiny Linux based computer running at 520MHz with 128MB RAM fitting into a miniature hardware device, and everyone on Slashdot it dissing it. Didn't anyone read the article (all the people complaining about the device not having ethernet ports clearly didn't read the article or they would have seen the companion product that has them)?

Think of the future possibilities - hijack the file system stack and implement hardware security on the filesystem. If the laptop is stolen (as if that would happen, why, if it did we'd see stories about it... wait) then the data is safe.

Missing the Point

[Anonymous Coward]

A real hardware firewall doesn't rely on the system it is protecting.
In this case, since the processing of the packets is done on the computer itself, the "hardware firewall" is just an illusion.
If the software doing the processing has been compromised, you're screwed, thus this design obliterates the philosophy behind a hardware firewall.
Plus you have more cross-platform and deployment issues.
This is really stupid. An ideal solution would have been a hardware firewall performing inline filtering by a microcontroller/FPGA/whatever embedded system with just two ethernet jacks.

Don't fall for this marketing gimmick. These guys just want to make some dough and you can get Norton for free after a mail-in rebate from Fry's.

Re:Missing the Point

[simong]

Two small problems here:

1) You don't know what you're talking about.
2) Norton is appalling proprietary desktop rubbish. See 1.

OMGWTFBBQ!!!!11oneeleventy

[windex82]

>> An Israeli startup has squeezed a complete hardware firewall into a USB key.

Oh my God! With only 16 GIGABYTES of space how could they possibly ever SQUEEZE a customized version of Linux onto a USB key!

As if any full blown Linux distro would take anywhere near that much space with a basic install, let alone a stripped down custom install.

Re:OMGWTFBBQ!!!!11oneeleventy

[Anonymous Coward]

Yes, I agree!!11
16 GIGABYTES!!!!11 That's like, enough for 50 real CPU's!!!11

I think the keyword here is hardware

(Not saying it's fantastic or anything, but I fail to see the relation between memory and physical space :p)

Re:OMGWTFBBQ!!!!11oneeleventy

[Anonymous Coward]

>> An Israeli startup has squeezed a complete hardware firewall into a USB key.

>Oh my God! With only 16 GIGABYTES of space how could they possibly ever SQUEEZE a customized version of Linux onto a USB key!

>As if any full blown Linux distro would take anywhere near that much space with a basic install, let alone a stripped down custom install.

Umm they packed in a PXA270 based SBC on that little dongle. That's quite impressive.

How does it compare to...

[Aryeh Goretsky]

Hello,

What I would like to know is how Yoggie's devices compare to Zyxel's ZyWALL P1. Zyxel's device is larger at about 5×3×0.75" (assuming I'm doing the metric conversion properly) but it is a standalone device with two 10/100 Ethernet ports. Zyxel's web site says anti-virus, IDP and anti-spam will be available in the future, but since that was two years ago with no update to the web site since then, I'm guessing they will never be added, so the device only acts as a firewall with SPI and DDoS protection and VPN client. Still, at around $70.00 or so, it is half the cost of the Yoggie and you can always run anti-virus and anti-spam on your client PC.

I have not used either device, so I am wondering how their respective firewall and VPN feature sets compare.

Regards,

Aryeh Goretsky

Oh that's just great.

[Organic Brain Damage]

"Honey, have you seen my firewall? Where'd I put that dang firewall...I know it's around here somewhere...oh geez, it was in my pocket the whole time."

I do this now with keys, wallets and cell phones. Do I really need to do it with my firewall?

Hardware firewall -- A real solution for less

[Dan Ferguson]

Don't buy it, it's a waste of money for $180. I have used many Mikrotik routers for ISP routers and they work great and cost less or the same depending on performance. They can also do more than the USB router or even a Cisco.

Assumptions

[Xardion]

There's alot of assumptions being made here fellas. For one, although the diagram suggests it, it doesn't HAVE to send data over the usb port twice. If the driver that's intercepting the stack is properly designed, it only needs to send the packet once, and then get a binary response: accept or deny. Remember, the USB port isn't a network device, so it doesn't have to work like one. However, we don't know if it works this way, or if it really does send it twice.

Re:Assumptions

[larytet]

the suggested scheme is problematic - will require queue of pending packets in the Windows driver and some additional tagging. It looks simpler just to run the packets via the dongle in and out.

Anyway I doubt they stand in 100 Mbits/s line rate when they decompress on the fly gziped streams and check the download by antivirus and run Layer 7 packet and above packet inspection (think about AJAX) and this is basically what they say in the product description.

Some enterprise boxes do similar tricks - full inspection of TCP/IP-to-HTML layers. Typically these are 3U boxes with lot of network processors and fair amount of proprietary logic.

Mod down the noise to improve the signal

[davo_1]

OK, how do we mod down posts that ' float to the top ' like this through the previews, once it has been vetted as junk?

/. sometimes you need to improve your signal to noise ratio.

You can't be so short on material to keep crud around for long.

Thanks for listening.

True, but let's take in the sweet irony

[Anonymous Coward]

It's true that this gizmo is nothing more than a hardware assisted software firewall, but let's not miss the irony: it's a lunix device... but it only has Windows drivers.

Even people creating linux devices know where the real market is at. But I'm guessing they only used Lunix because it was free.

Re:I am from Yoggie: Critial information disclosed

[larytet]

you can use HTML tags in the future to break the lines for example

will add an empty line to the

Re:Also ZoneAlarm freeware version.--NO!!!

[eggoeater]

The first few versions of ZoneAlarm were great, however I've had a lot of problems with
the newer versions (ver 5+), esp with memory usage and the entire network stack becoming inoperable until I rebooted.

I now rely on a nice router (DLink dgl-4300) with a proven track record for reliability, speed, etc., and has a built in firewall,
and as a last line of defense, the MS Windows firewall, which I agree is a joke, and AWFUL to configure, but has been very stable for me.

They don't even know the OSI model.

[Otis2222222]

conjunction with Windows XP or Vista drivers that hijack traffic at network layers 2-3, below the TCP/IP stack Sometimes Marketing 101 overrides Networking 101. The TCP/IP stack operates at layers 3 and 4. IP is a Layer 3 protocol. The phrase "hijack network traffic [...] below the TCP/IP stack" to me means that it is operating at the Datalink layer. Sorry if I am being pedantic here, as a network engineer reading stuff like that sets off alarms.

Re:They don't even know the OSI model.

[SST]

Hi Otis, I am from Yoggie and I am also a network engineer (for many years). Let's go back to Windows Network 101: I am sure you know the NDIS architecture: every network card has its network driver interfacing (bounding) to NDIS from below and communicating with miniPorts. Now, comes Windows TCP/IP driver that implements the Windows TCP/IP stack. It includes the "Packet Filer" from below (interfacing NDIS interface), IP routing and implementation of TCP and UDP from the Top. This is the Windows TCP/IP driver that bounds to NDIS. Eventually other drivers such as nbf.sys, NetBT.sys etc. can also interface directly to NDIS. So, Yoggie PICO is interfacing in the middle of NDIS intermediate (you probably know the NDIS wrapper) so it is - as we said - *below TCP/IP* and above the NICs drivers. In fact it is hooked into the NDIS for every miniport and therefore is transparent to the NICs below and to the TCP/IP stack above. Need more details, just ask. We provide Tech101 and not Buz101 :-) Cheers.

mmmmmmmm

[svallarian]

sounds delicious!!

So many red flags pop up

[billcopc]

Reading this slashvertisement has left me wondering what the hell these Israelis were trying to solve in the first place.

It's a USB device (not a USB key, dammit!) that merely houses an embedded processor, with funky drivers that mess with the network stack in order to route traffic through the gadget. You're piping your 100mbit line both ways over USB, which is such a dumb idea. It offloads the firewall process from your main CPU, but then ties it up waiting on USB I/O. It also raises the same issue as VM firewalls, where attackers are still connecting directly to your PC, you're just blindly hoping that the "raw" hop between the interface itself and the firewall won't be compromised.

This is hardly any different from running a pure software firewall like Zone Alarm or whatever's big these days. Adding a puny little embedded processor doesn't do all that much. If you worry about your idle CPU cycles so much that you'd throw $180 at a silly gadget like this, then I can think of several other options that are less hackish and platform-agnostic.

1. Spend that $180 to get a faster CPU, mitigating the performance hit of a software firewall
2. Buy/find an old Pentium-133 for ten bucks and install a Linux firewall (even a prebuilt one like SmoothWall)
3. Go to Worst Buy, Jerkit City or Mallwart and buy a $30 broadband router
4. Unplug your computer, bury it in 6 feet of concrete, post an armed guard nearby and find yourself a less stressful hobby

Re:So many red flags pop up

[pygm]

it is a usb 'stick'. from their site: "The world's first Linux-based dedicated & robust security computer in a USB stick, with 13 built-in security applications!"

Re:So many red flags pop up

[billcopc]

Nowhere on their site does it ever suggest this thing has any usable storage space. I've got a USB eeprom programmer that's about the same size, but I would never go around calling it a USB stick because that's yet another incorrect name for USB flash storage. Along with Jump Drive, USB key, USB traveler (?!), USB floppy (?!?!) and various other dumb names common folk make up.

I don't have much book lernin' but

[Anonymous Coward]

why not build a hardware firewall right into the laptop/desktop itself? Really why not?

Re:I am from Yoggie: Critial information disclosed

[illumin8]

10. Layer 8 agent - performs content scanning to "above layer 7"

I stopped reading right there. Sorry dude, I hate to break it to your "leet marketing gurus" but there is no such thing as "above layer 7"... Unless you're analyzing the context of the content I just downloaded to tell me what you think the Slashdot post I just read is trying to say... there's no such thing as layer 8.

Re:I am from Yoggie: Critial information disclosed

[SST]

Well, let's check the technical facts. On the OSI 7 layers model, layer 7 stands for the "application layer". Noted that this is the *network application* not the end user application. Also noted that this layer 7 or the Network Application layer (in specific HTTP, FTP, etc.) is really used by *end user Applications* as the transport layer. What are these applications: JavaScript, JavaApplet, ActiveX, VBScript, etc. These are end user productivity apps that travel over HTTP, SMTP etc. So, Yoggie developers like to name it "Layer 8". Eventually there is no Layer 8 in the OSI Model (this is why we use "") - but you know us developers and inventors, we like to come with our names. So, what is Layer 8 Security Agent? It is an agent that is doing behavior analysis to end user applications (=Layer 8). I am sure you heard of the term Behavior Analysis, it means we scan the content of the CODE, using heuristics to determine is this code is an attack (doing malicious acts) or just a friendly end user application that allowed to enter. Why do we do this? Well - this is a good technique to stop a Virus that still is not recognized by the Anti Virus (no signature was delivered yet) and otherwise - would infect the protected computer. I really suggest you keep reading, the depth in Yoggie PICO is by far more than what it seems in the first look

USB Firewall?

[rleesBSD]

Well, I don't exactly see the unique benefit of this device (not enough coffee this A.M., I guess). But let's give 'em credit for something:

Marketing Marketing Marketing!

• Find a field that regular folks know nothing about, but is scary for them.
• Sell a widget that purports to save them from the scariness.
• Make millions.
• Sell it to Homeland Security providers.
• Make more millions.

Re:I am from Yoggie: Critial information disclosed

[Anonymous Coward]

So how do you configure it? The article mentions a public site but there is nothing about this on the yoggie website.