From owner-svn-src-all@freebsd.org Wed Feb 22 11:23:38 2017 Return-Path: Delivered-To: svn-src-all@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id DB9D1CE9EBB; Wed, 22 Feb 2017 11:23:38 +0000 (UTC) (envelope-from joel@vnode.se) Received: from smtp.opsify.se (smtp.opsify.se [185.137.191.244]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "smtp.opsify.se", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 9E995301; Wed, 22 Feb 2017 11:23:38 +0000 (UTC) (envelope-from joel@vnode.se) Received: from ymer.vnode.se (62-20-154-136-no280.tbcn.telia.com [62.20.154.136]) by smtp.opsify.se (Postfix) with ESMTPSA id 10891387234; Wed, 22 Feb 2017 12:23:36 +0100 (CET) Date: Wed, 22 Feb 2017 12:23:35 +0100 From: Joel Dahl To: =?utf-8?Q?Bart=C5=82omiej?= Rutkowski Cc: Alexey Dokuchaev , Eric Badger , src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: Re: svn commit: r314036 - head/usr.sbin/bsdinstall/scripts Message-ID: <20170222112335.GA29481@ymer.vnode.se> Mail-Followup-To: =?utf-8?Q?Bart=C5=82omiej?= Rutkowski , Alexey Dokuchaev , Eric Badger , src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org References: <201702210937.v1L9bY6V093836@repo.freebsd.org> <28a4cf5e-2edd-3e30-9ecd-817f886e9ea3@FreeBSD.org> <20170221144002.GA87822@FreeBSD.org> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: User-Agent: Mutt/1.7.2 (2016-11-26) X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Feb 2017 11:23:39 -0000 On Wed, Feb 22, 2017 at 07:56:52AM +0000, Bartłomiej Rutkowski wrote: > On Tue, Feb 21, 2017 at 2:40 PM, Alexey Dokuchaev wrote: > > > On Tue, Feb 21, 2017 at 08:34:29AM -0600, Eric Badger wrote: > > > Thanks for working on making it easier to harden FreeBSD. While > > > defaulting some of these options to "on" seem pretty harmless (e.g. > > > random_pid), others are likely to cause confusion for new and > > > experienced users alike (e.g. proc_debug. I've never used that option > > > before, so I gave it a try. It simply causes gdb to hang when attempting > > > to start a process, with no obvious indication of why). > > > > I concur. In fact, harmless knobs should probably be turned on by default > > in FreeBSD itself (i.e., without any "hardening" help from the installer), > > while more intrusive ones should be opt-in, not opt-out. > > > > ./danfe > > > > I strongly believe we should, by default, ship as secured and hardened as > possible in order to improve overall security of new users installations. > Power users will and do change the OS as they please, they most likely > don't use bsdinstall in first place, so they're not affected in any way. Sorry, I strongly disagree with that. I'm most likely a "power user" and I use bsdinstall. -- Joel