tcpcryptd should be enabled by default for security.

[spacekitteh]

So, as part of the hardening process of NixOS, I think tcpcryptd should be enabled by default - it encrypts TCP connections if it's talking to another tcpcryptd-enabled server, otherwise it falls back to standard TCP connections.

[teh]

I think tcpcryptd is a fantastic idea in principle but I'm -1 on enable-by-default. IMHO daemons that rewrite network traffic to that extend should be opt-in (principle of least surprise).

On top of that I'm not convinced that exposing another daemon written in c to the Internet is a great idea :)

[langston-barrett]

Can we close this? Seems to be majority-against.

[globin]

I don't see this getting general support and it is easy enough to enable, with e.g. nixops especially for multiple machines.