SimpleDeFence 0.1.4 beta

Fixes the Connections screen showing no applications.

The bug

The Blocked section could be empty for ever on any installation never put into Learning mode — with nothing anywhere to say why. No error, no banner, and the Connected and Open lists working normally beside it.

The two Windows audit subcategories that make the Filtering Platform report what it dropped were switched on and off by the firewall-mode switch, and by nothing else. A service that started in Normal mode never enabled them at all, and leaving Learning mode switched them back off. Without them the WFP callback is never called, the event log stays empty, and the section has nothing to show. That audit policy now belongs to the service for its whole lifetime.

Also fixed

• One failure anywhere in the connections gather emptied all three sections — including Connected and Open, which are built from a local API and never needed the service. Each section is now gathered on its own.
• A service that stopped, or one that refuses to be queried, could abort the entire gather.
• Blocked attempts stamped a fraction of a second ahead of the reader's clock were silently discarded, and an attempt that is not listed cannot be released.
• The Connected and Open lists are kept when the service is unreachable, instead of blanking the screen behind an error.

Changed defaults

• The Blocked list now reaches back an hour instead of five minutes — five expired sooner than most people notice an app is broken and go looking for the reason. Configurable.
• The event ring behind it holds 5000 entries instead of 500, so ordinary broadcast traffic no longer evicts the application block worth seeing.

Note

This build enables the Filtering Platform Packet Drop and Filtering Platform Connection audit subcategories while the service runs. That is what makes the Blocked list work; it also means more entries in the Windows Security log.