But on a desktop, almost any application can open a port, especially on unprivileged ports. Also, desktops tend to need to run services to do desktop-related things. Even if these might not be enabled by default, they can easily pop open without the user realizing it from installing a package or enabling a service.
So unless the expected use case is to deploy it and run it without applications running, the idea that you don’t need a firewall here is flawed. The firewall protects us against all the unknown risks that come with a desktop.
Let me ask a different question, with a desktop use case, why would you not want to install a firewall by default in 2023? Sure, some people will disable it but isn’t it better to ship secure by default in this case?
Looking at it from the opposite angle, why would it make sense to ship leap and tumbleweed desktops with a firewall but not Aeon? The immutable base shouldn’t really change the need for a firewall one way or the other.
I’m not deeply involved in Aeon, so I can’t speak to the design principles behind the decisions. karlggest said something about Richard Brown’s principle being a “Chromebook experience” - and as I noted, iptables is on the system as installed, so you do have a firewall, it’s just not firewalld.
If you’re running applications that open ports, then Aeon is probably not the distribution you are looking for. You’re probably looking instead to use Leap or Tumbleweed. Aeon is for a really specific desktop use case: Minimal applications rather than hosting services.
For more information about what the design principles and goals are, I’d suggest reaching out on the channels that sfalken provided, as that’ll get you a conversation with those who are actually working on it.
These forums are user support forums, and are generally not monitored by the developers (there are a small number of devs who pop in here from time to time).
Might have missed it in your 2nd link, but “UPPERKEES” did reply and ask about the missing firewall … then asked a follow-up question, but R. Brown didn’t reply.
Given that UPPERKEES responded about an hour ago and Richard’s in another part of the world (at least relative to where I am), it’s probably not surprising that he’s not sitting there, watching Reddit like a hawk when he’s got distro architecture stuff to be working on.
Richard will respond when he’s able to. For all we know, he might even be on vacation or something.
This discussion has run its course now - any further questions or discussion is best taken up with those who worked on it, so I’m going to close this topic.