4 ms·
"there's literally no good reason (besides laziness) to leave sshd exposed to the public internet." Well, besides the fact that it's a whole lot more convenien
by sailormoon 17y ago
"there's literally no good reason (besides laziness) to leave sshd exposed to the public internet."
Well, besides the fact that it's a whole lot more convenient to just be able to ssh into somewhere without frigging around with VPN or what not. For most businesses, I would say having accessible ssh (with good passwords, and a properly set up, up-to-date system) is fine.
But yeah, for a "security" business .. it's pretty surprising they let it hang out like that. And on port 22 and the www domain, too .. tsk tsk.
- pavs 17y agoSecurity is not supposed to be convenient. If there is an option between a convenient way to do something and an inconvenient (but much secure) way to do the same thing. You should do it the inconvenient way, specially if you make a living in security.
- gchpaco 17y agoSo I'm guessing you mail hard drives around, rather than use the net 'cause somebody might have cracked sshd or OpenSSL? Wait, you don't? Gee.
- jimmybot 17y agoI agree with your point, but I do want to point out that mail theft (by postal workers, errant receivers, and malicious thieves) is not so uncommon. I have had a few things mailed without tracking numbers that I strongly suspect were stolen (mailed from post offices with complaints of theft or undelivered mail).
- khafra 17y agoIf you're at home, running OpenBSD on your own computer, then security can be inconvenient as you want it. But if you run security for a business, you have to balance confidentiality and integrity with availability (and sometimes some other concerns). Shell access from the internet could be important to availability--obviously, this was the wrong way to do it, but it wasn't a wrong objective.