&gt; You don&#x27;t need a firewall on individual machines either; just don&#x27;t run network-facing services in the first place<p>I disagree. Firewalls fail closed under user error. The solution you proposed (we&#x27;ll call it conscientious-wall) fails open under user error. That&#x27;s to say, once a firewall is set up it will protect me from outside intruders unless I specifically tell it not to. A &quot;conscientious-wall&quot; will not protect me from outside intruders unless I specifically remember to apply it whenever I install an application or download a software update.<p>I&#x27;m still firmly in the camp of having at least an inbound firewall on every machine.