4 ms·
Perhaps OP means they want to be able to turn on a setting whereby this automatically happens when a big zero day comes out - like, Canonical becomes aware that
by doubleunplussed 10y ago
Perhaps OP means they want to be able to turn on a setting whereby this automatically happens when a big zero day comes out - like, Canonical becomes aware that certain packages are vulnerable and has a way of pushing instructions to affected machines to tell them to isolate themselves.
- 3pt14159 10y agoIt's silly I even have to type this out, but I'm clearly aware of sudo shutdown now, and it isn't helpful. 1. I want the system to progressively fallback to more aggressive measures. Don't lock me out of ssh just because nginx has a 0day. Don't take out my static file hosting if there's just a rails vulnerability. This is the type of stuff I don't want to think about I just want to set my paranoia level. 2. Of course I know how to shutdown a server immediately, but knowing when to do a hard shutdown vs one that waits for the processes to clean up isn't something I feel qualified to make a decision on. I don't understand why usability around security is so brutal. How many times are we going to get locked out of our ssh because of a shitty chown. How many times are our servers going to get hacked and our DBs dumped just because admins and software developers don't have the tools to confidently mitigate 0days? Just make it easy for me.