Re: Security

Jeremy Stanley <[email protected]> Sat, 13 May 2023 03:15:49 +0000

Newsgroups	gmane.linux.debian.devel.security
Message-ID	<[email protected]>

On 2023-05-12 16:27:59 -0700 (-0700), Jeffrey Chimene wrote:
[...]
> So far, this official Debian list is in line with my expectations.
> For every 1 person on a Debian list, there are 10 who will tell
> you it's a waste of time. So far, the best "stop wasting our time"
> line is that Debian is unlikely to want to write about a package
> that's not in one of the repositories
[...]

Debian is, first and foremost, a software distribution, so it makes
sense that Debian documentation would focus on software that is
actually packaged in Debian. For example, you brought up HIDS: there
are several options for this already in the distribution. I've
personally used tiger, lynis and iwatch for HIDS purposes in a
professional syadmin capacity, and I can safely install them through
Debian's own cryptographically signed chain of trust.

Ideally, Debian can be secured with the software available in
Debian, but it also simply doesn't make sense (to me) for Debian to
recommend software it doesn't provide instead of providing that
software or otherwise recommending alternatives which someone has
put in the effort to get into the distribution. I don't consider
discussion of these topics to be a waste of time, but there are
plenty of places to publish articles about arbitrary software useful
to sysadmins where it might be more on topic and reach a wider
audience.
-- 
Jeremy Stanley

signature.asc (application/pgp-signature, 963 B)