3 ms·

I like the concept, but I am troubled by the idea of people running cookie-cutter scripts to set up systems which are then left in charge of real-world anonymit

by serf 12y ago

I like the concept, but I am troubled by the idea of people running cookie-cutter scripts to set up systems which are then left in charge of real-world anonymity. Could the suite of things installed by this software package be used as a profiling vector in the future? How could that be avoided if so? I know that your userbase is slim now and mass profiling probably doesn't apply yet, but it's something to consider. Are the installed defaults known to be sane and secure? That's another huge worry when the configuration is taken out of my hands initially. Sorry for the worrisome comments. I like the idea,

fdsary 12y ago
On the other hand, when everyone does it by hand every time, it's easy to make mistakes and bad design decisions. When it's a distribution, we can all contribute bug fixes. Security vs obscurity is bad!
jlund 12y ago
No problem. I totally understand. I intentionally made it really easy to override the default values that I chose for port numbers. It wouldn't be difficult to mix those up in the future, if necessary. I did my very best to make sure that I was configuring things in a secure way. My approach to installing OpenVPN involves several additional steps that harden its security, like setting up an HMAC firewall and changing the default cipher from Blowfish to AES, for example. I take this seriously and I want to do it right. I'm looking forward to getting contributions from the community too. I think that automation has the potential to significantly increase security because painful tasks that might be tempting to skip when someone is setting things up by hand can become painless. In an ideal world every task can be performed correctly and repeatedly. I also did my best to fully document every single action that is taken. You can see what is happening at at all times throughout the process. Ansible's syntax is also very readable, so you can examine the steps before you run anything too. I am optimistic that things will only get better :)
kordless 12y ago
Given the server starts were anonymous, your issues around profiling disappear: https://github.com/StackMonkey/utter-va#welcome-to-utterio-and-stackmonkey https://github.com/StackMonkey/utter-va#welcome-to-utterio-a...

by serf 12y ago

fdsary 12y ago

On the other hand, when everyone does it by hand every time, it's easy to make mistakes and bad design decisions. When it's a distribution, we can all contribute bug fixes. Security vs obscurity is bad!

jlund 12y ago

No problem. I totally understand. I intentionally made it really easy to override the default values that I chose for port numbers. It wouldn't be difficult to mix those up in the future, if necessary. I did my very best to make sure that I was configuring things in a secure way. My approach to installing OpenVPN involves several additional steps that harden its security, like setting up an HMAC firewall and changing the default cipher from Blowfish to AES, for example. I take this seriously and I want to do it right. I'm looking forward to getting contributions from the community too. I think that automation has the potential to significantly increase security because painful tasks that might be tempting to skip when someone is setting things up by hand can become painless. In an ideal world every task can be performed correctly and repeatedly. I also did my best to fully document every single action that is taken. You can see what is happening at at all times throughout the process. Ansible's syntax is also very readable, so you can examine the steps before you run anything too. I am optimistic that things will only get better :)

kordless 12y ago

Given the server starts were anonymous, your issues around profiling disappear: https://github.com/StackMonkey/utter-va#welcome-to-utterio-and-stackmonkey https://github.com/StackMonkey/utter-va#welcome-to-utterio-a...