[CentOS] Another Fedora decision

[Valeri Galtsev]

On Tue, February 3, 2015 12:39 pm, Les Mikesell wrote:
> On Tue, Feb 3, 2015 at 12:24 PM, Valeri Galtsev
> <galtsev at kicp.uchicago.edu> wrote:
>>
>> Sounds so I almost have to feel shame for securing my boxes no matter
>> what
>> job vendor did ;-)
>
> Yes, computers and the way people access them are pretty much a
> commodity now.  If you are spending time building something exotic for
> a common purpose, isn't that a waste?

Do I have to take that people who are not sysadmins themselves just hate
an existence of sysadmins?

>
>> Just a simple example: I have at least 3 classes of boxes configured
>> ultimately different and having very different level of
>> security/fortification. Do you seriously suggest that system vendor will
>> ship all three level of security configurations?
>
> Yes, 3 seems about right.
>
>> Do you seriously think
>> that needing quite high level of security for some box I will not go
>> over
>> all settings influencing it myself? Will you not?
>
> Of course, but only because the vendor does not do it.  I think Red
> Hat's engineers are capable of it if they wanted to.

Here is the difference between us. I refuse to trust something ultimately
important which I can check or tune without checking (and tuning if
necessary). It will be my laziness. Note, that that I apply to myself.
What you do is up to you (and you bear consequences of your decision, and
I bare consequences oi mine).

>
>> We are not Windows
>> admins, we rely on what we configure or check ourselves.
>
> Not sure what you mean by that.  Windows is much worse since the
> configurations tend to be hidden and the ways to do things
> interactively and scripted are wildly different.
>
>> Yet, I'm sure, majority Unix sysadmins will still do what I do: go over
>> everything themselves. No matter what someone says.
>
> There are probably still people that take their cars apart to check
> that they were assembled correctly too.  But that doesn't mean that
> things should not be shipped with usable defaults.
>

No, I'm not the driver of my cars, I mean computers. I am a mechanic of
racing car competition team, my cars go into competition, and the life of
driver riding it depends on me having taken the whole mechanism apart, and
making sure nothing breaks and kills driver and hundreds of spectators.

I really hate these car analogies. They are counter-productive. In your
eyes my server is indeed a commodity, which I refuse to agree with pretty
much like I refuse to join ipad generation. My ipad would be commodity,
but I for one will never trust that ipad and will not originate connection
to secure box from it.

Valeri

++++++++++++++++++++++++++++++++++++++++
Valeri Galtsev
Sr System Administrator
Department of Astronomy and Astrophysics
Kavli Institute for Cosmological Physics
University of Chicago
Phone: 773-702-4247
++++++++++++++++++++++++++++++++++++++++