7

I have an application running with admin rights, which in order to work, need add a port and register himself to the exceptions list of the Windows Firewall. the question is, is considered a bad practice do this without inform to the final user? or must be done asking to the final user about this ?

Thanks in advance.

  • This is off-topic, as it's not really a programming question. However...You should ask the user first. Opening a port and a hole in the firewall should never be done without the user's consent, IMO; in addition to just being a bad idea because it's the user's system, doing so may also (in some jurisdictions) leave you open for financial or other liabilities. (For instance, you open the port and make the exception, and some malware author learns of that and exploits that exception and port to allow access to the user's personal data.) –  Apr 06 '11 at 23:30
  • Actually, since Windows provides COM interfaces to do this, it's not at all off topic. – Warren P Apr 07 '11 at 01:27
  • 1
    @Warren P: OK. Point out to me where in the question there was a mention of how to do it programmatically, or COM interfaces were mentioned? –  Apr 07 '11 at 01:32
  • Okay, yes, he should edit it or delete it. – Warren P Apr 07 '11 at 01:37
  • @Ken, it's Stack Overflow. "How to do it programmatically" is implied in every single question. Also, the "programmatically" part was in the title, which you edited to remove. But then again, the rest of the question wasn't really asking how add a firewall exception; it's asking whether to ask the user before doing so. – Rob Kennedy Apr 07 '11 at 03:13
  • 3
    Yes it is a bad practice. You have to ask the user. Opening a port can be a potential security risk. – Runner Apr 07 '11 at 05:32
  • Even better, move it to EthicsAndCareersAndUnicorns.StackExchange.Com :-) – Warren P Apr 07 '11 at 21:08
  • @Ken White: Don't forget the possible consequences if it's used in a regulated industry (and I don't know what sort of application this is, so I don't know how likely that is). If somebody's application winds up violating HIPAA or whatever it is that banks have, the consequences could be serious. – David Thornley Apr 07 '11 at 21:37

5 Answers5

3

From user perspective, I think I should be informed about doing anything to my firewall.

Apart from security and ethics, I believe a user should be informed about an application requirement for open port because the computer it would run on might be behind a NAT, so the user might need to forward a port there anyway.

I wrote this because I don't know what sort of application it is nor what its use cases are, just wanted to point out that for some users applications that inform them on what they are going to do not only seem more trustworthy but are easier to troubleshoot as well.

And I would definitely try to find a similar application which would not require root privileges even if it had fewer features or clumsier interface.

Roman Grazhdan
  • 308
2

Well, since you asked this originally on stack overflow, which is a programming website, not an ethics website, I suggested you read more technical information, and see if what you have to do figures into this, as well as what you "should" do.

So here is some C# information. It suggests you look into NetFw Type Library. As does this C++ example. Both are showing the use of COM interfaces built into windows.

Delphi can import a type library which will create a NetFw_TLB.pas file, which you can build into your application, giving you access to these COM objects. You might also try importing the functions from the FirewallAPI.dll.

As the commenter says, you should ask users, but I suspect, that even if you don't, such an action as modifying the firewall rules through this interface is likely to invoke UAC and tell the user that your application wants to modify this setting. It might be necessary for you to write this part as a separate executable that you run with elevated priveleges, in order for this whole ordeal to work. Perhaps you might want to consider doing this part from your installer, and having a checkbox for it, and this will be usually done by someone who is expecting the UAC prompts, and who has Administrator priveleges, so they will be allowed to run the install.

So, in the end, since windows is going to ask you at least once about this, adding a second one, might make TWO dialogs. But on systems without UAC, you might want to consider adding a special notification to the user.

Warren P
  • 830
  • -1 Doesn't address the question asked at all. (The question was not programming related and didn't mention programming. It asked about whether the user should be informed first before doing something.) –  Apr 07 '11 at 01:33
  • that's harsh. I'm trying to address it from a programming point of view (UAC makes his question even more irrelevant, for example). – Warren P Apr 07 '11 at 01:50
  • @Warren: How do you figure? Your answer didn't address the question asked at all at the time I downvoted. Since there was no programming question, trying to address it from a programming point of view is useless. "What kind of car should I buy?" doesn't become on-topic because the cars you're considering have a computer controlling the fuel injection. You should have deleted your answer instead, since it was totally off target. –  Apr 07 '11 at 02:05
  • +1 This addresses valid points in implementing the functionality. – Aditya P Apr 07 '11 at 06:21
  • Well, I'm trying to be helpful Ken. I think this question does belong over here in Programmers land, so that's good. – Warren P Apr 07 '11 at 21:10
0

Simple Answer to edited direct question

This applies to your app installation or run requirements notification .

Yes it is a bad practice. You have to ask the user. Opening a port can be a potential security risk. – Runner

Answer to the question I understood.

No , if you are an system administrator who is setting privileges for an application by adding a firewall exception to the port.Final user should not need to know about this.This assumes you know fully well all the security risks involved.

Aditya P
  • 3,527
  • 2
  • 27
  • 42
  • In your case of the administrator it should be the fire wall software setting the exception, not the application for which the privileges are being set. So the answer there should still be "Yes it is bad practice, unless you are a fire wall application and are doing so on explicit request by the user". – Marjan Venema Apr 07 '11 at 10:45
  • @Venema ofcourse the firewall software does This( automatically or by manual prompt). I meant About the administrator informing the user of the changes.Here the end user do not need to know intricate details of administrative tasks. – Aditya P Apr 07 '11 at 10:51
  • Ok, I misunderstood who you had telling what to whom. I was talking about the software telling the sysadmin, you were talking about the sysadmin telling the end-user... And there I agree with you. – Marjan Venema Apr 07 '11 at 12:10
0

If this is for an application to be insalled by the general public then I would think very hard about telling them this. It is not useful information and is likely to worry them. If the app can't be used without that port open then you are justified in opening the port during installation. Plenty of other applications do it and I've never seen any warning dialogs, or even any obvious mentions in ReadMe files. [see below]

What you are obliged to do is to ensure you applciation is secure and that opening this port does not cause security problems. If it is only your application using this port then it is down to you to write secure code. Which brings me on to my main worry, which is running an application as admin. This is way more serious than opening a port and is a much bigger security risk, and may also make the app much harder to use - what if your user does not have admin rights? I think you need to fix this issue ASAP, in my book this would be a pri 0 show-stopper bug.

Edit I just checked the ports on my machine, here are a few apps that have open ports not including port 80 or 443:

  • File and Printer sharing - several ports.
  • Outlook
  • Remote Assistance - several ports
  • Remote Desktop
  • Windows Live Messenger
  • Zune
  • Several internal application

There are loads more. They won't work without network access, none of them "warned me" at install time.

Steve
  • 5,264
  • Opening a port should worry them! – Marjan Venema Apr 07 '11 at 10:41
  • The point is what can they possibly do about it? The user will either ignore it or panic and not install the app. – Steve Apr 07 '11 at 10:47
  • They can absolutely do something about it: your second option. The user may want to reconsider using the app when (s)he realizes the security risk it poses. Doing it silently for them robs them of this choice. – Marjan Venema Apr 07 '11 at 10:53
  • But what is the risk? How do you explain the risk to them? Do you not use email, IM, music players etc because they use ports other than port 80? I think it should be documented, but this is not a "dodgy" thing to do by any means. – Steve Apr 07 '11 at 10:55
  • In terms that the user would understand, the same firewall software does. If you cannot explain a risk to your users, you shouldn't be exposing them to it. If I found that an app opened up a port without telling me up front (and not somewhere in the depths of some documentation), I would scrap it immediately. – Marjan Venema Apr 07 '11 at 11:43
0

Answering your question with a question: Would you like to install and run software created by someone else on your personal machine that opens firewall ports without telling you about it?

GrandmasterB
  • 39,224
  • Most of them do the same.Often Its the Security Software which detects and blocks the process and prompts you to permit or deny the action. – Aditya P Apr 07 '11 at 07:28
  • @AdityaGameProgrammer: What most do is not always best practice. That would be equating quantity with quality. – Marjan Venema Apr 07 '11 at 10:42