Because you don't need a firewall for Linux.
Let me re-phrase that slightly:
you don't need a firewall for ALL operating systems!
If telnet or SSH is enabled, it doesn't take much for someone to hack and burn your machine, same with Windows and Remote Desktop. Why do you think that corporates spend loadsa money on system security.
To determine how susceptable an open connection is to detection and intrusion, I once set up an open and unsecured network (A "Honeypot") on my connection whilst I was out for a couple of days. The two machines on it were one with RedHat IX with a home desktop install, and one with WinXP SP1.
The Linux box was hooked up directly to the Internet connection, and the Windows box was linked through the Linux one. Aside from a couple of
iptables rules to serve traffic to and from the Windows box, both machines had firewalls disabled, had remote access systems (Telnet, SSH, XP Remote Desktop etc.) left on and open, and both machines had simple dictionary crackable passwords set. They also had some spoofed "personal" data files on (Mainly random DVD VOB files renamed as ZIPs etc.) and other deliberate "items of interest".
Both machines were made "visible" to the Internet by a Linux chron set to open an IRC connection between both systems and a popular Hacker's IRC server after I had left the house - A
make them find me move chosen from an IRC-based attack that I experienced a few years ago.
After I returned about 50 hours later, I checked both boxes. The Linux machine had been cracked, "root" password changed (The hacked "root" account was a fake with a UID of 10, the
real root had been renamed), reconfigured to act as an open relay, and already had an alien script set to chron at 02:00 the following morning which would've sent e-mail spam out all over the shop.
The less said about the Windows box, the better. There was so much crap running on it by the time I'd got back that I was forced to power it off by pulling the lead out of the back. The thing had become so heavily trojanised, that even a
Safe Mode with Command Prompt boot (Not that that was an option - One trojan had disabled all forms of OS boot control) would've taken at least 20 minutes and would still have rendered the machine unusable!
Naturally, I now try to make sure that I have
every available security precaution running on my network to minimise the scope of damage. Wisely configured firewalls (On every machine, as well as my painfully basic SOHO router), MAC address-based access permissions, and restricted user accounts are just three of many precautions that I make use of.
After all...It took me over a week of strict quarantine to thoroughly scrub both "Honeypot" machines clean of data and all known potential avenues of infection - Including flashing the BIOSes on the motherboard, video card and HDD controllers - And I'd rather not have to go through that process on a non disposable machine!

hock:

Any particular reason for being against ISO, just out of interest?
Yes. I hate having to ponce about downloading something then having to make a disk from the download. Another thing I detest are Zip files. These sort of things faffing about are like going from London to Penzance via Edinburgh if you want an analogy.
Personally, I prefer ISO images to physical media in many circumstances. Because Linux distros change very often and the ISOs are always being updated, I don't like the idea of wasting DVD-Rs that will becom obsolete in a very short space of time. Thanks to the ISO format - Which can be mounted virtually using tools like
Alcohol 120% - I can download and use ISO files very easily, and I now only burn a disk when I actually
need to!
As I tend to produce a lot of customised CD/DVD media and data collections, the ISO format allows me to preview and test an image before burning, and I burn
very few coasters as a result...Indeed, the only four I've ever done were two system recovery disks (Bad install of Roxio Burner in Vista HB) and two video collections (Donated media which turned out to be a bad batch) 8)