diff --git a/openup b/openup
index 25b15a7..608db42 100755
--- a/openup
+++ b/openup
@@ -16,22 +16,26 @@
 #
 # Author: Antoine Jacoutot <antoine@mtier.org>
 
-[ -f /etc/openup.conf ] && . /etc/openup.conf
-
-##### user defined variables -- overrides are read from /etc/openup.conf
+########################################################################
+### DO NOT EDIT THIS FILE!!!                                         ###
+### User defined variables: overrides are read from /etc/openup.conf ###
+########################################################################
 # URL to the latest openup version
-OPENUP_URL="${OPENUP_URL:=https://stable.mtier.org/openup}"
+OPENUP_URL="https://stable.mtier.org/openup"
 # URL to the certificate that was used to sign the packages
-PKG_CERT_URL="${PKG_CERT_URL:=https://stable.mtier.org/mtier.cert}"
+PKG_CERT_URL="https://stable.mtier.org/mtier.cert"
 # fingerprint of the certificate that was used to sign the packages
-PKG_CERT_FPRINT="${PKG_CERT_FPRINT:=DE:29:0F:7F:B8:0E:36:5A:AF:A9:BF:E0:4E:08:C2:0F:2D:50:16:97}"
+PKG_CERT_FPRINT="DE:29:0F:7F:B8:0E:36:5A:AF:A9:BF:E0:4E:08:C2:0F:2D:50:16:97"
 # PKG_PATH for currently running OpenBSD release
-PKG_PATH_MAIN="${PKG_PATH_MAIN:=http://ftp.fr.openbsd.org/pub/OpenBSD/$(uname -r)/packages/$(arch -s)}"
+PKG_PATH_MAIN="http://ftp.fr.openbsd.org/pub/OpenBSD/$(uname -r)/packages/$(arch -s)"
 # PKG_PATH for the corresponding release stable packages service
-PKG_PATH_UPDATE="${PKG_PATH_UPDATE:=https://stable.mtier.org/updates/$(uname -r)/$(arch -s)}"
+PKG_PATH_UPDATE="https://stable.mtier.org/updates/$(uname -r)/$(arch -s)"
 # URL to the latest vuxml (vulnerabilities database)
-VUXML_URL="${VUXML_URL:=https://stable.mtier.org/vuxml/$(uname -r | tr -d '.').xml}"
-##### end of user defined variables
+VUXML_URL="https://stable.mtier.org/vuxml/$(uname -r | tr -d '.').xml"
+########################################################################
+### End of user defined variables                                    ###
+########################################################################
+
 
 _OPENUP_VERSION=10
 _OPENUP_MINREL=53
@@ -58,6 +62,15 @@ if [ "$(id -u)" -ne 0 ]; then
 	usage
 fi
 
+if [ -f /etc/openup.conf ]; then
+	if [ $(stat -f "%SMp%SLp" /etc/openup.conf) != "------" ]; then
+		pr_error "Unsecure permissions on /etc/openup.conf; please run:"
+		pr_error "chmod 0600 /etc/openup.conf"
+		exit 1
+	fi
+	. /etc/openup.conf
+fi
+
 # regex taken from fw_update(1)
 set -A _REL -- $(sysctl -n kern.version | sed 's/^OpenBSD \([0-9]\.[0-9]\)\([^ ]*\).*/\1 \2/;q')
 _REL_INT="$(echo ${_REL[0]} | tr -d '.')"