A box under development can and will have all sorts of terribly insecure behavior. It shouldn't be on the internet. I'm not saying you "lose" anything by trying to secure it, I'm saying that you already "lost the [security] game" when you put the box on the unfiltered internet in the first place. Your goal should be limiting exposure when it is compromised, not trying to lock down hatches on a leaky hull.
Specifically: dickering over whether or not to make screen suid root on your dev boxes is an exercise in needless optimization.
Comments
If my development server is exposed to the Internet and I do something like disable root logins in ssh, why/what have I 'lost?'
A box under development can and will have all sorts of terribly insecure behavior. It shouldn't be on the internet. I'm not saying you "lose" anything by trying to secure it, I'm saying that you already "lost the [security] game" when you put the box on the unfiltered internet in the first place. Your goal should be limiting exposure when it is compromised, not trying to lock down hatches on a leaky hull.
Specifically: dickering over whether or not to make screen suid root on your dev boxes is an exercise in needless optimization.
> Your goal should be limiting exposure when it is compromised, not trying to lock down hatches on a leaky hull.
But isn't running applications only as regular users just that, limiting exposure?