Date: Mon, 06 Sep 1999 16:21:54 -0400 (EDT) From: Will Andrews <andrews@TECHNOLOGIST.COM> To: Brad Knowles <blk@skynet.be> Cc: freebsd-stable@FreeBSD.ORG Subject: Re: softupdates in latest build? Message-ID: <XFMail.990906162154.andrews@TECHNOLOGIST.COM> In-Reply-To: <v04205532b3f9b4bcedb9@[195.238.1.121]>
next in thread | previous in thread | raw e-mail | index | archive | help
On 06-Sep-99 Brad Knowles wrote: > I don't need to. We're violating rule #1 of Cheswick & Bellovin > -- if you don't need something, don't run it. This fact alone should > be enough to cause this feature to be disabled by default. Did I miss something, or is there a reason why FreeBSD should care about "Cheswick & Bellovin", whatever that is? > How many systems do you honestly expect to be "up-to-date" as > opposed to "out-of-the-box"? Many years of experience have taught me > that this percentage will be *very* low. Therefore, there's no > reason not to make whatever *reasonable* changes you can in order to > make the default out-of-the-box installation reasonable secure. Systems that are not "up-to-date" on security implementations are obviously not run by those who wish to keep their systems as secure as possible, and thus avoid security problems, lawsuits, and the like. > You don't have to go all super-anal-OpenBSD, but if there are > things that can be set by default to be either secure or insecure and > it doesn't make all that much difference, why not choose security? FreeBSD is intended to provide a well-tuned, general-use OS with an emphasis on servers. It is not intended to be anal retentive in the manner regarding security that DES pointed to. > Again, look at the services that get installed by default. > Plenty of places will probably never hear about ssh. Although we > don't necessarily have to have machines that automatically come up as > an ipfw "closed" system and ssh has to be part of the base install > (and the only supported method of remotely accessing the system), I > think it would behoove us to choose to be a bit more careful in those > areas where we can. The admin who cares about having his system operate as securely as he/she wants to WILL find out about what are considered general security hazards (i.e., telnetd, rshd, rlogind, etc.) and plug them up. People who setup default systems and expect them to do the same job miss the entire purpose of FreeBSD. > I have reason to believe that it is possible to sniff through > switches, at least certain types of switches. Oh boy. You're losing credibility for each and every word you send to this mailing list. Your "reason" seems to be rather unable to back itself up. > > I'll say it again. If the choices are "security" or "no > security", and otherwise it doesn't make a whole lot of difference to > how it operates out-of-the-box, then why not choose security? Some people would prefer that their FreeBSD installs not be difficult to setup so that they can make it convenient to play games, use X11, and make their system as convenient as possible to setup, configure, etc. So it comes down to this: security is a tradeoff for convenience. Say, that reminds me. Haven't I seen that phrase on these mailing lists somewhere? -- Will Andrews <andrews@technologist.com> To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-stable" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?XFMail.990906162154.andrews>