3 ms·
It works both ways. The OpenBSD developers know that their users take security seriously, over convenience and just-works installers. So it's a safe bet that
by quesera 4y ago
It works both ways.
The OpenBSD developers know that their users take security seriously, over convenience and just-works installers.
So it's a safe bet that OpenBSD users will take the few extra (well-documented) manual steps to encrypt their storage devices, leaving the developers to focus on things that are not easy for users to do for themselves.
Adding the convenience to the interactive installer is clearly a good thing, but it would not be at the tippy-top of the priority list if you have limited funding and developer time.
- YPPH 4y agoI mean, is that not like saying that a user will RTFM and disable all unnecessary services after their install? The OpenBSD mentality is the opposite - they will sacrifice convenience and disable all unnecessary services by default, in order to make the system as secure as possible, and you can go RTFM and knowingly increase your risk if you choose to. That mentality would suggest, I think, disk encryption should be opt-out on the install. Of course, the first step to getting there is an opt-in system.
- quesera 4y agoIt is, yes. It definitely works both ways. In this case (disk encryption) the process is simple, but the data collection and then things like back/fwd, changes, accept etc.. makes it more complicated than a simple boolean/checkbox. So the compromise was "bounce to the docs for this one", until this new improvement was added.