Shawn Walker wrote: > On 13/09/2007, Dave Miner <Dave.Miner at sun.com> wrote: >> Glynn Foster wrote: >>> David.Comay at Sun.COM wrote: >>>>> Note that whatever is on the live CD get's installed on the target system. >>>>> Therefore SUNWsshr and SUNWsshu are required. Telnet I would like drop >>>>> entirely. >>>> Good point. Yes, assuming the Live CD and the Install CD are one and >>>> the same (which they are for the moment), then including the SSH server >>>> packages makes sense for post-installation administration. However, >>>> I'm dubious about the others. >>> I agree - I think most people wanting to use it for a server install will >>> have >>> their own defined set of packages that we won't be able to predict as >>> easily, so >>> we might as well go for the common case of useful default packages from a >>> client >>> point of view. >>> >> Sure, but I'm not sure we need to be in quite such a hurry to toss out >> telnet; last I knew, Windows didn't include an ssh client or server - >> has that changed? > > Right, but maybe the better reason to exclude telnet is to show that > we consider security important and that no one in their right minds > should be using Telnet unless they know what they're doing. To me, > telnet is a perfect example of a package that should be optional, and > left out by default. > > While I don't agree with all of the choices the OpenBSD project has > made, I think that a proactive focus on security could only help (with > reasonable compromises and balance of course). >
I'm somewhat skeptical that the average user is going to understand the message you're trying to send, but even so, it seems the same would be accomplished with less inconvenience for those who do "know what they're doing" by merely including it and disabling it by default. Dave
