Re: Security

On 5/12/23 16:08, Jonathan Hutchins wrote:
> Here's hoping that this message is not lost in the flood of 
> potentially thousands of read notifications to your mailing list 
> post.  Hope you learned your lesson on that.


I appreciate your concern that your message might have gotten lost. 
There aren't a lot of active readers on this list.

>
> These days "security" seems to consist of installing and enabling 
> every item you can find that's labeled "security".  A huge amount of 
> it is pure waste, addressing mythical scenarios that no ordinary user 
> will ever encounter.

I'm not talking about ordinary users. I'm talking about people who might 
manage fewer than 10 machines.


>
> Real security comes from correctly analyzing your actual threat 
> profile, and carefully addressing real vulnerabilities, rather than a 
> shotgun approach that misses as much as it hits.
>
> That said, here's my own favorite treatise on server security.  A bit 
> dated, RedHat oriented, and probably not generic to your own purposes.
>
>    http://www.trinityos.com/LINUX/index-linux.html
>
>
> Best of luck,

Thanks for the advice.

So far, this official Debian list is in line with my expectations. For 
every 1 person on a Debian list, there are 10 who will tell you it's a 
waste of time. So far, the best "stop wasting our time" line is that 
Debian is unlikely to want to write about a package that's not in one of 
the repositories (e.g. webmin)

It's why I posted the question as I did.

Cheers,
jec