> You can verify that something is set, but this guarantees nothing about the things you haven't set. This is a serious problem, but it's a problem whether you

> You can verify that something is set, but this guarantees nothing about the things you haven't set. This is a serious problem, but it's a problem whether you're using a CM tool, packaging, using shell scripts, or doing nothing at all. If users are jumping in as root on random boxen, setting tunables, adding firewall rules, etc., and not capturing those changes elsewhere, it's going to bite you.