Have win2k Even i dont run a firewall, & antivirus , am on a LAN.It depends on how you configure the system.Obviously the patches are released after a vulnerability, but not every vulnerability gets turned into a workable exploit available for script kiddies.But for a novice user, it is better to run a firewall until and unless he gets more knowledge regarding security and configuration.And if you have enough RAM 256 or greater, it is better to run a firewall, no matter how much security geek you are.