I actually like the nVidia software firewall that came with my motherboard, called ActiveArmor Filewall. It has per-application allow/deny lists and automatically determines if software has been changed since being granted access, and ask again to allow it. Also, it doesn't have a built-in whitelist, so it won't automatically allow those stupid quicktime updates etc.