Hi, On Friday, 1 March 2024 20:46:49 CET Holger Wansing wrote: > Philip Hands <p...@hands.com> wrote (Fri, 01 Mar 2024 06:46:27 +0100): > > If you want to make a constructive contribution, how about suggesting a > > wording that reflects the advice that you think would be most useful to > > the people that actually read the advice? > > I would like to make a proposal, leaving the default setting as is > (aka: default to an enabled root account, no sudo), with only some wording > changings. > > Patch attached. > > What do you think?
I think it's an improvement and I have some suggestions, which hopefully makes it even better. I don't have a git-diff, but hopefully this works too. I'm not a native English speaker or particularly good at this, so it's more the direction then the exact wording that's important. Others can undoubtedly improve upon it. _Description: Root password: "You need to set a password for 'root', the system administrative account. The 'root' user has full control over the whole system, so it's extra important to protect it with a strong password. A strong password is usually a sentence, consisting of words not commonly found together in natural language. And not easily associated with you."* *) Not sure if there's room for it, but examples often help: 1) That's a battery staple? Correct! 2) Margaret Thatcher is 110% sexy ad 1) xkcd 936 ad 2) An example Edward Snowden gave in an interview (with Vice?) Why? - We need to get rid of the *word* part; making it long (via a sentence) is the easiest way to make it stronger. I don't know if passphrase is (technically) correct or easily understood though. - "A malicious or unqualified user ... can have disastrous results" I think it doesn't add useful or correct info as a benign qualified 'root' user making an error and can also wreak havoc. (A good password doesn't prevent that though) - A memorable password or passphrase can (always?) be guessed; the goal is to make it as hard as possible. - "It should not be a word found in dictionaries" I know where it comes from, but it's not helpful. And it gives the impression it should be a single word. A 'normal' dictionary contains a LOT of words and saying you can't use any of them makes it almost impossible for the user to make a good password/passphrase. That they can remember. I haven't verified it, but I'm guessing the words from Diceware Word List are all present in the 'normal' dictionary? "Note that you will not see the password in clear text as you type it, except if you explicitly choose to show it." You *are* able to see the plain text password, just not by default. HTH, Diederik
signature.asc
Description: This is a digitally signed message part.
