reasonable defaults are way better, or you'd end up with something like SELinux where nothing works out of the box