News for hackers. Stuff that matters.
Re:Linux Hardening Guide by BelenusMordred on Thursday December 31, 2020 @03:26AM (#25590730)
Would you honestly say systemd is the most secure init system when writing your own "Linux Hardening Guide"?

That's a big call to make in such a context.

Re:Linux Hardening Guide by lclarkmichalek on Thursday December 31, 2020 @05:56AM (#25591573)
Yeah probably. Its support for easily configuring daemons to run under dynamic users, with private tmp, lesser capabilities, read only root, etc etc makes it quite attractive.

Even more attractive if you’re writing a blog post about hardening Linux against ill specified ill specified threats. Writing a bunch of config files to “lock down” random daemons seems like it’d be right up this guy’s alley

Re:Linux Hardening Guide by Sebguer on Thursday December 31, 2020 @04:02AM (#25590938)
Would you say Gentoo is the most secure distribution to use when writing yours?
Re:Linux Hardening Guide by BelenusMordred on Thursday December 31, 2020 @06:10AM (#25591635)
No, I wouldn't. Qubes likely has the most security features out of the box without configuration for the average person trying to lock down their computer. BSD and Arch-flavours certainly have plenty going for them though and I wouldn't speak badly of their intent+outcomes.
Re:Linux Hardening Guide by Foxboron on Thursday December 31, 2020 @09:17AM (#25592842)
systemd has a strong track record of finding and fixing security issues and getting the CVE published. This is important if you want to consider "secure software" and getting things resolved in a timely manner.

People focus on the attack surface, but most of it is local exploits where the threat model is "someone has shell on your box".

Re:Linux Hardening Guide by chris_wot on Thursday December 31, 2020 @10:09PM (#25600456)
Are you saying that you can’t harden systemd and reduce its attack surface?