3 ms·
You make a good point. FSS isn't an IDS, it's a metric to be used by an IDS. However, that raises the question of what the hell it's doing in the init system,
by steventhedev 12y ago
You make a good point. FSS isn't an IDS, it's a metric to be used by an IDS.
However, that raises the question of what the hell it's doing in the init system, and not implemented by the IDS. That's a SOLID violation.
- angersock 12y agoIt would appear that systemd left behind SOLID engineering principles a long time ago.
- louwrentius 12y agoThis is EXACTLY my complaint.
- teddyh 12y ago“Security” is not something you can relegate to an IDS. Security must be embedded in each program from the start.
- steventhedev 12y ago> Security must be embedded in each program from the start. Agreed. Wholeheartedly. However, the way most of us interpret that bit of conventional wisdom is that security should be added to existing features, for example, by cleansing user input and not passing on tainted input (shellshock is a classic example of this, in the vein of a system-based XSS vuln). It does not mean that we should develop "security" features as addons to existing systems. In this case, they use an untested cryptographic primitive (SSKG) which was published by Poettering's brother almost a year after the feature landed. That's negligent and reeks of nepotism. I wouldn't recommend that any sysadmin use this feature in a security context (there are existing security products that provide log-signing, with security notifications and patches).
- tadfisher 12y agoThe answer to that is that systemd is much more than an init system.