Hacker News Reader

Comment by moviuro | Hacker News Reader

First "tip" is to regularly disable the firewall. This is stupid and dangerous.

I do the following on my machines:

  # cp /etc/pf.conf /etc/pf.conf.good
  # crontab -e
  */5 * * * * /sbin/pfctl -f /etc/pf.conf.good
  :x
  # #now vi /etc/pf.conf; pfctl -f /etc/pf.conf; and if OK: cp /etc/pf.conf /etc/pf.conf.good

View on HN

... especially since the tip is immediately followed by an explanation of how the author backs up a known good configuration file. The recovery mechanism should surely be to restore that known good version, as you say.

It also seems overcomplex to use sudo from an unprivileged user's crontab rather than just straight execution of the target command from the superuser's crontab. I infer that your # prompt is implying this, too. (-:

That tip is supposed to apply just while you are learning how to use pf so you don't block yourself from your machine.

Just like suggesting `chmod 777` to have your php app work once.

Just don't recommend stupid things: make them right once and the stupid thing won't ever have to go through your mind.

Seems like a better tip would have been "Don't muck with global network settings over a ssh pipe. Use a local console, dummy".

All physical hardware has them. All hosting companies offer them via various tricks. This is why.

Reply on news.ycombinator.com