Yo Daniel! On Fri, 30 Sep 2016 15:46:49 -0400 Daniel Franke <[email protected]> wrote:
> On 9/30/16, Gary E. Miller <[email protected]> wrote: > > So any upward extensible is fine, but trivial back-compatibility is > > essential. > > So what do you propose? I'm not there yet I do not graps what you are proposing yet to counter in detail. > We currently have insecure defaults. Yes. But even though the NTPsec defaults are the same as NTP Classic defaults the NTPsec implementation is still more secure. Let not the best be the enemy of better. > This must > change, and *tautologically*, such a change necessarily involves > breaking backward compatibility somewhere. Or rather: sometime. I would add upward compatible keywords that add more security, and warnings to encourage people to change their ntp.conf for the better. Only after critical usership is gained would I start to impose on users by default. Even if NTPsec is great, if the effort to convert from ne daemon to another is more than very sight, users will not change. Sort like giving people a free trial of soemthing, then after they get complacent yyyou stick it to them. :-) > I am proposing what I think > is smallest and least invasive of all possible changes which achieve > secure defaults. Do you disagree with this judgement? Yeah. Imposing security will fail. Encouraging security may succeed. Users do not particularly like software that acts superior to them. RGDS GARY --------------------------------------------------------------------------- Gary E. Miller Rellim 109 NW Wilmington Ave., Suite E, Bend, OR 97703 [email protected] Tel:+1 541 382 8588
pgpzFXFOlLdmt.pgp
Description: OpenPGP digital signature
_______________________________________________ devel mailing list [email protected] http://lists.ntpsec.org/mailman/listinfo/devel
