Re: svlogd and umask settings

[Vincent Danen <vdanen@linsec.ca>]

[-- Attachment #1: Type: text/plain, Size: 2331 bytes --]

* Laurent Bercot <ska-supervision@skarnet.org> [2006-09-16 11:51:09 +0200]:

> > and I'm aiming to protect dumb admins from themselves.
> 
>  I don't want to start a discussion here, or sound patronizing, but
> might I suggest you're on a wild goose chase ? ;)

No, I don't think I am.  I might be, but where's the harm, really?
Other than tending to sound, as you say, patronizing, or perhaps
elitist, I don't see the point in telling a user or customer what you're
telling me.  =)

>  Unix wasn't made to protect dumb admins from themselves. It was made
> to be used by people who know what they're doing. (And that's the
> reason why there are so many Unix problems and misconfigurations.)

Absolutely.  But that doesn't mean it can't be done differently, or more
correctly.  It certainly doesn't mean that I shouldn't bother or try and
assume a holier-than-thou "if you can't figure it out you don't deserve
to use it" attitude.  Of course, if they bugger things up even with the
little bits of properness that are implemented, it's still *their*
problem (not mine), but as a Linux distributor I'm doing my part to ease
things.

>  I have found so far that the most efficient way to write software that
> aims to ensure proper working and security of a Unix system is to set
> clear boundaries and document them: point A is the software's
> responsibility, point B is *your* responsibility as the admin and you
> should make sure it works before running the software.

Sure, but I'm not coding anything.  I'm packaging a Linux distribution.
So setting sane defaults and whatnot is part of the "job".

>  Anyway. Enough ranting.

Yeah, that's fine.  You can rant all you like, but it doesn't much
matter to me.  Others might take your elitist attitude to heart, and
that's fine (for some stuff I also share similar elitist attitudes), but
to sit back and tell people they're not smart enough to use it so I
won't bother making it any easier on them seems, well, really arrogant.

But that's ok too... it is unix after all and we are, more often than
not, elitist, arrogant, and better than the mindless sheep that use
other operating systems.  =)

-- 
{FEE30AD4 : 7F6C A60C 06C2 4811 FA1C  A2BC 2EBC 5E32 FEE3 0AD4}
mysql> SELECT * FROM users WHERE clue > 0;
Empty set (0.00sec)

[-- Attachment #2: Type: application/pgp-signature, Size: 186 bytes --]