Agreed, but it is definitely not enough, which is why some Debian folks packaged opensnitch.