'Demo configuration' is more insecure than 'non-workable state' [LWN.net]

'Demo configuration' is more insecure than 'non-workable state'

Posted Feb 8, 2004 10:40 UTC (Sun) by eludias (subscriber, #4058)
Parent article: UserLinux Moves Forward

'Perens said that all packages should be installed in a "working state" even if it's just a demo configuration for testing'.

I prefer the 'disable all packages by default' far more from a security point of view. The demo configuration which are not even used might open sites to security holes. Yes, it's true that non-demo use would also be vulnerable, but I prefer the doctrine 'disable what you do not use'.

(Log in to post comments)

'Demo configuration' is more insecure than 'non-workable state'

Posted Feb 9, 2004 10:42 UTC (Mon) by ekj (subscriber, #1524) [Link]

That is still the wrong answer. Noone should have "installed but nonworking" software on their computer.

The correct way to secure against bugs in un-used software is not to configure it so it doesn't work. The correct way to secure against bugs in non-used software is not to install it in the first place. Seriously.

If a user says "install postgres", he should be able to expect a working installation of postgres. Second-guessing and saying "most people who have postgres installed are probably not using it, thus it's more secure if we configure it so it won't start by default" is stupid in the extreme.

Mandrake, for example, gives you a list of services you have selected you have choosen after the select packages step and say something along the lines of: "You have choosen to install the following services [list here]. There are no known security-holes in these services. Nevertheless more services running increase the risk that security-holes are present. You should only install services you intend to use. [Install selected services] [Return to packet-selection]"

If the user, after reading that says "Yes, I wan't those services", then he should get it. If Debian is typically giving lots of services they never asked for, nor where aware of running, then that is a bug. And it should be fixed, but not by crippling the service-install procedures to the point where "apt-get install postgres" does not, infact, give me a working and functional version of postgres. (postgres is choosen as a random example here)