CUPS is technically ok, it binds to 127.0.0.1 only by default, only reachable via localhost/loopback.

I'm more annoyed by things like skype and banshee that insist on opening wide-open listening sockets on all interfaces. 

Skype is microsoft, one really can't trust anything they do since the first thing after acquisition was remove security features and removing decentralization (probably capitulation to .gov to allow blackbox sniffing to allow the acquisition), but sadly is almost a necessary evil to deal with the outside world now or I'd simply refuse as I had for years.  I just assume the open socket is to allow the nsa to direct connect and listen (assuming nat/firewalls don't restrict this).

Banshee, not really sure why it's opening a socket.  I don't usually expect music player authors to understand well network security aspects, one can only hope they understand at least enough to mitigate remote code exploits via it.

What's listening openly on your system?

sudo netstat -anp | egrep 'tcp|udp' | grep LIST

Anything NOT bound only to 127.0.0.1 is exposed when not hiding behind a firewall or host.allow.

-mb


On 10/10/2014 05:20 PM, Stephen M wrote: