Re: [tlug] remote

[Matt Doughty <mdoughty@example.com>]

On Thu, Jun 27, 2002 at 09:04:27AM -0400, Josh Glover wrote:
> 
> >As for that ridiculous claim about the default install. Dude they 
> >basically turn
> >off all services in the default install [...]
> 
> I will not argue that Open has its shortcomings, but I *like* the way a 
> default install is carried out. When *I* do a Redhat install, for 
> instance, the first thing I do (before even plugging eth0 in, thank you) 
> is hunting down and disabling or uninstalling all the crap that runs by 
> default. I would rather, a la OpenBSD or Gentoo (there are others, these 
> are just the two I am most familiar with), add just what I need and not 
> have to worry that I missed something.

Others like NetBSD maybe? You know where you have to turn everything on
explicitly.  Anyone can and should do this for the default install, but
only Open sits around and pats themselves on the back for doing what
only amounts to good sense.  It good that they do the right thing, but
they aren't the only ones. You have just manage to nail one of my 
chief gripes with RedHat.

> 
> >and then say "no remote exploit in blablabla".  Their record isn't
> >any better than just about anybody elses.
> 
> This is debatable. The OpenBSD team in general and Theo in particular 
> *have* done a lot for the Open Source community. Their code audits have 
> turned up quite a few things that people have been able to fix proactively.

True, they also have a history of not resubmitting their patches to 
upstream developers. I recall that Theo was of the opinion that 
the upstream developers should have to check the OpenBSD CVS for
fixes. Still no one will argue that the auditing is a bad thing.
> 
> The catch is, of course, that Theo has brought quite a bit of 'tude 
> along with him. And we are not talking about the reasonable, 
> constructive type of attitude.[1] We are talking about plain nastiness 
> and general antisocial behaviour. Read the archive of the mails that 
> flew back and forth between Theo and NetBSD core right after Theo got 
> the boot from core and got his CVS access revoked.[2] I did, and even 
> presented from Theo's point of view, he comes away looking bad.
> 
> >No you have to go through the trouble of downloading a tarball, and 
> >compiling it.
> >Life is difficult.  As is I have had to upgrade my boxes once in the last 
> >year, and
> >the bug wasn't even exploitable on my boxen I just did it because it only 
> >took like 15 minutes.
> 
> Which SSH do you use? I am trying to get away from OpenSSH on my stuff. 
> Just too scary recently!
> 
> 

I use the ssh from ssh.com. It works like a charm for me, and I have had
no problems at all with it.

--Matt