Personally I believe that a distribution should be kept as close to vanilla as possible (with the occasional patch if something is _really_ required), it should be making the life of the user simple (so using well written/designed GUI tools to do the job is not a problem – even though I don’t want to get overbogged by GUI apps, sometimes CLI is just much easier), and it should use the latest technologies to make an all in one desktop, and that definitely means that if proprietary software needs to be included, then so be it. We need to use our computers to complete our work, not to turn it on and be lacking something. The reason we started using computers is because of the way it helped us achieve our goals, and as a bonus we received a wonderful world to learn from.

- Jon

So far as I can tell, dcrod does not use /etc/cron.{allow,deny}

What RedHat does to the Mozilla based browsers is another extremely annoying example: if you launch a browser on a remote machine, the !*&$%^! RedHat-version browser code has been munged actually to launch a browser on your desktop rather than the machine you thought you launched it on.

So when you’re logged in to an Altix server hundreds of miles away, and you attempt to look at the HTML compiler documentation located there, your “firefox file:/opt/compiler-vendor/docs/index.html” command on the remote machine _actually_ launches a browser on your desktop, and of course “/opt/compiler-vendor/docs/index.html” doesn’t exist there. It’s RedHat who has munged the browser source this way (I’ve got the bugzilla bug around here somewhere…), as you can verify by downloading the source directly from Mozilla, and comparing.

And this for an allegedly-server operating system on a clearly-server always-headless Itanium machine! Doesn’t meet my laugh test for “server OS”.

Also very interesting about cron. I always prefer the distro to stick with upstream as closely as possible unless it enhances the product, such as Apache as mentioned above.

Also, lesson learned from libssl when the random number generator was destroyed.

At my workplace we never use cron on our Macs and schedule everything thought launchd.

/me unchecks “Authenticate this comment using OpenID.” because it always always always fails

Now, for the record, I don’t care if Debian deviates… much. Debian is an operating system. Sometimes, I think those in the Free Software and GNU/Linux world forget that. Operating systems are free to make the changes necessary for their platform as they see fit. Those changes will likely either make users happy and make the operating system popular, like Ubuntu, or they won’t be good changes, and likely will lose users, like, well, Gentoo (sorry guys, but you have seen better days). I’m all for changes that are thought out and that bring obvious or non-obvious benefits. For example, Debian Squeeze moving away from System V Init to Upstart.

And further…

But, when breaking from standard practice is called into question, I’m glad Debian sticks as close to upstream as possible. I understand the need for patches where appropriate, but I would prefer as vanilla as possible so I’m not a fish out of water when I need to move to another operating system that is deploying the same technology. At least from that point I’ll be able to see the changes the new system is making.

I think it’s quite clear that I’m not blindly accepting whatever upstream decides to do. I’ve recognized where patches are appropriate and I’ve mentioned why I prefer to keep things as clean as possible. Seems to be quite obvious.

Lastly, the post isn’t about the security of users on the system. Not at all. The post is about if Debian is patching default behavior or not. I know how to restrict users from installing cron jobs, and many other aspects of the system.

So, maybe you should read the entire post before commenting.

The purpose of an operation system — or distribution if you like — is to provide a uniform and tested environment, and it is the privilege of the developers to define how the individual components should be configured to be consistent with the philosophy they’ve chosen.

So, if that philosophy is that you need to do something special to restrict users from doing something, then you configure the utilities to work like that, if not, you do the opposite. It depends on what character you want for the OS.

In the case of cron, I personally don’t think it’s much of a security risk, so I prefer the Debian/Ubuntu way of doing things. I generally do.