Edd Barrett <edd@theunixzoo.co.uk> wrote:
> On Thu, May 30, 2019 at 10:00:12AM -0600, Theo de Raadt wrote:
> > It is such an amazing business-friendly but risk-ignorant pattern to
> > simply restart software that has failed.
>
> It's all configurable, so if that isn't the desired behaviour, then omit
> the `restart` line from the service description. Not restarting is the
> default.
>
> My example was just for demonstration purposes :)
That's not true. You are simply demonstrating precisely why people use
such software.
I'm just making it clear the practice of restarting-services before
determining whether the failure is exploitation related, stands 100% in
opposition to security of service deployment.
In the zeal for high-availability, insecure configuration is considered
acceptable. Wait not just acceptable, it's cheered as being state of the
art...
No comments:
Post a Comment