webserver sibboleth file
SSH: use RekeyLimit
Feature newly available in OpenSSH 6.3
PHP: only secure cookies
-session.use_only_cookies is so important it's even enabled by default in PHP now. Why was this ever unset?
chromium: ditch google, use duckduckgo
for some reason, requires generating sqlite from the PKGBUILD with a cryptic "version" set to 51. we will see if that number needs to change later.
duckduckgo search: no safe search, no favicons