Since Ubuntu doesn’t come with a firewall enabled by default, your postfix server is listening on all interfaces for mail immediately. The mynetworks configuration should prevent relaying, but any potential vulnerabilities in your postfix daemon are exposed to the network without your consent. I would prefer to configure postfix first before I ever allow it to run on my server
Technically, if security is your focus, then shouldn't one of your first actions after setting up a new machine be to set iptables default action to drop all incoming new,invalid packets anyway?
I mean, I generally install server with nothing. Set up iptables. Then install packages and open ports.
> Technically, if security is your focus, then shouldn't one of your first actions after setting up a new machine be to set iptables default action to drop all incoming new,invalid packets anyway?
But why expect the user to do that themselves? Shouldn't security be the default, with a secure configuration provided out of the box?
Giving the user a secure configuration which they can then opt out of if they wish does better by the user than giving them an insecure configuration and then asking them to opt in to security does.
If the user can't do that, then the user is not going to have the chops to configure Postfix anyway.
Seriously, Debian is the upstream distro does this, and it's the other linux grandparent with RHEL. It's been around for decades, used in production the same way RHEL and BSD are, and we haven't had debian-based boxes compromised left, right, and centre with these 'insecure' defaults. The threat is imaginary, and not born out in real world numbers.
And that indeed is what we have to look forward to in online forums over the next 5+ years, as machine learning cuts its teeth on places like reddit, HN & disqus, and spammers try to find new irritating ways of getting eyeballs.
Yeah, but I still wonder how often people copy comments around like that. It's not like that was some great writing or anything, but it was copied word for word.
I've seen it happen on YouTube (not to me); highly upvoted comments get copy/pasted a month or two later to "steal" upvotes for someone else.
It could be a bot tactic to build accounts with karma that can later be used for astroturfing, using proven comments from elsewhere. Maybe governments and organized astroturfers have automated that sort of thing more than we think.
Reddit reminds me of the Google, Don't be evil bullshit mantra with shenanigans like this almost every week. I understand the fucking "monetize, grow, and get bought out" mentality that every web business adopts, but it is pathetic when it comes to places founded by guys like Swartz.
Technically, if security is your focus, then shouldn't one of your first actions after setting up a new machine be to set iptables default action to drop all incoming new,invalid packets anyway? I mean, I generally install server with nothing. Set up iptables. Then install packages and open ports.