| 1 |
-----BEGIN PGP SIGNED MESSAGE----- |
| 2 |
Hash: SHA1 |
| 3 |
|
| 4 |
On Saturday 25 September 2004 19:35, Ciaran McCreesh wrote: |
| 5 |
> On Sat, 25 Sep 2004 19:26:26 +0200 Bart Lauwers <blauwers@g.o> |
| 6 |
> |
| 7 |
> wrote: |
| 8 |
> | 1) Safety is important, it should be our aim to have our |
| 9 |
> | default system as secure as it possibly could be. |
| 10 |
> |
| 11 |
> Uh, no. A *reasonable* level of security is good. "As secure as it |
| 12 |
> possibly could be" means turning on grsec, selinux etc in maximum |
| 13 |
> security mode, which makes a box unusable unless you spend a lot of |
| 14 |
> time screwing around with things. Nothing wrong with that under certain |
| 15 |
> circumstances, of course, but it should *not* be a default. |
| 16 |
|
| 17 |
As in how do you reason it would? You mean some things are not practically |
| 18 |
feasable? Well I agree on that (did you read as far down as the |
| 19 |
proposal?).... these things you name do not work with everything obviously |
| 20 |
and so these things just aren't possible yet for out of the box deployment, |
| 21 |
|
| 22 |
> | 3) A good housefather does not leave the front door of any home open |
| 23 |
> | at night. |
| 24 |
> |
| 25 |
> There is a difference between leaving the front door open and installing |
| 26 |
> fifty seven locks on the door. |
| 27 |
|
| 28 |
Yes, but this isn't 57 locks tho... |
| 29 |
|
| 30 |
> | Anyone who thinks that a speed tradeoff is too much for better |
| 31 |
> | protection is crazy. Do us all a favor and play a go night of russian |
| 32 |
> | roulette by yourself to get your thrills. |
| 33 |
> |
| 34 |
> You could equally say that anyone who is prepared to take a nasty |
| 35 |
> performance hit for possible slight damage mitigation is paranoid. There |
| 36 |
> is a huge difference between "not using ssp" and "playing russian |
| 37 |
> roulette". |
| 38 |
> |
| 39 |
> I kinda wonder about the security FUD certain people are spreading... |
| 40 |
|
| 41 |
Yes I expected as much based on what I had read and I wonder about the |
| 42 |
ignorance and pretention of some people. You don't want security fine, turn |
| 43 |
it off. In the meanwhile make it easier for the consumers of our distro. It's |
| 44 |
time someone speaks out for the user! Frankly, I am tired of all these one |
| 45 |
offs and lets implement xyz useless feature discussions. This will help |
| 46 |
people, it will help businesses and as a consequence it will most definitly |
| 47 |
help Gentoo. Heck, it helps everyone except maybe you. |
| 48 |
|
| 49 |
On the matter of the russian roulette, it is no different, computers without |
| 50 |
a security policy are a disaster waiting to happen and the risk could cost |
| 51 |
someone their life (not in all uses of a computer granted). Both are loosing |
| 52 |
propositions. You cannot proof read all the code you put into a distro so |
| 53 |
you need better ways to attain an acceptable level of protection. |
| 54 |
|
| 55 |
If nothing more then this measure would give the us the time to think of |
| 56 |
better solutions instead of chasing after moving targets. |
| 57 |
|
| 58 |
Bart. |
| 59 |
-----BEGIN PGP SIGNATURE----- |
| 60 |
Version: GnuPG v1.2.4 (GNU/Linux) |
| 61 |
|
| 62 |
iD8DBQFBVeY7BmJog5qpEKkRAl2SAJ93vZ52wbC7MHfpIvH4/9rc+b/D3QCeOxoZ |
| 63 |
mPouCFUVz83XN+T756a86lQ= |
| 64 |
=MsmO |
| 65 |
-----END PGP SIGNATURE----- |
| 66 |
|
| 67 |
-- |
| 68 |
gentoo-dev@g.o mailing list |
Archives