Re: numeric UIDs

[Neil Brown <neilb@suse.de>]

On Wed, 4 Aug 2010 14:32:06 -0700
David Brodbeck <brodbd@u.washington.edu> wrote:

> 
> On Aug 4, 2010, at 11:30 AM, Andy Adamson wrote:
> 
> > 
> > On Aug 4, 2010, at 1:06 PM, David Brodbeck wrote:
> > 
> >> 
> >> On Aug 3, 2010, at 7:02 PM, Trond Myklebust wrote:
> >> 
> >>> On Tue, 2010-08-03 at 18:42 -0400, J. Bruce Fields wrote:
> >>>> On Tue, Aug 03, 2010 at 06:31:15PM -0400, Trond Myklebust wrote:
> >>>>> On Tue, 2010-08-03 at 18:23 -0400, J. Bruce Fields wrote:
> >>>>>> On Tue, Aug 03, 2010 at 06:15:19PM -0400, Trond Myklebust wrote:
> >>>> 
> >>>>> 2) Why is AUTH_SYS so sacrosanct?
> >>>> 
> >>>> Because it's what almost everyone uses.
> >>> 
> >>> No. It's the _default_. ...and a really really bad default.
> >> 
> >> The problem is the only supported alternative is to set up Kerberos.  This is a lot of work, especially for established sites where it essentially requires every user to change their password during the migration.  It also creates problems with ticket expiration if you have daemons or batch jobs that need continuous access to NFS filesystems.
> > 
> > Changing passwords is a good thing - should be done on a regular basis anyway.
> 
> True, 

Not true.  Forced password changing encourages poor choice of passwords and
other poor practices.
Much better to choose a really good password and only change it when you have
reason to believe that it has been compromised, or when you get bored of the
old one.

(better still is two-factor authentication of course).

NeilBrown