freebsd security - Jul 2016 - FreeBSD - a lesson in poor defaults?

On 13.7.2016 9:38, Steve Clement wrote:
> https://vez.mrsk.me/freebsd-defaults.txt
This document is based on premise I can't agree with. I will not dispute 
each argument in the document, but there are two main ideas.

Features compiled in and features turned on by default.

According features compiled in ...

I'm administrator responsible for a computer configuration.

If OpenSSH devs have publicly said threads are too risky and won't be 
added, I'm hearing their opinion and taking them seriously, but final 
decision shall be mine.

I wish I will be allowed to decide I wish to use threads, NONE cipher 
and so on.

In short, no features should be removed/disabled at compiled time 
because if "security" (assuming the "insecure" feature can
be disabled
by  configuration).

According features turned on by default ...

To say true, I don't care them so much. Performance, backward 
compatibility and security require trade offs all the time. There are no 
generic answers.

I assume the virgin installed system will be ready to be remotely 
configured (e.g. sshd running, no firewall).

Particular system needs to be tuned according local environment, goal 
and requirements. Thus I don't care install-time defaults so much.


Just $0.02 ...

Dan

By default, IMHO, a system should resist a standard install on a public ip
address without being owned within the hour.

If you need hardening, you should always check and know your system.
Especially if something says ?secure by default?.
Wonder how HardenedBSD is doing these days? https://wiki.freebsd.org/Hardening

You do want to protect your basic users from themselves to a certain extent.

The SSL mess is a mess, but libreSSL hasn?t been spared either.

Nevertheless I am sure that the Core Security team is having regular discussions
on some defaults.

If we can assume that this About blob from the FreeBSD site is it?s mission
statement:

???? https://www.freebsd.org/about.html
What is FreeBSD?
FreeBSD is an operating system for a variety of platforms which focuses on
features, speed, and stability. It is derived from BSD, the version of UNIX?
developed at the University of California, Berkeley. It is developed and
maintained by a large community.
????

The rant is not that justified baring in mind the versatility of FreeBSD.

Sincerely,

Steve

> On 13 Jul 2016, at 10:57, Dan Lukes <dan at obluda.cz> wrote:
> 
> Particular system needs to be tuned according local environment, goal and
requirements. Thus I don't care install-time defaults so much.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 842 bytes
Desc: Message signed with OpenPGP using GPGMail
URL:
<http://lists.freebsd.org/pipermail/freebsd-security/attachments/20160713/0a4a161d/attachment.sig>