anchor.diff:  ----
   
   <1> "When "none", the core dumps will be logged but not stored permanently."
  -<2> "Setting Storage=none and ProcessSizeMax=0 disables all coredump handling except for a log entry."
  +<2> "Setting `Storage=none` and `ProcessSizeMax=0` disables all coredump handling except for a log entry."
   
   == Mounts
   
  
positive.code: 
  <1> "space-separated list of IPv4 and IPv6 addresses to use as system DNS servers."
  <2> "space-separated list of IPv4 and IPv6 addresses to use as the fallback DNS servers."
  <3> "If set to "allow-downgrade" DNSSEC validation is attempted, but if the server does not support DNSSEC properly, DNSSEC mode is automatically disabled." Should be set to `true` if possible.
  <4> "When set to "opportunistic" DNS request are attempted to send encrypted with DNS-over-TLS."
  
  === /etc/systemd/system.conf
  See https://www.freedesktop.org/software/systemd/man/systemd-system.conf.html[system.conf] and https://www.freedesktop.org/software/systemd/man/systemd.html[systemd, init].
  
negative.code: 
  === systemd-analyze and systemd_scan.sh
  
  Since `systemd` version 240, `systemd-analyze` has the https://www.freedesktop.org/software/systemd/man/systemd-analyze.html[security]
  option for analyzing the security and sandboxing settings of services in order
  to determine an exposure level value for them, indicating whether a service
  would benefit from more sand-boxing options turned on for them.
  
  https://github.com/konstruktoid/hardening/blob/master/misc/systemd_scan.sh[systemd_scan.sh]
  is a script to check the current `systemd` configuration of a local service,
  