News for hackers. Stuff that matters.

A comment on What I learned while securing Ubuntu (2015). Parent comment

Re:What I learned while securing Ubuntu (2015) by smacktoward on Friday June 10, 2016 @03:52PM (#11879484)
> Technically, if security is your focus, then shouldn't one of your first actions after setting up a new machine be to set iptables default action to drop all incoming new,invalid packets anyway?

But why expect the user to do that themselves? Shouldn't security be the default, with a secure configuration provided out of the box?

Giving the user a secure configuration which they can then opt out of if they wish does better by the user than giving them an insecure configuration and then asking them to opt in to security does.

[ Parent | on HN ]
Re:What I learned while securing Ubuntu (2015) by vacri on Friday June 10, 2016 @08:58PM (#11881383)
If the user can't do that, then the user is not going to have the chops to configure Postfix anyway.

Seriously, Debian is the upstream distro does this, and it's the other linux grandparent with RHEL. It's been around for decades, used in production the same way RHEL and BSD are, and we haven't had debian-based boxes compromised left, right, and centre with these 'insecure' defaults. The threat is imaginary, and not born out in real world numbers.

[ Parent | on HN ]