To view parent comment, click here.
To read all comments associated with this story, please click here.
I think Microsoft is doing better in this regard. If I remember correctly, the default install of Sql Server (or MSDE) used to have an SA password of blank - ripe for the picking! Fresh installs of Sql Server 2005 require a password and have network connectivity shut off until you specifically enable it. WIndows 2003 Server is also much more secure by default that 2000. However, I would still prefer a fresh install of OpenBSD.
One clarification to the article - it says OpenSSH if shutoff untill you specifically enable it. That makes it sound like you have to manually edit a file to enable it after install. The install asks if you want SSH enabled and it does it for you durng the install process (unless they have changed this in 4.1).
It's good for OpenBSD to have most services shut off by default. I guess that's a good compromise between usability and security.
In reality, the even better way to be secure by default is NOT to have any UNNEEDED applications installed in the first place.
As I said, the not-enabled-by-default approach is the best compromise between usability and security - I do want to point out that you can get even better security if tools are not installed to be exploited.






Member since:
2006-04-25
The idea is that at least you are starting with a secure base, and do not have to take action in order to make it secure. This differs from other OS's where a fresh install is not secure at all unless the administrator does *something* first. Ex: Windows 2003 requires a ton of patches after an initial install (along with turning off extra services) as the first step towards a secure system.