With the exploit of yet another Microsoft bug (MSBLAST), it's prompted me to propose a solution that would go a long way in containing these problems: I've never figured out why Microsoft hasn't implemented it.

The NETBIOS, CIFS and RPC core engines should have a "Local connections only" flag somewhere, and reject all connections and probes from IP addresses not directly connected to a local interface (as determined by IP address and netmask). This flag would be TRUE by default, and would require the user to override in the TCP/IP properties or perhaps picked up by DHCP.

This approach would allow most of the networking services to be enabled by default, but they would not be usable by anybody outside the local network. Most home users would be functional and mostly secure even if they had no firewall: no "security versus functionality" tradeoff for most.

This wouldn't be a complete fix - cable modem users have "neighbors" on the same network - but would not allow The Great Unwashed to be exploited by script kiddies and worms from all over the world.

Can anybody think of a reason why this wouldn't work?